277c41d336
* xds: refactor ingress listener SDS configuration * xds: update resolveListenerSDS call args in listeners_test * ingress: add TLS min, max and cipher suites to GatewayTLSConfig * xds: implement envoyTLSVersions and envoyTLSCipherSuites * xds: merge TLS config * xds: configure TLS parameters with ingress TLS context from leaf * xds: nil check in resolveListenerTLSConfig validation * xds: nil check in makeTLSParameters* functions * changelog: add entry for TLS params on ingress config entries * xds: remove indirection for TLS params in TLSConfig structs * xds: return tlsContext, nil instead of ambiguous err Co-authored-by: Chris S. Kim <ckim@hashicorp.com> * xds: switch zero checks to types.TLSVersionUnspecified * ingress: add validation for ingress config entry TLS params * ingress: validate listener TLS config * xds: add basic ingress with TLS params tests * xds: add ingress listeners mixed TLS min version defaults precedence test * xds: add more explicit tests for ingress listeners inheriting gateway defaults * xds: add test for single TLS listener on gateway without TLS defaults * xds: regen golden files for TLSVersionInvalid zero value, add TLSVersionAuto listener test * types/tls: change TLSVersion to string * types/tls: update TLSCipherSuite to string type * types/tls: implement validation functions for TLSVersion and TLSCipherSuites, make some maps private * api: add TLS params to GatewayTLSConfig, add tests * api: add TLSMinVersion to ingress gateway config entry test JSON * xds: switch to Envoy TLS cipher suite encoding from types package * xds: fixup validation for TLSv1_3 min version with cipher suites * add some kitchen sink tests and add a missing struct tag * xds: check if mergedCfg.TLSVersion is in TLSVersionsWithConfigurableCipherSuites * xds: update connectTLSEnabled comment * xds: remove unsued resolveGatewayServiceTLSConfig function * xds: add makeCommonTLSContextFromLeafWithoutParams * types/tls: add LessThan comparator function for concrete values * types/tls: change tlsVersions validation map from string to TLSVersion keys * types/tls: remove unused envoyTLSCipherSuites * types/tls: enable chacha20 cipher suites for Consul agent * types/tls: remove insecure cipher suites from allowed config TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256 and TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256 are both explicitly listed as insecure and disabled in the Go source. Refs https://cs.opensource.google/go/go/+/refs/tags/go1.17.3:src/crypto/tls/cipher_suites.go;l=329-330 * types/tls: add ValidateConsulAgentCipherSuites function, make direct lookup map private * types/tls: return all unmatched cipher suites in validation errors * xds: check that Envoy API value matching TLS version is found when building TlsParameters * types/tls: check that value is found in map before appending to slice in MarshalEnvoyTLSCipherSuiteStrings * types/tls: cast to string rather than fmt.Printf in TLSCihperSuite.String() * xds: add TLSVersionUnspecified to list of configurable cipher suites * structs: update note about config entry warning * xds: remove TLS min version cipher suite unconfigurable test placeholder * types/tls: update tests to remove assumption about private map values Co-authored-by: R.B. Boyer <rb@hashicorp.com>
51 lines
1.4 KiB
Go
51 lines
1.4 KiB
Go
package types
|
|
|
|
import (
|
|
"encoding/json"
|
|
"testing"
|
|
|
|
"github.com/stretchr/testify/require"
|
|
)
|
|
|
|
func TestTLSVersion_Valid(t *testing.T) {
|
|
require.NoError(t, ValidateTLSVersion("TLS_AUTO"))
|
|
require.NoError(t, ValidateTLSVersion("TLSv1_0"))
|
|
require.NoError(t, ValidateTLSVersion("TLSv1_1"))
|
|
require.NoError(t, ValidateTLSVersion("TLSv1_2"))
|
|
require.NoError(t, ValidateTLSVersion("TLSv1_3"))
|
|
}
|
|
|
|
func TestTLSVersion_Invalid(t *testing.T) {
|
|
var zeroValue TLSVersion
|
|
require.NotEqual(t, TLSVersionInvalid, zeroValue)
|
|
require.NotEqual(t, TLSVersionInvalid, TLSVersionUnspecified)
|
|
require.NotEqual(t, TLSVersionInvalid, TLSVersionAuto)
|
|
}
|
|
|
|
func TestTLSVersion_Zero(t *testing.T) {
|
|
var zeroValue TLSVersion
|
|
require.Equal(t, TLSVersionUnspecified, zeroValue)
|
|
require.NotEqual(t, TLSVersionUnspecified, TLSVersionInvalid)
|
|
require.NotEqual(t, TLSVersionUnspecified, TLSVersionAuto)
|
|
}
|
|
|
|
func TestTLSVersion_ToJSON(t *testing.T) {
|
|
var tlsVersion TLSVersion
|
|
|
|
// Unmarshalling won't catch invalid version strings,
|
|
// must be checked in config or config entry validation
|
|
err := json.Unmarshal([]byte(`"foo"`), &tlsVersion)
|
|
require.NoError(t, err)
|
|
|
|
for version := range tlsVersions {
|
|
str := version.String()
|
|
versionJSON, err := json.Marshal(version)
|
|
require.NoError(t, err)
|
|
require.Equal(t, versionJSON, []byte(`"`+str+`"`))
|
|
|
|
err = json.Unmarshal([]byte(`"`+str+`"`), &tlsVersion)
|
|
require.NoError(t, err)
|
|
require.Equal(t, tlsVersion, version)
|
|
}
|
|
}
|