From: Michael R Sweet <michael.r.sweet@gmail.com>
Date: Fri, 15 Jun 2018 15:26:16 +0000 (-0400)
Subject: Don't set maximum TLS version unless it is <max. Support TLS 1.3.
X-Git-Tag: v2.3b6~145
X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=9f4c8267f9210e231a0ea61871af999bf42a1d71;p=thirdparty%2Fcups.git

Don't set maximum TLS version unless it is <max. Support TLS 1.3.
---

diff --git a/cups/tls-darwin.c b/cups/tls-darwin.c
index 3e3a95daa8..e8c448081d 100644
--- a/cups/tls-darwin.c
+++ b/cups/tls-darwin.c
@@ -1283,14 +1283,16 @@ _httpTLSStart(http_t *http)		/* I - HTTP connection */
       kTLSProtocol1,
       kTLSProtocol11,
       kTLSProtocol12,
-      kTLSProtocol12, /* TODO: update to 1.3 when 1.3 is supported */
-      kTLSProtocol12  /* TODO: update to 1.3 when 1.3 is supported */
+      kTLSProtocol13
     };
 
-    error = SSLSetProtocolVersionMin(http->tls, protocols[tls_min_version]);
-    DEBUG_printf(("4_httpTLSStart: SSLSetProtocolVersionMin(%d), error=%d", protocols[tls_min_version], (int)error));
+    if (tls_min_version < _HTTP_TLS_MAX)
+    {
+      error = SSLSetProtocolVersionMin(http->tls, protocols[tls_min_version]);
+      DEBUG_printf(("4_httpTLSStart: SSLSetProtocolVersionMin(%d), error=%d", protocols[tls_min_version], (int)error));
+    }
 
-    if (!error)
+    if (!error && tls_max_version < _HTTP_TLS_MAX)
     {
       error = SSLSetProtocolVersionMax(http->tls, protocols[tls_max_version]);
       DEBUG_printf(("4_httpTLSStart: SSLSetProtocolVersionMax(%d), error=%d", protocols[tls_max_version], (int)error));