mirror of
https://github.com/vmware-tanzu/pinniped.git
synced 2026-08-15 11:46:12 +00:00
Refactor to make profiles.go and profiles_fips_strict.go more similar
Co-authored-by: Joshua Casey <joshuatcasey@gmail.com>
This commit is contained in:
Ryan Richard
co-authored by
Joshua Casey
Joshua Casey
parent
4ab2ed10f5
commit
f0f9efa277
@@ -218,8 +218,12 @@ no_proxy: "$(KUBERNETES_SERVICE_HOST),169.254.169.254,127.0.0.1,localhost,.svc,.
|
||||
#@schema/title "Allowed Ciphers for TLS 1.2"
|
||||
#@ allowed_ciphers_for_tls_onedottwo_desc = "When specified, only the ciphers listed will be used for TLS 1.2. \
|
||||
#@ This includes both server-side and client-side TLS connections. \
|
||||
#@ Specify only secure cipher names from golang's crypto/tls package. \
|
||||
#@ This list must only include cipher suites that Pinniped is configured to accept (see the internal/crypto/ptls package). \
|
||||
#@ This list must only include cipher suites that Pinniped is configured to accept \
|
||||
#@ (see internal/crypto/ptls/profiles.go and internal/crypto/ptls/profiles_fips_strict.go). \
|
||||
#@ Allowing too few ciphers may cause critical parts of Pinniped to be unable to function. For example, \
|
||||
#@ Kubernetes pod readiness checks, Pinniped pods acting as a client to the Kubernetes API server, \
|
||||
#@ Pinniped pods acting as a client to external identity providers, or Pinniped pods acting as an APIService server \
|
||||
#@ all need to be able to function with the allowed TLS cipher suites. \
|
||||
#@ An empty array means accept Pinniped's defaults."
|
||||
#@schema/desc allowed_ciphers_for_tls_onedottwo_desc
|
||||
#@schema/examples ("Example with a few secure ciphers", ["TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256"])
|
||||
|
||||
@@ -207,8 +207,12 @@ endpoints: { }
|
||||
#@schema/title "Allowed Ciphers for TLS 1.2"
|
||||
#@ allowed_ciphers_for_tls_onedottwo_desc = "When specified, only the ciphers listed will be used for TLS 1.2. \
|
||||
#@ This includes both server-side and client-side TLS connections. \
|
||||
#@ Specify only secure cipher names from golang's crypto/tls package. \
|
||||
#@ This list must only include cipher suites that Pinniped is configured to accept (see the internal/crypto/ptls package). \
|
||||
#@ This list must only include cipher suites that Pinniped is configured to accept \
|
||||
#@ (see internal/crypto/ptls/profiles.go and internal/crypto/ptls/profiles_fips_strict.go). \
|
||||
#@ Allowing too few ciphers may cause critical parts of Pinniped to be unable to function. For example, \
|
||||
#@ Kubernetes pod readiness checks, Pinniped pods acting as a client to the Kubernetes API server, \
|
||||
#@ Pinniped pods acting as a client to external identity providers, or Pinniped pods acting as an APIService server \
|
||||
#@ all need to be able to function with the allowed TLS cipher suites. \
|
||||
#@ An empty array means accept Pinniped's defaults."
|
||||
#@schema/desc allowed_ciphers_for_tls_onedottwo_desc
|
||||
#@schema/examples ("Example with a few secure ciphers", ["TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256"])
|
||||
|
||||
@@ -30,9 +30,9 @@ type SetAllowedCiphers func([]string) error
|
||||
// SetUserConfiguredCiphersForTLSOneDotTwo allows configuration/setup components to constrain the allowed TLS ciphers
|
||||
// for TLS1.2.
