Something went wrong. Try again.
Cloudflare Tunnel client with NetBSD support
Something went wrong. Try again.
1.7 kB · 35 lines
Go
123456789101112131415161718192021222324252627282930313233343536// Package crypto centralizes the cryptographic primitives and TLS// configuration used by cloudflared when establishing connections to the// Cloudflare edge.//// The primary responsibility of the package is to expose a single, canonical// source of TLS curve preferences so that every edge-facing transport (QUIC// and HTTP/2) negotiates the same key-exchange algorithms regardless of the// code path that sets up the connection.//// # Post-Quantum key exchange//// cloudflared supports the X25519MLKEM768 hybrid post-quantum key exchange.// Two operating modes are exposed via the features.PostQuantumMode flag://// - PostQuantumPrefer: advertise X25519MLKEM768 and the deprecated// P256Kyber768Draft00 first, then fall back to the classical CurveP256// if the peer does not support either PQ curve. This is the default// used for every outbound edge connection.// - PostQuantumStrict: advertise only the PQ curves (X25519MLKEM768 and// P256Kyber768Draft00). Activated by the user via the --post-quantum// CLI flag. No classical fallback is offered, so a peer that does not// support any PQ curve will fail the handshake.//// The resulting curve lists are identical under FIPS and non-FIPS builds,// which is why GetCurvePreferences does not take a FIPS toggle. If that// property ever changes (for example, if a curve stops being FIPS-approved),// the divergence should be expressed inside this package so callers remain// unchanged.//// # Thread-safety//// GetCurvePreferences returns a fresh slice on every call. Callers are free// to mutate the returned slice without affecting the package-level defaults// or other callers.package crypto