mirror of
https://github.com/XTLS/REALITY.git
synced 2026-09-27 17:38:00 +03:00
yuhan6665
de0813ca88
tlsmlkem=0 and tlssecpmlkem=0 were never meant to forcibly disable PQ KEMs, they were only meant to restore the Go 1.24 and Go 1.26 defaults when Config.CurvePreferences is nil. I noticed this while struggling to add a non-default key exchange. While at it, make our behavior on unimplemented Config.CurvePreferences entries more consistent by ignoring them regardless of role. Udpates #69985 Updates #71206 Change-Id: I7d977282153b1d95fdb549efa92353e86a6a6964 Reviewed-on: https://go-review.googlesource.com/c/go/+/777220 Auto-Submit: Filippo Valsorda <filippo@golang.org> Reviewed-by: Roland Shoemaker <roland@golang.org> LUCI-TryBot-Result: golang-scoped@luci-project-accounts.iam.gserviceaccount.com <golang-scoped@luci-project-accounts.iam.gserviceaccount.com> Reviewed-by: David Chase <drchase@google.com>
123 lines
3.6 KiB
Go
123 lines
3.6 KiB
Go
// Copyright 2024 The Go Authors. All rights reserved.
|
|
// Use of this source code is governed by a BSD-style
|
|
// license that can be found in the LICENSE file.
|
|
|
|
package reality
|
|
|
|
import (
|
|
"slices"
|
|
_ "unsafe" // for linkname
|
|
)
|
|
|
|
// Defaults are collected in this file to allow distributions to more easily patch
|
|
// them to apply local policies.
|
|
|
|
// tlsmlkem=0 restores the pre-Go 1.24 default key exchanges.
|
|
//var tlsmlkem = godebug.New("tlsmlkem")
|
|
|
|
// tlssecpmlkem=0 restores the pre-Go 1.26 default key exchanges.
|
|
//var tlssecpmlkem = godebug.New("tlssecpmlkem")
|
|
|
|
// defaultCurveEnabled returns whether the key exchange c is enabled by default.
|
|
func defaultCurveEnabled(c CurveID) bool {
|
|
switch c {
|
|
case X25519, CurveP256, CurveP384, CurveP521:
|
|
return true
|
|
case X25519MLKEM768:
|
|
return true//tlsmlkem.Value() != "0"
|
|
case SecP256r1MLKEM768, SecP384r1MLKEM1024:
|
|
return true//tlsmlkem.Value() != "0" && tlssecpmlkem.Value() != "0"
|
|
|
|
default:
|
|
return false
|
|
}
|
|
}
|
|
|
|
// curvePreferenceOrder is the fixed preference order of key exchanges. It must
|
|
// include every supported key exchange.
|
|
func curvePreferenceOrder() []CurveID {
|
|
return []CurveID{
|
|
X25519MLKEM768, SecP256r1MLKEM768, SecP384r1MLKEM1024,
|
|
X25519, CurveP256, CurveP384, CurveP521,
|
|
}
|
|
}
|
|
|
|
// defaultSupportedSignatureAlgorithms returns the signature and hash algorithms that
|
|
// the code advertises and supports in a TLS 1.2+ ClientHello and in a TLS 1.2+
|
|
// CertificateRequest. The two fields are merged to match with TLS 1.3.
|
|
// Note that in TLS 1.2, the ECDSA algorithms are not constrained to P-256, etc.
|
|
func defaultSupportedSignatureAlgorithms() []SignatureScheme {
|
|
return []SignatureScheme{
|
|
MLDSA44,
|
|
MLDSA65,
|
|
MLDSA87,
|
|
PSSWithSHA256,
|
|
ECDSAWithP256AndSHA256,
|
|
Ed25519,
|
|
PSSWithSHA384,
|
|
PSSWithSHA512,
|
|
PKCS1WithSHA256,
|
|
PKCS1WithSHA384,
|
|
PKCS1WithSHA512,
|
|
ECDSAWithP384AndSHA384,
|
|
ECDSAWithP521AndSHA512,
|
|
PKCS1WithSHA1,
|
|
ECDSAWithSHA1,
|
|
}
|
|
}
|
|
|
|
//var tlsrsakex = godebug.New("tlsrsakex")
|
|
//var tls3des = godebug.New("tls3des")
|
|
|
|
func supportedCipherSuites(aesGCMPreferred bool) []uint16 {
|
|
if aesGCMPreferred {
|
|
return slices.Clone(cipherSuitesPreferenceOrder)
|
|
} else {
|
|
return slices.Clone(cipherSuitesPreferenceOrderNoAES)
|
|
}
|
|
}
|
|
|
|
func defaultCipherSuites(aesGCMPreferred bool) []uint16 {
|
|
cipherSuites := supportedCipherSuites(aesGCMPreferred)
|
|
return slices.DeleteFunc(cipherSuites, func(c uint16) bool {
|
|
return disabledCipherSuites[c] ||
|
|
rsaKexCiphers[c] ||
|
|
tdesCiphers[c]
|
|
})
|
|
}
|
|
|
|
// defaultCipherSuitesTLS13 is also the preference order, since there are no
|
|
// disabled by default TLS 1.3 cipher suites. The same AES vs ChaCha20 logic as
|
|
// cipherSuitesPreferenceOrder applies.
|
|
//
|
|
// defaultCipherSuitesTLS13 should be an internal detail,
|
|
// but widely used packages access it using linkname.
|
|
// Notable members of the hall of shame include:
|
|
// - github.com/quic-go/quic-go
|
|
// - github.com/sagernet/quic-go
|
|
//
|
|
// Do not remove or change the type signature.
|
|
// See go.dev/issue/67401.
|
|
//
|
|
//go:linkname defaultCipherSuitesTLS13
|
|
var defaultCipherSuitesTLS13 = []uint16{
|
|
TLS_AES_128_GCM_SHA256,
|
|
TLS_AES_256_GCM_SHA384,
|
|
TLS_CHACHA20_POLY1305_SHA256,
|
|
}
|
|
|
|
// defaultCipherSuitesTLS13NoAES should be an internal detail,
|
|
// but widely used packages access it using linkname.
|
|
// Notable members of the hall of shame include:
|
|
// - github.com/quic-go/quic-go
|
|
// - github.com/sagernet/quic-go
|
|
//
|
|
// Do not remove or change the type signature.
|
|
// See go.dev/issue/67401.
|
|
//
|
|
//go:linkname defaultCipherSuitesTLS13NoAES
|
|
var defaultCipherSuitesTLS13NoAES = []uint16{
|
|
TLS_CHACHA20_POLY1305_SHA256,
|
|
TLS_AES_128_GCM_SHA256,
|
|
TLS_AES_256_GCM_SHA384,
|
|
} |