|
||||
func SetUserConfiguredCiphersForTLSOneDotTwo(userConfiguredCiphersForTLSOneDotTwo []string) error {
|
||||
plog.Debug("setting user-configured allowed ciphers for TLS 1.2", "userConfiguredAllowedCipherSuites", userConfiguredCiphersForTLSOneDotTwo)
|
||||
plog.Info("setting user-configured allowed ciphers for TLS 1.2", "userConfiguredAllowedCipherSuites", userConfiguredCiphersForTLSOneDotTwo)
|
||||
|
||||
validatedUserConfiguredAllowedCipherSuites, err := validateAllowedCiphers(hardcodedCipherSuites(), userConfiguredCiphersForTLSOneDotTwo)
|
||||
validatedUserConfiguredAllowedCipherSuites, err := validateAllowedCiphers(allHardcodedAllowedCipherSuites(), userConfiguredCiphersForTLSOneDotTwo)
|
||||
if err != nil {
|
||||
return err
|
||||
}
|
||||
@@ -191,3 +191,23 @@ func validateAllowedCiphers(
|
||||
|
||||
return validCiphers, nil
|
||||
}
|
||||
|
||||
// allHardcodedAllowedCipherSuites returns the full list of all hardcoded ciphers that are allowed for any profile.
|
||||
// Note that it will return different values depending on if the code was compiled in FIPS or non-FIPS mode.
|
||||
func allHardcodedAllowedCipherSuites() []*tls.CipherSuite {
|
||||
// First append all secure and LDAP cipher suites.
|
||||
result := translateIDIntoSecureCipherSuites(append(secureCipherSuiteIDs, additionalSecureCipherSuiteIDsOnlyForLDAPClients...))
|
||||
|
||||
// Then append any insecure cipher suites that might be allowed.
|
||||
// insecureCipherSuiteIDs is empty except when compiled in FIPS mode.
|
||||
for _, golangInsecureCipherSuite := range tls.InsecureCipherSuites() {
|
||||
if !slices.Contains(golangInsecureCipherSuite.SupportedVersions, tls.VersionTLS12) {
|
||||
continue
|
||||
}
|
||||
|
||||
if slices.Contains(insecureCipherSuiteIDs, golangInsecureCipherSuite.ID) {
|
||||
result = append(result, golangInsecureCipherSuite)
|
||||
}
|
||||
}
|
||||
return result
|
||||
}
|
||||
|
||||
@@ -1,6 +1,7 @@
|
||||
// Copyright 2021-2024 the Pinniped contributors. All Rights Reserved.
|
||||
// SPDX-License-Identifier: Apache-2.0
|
||||
|
||||
// Note that everything in this file is overridden by profiles_fips_strict.go when Pinniped is built in FIPS-only mode.
|
||||
//go:build !fips_strict
|
||||
|
||||
package ptls
|
||||
@@ -17,6 +18,62 @@ import (
|
||||
"go.pinniped.dev/internal/plog"
|
||||
)
|
||||
|
||||
var (
|
||||
// secureCipherSuiteIDs is the list of TLS ciphers to use for both clients and servers when using TLS 1.2.
|
||||
//
|
||||
// The order does not matter in go 1.17+ https://go.dev/blog/tls-cipher-suites.
|
||||
// We match crypto/tls.cipherSuitesPreferenceOrder because it makes unit tests easier to write.
|
||||
//
|
||||
// as of 2021-10-19, Mozilla Guideline v5.6, Go 1.17.2, intermediate configuration, supports:
|
||||
// - Firefox 27
|
||||
// - Android 4.4.2
|
||||
// - Chrome 31
|
||||
// - Edge
|
||||
// - IE 11 on Windows 7
|
||||
// - Java 8u31
|
||||
// - OpenSSL 1.0.1
|
||||
// - Opera 20
|
||||
// - Safari 9
|
||||
// https://ssl-config.mozilla.org/#server=go&version=1.17.2&config=intermediate&guideline=5.6
|
||||
//
|
||||
// The Kubernetes API server must use approved cipher suites.
|
||||
// https://stigviewer.com/stig/kubernetes/2021-06-17/finding/V-242418
|
||||
//
|
||||
// These are all AEADs with ECDHE, some use ChaCha20Poly1305 while others use AES-GCM,
|
||||
// which provides forward secrecy, confidentiality and authenticity of data.
|
||||
secureCipherSuiteIDs = []uint16{ //nolint:gochecknoglobals // please treat this as a const
|
||||
tls.TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,
|
||||
tls.TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,
|
||||
tls.TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,
|
||||
tls.TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,
|
||||
tls.TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256,
|
||||
tls.TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256,
|
||||
}
|
||||
|
||||
// insecureCipherSuiteIDs is a list of additional ciphers that should be allowed for both clients
|
||||
// and servers when using TLS 1.2.
