DevFW-CICD/ingress-nginx-helm
14
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

removed tlsv1 & tlsv1.1 (#11408)

Browse source 
Co-authored-by: longwuyuan <longwuyuan@gmail.com>
This commit is contained in:
k8s-infra-cherrypick-robot 2024-06-02 11:52:07 -07:00 committed by GitHub
parent 18cfd1daac
commit b7f6f93334
No known key found for this signature in database
GPG key ID: B5690EEEBB952194
7 changed files with 63363 additions and 60285 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

2
docs/user-guide/tls.md
View file

@ -145,7 +145,7 @@ metadata:
name: nginx-config name: nginx-config
data: data:
ssl-ciphers: "ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384:DHE-RSA-CHACHA20-POLY1305:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA256:ECDHE-ECDSA-AES128-SHA:ECDHE-RSA-AES128-SHA:ECDHE-ECDSA-AES256-SHA384:ECDHE-RSA-AES256-SHA384:ECDHE-ECDSA-AES256-SHA:ECDHE-RSA-AES256-SHA:DHE-RSA-AES128-SHA256:DHE-RSA-AES256-SHA256:AES128-GCM-SHA256:AES256-GCM-SHA384:AES128-SHA256:AES256-SHA256:AES128-SHA:AES256-SHA:DES-CBC3-SHA" ssl-ciphers: "ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384:DHE-RSA-CHACHA20-POLY1305:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA256:ECDHE-ECDSA-AES128-SHA:ECDHE-RSA-AES128-SHA:ECDHE-ECDSA-AES256-SHA384:ECDHE-RSA-AES256-SHA384:ECDHE-ECDSA-AES256-SHA:ECDHE-RSA-AES256-SHA:DHE-RSA-AES128-SHA256:DHE-RSA-AES256-SHA256:AES128-GCM-SHA256:AES256-GCM-SHA384:AES128-SHA256:AES256-SHA256:AES128-SHA:AES256-SHA:DES-CBC3-SHA"
ssl-protocols: "TLSv1 TLSv1.1 TLSv1.2 TLSv1.3" ssl-protocols: "TLSv1.2 TLSv1.3"
``` ```

4
internal/ingress/annotations/proxyssl/main.go
View file

@ -32,7 +32,7 @@ import (
const ( const (
defaultProxySSLCiphers = "DEFAULT" defaultProxySSLCiphers = "DEFAULT"
defaultProxySSLProtocols = "TLSv1 TLSv1.1 TLSv1.2" defaultProxySSLProtocols = "TLSv1.2"
defaultProxySSLVerify = "off" defaultProxySSLVerify = "off"
defaultProxySSLVerifyDepth = 1 defaultProxySSLVerifyDepth = 1
defaultProxySSLServerName = "off" defaultProxySSLServerName = "off"
@ -40,7 +40,7 @@ const (
var ( var (
proxySSLOnOffRegex = regexp.MustCompile(`^(on|off)$`) proxySSLOnOffRegex = regexp.MustCompile(`^(on|off)$`)
proxySSLProtocolRegex = regexp.MustCompile(`^(SSLv2|SSLv3|TLSv1|TLSv1\.1|TLSv1\.2|TLSv1\.3| )*$`) proxySSLProtocolRegex = regexp.MustCompile(`^(TLSv1\.2|TLSv1\.3| )*$`)
proxySSLCiphersRegex = regexp.MustCompile(`^[A-Za-z0-9\+:\_\-!]*$`) proxySSLCiphersRegex = regexp.MustCompile(`^[A-Za-z0-9\+:\_\-!]*$`)
) )

4
internal/ingress/annotations/proxyssl/main_test.go
View file

@ -32,7 +32,7 @@ const (
proxySslCiphers = "HIGH:-SHA" proxySslCiphers = "HIGH:-SHA"
off = "off" off = "off"
sslServerName = "w00t" sslServerName = "w00t"
defaultProtocol = "SSLv2 TLSv1 TLSv1.2 TLSv1.3" defaultProtocol = "TLSv1.2 TLSv1.3"
) )
func buildIngress() *networking.Ingress { func buildIngress() *networking.Ingress {
@ -103,7 +103,7 @@ func TestAnnotations(t *testing.T) {
data[parser.GetAnnotationWithPrefix(proxySSLSecretAnnotation)] = defaultDemoSecret data[parser.GetAnnotationWithPrefix(proxySSLSecretAnnotation)] = defaultDemoSecret
data[parser.GetAnnotationWithPrefix("proxy-ssl-ciphers")] = proxySslCiphers data[parser.GetAnnotationWithPrefix("proxy-ssl-ciphers")] = proxySslCiphers
data[parser.GetAnnotationWithPrefix("proxy-ssl-name")] = "$host" data[parser.GetAnnotationWithPrefix("proxy-ssl-name")] = "$host"
data[parser.GetAnnotationWithPrefix("proxy-ssl-protocols")] = "TLSv1.3 SSLv2 TLSv1 TLSv1.2" data[parser.GetAnnotationWithPrefix("proxy-ssl-protocols")] = "TLSv1.3 TLSv1.2"
data[parser.GetAnnotationWithPrefix("proxy-ssl-server-name")] = "on" data[parser.GetAnnotationWithPrefix("proxy-ssl-server-name")] = "on"
data[parser.GetAnnotationWithPrefix("proxy-ssl-session-reuse")] = off data[parser.GetAnnotationWithPrefix("proxy-ssl-session-reuse")] = off
data[parser.GetAnnotationWithPrefix("proxy-ssl-verify")] = "on" data[parser.GetAnnotationWithPrefix("proxy-ssl-verify")] = "on"

2
internal/ingress/annotations/sslcipher/main.go
View file

@ -43,7 +43,7 @@ var sslCipherAnnotations = parser.Annotation{
Scope: parser.AnnotationScopeIngress, Scope: parser.AnnotationScopeIngress,
Risk: parser.AnnotationRiskLow, Risk: parser.AnnotationRiskLow,
