Skip to content

Commit 5363dca

Browse files
authored
credentials: Apply defaults to TLS configs provided through GetConfigForClient (#7754) (#7813)
1 parent 056dc64 commit 5363dca

File tree

2 files changed

+324
-99
lines changed

2 files changed

+324
-99
lines changed

credentials/tls.go

+22-7
Original file line numberDiff line numberDiff line change
@@ -200,25 +200,40 @@ var tls12ForbiddenCipherSuites = map[uint16]struct{}{
200200

201201
// NewTLS uses c to construct a TransportCredentials based on TLS.
202202
func NewTLS(c *tls.Config) TransportCredentials {
203-
tc := &tlsCreds{credinternal.CloneTLSConfig(c)}
204-
tc.config.NextProtos = credinternal.AppendH2ToNextProtos(tc.config.NextProtos)
203+
config := applyDefaults(c)
204+
if config.GetConfigForClient != nil {
205+
oldFn := config.GetConfigForClient
206+
config.GetConfigForClient = func(hello *tls.ClientHelloInfo) (*tls.Config, error) {
207+
cfgForClient, err := oldFn(hello)
208+
if err != nil || cfgForClient == nil {
209+
return cfgForClient, err
210+
}
211+
return applyDefaults(cfgForClient), nil
212+
}
213+
}
214+
return &tlsCreds{config: config}
215+
}
216+
217+
func applyDefaults(c *tls.Config) *tls.Config {
218+
config := credinternal.CloneTLSConfig(c)
219+
config.NextProtos = credinternal.AppendH2ToNextProtos(config.NextProtos)
205220
// If the user did not configure a MinVersion and did not configure a
206221
// MaxVersion < 1.2, use MinVersion=1.2, which is required by
207222
// https://datatracker.ietf.org/doc/html/rfc7540#section-9.2
208-
if tc.config.MinVersion == 0 && (tc.config.MaxVersion == 0 || tc.config.MaxVersion >= tls.VersionTLS12) {
209-
tc.config.MinVersion = tls.VersionTLS12
223+
if config.MinVersion == 0 && (config.MaxVersion == 0 || config.MaxVersion >= tls.VersionTLS12) {
224+
config.MinVersion = tls.VersionTLS12
210225
}
211226
// If the user did not configure CipherSuites, use all "secure" cipher
212227
// suites reported by the TLS package, but remove some explicitly forbidden
213228
// by https://datatracker.ietf.org/doc/html/rfc7540#appendix-A
214-
if tc.config.CipherSuites == nil {
229+
if config.CipherSuites == nil {
215230
for _, cs := range tls.CipherSuites() {
216231
if _, ok := tls12ForbiddenCipherSuites[cs.ID]; !ok {
217-
tc.config.CipherSuites = append(tc.config.CipherSuites, cs.ID)
232+
config.CipherSuites = append(config.CipherSuites, cs.ID)
218233
}
219234
}
220235
}
221-
return tc
236+
return config
222237
}
223238

224239
// NewClientTLSFromCert constructs TLS credentials from the provided root

0 commit comments

Comments
 (0)