@marcel91200 / caddy Mirror · read-only
Fork 0

Fast and extensible multi-platform HTTP/1-2-3 web server with automatic HTTPS

Mirrored from https://github.com/Slazee/caddy.git

Synced Nov 11, 01:00 UTC

Code Commits Issues Pulls Cloud Agent CICD
master
master
go 158 lines 4.82 KB
Raw
1 // Copyright 2015 Matthew Holt and The Caddy Authors
2 //
3 // Licensed under the Apache License, Version 2.0 (the "License");
4 // you may not use this file except in compliance with the License.
5 // You may obtain a copy of the License at
6 //
7 // http://www.apache.org/licenses/LICENSE-2.0
8 //
9 // Unless required by applicable law or agreed to in writing, software
10 // distributed under the License is distributed on an "AS IS" BASIS,
11 // WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
12 // See the License for the specific language governing permissions and
13 // limitations under the License.
14
15 package caddytls
16
17 import (
18 "crypto/tls"
19 "crypto/x509"
20 "fmt"
21
22 "github.com/caddyserver/certmagic"
23 "github.com/klauspost/cpuid/v2"
24 )
25
26 // CipherSuiteNameSupported returns true if name is
27 // a supported cipher suite.
28 func CipherSuiteNameSupported(name string) bool {
29 return CipherSuiteID(name) != 0
30 }
31
32 // CipherSuiteID returns the ID of the cipher suite associated with
33 // the given name, or 0 if the name is not recognized/supported.
34 func CipherSuiteID(name string) uint16 {
35 for _, cs := range SupportedCipherSuites() {
36 if cs.Name == name {
37 return cs.ID
38 }
39 }
40 return 0
41 }
42
43 // SupportedCipherSuites returns a list of all the cipher suites
44 // Caddy supports. The list is NOT ordered by security preference.
45 func SupportedCipherSuites() []*tls.CipherSuite {
46 return tls.CipherSuites()
47 }
48
49 // defaultCipherSuites is the ordered list of all the cipher
50 // suites we want to support by default, assuming AES-NI
51 // (hardware acceleration for AES).
52 var defaultCipherSuitesWithAESNI = []uint16{
53 tls.TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,
54 tls.TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,
55 tls.TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,
56 tls.TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,
57 tls.TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,
58 tls.TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305,
59 }
60
61 // defaultCipherSuites is the ordered list of all the cipher
62 // suites we want to support by default, assuming lack of
63 // AES-NI (NO hardware acceleration for AES).
64 var defaultCipherSuitesWithoutAESNI = []uint16{
65 tls.TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,
66 tls.TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305,
67 tls.TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,
68 tls.TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,
69 tls.TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,
70 tls.TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,
71 }
72
73 // getOptimalDefaultCipherSuites returns an appropriate cipher
74 // suite to use depending on the hardware support for AES.
75 //
76 // See https://github.com/caddyserver/caddy/issues/1674
77 func getOptimalDefaultCipherSuites() []uint16 {
78 if cpuid.CPU.Supports(cpuid.AESNI) {
79 return defaultCipherSuitesWithAESNI
80 }
81 return defaultCipherSuitesWithoutAESNI
82 }
83
84 // SupportedCurves is the unordered map of supported curves
85 // or key exchange mechanisms ("curves" traditionally).
86 // https://golang.org/pkg/crypto/tls/#CurveID
87 var SupportedCurves = map[string]tls.CurveID{
88 "x25519mlkem768": tls.X25519MLKEM768,
89 "x25519": tls.X25519,
90 "secp256r1": tls.CurveP256,
91 "secp384r1": tls.CurveP384,
92 "secp521r1": tls.CurveP521,
93 }
94
95 // supportedCertKeyTypes is all the key types that are supported
96 // for certificates that are obtained through ACME.
97 var supportedCertKeyTypes = map[string]certmagic.KeyType{
98 "rsa2048": certmagic.RSA2048,
99 "rsa4096": certmagic.RSA4096,
100 "p256": certmagic.P256,
101 "p384": certmagic.P384,
102 "ed25519": certmagic.ED25519,
103 }
104
105 // defaultCurves is the list of only the curves or key exchange
106 // mechanisms we want to use by default. The order is irrelevant.
107 //
108 // This list should only include mechanisms which are fast by
109 // design (e.g. X25519) and those for which an optimized assembly
110 // implementation exists (e.g. P256). The latter ones can be
111 // found here:
112 // https://github.com/golang/go/tree/master/src/crypto/elliptic
113 var defaultCurves = []tls.CurveID{
114 tls.X25519MLKEM768,
115 tls.X25519,
116 tls.CurveP256,
117 }
118
119 // SupportedProtocols is a map of supported protocols.
120 var SupportedProtocols = map[string]uint16{
121 "tls1.2": tls.VersionTLS12,
122 "tls1.3": tls.VersionTLS13,
123 }
124
125 // unsupportedProtocols is a map of unsupported protocols.
126 // Used for logging only, not enforcement.
127 var unsupportedProtocols = map[string]uint16{
128 //nolint:staticcheck
129 "ssl3.0": tls.VersionSSL30,
130 "tls1.0": tls.VersionTLS10,
131 "tls1.1": tls.VersionTLS11,
132 }
133
134 // publicKeyAlgorithms is the map of supported public key algorithms.
135 var publicKeyAlgorithms = map[string]x509.PublicKeyAlgorithm{
136 "rsa": x509.RSA,
137 "dsa": x509.DSA,
138 "ecdsa": x509.ECDSA,
139 }
140
141 // ProtocolName returns the standard name for the passed protocol version ID
142 // (e.g. "TLS1.3") or a fallback representation of the ID value if the version
143 // is not supported.
144 func ProtocolName(id uint16) string {
145 for k, v := range SupportedProtocols {
146 if v == id {
147 return k
148 }
149 }
150
151 for k, v := range unsupportedProtocols {
152 if v == id {
153 return k
154 }
155 }
156
157 return fmt.Sprintf("0x%04x", id)
158 }