diff options
Diffstat (limited to 'modules/caddytls/connpolicy.go')
| -rw-r--r-- | modules/caddytls/connpolicy.go | 32 |
1 files changed, 32 insertions, 0 deletions
diff --git a/modules/caddytls/connpolicy.go b/modules/caddytls/connpolicy.go index 89c91ad..ab0fbca 100644 --- a/modules/caddytls/connpolicy.go +++ b/modules/caddytls/connpolicy.go @@ -132,6 +132,10 @@ func (p *ConnectionPolicy) buildStandardTLSConfig(ctx caddy.Context) error { } tlsApp := tlsAppIface.(*TLS) + // fill in some "easy" default values, but for other values + // (such as slices), we should ensure that they start empty + // so the user-provided config can fill them in; then we will + // fill in a default config at the end if they are still unset cfg := &tls.Config{ NextProtos: p.ALPN, PreferServerCipherSuites: true, @@ -210,11 +214,39 @@ func (p *ConnectionPolicy) buildStandardTLSConfig(ctx caddy.Context) error { // TODO: client auth, and other fields + setDefaultTLSParams(cfg) + p.stdTLSConfig = cfg return nil } +// setDefaultTLSParams sets the default TLS cipher suites, protocol versions, +// and server preferences of cfg if they are not already set; it does not +// overwrite values, only fills in missing values. +func setDefaultTLSParams(cfg *tls.Config) { + if len(cfg.CipherSuites) == 0 { + cfg.CipherSuites = getOptimalDefaultCipherSuites() + } + + // Not a cipher suite, but still important for mitigating protocol downgrade attacks + // (prepend since having it at end breaks http2 due to non-h2-approved suites before it) + cfg.CipherSuites = append([]uint16{tls.TLS_FALLBACK_SCSV}, cfg.CipherSuites...) + + if len(cfg.CurvePreferences) == 0 { + cfg.CurvePreferences = defaultCurves + } + + if cfg.MinVersion == 0 { + cfg.MinVersion = tls.VersionTLS12 + } + if cfg.MaxVersion == 0 { + cfg.MaxVersion = tls.VersionTLS13 + } + + cfg.PreferServerCipherSuites = true +} + // PublicKeyAlgorithm is a JSON-unmarshalable wrapper type. type PublicKeyAlgorithm x509.PublicKeyAlgorithm |