Add insecure cipher suites for Axis cameras#2212
Conversation
There was a problem hiding this comment.
Pull request overview
This PR expands the set of insecure TLS cipher suites used by pkg/tcp when connecting to endpoints that require relaxed TLS settings (notably Axis cameras hitting tls: handshake failure per #2211).
Changes:
- Add two RSA+AES-CBC-SHA1 cipher suites to the existing
insecureConfigTLS cipher list. - Broaden compatibility with legacy Axis camera TLS stacks that don’t support the currently-offered suites.
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
| // this cipher suites disabled starting from https://tip.golang.org/doc/go1.22 | ||
| // but cameras can't work without them https://github.com/AlexxIT/go2rtc/issues/1172 | ||
| tls.TLS_RSA_WITH_AES_128_GCM_SHA256, // insecure | ||
| tls.TLS_RSA_WITH_AES_256_GCM_SHA384, // insecure | ||
| tls.TLS_RSA_WITH_AES_128_CBC_SHA, // insecure | ||
| tls.TLS_RSA_WITH_AES_256_CBC_SHA, // insecure |
There was a problem hiding this comment.
The comment above these cipher suites has a grammar issue ("this cipher suites") and now no longer reflects why the additional RSA+CBC suites were added. Please fix the wording (e.g., "these cipher suites are disabled...") and include a reference to the Axis handshake failure issue (#2211) alongside #1172 so future readers understand why these specific suites are enabled.
| tls.TLS_RSA_WITH_AES_128_CBC_SHA, // insecure | ||
| tls.TLS_RSA_WITH_AES_256_CBC_SHA, // insecure |
There was a problem hiding this comment.
Adding TLS_RSA_WITH_AES_{128,256}_CBC_SHA expands the insecureConfig cipher list for both the explicit "httpx" scheme and all "https" requests to IP hosts. Because servers may select these weaker non-AEAD SHA1 CBC suites even when stronger options are available, consider enabling them only as a fallback (e.g., retry the handshake after a failure with a broader cipher list) or gating them behind an explicit opt-in to avoid unintended downgrade of connections that would otherwise negotiate a better cipher.
Adding two insecure cipher suites to succeed to connect to Axis cameras.
#2211