mirrors/dnscrypt-proxy
1
0
Fork 0
mirror of https://github.com/DNSCrypt/dnscrypt-proxy.git synced 2025-03-03 18:04:40 +01:00
Code Issues Projects Releases Packages Wiki Activity Actions

Fix undefined vs empty confusion for tls_cipher_suite

Browse source 
The documentation refers to tls_cipher_suite being empty in order
to use the default parameters, not undefined.

However, configuring an empty set of cipher suites did just that:
no cipher suites could be used, which is not very useful.

Fix the documentation: in order to use the default suites, the
parameter must be undefined, not empty.

And in code, make an empty set equivalent to the parameter being
undefined.
This commit is contained in:
Frank Denis 2025-01-26 23:18:03 +01:00
parent eb2c1dc6b3
commit 3b75a4c6ac
2 changed files with 5 additions and 4 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

4
dnscrypt-proxy/example-dnscrypt-proxy.toml
View file

@ -223,9 +223,9 @@ cert_refresh_delay = 240
## On non-Intel CPUs such as MIPS routers and ARM systems (Android, Raspberry Pi...),
## the following suite improves performance.
## This may also help on Intel CPUs running 32-bit operating systems.
## However, this can cause issues fetching sources or connecting to some HTTP servers.
##
## Keep tls_cipher_suite empty if you have issues fetching sources or
## connecting to some DoH servers.
## Keep tls_cipher_suite undefined to let the app automatically choose secure parameters
# tls_cipher_suite = [52392, 49199]

5
dnscrypt-proxy/xtransport.go
View file

@ -217,12 +217,13 @@ func (xTransport *XTransport) rebuildTransport() {
tlsClientConfig.Certificates = []tls.Certificate{cert}
}
if xTransport.tlsDisableSessionTickets || xTransport.tlsCipherSuite != nil {
overrideCipherSuite := xTransport.tlsCipherSuite != nil && len(xTransport.tlsCipherSuite) > 0
if xTransport.tlsDisableSessionTickets || overrideCipherSuite {
tlsClientConfig.SessionTicketsDisabled = xTransport.tlsDisableSessionTickets
if !xTransport.tlsDisableSessionTickets {
tlsClientConfig.ClientSessionCache = tls.NewLRUClientSessionCache(10)
}
if xTransport.tlsCipherSuite != nil {
if overrideCipherSuite {
tlsClientConfig.PreferServerCipherSuites = false
tlsClientConfig.CipherSuites = xTransport.tlsCipherSuite