tls: fix connection issues with some servers

[Red54]

Before:
$ kdig +short +tls dns.google @1.12.12.12
;; WARNING: TLS, handshake failed (A TLS fatal alert has been received.) ;; ERROR: failed to query server 1.12.12.12@853(TCP)

After:
$ kdig +short +tls dns.google @1.12.12.12
8.8.4.4
8.8.8.8

Fixes: bd75c1f (tls: unification of TLS priority settings, 2024-04-26)

[salzmdan]

What about this solution?

                        {
                                // Establish TLS connection.
                                ret = tls_ctx_setup_remote_endpoint(&net->tls, &dot_alpn, 1,
-                                       KNOT_TLS_PRIORITIES, net_get_remote(net));
+                                       KNOT_TLS_PRIORITIES":+VERS-TLS1.2", net_get_remote(net));
                                if (ret != 0) {
                                        net_close(net);
                                        return ret;

I would prefer keeping KNOT_TLS_PRIORITIES there with this possible exception.

[Red54]

My point is that kdig is a debugging tool rather than a system resolver (like systemd-resolved), and allowing only high-security level connections is meaningless for debugging.

[salzmdan]

I understand your point, but kdig isn't intended for TLS debugging. In server we support only TLS 1.3 with limited algorithms (similar to QUIC), so it would be confusing if kdig had inconsistent support.