|
||||
//
|
||||
// This list is empty when compiled in non-FIPS mode, so we will not use any insecure ciphers in non-FIPS mode.
|
||||
insecureCipherSuiteIDs []uint16 //nolint:gochecknoglobals // please treat this as a const
|
||||
|
||||
// additionalSecureCipherSuiteIDsOnlyForLDAPClients are additional ciphers to use only for LDAP clients
|
||||
// when using TLS 1.2. These can be used when the Pinniped Supervisor is making calls to an LDAP server
|
||||
// configured by an LDAPIdentityProvider or ActiveDirectoryIdentityProvider.
|
||||
//
|
||||
// Adds less secure ciphers to support the default AWS Active Directory config.
|
||||
//
|
||||
// These are all CBC with ECDHE. Golang considers these to be secure. However,
|
||||
// these provide forward secrecy and confidentiality of data, but not authenticity.
|
||||
// MAC-then-Encrypt CBC ciphers are susceptible to padding oracle attacks.
|
||||
// See https://crypto.stackexchange.com/a/205 and https://crypto.stackexchange.com/a/224
|
||||
additionalSecureCipherSuiteIDsOnlyForLDAPClients = []uint16{ //nolint:gochecknoglobals // please treat this as a const
|
||||
tls.TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA,
|
||||
tls.TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA,
|
||||
tls.TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA,
|
||||
tls.TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA,
|
||||
}
|
||||
)
|
||||
|
||||
// init prints a log message to tell the operator how Pinniped was compiled. This makes it obvious
|
||||
// that they are using Pinniped in FIPS-mode or not, which is otherwise hard to observe.
|
||||
func init() { //nolint:gochecknoinits
|
||||
@@ -41,14 +98,17 @@ const SecureTLSConfigMinTLSVersion = tls.VersionTLS13
|
||||
// Note that this will behave differently when compiled in FIPS mode (see profiles_fips_strict.go).
|
||||
// Default returns a tls.Config with a minimum of TLS1.2+ and a few ciphers that can be further constrained by configuration.
|
||||
func Default(rootCAs *x509.CertPool) *tls.Config {
|
||||
return buildTLSConfig(rootCAs, cipherSuitesForDefault(), getUserConfiguredCiphersAllowList())
|
||||
ciphers := translateIDIntoSecureCipherSuites(secureCipherSuiteIDs)
|
||||
return buildTLSConfig(rootCAs, ciphers, getUserConfiguredCiphersAllowList())
|
||||
}
|
||||
|
||||
// DefaultLDAP TLS profile should be used by clients who need to interact with potentially old LDAP servers
|
||||
// that might not support TLS 1.3 and that might use older ciphers.
|
||||
// Note that this will behave differently when compiled in FIPS mode (see profiles_fips_strict.go).
|
||||
func DefaultLDAP(rootCAs *x509.CertPool) *tls.Config {
|
||||
return buildTLSConfig(rootCAs, cipherSuitesForDefaultLDAP(), getUserConfiguredCiphersAllowList())
|
||||
ciphers := translateIDIntoSecureCipherSuites(secureCipherSuiteIDs)
|
||||
ciphers = append(ciphers, translateIDIntoSecureCipherSuites(additionalSecureCipherSuiteIDsOnlyForLDAPClients)...)
|
||||
return buildTLSConfig(rootCAs, ciphers, getUserConfiguredCiphersAllowList())
|
||||
}
|
||||
|
||||
// Secure TLS profile should be used by:
|
||||
@@ -85,63 +145,3 @@ func SecureServing(opts *options.SecureServingOptionsWithLoopback) {
|
||||
opts.MinTLSVersion = "VersionTLS13"
|
||||
opts.CipherSuites = nil
|
||||
}
|
||||
|
||||
func hardcodedCipherSuites() []*tls.CipherSuite {
|
||||
return cipherSuitesForDefaultLDAP()
|
||||
}
|
||||
|
||||
// cipherSuitesForDefault are the ciphers that Pinniped allows.
|
||||
// It will be a strict subset of tls.CipherSuites.
