diff --git a/deploy/concierge/values.yaml b/deploy/concierge/values.yaml index 92bd2db6d..24ccea66a 100644 --- a/deploy/concierge/values.yaml +++ b/deploy/concierge/values.yaml @@ -218,8 +218,12 @@ no_proxy: "$(KUBERNETES_SERVICE_HOST),169.254.169.254,127.0.0.1,localhost,.svc,. #@schema/title "Allowed Ciphers for TLS 1.2" #@ allowed_ciphers_for_tls_onedottwo_desc = "When specified, only the ciphers listed will be used for TLS 1.2. \ #@ This includes both server-side and client-side TLS connections. \ -#@ Specify only secure cipher names from golang's crypto/tls package. \ -#@ This list must only include cipher suites that Pinniped is configured to accept (see the internal/crypto/ptls package). \ +#@ This list must only include cipher suites that Pinniped is configured to accept \ +#@ (see internal/crypto/ptls/profiles.go and internal/crypto/ptls/profiles_fips_strict.go). \ +#@ Allowing too few ciphers may cause critical parts of Pinniped to be unable to function. For example, \ +#@ Kubernetes pod readiness checks, Pinniped pods acting as a client to the Kubernetes API server, \ +#@ Pinniped pods acting as a client to external identity providers, or Pinniped pods acting as an APIService server \ +#@ all need to be able to function with the allowed TLS cipher suites. \ #@ An empty array means accept Pinniped's defaults." #@schema/desc allowed_ciphers_for_tls_onedottwo_desc #@schema/examples ("Example with a few secure ciphers", ["TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256"]) diff --git a/deploy/supervisor/values.yaml b/deploy/supervisor/values.yaml index 912ad3932..f4aab5e62 100644 --- a/deploy/supervisor/values.yaml +++ b/deploy/supervisor/values.yaml @@ -207,8 +207,12 @@ endpoints: { } #@schema/title "Allowed Ciphers for TLS 1.2" #@ allowed_ciphers_for_tls_onedottwo_desc = "When specified, only the ciphers listed will be used for TLS 1.2. \ #@ This includes both server-side and client-side TLS connections. \ -#@ Specify only secure cipher names from golang's crypto/tls package. \ -#@ This list must only include cipher suites that Pinniped is configured to accept (see the internal/crypto/ptls package). \ +#@ This list must only include cipher suites that Pinniped is configured to accept \ +#@ (see internal/crypto/ptls/profiles.go and internal/crypto/ptls/profiles_fips_strict.go). \ +#@ Allowing too few ciphers may cause critical parts of Pinniped to be unable to function. For example, \ +#@ Kubernetes pod readiness checks, Pinniped pods acting as a client to the Kubernetes API server, \ +#@ Pinniped pods acting as a client to external identity providers, or Pinniped pods acting as an APIService server \ +#@ all need to be able to function with the allowed TLS cipher suites. \ #@ An empty array means accept Pinniped's defaults." #@schema/desc allowed_ciphers_for_tls_onedottwo_desc #@schema/examples ("Example with a few secure ciphers", ["TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256"]) diff --git a/internal/crypto/ptls/common.go b/internal/crypto/ptls/common.go index a50811c56..45318d3f2 100644 --- a/internal/crypto/ptls/common.go +++ b/internal/crypto/ptls/common.go @@ -30,9 +30,9 @@ type SetAllowedCiphers func([]string) error // SetUserConfiguredCiphersForTLSOneDotTwo allows configuration/setup components to constrain the allowed TLS ciphers // for TLS1.2. func SetUserConfiguredCiphersForTLSOneDotTwo(userConfiguredCiphersForTLSOneDotTwo []string) error { - plog.Debug("setting user-configured allowed ciphers for TLS 1.2", "userConfiguredAllowedCipherSuites", userConfiguredCiphersForTLSOneDotTwo) + plog.Info("setting user-configured allowed ciphers for TLS 1.2", "userConfiguredAllowedCipherSuites", userConfiguredCiphersForTLSOneDotTwo) - validatedUserConfiguredAllowedCipherSuites, err := validateAllowedCiphers(hardcodedCipherSuites(), userConfiguredCiphersForTLSOneDotTwo) + validatedUserConfiguredAllowedCipherSuites, err := validateAllowedCiphers(allHardcodedAllowedCipherSuites(), userConfiguredCiphersForTLSOneDotTwo) if err != nil { return err } @@ -191,3 +191,23 @@ func validateAllowedCiphers( return validCiphers, nil } + +// allHardcodedAllowedCipherSuites returns the full list of all hardcoded ciphers that are allowed for any profile. +// Note that it will return different values depending on if the code was compiled in FIPS or non-FIPS mode. +func allHardcodedAllowedCipherSuites() []*tls.CipherSuite { + // First append all secure and LDAP cipher suites. + result := translateIDIntoSecureCipherSuites(append(secureCipherSuiteIDs, additionalSecureCipherSuiteIDsOnlyForLDAPClients...)) + + // Then append any insecure cipher suites that might be allowed. + // insecureCipherSuiteIDs is empty except when compiled in FIPS mode. + for _, golangInsecureCipherSuite := range tls.InsecureCipherSuites() { + if !slices.Contains(golangInsecureCipherSuite.SupportedVersions, tls.VersionTLS12) { + continue + } + + if slices.Contains(insecureCipherSuiteIDs, golangInsecureCipherSuite.ID) { + result = append(result, golangInsecureCipherSuite) + } + } + return result +} diff --git a/internal/crypto/ptls/profiles.go b/internal/crypto/ptls/profiles.go index 185acb193..a5293c6df 100644 --- a/internal/crypto/ptls/profiles.go +++ b/internal/crypto/ptls/profiles.go @@ -1,6 +1,7 @@ // Copyright 2021-2024 the Pinniped contributors. All Rights Reserved. // SPDX-License-Identifier: Apache-2.0 +// Note that everything in this file is overridden by profiles_fips_strict.go when Pinniped is built in FIPS-only mode. //go:build !fips_strict package ptls @@ -17,6 +18,62 @@ import ( "go.pinniped.dev/internal/plog" ) +var ( + // secureCipherSuiteIDs is the list of TLS ciphers to use for both clients and servers when using TLS 1.2. + // + // The order does not matter in go 1.17+ https://go.dev/blog/tls-cipher-suites. + // We match crypto/tls.cipherSuitesPreferenceOrder because it makes unit tests easier to write. + // + // as of 2021-10-19, Mozilla Guideline v5.6, Go 1.17.2, intermediate configuration, supports: + // - Firefox 27 + // - Android 4.4.2 + // - Chrome 31 + // - Edge + // - IE 11 on Windows 7 + // - Java 8u31 + // - OpenSSL 1.0.1 + // - Opera 20 + // - Safari 9 + // https://ssl-config.mozilla.org/#server=go&version=1.17.2&config=intermediate&guideline=5.6 + // + // The Kubernetes API server must use approved cipher suites. + // https://stigviewer.com/stig/kubernetes/2021-06-17/finding/V-242418 + // + // These are all AEADs with ECDHE, some use ChaCha20Poly1305 while others use AES-GCM, + // which provides forward secrecy, confidentiality and authenticity of data. + secureCipherSuiteIDs = []uint16{ //nolint:gochecknoglobals // please treat this as a const + tls.TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256, + tls.TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256, + tls.TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384, + tls.TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384, + tls.TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256, + tls.TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256, + } + + // insecureCipherSuiteIDs is a list of additional ciphers that should be allowed for both clients + // and servers when using TLS 1.2. + // + // This list is empty when compiled in non-FIPS mode, so we will not use any insecure ciphers in non-FIPS mode. + insecureCipherSuiteIDs []uint16 //nolint:gochecknoglobals // please treat this as a const + + // additionalSecureCipherSuiteIDsOnlyForLDAPClients are additional ciphers to use