From 39ef54a54551c685d36da7b87e8e6376db569f7e Mon Sep 17 00:00:00 2001 From: yuhan6665 <1588741+yuhan6665@users.noreply.github.com> Date: Sun, 18 Aug 2024 19:24:16 -0400 Subject: [PATCH] crypto/tls: check and record godebugs more granularly We should call Value as late as possible to allow programs to set GODEBUG with os.Setenv, and IncNonDefault only when (and every time) the GODEBUG has an effect on a connection (that we'd have regularly rejected). Change-Id: If7a1446de407db7ca2d904d41dda13558b684dda Reviewed-on: https://go-review.googlesource.com/c/go/+/544335 LUCI-TryBot-Result: Go LUCI Reviewed-by: Roland Shoemaker Reviewed-by: David Chase Auto-Submit: Filippo Valsorda --- cipher_suites.go | 38 +++++++++++++++++++------------------- 1 file changed, 19 insertions(+), 19 deletions(-) diff --git a/cipher_suites.go b/cipher_suites.go index 1d1670d..c23f8e8 100644 --- a/cipher_suites.go +++ b/cipher_suites.go @@ -321,25 +321,21 @@ var cipherSuitesPreferenceOrderNoAES = []uint16{ TLS_RSA_WITH_RC4_128_SHA, } -// disabledCipherSuites are not used unless explicitly listed in -// Config.CipherSuites. They MUST be at the end of cipherSuitesPreferenceOrder. -var disabledCipherSuites = []uint16{ +// disabledCipherSuites are not used unless explicitly listed in Config.CipherSuites. +var disabledCipherSuites = map[uint16]bool{ // CBC_SHA256 - TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256, TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256, - TLS_RSA_WITH_AES_128_CBC_SHA256, + TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256: true, + TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256: true, + TLS_RSA_WITH_AES_128_CBC_SHA256: true, // RC4 - TLS_ECDHE_ECDSA_WITH_RC4_128_SHA, TLS_ECDHE_RSA_WITH_RC4_128_SHA, - TLS_RSA_WITH_RC4_128_SHA, + TLS_ECDHE_ECDSA_WITH_RC4_128_SHA: true, + TLS_ECDHE_RSA_WITH_RC4_128_SHA: true, + TLS_RSA_WITH_RC4_128_SHA: true, } -var ( - defaultCipherSuitesLen int - defaultCipherSuites []uint16 -) - // rsaKexCiphers contains the ciphers which use RSA based key exchange, -// which we disable by default. +// which we also disable by default unless a GODEBUG is set. var rsaKexCiphers = map[uint16]bool{ TLS_RSA_WITH_RC4_128_SHA: true, TLS_RSA_WITH_3DES_EDE_CBC_SHA: true, @@ -350,17 +346,21 @@ var rsaKexCiphers = map[uint16]bool{ TLS_RSA_WITH_AES_256_GCM_SHA384: true, } -//var rsaKEXgodebug = godebug.New("tlsrsakex") +var defaultCipherSuites []uint16 +var defaultCipherSuitesWithRSAKex []uint16 func init() { - rsaKexEnabled := false // rsaKEXgodebug.Value() == "1" - for _, c := range cipherSuitesPreferenceOrder[:len(cipherSuitesPreferenceOrder)-len(disabledCipherSuites)] { - if !rsaKexEnabled && rsaKexCiphers[c] { + defaultCipherSuites = make([]uint16, 0, len(cipherSuitesPreferenceOrder)) + defaultCipherSuitesWithRSAKex = make([]uint16, 0, len(cipherSuitesPreferenceOrder)) + for _, c := range cipherSuitesPreferenceOrder { + if disabledCipherSuites[c] { continue } - defaultCipherSuites = append(defaultCipherSuites, c) + if !rsaKexCiphers[c] { + defaultCipherSuites = append(defaultCipherSuites, c) + } + defaultCipherSuitesWithRSAKex = append(defaultCipherSuitesWithRSAKex, c) } - defaultCipherSuitesLen = len(defaultCipherSuites) } // defaultCipherSuitesTLS13 is also the preference order, since there are no