Added support for new cipher suites. (#58)

* Added support for two new cipher suites Signed-off-by: RohitChelluru06 <[email protected]> * Added new cipher suites Signed-off-by: RohitChelluru06 <[email protected]> --------- Signed-off-by: RohitChelluru06 <[email protected]>
IBM · Oct 27, 2023 · 53131ce · 53131ce
1 parent 689bcd1
commit 53131ce
Showing 1 changed file with 18 additions and 9 deletions.
diff --git a/ssl.go b/ssl.go
@@ -11,23 +11,32 @@ import (
 )
 
 const (
-	TLS1_CK_RSA_WITH_AES_128_GCM_SHA256     = 0x09C
-	TLS1_CK_RSA_WITH_AES_128_SHA256         = 0x03c
-	TLS1_CK_ECDHE_ECDSA_WITH_AES_128_SHA256 = 0xc023
-	TLS1_CK_ECDHE_RSA_WITH_AES_128_SHA256   = 0xc027
+        TLS1_CK_ECDHE_RSA_WITH_AES_256_GCM_SHA384 = 0xc030
+        TLS1_CK_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384 = 0xc02c
+        TLS1_CK_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256 = 0xc02b
+        TLS1_CK_RSA_WITH_AES_128_GCM_SHA256 = 0x009c
+        TLS1_CK_RSA_WITH_AES_256_GCM_SHA384 = 0x009d
+        TLS1_CK_RSA_WITH_AES_128_SHA256 = 0x03c
+        TLS1_CK_ECDHE_ECDSA_WITH_AES_128_SHA256 = 0xc023
+        TLS1_CK_ECDHE_RSA_WITH_AES_128_SHA256   = 0xc027
 )
 
 // ssl generates a function to upgrade a net.Conn based on the "sslmode" and
 // related settings. The function is nil when no upgrade should take place.
 func ssl(o values) (func(net.Conn) (net.Conn, error), error) {
 	verifyCaOnly := false
 	tlsConf := tls.Config{}
+        tlsConf.MinVersion = tls.VersionTLS12
 	tlsConf.CipherSuites = []uint16{
-		TLS1_CK_RSA_WITH_AES_128_GCM_SHA256,
-		TLS1_CK_RSA_WITH_AES_128_SHA256,
-		TLS1_CK_ECDHE_ECDSA_WITH_AES_128_SHA256,
-		TLS1_CK_ECDHE_RSA_WITH_AES_128_SHA256,
-	}
+                TLS1_CK_ECDHE_RSA_WITH_AES_256_GCM_SHA384,
+                TLS1_CK_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,
+                TLS1_CK_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,
+                TLS1_CK_RSA_WITH_AES_128_GCM_SHA256,
+                TLS1_CK_RSA_WITH_AES_256_GCM_SHA384,
+                TLS1_CK_RSA_WITH_AES_128_SHA256,
+                TLS1_CK_ECDHE_ECDSA_WITH_AES_128_SHA256,
+                TLS1_CK_ECDHE_RSA_WITH_AES_128_SHA256,
+        }
 	switch mode := o["sslmode"]; mode {
 	// "require" is the default.
 	case "", "require":