Skip to content

[release-4.18] OCPBUGS-56834: allow TLS1.3 or modern profile to be specified #2315

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
wants to merge 1 commit into
base: release-4.18
Choose a base branch
from
Open

[release-4.18] OCPBUGS-56834: allow TLS1.3 or modern profile to be specified #2315

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
27 changes: 12 additions & 15 deletions openshift-kube-apiserver/admission/customresourcevalidation/apiserver/validate_apiserver.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -180,12 +180,6 @@ func validateTLSSecurityProfileType(fieldPath *field.Path, profile *configv1.TLS

errs := field.ErrorList{}

availableTypes := []string{
string(configv1.TLSProfileOldType),
string(configv1.TLSProfileIntermediateType),
string(configv1.TLSProfileCustomType),
}

switch profile.Type {
case "":
if profile.Old != nil || profile.Intermediate != nil || profile.Modern != nil || profile.Custom != nil {
Expand All @@ -200,13 +194,15 @@ func validateTLSSecurityProfileType(fieldPath *field.Path, profile *configv1.TLS
errs = append(errs, field.Required(fieldPath.Child("intermediate"), fmt.Sprintf(typeProfileMismatchFmt, profile.Type)))
}
case configv1.TLSProfileModernType:
errs = append(errs, field.NotSupported(fieldPath.Child("type"), profile.Type, availableTypes))
if profile.Modern == nil {
errs = append(errs, field.Required(fieldPath.Child("modern"), fmt.Sprintf(typeProfileMismatchFmt, profile.Type)))
}
case configv1.TLSProfileCustomType:
if profile.Custom == nil {
errs = append(errs, field.Required(fieldPath.Child("custom"), fmt.Sprintf(typeProfileMismatchFmt, profile.Type)))
}
default:
errs = append(errs, field.Invalid(typePath, profile.Type, fmt.Sprintf("unknown type, valid values are: %v", availableTypes)))
errs = append(errs, field.Invalid(typePath, profile.Type, fmt.Sprintf("unknown type, valid values are: [Old Intermediate Modern Custom]")))
}

return errs
Expand All @@ -215,6 +211,13 @@ func validateTLSSecurityProfileType(fieldPath *field.Path, profile *configv1.TLS
func validateCipherSuites(fieldPath *field.Path, suites []string, version configv1.TLSProtocolVersion) field.ErrorList {
errs := field.ErrorList{}

if version == configv1.VersionTLS13 {
if len(suites) != 0 {
errs = append(errs, field.Invalid(fieldPath, suites, "TLS 1.3 cipher suites are not configurable"))
}
return errs
}

if ianaSuites := libgocrypto.OpenSSLToIANACipherSuites(suites); len(ianaSuites) == 0 {
errs = append(errs, field.Invalid(fieldPath, suites, "no supported cipher suite found"))
}
Expand All @@ -224,7 +227,7 @@ func validateCipherSuites(fieldPath *field.Path, suites []string, version config
// configuration to return an error when http2 required cipher suites aren't
// provided.
// See: go/x/net/http2.ConfigureServer for futher information.
if version < configv1.VersionTLS13 && !haveRequiredHTTP2CipherSuites(suites) {
if !haveRequiredHTTP2CipherSuites(suites) {
errs = append(errs, field.Invalid(fieldPath, suites, "http2: TLSConfig.CipherSuites is missing an HTTP/2-required AES_128_GCM_SHA256 cipher (need at least one of ECDHE-RSA-AES128-GCM-SHA256 or ECDHE-ECDSA-AES128-GCM-SHA256)"))
}

Expand All @@ -246,14 +249,8 @@ func haveRequiredHTTP2CipherSuites(suites []string) bool {

func validateMinTLSVersion(fieldPath *field.Path, version configv1.TLSProtocolVersion) field.ErrorList {
errs := field.ErrorList{}

if version == configv1.VersionTLS13 {
return append(errs, field.NotSupported(fieldPath, version, []string{string(configv1.VersionTLS10), string(configv1.VersionTLS11), string(configv1.VersionTLS12)}))
}

if _, err := libgocrypto.TLSVersion(string(version)); err != nil {
errs = append(errs, field.Invalid(fieldPath, version, err.Error()))
}

