Fast and extensible multi-platform HTTP/1-2-3 web server with automatic HTTPS
Mirrored from https://github.com/Slazee/caddy.git
Synced Nov 14, 05:15 UTC
caddytls: Update cipher suite names and curve names
Now using IANA-compliant names and Go 1.14's CipherSuites() function so we don't have to maintain our own mapping of currently-secure cipher suites.
Matthew Holt committed
Apr 1, 2020 at 14:09 UTC
ce3ca541d83aedac70b6c251c149ed91e1fb843a
4 files changed
+33
-40
caddyconfig/httpcaddyfile/builtins.go
+1
-1
@@ -166,7 +166,7 @@ func parseTLS(h Helper) ([]ConfigValue, error) {
166
167
case "ciphers":
168
for h.NextArg() {
169
- if _, ok := caddytls.SupportedCipherSuites[h.Val()]; !ok {
169
+ if !caddytls.CipherSuiteNameSupported(h.Val()) {
170
return nil, h.Errf("Wrong cipher suite name or cipher suite not supported: '%s'", h.Val())
171
}
172
cp.CipherSuites = append(cp.CipherSuites, h.Val())
modules/caddyhttp/reverseproxy/fastcgi/fastcgi.go
+3
-3
@@ -274,9 +274,9 @@ func (t Transport) buildEnv(r *http.Request) (map[string]string, error) {
274
env["SSL_PROTOCOL"] = v
275
}
276
// and pass the cipher suite in a manner compatible with apache's mod_ssl
277
- for k, v := range caddytls.SupportedCipherSuites {
278
- if v == r.TLS.CipherSuite {
279
- env["SSL_CIPHER"] = k
277
+ for _, cs := range caddytls.SupportedCipherSuites() {
278
+ if cs.ID == r.TLS.CipherSuite {
279
+ env["SSL_CIPHER"] = cs.Name
280
break
281
}
282
}
modules/caddytls/connpolicy.go
+4
-1
@@ -214,7 +214,10 @@ func (p *ConnectionPolicy) buildStandardTLSConfig(ctx caddy.Context) error {
214
// add all the cipher suites in order, without duplicates
215
cipherSuitesAdded := make(map[uint16]struct{})
216
for _, csName := range p.CipherSuites {
217
- csID := SupportedCipherSuites[csName]
217
+ csID := CipherSuiteID(csName)
218
+ if csID == 0 {
219
+ return fmt.Errorf("unsupported cipher suite: %s", csName)
220
+ }
221
if _, ok := cipherSuitesAdded[csID]; !ok {
222
cipherSuitesAdded[csID] = struct{}{}
223
cfg.CipherSuites = append(cfg.CipherSuites, csID)
modules/caddytls/values.go
+25
-35
@@ -23,35 +23,27 @@ import (
23
"github.com/klauspost/cpuid"
24
)
25
26
-// SupportedCipherSuites is the unordered map of cipher suite
27
-// string names to their definition in crypto/tls. All values
28
-// should be IANA-reserved names. See
29
-// https://www.iana.org/assignments/tls-parameters/tls-parameters.xhtml
30
-// Two of the cipher suite constants in the standard lib do not use the
31
-// full IANA name, but we do; see:
32
-// https://github.com/golang/go/issues/32061 and
33
-// https://github.com/golang/go/issues/30325#issuecomment-512862374.
34
-// TODO: might not be needed much longer: https://github.com/golang/go/issues/30325
35
-var SupportedCipherSuites = map[string]uint16{
36
- "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384": tls.TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,
37
- "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384": tls.TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,
38
- "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256": tls.TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,
39
- "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256": tls.TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,
40
- "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256": tls.TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,
41
- "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256": tls.TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305,
42
- "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA": tls.TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA,
43
- "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256": tls.TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256,
44
- "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA": tls.TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA,
45
- "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA": tls.TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA,
46
- "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256": tls.TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256,
47
- "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA": tls.TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA,
48
- "TLS_RSA_WITH_AES_128_GCM_SHA256": tls.TLS_RSA_WITH_AES_128_GCM_SHA256,
49
- "TLS_RSA_WITH_AES_256_GCM_SHA384": tls.TLS_RSA_WITH_AES_256_GCM_SHA384,
50
- "TLS_RSA_WITH_AES_256_CBC_SHA": tls.TLS_RSA_WITH_AES_256_CBC_SHA,
51
- "TLS_RSA_WITH_AES_128_CBC_SHA256": tls.TLS_RSA_WITH_AES_128_CBC_SHA256,
52
- "TLS_RSA_WITH_AES_128_CBC_SHA": tls.TLS_RSA_WITH_AES_128_CBC_SHA,
53
- "TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA": tls.TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA,
54
- "TLS_RSA_WITH_3DES_EDE_CBC_SHA": tls.TLS_RSA_WITH_3DES_EDE_CBC_SHA,
26
+// CipherSuiteNameSupported returns true if name is
27
+// a supported cipher suite.
28
+func CipherSuiteNameSupported(name string) bool {
29
+ return CipherSuiteID(name) != 0
30
+}
31
+
32
+// CipherSuiteID returns the ID of the cipher suite associated with
33
+// the given name, or 0 if the name is not recognized/supported.
34
+func CipherSuiteID(name string) uint16 {
35
+ for _, cs := range SupportedCipherSuites() {
36
+ if cs.Name == name {
37
+ return cs.ID
38
+ }
39
+ }
40
+ return 0
41
+}
42
+
43
+// SupportedCipherSuites returns a list of all the cipher suites
44
+// Caddy supports. The list is NOT ordered by security preference.
45
+func SupportedCipherSuites() []*tls.CipherSuite {
46
+ return tls.CipherSuites()
47
}
48
49
// defaultCipherSuites is the ordered list of all the cipher
@@ -92,12 +84,10 @@ func getOptimalDefaultCipherSuites() []uint16 {
84
// SupportedCurves is the unordered map of supported curves.
85
// https://golang.org/pkg/crypto/tls/#CurveID
86
var SupportedCurves = map[string]tls.CurveID{
95
- // TODO: Use IANA names, probably? see https://www.iana.org/assignments/tls-parameters/tls-parameters.xhtml#tls-parameters-8
96
- // All named crypto/elliptic curves have secpXXXr1 IANA names.
97
- "x25519": tls.X25519, // x25519, 29
98
- "p256": tls.CurveP256, // secp256r1, 23
99
- "p384": tls.CurveP384, // secp384r1, 24
100
- "p521": tls.CurveP521, // secp521r1, 25
87
+ "x25519": tls.X25519,
88
+ "secp256r1": tls.CurveP256,
89
+ "secp384r1": tls.CurveP384,
90
+ "secp521r1": tls.CurveP521,
91
}
92
93
// supportedCertKeyTypes is all the key types that are supported