Max/XTLS_REALITY
1
0
Fork 0
mirror of https://github.com/XTLS/REALITY.git synced 2026-10-12 17:28:23 +03:00
Code Issues Packages Projects Releases Wiki Activity

crypto/tls: let Config.CurvePreferences override GODEBUG options

Browse Source 
tlsmlkem=0 and tlssecpmlkem=0 were never meant to forcibly disable PQ
KEMs, they were only meant to restore the Go 1.24 and Go 1.26 defaults
when Config.CurvePreferences is nil.

I noticed this while struggling to add a non-default key exchange.

While at it, make our behavior on unimplemented Config.CurvePreferences
entries more consistent by ignoring them regardless of role.

Udpates #69985
Updates #71206

Change-Id: I7d977282153b1d95fdb549efa92353e86a6a6964
Reviewed-on: https://go-review.googlesource.com/c/go/+/777220
Auto-Submit: Filippo Valsorda <filippo@golang.org>
Reviewed-by: Roland Shoemaker <roland@golang.org>
LUCI-TryBot-Result: golang-scoped@luci-project-accounts.iam.gserviceaccount.com <golang-scoped@luci-project-accounts.iam.gserviceaccount.com>
Reviewed-by: David Chase <drchase@google.com>
This commit is contained in:
yuhan6665
2026-09-10 21:54:16 -04:00
parent 5dabb073f8
commit de0813ca88
6 changed files with 51 additions and 35 deletions
Download Patch File Download Diff File Expand all files Collapse all files
defaults.go
+23 -14
View File
@@ -12,24 +12,33 @@ import (
// Defaults are collected in this file to allow distributions to more easily patch
// them to apply local policies.
// tlsmlkem=0 restores the pre-Go 1.24 default key exchanges.
//var tlsmlkem = godebug.New("tlsmlkem")
// tlssecpmlkem=0 restores the pre-Go 1.26 default key exchanges.
//var tlssecpmlkem = godebug.New("tlssecpmlkem")
// defaultCurvePreferences is the default set of supported key exchanges, as
// well as the preference order.
func defaultCurvePreferences() []CurveID {
switch {
// // tlsmlkem=0 restores the pre-Go 1.24 default.
// case tlsmlkem.Value() == "0":
// return []CurveID{X25519, CurveP256, CurveP384, CurveP521}
// // tlssecpmlkem=0 restores the pre-Go 1.26 default.
// case tlssecpmlkem.Value() == "0":
// return []CurveID{X25519MLKEM768, X25519, CurveP256, CurveP384, CurveP521}
// defaultCurveEnabled returns whether the key exchange c is enabled by default.
func defaultCurveEnabled(c CurveID) bool {
switch c {
case X25519, CurveP256, CurveP384, CurveP521:
return true
case X25519MLKEM768:
return true//tlsmlkem.Value() != "0"
case SecP256r1MLKEM768, SecP384r1MLKEM1024:
return true//tlsmlkem.Value() != "0" && tlssecpmlkem.Value() != "0"
default:
return []CurveID{
X25519MLKEM768, SecP256r1MLKEM768, SecP384r1MLKEM1024,
X25519, CurveP256, CurveP384, CurveP521,
}
return false
}
}
// curvePreferenceOrder is the fixed preference order of key exchanges. It must
// include every supported key exchange.
func curvePreferenceOrder() []CurveID {
return []CurveID{
X25519MLKEM768, SecP256r1MLKEM768, SecP384r1MLKEM1024,
X25519, CurveP256, CurveP384, CurveP521,
}
}