only for LDAP clients + // when using TLS 1.2. These can be used when the Pinniped Supervisor is making calls to an LDAP server + // configured by an LDAPIdentityProvider or ActiveDirectoryIdentityProvider. + // + // Adds less secure ciphers to support the default AWS Active Directory config. + // + // These are all CBC with ECDHE. Golang considers these to be secure. However, + // these provide forward secrecy and confidentiality of data, but not authenticity. + // MAC-then-Encrypt CBC ciphers are susceptible to padding oracle attacks. + // See https://crypto.stackexchange.com/a/205 and https://crypto.stackexchange.com/a/224 + additionalSecureCipherSuiteIDsOnlyForLDAPClients = []uint16{ //nolint:gochecknoglobals // please treat this as a const + tls.TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA, + tls.TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA, + tls.TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA, + tls.TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA, + } +) + // init prints a log message to tell the operator how Pinniped was compiled. This makes it obvious // that they are using Pinniped in FIPS-mode or not, which is otherwise hard to observe. func init() { //nolint:gochecknoinits @@ -41,14 +98,17 @@ const SecureTLSConfigMinTLSVersion = tls.VersionTLS13 // Note that this will behave differently when compiled in FIPS mode (see profiles_fips_strict.go). // Default returns a tls.Config with a minimum of TLS1.2+ and a few ciphers that can be further constrained by configuration. func Default(rootCAs *x509.CertPool) *tls.Config { - return buildTLSConfig(rootCAs, cipherSuitesForDefault(), getUserConfiguredCiphersAllowList()) + ciphers := translateIDIntoSecureCipherSuites(secureCipherSuiteIDs) + return buildTLSConfig(rootCAs, ciphers, getUserConfiguredCiphersAllowList()) } // DefaultLDAP TLS profile should be used by clients who need to interact with potentially old LDAP servers // that might not support TLS 1.3 and that might use older ciphers. // Note that this will behave differently when compiled in FIPS mode (see profiles_fips_strict.go). func DefaultLDAP(rootCAs *x509.CertPool) *tls.Config { - return buildTLSConfig(rootCAs, cipherSuitesForDefaultLDAP(), getUserConfiguredCiphersAllowList()) + ciphers := translateIDIntoSecureCipherSuites(secureCipherSuiteIDs) + ciphers = append(ciphers, translateIDIntoSecureCipherSuites(additionalSecureCipherSuiteIDsOnlyForLDAPClients)...) + return buildTLSConfig(rootCAs, ciphers, getUserConfiguredCiphersAllowList()) } // Secure TLS profile should be used by: @@ -85,63 +145,3 @@ func SecureServing(opts *options.SecureServingOptionsWithLoopback) { opts.MinTLSVersion = "VersionTLS13" opts.CipherSuites = nil } - -func hardcodedCipherSuites() []*tls.CipherSuite { - return cipherSuitesForDefaultLDAP() -} - -// cipherSuitesForDefault are the ciphers that Pinniped allows. -// It will be a strict subset of tls.CipherSuites. -func cipherSuitesForDefault() []*tls.CipherSuite { - // the order does not matter in go 1.17+ https://go.dev/blog/tls-cipher-suites - // we match crypto/tls.cipherSuitesPreferenceOrder because it makes unit tests easier to write - // this list is ignored when TLS 1.3 is used - // - // as of 2021-10-19, Mozilla Guideline v5.6, Go 1.17.2, intermediate configuration, supports: - // - Firefox 27 - // - Android 4.4.2 - // - Chrome 31 - // - Edge - // - IE 11 on Windows 7 - // - Java 8u31 - // - OpenSSL 1.0.1 - // - Opera 20 - // - Safari 9 - // https://ssl-config.mozilla.org/#server=go&version=1.17.2&config=intermediate&guideline=5.6 - // - // The Kubernetes API server must use approved cipher suites. - // https://stigviewer.com/stig/kubernetes/2021-06-17/finding/V-242418 - - // These are all AEADs with