USEFULL/gogs
1
0
Fork 0
mirror of https://github.com/gogs/gogs.git synced 2025-05-31 11:42:13 +00:00
Code Issues Packages Projects Releases Wiki Activity

Allow configurable HTTPS SSL/TLS version(#4451)

Browse Source
This commit is contained in:
spacetourist 2017-05-20 13:31:25 +01:00 committed by 无闻
parent d71a8fece8
commit 0a6ceabb9b
3 changed files with 21 additions and 3 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

15
cmd/web.go
View File

@ -672,8 +672,21 @@ func runWeb(ctx *cli.Context) error {
case setting.SCHEME_HTTP: case setting.SCHEME_HTTP:
err = http.ListenAndServe(listenAddr, m) err = http.ListenAndServe(listenAddr, m)
case setting.SCHEME_HTTPS: case setting.SCHEME_HTTPS:
var tlsMinVersion uint16
switch setting.TLSMinVersion {
case "SSL30":
tlsMinVersion = tls.VersionSSL30
case "TLS12":
tlsMinVersion = tls.VersionTLS12
case "TLS11":
tlsMinVersion = tls.VersionTLS11
case "TLS10":
fallthrough
default:
tlsMinVersion = tls.VersionTLS10
}
server := &http.Server{Addr: listenAddr, TLSConfig: &tls.Config{ server := &http.Server{Addr: listenAddr, TLSConfig: &tls.Config{
MinVersion: tls.VersionTLS10, MinVersion: tlsMinVersion,
CurvePreferences: []tls.CurveID{tls.CurveP521, tls.CurveP384, tls.CurveP256}, CurvePreferences: []tls.CurveID{tls.CurveP521, tls.CurveP384, tls.CurveP256},
PreferServerCipherSuites: true, PreferServerCipherSuites: true,
CipherSuites: []uint16{ CipherSuites: []uint16{

3
conf/app.ini
View File

@ -56,6 +56,9 @@ DISABLE_ROUTER_LOG = false
; $ openssl pkcs12 -in cert.pfx -out key.pem -nocerts -nodes ; $ openssl pkcs12 -in cert.pfx -out key.pem -nocerts -nodes
CERT_FILE = custom/https/cert.pem CERT_FILE = custom/https/cert.pem
KEY_FILE = custom/https/key.pem KEY_FILE = custom/https/key.pem
; Allowed TLS version values: SSL30, TLS10, TLS11, TLS12
TLS_MIN_VERSION = TLS10
; Upper level of template and static file path ; Upper level of template and static file path
; default is the path where Gogs is executed ; default is the path where Gogs is executed
STATIC_ROOT_PATH = STATIC_ROOT_PATH =

2
pkg/setting/setting.go
View File

@ -69,6 +69,7 @@ var (
OfflineMode bool OfflineMode bool
DisableRouterLog bool DisableRouterLog bool
CertFile, KeyFile string CertFile, KeyFile string
TLSMinVersion string
StaticRootPath string StaticRootPath string
EnableGzip bool EnableGzip bool
LandingPageURL LandingPage LandingPageURL LandingPage
@ -438,6 +439,7 @@ func NewContext() {
Protocol = SCHEME_HTTPS Protocol = SCHEME_HTTPS
CertFile = sec.Key("CERT_FILE").String() CertFile = sec.Key("CERT_FILE").String()
KeyFile = sec.Key("KEY_FILE").String() KeyFile = sec.Key("KEY_FILE").String()
TLSMinVersion = sec.Key("TLS_MIN_VERSION").String()
} else if sec.Key("PROTOCOL").String() == "fcgi" { } else if sec.Key("PROTOCOL").String() == "fcgi" {
Protocol = SCHEME_FCGI Protocol = SCHEME_FCGI
} else if sec.Key("PROTOCOL").String() == "unix" { } else if sec.Key("PROTOCOL").String() == "unix" {