foomo/tlsconfig
1
0
Fork 0
mirror of https://github.com/foomo/tlsconfig.git synced 2025-10-16 12:45:36 +00:00
Code Issues Actions Packages Projects Releases Wiki Activity

feat: add TLSModeServerStrict and add X25519 curve to default prefs

Browse Source
This commit is contained in:
Philipp Mieden 2024-03-28 18:07:28 +01:00
parent e080db8b80
commit 00773525b0
1 changed files with 19 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

21
tlsconfig.go
View File

@ -7,15 +7,20 @@ import "crypto/tls"
type TLSModeServer string type TLSModeServer string
const ( const (
// TLSModeServerStrict - this is serious and we do not mind loosing clients // TLSModeServerVeryStrict enforces the latest tls standard, and should be used for service to service communication.
TLSModeServerVeryStrict TLSModeServer = "very-strict"
// TLSModeServerStrict - we do not mind loosing clients due to lacking support for modern tls versions
// (= Mozilla "modern" compatibility). Compatible clients have versions // (= Mozilla "modern" compatibility). Compatible clients have versions
// equal or greater than Firefox 27, Chrome 22, IE 11, Opera 14, Safari 7, // equal or greater than Firefox 27, Chrome 22, IE 11, Opera 14, Safari 7,
// Android 4.4, Java 8 // Android 4.4, Java 8
TLSModeServerStrict TLSModeServer = "strict" TLSModeServerStrict = "strict"
// TLSModeServerLoose - ecommerce compromise // TLSModeServerLoose - ecommerce compromise
// Compatible clients (>=): Firefox 1, Chrome 1, IE 7, Opera 5, Safari 1, // Compatible clients (>=): Firefox 1, Chrome 1, IE 7, Opera 5, Safari 1,
// Windows XP IE8, Android 2.3, Java 7 // Windows XP IE8, Android 2.3, Java 7
TLSModeServerLoose = "loose" TLSModeServerLoose = "loose"
// TLSModeServerDefault - standard crypto/tls.Config untouched // TLSModeServerDefault - standard crypto/tls.Config untouched
// highly compatible and insecure // highly compatible and insecure
TLSModeServerDefault = "default" TLSModeServerDefault = "default"
@ -49,6 +54,7 @@ func NewServerTLSConfig(mode TLSModeServer) *tls.Config {
tls.CurveP256, tls.CurveP256,
tls.CurveP384, tls.CurveP384,
tls.CurveP521, tls.CurveP521,
tls.X25519,
} }
case TLSModeServerStrict: case TLSModeServerStrict:
c.MinVersion = tls.VersionTLS12 c.MinVersion = tls.VersionTLS12
@ -64,6 +70,17 @@ func NewServerTLSConfig(mode TLSModeServer) *tls.Config {
tls.CurveP256, tls.CurveP256,
tls.CurveP384, tls.CurveP384,
tls.CurveP521, tls.CurveP521,
tls.X25519,
}
case TLSModeServerVeryStrict:
c.MinVersion = tls.VersionTLS13
// CipherSuites is a list of enabled TLS 1.0–1.2 cipher suites. The order of
// the list is ignored. Note that TLS 1.3 ciphersuites are not configurable.
c.CipherSuites = []uint16{}
c.CurvePreferences = []tls.CurveID{
tls.CurveP384,
tls.CurveP521,
tls.X25519,
} }
} }
return c return c