open-consul/command
Mike Morris 277c41d336
ingress: allow setting TLS min version and cipher suites in ingress gateway config entries (#11576)
* xds: refactor ingress listener SDS configuration

* xds: update resolveListenerSDS call args in listeners_test

* ingress: add TLS min, max and cipher suites to GatewayTLSConfig

* xds: implement envoyTLSVersions and envoyTLSCipherSuites

* xds: merge TLS config

* xds: configure TLS parameters with ingress TLS context from leaf

* xds: nil check in resolveListenerTLSConfig validation

* xds: nil check in makeTLSParameters* functions

* changelog: add entry for TLS params on ingress config entries

* xds: remove indirection for TLS params in TLSConfig structs

* xds: return tlsContext, nil instead of ambiguous err

Co-authored-by: Chris S. Kim <ckim@hashicorp.com>

* xds: switch zero checks to types.TLSVersionUnspecified

* ingress: add validation for ingress config entry TLS params

* ingress: validate listener TLS config

* xds: add basic ingress with TLS params tests

* xds: add ingress listeners mixed TLS min version defaults precedence test

* xds: add more explicit tests for ingress listeners inheriting gateway defaults

* xds: add test for single TLS listener on gateway without TLS defaults

* xds: regen golden files for TLSVersionInvalid zero value, add TLSVersionAuto listener test

* types/tls: change TLSVersion to string

* types/tls: update TLSCipherSuite to string type

* types/tls: implement validation functions for TLSVersion and TLSCipherSuites, make some maps private

* api: add TLS params to GatewayTLSConfig, add tests

* api: add TLSMinVersion to ingress gateway config entry test JSON

* xds: switch to Envoy TLS cipher suite encoding from types package

* xds: fixup validation for TLSv1_3 min version with cipher suites

* add some kitchen sink tests and add a missing struct tag

* xds: check if mergedCfg.TLSVersion is in TLSVersionsWithConfigurableCipherSuites

* xds: update connectTLSEnabled comment

* xds: remove unsued resolveGatewayServiceTLSConfig function

 * xds: add makeCommonTLSContextFromLeafWithoutParams

* types/tls: add LessThan comparator function for concrete values

* types/tls: change tlsVersions validation map from string to TLSVersion keys

* types/tls: remove unused envoyTLSCipherSuites

* types/tls: enable chacha20 cipher suites for Consul agent

* types/tls: remove insecure cipher suites from allowed config

TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256 and TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256 are both explicitly listed as insecure and disabled in the Go source.

Refs https://cs.opensource.google/go/go/+/refs/tags/go1.17.3:src/crypto/tls/cipher_suites.go;l=329-330

* types/tls: add ValidateConsulAgentCipherSuites function, make direct lookup map private

* types/tls: return all unmatched cipher suites in validation errors

* xds: check that Envoy API value matching TLS version is found when building TlsParameters

* types/tls: check that value is found in map before appending to slice in MarshalEnvoyTLSCipherSuiteStrings

* types/tls: cast to string rather than fmt.Printf in TLSCihperSuite.String()

* xds: add TLSVersionUnspecified to list of configurable cipher suites

* structs: update note about config entry warning

* xds: remove TLS min version cipher suite unconfigurable test placeholder

* types/tls: update tests to remove assumption about private map values

Co-authored-by: R.B. Boyer <rb@hashicorp.com>
2022-01-11 11:46:42 -05:00
..
acl cli: Show node identities in acl token list output (#11926) 2022-01-04 12:44:43 -08:00
agent agent: refactor the agent delegate interface to be partition friendly (#11429) 2021-10-26 15:08:55 -05:00
catalog re-run gofmt on 1.17 (#11579) 2021-11-16 12:04:01 -06:00
cli cmd: introduce a shim to expose Stdout/Stderr writers 2021-06-02 16:51:34 -04:00
config ingress: allow setting TLS min version and cipher suites in ingress gateway config entries (#11576) 2022-01-11 11:46:42 -05:00
connect Update golden files 2021-12-14 08:57:09 -07:00
debug debug: use human readable dates for filenames 2021-08-18 13:06:57 -04:00
event testing: skip slow tests with -short 2020-12-07 13:42:55 -05:00
exec Replace use of 'sane' where appropriate 2021-07-02 12:18:46 -04:00
flags add partition flag to catalog commands (#10949) 2021-08-27 16:34:45 -04:00
forceleave agent: add variation of force-leave that exclusively works on the WAN (#11722) 2021-12-02 17:15:10 -06:00
helpers
info testing: skip slow tests with -short 2020-12-07 13:42:55 -05:00
intention Support partitions in connect expose cmd 2021-11-12 14:45:32 -07:00
join partitions: various refactors to support partitioning the serf LAN pool (#11568) 2021-11-15 09:51:14 -06:00
keygen
keyring partitions: various refactors to support partitioning the serf LAN pool (#11568) 2021-11-15 09:51:14 -06:00
kv KV refactoring, part 2 (#11512) 2021-11-08 11:43:21 -05:00
leave testing: skip slow tests with -short 2020-12-07 13:42:55 -05:00
lock re-run gofmt on 1.17 (#11579) 2021-11-16 12:04:01 -06:00
login Remove references to "master" ACL tokens in tests (#11751) 2021-12-07 12:48:50 +00:00
logout Remove references to "master" ACL tokens in tests (#11751) 2021-12-07 12:48:50 +00:00
maint Fix maint test 2021-07-30 12:58:46 -04:00
members partitions: various refactors to support partitioning the serf LAN pool (#11568) 2021-11-15 09:51:14 -06:00
monitor fix monitor to only start the monitor in json format when requested (#10358) 2021-06-07 12:08:48 -04:00
operator testing: skip slow tests with -short 2020-12-07 13:42:55 -05:00
reload testing: skip slow tests with -short 2020-12-07 13:42:55 -05:00
rtt agent: ensure that most agent behavior correctly respects partition configuration (#10880) 2021-08-19 15:09:42 -05:00
services Fixup to support unix domain socket via command line (#10758) 2021-08-12 10:05:22 -07:00
snapshot cli: use file mode 0600 when saving a snapshot 2022-01-05 17:51:03 -05:00
tls Merge pull request #11884 from assareh/patch-1 2022-01-04 15:17:32 -05:00
validate config: replace calls to config.NewBuilder with config.Load 2021-01-27 17:34:43 -05:00
version
watch cli: Test API access using /status/leader in consul watch (#10795) 2021-08-09 09:00:33 -07:00
commands_oss.go debug: restore cancel on SigInt 2021-08-18 12:29:34 -04:00
registry.go debug: restore cancel on SigInt 2021-08-18 12:29:34 -04:00