ECDHE, some use ChaCha20Poly1305 while others use AES-GCM, - // which provides forward secrecy, confidentiality and authenticity of data. - cipherSuiteIDsForDefault := []uint16{ - tls.TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256, - tls.TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256, - tls.TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384, - tls.TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384, - tls.TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256, - tls.TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256, - } - - return translateIDIntoSecureCipherSuites(cipherSuiteIDsForDefault) -} - -// cipherSuitesForDefaultLDAP are some additional ciphers that Pinniped allows only for LDAP. -// It will be a strict subset of tls.CipherSuites. -func cipherSuitesForDefaultLDAP() []*tls.CipherSuite { - // Add less secure ciphers to support the default AWS Active Directory config - // - // CBC with ECDHE - // this provides forward secrecy and confidentiality of data but not authenticity - // MAC-then-Encrypt CBC ciphers are susceptible to padding oracle attacks - // See https://crypto.stackexchange.com/a/205 and https://crypto.stackexchange.com/a/224 - cipherSuiteIDsForDefaultLDAP := []uint16{ - tls.TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA, - tls.TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA, - tls.TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA, - tls.TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA, - } - result := cipherSuitesForDefault() - result = append(result, translateIDIntoSecureCipherSuites(cipherSuiteIDsForDefaultLDAP)...) - return result -} diff --git a/internal/crypto/ptls/profiles_fips_strict.go b/internal/crypto/ptls/profiles_fips_strict.go index 0ffad2cfd..0558de141 100644 --- a/internal/crypto/ptls/profiles_fips_strict.go +++ b/internal/crypto/ptls/profiles_fips_strict.go @@ -1,7 +1,7 @@ // Copyright 2022-2024 the Pinniped contributors. All Rights Reserved. // SPDX-License-Identifier: Apache-2.0 -// The configurations here override the usual configs when Pinniped is built in fips-only mode. +// This file overrides profiles.go when Pinniped is built in FIPS-only mode. //go:build fips_strict package ptls @@ -12,7 +12,6 @@ import ( "os" "path/filepath" "runtime" - "slices" "k8s.io/apiserver/pkg/server/options" @@ -21,6 +20,37 @@ import ( "go.pinniped.dev/internal/plog" ) +// The union of these three variables is all the FIPS-approved TLS 1.2 ciphers. +// If this list does not match the boring crypto compiler's list then the TestFIPSCipherSuites integration +// test should fail, which indicates that this list needs to be updated. +var ( + // secureCipherSuiteIDs is the list of TLS ciphers to use for both clients and servers when using TLS 1.2. + // + // FIPS allows the use of these ciphers which golang considers secure. + secureCipherSuiteIDs = []uint16{ + tls.TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256, + tls.TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256, + tls.TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384, + tls.TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384, + } + + // insecureCipherSuiteIDs is a list of additional ciphers that should be allowed for both clients + // and servers when using TLS 1.2. + // + // FIPS allows the use of these specific ciphers that golang considers insecure. + insecureCipherSuiteIDs = []uint16{ + tls.TLS_RSA_WITH_AES_128_GCM_SHA256, + tls.TLS_RSA_WITH_AES_256_GCM_SHA384, + } + + // additionalSecureCipherSuiteIDsOnlyForLDAPClients are additional ciphers to use only for LDAP clients + // when using TLS 1.2. These can be used when the Pinniped Supervisor is making calls to an LDAP server + // configured by an LDAPIdentityProvider