Skip to content

Commit 7ac1540

Browse files
zeripathzeripath
committed
use maps which can be easily added to (and potentially inverted)
Signed-off-by: Andrew Thornton <[email protected]>
1 parent 9369a75 commit 7ac1540

File tree

1 file changed

+54
-79
lines changed

1 file changed

+54
-79
lines changed

‎cmd/web_https.go

Lines changed: 54 additions & 79 deletions
Original file line numberDiff line numberDiff line change
@@ -16,36 +16,35 @@ import (
1616
"github.com/klauspost/cpuid/v2"
1717
)
1818

19+
var tlsVersionStringMap = map[string]uint16{
20+
"": tls.VersionTLS12, // Default to tls.VersionTLS12
21+
"tlsv1.0": tls.VersionTLS10,
22+
"tlsv1.1": tls.VersionTLS11,
23+
"tlsv1.2": tls.VersionTLS12,
24+
"tlsv1.3": tls.VersionTLS13,
25+
}
26+
1927
func toTLSVersion(version string) uint16 {
20-
switch strings.TrimSpace(strings.ToLower(version)) {
21-
case "tlsv1.0":
22-
return tls.VersionTLS10
23-
case "tlsv1.1":
24-
return tls.VersionTLS11
25-
case "tlsv1.2", "": // Set TLSv1.2 as our default
26-
return tls.VersionTLS12
27-
case "tlsv1.3":
28-
return tls.VersionTLS13
29-
default:
28+
tlsVersion, ok := tlsVersionStringMap[strings.TrimSpace(strings.ToLower(version))]
29+
if !ok {
3030
log.Warn("Unknown tls version: %s", version)
3131
return 0
3232
}
33+
return tlsVersion
34+
}
35+
36+
var curveStringMap = map[string]tls.CurveID{
37+
"x25519": tls.X25519,
38+
"p256": tls.CurveP256,
39+
"p384": tls.CurveP384,
40+
"p521": tls.CurveP521,
3341
}
3442

3543
func toCurvePreferences(preferences []string) []tls.CurveID {
3644
ids := make([]tls.CurveID, 0, len(preferences))
3745
for _, pref := range preferences {
38-
var id tls.CurveID
39-
switch strings.TrimSpace(strings.ToLower(pref)) {
40-
case "x25519":
41-
id = tls.X25519
42-
case "p256":
43-
id = tls.CurveP256
44-
case "p384":
45-
id = tls.CurveP384
46-
case "p521":
47-
id = tls.CurveP521
48-
default:
46+
id, ok := curveStringMap[strings.TrimSpace(strings.ToLower(pref))]
47+
if !ok {
4948
log.Warn("Unknown curve: %s", pref)
5049
}
5150
if id != 0 {
@@ -55,66 +54,41 @@ func toCurvePreferences(preferences []string) []tls.CurveID {
5554
return ids
5655
}
5756

