diff --git a/transport/internet/tls/config.go b/transport/internet/tls/config.go index 7f6d759b54b..8c36379f31f 100644 --- a/transport/internet/tls/config.go +++ b/transport/internet/tls/config.go @@ -249,6 +249,28 @@ func (c *Config) GetTLSConfig(opts ...Option) *tls.Config { if c.VerifyClientCertificate { config.ClientAuth = tls.RequireAndVerifyClientCert } + + switch c.MinVersion { + case tls.VersionTLS10: + config.MinVersion = tls.VersionTLS10 + case tls.VersionTLS11: + config.MinVersion = tls.VersionTLS11 + case tls.VersionTLS12: + config.MinVersion = tls.VersionTLS12 + case tls.VersionTLS13: + config.MinVersion = tls.VersionTLS13 + } + + switch c.MaxVersion { + case tls.VersionTLS10: + config.MaxVersion = tls.VersionTLS10 + case tls.VersionTLS11: + config.MaxVersion = tls.VersionTLS11 + case tls.VersionTLS12: + config.MaxVersion = tls.VersionTLS12 + case tls.VersionTLS13: + config.MaxVersion = tls.VersionTLS13 + } return config } diff --git a/transport/internet/tls/config.pb.go b/transport/internet/tls/config.pb.go index cd94057cc22..9bb8894d73e 100644 --- a/transport/internet/tls/config.pb.go +++ b/transport/internet/tls/config.pb.go @@ -67,6 +67,61 @@ func (Certificate_Usage) EnumDescriptor() ([]byte, []int) { return file_transport_internet_tls_config_proto_rawDescGZIP(), []int{0, 0} } +type Config_TLSVersion int32 + +const ( + Config_Default Config_TLSVersion = 0 + Config_TLS1_0 Config_TLSVersion = 1 + Config_TLS1_1 Config_TLSVersion = 2 + Config_TLS1_2 Config_TLSVersion = 3 + Config_TLS1_3 Config_TLSVersion = 4 +) + +// Enum value maps for Config_TLSVersion. +var ( + Config_TLSVersion_name = map[int32]string{ + 0: "Default", + 1: "TLS1_0", + 2: "TLS1_1", + 3: "TLS1_2", + 4: "TLS1_3", + } + Config_TLSVersion_value = map[string]int32{ + "Default": 0, + "TLS1_0": 1, + "TLS1_1": 2, + "TLS1_2": 3, + "TLS1_3": 4, + } +) + +func (x Config_TLSVersion) Enum() *Config_TLSVersion { + p := new(Config_TLSVersion) + *p = x + return p +} + +func (x Config_TLSVersion) String() string { + return protoimpl.X.EnumStringOf(x.Descriptor(), protoreflect.EnumNumber(x)) +} + +func (Config_TLSVersion) Descriptor() protoreflect.EnumDescriptor { + return file_transport_internet_tls_config_proto_enumTypes[1].Descriptor() +} + +func (Config_TLSVersion) Type() protoreflect.EnumType { + return &file_transport_internet_tls_config_proto_enumTypes[1] +} + +func (x Config_TLSVersion) Number() protoreflect.EnumNumber { + return