From 1795e0a290e2ebe4096f553c916fb6f59c159747 Mon Sep 17 00:00:00 2001 From: Jakob Borg Date: Wed, 12 Nov 2014 10:47:34 +0100 Subject: [PATCH] Never use crappy cipher suites (fixes #945) --- cmd/syncthing/main.go | 8 ++++++++ 1 file changed, 8 insertions(+) diff --git a/cmd/syncthing/main.go b/cmd/syncthing/main.go index 0abc7574..6618a9b9 100644 --- a/cmd/syncthing/main.go +++ b/cmd/syncthing/main.go @@ -441,6 +441,14 @@ func syncthingMain() { SessionTicketsDisabled: true, InsecureSkipVerify: true, MinVersion: tls.VersionTLS12, + CipherSuites: []uint16{ + tls.TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256, + tls.TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256, + tls.TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA, + tls.TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA, + tls.TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA, + tls.TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA, + }, } // If the read or write rate should be limited, set up a rate limiter for it.