Allow to choose TLS ciphersuites#110
Conversation
If server implementation provides only h2 (HTTP2 over TLS), then it might be useful to control which ciphersuites are used to establish secure connection to check the encrypted traffic in Wireshark or similar utilities.
| } | ||
|
|
||
| // Addr returns the string concatinated with hostname and port number. | ||
| // Addr returns the string concatenated with hostname and port number. |
summerwind
left a comment
summerwind
left a comment
There was a problem hiding this comment.
Thanks for the PR! I feel that the ciphers option is useful for testing.
I left the comment related insecure ciphers.
| func CiphersuiteByName(name string) uint16 { | ||
| switch name { | ||
| case "TLS_RSA_WITH_RC4_128_SHA": | ||
| return tls.TLS_RSA_WITH_RC4_128_SHA |
There was a problem hiding this comment.
RC4 and 3DES are not recommended to use now. Do you have any good reason to support them?
There was a problem hiding this comment.
Thank you for review!
For some reason Golang didn't provide literal names for ciphersuites and it wasn't possible to get ciphersuite id by name. So I had to add a such convert function on my own. I've listed all TLS1.0-1.2 ciphersuites here without any security considerations just to keep the function more library-like. TLS 1.3 ciphersuites are not listed there since they are not configurable. That's why I've covered all ciphersuites listed in crtypto/tls module.
But I actually was surprised that master branch of Golang was updated after this PR was created. In upcoming 1.14 release they have added a CipherSuite() function, which provide the missing link between literal names and ids which can be used to get ciphersuite id by literal name (simillary to new cipherSuiteByID() function).
I can adapt PR to changes in upcoming 1.4 Golang release, but then I will need to bump go version in go.mod and the PR will have to be postponed until Golang 1.4 is released (it's in beta now).
Or I can leave the changes as is, then the code will work fine in both Go 1.2 and 1.4. Which variant do you prefer?
There was a problem hiding this comment.
Thank you for describing!
It's OK to use your current code because Go 1.4 has not released yet.
2 participants
If server implementation provides only h2 (HTTP2 over TLS), then it might
be useful to control which ciphersuites are used to establish secure
connection to check the encrypted traffic in Wireshark or similar
utilities.
A new optional command-line option
--ciphers <list>is added in this PR. Just the same like incurl. But unlike in curl, ciphersuite names doesn't mirror openssl ones, since in future Golang releases native golang names will be provided.