Skip to content

Make SSL cipher suite configurable #17440

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
merged 8 commits into from
Nov 20, 2021
Merged

Make SSL cipher suite configurable #17440

Show file tree
Hide file tree
Changes from 1 commit
Commits
Show all changes
8 commits
Select commit Hold shift + click to select a range
b7843af
Make SSL cipher suite configurable
zeripath Oct 25, 2021
94500d5
as per review
zeripath Oct 27, 2021
0c547f0
Merge remote-tracking branch 'origin/main' into fix-9691-configure-ss…
zeripath Oct 27, 2021
9369a75
as per review and fix docs
zeripath Oct 27, 2021
7ac1540
use maps which can be easily added to (and potentially inverted)
zeripath Oct 27, 2021
7cb3835
Honour tlsConfig.MinVersion
zeripath Nov 19, 2021
01f13e5
Merge branch 'main' into fix-9691-configure-ssl-cipher-suites
wxiaoguang Nov 20, 2021
8934cd9
Merge branch 'main' into fix-9691-configure-ssl-cipher-suites
techknowlogick Nov 20, 2021
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
Prev Previous commit
Next Next commit
as per review and fix docs 
Signed-off-by: Andrew Thornton <[email protected]>
  • Loading branch information
@zeripath
zeripath committed Oct 27, 2021
commit 9369a752fa4b9942ab032be0a475cca218a3c6e2
2 changes: 1 addition & 1 deletion cmd/web_https.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -22,7 +22,7 @@ func toTLSVersion(version string) uint16 {
return tls.VersionTLS10
case "tlsv1.1":
return tls.VersionTLS11
case "tlsv1.2":
case "tlsv1.2", "": // Set TLSv1.2 as our default
return tls.VersionTLS12
case "tlsv1.3":
return tls.VersionTLS13
Expand Down
2 changes: 1 addition & 1 deletion custom/conf/app.example.ini
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -52,7 +52,7 @@ RUN_MODE = ; prod
;PORT_TO_REDIRECT = 80
;;
;; Minimum and maximum supported TLS versions
;SSL_MIN_VERSION=tls12
;SSL_MIN_VERSION=TLSv1.2
;SSL_MAX_VERSION=
;;
;; SSL Curve Preferences
Expand Down
2 changes: 1 addition & 1 deletion docs/content/doc/advanced/config-cheat-sheet.en-us.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -310,7 +310,7 @@ The following configuration set `Content-Type: application/vnd.android.package-a

- `REDIRECT_OTHER_PORT`: **false**: If true and `PROTOCOL` is https, allows redirecting http requests on `PORT_TO_REDIRECT` to the https port Gitea listens on.
- `PORT_TO_REDIRECT`: **80**: Port for the http redirection service to listen on. Used when `REDIRECT_OTHER_PORT` is true.
- `SSL_MIN_VERSION`: **tls12**: Set the minimum version of ssl support.
- `SSL_MIN_VERSION`: **TLSv1.2**: Set the minimum version of ssl support.
- `SSL_MAX_VERSION`: **\<empty\>**: Set the maximum version of ssl support.
- `SSL_CURVE_PREFERENCES`: **X25519,P256**: Set the prefered curves,
- `SSL_CIPHER_SUITES`: **ecdhe_ecdsa_with_aes_256_gcm_sha384,ecdhe_rsa_with_aes_256_gcm_sha384,ecdhe_ecdsa_with_aes_128_gcm_sha256,ecdhe_rsa_with_aes_128_gcm_sha256,ecdhe_ecdsa_with_chacha20_poly1305,ecdhe_rsa_with_chacha20_poly1305**: Set the preferred cipher suites.
Expand Down
4 changes: 2 additions & 2 deletions modules/setting/setting.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -622,8 +622,8 @@ func NewContext() {
}
LetsEncryptDirectory = sec.Key("LETSENCRYPT_DIRECTORY").MustString("https")
LetsEncryptEmail = sec.Key("LETSENCRYPT_EMAIL").MustString("")
SSLMinimumVersion = sec.Key("SSL_MIN_VERSION").In("tls12", []string{"tls10", "tls11", "tls12", "tls13"})
SSLMaximumVersion = sec.Key("SSL_MAX_VERSION").In("", []string{"tls10", "tls11", "tls12", "tls13"})
SSLMinimumVersion = sec.Key("SSL_MIN_VERSION").MustString("")
SSLMaximumVersion = sec.Key("SSL_MAX_VERSION").MustString("")
SSLCurvePreferences = sec.Key("SSL_CURVE_PREFERENCES").Strings(",")
SSLCipherSuites = sec.Key("SSL_CIPHER_SUITES").Strings(",")
Domain = sec.Key("DOMAIN").MustString("localhost")
Expand Down