mirror of
https://github.com/octoleo/syncthing.git
synced 2024-09-19 05:09:01 +00:00
8519a24ba6
This changes the TLS and certificate handling in a few ways: - We always use TLS 1.2, both for sync connections (as previously) and the GUI/REST/discovery stuff. This is a tightening of the requirements on the GUI. AS far as I can tell from caniusethis.com every browser from 2013 and forward supports TLS 1.2, so I think we should be fine. - We always greate ECDSA certificates. Previously we'd create ECDSA-with-RSA certificates for sync connections and pure RSA certificates for the web stuff. The new default is more modern and the same everywhere. These certificates are OK in TLS 1.2. - We use the Go CPU detection stuff to choose the cipher suites to use, indirectly. The TLS package uses CPU capabilities probing to select either AES-GCM (fast if we have AES-NI) or ChaCha20 (faster if we don't). These CPU detection things aren't exported though, so the tlsutil package now does a quick TLS handshake with itself as part of init(). If the chosen cipher suite was AES-GCM we prioritize that, otherwise we prefer ChaCha20. Some might call this ugly. I think it's awesome. |
||
---|---|---|
.. | ||
auto | ||
beacon | ||
config | ||
connections | ||
db | ||
dialer | ||
discover | ||
events | ||
fs | ||
ignore | ||
logger | ||
model | ||
nat | ||
osutil | ||
pmp | ||
protocol | ||
rand | ||
rc | ||
relay | ||
scanner | ||
sha256 | ||
signature | ||
stats | ||
sync | ||
tlsutil | ||
upgrade | ||
upnp | ||
util | ||
versioner | ||
watchaggregator | ||
weakhash |