|
||||
func cipherSuitesForDefault() []*tls.CipherSuite {
|
||||
// the order does not matter in go 1.17+ https://go.dev/blog/tls-cipher-suites
|
||||
// we match crypto/tls.cipherSuitesPreferenceOrder because it makes unit tests easier to write
|
||||
// this list is ignored when TLS 1.3 is used
|
||||
//
|
||||
// as of 2021-10-19, Mozilla Guideline v5.6, Go 1.17.2, intermediate configuration, supports:
|
||||
// - Firefox 27
|
||||
// - Android 4.4.2
|
||||
// - Chrome 31
|
||||
// - Edge
|
||||
// - IE 11 on Windows 7
|
||||
// - Java 8u31
|
||||
// - OpenSSL 1.0.1
|
||||
// - Opera 20
|
||||
// - Safari 9
|
||||
// https://ssl-config.mozilla.org/#server=go&version=1.17.2&config=intermediate&guideline=5.6
|
||||
//
|
||||
// The Kubernetes API server must use approved cipher suites.
|
||||
// https://stigviewer.com/stig/kubernetes/2021-06-17/finding/V-242418
|
||||
|
||||
// These are all AEADs with ECDHE, some use ChaCha20Poly1305 while others use AES-GCM,
|
||||
// which provides forward secrecy, confidentiality and authenticity of data.
|
||||
cipherSuiteIDsForDefault := []uint16{
|
||||
tls.TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,
|
||||
tls.TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,
|
||||
tls.TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,
|
||||
tls.TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,
|
||||
tls.TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256,
|
||||
tls.TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256,
|
||||
}
|
||||
|
||||
return translateIDIntoSecureCipherSuites(cipherSuiteIDsForDefault)
|
||||
}
|
||||
|
||||
// cipherSuitesForDefaultLDAP are some additional ciphers that Pinniped allows only for LDAP.
|
||||
// It will be a strict subset of tls.CipherSuites.
|
||||
func cipherSuitesForDefaultLDAP() []*tls.CipherSuite {
|
||||
// Add less secure ciphers to support the default AWS Active Directory config
|
||||
//
|
||||
// CBC with ECDHE
|
||||
// this provides forward secrecy and confidentiality of data but not authenticity
|
||||
// MAC-then-Encrypt CBC ciphers are susceptible to padding oracle attacks
|
||||
// See https://crypto.stackexchange.com/a/205 and https://crypto.stackexchange.com/a/224
|
||||
cipherSuiteIDsForDefaultLDAP := []uint16{
|
||||
tls.TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA,
|
||||
tls.TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA,
|
||||
tls.TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA,
|
||||
tls.TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA,
|
||||
}
|
||||
result := cipherSuitesForDefault()
|
||||
result = append(result, translateIDIntoSecureCipherSuites(cipherSuiteIDsForDefaultLDAP)...)
|
||||
return result
|
||||
}
|
||||
|
||||
@@ -1,7 +1,7 @@
|
||||
// Copyright 2022-2024 the Pinniped contributors. All Rights Reserved.
|
||||
// SPDX-License-Identifier: Apache-2.0
|
||||
|
||||
// The configurations here override the usual configs when Pinniped is built in fips-only mode.
|
||||
// This file overrides profiles.go when Pinniped is built in FIPS-only mode.
|
||||
//go:build fips_strict
|
||||
|
||||
package ptls
|
||||
@@ -12,7 +12,6 @@ import (
|
||||
"os"
|
||||
"path/filepath"
|
||||
"runtime"
|
||||
"slices"
|
||||
|
||||
"k8s.io/apiserver/pkg/server/options"
|
||||
|
||||
@@ -21,6 +20,37 @@ import (
|
||||
"go.pinniped.dev/internal/plog"
|
||||
)
|
||||
|
||||
// The union of these three variables is all the FIPS-approved TLS 1.2 ciphers.
|
||||
// If this list does not match the boring crypto compiler's list then the TestFIPSCipherSuites integration
|
||||
// test should fail, which indicates that this list needs to be updated.
|
||||
var (
|
||||
// secureCipherSuiteIDs is the list of TLS ciphers to use for both clients and servers when using TLS 1.2.
|
||||
//
|
||||
// FIPS allows the use of these ciphers which golang considers secure.
