Skip to content

Commit 59a5022

Browse files
ZetaoZhuangZetaoZhuang
authored
expose MinTLSVersion config for TLS handshake (#3103)
* expose MinTLSVersion config * address comment * use valid TLS version in config test
1 parent 8e8a5fd commit 59a5022

File tree

8 files changed

+78
-8
lines changed

8 files changed

+78
-8
lines changed

‎cns/configuration/cns_config.json‎

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -33,5 +33,6 @@
3333
"MellanoxMonitorIntervalSecs": 30,
3434
"AZRSettings": {
3535
"PopulateHomeAzCacheRetryIntervalSecs": 60
36-
}
36+
},
37+
"MinTLSVersion": "TLS 1.2"
3738
}

‎cns/configuration/configuration.go‎

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -54,6 +54,7 @@ type CNSConfig struct {
5454
WatchPods bool `json:"-"`
5555
WireserverIP string
5656
GRPCSettings GRPCSettings
57+
MinTLSVersion string
5758
}
5859

5960
type TelemetrySettings struct {
@@ -229,6 +230,10 @@ func SetCNSConfigDefaults(config *CNSConfig) {
229230
if config.GRPCSettings.Port == 0 {
230231
config.GRPCSettings.Port = 8080
231232
}
233+
234+
if config.MinTLSVersion == "" {
235+
config.MinTLSVersion = "TLS 1.2"
236+
}
232237
config.GRPCSettings.Enable = false
233238
config.WatchPods = config.EnableIPAMv2 || config.EnableSwiftV2
234239
}

‎cns/configuration/configuration_test.go‎

Lines changed: 7 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -86,9 +86,10 @@ func TestReadConfigFromFile(t *testing.T) {
8686
AZRSettings: AZRSettings{
8787
PopulateHomeAzCacheRetryIntervalSecs: 60,
8888
},
89-
UseHTTPS: true,
90-
UseMTLS: true,
91-
WireserverIP: "168.63.129.16",
89+
UseHTTPS: true,
90+
UseMTLS: true,
91+
WireserverIP: "168.63.129.16",
92+
MinTLSVersion: "TLS 1.3",
9293
},
9394
wantErr: false,
9495
},
@@ -220,6 +221,7 @@ func TestSetCNSConfigDefaults(t *testing.T) {
220221
IPAddress: "localhost",
221222
Port: 8080,
222223
},
224+
MinTLSVersion: "TLS 1.2",
223225
},
224226
},
225227
{
@@ -250,6 +252,7 @@ func TestSetCNSConfigDefaults(t *testing.T) {
250252
IPAddress: "192.168.1.1",
251253
Port: 9090,
252254
},
255+
MinTLSVersion: "TLS 1.3",
253256
},
254257
want: CNSConfig{
255258
ChannelMode: "Other",
@@ -279,6 +282,7 @@ func TestSetCNSConfigDefaults(t *testing.T) {
279282
IPAddress: "192.168.1.1",
280283
Port: 9090,
281284
},
285+
MinTLSVersion: "TLS 1.3",
282286
},
283287
},
284288
}

‎cns/configuration/testdata/good.json‎

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -34,5 +34,6 @@
3434
"WireserverIP": "168.63.129.16",
3535
"AZRSettings": {
3636
"PopulateHomeAzCacheRetryIntervalSecs": 60
37-
}
37+
},
38+
"MinTLSVersion": "TLS 1.3"
3839
}

‎cns/service.go‎

Lines changed: 26 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -28,6 +28,8 @@ const (
2828
genericData = "com.microsoft.azure.network.generic"
2929
)
3030

31+
var errTLSConfig = errors.New("unsupported TLS version name from config")
32+
3133
// Service defines Container Networking Service.
3234
type Service struct {
3335
*common.Service
@@ -179,10 +181,14 @@ func getTLSConfigFromFile(tlsSettings localtls.TlsSettings) (*tls.Config, error)
179181
PrivateKey: privateKey,
180182
Leaf: leafCertificate,
181183
}
184+
minTLSVersionNumber, err := parseTLSVersionName(tlsSettings.MinTLSVersion)
185+
if err != nil {
186+
return nil, errors.Wrap(err, "parsing MinTLSVersion from config")
187+
}
182188

183189
tlsConfig := &tls.Config{
184190
MaxVersion: tls.VersionTLS13,
185-
MinVersion: tls.VersionTLS12,
191+
MinVersion: minTLSVersionNumber,
186192
Certificates: []tls.Certificate{
187193
tlsCert,
188194
},
@@ -226,8 +232,13 @@ func getTLSConfigFromKeyVault(tlsSettings localtls.TlsSettings, errChan chan<- e
226232
errChan <- cr.Refresh(ctx, tlsSettings.KeyVaultCertificateRefreshInterval)
227233
}()
228234