protoreflect.EnumNumber(x) +} + +// Deprecated: Use Config_TLSVersion.Descriptor instead. +func (Config_TLSVersion) EnumDescriptor() ([]byte, []int) { + return file_transport_internet_tls_config_proto_rawDescGZIP(), []int{1, 0} +} + type Certificate struct { state protoimpl.MessageState sizeCache protoimpl.SizeCache @@ -173,6 +228,10 @@ type Config struct { PinnedPeerCertificateChainSha256 [][]byte `protobuf:"bytes,7,rep,name=pinned_peer_certificate_chain_sha256,json=pinnedPeerCertificateChainSha256,proto3" json:"pinned_peer_certificate_chain_sha256,omitempty"` // If true, the client is required to present a certificate. VerifyClientCertificate bool `protobuf:"varint,8,opt,name=verify_client_certificate,json=verifyClientCertificate,proto3" json:"verify_client_certificate,omitempty"` + // Minimum TLS version to support. + MinVersion Config_TLSVersion `protobuf:"varint,9,opt,name=min_version,json=minVersion,proto3,enum=v2ray.core.transport.internet.tls.Config_TLSVersion" json:"min_version,omitempty"` + // Maximum TLS version to support. + MaxVersion Config_TLSVersion `protobuf:"varint,10,opt,name=max_version,json=maxVersion,proto3,enum=v2ray.core.transport.internet.tls.Config_TLSVersion" json:"max_version,omitempty"` } func (x *Config) Reset() { @@ -263,6 +322,20 @@ func (x *Config) GetVerifyClientCertificate() bool { return false } +func (x *Config) GetMinVersion() Config_TLSVersion { + if x != nil { + return x.MinVersion + } + return Config_Default +} + +func (x *Config) GetMaxVersion() Config_TLSVersion { + if x != nil { + return x.MaxVersion + } + return Config_Default +} + var File_transport_internet_tls_config_proto protoreflect.FileDescriptor var file_transport_internet_tls_config_proto_rawDesc = []byte{ @@ -294,7 +367,7 @@ var file_transport_internet_tls_config_proto_rawDesc = []byte{ 0x59, 0x10, 0x01, 0x12, 0x13, 0x0a, 0x0f, 0x41, 0x55, 0x54, 0x48, 0x4f, 0x52, 0x49, 0x54, 0x59, 0x5f, 0x49, 0x53, 0x53, 0x55, 0x45, 0x10, 0x02, 0x12, 0x1b, 0x0a, 0x17, 0x41, 0x55, 0x54, 0x48, 0x4f, 0x52, 0x49, 0x54, 0x59, 0x5f, 0x56, 0x45, 0x52, 0x49, 0x46, 0x59, 0x5f, 0x43, 0x4c, 0x49, - 0x45, 0x4e, 0x54, 0x10, 0x03, 0x22, 0xe0, 0x03, 0x0a, 0x06, 0x43, 0x6f, 0x6e, 0x66, 0x69, 0x67, + 0x45, 0x4e, 0x54, 0x10, 0x03, 0x22, 0xd9, 0x05, 0x0a, 0x06, 0x43, 0x6f, 0x6e, 0x66, 0x69, 0x67, 0x12, 0x2d, 0x0a, 0x0e, 0x61, 0x6c, 0x6c, 0x6f, 0x77, 0x5f, 0x69, 0x6e, 0x73, 0x65, 0x63, 0x75, 0x72, 0x65, 0x18, 0x01, 0x20, 0x01, 0x28, 0x08, 0x42, 0x06, 0x82, 0xb5, 0x18, 0x02, 