home: refactor override

internal/home/config.go

@@ -9,6 +9,7 @@ import (
 	"sync"
 
 	"github.com/AdguardTeam/AdGuardHome/internal/aghalg"
+	"github.com/AdguardTeam/AdGuardHome/internal/aghtls"
 	"github.com/AdguardTeam/AdGuardHome/internal/dhcpd"
 	"github.com/AdguardTeam/AdGuardHome/internal/dnsforward"
 	"github.com/AdguardTeam/AdGuardHome/internal/filtering"
@@ -380,6 +381,7 @@ func parseConfig() (err error) {
 		// we add support for HTTP/3 for web admin interface.
 		addPorts(udpPorts, udpPort(config.TLS.PortDNSOverQUIC))
 	}
+
 	if err = tcpPorts.Validate(); err != nil {
 		return fmt.Errorf("validating tcp ports: %w", err)
 	} else if err = udpPorts.Validate(); err != nil {
@@ -394,6 +396,11 @@ func parseConfig() (err error) {
 		config.DNS.UpstreamTimeout = timeutil.Duration{Duration: dnsforward.DefaultTimeout}
 	}
 
+	err = setContextTLSCipherIDs()
+	if err != nil {
+		return err
+	}
+
 	return nil
 }
 
@@ -496,3 +503,23 @@ func (c *configuration) write() (err error) {
 
 	return nil
 }
+
+// setContextTLSCipherIDs sets the TLS cipher suite IDs to use.
+func setContextTLSCipherIDs() (err error) {
+	if len(config.TLS.OverrideTLSCiphers) == 0 {
+		log.Info("tls: using default ciphers")
+
+		Context.tlsCipherIDs = aghtls.SaferCipherSuites()
+
+		return nil
+	}
+
+	log.Info("tls: overriding ciphers: %s", config.TLS.OverrideTLSCiphers)
+
+	Context.tlsCipherIDs, err = aghtls.ParseCiphers(config.TLS.OverrideTLSCiphers)
+	if err != nil {
+		return fmt.Errorf("parsing override ciphers: %w", err)
+	}
+
+	return nil
+}

internal/home/home.go

@@ -84,6 +84,10 @@ type homeContext struct {
 	transport        *http.Transport
 	client           *http.Client
 	appSignalChannel chan os.Signal // Channel for receiving OS signals by the console app
+
+	// tlsCipherIDs are the ID of the cipher suites that AdGuard Home must use.
+	tlsCipherIDs []uint16
+
 	// runningAsService flag is set to true when options are passed from the service runner
 	runningAsService bool
 }
@@ -153,7 +157,7 @@ func setupContext(opts options) {
 		Proxy:       getHTTPProxy,
 		TLSClientConfig: &tls.Config{
 			RootCAs:      Context.tlsRoots,
-			CipherSuites: aghtls.SaferCipherSuites(),
+			CipherSuites: Context.tlsCipherIDs,
 			MinVersion:   tls.VersionTLS12,
 		},
 	}
@@ -386,11 +390,6 @@ func initWeb(opts options, clientBuildFS fs.FS) (web *Web, err error) {
 		}
 	}
 
-	tlsCiphers, err := getTLSCiphers()
-	if err != nil {
-		return nil, err
-	}
-
 	webConf := webConfig{
 		firstRun:     Context.firstRun,
 		BindHost:     config.BindHost,
@@ -405,7 +404,6 @@ func initWeb(opts options, clientBuildFS fs.FS) (web *Web, err error) {
 		clientBetaFS: clientBetaFS,
 
 		serveHTTP3: config.DNS.ServeHTTP3,
-		tlsCiphers: tlsCiphers,
 	}
 
 	web = newWeb(&webConf)
@@ -916,14 +914,3 @@ type jsonError struct {
 	// Message is the error message, an opaque string.
 	Message string `json:"message"`
 }
-
-// getTLSCiphers check for overridden tls ciphers, if the slice is
-// empty, then default safe ciphers are used
-func getTLSCiphers() (cipherIds []uint16, err error) {
-	if len(config.TLS.OverrideTLSCiphers) == 0 {
-		return aghtls.SaferCipherSuites(), nil
-	} else {
-		log.Info("Overriding TLS Ciphers : %s", config.TLS.OverrideTLSCiphers)
-		return aghtls.ParseCiphers(config.TLS.OverrideTLSCiphers)
-	}
-}

internal/home/web.go

@@ -33,9 +33,6 @@ const (
 )
 
 type webConfig struct {
-	// Ciphers that are used for https listener
-	tlsCiphers []uint16
-
 	clientFS     fs.FS
 	clientBetaFS fs.FS
 
@@ -300,7 +297,7 @@ func (web *Web) tlsServerLoop() {
 			TLSConfig: &tls.Config{
 				Certificates: []tls.Certificate{web.httpsServer.cert},
 				RootCAs:      Context.tlsRoots,
-				CipherSuites: web.conf.tlsCiphers,
+				CipherSuites: Context.tlsCipherIDs,
 				MinVersion:   tls.VersionTLS12,
 			},
 			Handler:           withMiddlewares(Context.mux, limitRequestBody),
@@ -334,7 +331,7 @@ func (web *Web) mustStartHTTP3(address string) {
 		TLSConfig: &tls.Config{
 			Certificates: []tls.Certificate{web.httpsServer.cert},
 			RootCAs:      Context.tlsRoots,
-			CipherSuites: web.conf.tlsCiphers,
+			CipherSuites: Context.tlsCipherIDs,
 			MinVersion:   tls.VersionTLS12,
 		},
 		Handler: withMiddlewares(Context.mux, limitRequestBody),