@@ -200,25 +200,40 @@ var tls12ForbiddenCipherSuites = map[uint16]struct{}{
200
200
201
201
// NewTLS uses c to construct a TransportCredentials based on TLS.
202
202
func NewTLS (c * tls.Config ) TransportCredentials {
203
- tc := & tlsCreds {credinternal .CloneTLSConfig (c )}
204
- tc .config .NextProtos = credinternal .AppendH2ToNextProtos (tc .config .NextProtos )
203
+ config := applyDefaults (c )
204
+ if config .GetConfigForClient != nil {
205
+ oldFn := config .GetConfigForClient
206
+ config .GetConfigForClient = func (hello * tls.ClientHelloInfo ) (* tls.Config , error ) {
207
+ cfgForClient , err := oldFn (hello )
208
+ if err != nil || cfgForClient == nil {
209
+ return cfgForClient , err
210
+ }
211
+ return applyDefaults (cfgForClient ), nil
212
+ }
213
+ }
214
+ return & tlsCreds {config : config }
215
+ }
216
+
217
+ func applyDefaults (c * tls.Config ) * tls.Config {
218
+ config := credinternal .CloneTLSConfig (c )
219
+ config .NextProtos = credinternal .AppendH2ToNextProtos (config .NextProtos )
205
220
// If the user did not configure a MinVersion and did not configure a
206
221
// MaxVersion < 1.2, use MinVersion=1.2, which is required by
207
222
// https://datatracker.ietf.org/doc/html/rfc7540#section-9.2
208
- if tc . config .MinVersion == 0 && (tc . config .MaxVersion == 0 || tc . config .MaxVersion >= tls .VersionTLS12 ) {
209
- tc . config .MinVersion = tls .VersionTLS12
223
+ if config .MinVersion == 0 && (config .MaxVersion == 0 || config .MaxVersion >= tls .VersionTLS12 ) {
224
+ config .MinVersion = tls .VersionTLS12
210
225
}
211
226
// If the user did not configure CipherSuites, use all "secure" cipher
212
227
// suites reported by the TLS package, but remove some explicitly forbidden
213
228
// by https://datatracker.ietf.org/doc/html/rfc7540#appendix-A
214
- if tc . config .CipherSuites == nil {
229
+ if config .CipherSuites == nil {
215
230
for _ , cs := range tls .CipherSuites () {
216
231
if _ , ok := tls12ForbiddenCipherSuites [cs .ID ]; ! ok {
217
- tc . config .CipherSuites = append (tc . config .CipherSuites , cs .ID )
232
+ config .CipherSuites = append (config .CipherSuites , cs .ID )
218
233
}
219
234
}
220
235
}
221
- return tc
236
+ return config
222
237
}
223
238
224
239
// NewClientTLSFromCert constructs TLS credentials from the provided root
0 commit comments