feat(tls): allow configuring TLS versions and cipher suites #575
Conversation
Expose configuration options for TLS MinVersion, MaxVersion, and CipherSuites backed by crypto/tls. This allows LiveKit to interoperate with providers that require non-default or legacy TLS configurations.
|
|
dennwc
left a comment
dennwc
left a comment
There was a problem hiding this comment.
Looks good, just a few minor adjustments.
| Certs []TLSCert `yaml:"certs"` | ||
| KeyLog string `yaml:"key_log"` | ||
|
|
||
| MinVersion string `yaml:"min_version"` // min TLS version, accepts: "1.0", "1.1", "1.2", "1.3" |
There was a problem hiding this comment.
Values like 1.0 are dangerous in YAML, since they will be interpreted as a number by default. The user must then know to set it to "1.0" (a string).
So I'd propose we settle on accepting just tls1.0 and/or TLS1.0.
|
|
||
| // ParseCipherSuites parses cipher suite names to uint16 IDs. | ||
| // Logs a warning for each insecure cipher suite configured. | ||
| func ParseCipherSuites(suites []string, log logger.Logger) ([]uint16, error) { |
There was a problem hiding this comment.
| func ParseCipherSuites(suites []string, log logger.Logger) ([]uint16, error) { | |
| func ParseCipherSuites(log logger.Logger, suites []string) ([]uint16, error) { |
|
|
||
| // ParseCipherSuites parses cipher suite names to uint16 IDs. | ||
| // Logs a warning for each insecure cipher suite configured. | ||
| func ParseCipherSuites(suites []string, log logger.Logger) ([]uint16, error) { |
There was a problem hiding this comment.
| func ParseCipherSuites(suites []string, log logger.Logger) ([]uint16, error) { | |
| func parseCipherSuites(suites []string, log logger.Logger) ([]uint16, error) { |
Can be unexported, since these are only used it this package.
|
|
||
| // ParseTLSVersion parses a TLS version string to its uint16 constant. | ||
| // Accepts formats: "1.0", "1.1", "1.2", "1.3" or "TLS 1.0", "TLS 1.1", "TLS 1.2", "TLS 1.3". | ||
| func ParseTLSVersion(version string) (uint16, error) { |
There was a problem hiding this comment.
| func ParseTLSVersion(version string) (uint16, error) { | |
| func parseTLSVersion(version string) (uint16, error) { |
Same here - can be unexported.
3 participants
Expose configuration options for TLS MinVersion, MaxVersion, and CipherSuites backed by crypto/tls. This allows LiveKit to interoperate with providers that require non-default or legacy TLS configurations.