[crypto] Make maximum TLS version a configurable option

The minimum supported TLS version is already configurable via
TLS_VERSION_MIN in config/crypto.h, but changing the maximum TLS
version currently requires editing the source code proper.  This makes
it cumbersome to test older TLS versions, and therefore increases the
chances that support for older versions will end up breaking as new
features are added.

Move TLS_VERSION_MAX from include/ipxe/tls.h to config/crypto.h to
ease the process of testing older TLS versions.

Signed-off-by: Michael Brown <mcb30@ipxe.org>

diff --git a/src/config/crypto.h b/src/config/crypto.h
index 333f59b87a5ca318197a8644f426b2876bc27210..bf382df886a6f7b0f59939bce1ac803183866e28 100644 (file)
--- a/src/config/crypto.h
+++ b/src/config/crypto.h
@@ -13,6 +13,9 @@ FILE_SECBOOT ( PERMITTED );
 /** Minimum TLS version */
 #define TLS_VERSION_MIN TLS_VERSION_TLS_1_1
 
+/** Maximum TLS version */
+#define TLS_VERSION_MAX TLS_VERSION_TLS_1_2
+
 /** Public-key exchange algorithm */
 #define CRYPTO_EXCHANGE_PUBKEY
 

diff --git a/src/include/ipxe/tls.h b/src/include/ipxe/tls.h
index 210444a38c89e330eb8b0af498a5fec5b038b5ce..e21ba411508b7e6fd508397b65fef952c5723061 100644 (file)
--- a/src/include/ipxe/tls.h
+++ b/src/include/ipxe/tls.h
@@ -48,9 +48,6 @@ struct tls_header {
 /** TLS version 1.2 */
 #define TLS_VERSION_TLS_1_2 0x0303
 
-/** Maximum supported TLS version */
-#define TLS_VERSION_MAX TLS_VERSION_TLS_1_2
-
 /** Change cipher content type */
 #define TLS_TYPE_CHANGE_CIPHER 20