Fast and extensible multi-platform HTTP/1-2-3 web server with automatic HTTPS
Mirrored from https://github.com/Slazee/caddy.git
Synced Nov 14, 05:15 UTC
tls: Enable TLS 1.3 by default; set sane defaults on tls.Config structs
Matthew Holt committed
Jul 1, 2019 at 11:47 UTC
533d1afb4b4e61dc34282f5be88014f0952c9a00
2 files changed
+40
modules/caddytls/connpolicy.go
+32
@@ -132,6 +132,10 @@ func (p *ConnectionPolicy) buildStandardTLSConfig(ctx caddy.Context) error {
132
}
133
tlsApp := tlsAppIface.(*TLS)
134
135
+ // fill in some "easy" default values, but for other values
136
+ // (such as slices), we should ensure that they start empty
137
+ // so the user-provided config can fill them in; then we will
138
+ // fill in a default config at the end if they are still unset
139
cfg := &tls.Config{
140
NextProtos: p.ALPN,
141
PreferServerCipherSuites: true,
@@ -210,11 +214,39 @@ func (p *ConnectionPolicy) buildStandardTLSConfig(ctx caddy.Context) error {
214
215
// TODO: client auth, and other fields
216
217
+ setDefaultTLSParams(cfg)
218
+
219
p.stdTLSConfig = cfg
220
221
return nil
222
}
223
224
+// setDefaultTLSParams sets the default TLS cipher suites, protocol versions,
225
+// and server preferences of cfg if they are not already set; it does not
226
+// overwrite values, only fills in missing values.
227
+func setDefaultTLSParams(cfg *tls.Config) {
228
+ if len(cfg.CipherSuites) == 0 {
229
+ cfg.CipherSuites = getOptimalDefaultCipherSuites()
230
+ }
231
+
232
+ // Not a cipher suite, but still important for mitigating protocol downgrade attacks
233
+ // (prepend since having it at end breaks http2 due to non-h2-approved suites before it)
234
+ cfg.CipherSuites = append([]uint16{tls.TLS_FALLBACK_SCSV}, cfg.CipherSuites...)
235
+
236
+ if len(cfg.CurvePreferences) == 0 {
237
+ cfg.CurvePreferences = defaultCurves
238
+ }
239
+
240
+ if cfg.MinVersion == 0 {
241
+ cfg.MinVersion = tls.VersionTLS12
242
+ }
243
+ if cfg.MaxVersion == 0 {
244
+ cfg.MaxVersion = tls.VersionTLS13
245
+ }
246
+
247
+ cfg.PreferServerCipherSuites = true
248
+}
249
+
250
// PublicKeyAlgorithm is a JSON-unmarshalable wrapper type.
251
type PublicKeyAlgorithm x509.PublicKeyAlgorithm
252
modules/caddytls/tls.go
+8
@@ -18,7 +18,9 @@ import (
18
"crypto/tls"
19
"encoding/json"
20
"fmt"
21
+ "log"
22
"net/http"
23
+ "os"
24
"time"
25
26
"github.com/caddyserver/caddy"
@@ -32,6 +34,12 @@ func init() {
34
Name: "tls",
35
New: func() interface{} { return new(TLS) },
36
})
37
+
38
+ // opt-in TLS 1.3 for Go1.12
39
+ // TODO: remove this line when Go1.13 is released.
40
+ if err := os.Setenv("GODEBUG", os.Getenv("GODEBUG")+",tls13=1"); err != nil {
41
+ log.Println("[ERROR] failed to set environment variable: ", err)
42
+ }
43
}
44
45
// TLS represents a process-wide TLS configuration.