Skip to content

Commit 92da3cc

Browse files
liggittmfojtik
liggitt
authored and
mfojtik
committed
make ciphers/tls version configurable
1 parent 9af0523 commit 92da3cc

File tree

11 files changed

+381
-50
lines changed

11 files changed

+381
-50
lines changed

‎pkg/cmd/server/api/types.go

+6
Original file line numberDiff line numberDiff line change
@@ -559,6 +559,12 @@ type ServingInfo struct {
559559
ClientCA string
560560
// NamedCertificates is a list of certificates to use to secure requests to specific hostnames
561561
NamedCertificates []NamedCertificate
562+
// MinTLSVersion is the minimum TLS version supported.
563+
// Values must match version names from https://golang.org/pkg/crypto/tls/#pkg-constants
564+
MinTLSVersion string
565+
// CipherSuites contains an overridden list of ciphers for the server to support.
566+
// Values must match cipher suite IDs from https://golang.org/pkg/crypto/tls/#pkg-constants
567+
CipherSuites []string
562568
}
563569

564570
// NamedCertificate specifies a certificate/key, and the names it should be served for

‎pkg/cmd/server/api/v1/swagger_doc.go

+2
Original file line numberDiff line numberDiff line change
@@ -765,6 +765,8 @@ var map_ServingInfo = map[string]string{
765765
"bindNetwork": "BindNetwork is the type of network to bind to - defaults to \"tcp4\", accepts \"tcp\", \"tcp4\", and \"tcp6\"",
766766
"clientCA": "ClientCA is the certificate bundle for all the signers that you'll recognize for incoming client certificates",
767767
"namedCertificates": "NamedCertificates is a list of certificates to use to secure requests to specific hostnames",
768+
"minTLSVersion": "MinTLSVersion is the minimum TLS version supported. Values must match version names from https://golang.org/pkg/crypto/tls/#pkg-constants",
769+
"cipherSuites": "CipherSuites contains an overridden list of ciphers for the server to support. Values must match cipher suite IDs from https://golang.org/pkg/crypto/tls/#pkg-constants",
768770
}
769771

770772
func (ServingInfo) SwaggerDoc() map[string]string {

‎pkg/cmd/server/api/v1/types.go

+6
Original file line numberDiff line numberDiff line change
@@ -511,6 +511,12 @@ type ServingInfo struct {
511511
ClientCA string `json:"clientCA"`
512512
// NamedCertificates is a list of certificates to use to secure requests to specific hostnames
513513
NamedCertificates []NamedCertificate `json:"namedCertificates"`
514+
// MinTLSVersion is the minimum TLS version supported.
515+
// Values must match version names from https://golang.org/pkg/crypto/tls/#pkg-constants
516+
MinTLSVersion string `json:"minTLSVersion,omitempty"`
517+
// CipherSuites contains an overridden list of ciphers for the server to support.
518+
// Values must match cipher suite IDs from https://golang.org/pkg/crypto/tls/#pkg-constants
519+
CipherSuites []string `json:"cipherSuites,omitempty"`
514520
}
515521

516522
// NamedCertificate specifies a certificate/key, and the names it should be served for

‎pkg/cmd/server/api/validation/validation.go

+10
Original file line numberDiff line numberDiff line change
@@ -21,6 +21,7 @@ import (
2121
"k8s.io/kubernetes/pkg/util/validation/field"
2222

2323
"github.com/openshift/origin/pkg/cmd/server/api"
24+
"github.com/openshift/origin/pkg/cmd/server/crypto"
2425
cmdutil "github.com/openshift/origin/pkg/cmd/util"
2526
cmdflags "github.com/openshift/origin/pkg/cmd/util/flags"
2627
)
@@ -132,6 +133,15 @@ func ValidateServingInfo(info api.ServingInfo, fldPath *field.Path) ValidationRe
132133
}
133134
}
134135