|
||||
secureCipherSuiteIDs = []uint16{
|
||||
tls.TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,
|
||||
tls.TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,
|
||||
tls.TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,
|
||||
tls.TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,
|
||||
}
|
||||
|
||||
// insecureCipherSuiteIDs is a list of additional ciphers that should be allowed for both clients
|
||||
// and servers when using TLS 1.2.
|
||||
//
|
||||
// FIPS allows the use of these specific ciphers that golang considers insecure.
|
||||
insecureCipherSuiteIDs = []uint16{
|
||||
tls.TLS_RSA_WITH_AES_128_GCM_SHA256,
|
||||
tls.TLS_RSA_WITH_AES_256_GCM_SHA384,
|
||||
}
|
||||
|
||||
// additionalSecureCipherSuiteIDsOnlyForLDAPClients are additional ciphers to use only for LDAP clients
|
||||
// when using TLS 1.2. These can be used when the Pinniped Supervisor is making calls to an LDAP server
|
||||
// configured by an LDAPIdentityProvider or ActiveDirectoryIdentityProvider.
|
||||
//
|
||||
// When compiled in FIPS mode, there are no extras for LDAP clients.
|
||||
additionalSecureCipherSuiteIDsOnlyForLDAPClients []uint16
|
||||
)
|
||||
|
||||
// init: see comment in profiles.go.
|
||||
func init() {
|
||||
switch filepath.Base(os.Args[0]) {
|
||||
@@ -41,8 +71,10 @@ const SecureTLSConfigMinTLSVersion = tls.VersionTLS12
|
||||
|
||||
// Default: see comment in profiles.go.
|
||||
// This chooses different cipher suites and/or TLS versions compared to non-FIPS mode.
|
||||
// In FIPS mode, this will use the union of the secureCipherSuiteIDs, additionalSecureCipherSuiteIDsOnlyForLDAPClients,
|
||||
// and insecureCipherSuiteIDs values defined above.
|
||||
func Default(rootCAs *x509.CertPool) *tls.Config {
|
||||
config := buildTLSConfig(rootCAs, hardcodedCipherSuites(), getUserConfiguredCiphersAllowList())
|
||||
config := buildTLSConfig(rootCAs, allHardcodedAllowedCipherSuites(), getUserConfiguredCiphersAllowList())
|
||||
// Until goboring supports TLS 1.3, make the max version 1.2.
|
||||
config.MaxVersion = tls.VersionTLS12
|
||||
return config
|
||||
@@ -50,6 +82,7 @@ func Default(rootCAs *x509.CertPool) *tls.Config {
|
||||
|
||||
// DefaultLDAP: see comment in profiles.go.
|
||||
// This chooses different cipher suites and/or TLS versions compared to non-FIPS mode.
|
||||
// In FIPS mode, this is not any different from the Default profile.
|
||||
func DefaultLDAP(rootCAs *x509.CertPool) *tls.Config {
|
||||
return Default(rootCAs)
|
||||
}
|
||||
@@ -57,6 +90,7 @@ func DefaultLDAP(rootCAs *x509.CertPool) *tls.Config {
|
||||
// Secure: see comment in profiles.go.
|
||||
// This chooses different cipher suites and/or TLS versions compared to non-FIPS mode.
|
||||
// Until goboring supports TLS 1.3, make the Secure profile the same as the Default profile in FIPS mode.
|
||||
// Until then, this is not any different from the Default profile in FIPS mode.
|
||||
func Secure(rootCAs *x509.CertPool) *tls.Config {
|
||||
return Default(rootCAs)
|
||||
}
|
||||
@@ -67,34 +101,3 @@ func Secure(rootCAs *x509.CertPool) *tls.Config {
|
||||
func SecureServing(opts *options.SecureServingOptionsWithLoopback) {
|
||||
defaultServing(opts)
|
||||
}
|
||||
|
||||
func hardcodedCipherSuites() []*tls.CipherSuite {
|
||||
// This is all the fips-approved TLS 1.2 ciphers.
|
||||
// The list is hard-coded for convenience of testing.
|
||||
// If this list does not match the boring crypto compiler's list then the TestFIPSCipherSuites integration
|
||||
// test should fail, which indicates that this list needs to be updated.
