luxolus
/
open-nomad
2
0
Fork 0
Code Issues 1 Pull Requests Packages Releases Wiki Activity

change function signature to take entire tls config object

This commit is contained in:
Chelsea Holland Komlo 2018-08-06 13:54:57 -04:00
parent 720cc4d90c
commit b92098fd08
3 changed files with 33 additions and 27 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
command/agent/config_parse.go
View File

@ -844,7 +844,7 @@ func parseTLSConfig(result **config.TLSConfig, list *ast.ObjectList) error {
return err
}
if _, err := tlsutil.ParseCiphers(tlsConfig.TLSCipherSuites); err != nil {
if _, err := tlsutil.ParseCiphers(&tlsConfig); err != nil {
return err
}

8
helper/tlsutil/config.go
View File

@ -125,7 +125,7 @@ type Config struct {
}
func NewTLSConfiguration(newConf *config.TLSConfig, verifyIncoming, verifyOutgoing bool) (*Config, error) {
ciphers, err := ParseCiphers(newConf.TLSCipherSuites)
ciphers, err := ParseCiphers(newConf)
if err != nil {
return nil, err
}
@ -385,17 +385,17 @@ func (c *Config) IncomingTLSConfig() (*tls.Config, error) {
// ParseCiphers parses ciphersuites from the comma-separated string into
// recognized slice
func ParseCiphers(cipherStr string) ([]uint16, error) {
func ParseCiphers(tlsConfig *config.TLSConfig) ([]uint16, error) {
suites := []uint16{}
cipherStr = strings.TrimSpace(cipherStr)
cipherStr := strings.TrimSpace(tlsConfig.TLSCipherSuites)
var ciphers []string
if cipherStr == "" {
ciphers = defaultTLSCiphers
} else {
ciphers = strings.Split(cipherStr, ",")
ciphers = strings.Split(tlsConfig.TLSCipherSuites, ",")
}
for _, cipher := range ciphers {
c, ok := supportedTLSCiphers[cipher]

50
helper/tlsutil/config_test.go
View File

@ -647,25 +647,27 @@ func TestConfig_IncomingTLS_TLSCipherSuites(t *testing.T) {
func TestConfig_ParseCiphers_Valid(t *testing.T) {
require := require.New(t)
validCiphers := strings.Join([]string{
"TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305",
"TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305",
"TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256",
"TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256",
"TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384",
"TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384",
"TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256",
"TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA",
"TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256",
"TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA",
"TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA",
"TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA",
"TLS_RSA_WITH_AES_128_GCM_SHA256",
"TLS_RSA_WITH_AES_256_GCM_SHA384",
"TLS_RSA_WITH_AES_128_CBC_SHA256",
"TLS_RSA_WITH_AES_128_CBC_SHA",
"TLS_RSA_WITH_AES_256_CBC_SHA",
}, ",")
tlsConfig := &config.TLSConfig{
TLSCipherSuites: strings.Join([]string{
"TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305",
"TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305",
"TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256",
"TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256",
"TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384",
"TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384",
"TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256",
"TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA",
"TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256",
"TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA",
"TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA",
"TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA",
"TLS_RSA_WITH_AES_128_GCM_SHA256",
"TLS_RSA_WITH_AES_256_GCM_SHA384",
"TLS_RSA_WITH_AES_128_CBC_SHA256",
"TLS_RSA_WITH_AES_128_CBC_SHA",
"TLS_RSA_WITH_AES_256_CBC_SHA",
}, ","),
}
expectedCiphers := []uint16{
tls.TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305,
@ -687,7 +689,7 @@ func TestConfig_ParseCiphers_Valid(t *testing.T) {
tls.TLS_RSA_WITH_AES_256_CBC_SHA,
}
parsedCiphers, err := ParseCiphers(validCiphers)
parsedCiphers, err := ParseCiphers(tlsConfig)
require.Nil(err)
require.Equal(parsedCiphers, expectedCiphers)
}
@ -708,7 +710,8 @@ func TestConfig_ParseCiphers_Default(t *testing.T) {
tls.TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,
}
parsedCiphers, err := ParseCiphers("")
empty := &config.TLSConfig{}
parsedCiphers, err := ParseCiphers(empty)
require.Nil(err)
require.Equal(parsedCiphers, expectedCiphers)
}
@ -722,7 +725,10 @@ func TestConfig_ParseCiphers_Invalid(t *testing.T) {
}
for _, cipher := range invalidCiphers {
parsedCiphers, err := ParseCiphers(cipher)
tlsConfig := &config.TLSConfig{
TLSCipherSuites: cipher,
}
parsedCiphers, err := ParseCiphers(tlsConfig)
require.NotNil(err)
require.Equal(fmt.Sprintf("unsupported TLS cipher %q", cipher), err.Error())
require.Equal(0, len(parsedCiphers))