136+
if _, err := crypto.TLSVersion(info.MinTLSVersion); err != nil {
137+
validationResults.AddErrors(field.NotSupported(fldPath.Child("minTLSVersion"), info.MinTLSVersion, crypto.ValidTLSVersions()))
138+
}
139+
for i, cipher := range info.CipherSuites {
140+
if _, err := crypto.CipherSuite(cipher); err != nil {
141+
validationResults.AddErrors(field.NotSupported(fldPath.Child("cipherSuites").Index(i), cipher, crypto.ValidCipherSuites()))
142+
}
143+
}
144+
135145
return validationResults
136146
}
137147

‎pkg/cmd/server/crypto/crypto.go

+136-50
Original file line numberDiff line numberDiff line change
@@ -27,64 +27,150 @@ import (
2727
"k8s.io/kubernetes/pkg/auth/user"
2828
"k8s.io/kubernetes/pkg/util/sets"
2929

30+
"sort"
31+
3032
"github.com/openshift/origin/pkg/auth/authenticator/request/x509request"
3133
cmdutil "github.com/openshift/origin/pkg/cmd/util"
3234
)
3335

34-
// SecureTLSConfig enforces the default minimum security settings for the
35-
// cluster.
36-
// TODO: allow override
37-
func SecureTLSConfig(config *tls.Config) *tls.Config {
38-
// Recommendations from https://wiki.mozilla.org/Security/Server_Side_TLS
36+
var versions = map[string]uint16{
37+
"VersionTLS10": tls.VersionTLS10,
38+
"VersionTLS11": tls.VersionTLS11,
39+
"VersionTLS12": tls.VersionTLS12,
40+
}
41+
42+
func TLSVersion(versionName string) (uint16, error) {
43+
if len(versionName) == 0 {
44+
return DefaultTLSVersion(), nil
45+
}
46+
if version, ok := versions[versionName]; ok {
47+
return version, nil
48+
}
49+
return 0, fmt.Errorf("unknown tls version %q", versionName)
50+
}
51+
func TLSVersionOrDie(versionName string) uint16 {
52+
version, err := TLSVersion(versionName)
53+
if err != nil {
54+
panic(err)
55+
}
56+
return version
57+
}
58+
func ValidTLSVersions() []string {
59+
validVersions := []string{}
60+
for k := range versions {
61+
validVersions = append(validVersions, k)
62+
}
63+
sort.Strings(validVersions)
64+
return validVersions
65+
}
66+
func DefaultTLSVersion() uint16 {
3967
// Can't use SSLv3 because of POODLE and BEAST
4068
// Can't use TLSv1.0 because of POODLE and BEAST using CBC cipher
4169
// Can't use TLSv1.1 because of RC4 cipher usage
42-
config.MinVersion = tls.VersionTLS12
43-
// In a legacy environment, allow cipher control to be disabled.
44-
if len(os.Getenv("OPENSHIFT_ALLOW_DANGEROUS_TLS_CIPHER_SUITES")) == 0 {
45-
config.PreferServerCipherSuites = true
46-
config.CipherSuites = []uint16{
47-
// Ciphers below are selected and ordered based on the recommended "Intermediate compatibility" suite
48-
// Compare with available ciphers when bumping Go versions
49-
//
50-
// Available ciphers from last comparison (go 1.6):
51-
// TLS_RSA_WITH_RC4_128_SHA - no
52-
// TLS_RSA_WITH_3DES_EDE_CBC_SHA
53-
// TLS_RSA_WITH_AES_128_CBC_SHA
54-
// TLS_RSA_WITH_AES_256_CBC_SHA
55-
// TLS_RSA_WITH_AES_128_GCM_SHA256
56-
// TLS_RSA_WITH_AES_256_GCM_SHA384
57-
// TLS_ECDHE_ECDSA_WITH_RC4_128_SHA - no
58-
// TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA
59-
// TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA
60-
// TLS_ECDHE_RSA_WITH_RC4_128_SHA - no
61-
// TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA
62-
// TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA
63-
// TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA
64-
// TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256
65-
// TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256
66-
// TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384
67-
// TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384
68-
69-
tls.TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,
70-
tls.TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,
71-
tls.TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,
72-
tls.TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,
73-
tls.TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA,
74-
tls.TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA,
75-
tls.TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA,
76-
tls.TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA,
77-
// the next two are in the intermediate suite, but go1.6 http2 complains when they are included at the recommended index
78-
// fixed in https://github.com/golang/go/commit/b5aae1a2845f157a2565b856fb2d7773a0f7af25 in go1.7
79-
// tls.TLS_RSA_WITH_AES_128_GCM_SHA256,
80-
// tls.TLS_RSA_WITH_AES_256_GCM_SHA384,
81-
tls.TLS_RSA_WITH_AES_128_CBC_SHA,
82-
tls.TLS_RSA_WITH_AES_256_CBC_SHA,
83-
tls.TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA,
84-
tls.TLS_RSA_WITH_3DES_EDE_CBC_SHA,
70+
return tls.VersionTLS12
71+
}
72+
73+
var ciphers = map[string]uint16{
74+
"TLS_RSA_WITH_RC4_128_SHA": tls.TLS_RSA_WITH_RC4_128_SHA,
75+
"TLS_RSA_WITH_3DES_EDE_CBC_SHA": tls.TLS_RSA_WITH_3DES_EDE_CBC_SHA,
76+
"TLS_RSA_WITH_AES_128_CBC_SHA": tls.TLS_RSA_WITH_AES_128_CBC_SHA,
77+
"TLS_RSA_WITH_AES_256_CBC_SHA": tls.TLS_RSA_WITH_AES_256_CBC_SHA,
78+
"TLS_RSA_WITH_AES_128_GCM_SHA256": tls.TLS_RSA_WITH_AES_128_GCM_SHA256,
79+
