Skip to content
This repository has been archived by the owner on Sep 30, 2024. It is now read-only.

Drop fixed list of cipher suites. #1295

Merged
merged 1 commit into from
Mar 4, 2021
Merged

Drop fixed list of cipher suites. #1295

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
17 changes: 2 additions & 15 deletions go/ssl/ssl.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -16,19 +16,6 @@ import (
"github.com/openark/orchestrator/go/config"
)

var cipherSuites = []uint16{
tls.TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,
tls.TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,
tls.TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,
tls.TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,
tls.TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA,
tls.TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA,
tls.TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA,
tls.TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA,
tls.TLS_RSA_WITH_AES_128_CBC_SHA,
tls.TLS_RSA_WITH_AES_256_CBC_SHA,
}

// Determine if a string element is in a string array
func HasString(elem string, arr []string) bool {
for _, s := range arr {
Expand All @@ -46,8 +33,8 @@ func NewTLSConfig(caFile string, verifyCert bool) (*tls.Config, error) {

// Set to TLS 1.2 as a minimum. This is overridden for mysql communication
c.MinVersion = tls.VersionTLS12
// Remove insecure ciphers from the list
c.CipherSuites = cipherSuites
// "If CipherSuites is nil, a default list of secure cipher suites is used"
Copy link
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

What is the default list of secure cipher suites?

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

It's roughly https://golang.org/src/crypto/tls/cipher_suites.go?s=1340:1374#L40
(The ordering can vary depending on what hardware features are available)

Copy link
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Thank you

c.CipherSuites = nil
c.PreferServerCipherSuites = true

if verifyCert {
Expand Down