mirror of
https://github.com/coder/coder.git
synced 2026-11-08 05:32:55 +08:00
Colin Adler
af001773db
This cipher is included by default in Go as a fallback, but is marked as an insecure cipher. This removes the 3des cipher by default. Before: ``` $ nmap --script ssl-enum-ciphers -p 443 xxxxxxx Starting Nmap 7.94 ( https://nmap.org ) at 2024-07-08 14:16 CDT Nmap scan report for xxxxx (xxx.xxx.xxx.xxx) Host is up (0.038s latency). rDNS record for xxx.xxx.xxx.xxx: xxx.xxx.xxx.xxx.bc.googleusercontent.com PORT STATE SERVICE 443/tcp open https | ssl-enum-ciphers: | TLSv1.2: | ciphers: | TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256 (secp256r1) - A | TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256 (secp256r1) - A | TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384 (secp256r1) - A | TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA (secp256r1) - A | TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA (secp256r1) - A | TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA (secp256r1) - C | compressors: | NULL | cipher preference: server | warnings: | 64-bit block cipher 3DES vulnerable to SWEET32 attack | TLSv1.3: | ciphers: | TLS_AKE_WITH_AES_128_GCM_SHA256 (ecdh_x25519) - A | TLS_AKE_WITH_AES_256_GCM_SHA384 (ecdh_x25519) - A | TLS_AKE_WITH_CHACHA20_POLY1305_SHA256 (ecdh_x25519) - A | cipher preference: server |_ least strength: C ``` After: ``` $ nmap --script ssl-enum-ciphers -p 443 xxxxxxx Starting Nmap 7.94 ( https://nmap.org ) at 2024-07-08 15:04 CDT Nmap scan report for xxxxx (xxx.xxx.xxx.xxx) Host is up (0.039s latency). rDNS record for xxx.xxx.xxx.xxx: xxx.xxx.xxx.xxx.bc.googleusercontent.com PORT STATE SERVICE 443/tcp open https | ssl-enum-ciphers: | TLSv1.2: | ciphers: | TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA (secp256r1) - A | TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256 (secp256r1) - A | TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA (secp256r1) - A | TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384 (secp256r1) - A | TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256 (secp256r1) - A | compressors: | NULL | cipher preference: client | TLSv1.3: | ciphers: | TLS_AKE_WITH_AES_128_GCM_SHA256 (ecdh_x25519) - A | TLS_AKE_WITH_AES_256_GCM_SHA384 (ecdh_x25519) - A | TLS_AKE_WITH_CHACHA20_POLY1305_SHA256 (ecdh_x25519) - A | cipher preference: server |_ least strength: A ``` * fixup! fix!(cli): remove `TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA` cipher by default * fixup! fix!(cli): remove `TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA` cipher by default
42 lines
816 B
TOML
42 lines
816 B
TOML
[default.extend-identifiers]
|
|
alog = "alog"
|
|
Jetbrains = "JetBrains"
|
|
IST = "IST"
|
|
MacOS = "macOS"
|
|
AKS = "AKS"
|
|
O_WRONLY = "O_WRONLY"
|
|
|
|
[default.extend-words]
|
|
AKS = "AKS"
|
|
# do as sudo replacement
|
|
doas = "doas"
|
|
darcula = "darcula"
|
|
Hashi = "Hashi"
|
|
trialer = "trialer"
|
|
encrypter = "encrypter"
|
|
# as in helsinki
|
|
hel = "hel"
|
|
# this is used as proto node
|
|
pn = "pn"
|
|
# typos doesn't like the EDE in TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA
|
|
EDE = "EDE"
|
|
|
|
[files]
|
|
extend-exclude = [
|
|
"**.svg",
|
|
"**.png",
|
|
"**.lock",
|
|
"go.sum",
|
|
"go.mod",
|
|
# These files contain base64 strings that confuse the detector
|
|
"**XService**.ts",
|
|
"**identity.go",
|
|
"scripts/ci-report/testdata/**",
|
|
"**/*_test.go",
|
|
"**/*.test.tsx",
|
|
"**/pnpm-lock.yaml",
|
|
"tailnet/testdata/**",
|
|
"site/src/pages/SetupPage/countries.tsx",
|
|
"provisioner/terraform/testdata/**",
|
|
]
|