"TLS_RSA_WITH_AES_256_GCM_SHA384": tls.TLS_RSA_WITH_AES_256_GCM_SHA384,
80+
"TLS_ECDHE_ECDSA_WITH_RC4_128_SHA": tls.TLS_ECDHE_ECDSA_WITH_RC4_128_SHA,
81+
"TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA": tls.TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA,
82+
"TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA": tls.TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA,
83+
"TLS_ECDHE_RSA_WITH_RC4_128_SHA": tls.TLS_ECDHE_RSA_WITH_RC4_128_SHA,
84+
"TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA": tls.TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA,
85+
"TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA": tls.TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA,
86+
"TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA": tls.TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA,
87+
"TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256": tls.TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,
88+
"TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256": tls.TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,
89+
"TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384": tls.TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,
90+
"TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384": tls.TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,
91+
}
92+
93+
func CipherSuite(cipherName string) (uint16, error) {
94+
if cipher, ok := ciphers[cipherName]; ok {
95+
return cipher, nil
96+
}
97+
return 0, fmt.Errorf("unknown cipher name %q", cipherName)
98+
}
99+
100+
func CipherSuitesOrDie(cipherNames []string) []uint16 {
101+
if len(cipherNames) == 0 {
102+
return DefaultCiphers()
103+
}
104+
cipherValues := []uint16{}
105+
for _, cipherName := range cipherNames {
106+
cipher, err := CipherSuite(cipherName)
107+
if err != nil {
108+
panic(err)
85109
}
86-
} else {
87-
glog.Warningf("Potentially insecure TLS cipher suites are allowed in client connections because environment variable OPENSHIFT_ALLOW_DANGEROUS_TLS_CIPHER_SUITES is set")
110+
cipherValues = append(cipherValues, cipher)
111+
}
112+
return cipherValues
113+
}
114+
func ValidCipherSuites() []string {
115+
validCipherSuites := []string{}
116+
for k := range ciphers {
117+
validCipherSuites = append(validCipherSuites, k)
118+
}
119+
sort.Strings(validCipherSuites)
120+
return validCipherSuites
121+
}
122+
func DefaultCiphers() []uint16 {
123+
return []uint16{
124+
// Ciphers below are selected and ordered based on the recommended "Intermediate compatibility" suite
125+
// Compare with available ciphers when bumping Go versions
126+
//
127+
// Available ciphers from last comparison (go 1.6):
128+
// TLS_RSA_WITH_RC4_128_SHA - no
129+
// TLS_RSA_WITH_3DES_EDE_CBC_SHA
130+
// TLS_RSA_WITH_AES_128_CBC_SHA
131+
// TLS_RSA_WITH_AES_256_CBC_SHA
132+
// TLS_RSA_WITH_AES_128_GCM_SHA256
133+
// TLS_RSA_WITH_AES_256_GCM_SHA384
134+
// TLS_ECDHE_ECDSA_WITH_RC4_128_SHA - no
135+
// TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA
136+
// TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA
137+
// TLS_ECDHE_RSA_WITH_RC4_128_SHA - no
138+
// TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA
139+
// TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA
140+
// TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA
141+
// TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256
142+
// TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256
143+
// TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384
144+
// TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384
145+
146+
tls.TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,
147+
tls.TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,
148+
tls.TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,
149+
tls.TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,
150+
tls.TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA,
151+
tls.TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA,
152+
tls.TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA,
153+
tls.TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA,
154+
// the next two are in the intermediate suite, but go1.6 http2 complains when they are included at the recommended index
155+
// fixed in https://github.com/golang/go/commit/b5aae1a2845f157a2565b856fb2d7773a0f7af25 in go1.7
156+
// tls.TLS_RSA_WITH_AES_128_GCM_SHA256,
157+
// tls.TLS_RSA_WITH_AES_256_GCM_SHA384,
158+
tls.TLS_RSA_WITH_AES_128_CBC_SHA,
159+
tls.TLS_RSA_WITH_AES_256_CBC_SHA,
160+
tls.TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA,
161+
tls.TLS_RSA_WITH_3DES_EDE_CBC_SHA,
162+
}
163+
}
164+
165+
// SecureTLSConfig enforces the default minimum security settings for the cluster.
166+
func SecureTLSConfig(config *tls.Config) *tls.Config {
167+
if config.MinVersion == 0 {
168+
config.MinVersion = DefaultTLSVersion()
169+
}
170+
171+
config.PreferServerCipherSuites = true
172+
if len(config.CipherSuites) == 0 {
173+
config.CipherSuites = DefaultCiphers()
88174
}
89175
return config
90176
}

