diff options
| author | David Lönnhager <david.l@mullvad.net> | 2020-09-28 16:46:02 +0200 |
|---|---|---|
| committer | David Lönnhager <david.l@mullvad.net> | 2020-11-24 18:50:03 +0100 |
| commit | ca150b116febca516df53e6bf0ddd4162636eb47 (patch) | |
| tree | 6a9143cd8b1bd0246fd6672e9bb50176a49d757b /talpid-core | |
| parent | 299c6e6a6013f866a9f618e060edf0bfbb2fd7fc (diff) | |
| download | mullvadvpn-ca150b116febca516df53e6bf0ddd4162636eb47.tar.xz mullvadvpn-ca150b116febca516df53e6bf0ddd4162636eb47.zip | |
Force TLS 1.3 minimum for OpenVPN
Diffstat (limited to 'talpid-core')
| -rw-r--r-- | talpid-core/src/process/openvpn.rs | 8 |
1 files changed, 1 insertions, 7 deletions
diff --git a/talpid-core/src/process/openvpn.rs b/talpid-core/src/process/openvpn.rs index e4172ff4ec..5193784eb8 100644 --- a/talpid-core/src/process/openvpn.rs +++ b/talpid-core/src/process/openvpn.rs @@ -30,7 +30,7 @@ static BASE_ARGUMENTS: &[&[&str]] = &[ &["--sndbuf", "1048576"], &["--fast-io"], &["--cipher", "AES-256-CBC"], - &["--tls-version-min", "1.2"], + &["--tls-version-min", "1.3"], &["--verb", "3"], #[cfg(windows)] &[ @@ -47,10 +47,6 @@ static BASE_ARGUMENTS: &[&[&str]] = &[ &["--route-noexec"], ]; -static ALLOWED_TLS1_2_CIPHERS: &[&str] = &[ - "TLS-DHE-RSA-WITH-AES-256-GCM-SHA384", - "TLS-DHE-RSA-WITH-AES-256-CBC-SHA", -]; static ALLOWED_TLS1_3_CIPHERS: &[&str] = &["TLS_AES_256_GCM_SHA384", "TLS_CHACHA20_POLY1305_SHA256"]; @@ -274,8 +270,6 @@ impl OpenVpnCommand { fn tls_cipher_arguments() -> Vec<String> { let mut args = vec![]; - args.push("--tls-cipher".to_owned()); - args.push(ALLOWED_TLS1_2_CIPHERS.join(":")); args.push("--tls-ciphersuites".to_owned()); args.push(ALLOWED_TLS1_3_CIPHERS.join(":")); args |