or ActiveDirectoryIdentityProvider. + // + // When compiled in FIPS mode, there are no extras for LDAP clients. + additionalSecureCipherSuiteIDsOnlyForLDAPClients []uint16 +) + // init: see comment in profiles.go. func init() { switch filepath.Base(os.Args[0]) { @@ -41,8 +71,10 @@ const SecureTLSConfigMinTLSVersion = tls.VersionTLS12 // Default: see comment in profiles.go. // This chooses different cipher suites and/or TLS versions compared to non-FIPS mode. +// In FIPS mode, this will use the union of the secureCipherSuiteIDs, additionalSecureCipherSuiteIDsOnlyForLDAPClients, +// and insecureCipherSuiteIDs values defined above. func Default(rootCAs *x509.CertPool) *tls.Config { - config := buildTLSConfig(rootCAs, hardcodedCipherSuites(), getUserConfiguredCiphersAllowList()) + config := buildTLSConfig(rootCAs, allHardcodedAllowedCipherSuites(), getUserConfiguredCiphersAllowList()) // Until goboring supports TLS 1.3, make the max version 1.2. config.MaxVersion = tls.VersionTLS12 return config @@ -50,6 +82,7 @@ func Default(rootCAs *x509.CertPool) *tls.Config { // DefaultLDAP: see comment in profiles.go. // This chooses different cipher suites and/or TLS versions compared to non-FIPS mode. +// In FIPS mode, this is not any different from the Default profile. func DefaultLDAP(rootCAs *x509.CertPool) *tls.Config { return Default(rootCAs) } @@ -57,6 +90,7 @@ func DefaultLDAP(rootCAs *x509.CertPool) *tls.Config { // Secure: see comment in profiles.go. // This chooses different cipher suites and/or TLS versions compared to non-FIPS mode. // Until goboring supports TLS 1.3, make the Secure profile the same as the Default profile in FIPS mode. +// Until then, this is not any different from the Default profile in FIPS mode. func Secure(rootCAs *x509.CertPool) *tls.Config { return Default(rootCAs) } @@ -67,34 +101,3 @@ func Secure(rootCAs *x509.CertPool) *tls.Config { func SecureServing(opts *options.SecureServingOptionsWithLoopback) { defaultServing(opts) } - -func hardcodedCipherSuites() []*tls.CipherSuite { - // This is all the fips-approved TLS 1.2 ciphers. - // The list is hard-coded for convenience of testing. - // If this list does not match the boring crypto compiler's list then the TestFIPSCipherSuites integration - // test should fail, which indicates that this list needs to be updated. - secureCipherSuiteIDsForFIPS := []uint16{ - tls.TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256, - tls.TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256, - tls.TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384, - tls.TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384, - } - - insecureCipherSuiteIDsForFIPS := []uint16{ - tls.TLS_RSA_WITH_AES_128_GCM_SHA256, - tls.TLS_RSA_WITH_AES_256_GCM_SHA384, - } - - result := translateIDIntoSecureCipherSuites(secureCipherSuiteIDsForFIPS) - - for _, golangInsecureCipherSuite := range tls.InsecureCipherSuites() { - if !slices.Contains(golangInsecureCipherSuite.SupportedVersions, tls.VersionTLS12) { - continue - } - - if slices.Contains(insecureCipherSuiteIDsForFIPS, golangInsecureCipherSuite.ID) { - result = append(result, golangInsecureCipherSuite) - } - } - return result -} diff --git a/internal/crypto/ptls/profiles_test.go b/internal/crypto/ptls/profiles_test.go index 972bf4606..95cd6e2dd 100644 --- a/internal/crypto/ptls/profiles_test.go +++ b/internal/crypto/ptls/profiles_test.go @@ -6,7 +6,6 @@ package ptls import ( "crypto/tls" "crypto/x509" - "slices" "testing" "github.com/stretchr/testify/require" @@ -19,7 +18,6 @@ func TestDefault(t *testing.T) { aCertPool := x509.NewCertPool() - actual := Default(aCertPool) expected := &tls.Config{ MinVersion: tls.VersionTLS12, CipherSuites: []uint16{ @@ -34,7 +32,7 @@ func TestDefault(t *testing.T) { RootCAs: aCertPool, } - require.Equal(t, expected, actual) + require.Equal(t, expected, Default(aCertPool)) } func TestDefaultLDAP(t *testing.T) { @@ -42,7 +40,6 @@ func TestDefaultLDAP(t *testing.T) { aCertPool := x509.NewCertPool() - actual := DefaultLDAP(aCertPool) expected := &tls.Config{ MinVersion: tls.VersionTLS12, CipherSuites: []uint16{ @@ -61,7 +58,7 @@ func TestDefaultLDAP(t *testing.T) { RootCAs: aCertPool, } - require.Equal(t, expected, actual) + require.Equal(t, expected, DefaultLDAP(aCertPool)) } func TestSecure(t *testing.T) { @@ -69,7 +66,6 @@ func TestSecure(t *testing.T) { aCertPool := x509.NewCertPool() - actual := Secure(aCertPool) expected := &tls.Config{ MinVersion: tls.VersionTLS13, CipherSuites: nil, // TLS 1.3 ciphers are not configurable @@ -77,19 +73,22 @@ func TestSecure(t *testing.T) { RootCAs: aCertPool, } - require.Equal(t, expected, actual) + require.Equal(t, expected, Secure(aCertPool)) } func TestSecureServing(t *testing.T) { t.Parallel() opts := &options.SecureServingOptionsWithLoopback{SecureServingOptions: &options.SecureServingOptions{}} - SecureServing(opts) - require.Equal(t, options.SecureServingOptionsWithLoopback{ + + expected := options.SecureServingOptionsWithLoopback{ SecureServingOptions: &options.SecureServingOptions{ MinTLSVersion: "VersionTLS13", }, - }, *opts) + } + + SecureServing(opts) + require.Equal(t, expected, *opts) } func TestCipherSuitesForDefault(t *testing.T) { @@ -103,31 +102,17 @@ func TestCipherSuitesForDefault(t *testing.T) { tls.TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256, } - actual := cipherSuitesForDefault() - - require.Equal(t, len(expected), len(actual)) - for _, suite := range actual { - require.True(t, slices.Contains(expected, suite.ID)) - } + require.Equal(t, expected, Default(nil).CipherSuites) }) t.Run("is a subset of TestCipherSuitesForDefaultLDAP", func(t *testing.T) { - a1 := cipherSuitesForDefault() - a2 := cipherSuitesForDefaultLDAP() + defaultSuiteIDs := Default(nil).CipherSuites + ldapSuiteIDs := DefaultLDAP(nil).CipherSuites - require.Greater(t, len(a1), 0) - require.GreaterOrEqual(t, len(a2), len(a1)) + require.Greater(t, len(defaultSuiteIDs), 0) + require.GreaterOrEqual(t, len(ldapSuiteIDs), len(defaultSuiteIDs)) - a1ids := sets.New[uint16]() - for _, suite := range a1 { - a1ids.Insert(suite.ID) - } - a2ids := sets.New[uint16]() - for _, suite := range a1 { - a2ids.Insert(suite.ID) - } - - require.Equal(t, 0, a1ids.Difference(a2ids).Len()) + require.Equal(t, 0, sets.New[uint16](defaultSuiteIDs...).Difference(sets.New[uint16](ldapSuiteIDs...)).Len()) }) } @@ -148,30 +133,16 @@ func TestCipherSuitesForDefaultLDAP(t *testing.T) { tls.TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA, } - actual := cipherSuitesForDefaultLDAP() - - require.Equal(t, len(expected), len(actual)) - for _, suite := range actual { - require.True(t, slices.Contains(expected, suite.ID)) - } + require.Equal(t, expected, DefaultLDAP(nil).CipherSuites) }) t.Run("is a superset of TestCipherSuitesForDefault", func(t *testing.T) { - a1 := cipherSuitesForDefault() - a2 := cipherSuitesForDefaultLDAP() + defaultSuiteIDs := Default(nil).CipherSuites + ldapSuiteIDs := DefaultLDAP(nil).CipherSuites - require.Greater(t, len(a1), 0) - require.GreaterOrEqual(t, len(a2), len(a1)) + require.Greater(t, len(defaultSuiteIDs), 0) + require.GreaterOrEqual(t, len(ldapSuiteIDs), len(defaultSuiteIDs)) - a1ids := sets.New[uint16]() - for _, suite := range a1 { - a1ids.Insert(suite.ID) - } - a2ids := sets.New[uint16]() - for _, suite := range a1 { - a2ids.Insert(suite.ID) - } - - require.True(t, a2ids.IsSuperset(a1ids)) + require.True(t, sets.New[uint16](ldapSuiteIDs...).IsSuperset(sets.New[uint16](defaultSuiteIDs...))) }) }