all: Deprecate TLS 1.2 on sync connections (fixes #7594) (#7598)

This makes us use TLS 1.3+ on sync connections by default. A new option `insecureAllowOldTLSVersions` exists to allow communication with TLS 1.2-only clients (roughly Syncthing 1.2.2 and older). Even with that option set you get a slightly simplified setup, with the cipher suite order fixed instead of auto detected.
2021-04-26 10:04:35 +02:00
parent ef4b8a2cf8
commit 74823e81e9
9 changed files with 280 additions and 306 deletions
@@ -67,6 +67,10 @@ message OptionsConfiguration {
    // attempting outgoing connections.
    int32 connection_limit_max = 52;

+    // When set, this allows TLS 1.2 on sync connections, where we otherwise
+    // default to TLS 1.3+ only.
+    bool insecure_allow_old_tls_versions = 53 [(ext.goname)= "InsecureAllowOldTLSVersions", (ext.xml) = "insecureAllowOldTLSVersions", (ext.json) = "insecureAllowOldTLSVersions"];
+
    // Legacy deprecated
    bool            upnp_enabled           = 9000 [deprecated = true, (ext.goname) = "DeprecatedUPnPEnabled"];
    int32           upnp_lease_m           = 9001 [deprecated = true, (ext.goname) = "DeprecatedUPnPLeaseM", (ext.xml) = "upnpLeaseMinutes,omitempty"];