|
||||
secureCipherSuiteIDsForFIPS := []uint16{
|
||||
tls.TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,
|
||||
tls.TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,
|
||||
tls.TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,
|
||||
tls.TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,
|
||||
}
|
||||
|
||||
insecureCipherSuiteIDsForFIPS := []uint16{
|
||||
tls.TLS_RSA_WITH_AES_128_GCM_SHA256,
|
||||
tls.TLS_RSA_WITH_AES_256_GCM_SHA384,
|
||||
}
|
||||
|
||||
result := translateIDIntoSecureCipherSuites(secureCipherSuiteIDsForFIPS)
|
||||
|
||||
for _, golangInsecureCipherSuite := range tls.InsecureCipherSuites() {
|
||||
if !slices.Contains(golangInsecureCipherSuite.SupportedVersions, tls.VersionTLS12) {
|
||||
continue
|
||||
}
|
||||
|
||||
if slices.Contains(insecureCipherSuiteIDsForFIPS, golangInsecureCipherSuite.ID) {
|
||||
result = append(result, golangInsecureCipherSuite)
|
||||
}
|
||||
}
|
||||
return result
|
||||
}
|
||||
|
||||
@@ -6,7 +6,6 @@ package ptls
|
||||
import (
|
||||
"crypto/tls"
|
||||
"crypto/x509"
|
||||
"slices"
|
||||
"testing"
|
||||
|
||||
"github.com/stretchr/testify/require"
|
||||
@@ -19,7 +18,6 @@ func TestDefault(t *testing.T) {
|
||||
|
||||
aCertPool := x509.NewCertPool()
|
||||
|
||||
actual := Default(aCertPool)
|
||||
expected := &tls.Config{
|
||||
MinVersion: tls.VersionTLS12,
|
||||
CipherSuites: []uint16{
|
||||
@@ -34,7 +32,7 @@ func TestDefault(t *testing.T) {
|
||||
RootCAs: aCertPool,
|
||||
}
|
||||
|
||||
require.Equal(t, expected, actual)
|
||||
require.Equal(t, expected, Default(aCertPool))
|
||||
}
|
||||
|
||||
func TestDefaultLDAP(t *testing.T) {
|
||||
@@ -42,7 +40,6 @@ func TestDefaultLDAP(t *testing.T) {
|
||||
|
||||
aCertPool := x509.NewCertPool()
|
||||
|
||||
actual := DefaultLDAP(aCertPool)
|
||||
expected := &tls.Config{
|
||||
MinVersion: tls.VersionTLS12,
|
||||
CipherSuites: []uint16{
|
||||
@@ -61,7 +58,7 @@ func TestDefaultLDAP(t *testing.T) {
|
||||
RootCAs: aCertPool,
|
||||
}
|
||||
|
||||
require.Equal(t, expected, actual)
|
||||
require.Equal(t, expected, DefaultLDAP(aCertPool))
|
||||
}
|
||||
|
||||
func TestSecure(t *testing.T) {
|
||||
@@ -69,7 +66,6 @@ func TestSecure(t *testing.T) {
|
||||
|
||||
aCertPool := x509.NewCertPool()
|
||||
|
||||
actual := Secure(aCertPool)
|
||||
expected := &tls.Config{
|
||||
MinVersion: tls.VersionTLS13,
|
||||
CipherSuites: nil, // TLS 1.3 ciphers are not configurable
|
||||
@@ -77,19 +73,22 @@ func TestSecure(t *testing.T) {
|
||||
RootCAs: aCertPool,
|
||||
}
|
||||
|
||||
require.Equal(t, expected, actual)
|
||||
require.Equal(t, expected, Secure(aCertPool))
|
||||
}
|
||||
|
||||
func TestSecureServing(t *testing.T) {
|
||||
t.Parallel()
|
||||
|
||||
opts := &options.SecureServingOptionsWithLoopback{SecureServingOptions: &options.SecureServingOptions{}}
|
||||
SecureServing(opts)
|
||||
require.Equal(t, options.SecureServingOptionsWithLoopback{
|
||||
|
||||
expected := options.SecureServingOptionsWithLoopback{
|
||||
