mirrors/dnscrypt-proxy
1
0
Fork 0
mirror of https://github.com/DNSCrypt/dnscrypt-proxy.git synced 2025-04-04 13:47:39 +03:00
Code Issues Projects Releases Packages Wiki Activity

Update xtransport.go

Browse source 
Testing keep cipher suite to fix cipher suite downgrade and tls 1.3 upgrade on error/dos.
Trying to keep the same specified cipher suite if we had a successfull connection.
This commit is contained in:
ACE 2025-01-25 20:14:35 +02:00 • committed by GitHub
parent 6c33547288
commit e4fc6d6fd0
No known key found for this signature in database
GPG key ID: B5690EEEBB952194
1 changed files with 29 additions and 25 deletions
Download patch file Download diff file Expand all files Collapse all files

54
dnscrypt-proxy/xtransport.go
View file

@ -71,6 +71,7 @@ type XTransport struct {
http3 bool http3 bool
tlsDisableSessionTickets bool tlsDisableSessionTickets bool
tlsCipherSuite []uint16 tlsCipherSuite []uint16
keepCipherSuite bool
proxyDialer *netproxy.Dialer proxyDialer *netproxy.Dialer
httpProxyFunction func(*http.Request) (*url.URL, error) httpProxyFunction func(*http.Request) (*url.URL, error)
tlsClientCreds DOHClientCreds tlsClientCreds DOHClientCreds
@ -93,6 +94,7 @@ func NewXTransport() *XTransport {
useIPv6: false, useIPv6: false,
tlsDisableSessionTickets: false, tlsDisableSessionTickets: false,
tlsCipherSuite: nil, tlsCipherSuite: nil,
keepCipherSuite: false,
keyLogWriter: nil, keyLogWriter: nil,
} }
return &xTransport return &xTransport
@ -216,45 +218,45 @@ func (xTransport *XTransport) rebuildTransport() {
} }
tlsClientConfig.Certificates = []tls.Certificate{cert} tlsClientConfig.Certificates = []tls.Certificate{cert}
} }
if xTransport.tlsDisableSessionTickets {
if xTransport.tlsDisableSessionTickets || xTransport.tlsCipherSuite != nil {
tlsClientConfig.SessionTicketsDisabled = xTransport.tlsDisableSessionTickets tlsClientConfig.SessionTicketsDisabled = xTransport.tlsDisableSessionTickets
if !xTransport.tlsDisableSessionTickets { if !xTransport.tlsDisableSessionTickets {
tlsClientConfig.ClientSessionCache = tls.NewLRUClientSessionCache(10) tlsClientConfig.ClientSessionCache = tls.NewLRUClientSessionCache(10)
} }
if xTransport.tlsCipherSuite != nil { }
tlsClientConfig.PreferServerCipherSuites = false if xTransport.tlsCipherSuite != nil {
tlsClientConfig.CipherSuites = xTransport.tlsCipherSuite tlsClientConfig.PreferServerCipherSuites = false
tlsClientConfig.CipherSuites = xTransport.tlsCipherSuite
// Go doesn't allow changing the cipher suite with TLS 1.3 // Go doesn't allow changing the cipher suite with TLS 1.3
// So, check if the requested set of ciphers matches the TLS 1.3 suite. // So, check if the requested set of ciphers matches the TLS 1.3 suite.
// If it doesn't, downgrade to TLS 1.2 // If it doesn't, downgrade to TLS 1.2
compatibleSuitesCount := 0 compatibleSuitesCount := 0
for _, suite := range tls.CipherSuites() { for _, suite := range tls.CipherSuites() {
if suite.Insecure { if suite.Insecure {
continue continue
} }
for _, supportedVersion := range suite.SupportedVersions { for _, supportedVersion := range suite.SupportedVersions {
if supportedVersion != tls.VersionTLS13 { if supportedVersion != tls.VersionTLS13 {
for _, expectedSuiteID := range xTransport.tlsCipherSuite { for _, expectedSuiteID := range xTransport.tlsCipherSuite {
if expectedSuiteID == suite.ID { if expectedSuiteID == suite.ID {
compatibleSuitesCount += 1 compatibleSuitesCount += 1
break break
}
} }
} }
} }
} }
if compatibleSuitesCount != len(tls.CipherSuites()) { }
dlog.Notice("Explicit cipher suite configured - downgrading to TLS 1.2") if compatibleSuitesCount != len(tls.CipherSuites()) {
tlsClientConfig.MaxVersion = tls.VersionTLS12 dlog.Infof("Explicit cipher suite configured - downgrading to TLS 1.2 with cipher suite: %v", xTransport.tlsCipherSuite)
} tlsClientConfig.MaxVersion = tls.VersionTLS12
} }
} }
transport.TLSClientConfig = &tlsClientConfig transport.TLSClientConfig = &tlsClientConfig
if http2Transport, err := http2.ConfigureTransports(transport); err != nil { if http2Transport, err := http2.ConfigureTransports(transport); err != nil {
http2Transport.ReadIdleTimeout = timeout http2Transport.ReadIdleTimeout = timeout
http2Transport.AllowHTTP = false http2Transport.AllowHTTP = false
xTransport.keepCipherSuite = true
} }
xTransport.transport = transport xTransport.transport = transport
if xTransport.http3 { if xTransport.http3 {
@ -566,7 +568,9 @@ func (xTransport *XTransport) Fetch(
dlog.Warnf( dlog.Warnf(
"TLS handshake failure - Try changing or deleting the tls_cipher_suite value in the configuration file", "TLS handshake failure - Try changing or deleting the tls_cipher_suite value in the configuration file",
) )
//xTransport.tlsCipherSuite = nil if xTransport.keepCipherSuite != true {
xTransport.tlsCipherSuite = nil
}
xTransport.rebuildTransport() xTransport.rebuildTransport()
} }
return nil, statusCode, nil, rtt, err return nil, statusCode, nil, rtt, err