diff options
| author | Emīls <emils@mullvad.net> | 2021-02-17 14:45:41 +0000 |
|---|---|---|
| committer | Emīls <emils@mullvad.net> | 2021-02-17 14:45:41 +0000 |
| commit | f71be4deb373eb29427a19478bf708a1a7eb5753 (patch) | |
| tree | 4b01e06bff4fdedd0587ab997ed15505388105e8 | |
| parent | e0eb44ae9d5e518de7fec1b38c9bec2ea789dc81 (diff) | |
| download | mullvadvpn-f71be4deb373eb29427a19478bf708a1a7eb5753.tar.xz mullvadvpn-f71be4deb373eb29427a19478bf708a1a7eb5753.zip | |
Use only TLS 1.3 when connecting to the API
| -rw-r--r-- | CHANGELOG.md | 1 | ||||
| -rw-r--r-- | mullvad-rpc/src/https_client_with_sni.rs | 3 |
2 files changed, 3 insertions, 1 deletions
diff --git a/CHANGELOG.md b/CHANGELOG.md index c89daa4b0e..e0714f35fe 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -37,6 +37,7 @@ Line wrap the file at 100 chars. Th security patches. - Allow provider constraint to specify multiple hosting providers. - Only download a new relay list if it has been modified. +- Connect to the API only via TLS 1.3 #### Android - WireGuard key is now rotated sooner: every four days instead of seven. diff --git a/mullvad-rpc/src/https_client_with_sni.rs b/mullvad-rpc/src/https_client_with_sni.rs index b80b2db95b..c8ac8e833d 100644 --- a/mullvad-rpc/src/https_client_with_sni.rs +++ b/mullvad-rpc/src/https_client_with_sni.rs @@ -25,7 +25,7 @@ use std::{ }; use tokio::{net::TcpStream as TokioTcpStream, runtime::Handle, time::timeout}; -use tokio_rustls::rustls; +use tokio_rustls::rustls::{self, ProtocolVersion}; use webpki::DNSNameRef; // Old LetsEncrypt root certificate @@ -65,6 +65,7 @@ impl HttpsConnectorWithSni { let mut config = rustls::ClientConfig::new(); config.enable_sni = true; config.root_store = Self::read_cert_store(); + config.versions = vec![ProtocolVersion::TLSv1_3]; HttpsConnectorWithSni { next_socket_id: 0, |