You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Copy file name to clipboardExpand all lines: go/src/docs/security/MissingMinVersionTLS/MissingMinVersionTLS.md
+21-3Lines changed: 21 additions & 3 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -1,9 +1,20 @@
1
1
# Missing MinVersion in tls.Config
2
-
Golang's `tls.Config` struct accepts `MinVersion` parameter that sets minimum accepted TLS version. If the parameter is not provided, default value is used: TLS1.2 for clients, and TLS1.0 for servers. TLS1.0 is considered deprecated and should not be used.
2
+
Golang's `tls.Config` struct accepts `MinVersion` parameter that sets minimum accepted TLS version. If the parameter is not provided, the default depends on the Go version in use:
3
3
4
+
- Since **Go 1.18**, clients default to TLS 1.2 (previously TLS 1.0)
5
+
- Since **Go 1.22**, servers also default to TLS 1.2 (previously TLS 1.0)
6
+
7
+
For projects that support older Go versions, leaving `MinVersion` unset may still permit TLS 1.0 or 1.1, which are deprecated and should not be used.
8
+
9
+
This query flags `tls.Config` values where `MinVersion` is never set explicitly and the project's `go.mod` declares support for:
10
+
-**Go < 1.18** for client-side configs (when client default is TLS 1.0)
11
+
-**Go < 1.22** for server-side configs (when server default is TLS 1.0)
4
12
5
13
## Recommendation
6
-
Explicitly set tls version to an up-to-date one.
14
+
Explicitly set the TLS version to TLS 1.2 or higher:
15
+
- For projects using Go < 1.18: Set `MinVersion` for both clients and servers
16
+
- For projects using Go 1.18-1.21: Set `MinVersion` for servers
17
+
- For projects using Go >= 1.22: Defaults are secure, but explicit setting is still recommended
7
18
8
19
9
20
## Example
@@ -50,8 +61,15 @@ func main() {
50
61
}
51
62
52
63
```
53
-
In this example, the `http.Server` may be set with TLS configuration created by either `test1` or `test2` functions. The `test1` result will be highlighted by this query, as it fails to explicitly set minimum supported TLS version. The `test2` result will not be marked, even that it also uses the default value for minimum version. That is because the `test2` is explicit, and this query assumes that developers knew what they are doing.
64
+
In this example, the `http.Server` may be set with TLS configuration created by either `test1` or `test2` functions. For projects with `go` directive < 1.22, the `test1` result will be highlighted by this query, as it fails to explicitly set minimum supported TLS version. The `test2` result will not be marked, even though it also uses the default value for minimum version. That is because the `test2` is explicit, and this query assumes that developers knew what they are doing.
65
+
66
+
Note: The query behavior depends on the `go` directive in `go.mod`:
67
+
-**Go < 1.18**: Both client and server configs without MinVersion are flagged
68
+
-**Go 1.18-1.21**: Only server configs without MinVersion are flagged
69
+
-**Go >= 1.22**: No configs are flagged (both defaults are secure)
If the parameter is not provided, default value is used: TLS1.2 for clients, and TLS1.0 for servers.
9
-
TLS1.0 is considered deprecated and should not be used.
7
+
Golang's <code>tls.Config</code> struct accepts a <code>MinVersion</code> parameter that sets the minimum accepted TLS version.
8
+
If the parameter is not provided, the default depends on the Go version in use. Since Go 1.18, <code>crypto/tls</code> clients default to TLS 1.2 (previously TLS 1.0).
9
+
Since Go 1.22, <code>crypto/tls</code> servers also default to TLS 1.2 (previously TLS 1.0).
10
+
</p>
11
+
<p>
12
+
This query flags <code>tls.Config</code> values where <code>MinVersion</code> is never set explicitly and the project's
13
+
<code>go.mod</code> declares support for a Go version where the defaults are insecure:
14
+
</p>
15
+
<ul>
16
+
<li>Go < 1.18 for client-side configs (when client default is TLS 1.0)</li>
17
+
<li>Go < 1.22 for server-side configs (when server default is TLS 1.0)</li>
18
+
</ul>
19
+
<p>
20
+
TLS 1.0 and 1.1 are deprecated and should not be used.
10
21
</p>
11
22
12
23
</overview>
13
24
<recommendation>
14
-
<p>Explicitly set tls version to an up-to-date one.</p>
25
+
<p>Explicitly set the TLS version to TLS 1.2 or higher:</p>
26
+
<ul>
27
+
<li>For projects using Go < 1.18: Set <code>MinVersion</code> for both clients and servers</li>
28
+
<li>For projects using Go 1.18-1.21: Set <code>MinVersion</code> for servers</li>
29
+
<li>For projects using Go >= 1.22: Defaults are secure, but explicit setting is still recommended</li>
30
+
</ul>
15
31
16
32
</recommendation>
17
33
<example>
18
34
<samplesrc="MissingMinVersionTLS.go" />
19
35
20
36
<p>In this example, the <code>http.Server</code> may be set with TLS configuration created by either <code>test1</code> or <code>test2</code> functions.
21
-
The <code>test1</code> result will be highlighted by this query, as it fails to explicitly set minimum supported TLS version.
22
-
The <code>test2</code> result will not be marked, even that it also uses the default value for minimum version.
23
-
That is because the <code>test2</code> is explicit, and this query assumes that developers knew what they are doing.
37
+
For projects with a <code>go</code> directive < 1.22, the <code>test1</code> result will be highlighted by this query, as it fails to explicitly set minimum supported TLS version.
38
+
The <code>test2</code> result will not be marked, even though it also uses the default value for minimum version.
39
+
That is because the <code>test2</code> is explicit, and this query assumes that developers knew what they are doing.
24
40
</p>
41
+
<p>Note: The query behavior depends on the <code>go</code> directive in <code>go.mod</code>:</p>
42
+
<ul>
43
+
<li>Go < 1.18: Both client and server configs without MinVersion are flagged</li>
44
+
<li>Go 1.18-1.21: Only server configs without MinVersion are flagged</li>
45
+
<li>Go >= 1.22: No configs are flagged (both defaults are secure)</li>
0 commit comments