consul/.changelog
Mike Morris 1b1a97e8f9
ingress: allow setting TLS min version and cipher suites in ingress gateway config entries (#11576)
* xds: refactor ingress listener SDS configuration

* xds: update resolveListenerSDS call args in listeners_test

* ingress: add TLS min, max and cipher suites to GatewayTLSConfig

* xds: implement envoyTLSVersions and envoyTLSCipherSuites

* xds: merge TLS config

* xds: configure TLS parameters with ingress TLS context from leaf

* xds: nil check in resolveListenerTLSConfig validation

* xds: nil check in makeTLSParameters* functions

* changelog: add entry for TLS params on ingress config entries

* xds: remove indirection for TLS params in TLSConfig structs

* xds: return tlsContext, nil instead of ambiguous err

Co-authored-by: Chris S. Kim <ckim@hashicorp.com>

* xds: switch zero checks to types.TLSVersionUnspecified

* ingress: add validation for ingress config entry TLS params

* ingress: validate listener TLS config

* xds: add basic ingress with TLS params tests

* xds: add ingress listeners mixed TLS min version defaults precedence test

* xds: add more explicit tests for ingress listeners inheriting gateway defaults

* xds: add test for single TLS listener on gateway without TLS defaults

* xds: regen golden files for TLSVersionInvalid zero value, add TLSVersionAuto listener test

* types/tls: change TLSVersion to string

* types/tls: update TLSCipherSuite to string type

* types/tls: implement validation functions for TLSVersion and TLSCipherSuites, make some maps private

* api: add TLS params to GatewayTLSConfig, add tests

* api: add TLSMinVersion to ingress gateway config entry test JSON

* xds: switch to Envoy TLS cipher suite encoding from types package

* xds: fixup validation for TLSv1_3 min version with cipher suites

* add some kitchen sink tests and add a missing struct tag

* xds: check if mergedCfg.TLSVersion is in TLSVersionsWithConfigurableCipherSuites

* xds: update connectTLSEnabled comment

* xds: remove unsued resolveGatewayServiceTLSConfig function

 * xds: add makeCommonTLSContextFromLeafWithoutParams

* types/tls: add LessThan comparator function for concrete values

* types/tls: change tlsVersions validation map from string to TLSVersion keys

* types/tls: remove unused envoyTLSCipherSuites

* types/tls: enable chacha20 cipher suites for Consul agent

* types/tls: remove insecure cipher suites from allowed config

TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256 and TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256 are both explicitly listed as insecure and disabled in the Go source.

Refs https://cs.opensource.google/go/go/+/refs/tags/go1.17.3:src/crypto/tls/cipher_suites.go;l=329-330

* types/tls: add ValidateConsulAgentCipherSuites function, make direct lookup map private

* types/tls: return all unmatched cipher suites in validation errors

* xds: check that Envoy API value matching TLS version is found when building TlsParameters

* types/tls: check that value is found in map before appending to slice in MarshalEnvoyTLSCipherSuiteStrings

* types/tls: cast to string rather than fmt.Printf in TLSCihperSuite.String()

