feat:add ssl minVersion maxVersion

#ICDIVQ

global/config.go

@@ -16,12 +16,14 @@ var (
 	GCONFIG_RECORD_LOGIN_MAX_ERROR_TIME int64 = 3 //登录周期里错误最大次数
 	GCONFIG_RECORD_LOGIN_LIMIT_MINTUTES int64 = 1 //登录错误记录周期 单位分钟最小1
 
-	GCONFIG_RECORD_ENABLE_OWASP        int64 = 0  //启动OWASP数据检测
-	GCONFIG_RECORD_ENABLE_HTTP_80      int64 = 0  //启动80端口服务（为自动申请证书使用 HTTP文件验证类型，DNS验证不需要）
-	GCONFIG_RECORD_SSLOrder_EXPIRE_DAY int64 = 30 // 提前多少天进行自动申请
-	GCONFIG_RECORD_SSLHTTP_CHECK       int64 = 1  // ssl申请文件验证类型 是否校验原始路径HTTP响应代码 1 校验 0 不校验
-	GCONFIG_RECORD_CONNECT_TIME_OUT    int64 = 30 // 连接超时 默认30s
-	GCONFIG_RECORD_KEEPALIVE_TIME_OUT  int64 = 30 // 保持活动超时 默认30s
+	GCONFIG_RECORD_ENABLE_OWASP        int64  = 0         //启动OWASP数据检测
+	GCONFIG_RECORD_ENABLE_HTTP_80      int64  = 0         //启动80端口服务（为自动申请证书使用 HTTP文件验证类型，DNS验证不需要）
+	GCONFIG_RECORD_SSLOrder_EXPIRE_DAY int64  = 30        // 提前多少天进行自动申请
+	GCONFIG_RECORD_SSLHTTP_CHECK       int64  = 1         // ssl申请文件验证类型 是否校验原始路径HTTP响应代码 1 校验 0 不校验
+	GCONFIG_RECORD_SSLMinVerson        string = "TLS 1.2" // ssl最低版本
+	GCONFIG_RECORD_SSLMaxVerson        string = "TLS 1.3" // ssl最大版本
+	GCONFIG_RECORD_CONNECT_TIME_OUT    int64  = 30        // 连接超时 默认30s
+	GCONFIG_RECORD_KEEPALIVE_TIME_OUT  int64  = 30        // 保持活动超时 默认30s
 	//GCONFIG_RECORD_PATCH_VERSION_CORE  int64 = 20250106 // 核心数据库补丁日期
 	//GCONFIG_RECORD_PATCH_VERSION_LOG   int64 = 20250106 // 日志数据库补丁日期
 	GCONFIG_RECORD_ALL_SRC_BYTE_INFO int64 = 0 //记录原始信息(默认不开启)

utils/sslutils.go

@@ -1,9 +1,11 @@
 package utils
 
 import (
+	"crypto/tls"
 	"crypto/x509"
 	"encoding/pem"
 	"fmt"
+	"strings"
 )
 
 // PrintSSLCert 打印证书信息
@@ -40,3 +42,21 @@ func PrintSSLCert(cert string) string {
 	}
 	return result
 }
+
+// TLSVersionMap maps string representations to tls version constants
+var TLSVersionMap = map[string]uint16{
+	"SSLv3":   tls.VersionSSL30, //这个已经废弃了
+	"TLS 1.0": tls.VersionTLS10,
+	"TLS 1.1": tls.VersionTLS11,
+	"TLS 1.2": tls.VersionTLS12,
+	"TLS 1.3": tls.VersionTLS13,
+}
+
+// ParseTLSVersion parses string like "TLS 1.2" into uint16 version constant
+func ParseTLSVersion(ver string) uint16 {
+	ver = strings.TrimSpace(ver)
+	if v, ok := TLSVersionMap[ver]; ok {
+		return v
+	}
+	return tls.VersionTLS12 // Default to TLS 1.2 if not found
+}