57+
var cipherStringMap = map[string]uint16{
58+
"rsa_with_rc4_128_sha": tls.TLS_RSA_WITH_RC4_128_SHA,
59+
"rsa_with_3des_ede_cbc_sha": tls.TLS_RSA_WITH_3DES_EDE_CBC_SHA,
60+
"rsa_with_aes_128_cbc_sha": tls.TLS_RSA_WITH_AES_128_CBC_SHA,
61+
"rsa_with_aes_256_cbc_sha": tls.TLS_RSA_WITH_AES_256_CBC_SHA,
62+
"rsa_with_aes_128_cbc_sha256": tls.TLS_RSA_WITH_AES_128_CBC_SHA256,
63+
"rsa_with_aes_128_gcm_sha256": tls.TLS_RSA_WITH_AES_128_GCM_SHA256,
64+
"rsa_with_aes_256_gcm_sha384": tls.TLS_RSA_WITH_AES_256_GCM_SHA384,
65+
"ecdhe_ecdsa_with_rc4_128_sha": tls.TLS_ECDHE_ECDSA_WITH_RC4_128_SHA,
66+
"ecdhe_ecdsa_with_aes_128_cbc_sha": tls.TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA,
67+
"ecdhe_ecdsa_with_aes_256_cbc_sha": tls.TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA,
68+
"ecdhe_rsa_with_rc4_128_sha": tls.TLS_ECDHE_RSA_WITH_RC4_128_SHA,
69+
"ecdhe_rsa_with_3des_ede_cbc_sha": tls.TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA,
70+
"ecdhe_rsa_with_aes_128_cbc_sha": tls.TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA,
71+
"ecdhe_rsa_with_aes_256_cbc_sha": tls.TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA,
72+
"ecdhe_ecdsa_with_aes_128_cbc_sha256": tls.TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256,
73+
"ecdhe_rsa_with_aes_128_cbc_sha256": tls.TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256,
74+
"ecdhe_rsa_with_aes_128_gcm_sha256": tls.TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,
75+
"ecdhe_ecdsa_with_aes_128_gcm_sha256": tls.TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,
76+
"ecdhe_rsa_with_aes_256_gcm_sha384": tls.TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,
77+
"ecdhe_ecdsa_with_aes_256_gcm_sha384": tls.TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,
78+
"ecdhe_rsa_with_chacha20_poly1305_sha256": tls.TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256,
79+
"ecdhe_ecdsa_with_chacha20_poly1305_sha256": tls.TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256,
80+
"ecdhe_rsa_with_chacha20_poly1305": tls.TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305,
81+
"ecdhe_ecdsa_with_chacha20_poly1305": tls.TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,
82+
"aes_128_gcm_sha256": tls.TLS_AES_128_GCM_SHA256,
83+
"aes_256_gcm_sha384": tls.TLS_AES_256_GCM_SHA384,
84+
"chacha20_poly1305_sha256": tls.TLS_CHACHA20_POLY1305_SHA256,
85+
}
86+
5887
func toTLSCiphers(cipherStrings []string) []uint16 {
5988
ciphers := make([]uint16, 0, len(cipherStrings))
6089
for _, cipherString := range cipherStrings {
61-
var cipher uint16
62-
switch strings.TrimSpace(strings.ToLower(cipherString)) {
63-
case "rsa_with_rc4_128_sha":
64-
cipher = tls.TLS_RSA_WITH_RC4_128_SHA
65-
case "rsa_with_3des_ede_cbc_sha":
66-
cipher = tls.TLS_RSA_WITH_3DES_EDE_CBC_SHA
67-
case "rsa_with_aes_128_cbc_sha":
68-
cipher = tls.TLS_RSA_WITH_AES_128_CBC_SHA
69-
case "rsa_with_aes_256_cbc_sha":
70-
cipher = tls.TLS_RSA_WITH_AES_256_CBC_SHA
71-
case "rsa_with_aes_128_cbc_sha256":
72-
cipher = tls.TLS_RSA_WITH_AES_128_CBC_SHA256
73-
case "rsa_with_aes_128_gcm_sha256":
74-
cipher = tls.TLS_RSA_WITH_AES_128_GCM_SHA256
75-
case "rsa_with_aes_256_gcm_sha384":
76-
cipher = tls.TLS_RSA_WITH_AES_256_GCM_SHA384
77-
case "ecdhe_ecdsa_with_rc4_128_sha":
78-
cipher = tls.TLS_ECDHE_ECDSA_WITH_RC4_128_SHA
79-
case "ecdhe_ecdsa_with_aes_128_cbc_sha":
80-
cipher = tls.TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA
81-
case "ecdhe_ecdsa_with_aes_256_cbc_sha":
82-
cipher = tls.TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA
83-
case "ecdhe_rsa_with_rc4_128_sha":
84-
cipher = tls.TLS_ECDHE_RSA_WITH_RC4_128_SHA
85-
case "ecdhe_rsa_with_3des_ede_cbc_sha":
86-
cipher = tls.TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA
87-
case "ecdhe_rsa_with_aes_128_cbc_sha":
88-
cipher = tls.TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA
89-
case "ecdhe_rsa_with_aes_256_cbc_sha":
90-
cipher = tls.TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA
91-
case "ecdhe_ecdsa_with_aes_128_cbc_sha256":
92-
cipher = tls.TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256
93-
case "ecdhe_rsa_with_aes_128_cbc_sha256":
94-
cipher = tls.TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256
95-
case "ecdhe_rsa_with_aes_128_gcm_sha256":
96-
cipher = tls.TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256
97-
case "ecdhe_ecdsa_with_aes_128_gcm_sha256":
98-
cipher = tls.TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256
99-
case "ecdhe_rsa_with_aes_256_gcm_sha384":
100-
cipher = tls.TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384
101-
case "ecdhe_ecdsa_with_aes_256_gcm_sha384":
102-
cipher = tls.TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384
103-
case "ecdhe_rsa_with_chacha20_poly1305_sha256":
104-
cipher = tls.TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256
105-
case "ecdhe_ecdsa_with_chacha20_poly1305_sha256":
106-
cipher = tls.TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256
107-
case "ecdhe_rsa_with_chacha20_poly1305":
108-
cipher = tls.TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305
109-
case "ecdhe_ecdsa_with_chacha20_poly1305":
110-
cipher = tls.TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305
111-
case "aes_128_gcm_sha256":
112-
cipher = tls.TLS_AES_128_GCM_SHA256
113-
case "aes_256_gcm_sha384":
114-
cipher = tls.TLS_AES_256_GCM_SHA384
115-
case "chacha20_poly1305_sha256":
116-
cipher = tls.TLS_CHACHA20_POLY1305_SHA256
117-
default:
90+
cipher, ok := cipherStringMap[strings.TrimSpace(strings.ToLower(cipherString))]
91+
if !ok {
11892
log.Warn("Unknown cipher: %s", cipherString)
11993
}
12094
if cipher != 0 {
@@ -128,7 +102,8 @@ func toTLSCiphers(cipherStrings []string) []uint16 {
128102
// defaultCiphers uses hardware support to check if AES is specifically
129103
// supported by the CPU.
130104
//
131-
// If it is AES ciphers will be preferred over ChaCha based ciphers
105+
// If AES is supported AES ciphers will be preferred over ChaCha based ciphers
106+
// (This code is directly inspired by the certmagic code.)
132107
func defaultCiphers() []uint16 {
133108
if cpuid.CPU.Supports(cpuid.AESNI) {
134109
return defaultCiphersAESfirst

0 commit comments

Comments
 (0)