mirror of
https://github.com/foomo/tlsconfig.git
synced 2025-10-16 12:45:36 +00:00
88 lines
2.8 KiB
Go
88 lines
2.8 KiB
Go
// Package tlsconfig is a lightweight tls configuration package.
|
||
package tlsconfig
|
||
|
||
import "crypto/tls"
|
||
|
||
// TLSModeServer a type to define server tls config
|
||
type TLSModeServer string
|
||
|
||
const (
|
||
// TLSModeServerVeryStrict enforces the latest tls standard, and should be used for service to service communication.
|
||
TLSModeServerVeryStrict TLSModeServer = "very-strict"
|
||
|
||
// TLSModeServerStrict - we do not mind loosing clients due to lacking support for modern tls versions
|
||
// (= Mozilla "modern" compatibility). Compatible clients have versions
|
||
// equal or greater than Firefox 27, Chrome 22, IE 11, Opera 14, Safari 7,
|
||
// Android 4.4, Java 8
|
||
TLSModeServerStrict = "strict"
|
||
|
||
// TLSModeServerLoose - ecommerce compromise
|
||
// Compatible clients (>=): Firefox 1, Chrome 1, IE 7, Opera 5, Safari 1,
|
||
// Windows XP IE8, Android 2.3, Java 7
|
||
TLSModeServerLoose = "loose"
|
||
|
||
// TLSModeServerDefault - standard crypto/tls.Config untouched
|
||
// highly compatible and insecure
|
||
TLSModeServerDefault = "default"
|
||
)
|
||
|
||
// NewServerTLSConfig - server tls config
|
||
func NewServerTLSConfig(mode TLSModeServer) *tls.Config {
|
||
c := &tls.Config{}
|
||
switch mode {
|
||
case TLSModeServerDefault:
|
||
// will not touch this one, but trust the golang team
|
||
case TLSModeServerLoose:
|
||
c.MinVersion = tls.VersionTLS10
|
||
c.CipherSuites = []uint16{
|
||
tls.TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,
|
||
tls.TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,
|
||
tls.TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,
|
||
tls.TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,
|
||
tls.TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256,
|
||
tls.TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256,
|
||
tls.TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA,
|
||
tls.TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA,
|
||
tls.TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA,
|
||
tls.TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA,
|
||
tls.TLS_RSA_WITH_AES_128_GCM_SHA256,
|
||
tls.TLS_RSA_WITH_AES_256_GCM_SHA384,
|
||
tls.TLS_RSA_WITH_AES_128_CBC_SHA,
|
||
tls.TLS_RSA_WITH_AES_256_CBC_SHA,
|
||
}
|
||
c.CurvePreferences = []tls.CurveID{
|
||
tls.CurveP256,
|
||
tls.CurveP384,
|
||
tls.CurveP521,
|
||
tls.X25519,
|
||
}
|
||
case TLSModeServerStrict:
|
||
c.MinVersion = tls.VersionTLS12
|
||
c.CipherSuites = []uint16{
|
||
tls.TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,
|
||
tls.TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,
|
||
tls.TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,
|
||
tls.TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,
|
||
tls.TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256,
|
||
tls.TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256,
|
||
}
|
||
c.CurvePreferences = []tls.CurveID{
|
||
tls.CurveP256,
|
||
tls.CurveP384,
|
||
tls.CurveP521,
|
||
tls.X25519,
|
||
}
|
||
case TLSModeServerVeryStrict:
|
||
c.MinVersion = tls.VersionTLS13
|
||
// CipherSuites is a list of enabled TLS 1.0–1.2 cipher suites. The order of
|
||
// the list is ignored. Note that TLS 1.3 ciphersuites are not configurable.
|
||
c.CipherSuites = []uint16{}
|
||
c.CurvePreferences = []tls.CurveID{
|
||
tls.CurveP384,
|
||
tls.CurveP521,
|
||
tls.X25519,
|
||
}
|
||
}
|
||
return c
|
||
}
|