Skip to content

Commit e7f5d8d

Browse files
daurnimatordaurnimator
committed
http/tls: update to new mozilla recommendations
This updates to the [Mozilla page](https://wiki.mozilla.org/Security/Server_Side_TLS) v5.7
1 parent ddab283 commit e7f5d8d

File tree

1 file changed

+37
-57
lines changed

1 file changed

+37
-57
lines changed

‎http/tls.lua

+37-57
Original file line numberDiff line numberDiff line change
@@ -19,91 +19,58 @@ end
1919

2020
-- "Modern" cipher list
2121
local modern_cipher_list = cipher_list {
22-
"ECDHE-ECDSA-AES256-GCM-SHA384";
23-
"ECDHE-RSA-AES256-GCM-SHA384";
24-
"ECDHE-ECDSA-CHACHA20-POLY1305";
25-
"ECDHE-RSA-CHACHA20-POLY1305";
26-
"ECDHE-ECDSA-AES128-GCM-SHA256";
27-
"ECDHE-RSA-AES128-GCM-SHA256";
28-
"ECDHE-ECDSA-AES256-SHA384";
29-
"ECDHE-RSA-AES256-SHA384";
30-
"ECDHE-ECDSA-AES128-SHA256";
31-
"ECDHE-RSA-AES128-SHA256";
22+
"TLS_AES_128_GCM_SHA256";
23+
"TLS_AES_256_GCM_SHA384";
24+
"TLS_CHACHA20_POLY1305_SHA256";
3225
}
3326

3427
-- "Intermediate" cipher list
3528
local intermediate_cipher_list = cipher_list {
36-
"ECDHE-ECDSA-CHACHA20-POLY1305";
37-
"ECDHE-RSA-CHACHA20-POLY1305";
29+
"TLS_AES_128_GCM_SHA256";
30+
"TLS_AES_256_GCM_SHA384";
31+
"TLS_CHACHA20_POLY1305_SHA256";
3832
"ECDHE-ECDSA-AES128-GCM-SHA256";
3933
"ECDHE-RSA-AES128-GCM-SHA256";
4034
"ECDHE-ECDSA-AES256-GCM-SHA384";
4135
"ECDHE-RSA-AES256-GCM-SHA384";
36+
"ECDHE-ECDSA-CHACHA20-POLY1305";
37+
"ECDHE-RSA-CHACHA20-POLY1305";
4238
"DHE-RSA-AES128-GCM-SHA256";
4339
"DHE-RSA-AES256-GCM-SHA384";
44-
"ECDHE-ECDSA-AES128-SHA256";
45-
"ECDHE-RSA-AES128-SHA256";
46-
"ECDHE-ECDSA-AES128-SHA";
47-
"ECDHE-RSA-AES256-SHA384";
48-
"ECDHE-RSA-AES128-SHA";
49-
"ECDHE-ECDSA-AES256-SHA384";
50-
"ECDHE-ECDSA-AES256-SHA";
51-
"ECDHE-RSA-AES256-SHA";
52-
"DHE-RSA-AES128-SHA256";
53-
"DHE-RSA-AES128-SHA";
54-
"DHE-RSA-AES256-SHA256";
55-
"DHE-RSA-AES256-SHA";
56-
"ECDHE-ECDSA-DES-CBC3-SHA";
57-
"ECDHE-RSA-DES-CBC3-SHA";
58-
"EDH-RSA-DES-CBC3-SHA";
59-
"AES128-GCM-SHA256";
60-
"AES256-GCM-SHA384";
61-
"AES128-SHA256";
62-
"AES256-SHA256";
63-
"AES128-SHA";
64-
"AES256-SHA";
65-
"DES-CBC3-SHA";
66-
"!DSS";
40+
"DHE-RSA-CHACHA20-POLY1305";
6741
}
6842