return errs
}
48 changes: 33 additions & 15 deletions ...ft-kube-apiserver/admission/customresourcevalidation/apiserver/validate_apiserver_test.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -144,27 +144,20 @@ func Test_validateTLSSecurityProfile(t *testing.T) {
},
},
{
name: "modern type - currently unsupported",
name: "modern type - supported",
profile: &configv1.TLSSecurityProfile{
Type: configv1.TLSProfileModernType,
Modern: &configv1.ModernTLSProfile{},
},
want: field.ErrorList{
field.NotSupported(rootFieldPath.Child("type"), configv1.TLSProfileModernType,
[]string{
string(configv1.TLSProfileOldType),
string(configv1.TLSProfileIntermediateType),
string(configv1.TLSProfileCustomType),
}),
},
want: field.ErrorList{},
},
{
name: "unknown type",
profile: &configv1.TLSSecurityProfile{
Type: "something",
},
want: field.ErrorList{
field.Invalid(rootFieldPath.Child("type"), "something", "unknown type, valid values are: [Old Intermediate Custom]"),
field.Invalid(rootFieldPath.Child("type"), "something", "unknown type, valid values are: [Old Intermediate Modern Custom]"),
},
},
{
Expand Down Expand Up @@ -212,19 +205,16 @@ func Test_validateTLSSecurityProfile(t *testing.T) {
},
},
{
name: "min tls 1.3 - currently unsupported",
name: "min tls 1.3 - supported",
profile: &configv1.TLSSecurityProfile{
Type: "Custom",
Custom: &configv1.CustomTLSProfile{
TLSProfileSpec: configv1.TLSProfileSpec{
Ciphers: []string{"ECDHE-ECDSA-CHACHA20-POLY1305"},
MinTLSVersion: configv1.VersionTLS13,
},
},
},
want: field.ErrorList{
field.NotSupported(rootFieldPath.Child("custom", "minTLSVersion"), configv1.VersionTLS13, []string{string(configv1.VersionTLS10), string(configv1.VersionTLS11), string(configv1.VersionTLS12)}),
},
want: field.ErrorList{},
},
{
name: "custom profile missing required http2 ciphers",
Expand All @@ -246,6 +236,19 @@ func Test_validateTLSSecurityProfile(t *testing.T) {
field.Invalid(rootFieldPath.Child("custom", "ciphers"), []string{"ECDSA-AES256-GCM-SHA384", "ECDHE-RSA-AES256-GCM-SHA384", "ECDHE-ECDSA-CHACHA20-POLY1305", "ECDHE-RSA-CHACHA20-POLY1305"}, "http2: TLSConfig.CipherSuites is missing an HTTP/2-required AES_128_GCM_SHA256 cipher (need at least one of ECDHE-RSA-AES128-GCM-SHA256 or ECDHE-ECDSA-AES128-GCM-SHA256)"),
},
},
{
name: "custom profile required http2 ciphers tls 1.3",
profile: &configv1.TLSSecurityProfile{
Type: "Custom",
Custom: &configv1.CustomTLSProfile{
TLSProfileSpec: configv1.TLSProfileSpec{
Ciphers: []string{},
MinTLSVersion: configv1.VersionTLS13,
},
},
},
want: field.ErrorList{},
},
{
name: "custom profile with one required http2 ciphers",
profile: &configv1.TLSSecurityProfile{
Expand All @@ -265,6 +268,21 @@ func Test_validateTLSSecurityProfile(t *testing.T) {
},
want: field.ErrorList{},
},
{
name: "custom profile min tls 1.3 cannot customize",
profile: &configv1.TLSSecurityProfile{
Type: "Custom",
Custom: &configv1.CustomTLSProfile{
TLSProfileSpec: configv1.TLSProfileSpec{
Ciphers: []string{"TLS_AES_128_GCM_SHA256"},
MinTLSVersion: configv1.VersionTLS13,
},
},
},
want: field.ErrorList{
field.Invalid(rootFieldPath.Child("custom", "ciphers"), []string{"TLS_AES_128_GCM_SHA256"}, "TLS 1.3 cipher suites are not configurable"),
},
},
}
for _, tt := range tests {
t.Run(tt.name, func(t *testing.T) {
Expand Down