mirrors/pinniped
1
0
Fork 0
mirror of https://github.com/vmware-tanzu/pinniped.git synced 2026-07-30 12:02:56 +00:00
Code Issues Actions Packages Projects Releases Wiki Activity

Support the new Go FIPS compiler which was upgraded inside Go 1.21.6

Browse Source 
The release of Go 1.21.6 includes the new boring crypto when compiling
with FIPS enabled. See https://go.dev/doc/devel/release#go1.21.0 and
https://github.com/golang/go/issues/64717.

This new version of boring crypto allows the use of TLS v1.3 for the
first time, so we changed the Pinniped code to use TLS v1.3 where
appropriate when compiled with the FIPS compiler. It also changed the
allowed TLS v1.2 ciphers, so we updated those as well.

After this commit, the project must be compiled by at least Go v1.21.6
when compiling in fips mode. The hack/Dockerfile_fips was already
updated to use that version of Go in a previous commit.

Co-authored-by: Benjamin A. Petersen <ben@benjaminapetersen.me>
This commit is contained in:
Ryan Richard
2024-01-18 14:23:26 -08:00
co-authored by Benjamin A. Petersen
parent bcf070cb73
commit 50e4d6db6c
8 changed files with 175 additions and 99 deletions
Download Patch File Download Diff File Expand all files Collapse all files
test/integration/securetls_test.go
+26 -9
View File
@@ -1,4 +1,4 @@
// Copyright 2021-2022 the Pinniped contributors. All Rights Reserved.
// Copyright 2021-2024 the Pinniped contributors. All Rights Reserved.
// SPDX-License-Identifier: Apache-2.0
package integration
@@ -25,8 +25,8 @@ func TestSecureTLSPinnipedCLIToKAS_Parallel(t *testing.T) {
server := tlsserver.TLSTestServer(t, http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
// pinniped CLI uses ptls.Secure when talking to KAS
// in FIPs mode the distinction doesn't matter much because
// each of the configs is a wrapper for the same base FIPs config
// in FIPS mode the distinction doesn't matter much because
// each of the configs is a wrapper for the same base FIPS config
tlsserver.AssertTLS(t, r, ptls.Secure)
w.Header().Set("content-type", "application/json")
fmt.Fprint(w, `{"kind":"TokenCredentialRequest","apiVersion":"login.concierge.pinniped.dev/v1alpha1",`+
@@ -59,8 +59,8 @@ func TestSecureTLSPinnipedCLIToSupervisor_Parallel(t *testing.T) {
server := tlsserver.TLSTestServer(t, http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
// pinniped CLI uses ptls.Default when talking to supervisor
// in FIPs mode the distinction doesn't matter much because
// each of the configs is a wrapper for the same base FIPs config
// in FIPS mode the distinction doesn't matter much because
// each of the configs is a wrapper for the same base FIPS config
tlsserver.AssertTLS(t, r, ptls.Default)
w.Header().Set("content-type", "application/json")
fmt.Fprint(w, `{"issuer":"https://not-a-good-issuer"}`)
@@ -101,17 +101,34 @@ func TestSecureTLSConciergeAggregatedAPI_Parallel(t *testing.T) {
require.Contains(t, stdout, testlib.GetExpectedCiphers(ptls.Secure(nil)), "stdout:\n%s", stdout)
}
func TestSecureTLSSupervisor(t *testing.T) { // does not run in parallel because of the createSupervisorDefaultTLSCertificateSecretIfNeeded call
// TLS checks safe to run in parallel with serial tests, see main_test.go.
func TestSecureTLSSupervisorAggregatedAPI_Parallel(t *testing.T) {
env := testlib.IntegrationEnv(t)
