Fast and extensible multi-platform HTTP/1-2-3 web server with automatic HTTPS
Mirrored from https://github.com/Slazee/caddy.git
Synced Nov 14, 05:15 UTC
tls: Use IANA-standard cipher suite names
Matthew Holt committed
Jul 18, 2019 at 09:52 UTC
28df6cedfe8d347bd87931960c01e6606c14851e
3 files changed
+34
-27
modules.go
+1
-1
@@ -86,7 +86,7 @@ func GetModules(scope string) []Module {
86
87
// handle the special case of an empty scope, which
88
// should match only the top-level modules
89
- if len(scopeParts) == 1 && scopeParts[0] == "" {
89
+ if scope == "" {
90
scopeParts = []string{}
91
}
92
modules/caddytls/acmemanager.go
-9
@@ -202,14 +202,5 @@ func onDemandAskRequest(ask string, name string) error {
202
return nil
203
}
204
205
-// supportedCertKeyTypes is all the key types that are supported
206
-// for certificates that are obtained through ACME.
207
-var supportedCertKeyTypes = map[string]certcrypto.KeyType{
208
- "RSA2048": certcrypto.RSA2048,
209
- "RSA4096": certcrypto.RSA4096,
210
- "P256": certcrypto.EC256,
211
- "P384": certcrypto.EC384,
212
-}
213
-
205
// Interface guard
206
var _ managerMaker = (*ACMEManagerMaker)(nil)
modules/caddytls/values.go
+33
-17
@@ -18,28 +18,35 @@ import (
18
"crypto/tls"
19
"crypto/x509"
20
21
+ "github.com/go-acme/lego/certcrypto"
22
"github.com/klauspost/cpuid"
23
)
24
25
// supportedCipherSuites is the unordered map of cipher suite
25
-// string names to their definition in crypto/tls.
26
-// TODO: might not be needed much longer, see:
27
-// https://github.com/golang/go/issues/30325
26
+// string names to their definition in crypto/tls. All values
27
+// should be IANA-reserved names. See
28
+// https://www.iana.org/assignments/tls-parameters/tls-parameters.xhtml
29
+// TODO: might not be needed much longer: https://github.com/golang/go/issues/30325
30
var supportedCipherSuites = map[string]uint16{
29
- "ECDHE_ECDSA_AES256_GCM_SHA384": tls.TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,
30
- "ECDHE_RSA_AES256_GCM_SHA384": tls.TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,
31
- "ECDHE_ECDSA_AES128_GCM_SHA256": tls.TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,
32
- "ECDHE_RSA_AES128_GCM_SHA256": tls.TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,
33
- "ECDHE_ECDSA_WITH_CHACHA20_POLY1305": tls.TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,
34
- "ECDHE_RSA_WITH_CHACHA20_POLY1305": tls.TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305,
35
- "ECDHE_RSA_AES256_CBC_SHA": tls.TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA,
36
- "ECDHE_RSA_AES128_CBC_SHA": tls.TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA,
37
- "ECDHE_ECDSA_AES256_CBC_SHA": tls.TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA,
38
- "ECDHE_ECDSA_AES128_CBC_SHA": tls.TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA,
39
- "RSA_AES256_CBC_SHA": tls.TLS_RSA_WITH_AES_256_CBC_SHA,
40
- "RSA_AES128_CBC_SHA": tls.TLS_RSA_WITH_AES_128_CBC_SHA,
41
- "ECDHE_RSA_3DES_EDE_CBC_SHA": tls.TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA,
42
- "RSA_3DES_EDE_CBC_SHA": tls.TLS_RSA_WITH_3DES_EDE_CBC_SHA,
31
+ "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384": tls.TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,
32
+ "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384": tls.TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,
33
+ "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256": tls.TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,
34
+ "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256": tls.TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,
35
+ "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256": tls.TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,
36
+ "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256": tls.TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305,
37
+ "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA": tls.TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA,
38
+ "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256": tls.TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256,
39
+ "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA": tls.TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA,
40
+ "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA": tls.TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA,
41
+ "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256": tls.TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256,
42
+ "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA": tls.TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA,
43
+ "TLS_RSA_WITH_AES_128_GCM_SHA256": tls.TLS_RSA_WITH_AES_128_GCM_SHA256,
44
+ "TLS_RSA_WITH_AES_256_GCM_SHA384": tls.TLS_RSA_WITH_AES_256_GCM_SHA384,
45
+ "TLS_RSA_WITH_AES_256_CBC_SHA": tls.TLS_RSA_WITH_AES_256_CBC_SHA,
46
+ "TLS_RSA_WITH_AES_128_CBC_SHA256": tls.TLS_RSA_WITH_AES_128_CBC_SHA256,
47
+ "TLS_RSA_WITH_AES_128_CBC_SHA": tls.TLS_RSA_WITH_AES_128_CBC_SHA,
48
+ "TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA": tls.TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA,
49
+ "TLS_RSA_WITH_3DES_EDE_CBC_SHA": tls.TLS_RSA_WITH_3DES_EDE_CBC_SHA,
50
}
51
52
// defaultCipherSuites is the ordered list of all the cipher
@@ -86,6 +93,15 @@ var supportedCurves = map[string]tls.CurveID{
93
"P521": tls.CurveP521,
94
}
95
96
+// supportedCertKeyTypes is all the key types that are supported
97
+// for certificates that are obtained through ACME.
98
+var supportedCertKeyTypes = map[string]certcrypto.KeyType{
99
+ "RSA2048": certcrypto.RSA2048,
100
+ "RSA4096": certcrypto.RSA4096,
101
+ "P256": certcrypto.EC256,
102
+ "P384": certcrypto.EC384,
103
+}
104
+
105
// defaultCurves is the list of only the curves we want to use
106
// by default, in descending order of preference.
107
//