From c3294e9f64cf0b28640e8029e8f3e14e4b37435a Mon Sep 17 00:00:00 2001
From: Sadie Powell
Date: Sat, 10 Dec 2022 05:00:35 +0000
Subject: Add a sslprofile option for disabling TLS 1.3 in ssl_openssl.

This mirrors the options (<sslprofile:tlsv{1,11,12}>) for other
TLS versions.
---
 src/modules/extra/m_ssl_openssl.cpp | 6 ++++++
 1 file changed, 6 insertions(+)

(limited to 'src/modules')

diff --git a/src/modules/extra/m_ssl_openssl.cpp b/src/modules/extra/m_ssl_openssl.cpp
index 10fed5f30..0811ac7db 100644
--- a/src/modules/extra/m_ssl_openssl.cpp
+++ b/src/modules/extra/m_ssl_openssl.cpp
@@ -408,6 +408,12 @@ namespace OpenSSL
 				setoptions |= SSL_OP_NO_TLSv1_2;
 #endif
 
+#ifdef SSL_OP_NO_TLSv1_3
+			// Enable TLSv1.3 by default.
+			if (!tag->getBool("tlsv13", true))
+				setoptions |= SSL_OP_NO_TLSv1_3;
+#endif
+
 			if (!setoptions && !clearoptions)
 				return; // Nothing to do
 
-- 
cgit v1.3.1-10-gc9f91