‎pkg/cmd/server/crypto/crypto_test.go

+42
Original file line numberDiff line numberDiff line change
@@ -5,12 +5,54 @@ import (
55
"crypto/x509"
66
"crypto/x509/pkix"
77
"fmt"
8+
"go/importer"
9+
"strings"
810
"testing"
911
"time"
1012
)
1113

1214
const certificateLifetime = 365 * 2
1315

16+
func TestConstantMaps(t *testing.T) {
17+
pkg, err := importer.Default().Import("crypto/tls")
18+
if err != nil {
19+
fmt.Printf("error: %s\n", err.Error())
20+
return
21+
}
22+
discoveredVersions := map[string]bool{}
23+
discoveredCiphers := map[string]bool{}
24+
for _, declName := range pkg.Scope().Names() {
25+
if strings.HasPrefix(declName, "VersionTLS") {
26+
discoveredVersions[declName] = true
27+
}
28+
if strings.HasPrefix(declName, "TLS_RSA_") || strings.HasPrefix(declName, "TLS_ECDHE_") {
29+
discoveredCiphers[declName] = true
30+
}
31+
}
32+
33+
for k := range discoveredCiphers {
34+
if _, ok := ciphers[k]; !ok {
35+
t.Errorf("discovered cipher tls.%s not in ciphers map", k)
36+
}
37+
}
38+
for k := range ciphers {
39+
if _, ok := discoveredCiphers[k]; !ok {
40+
t.Errorf("ciphers map has %s not in tls package", k)
41+
}
42+
}
43+
44+
for k := range discoveredVersions {
45+
if _, ok := versions[k]; !ok {
46+
t.Errorf("discovered version tls.%s not in version map", k)
47+
}
48+
}
49+
for k := range versions {
50+
if _, ok := discoveredVersions[k]; !ok {
51+
t.Errorf("versions map has %s not in tls package", k)
52+
}
53+
}
54+
}
55+
1456
func TestCrypto(t *testing.T) {
1557
roots := x509.NewCertPool()
1658
intermediates := x509.NewCertPool()