Documentation: `The following annotation will set the ssl_prefer_server_ciphers directive at the server level. Documentation: `The following annotation will set the ssl_prefer_server_ciphers directive at the server level.
This configuration specifies that server ciphers should be preferred over client ciphers when using the SSLv3 and TLS protocols.`, This configuration specifies that server ciphers should be preferred over client ciphers when using the TLS protocols.`,
}, },
sslCipherAnnotation: { sslCipherAnnotation: {
Validator: parser.ValidateRegex(regexValidSSLCipher, true), Validator: parser.ValidateRegex(regexValidSSLCipher, true),

2
pkg/apis/ingress/types.go
View file

@ -210,7 +210,7 @@ type Server struct {
// SSLCiphers returns list of ciphers to be enabled // SSLCiphers returns list of ciphers to be enabled
SSLCiphers string `json:"sslCiphers,omitempty"` SSLCiphers string `json:"sslCiphers,omitempty"`
// SSLPreferServerCiphers indicates that server ciphers should be preferred // SSLPreferServerCiphers indicates that server ciphers should be preferred
// over client ciphers when using the SSLv3 and TLS protocols. // over client ciphers when using the TLS protocols.
SSLPreferServerCiphers string `json:"sslPreferServerCiphers,omitempty"` SSLPreferServerCiphers string `json:"sslPreferServerCiphers,omitempty"`
// AuthTLSError contains the reason why the access to a server should be denied // AuthTLSError contains the reason why the access to a server should be denied
AuthTLSError string `json:"authTLSError,omitempty"` AuthTLSError string `json:"authTLSError,omitempty"`

9230
test/data/config.json
View file

File diff suppressed because it is too large Load diff

8
test/e2e/annotations/proxyssl.go
View file

@ -47,7 +47,7 @@ var _ = framework.DescribeAnnotation("proxy-ssl-*", func() {
ing := framework.NewSingleIngressWithTLS(host, "/", host, []string{host}, f.Namespace, framework.EchoService, 80, annotations) ing := framework.NewSingleIngressWithTLS(host, "/", host, []string{host}, f.Namespace, framework.EchoService, 80, annotations)
f.EnsureIngress(ing) f.EnsureIngress(ing)
assertProxySSL(f, host, "", "DEFAULT", "TLSv1 TLSv1.1 TLSv1.2", "off", 1, "") assertProxySSL(f, host, "", "DEFAULT", "TLSv1.2", "off", 1, "")
f.HTTPTestClient(). f.HTTPTestClient().
GET("/"). GET("/").
@ -77,7 +77,7 @@ var _ = framework.DescribeAnnotation("proxy-ssl-*", func() {
ing := framework.NewSingleIngressWithTLS(host, "/", host, []string{host}, f.Namespace, framework.EchoService, 80, annotations) ing := framework.NewSingleIngressWithTLS(host, "/", host, []string{host}, f.Namespace, framework.EchoService, 80, annotations)
f.EnsureIngress(ing) f.EnsureIngress(ing)
assertProxySSL(f, host, "", "DEFAULT", "TLSv1 TLSv1.1 TLSv1.2", "on", 2, "on") assertProxySSL(f, host, "", "DEFAULT", "TLSv1.2", "on", 2, "on")
f.HTTPTestClient(). f.HTTPTestClient().
GET("/"). GET("/").
@ -105,7 +105,7 @@ var _ = framework.DescribeAnnotation("proxy-ssl-*", func() {
ing := framework.NewSingleIngressWithTLS(host, "/", host, []string{host}, f.Namespace, framework.EchoService, 80, annotations) ing := framework.NewSingleIngressWithTLS(host, "/", host, []string{host}, f.Namespace, framework.EchoService, 80, annotations)
f.EnsureIngress(ing) f.EnsureIngress(ing)
assertProxySSL(f, host, "", "HIGH:!AES", "TLSv1 TLSv1.1 TLSv1.2", "off", 1, "") assertProxySSL(f, host, "", "HIGH:!AES", "TLSv1.2", "off", 1, "")
f.HTTPTestClient(). f.HTTPTestClient().
GET("/"). GET("/").
@ -171,7 +171,7 @@ var _ = framework.DescribeAnnotation("proxy-ssl-*", func() {
wlValue := "true" wlValue := "true"
f.UpdateNginxConfigMapData(wlKey, wlValue) f.UpdateNginxConfigMapData(wlKey, wlValue)
assertProxySSL(f, host, secretName, "DEFAULT", "TLSv1 TLSv1.1 TLSv1.2", "on", 1, "on") assertProxySSL(f, host, secretName, "DEFAULT", "TLSv1.2", "on", 1, "on")
f.WaitForNginxCustomConfiguration("## start server proxyssl.com", "location ", func(server string) bool { f.WaitForNginxCustomConfiguration("## start server proxyssl.com", "location ", func(server string) bool {
return (!strings.Contains(server, "proxy_ssl_trusted_certificate") && return (!strings.Contains(server, "proxy_ssl_trusted_certificate") &&