mirror of
https://github.com/octoleo/syncthing.git
synced 2024-11-12 16:26:37 +00:00
8519a24ba6
This changes the TLS and certificate handling in a few ways: - We always use TLS 1.2, both for sync connections (as previously) and the GUI/REST/discovery stuff. This is a tightening of the requirements on the GUI. AS far as I can tell from caniusethis.com every browser from 2013 and forward supports TLS 1.2, so I think we should be fine. - We always greate ECDSA certificates. Previously we'd create ECDSA-with-RSA certificates for sync connections and pure RSA certificates for the web stuff. The new default is more modern and the same everywhere. These certificates are OK in TLS 1.2. - We use the Go CPU detection stuff to choose the cipher suites to use, indirectly. The TLS package uses CPU capabilities probing to select either AES-GCM (fast if we have AES-NI) or ChaCha20 (faster if we don't). These CPU detection things aren't exported though, so the tlsutil package now does a quick TLS handshake with itself as part of init(). If the chosen cipher suite was AES-GCM we prioritize that, otherwise we prefer ChaCha20. Some might call this ugly. I think it's awesome. |
||
|---|---|---|
| .. | ||
| stbench | ||
| stcli | ||
| stcompdirs | ||
| stdisco | ||
| stdiscosrv | ||
| stevents | ||
| stfileinfo | ||
| stfinddevice | ||
| stfindignored | ||
| stgenfiles | ||
| stindex | ||
| strelaypoolsrv | ||
| strelaysrv | ||
| stsigtool | ||
| stvanity | ||
| stwatchfile | ||
| syncthing | ||
| todos | ||
| uraggregate | ||
| ursrv | ||
| .gitignore | ||