From nobody Sun Jan 25 04:16:48 2026 X-Original-To: dev-commits-src-all@mlmmj.nyi.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2610:1c1:1:606c::19:1]) by mlmmj.nyi.freebsd.org (Postfix) with ESMTP id 4dzJJw5j4Wz6QBCx for ; Sun, 25 Jan 2026 04:16:48 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from mxrelay.nyi.freebsd.org (mxrelay.nyi.freebsd.org [IPv6:2610:1c1:1:606c::19:3]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256 client-signature RSA-PSS (4096 bits) client-digest SHA256) (Client CN "mxrelay.nyi.freebsd.org", Issuer "R13" (verified OK)) by mx1.freebsd.org (Postfix) with ESMTPS id 4dzJJw4WvRz45jq for ; Sun, 25 Jan 2026 04:16:48 +0000 (UTC) (envelope-from git@FreeBSD.org) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1769314608; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=fK/UV+8mkLDnhuQBJYhlLCsNl4ptYS9odAIBUpQ+h10=; b=jykzsmsdq786Wdrzu/Dna7btPxypvTgJuOlrY1uGnforg0tUcr9mvqEsGkdXltDwbz+j/G XX79NK6bEtmhybk1IXN/12AI6zYr1X4MLv5ich0wdXNZgLgiA2thDvOD/JbL0exazPMV3j co5sU3+UN9zLDAKAo0J3VLTADLNwE7SSxCU7Ksej9i3+ZeNtIeUajuq5BfAQXfFdsf44qy 0ArZt0QLxbVD56WOvc+/bbzVCmQlAFaU7dVoQxYyDsDR18pwP/doVP/vTTVvvBLX+OBP0d AyCLfSSPg5YOPBz2h2+SaBYi1M0vtc/kUPezRXNRySgakI8H/04NymZIlcOQfg== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1769314608; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=fK/UV+8mkLDnhuQBJYhlLCsNl4ptYS9odAIBUpQ+h10=; b=fpcoZg/pIgVZK1UNQwG1eSvFMr0j3lUy10TMaPI8i2G4GDl6GyCCwfnFz69hkUdXEhFsHH iQdfrI+xIFuNtN+gc8TRSalANWrKWsyCCq3q85dHCYCJ8vbYBLF4qlJPCvf3dcZfHsVbYA FmvkBV6mpcZuDkyeAdH5gELsRFTgzOL/1PQVWZjV4UUmcSJkvV5slJNkwW6X5jmgZ6mR8f ta4ZENBMdoJ3cVEqFR1juMSzGSOa3LqmsoTwzw4/P9eabJQMlIyFQgiSUn51WhLgHsOPw3 Nb9hjooDxzxEsDg/f6RmG6mYioTAcYrRW+XKDgnHPdQCNUjJPVWwiJRPVMjxCw== ARC-Seal: i=1; s=dkim; d=freebsd.org; t=1769314608; a=rsa-sha256; cv=none; b=sg4sSeHMYbPmrK4fB8ZsXICiTnElugO+UJNKmcmaFmAeDaKd9qRQ/J3gWyL2YI2FiLjs4h ORada44uDH92GedDcjmEZjzSemTOvG2+YCrJZwr5TXu8rQUIQUessVJOfeSgwsKbgwzMcW 3nuTJtV2e9osGVceiL2MQAodBK5yqk3oEPUZjQ+nSnkfPVCKN8lHDJYrvhoQd/y8loZ0iq tUCIbq85JJPbdxtZJbdv2q3wTkI2GCUB85MhZ5yk9qPrLDxmKK95cwvrf31QbdfDdDnIWS 6f9XyV9Ybs1NqpTCo92kuYPaWfvAF4HS/e73WJXVKjuSxCWPhmZCelo+0czUMw== ARC-Authentication-Results: i=1; mx1.freebsd.org; none Received: from gitrepo.freebsd.org (gitrepo.freebsd.org [IPv6:2610:1c1:1:6068::e6a:5]) by mxrelay.nyi.freebsd.org (Postfix) with ESMTP id 4dzJJw3vt0z3j7 for ; Sun, 25 Jan 2026 04:16:48 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from git (uid 1279) (envelope-from git@FreeBSD.org) id 37688 by gitrepo.freebsd.org (DragonFly Mail Agent v0.13+ on gitrepo.freebsd.org); Sun, 25 Jan 2026 04:16:48 +0000 To: src-committers@FreeBSD.org, dev-commits-src-all@FreeBSD.org, dev-commits-src-branches@FreeBSD.org From: Eugene Grosbein Subject: git: c41b12651a80 - stable/14 - MFC: libfetch: allow disabling TLS v1.3 when negotiating the connection List-Id: Commit messages for all branches of the src repository List-Archive: https://lists.freebsd.org/archives/dev-commits-src-all List-Help: List-Post: List-Subscribe: List-Unsubscribe: X-BeenThere: dev-commits-src-all@freebsd.org Sender: owner-dev-commits-src-all@FreeBSD.org MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: 8bit X-Git-Committer: eugen X-Git-Repository: src X-Git-Refname: refs/heads/stable/14 X-Git-Reftype: branch X-Git-Commit: c41b12651a80e5c3c227e7428c2804f66ec17f2c Auto-Submitted: auto-generated Date: Sun, 25 Jan 2026 04:16:48 +0000 Message-Id: <69759930.37688.2068fb53@gitrepo.freebsd.org> The branch stable/14 has been updated by eugen: URL: https://cgit.FreeBSD.org/src/commit/?id=c41b12651a80e5c3c227e7428c2804f66ec17f2c commit c41b12651a80e5c3c227e7428c2804f66ec17f2c Author: Eugene Grosbein AuthorDate: 2026-01-22 14:37:54 +0000 Commit: Eugene Grosbein CommitDate: 2026-01-25 04:16:30 +0000 MFC: libfetch: allow disabling TLS v1.3 when negotiating the connection (cherry picked from commit 129aec72250266e60c07ff4643623188f7c27a9d) --- lib/libfetch/common.c | 2 ++ lib/libfetch/fetch.3 | 12 ++++++++---- 2 files changed, 10 insertions(+), 4 deletions(-) diff --git a/lib/libfetch/common.c b/lib/libfetch/common.c index 9721cc557b53..a39bfb33e95c 100644 --- a/lib/libfetch/common.c +++ b/lib/libfetch/common.c @@ -1049,6 +1049,8 @@ fetch_ssl_setup_transport_layer(SSL_CTX *ctx, int verbose) ssl_ctx_options |= SSL_OP_NO_TLSv1_1; if (getenv("SSL_NO_TLS1_2") != NULL) ssl_ctx_options |= SSL_OP_NO_TLSv1_2; + if (getenv("SSL_NO_TLS1_3") != NULL) + ssl_ctx_options |= SSL_OP_NO_TLSv1_3; if (verbose) fetch_info("SSL options: %lx", ssl_ctx_options); SSL_CTX_set_options(ctx, ssl_ctx_options); diff --git a/lib/libfetch/fetch.3 b/lib/libfetch/fetch.3 index 5f7489799cf6..20a22a263b5b 100644 --- a/lib/libfetch/fetch.3 +++ b/lib/libfetch/fetch.3 @@ -24,7 +24,7 @@ .\" OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF .\" SUCH DAMAGE. .\" -.Dd October 7, 2023 +.Dd January 22, 2026 .Dt FETCH 3 .Os .Sh NAME @@ -450,9 +450,11 @@ allows TLSv1 and newer when negotiating the connecting with the remote peer. You can change this behavior by setting the .Ev SSL_NO_TLS1 , -.Ev SSL_NO_TLS1_1 and -.Ev SSL_NO_TLS1_2 -environment variables to disable TLS 1.0, 1.1 and 1.2 respectively. +.Ev SSL_NO_TLS1_1 , +.Ev SSL_NO_TLS1_2 and +.Ev SSL_NO_TLS1_3 +environment variables to disable TLS 1.0, 1.1, 1.2 and 1.3 +respectively. .Sh AUTHENTICATION Apart from setting the appropriate environment variables and specifying the user name and password in the URL or the @@ -676,6 +678,8 @@ Do not allow TLS version 1.0 when negotiating the connection. Do not allow TLS version 1.1 when negotiating the connection. .It Ev SSL_NO_TLS1_2 Do not allow TLS version 1.2 when negotiating the connection. +.It Ev SSL_NO_TLS1_3 +Do not allow TLS version 1.3 when negotiating the connection. .It Ev SSL_NO_VERIFY_HOSTNAME If set, do not verify that the hostname matches the subject of the certificate presented by the server.