6943
-- "Old" cipher list
7044
local old_cipher_list = cipher_list {
71-
"ECDHE-ECDSA-CHACHA20-POLY1305";
72-
"ECDHE-RSA-CHACHA20-POLY1305";
73-
"ECDHE-RSA-AES128-GCM-SHA256";
45+
"TLS_AES_128_GCM_SHA256";
46+
"TLS_AES_256_GCM_SHA384";
47+
"TLS_CHACHA20_POLY1305_SHA256";
7448
"ECDHE-ECDSA-AES128-GCM-SHA256";
75-
"ECDHE-RSA-AES256-GCM-SHA384";
49+
"ECDHE-RSA-AES128-GCM-SHA256";
7650
"ECDHE-ECDSA-AES256-GCM-SHA384";
51+
"ECDHE-RSA-AES256-GCM-SHA384";
52+
"ECDHE-ECDSA-CHACHA20-POLY1305";
53+
"ECDHE-RSA-CHACHA20-POLY1305";
7754
"DHE-RSA-AES128-GCM-SHA256";
78-
"DHE-DSS-AES128-GCM-SHA256";
79-
"kEDH+AESGCM";
80-
"ECDHE-RSA-AES128-SHA256";
55+
"DHE-RSA-AES256-GCM-SHA384";
56+
"DHE-RSA-CHACHA20-POLY1305";
8157
"ECDHE-ECDSA-AES128-SHA256";
82-
"ECDHE-RSA-AES128-SHA";
58+
"ECDHE-RSA-AES128-SHA256";
8359
"ECDHE-ECDSA-AES128-SHA";
84-
"ECDHE-RSA-AES256-SHA384";
60+
"ECDHE-RSA-AES128-SHA";
8561
"ECDHE-ECDSA-AES256-SHA384";
86-
"ECDHE-RSA-AES256-SHA";
62+
"ECDHE-RSA-AES256-SHA384";
8763
"ECDHE-ECDSA-AES256-SHA";
64+
"ECDHE-RSA-AES256-SHA";
8865
"DHE-RSA-AES128-SHA256";
89-
"DHE-RSA-AES128-SHA";
90-
"DHE-DSS-AES128-SHA256";
9166
"DHE-RSA-AES256-SHA256";
92-
"DHE-DSS-AES256-SHA";
93-
"DHE-RSA-AES256-SHA";
94-
"ECDHE-RSA-DES-CBC3-SHA";
95-
"ECDHE-ECDSA-DES-CBC3-SHA";
96-
"EDH-RSA-DES-CBC3-SHA";
9767
"AES128-GCM-SHA256";
9868
"AES256-GCM-SHA384";
9969
"AES128-SHA256";
10070
"AES256-SHA256";
10171
"AES128-SHA";
10272
"AES256-SHA";
103-
"AES";
10473
"DES-CBC3-SHA";
105-
"HIGH";
106-
"SEED";
10774
"!aNULL";
10875
"!eNULL";
10976
"!EXPORT";
@@ -458,6 +425,15 @@ local spec_to_openssl = {
458425
TLS_ECDHE_PSK_WITH_CHACHA20_POLY1305_SHA256 = "ECDHE-PSK-CHACHA20-POLY1305";
459426
TLS_DHE_PSK_WITH_CHACHA20_POLY1305_SHA256 = "DHE-PSK-CHACHA20-POLY1305";
460427
TLS_RSA_PSK_WITH_CHACHA20_POLY1305_SHA256 = "RSA-PSK-CHACHA20-POLY1305";
428+
429+
430+
-- TLS v1.3 cipher suites
431+
432+
TLS_AES_128_GCM_SHA256 = "TLS_AES_128_GCM_SHA256";
433+
TLS_AES_256_GCM_SHA384 = "TLS_AES_256_GCM_SHA384";
434+
TLS_CHACHA20_POLY1305_SHA256 = "TLS_CHACHA20_POLY1305_SHA256";
435+
TLS_AES_128_CCM_SHA256 = "TLS_AES_128_CCM_SHA256";
436+
TLS_AES_128_CCM_8_SHA256 = "TLS_AES_128_CCM_8_SHA256";
461437
}
462438

463439
-- Banned ciphers from https://http2.github.io/http2-spec/#BadCipherSuites
@@ -750,13 +726,17 @@ local default_tls_options = openssl_ctx.OP_NO_COMPRESSION
750726
+ openssl_ctx.OP_SINGLE_ECDH_USE
751727
+ openssl_ctx.OP_NO_SSLv2
752728
+ openssl_ctx.OP_NO_SSLv3
729+
+ openssl_ctx.OP_NO_SSLv3
730+
+ openssl_ctx.OP_NO_TLSv1
731+
+ openssl_ctx.OP_NO_TLSv1_1
732+
+ openssl_ctx.OP_NO_TICKET
753733

754734
local function new_client_context()
755735
local ctx = openssl_ctx.new("TLS", false)
756736
ctx:setCipherList(intermediate_cipher_list)
757737
ctx:setOptions(default_tls_options)
758738
if ctx.setGroups then
759-
ctx:setGroups("P-521:P-384:P-256")
739+
ctx:setGroups("P-521:P-384:P-256:X25519")
760740
else
761741
ctx:setEphemeralKey(openssl_pkey.new{ type = "EC", curve = "prime256v1" })
762742
end
@@ -771,7 +751,7 @@ local function new_server_context()
771751
ctx:setCipherList(intermediate_cipher_list)
772752
ctx:setOptions(default_tls_options)
773753
if ctx.setGroups then
774-
ctx:setGroups("P-521:P-384:P-256")
754+
ctx:setGroups("P-521:P-384:P-256:X25519")
775755
else
776756
ctx:setEphemeralKey(openssl_pkey.new{ type = "EC", curve = "prime256v1" })
777757
end

0 commit comments

Comments
 (0)