feat: add tlsv1.3 to default cipher suites #128
Conversation
| @@ -135,6 +135,17 @@ | |||
|
|
|||
| -define(APPLICATION_DEFAULT_OPTIONS, undefined). | |||
|
|
|||
| %% Enable TLS 1.3 support for erlang 23 and higher. | |||
| %% TLS 1.3 support stabilized during 22, but this implementation does not work in 22.0. | |||
There was a problem hiding this comment.
The release notes say 22, and the latest 22 does work if I change this to 22. But 22.0 and 22.1 did not and I don't want to roll through all the releases to determine a point where it starts working. By having the version list be constrained we avoid the original problem regardless.
| CipherSuites = ssl:filter_cipher_suites(DefaultCipherSuites, [ | ||
| -spec get_suites(TlsVersion :: ssl:protocol_version()) -> ssl:ciphers(). | ||
| get_suites(TlsVersion) -> | ||
| DefaultCipherSuites = ssl:cipher_suites(default, TlsVersion), |
There was a problem hiding this comment.
The cipher_suites function gives you all ciphers supported by the specified version and previous versions. default are the default suites, so some are already disabled for security. Not enough to pass my existing TLS tests.
exclusive gives you the ones exclusive to that version. I considered adding together the ones we had used for 1.2, and the ones that are exclusive to 1.3. That did work, but this seems a little cleaner.
🤖 I have created a release *beep* *boop* --- ## [3.3.0](v3.2.0...v3.3.0) (2024-05-20) ### Features * add tlsv1.3 to default cipher suites ([#128](#128)) ([4074483](4074483)) --- This PR was generated with [Release Please](https://github.com/googleapis/release-please). See [documentation](https://github.com/googleapis/release-please#release-please). Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
Requirements
Related issues
#127
Describe the solution you've provided
SDK client should be able to connect successfully to a server presenting TLSv1.2 and TLSv1.3 cipher suites.
Describe alternatives you've considered
Only support TLSv1.2 specifically.