SecureServingOptions: &options.SecureServingOptions{
|
||||
MinTLSVersion: "VersionTLS13",
|
||||
},
|
||||
}, *opts)
|
||||
}
|
||||
|
||||
SecureServing(opts)
|
||||
require.Equal(t, expected, *opts)
|
||||
}
|
||||
|
||||
func TestCipherSuitesForDefault(t *testing.T) {
|
||||
@@ -103,31 +102,17 @@ func TestCipherSuitesForDefault(t *testing.T) {
|
||||
tls.TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256,
|
||||
}
|
||||
|
||||
actual := cipherSuitesForDefault()
|
||||
|
||||
require.Equal(t, len(expected), len(actual))
|
||||
for _, suite := range actual {
|
||||
require.True(t, slices.Contains(expected, suite.ID))
|
||||
}
|
||||
require.Equal(t, expected, Default(nil).CipherSuites)
|
||||
})
|
||||
|
||||
t.Run("is a subset of TestCipherSuitesForDefaultLDAP", func(t *testing.T) {
|
||||
a1 := cipherSuitesForDefault()
|
||||
a2 := cipherSuitesForDefaultLDAP()
|
||||
defaultSuiteIDs := Default(nil).CipherSuites
|
||||
ldapSuiteIDs := DefaultLDAP(nil).CipherSuites
|
||||
|
||||
require.Greater(t, len(a1), 0)
|
||||
require.GreaterOrEqual(t, len(a2), len(a1))
|
||||
require.Greater(t, len(defaultSuiteIDs), 0)
|
||||
require.GreaterOrEqual(t, len(ldapSuiteIDs), len(defaultSuiteIDs))
|
||||
|
||||
a1ids := sets.New[uint16]()
|
||||
for _, suite := range a1 {
|
||||
a1ids.Insert(suite.ID)
|
||||
}
|
||||
a2ids := sets.New[uint16]()
|
||||
for _, suite := range a1 {
|
||||
a2ids.Insert(suite.ID)
|
||||
}
|
||||
|
||||
require.Equal(t, 0, a1ids.Difference(a2ids).Len())
|
||||
require.Equal(t, 0, sets.New[uint16](defaultSuiteIDs...).Difference(sets.New[uint16](ldapSuiteIDs...)).Len())
|
||||
})
|
||||
}
|
||||
|
||||
@@ -148,30 +133,16 @@ func TestCipherSuitesForDefaultLDAP(t *testing.T) {
|
||||
tls.TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA,
|
||||
}
|
||||
|
||||
actual := cipherSuitesForDefaultLDAP()
|
||||
|
||||
require.Equal(t, len(expected), len(actual))
|
||||
for _, suite := range actual {
|
||||
require.True(t, slices.Contains(expected, suite.ID))
|
||||
}
|
||||
require.Equal(t, expected, DefaultLDAP(nil).CipherSuites)
|
||||
})
|
||||
|
||||
t.Run("is a superset of TestCipherSuitesForDefault", func(t *testing.T) {
|
||||
a1 := cipherSuitesForDefault()
|
||||
a2 := cipherSuitesForDefaultLDAP()
|
||||
defaultSuiteIDs := Default(nil).CipherSuites
|
||||
ldapSuiteIDs := DefaultLDAP(nil).CipherSuites
|
||||
|
||||
require.Greater(t, len(a1), 0)
|
||||
require.GreaterOrEqual(t, len(a2), len(a1))
|
||||
require.Greater(t, len(defaultSuiteIDs), 0)
|
||||
require.GreaterOrEqual(t, len(ldapSuiteIDs), len(defaultSuiteIDs))
|
||||
|
||||
a1ids := sets.New[uint16]()
|
||||
for _, suite := range a1 {
|
||||
a1ids.Insert(suite.ID)
|
||||
}
|
||||
a2ids := sets.New[uint16]()
|
||||
for _, suite := range a1 {
|
||||
a2ids.Insert(suite.ID)
|
||||
}
|
||||
|
||||
require.True(t, a2ids.IsSuperset(a1ids))
|
||||
require.True(t, sets.New[uint16](ldapSuiteIDs...).IsSuperset(sets.New[uint16](defaultSuiteIDs...)))
|
||||
})
|
||||
}
|
||||
|
||||
Reference in New Issue
Block a user