wafenginecore/wafengine.go

@@ -1246,6 +1246,8 @@ func (waf *WafEngine) StartProxyServer(innruntime innerbean.ServerRunTime) {
 						Handler: waf,
 						TLSConfig: &tls.Config{
 							GetCertificate: waf.GetCertificateFunc,
+							MinVersion:     utils.ParseTLSVersion(global.GCONFIG_RECORD_SSLMinVerson),
+							MaxVersion:     utils.ParseTLSVersion(global.GCONFIG_RECORD_SSLMaxVerson),
 						},
 					},
 				}
@@ -1266,6 +1268,8 @@ func (waf *WafEngine) StartProxyServer(innruntime innerbean.ServerRunTime) {
 					Handler: waf,
 					TLSConfig: &tls.Config{
 						GetCertificate: waf.GetCertificateFunc,
+						MinVersion:     utils.ParseTLSVersion(global.GCONFIG_RECORD_SSLMinVerson),
+						MaxVersion:     utils.ParseTLSVersion(global.GCONFIG_RECORD_SSLMaxVerson),
 					},
 				}
 				serclone, _ := waf.ServerOnline.Get(innruntime.Port)

waftask/task_config.go

@@ -131,6 +131,12 @@ func setConfigStringValue(name string, value string, change int) {
 	case "gpt_model":
 		global.GCONFIG_RECORD_GPT_MODEL = value
 		break
+	case "ssl_min_version":
+		global.GCONFIG_RECORD_SSLMinVerson = value
+		break
+	case "ssl_max_version":
+		global.GCONFIG_RECORD_SSLMaxVerson = value
+		break
 	default:
 		zlog.Warn("Unknown config item:", name)
 	}
@@ -218,6 +224,8 @@ func TaskLoadSetting(initLoad bool) {
 	updateConfigIntItem(initLoad, "ssl", "enable_http_80", global.GCONFIG_RECORD_ENABLE_HTTP_80, "启动80端口服务（为自动申请证书使用 HTTP文件验证类型需要，DNS验证不需要）", "int", "")
 	updateConfigIntItem(initLoad, "ssl", "sslorder_expire_day", global.GCONFIG_RECORD_SSLOrder_EXPIRE_DAY, "自动续期检测小于多少天开始发起自动申请 默认30天", "int", "")
 	updateConfigIntItem(initLoad, "ssl", "sslhttp_check", global.GCONFIG_RECORD_SSLHTTP_CHECK, "证书文件验证方式是否要严控后端.well-known 响应代码必须是404 301 302 ，默认1控制 0 不控制", "int", "")
+	updateConfigStringItem(initLoad, "ssl", "ssl_min_version", global.GCONFIG_RECORD_SSLMinVerson, "SSL最低版本(支持TLS 1.0,TLS 1.1,TLS 1.2,TLS 1.3)，修改后重启一下", "options", "TLS 1.0|TLS 1.0,TLS 1.1|TLS 1.1,TLS 1.2|TLS 1.2,TLS 1.3|TLS 1.3")
+	updateConfigStringItem(initLoad, "ssl", "ssl_max_version", global.GCONFIG_RECORD_SSLMaxVerson, "SSL最大版本(支持TLS 1.0,TLS 1.1,TLS 1.2,TLS 1.3)，修改后重启一下", "options", "TLS 1.0|TLS 1.0,TLS 1.1|TLS 1.1,TLS 1.2|TLS 1.2,TLS 1.3|TLS 1.3")
 
 	updateConfigIntItem(initLoad, "network", "connect_time_out", global.GCONFIG_RECORD_CONNECT_TIME_OUT, "连接超时（默认30s）", "int", "")
 	updateConfigIntItem(initLoad, "network", "keepalive_time_out", global.GCONFIG_RECORD_KEEPALIVE_TIME_OUT, "保持活动超时（默认30s）", "int", "")