0x28, 0x01, 0x52, 0x0d, 0x61, 0x6c, 0x6c, 0x6f, 0x77, 0x49, 0x6e, 0x73, 0x65, 0x63, 0x75, 0x72, 0x65, 0x12, @@ -322,18 +395,33 @@ var file_transport_internet_tls_config_proto_rawDesc = []byte{ 0x32, 0x35, 0x36, 0x12, 0x3a, 0x0a, 0x19, 0x76, 0x65, 0x72, 0x69, 0x66, 0x79, 0x5f, 0x63, 0x6c, 0x69, 0x65, 0x6e, 0x74, 0x5f, 0x63, 0x65, 0x72, 0x74, 0x69, 0x66, 0x69, 0x63, 0x61, 0x74, 0x65, 0x18, 0x08, 0x20, 0x01, 0x28, 0x08, 0x52, 0x17, 0x76, 0x65, 0x72, 0x69, 0x66, 0x79, 0x43, 0x6c, - 0x69, 0x65, 0x6e, 0x74, 0x43, 0x65, 0x72, 0x74, 0x69, 0x66, 0x69, 0x63, 0x61, 0x74, 0x65, 0x3a, - 0x17, 0x82, 0xb5, 0x18, 0x13, 0x0a, 0x08, 0x73, 0x65, 0x63, 0x75, 0x72, 0x69, 0x74, 0x79, 0x12, - 0x03, 0x74, 0x6c, 0x73, 0x90, 0xff, 0x29, 0x01, 0x42, 0x84, 0x01, 0x0a, 0x25, 0x63, 0x6f, 0x6d, - 0x2e, 0x76, 0x32, 0x72, 0x61, 0x79, 0x2e, 0x63, 0x6f, 0x72, 0x65, 0x2e, 0x74, 0x72, 0x61, 0x6e, - 0x73, 0x70, 0x6f, 0x72, 0x74, 0x2e, 0x69, 0x6e, 0x74, 0x65, 0x72, 0x6e, 0x65, 0x74, 0x2e, 0x74, - 0x6c, 0x73, 0x50, 0x01, 0x5a, 0x35, 0x67, 0x69, 0x74, 0x68, 0x75, 0x62, 0x2e, 0x63, 0x6f, 0x6d, - 0x2f, 0x76, 0x32, 0x66, 0x6c, 0x79, 0x2f, 0x76, 0x32, 0x72, 0x61, 0x79, 0x2d, 0x63, 0x6f, 0x72, - 0x65, 0x2f, 0x76, 0x35, 0x2f, 0x74, 0x72, 0x61, 0x6e, 0x73, 0x70, 0x6f, 0x72, 0x74, 0x2f, 0x69, - 0x6e, 0x74, 0x65, 0x72, 0x6e, 0x65, 0x74, 0x2f, 0x74, 0x6c, 0x73, 0xaa, 0x02, 0x21, 0x56, 0x32, - 0x52, 0x61, 0x79, 0x2e, 0x43, 0x6f, 0x72, 0x65, 0x2e, 0x54, 0x72, 0x61, 0x6e, 0x73, 0x70, 0x6f, - 0x72, 0x74, 0x2e, 0x49, 0x6e, 0x74, 0x65, 0x72, 0x6e, 0x65, 0x74, 0x2e, 0x54, 0x6c, 0x73, 0x62, - 0x06, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x33, + 0x69, 0x65, 0x6e, 0x74, 0x43, 0x65, 0x72, 0x74, 0x69, 0x66, 0x69, 0x63, 0x61, 0x74, 0x65, 0x12, + 0x55, 0x0a, 0x0b, 0x6d, 0x69, 0x6e, 0x5f, 0x76, 0x65, 0x72, 0x73, 0x69, 0x6f, 0x6e, 0x18, 0x09, + 0x20, 0x01, 0x28, 0x0e, 0x32, 0x34, 0x2e, 0x76, 0x32, 0x72, 0x61, 0x79, 0x2e, 0x63, 0x6f, 0x72, + 0x65, 0x2e, 0x74, 0x72, 0x61, 0x6e, 0x73, 0x70, 0x6f, 0x72, 0x74, 0x2e, 0x69, 0x6e, 0x74, 0x65, + 0x72, 0x6e, 0x65, 0x74, 0x2e, 0x74, 0x6c, 0x73, 0x2e, 0x43, 0x6f, 0x6e, 0x66, 0x69, 0x67, 0x2e, + 0x54, 0x4c, 0x53, 0x56, 0x65, 0x72, 0x73, 0x69, 0x6f, 0x6e, 0x52, 0x0a, 0x6d, 0x69, 0x6e, 0x56, + 0x65, 0x72, 0x73, 0x69, 0x6f, 0x6e, 0x12, 0x55, 0x0a, 0x0b, 0x6d, 0x61, 0x78, 0x5f, 0x76, 0x65, + 0x72, 0x73, 0x69, 0x6f, 0x6e, 0x18, 0x0a, 0x20, 0x01, 0x28, 0x0e, 0x32, 0x34, 0x2e, 0x76, 0x32, + 0x72, 0x61, 0x79, 0x2e, 0x63, 0x6f, 0x72, 0x65, 0x2e, 