‎pkg/cmd/server/kubernetes/master_config.go

+3
Original file line numberDiff line numberDiff line change
@@ -50,6 +50,7 @@ import (
5050
"github.com/openshift/origin/pkg/api"
5151
"github.com/openshift/origin/pkg/cmd/flagtypes"
5252
configapi "github.com/openshift/origin/pkg/cmd/server/api"
53+
"github.com/openshift/origin/pkg/cmd/server/crypto"
5354
"github.com/openshift/origin/pkg/cmd/server/election"
5455
cmdflags "github.com/openshift/origin/pkg/cmd/util/flags"
5556
"github.com/openshift/origin/pkg/controller/shared"
@@ -298,6 +299,8 @@ func BuildKubernetesMasterConfig(options configapi.MasterConfig, requestContextM
298299
genericConfig.LegacyAPIGroupPrefixes = LegacyAPIGroupPrefixes
299300
genericConfig.SecureServingInfo.BindAddress = options.ServingInfo.BindAddress
300301
genericConfig.SecureServingInfo.BindNetwork = options.ServingInfo.BindNetwork
302+
genericConfig.SecureServingInfo.MinTLSVersion = crypto.TLSVersionOrDie(options.ServingInfo.MinTLSVersion)
303+
genericConfig.SecureServingInfo.CipherSuites = crypto.CipherSuitesOrDie(options.ServingInfo.CipherSuites)
301304
oAuthClientCertCAs, err := configapi.GetOAuthClientCertCAs(options)
302305
if err != nil {
303306
glog.Fatalf("Error setting up OAuth2 client certificates: %v", err)

‎pkg/cmd/server/kubernetes/node_config.go

+2
Original file line numberDiff line numberDiff line change
@@ -275,6 +275,8 @@ func BuildKubernetesNodeConfig(options configapi.NodeConfig, enableProxy, enable
275275
// Do not use NameToCertificate, since that requires certificates be included in the server's tlsConfig.Certificates list,
276276
// which we do not control when running with http.Server#ListenAndServeTLS
277277
GetCertificate: cmdutil.GetCertificateFunc(extraCerts),
278+
MinVersion: crypto.TLSVersionOrDie(options.ServingInfo.MinTLSVersion),
279+
CipherSuites: crypto.CipherSuitesOrDie(options.ServingInfo.CipherSuites),
278280
}),
279281
CertFile: options.ServingInfo.ServerCert.CertFile,
280282
KeyFile: options.ServingInfo.ServerCert.KeyFile,

‎pkg/cmd/server/origin/asset.go

+2
Original file line numberDiff line numberDiff line change
@@ -73,6 +73,8 @@ func (c *AssetConfig) Run() {
7373
server.TLSConfig = crypto.SecureTLSConfig(&tls.Config{
7474
// Set SNI certificate func
7575
GetCertificate: cmdutil.GetCertificateFunc(extraCerts),
76+
MinVersion: crypto.TLSVersionOrDie(c.Options.ServingInfo.MinTLSVersion),
77+
CipherSuites: crypto.CipherSuitesOrDie(c.Options.ServingInfo.CipherSuites),
7678
})
7779
glog.Infof("Web console listening at https://%s", c.Options.ServingInfo.BindAddress)
7880
glog.Fatal(cmdutil.ListenAndServeTLS(server, c.Options.ServingInfo.BindNetwork, c.Options.ServingInfo.ServerCert.CertFile, c.Options.ServingInfo.ServerCert.KeyFile))

‎pkg/cmd/server/origin/master.go

+2
Original file line numberDiff line numberDiff line change
@@ -396,6 +396,8 @@ func (c *MasterConfig) serve(handler http.Handler, messages []string) {
396396
ClientCAs: c.ClientCAs,
397397
// Set SNI certificate func
398398
GetCertificate: cmdutil.GetCertificateFunc(extraCerts),
399+
MinVersion: crypto.TLSVersionOrDie(c.Options.ServingInfo.MinTLSVersion),
400+
CipherSuites: crypto.CipherSuitesOrDie(c.Options.ServingInfo.CipherSuites),
399401
})
400402
glog.Fatal(cmdutil.ListenAndServeTLS(server, c.Options.ServingInfo.BindNetwork, c.Options.ServingInfo.ServerCert.CertFile, c.Options.ServingInfo.ServerCert.KeyFile))
401403
} else {

0 commit comments

Comments
 (0)