From af680c1778ff04442183f3884bfc4594acf137fe Mon Sep 17 00:00:00 2001 From: CN_SZTL Date: Wed, 15 Jan 2020 18:09:55 +0800 Subject: [PATCH] luci-app-trojan-server: update ciphers and disable reuse_port in default --- .../model/cbi/passwall/api/gen_trojan_client_config_file.lua | 4 +++- .../model/cbi/trojan_server/api/gen_trojan_config_file.lua | 4 +++- 2 files changed, 6 insertions(+), 2 deletions(-) diff --git a/package/lienol/luci-app-passwall/luasrc/model/cbi/passwall/api/gen_trojan_client_config_file.lua b/package/lienol/luci-app-passwall/luasrc/model/cbi/passwall/api/gen_trojan_client_config_file.lua index e6f5e1be8f..275afb94f3 100644 --- a/package/lienol/luci-app-passwall/luasrc/model/cbi/passwall/api/gen_trojan_client_config_file.lua +++ b/package/lienol/luci-app-passwall/luasrc/model/cbi/passwall/api/gen_trojan_client_config_file.lua @@ -18,7 +18,8 @@ local trojan = { verify = (node.trojan_verify_cert == "1") and true or false, verify_hostname = true, cert = node.trojan_cert_path, - cipher = "ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:ECDHE-RSA-AES128-SHA:ECDHE-RSA-AES256-SHA:RSA-AES128-GCM-SHA256:RSA-AES256-GCM-SHA384:RSA-AES128-SHA:RSA-AES256-SHA:RSA-3DES-EDE-SHA", + cipher = "ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES256-SHA:ECDHE-ECDSA-AES128-SHA:ECDHE-RSA-AES128-SHA:ECDHE-RSA-AES256-SHA:DHE-RSA-AES128-SHA:DHE-RSA-AES256-SHA:AES128-SHA:AES256-SHA:DES-CBC3-SHA", + cipher_tls13 = "TLS_AES_128_GCM_SHA256:TLS_CHACHA20_POLY1305_SHA256:TLS_AES_256_GCM_SHA384", sni = "", alpn = {"h2", "http/1.1"}, reuse_session = true, @@ -28,6 +29,7 @@ local trojan = { tcp = { no_delay = true, keep_alive = true, + reuse_port = false, fast_open = (node.tcp_fast_open == "true") and true or false, fast_open_qlen = 20 } diff --git a/package/lienol/luci-app-trojan-server/luasrc/model/cbi/trojan_server/api/gen_trojan_config_file.lua b/package/lienol/luci-app-trojan-server/luasrc/model/cbi/trojan_server/api/gen_trojan_config_file.lua index 10eb32a7ab..e4811085e1 100644 --- a/package/lienol/luci-app-trojan-server/luasrc/model/cbi/trojan_server/api/gen_trojan_config_file.lua +++ b/package/lienol/luci-app-trojan-server/luasrc/model/cbi/trojan_server/api/gen_trojan_config_file.lua @@ -17,7 +17,8 @@ local trojan = { cert = server.ssl_certFile, key = server.ssl_keyFile, key_password = "", - cipher = "ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-SHA384:ECDHE-RSA-AES256-SHA384:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA256", + cipher = "ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES256-SHA:ECDHE-ECDSA-AES128-SHA:ECDHE-RSA-AES128-SHA:ECDHE-RSA-AES256-SHA:DHE-RSA-AES128-SHA:DHE-RSA-AES256-SHA:AES128-SHA:AES256-SHA:DES-CBC3-SHA", + cipher_tls13 = "TLS_AES_128_GCM_SHA256:TLS_CHACHA20_POLY1305_SHA256:TLS_AES_256_GCM_SHA384", prefer_server_cipher = true, alpn = {"http/1.1"}, reuse_session = true, @@ -31,6 +32,7 @@ local trojan = { prefer_ipv4 = false, no_delay = true, keep_alive = true, + reuse_port = false, fast_open = (server.fast_open == "true") and true or false, fast_open_qlen = 20 }