0x74, 0x72, 0x61, 0x6e, 0x73, 0x70, 0x6f, + 0x72, 0x74, 0x2e, 0x69, 0x6e, 0x74, 0x65, 0x72, 0x6e, 0x65, 0x74, 0x2e, 0x74, 0x6c, 0x73, 0x2e, + 0x43, 0x6f, 0x6e, 0x66, 0x69, 0x67, 0x2e, 0x54, 0x4c, 0x53, 0x56, 0x65, 0x72, 0x73, 0x69, 0x6f, + 0x6e, 0x52, 0x0a, 0x6d, 0x61, 0x78, 0x56, 0x65, 0x72, 0x73, 0x69, 0x6f, 0x6e, 0x22, 0x49, 0x0a, + 0x0a, 0x54, 0x4c, 0x53, 0x56, 0x65, 0x72, 0x73, 0x69, 0x6f, 0x6e, 0x12, 0x0b, 0x0a, 0x07, 0x44, + 0x65, 0x66, 0x61, 0x75, 0x6c, 0x74, 0x10, 0x00, 0x12, 0x0a, 0x0a, 0x06, 0x54, 0x4c, 0x53, 0x31, + 0x5f, 0x30, 0x10, 0x01, 0x12, 0x0a, 0x0a, 0x06, 0x54, 0x4c, 0x53, 0x31, 0x5f, 0x31, 0x10, 0x02, + 0x12, 0x0a, 0x0a, 0x06, 0x54, 0x4c, 0x53, 0x31, 0x5f, 0x32, 0x10, 0x03, 0x12, 0x0a, 0x0a, 0x06, + 0x54, 0x4c, 0x53, 0x31, 0x5f, 0x33, 0x10, 0x04, 0x3a, 0x17, 0x82, 0xb5, 0x18, 0x13, 0x0a, 0x08, + 0x73, 0x65, 0x63, 0x75, 0x72, 0x69, 0x74, 0x79, 0x12, 0x03, 0x74, 0x6c, 0x73, 0x90, 0xff, 0x29, + 0x01, 0x42, 0x84, 0x01, 0x0a, 0x25, 0x63, 0x6f, 0x6d, 0x2e, 0x76, 0x32, 0x72, 0x61, 0x79, 0x2e, + 0x63, 0x6f, 0x72, 0x65, 0x2e, 0x74, 0x72, 0x61, 0x6e, 0x73, 0x70, 0x6f, 0x72, 0x74, 0x2e, 0x69, + 0x6e, 0x74, 0x65, 0x72, 0x6e, 0x65, 0x74, 0x2e, 0x74, 0x6c, 0x73, 0x50, 0x01, 0x5a, 0x35, 0x67, + 0x69, 0x74, 0x68, 0x75, 0x62, 0x2e, 0x63, 0x6f, 0x6d, 0x2f, 0x76, 0x32, 0x66, 0x6c, 0x79, 0x2f, + 0x76, 0x32, 0x72, 0x61, 0x79, 0x2d, 0x63, 0x6f, 0x72, 0x65, 0x2f, 0x76, 0x35, 0x2f, 0x74, 0x72, + 0x61, 0x6e, 0x73, 0x70, 0x6f, 0x72, 0x74, 0x2f, 0x69, 0x6e, 0x74, 0x65, 0x72, 0x6e, 0x65, 0x74, + 0x2f, 0x74, 0x6c, 0x73, 0xaa, 0x02, 0x21, 0x56, 0x32, 0x52, 0x61, 0x79, 0x2e, 0x43, 0x6f, 0x72, + 0x65, 0x2e, 0x54, 0x72, 0x61, 0x6e, 0x73, 0x70, 0x6f, 0x72, 0x74, 0x2e, 0x49, 0x6e, 0x74, 0x65, + 0x72, 0x6e, 0x65, 0x74, 0x2e, 0x54, 0x6c, 0x73, 0x62, 0x06, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x33, } var ( @@ -348,21 +436,24 @@ func file_transport_internet_tls_config_proto_rawDescGZIP() []byte { return file_transport_internet_tls_config_proto_rawDescData } -var file_transport_internet_tls_config_proto_enumTypes = make([]protoimpl.EnumInfo, 1) +var file_transport_internet_tls_config_proto_enumTypes = make([]protoimpl.EnumInfo, 2) var file_transport_internet_tls_config_proto_msgTypes = make([]protoimpl.MessageInfo, 2) var file_transport_internet_tls_config_proto_goTypes = []interface{}{ (Certificate_Usage)(0), // 0: v2ray.core.transport.internet.tls.Certificate.Usage - (*Certificate)(nil), // 1: v2ray.core.transport.internet.tls.Certificate - (*Config)(nil), // 2: v2ray.core.transport.internet.tls.Config + (Config_TLSVersion)(0), // 1: v2ray.core.transport.internet.tls.Config.TLSVersion + (*Certificate)(nil), // 2: v2ray.core.transport.internet.tls.Certificate + (*Config)(nil), // 3: v2ray.core.transport.internet.tls.Config } var file_transport_internet_tls_config_proto_depIdxs = []int32{ 0, // 0: v2ray.core.transport.internet.tls.Certificate.usage:type_name -> v2ray.core.transport.internet.tls.Certificate.Usage - 1, // 1: v2ray.core.transport.internet.tls.Config.certificate:type_name -> v2ray.core.transport.internet.tls.Certificate - 2, // [2:2] is the sub-list for method output_type - 2, // [2:2] is the sub-list for method input_type - 2, // [2:2] is the sub-list for extension type_name - 2, // [2:2] is the sub-list for extension extendee - 0, // [0:2] is the sub-list for field type_name + 2, // 1: v2ray.core.transport.internet.tls.Config.certificate:type_name -> v2ray.core.transport.internet.tls.Certificate + 1, // 2: v2ray.core.transport.internet.tls.Config.min_version:type_name -> v2ray.core.transport.internet.tls.Config.TLSVersion + 1, // 3: v2ray.core.transport.internet.tls.Config.max_version:type_name -> v2ray.core.transport.internet.tls.Config.TLSVersion + 4, // [4:4] is the sub-list for method output_type + 4, // [4:4] is the sub-list for method input_type + 4, // [4:4] is the sub-list for extension type_name + 4, // [4:4] is the sub-list for extension extendee + 0, // [0:4] is the sub-list for field type_name } func init() { file_transport_internet_tls_config_proto_init() } @@ -401,7 +492,7 @@ func file_transport_internet_tls_config_proto_init() { File: protoimpl.DescBuilder{ GoPackagePath: reflect.TypeOf(x{}).PkgPath(), RawDescriptor: file_transport_internet_tls_config_proto_rawDesc, - NumEnums: 1, + NumEnums: 2, NumMessages: 2, NumExtensions: 0, NumServices: 0, diff --git a/transport/internet/tls/config.proto b/transport/internet/tls/config.proto index 07816697bc4..1573f07a811 100644 --- a/transport/internet/tls/config.proto +++ b/transport/internet/tls/config.proto @@ -61,4 +61,19 @@ message Config { // If true, the client is required to present a certificate. bool verify_client_certificate = 8; + + enum TLSVersion { + Default = 0; + TLS1_0 = 1; + TLS1_1 = 2; + TLS1_2 = 3; + TLS1_3 = 4; + } + + // Minimum TLS version to support. + TLSVersion min_version = 9; + + // Maximum TLS version to support. + TLSVersion max_version = 10; + }