Mirrors/sftpgo
1
0
Fork 0
mirror of https://github.com/drakkan/sftpgo.git synced 2025-12-07 14:50:55 +03:00
Code Issues Packages Projects Releases Wiki Activity

TLS: allow to configure cipher suites

Browse Source 
Fixes #316
This commit is contained in:
Nicola Murino
2021-02-18 20:17:16 +01:00
parent 552a96533e
commit 5da4f931c5
12 changed files with 162 additions and 19 deletions
Download Patch File Download Diff File Expand all files Collapse all files

18
telemetry/telemetry.go
View File

@@ -52,6 +52,17 @@ type Conf struct {
// "paramchange" request to the running service on Windows.
CertificateFile string `json:"certificate_file" mapstructure:"certificate_file"`
CertificateKeyFile string `json:"certificate_key_file" mapstructure:"certificate_key_file"`
// TLSCipherSuites is a list of supported cipher suites for TLS version 1.2.
// If CipherSuites is nil/empty, a default list of secure cipher suites
// is used, with a preference order based on hardware performance.
// Note that TLS 1.3 ciphersuites are not configurable.
// The supported ciphersuites names are defined here:
//
// https://github.com/golang/go/blob/master/src/crypto/tls/cipher_suites.go#L52
//
// any invalid name will be silently ignored.
// The order matters, the ciphers listed first will be the preferred ones.
TLSCipherSuites []string `json:"tls_cipher_suites" mapstructure:"tls_cipher_suites"`
}
// ShouldBind returns true if there service must be started
@@ -91,9 +102,12 @@ func (c Conf) Initialize(configDir string) error {
return err
}
config := &tls.Config{
GetCertificate: certMgr.GetCertificateFunc(),
MinVersion: tls.VersionTLS12,
GetCertificate: certMgr.GetCertificateFunc(),
MinVersion: tls.VersionTLS12,
CipherSuites: utils.GetTLSCiphersFromNames(c.TLSCipherSuites),
PreferServerCipherSuites: true,
}
logger.Debug(logSender, "", "configured TLS cipher suites: %v", config.CipherSuites)
httpServer.TLSConfig = config
return utils.HTTPListenAndServe(httpServer, c.BindAddress, c.BindPort, true, logSender)
}