mirrors/pinniped
1
0
Fork 0
mirror of https://github.com/vmware-tanzu/pinniped.git synced 2026-01-03 11:45:45 +00:00
Code Issues Actions Packages Projects Releases Wiki Activity

Also probe aggregated API ports in new ciphers test

Browse Source 
Co-authored-by: Joshua Casey <joshuatcasey@gmail.com>
This commit is contained in:
Ryan Richard
2024-06-14 10:41:17 -07:00
parent 75ff3efb59
commit 1f8ac0ff23
7 changed files with 221 additions and 120 deletions
Download Patch File Download Diff File Expand all files Collapse all files

29
test/integration/limited_ciphers_test.go
View File

@@ -10,21 +10,34 @@ import (
"testing"
)
// TestLimitedCiphersNotFIPS_Disruptive will confirm that the Pinniped Supervisor exposes only those ciphers listed in
// configuration.
// This does not test the Concierge (which has the same feature) since the Concierge does not have exposed API
// endpoints with the Default profile.
// TestLimitedCiphersNotFIPS_Disruptive will confirm that the Pinniped Supervisor and Concierge expose only those
// ciphers listed in configuration, when compiled in non-FIPS mode.
// This does not test the CLI, since it does not have a feature to limit cipher suites.
func TestLimitedCiphersNotFIPS_Disruptive(t *testing.T) {
performLimitedCiphersTest(t,
// The user-configured ciphers for both the Supervisor and Concierge.
// This is a subset of the hardcoded ciphers from profiles.go.
[]string{
"TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256",
"TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256",
"TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384",
"TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384",
},
[]uint16{
tls.TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,
tls.TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,
})
// Expected server configuration for the Supervisor's OIDC endpoints.
&tls.Config{
MinVersion: tls.VersionTLS12, // Supervisor OIDC always allows TLS 1.2 clients to connect
MaxVersion: tls.VersionTLS13,
CipherSuites: []uint16{
// Supervisor OIDC endpoints configured with EC certs use only EC ciphers.
tls.TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,
tls.TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,
},
},
// Expected server configuration for the Supervisor and Concierge aggregated API endpoints.
&tls.Config{
MinVersion: tls.VersionTLS13, // do not allow TLS 1.2 clients to connect
MaxVersion: tls.VersionTLS13,
CipherSuites: nil, // TLS 1.3 ciphers are not configurable
},
)
}