* xds: add TLSVersionUnspecified to list of configurable cipher suites

* structs: update note about config entry warning

* xds: remove TLS min version cipher suite unconfigurable test placeholder

* types/tls: update tests to remove assumption about private map values

Co-authored-by: R.B. Boyer <rb@hashicorp.com>
2022-01-11 11:46:42 -05:00
..
2020-10-09 10:51:37 -04:00
2021-04-14 19:41:04 -04:00
2021-04-14 11:50:15 -04:00
2021-05-20 12:57:15 -04:00
2021-08-25 19:46:21 -06:00
2021-08-25 19:46:21 -06:00
2021-11-11 16:09:00 -05:00
2021-11-04 16:52:54 -05:00
2021-11-12 16:10:36 -06:00
2021-12-02 11:41:08 -05:00
2020-10-13 18:16:33 -04:00
2020-08-06 23:15:29 +02:00
2020-08-06 23:15:29 +02:00
2020-08-06 23:15:29 +02:00
2020-08-06 23:15:29 +02:00
2020-08-06 23:15:29 +02:00
2020-08-06 23:15:29 +02:00
2020-08-06 23:15:29 +02:00
2020-08-06 23:15:29 +02:00
2020-08-06 23:15:29 +02:00
2020-08-06 23:15:29 +02:00
2020-08-06 23:15:29 +02:00
2020-08-06 23:15:29 +02:00
2020-08-06 23:15:29 +02:00
2020-08-06 23:15:29 +02:00
2020-08-12 11:21:54 -05:00
2020-08-28 23:01:04 +02:00
2020-09-15 13:33:55 -07:00
2020-09-14 14:16:47 -06:00
2020-09-10 18:53:36 +02:00
2020-09-02 10:48:11 -05:00
2020-09-15 10:05:23 -07:00
2020-09-25 12:03:49 -04:00
2020-10-20 16:42:06 -04:00
2020-10-09 08:01:55 -07:00
2021-05-18 15:04:12 -04:00
2020-10-07 10:22:40 -05:00
2021-04-06 17:12:10 +08:00
2020-12-30 14:09:50 -06:00
2020-11-11 11:33:38 -06:00
2020-11-09 17:29:06 -05:00
2020-11-17 10:35:56 -05:00
2020-11-13 14:31:14 -08:00
2020-11-20 18:23:01 +01:00
2020-11-30 17:27:39 +00:00
2021-03-16 18:22:25 -04:00
2021-01-05 13:05:42 -05:00
2021-01-20 18:18:46 +00:00
2021-02-26 17:08:33 -06:00
2021-01-29 16:08:39 +00:00
2021-03-11 11:47:35 -08:00
2021-02-08 09:45:58 -07:00
2021-02-08 18:16:07 +01:00
2021-02-16 12:52:23 -05:00
2021-03-11 09:46:53 -08:00
2021-03-09 09:30:01 +00:00
2021-03-17 10:46:21 +00:00
2021-04-29 13:54:05 -05:00
2021-03-17 22:09:02 -06:00
2021-06-14 17:01:16 -04:00
2021-05-04 12:41:43 -07:00
2021-04-27 14:29:48 -04:00
2021-07-14 17:50:00 -04:00
2021-04-15 13:58:28 -06:00
2021-04-14 16:51:21 -04:00
2021-05-03 16:19:09 +01:00
2021-04-27 19:03:17 -04:00
2021-04-29 12:08:03 -04:00
2021-05-04 14:09:14 -04:00
2021-05-06 18:35:52 -04:00
2021-05-21 11:08:50 -04:00
2021-06-02 17:39:30 -04:00
2021-06-15 12:05:52 -04:00
2021-07-26 17:53:32 -04:00
2021-06-15 14:15:30 -06:00
2021-06-17 12:06:26 -07:00
2021-07-07 09:41:01 -04:00
2021-07-06 17:57:36 -04:00
2021-07-06 18:39:40 -04:00
2021-07-15 09:27:46 -06:00
2021-07-28 17:50:01 -04:00
2021-07-30 09:58:11 -07:00
2021-08-18 12:54:11 -04:00
2021-08-20 17:40:33 -06:00
2021-09-20 12:52:19 -05:00
2021-09-22 10:57:36 -07:00
2021-09-29 12:45:42 -04:00
2021-10-19 20:58:28 +01:00
2021-10-20 16:02:14 +05:30
2021-10-27 02:33:36 +03:00
2021-10-21 16:18:32 -04:00
2021-10-21 13:21:22 -04:00
2021-11-10 14:53:52 -05:00
2021-11-01 22:47:20 +00:00
2021-11-09 09:32:27 -08:00
2021-11-08 17:14:27 -07:00
2021-12-02 15:54:40 -08:00
2021-12-21 16:45:45 -05:00
2021-12-13 19:03:12 -07:00
2022-01-05 17:51:03 -05:00
2022-01-04 16:08:06 +00:00
2022-01-06 14:09:13 -05:00
2020-10-09 22:44:51 -04:00