Skip to content

Commit

Permalink
fix
Browse files Browse the repository at this point in the history
  • Loading branch information
@kevindiu @actions-user
kevindiu authored and actions-user committed Jul 8, 2020
1 parent 360bb7c commit db434cb
Show file tree
Hide file tree
Showing 2 changed files with 47 additions and 93 deletions.
48 changes: 45 additions & 3 deletions internal/tls/option.go
View file
Original file line number Diff line number Diff line change
Expand Up @@ -21,9 +21,51 @@ import "crypto/tls"

type Option func(*credentials) error

var (
defaultOpts = []Option{}
)
func defaultOptions() []Option {
return []Option{
WithTLSConfig(&tls.Config{
MinVersion: tls.VersionTLS12,
NextProtos: []string{
"http/1.1",
"h2",
},
CurvePreferences: []tls.CurveID{
tls.CurveP521,
tls.CurveP384,
tls.CurveP256,
tls.X25519,
},
SessionTicketsDisabled: true,
// PreferServerCipherSuites: true,
// CipherSuites: []uint16{
// tls.TLS_RSA_WITH_RC4_128_SHA,
// tls.TLS_RSA_WITH_AES_128_CBC_SHA,
// tls.TLS_RSA_WITH_AES_256_CBC_SHA,
// tls.TLS_RSA_WITH_AES_128_CBC_SHA256,
// tls.TLS_RSA_WITH_AES_128_GCM_SHA256,
// tls.TLS_RSA_WITH_AES_256_GCM_SHA384,
// tls.TLS_ECDHE_ECDSA_WITH_RC4_128_SHA,
// tls.TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA,
// tls.TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA,
// tls.TLS_ECDHE_RSA_WITH_RC4_128_SHA,
// tls.TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA,
// tls.TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256,
// tls.TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA,
// tls.TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256,
// tls.TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256,
// tls.TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,
// tls.TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,
// tls.TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,
// tls.TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384, // Maybe this is work on TLS 1.2
// tls.TLS_RSA_WITH_3DES_EDE_CBC_SHA, // TLS1.3 Feature
// tls.TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA, // TLS1.3 Feature
// tls.TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305, // Go 1.8 only
// tls.TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305, // Go 1.8 only
// },
ClientAuth: tls.NoClientCert,
}),
}
}

func WithCert(cert string) Option {
return func(c *credentials) error {
Expand Down
92 changes: 2 additions & 90 deletions internal/tls/tls.go
View file
Original file line number Diff line number Diff line change
Expand Up @@ -43,7 +43,7 @@ func New(opts ...Option) (*Config, error) {
var err error
c := new(credentials)

for _, opt := range append(defaultOpts, opts...) {
for _, opt := range append(defaultOptions(), opts...) {
if err := opt(c); err != nil {
return nil, errors.ErrOptionFailed(err, reflect.ValueOf(opt))
}
Expand All @@ -53,50 +53,6 @@ func New(opts ...Option) (*Config, error) {
return nil, errors.ErrTLSCertOrKeyNotFound
}

if c.cfg == nil {
c.cfg = &tls.Config{
MinVersion: tls.VersionTLS12,
NextProtos: []string{
"http/1.1",
"h2",
},
CurvePreferences: []tls.CurveID{
tls.CurveP521,
tls.CurveP384,
tls.CurveP256,
tls.X25519,
},
SessionTicketsDisabled: true,
// PreferServerCipherSuites: true,
// CipherSuites: []uint16{
// tls.TLS_RSA_WITH_RC4_128_SHA,
// tls.TLS_RSA_WITH_AES_128_CBC_SHA,
// tls.TLS_RSA_WITH_AES_256_CBC_SHA,
// tls.TLS_RSA_WITH_AES_128_CBC_SHA256,
// tls.TLS_RSA_WITH_AES_128_GCM_SHA256,
// tls.TLS_RSA_WITH_AES_256_GCM_SHA384,
// tls.TLS_ECDHE_ECDSA_WITH_RC4_128_SHA,
// tls.TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA,
// tls.TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA,
// tls.TLS_ECDHE_RSA_WITH_RC4_128_SHA,
// tls.TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA,
// tls.TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256,
// tls.TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA,
// tls.TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256,
// tls.TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256,
// tls.TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,
// tls.TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,
// tls.TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,
// tls.TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384, // Maybe this is work on TLS 1.2
// tls.TLS_RSA_WITH_3DES_EDE_CBC_SHA, // TLS1.3 Feature
// tls.TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA, // TLS1.3 Feature
// tls.TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305, // Go 1.8 only
// tls.TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305, // Go 1.8 only
// },
ClientAuth: tls.NoClientCert,
}
}

c.cfg.Certificates = make([]tls.Certificate, 1)
c.cfg.Certificates[0], err = tls.LoadX509KeyPair(c.cert, c.key)
if err != nil {
Expand All @@ -119,56 +75,12 @@ func NewClientConfig(opts ...Option) (*Config, error) {
var err error
c := new(credentials)

for _, opt := range append(defaultOpts, opts...) {
for _, opt := range append(defaultOptions(), opts...) {
if err := opt(c); err != nil {
return nil, errors.ErrOptionFailed(err, reflect.ValueOf(opt))
}
}

if c.cfg == nil {
c.cfg = &tls.Config{
MinVersion: tls.VersionTLS12,
NextProtos: []string{
"http/1.1",
"h2",
},
CurvePreferences: []tls.CurveID{
tls.CurveP521,
tls.CurveP384,
tls.CurveP256,
tls.X25519,
},
SessionTicketsDisabled: true,
// PreferServerCipherSuites: true,
// CipherSuites: []uint16{
// tls.TLS_RSA_WITH_RC4_128_SHA,
// tls.TLS_RSA_WITH_AES_128_CBC_SHA,
// tls.TLS_RSA_WITH_AES_256_CBC_SHA,
// tls.TLS_RSA_WITH_AES_128_CBC_SHA256,
// tls.TLS_RSA_WITH_AES_128_GCM_SHA256,
// tls.TLS_RSA_WITH_AES_256_GCM_SHA384,
// tls.TLS_ECDHE_ECDSA_WITH_RC4_128_SHA,
// tls.TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA,
// tls.TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA,
// tls.TLS_ECDHE_RSA_WITH_RC4_128_SHA,
// tls.TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA,
// tls.TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256,
// tls.TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA,
// tls.TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256,
// tls.TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256,
// tls.TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,
// tls.TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,
// tls.TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,
// tls.TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384, // Maybe this is work on TLS 1.2
// tls.TLS_RSA_WITH_3DES_EDE_CBC_SHA, // TLS1.3 Feature
// tls.TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA, // TLS1.3 Feature
// tls.TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305, // Go 1.8 only
// tls.TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305, // Go 1.8 only
// },
ClientAuth: tls.NoClientCert,
}
}

if c.ca != "" {
pool, err := NewX509CertPool(c.ca)
if err != nil {
Expand Down

0 comments on commit db434cb

Please sign in to comment.