cancelCtx, cancel := context.WithCancel(context.Background())
t.Cleanup(cancel)
startKubectlPortForward(cancelCtx, t, "10447", "443", env.SupervisorAppName+"-api", env.SupervisorNamespace)
stdout, stderr := testlib.RunNmapSSLEnum(t, "127.0.0.1", 10447)
require.Empty(t, stderr)
require.Contains(t, stdout, testlib.GetExpectedCiphers(ptls.Secure(nil)), "stdout:\n%s", stdout)
}
func TestSecureTLSSupervisor(t *testing.T) {
env := testlib.IntegrationEnv(t)
ctx, cancel := context.WithCancel(context.Background())
t.Cleanup(cancel)
startKubectlPortForward(ctx, t, "10447", "443", env.SupervisorAppName+"-nodeport", env.SupervisorNamespace)
startKubectlPortForward(ctx, t, "10448", "443", env.SupervisorAppName+"-nodeport", env.SupervisorNamespace)
stdout, stderr := testlib.RunNmapSSLEnum(t, "127.0.0.1", 10447)
stdout, stderr := testlib.RunNmapSSLEnum(t, "127.0.0.1", 10448)
// supervisor's cert is ECDSA
// The Supervisor's auto-generated bootstrap TLS cert is ECDSA, so we think that only the ECDSA ciphers
// will be available on the server for TLS 1.2. Therefore, filter the list of expected ciphers to only
// include the ECDSA ciphers.
defaultECDSAOnly := ptls.Default(nil)
ciphers := make([]uint16, 0, len(defaultECDSAOnly.CipherSuites)/2)
for _, id := range defaultECDSAOnly.CipherSuites {
test/testlib/securetls.go
+12 -10
View File
@@ -1,4 +1,4 @@
// Copyright 2022 the Pinniped contributors. All Rights Reserved.
// Copyright 2022-2024 the Pinniped contributors. All Rights Reserved.
// SPDX-License-Identifier: Apache-2.0
package testlib
@@ -18,7 +18,7 @@ import (
"github.com/stretchr/testify/require"
"go.pinniped.dev/internal/crypto/ptls"
"go.pinniped.dev/internal/testutil/tlsserver"
)
func RunNmapSSLEnum(t *testing.T, host string, port uint16) (string, string) {
@@ -51,9 +51,8 @@ func RunNmapSSLEnum(t *testing.T, host string, port uint16) (string, string) {
}
func GetExpectedCiphers(config *tls.Config) string {
secureConfig := ptls.Secure(nil)
skip12 := config.MinVersion == tls.VersionTLS13
skip13 := config.MaxVersion == tls.VersionTLS12
var tls12Bit, tls13Bit string
@@ -90,12 +89,15 @@ func GetExpectedCiphers(config *tls.Config) string {
tls12Bit = fmt.Sprintf(tls12Base, s.String(), cipherSuitePreference)
}
skip13 := config.MaxVersion == tls.VersionTLS12
if !skip13 {
var s strings.Builder
for i, id := range secureConfig.CipherSuites {
s.WriteString(fmt.Sprintf(tls13Item, strings.Replace(tls.CipherSuiteName(id), "TLS_", "TLS_AKE_WITH_", 1)))
if i == len(secureConfig.CipherSuites)-1 {
tls13CipherSuites := tlsserver.GetExpectedTLS13Ciphers()
for i, id := range tls13CipherSuites {
s.WriteString(fmt.Sprintf(tls13Item,
strings.Replace(tls.CipherSuiteName(id), "TLS_", "TLS_AKE_WITH_", 1),
tlsserver.GetExpectedTLS13CipherNMapKeyExchangeInfoValue(id)),
)
if i == len(tls13CipherSuites)-1 {
break
}
s.WriteString("\n")
@@ -114,7 +116,7 @@ const (
Nmap done: 1 IP address (1 host up) scanned in`
// cipher preference is a variable because in FIPs mode it is server
// cipher preference is a variable because in FIPS mode it is server
// but in normal mode it is client.
tls12Base = `
| TLSv1.2:
@@ -138,5 +140,5 @@ Nmap done: 1 IP address (1 host up) scanned in`
// For the RSA ciphers, we expect this output to be RSA 2048.
rsa2048 = "rsa 2048"
tls13Item = `| %s (ecdh_x25519) - A`
tls13Item = `| %s (%s) - A`
)