235+
minTLSVersionNumber, err := parseTLSVersionName(tlsSettings.MinTLSVersion)
236+
if err != nil {
237+
return nil, errors.Wrap(err, "parsing MinTLSVersion from config")
238+
}
239+
229240
tlsConfig := tls.Config{
230-
MinVersion: tls.VersionTLS12,
241+
MinVersion: minTLSVersionNumber,
231242
MaxVersion: tls.VersionTLS13,
232243
GetCertificate: func(_ *tls.ClientHelloInfo) (*tls.Certificate, error) {
233244
return cr.GetCertificate(), nil
@@ -316,3 +327,16 @@ func (service *Service) SendErrorResponse(w http.ResponseWriter, errMsg error) {
316327
err := acn.Encode(w, &resp)
317328
logger.Errorf("[%s] %+v %s.", service.Name, &resp, err.Error())
318329
}
330+
331+
// parseTLSVersionName returns the version number for the provided TLS version name
332+
// (e.g. 0x0301)
333+
func parseTLSVersionName(versionName string) (uint16, error) {
334+
switch versionName {
335+
case "TLS 1.2":
336+
return tls.VersionTLS12, nil
337+
case "TLS 1.3":
338+
return tls.VersionTLS13, nil
339+
default:
340+
return 0, errors.Wrapf(errTLSConfig, "version name %s", versionName)
341+
}
342+
}

‎cns/service/main.go‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -776,6 +776,7 @@ func main() {
776776
MSIResourceID: cnsconfig.MSISettings.ResourceID,
777777
KeyVaultCertificateRefreshInterval: time.Duration(cnsconfig.KeyVaultSettings.RefreshIntervalInHrs) * time.Hour,
778778
UseMTLS: cnsconfig.UseMTLS,
779+
MinTLSVersion: cnsconfig.MinTLSVersion,
779780
}
780781
}
781782

‎cns/service_test.go‎

Lines changed: 34 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -76,6 +76,7 @@ func TestNewService(t *testing.T) {
7676
TLSPort: "10091",
7777
TLSSubjectName: "localhost",
7878
TLSCertificatePath: testCertFilePath,
79+
MinTLSVersion: "TLS 1.2",
7980
}
8081

8182
svc, err := NewService(config.Name, config.Version, config.ChannelMode, config.Store)
@@ -94,10 +95,13 @@ func TestNewService(t *testing.T) {
9495
err = svc.StartListener(config)
9596
require.NoError(t, err)
9697

98+
minTLSVersionNumber, err := parseTLSVersionName(config.TLSSettings.MinTLSVersion)
99+
require.NoError(t, err)
100+
97101
tlsClient := &http.Client{
98102
Transport: &http.Transport{
99103
TLSClientConfig: &tls.Config{
100-
MinVersion: tls.VersionTLS12,
104+
MinVersion: minTLSVersionNumber,
101105
MaxVersion: tls.VersionTLS13,
102106
ServerName: config.TLSSettings.TLSSubjectName,
103107
// #nosec G402 for test purposes only
@@ -134,6 +138,7 @@ func TestNewService(t *testing.T) {
134138
TLSSubjectName: "localhost",
135139
TLSCertificatePath: testCertFilePath,
136140
UseMTLS: true,
141+
MinTLSVersion: "TLS 1.2",
137142
}
138143

139144
svc, err := NewService(config.Name, config.Version, config.ChannelMode, config.Store)
@@ -322,3 +327,31 @@ func createTestCertificate(t *testing.T) string {
322327

323328
return testCertFilePath
324329
}
330+
331+
func TestTLSVersionNumber(t *testing.T) {
332+
t.Run("unsupported ServerSettings.MinTLSVersion TLS 1.0", func(t *testing.T) {
333+
versionNumber, err := parseTLSVersionName("TLS 1.0")
334+
require.Equal(t, uint16(0), versionNumber)
335+
require.Error(t, err)
336+
require.ErrorContains(t, err, "unsupported TLS version name")
337+
})
338+
339+
t.Run("unsupported ServerSettings.MinTLSVersion TLS 1.1", func(t *testing.T) {
340+
versionNumber, err := parseTLSVersionName("TLS 1.1")
341+
require.Equal(t, uint16(0), versionNumber)
342+
require.Error(t, err)
343+
require.ErrorContains(t, err, "unsupported TLS version name")
344+
})
345+
t.Run("unsupported ServerSettings.MinTLSVersion TLS 1.4", func(t *testing.T) {
346+
versionNumber, err := parseTLSVersionName("TLS 1.4")
347+
require.Equal(t, uint16(0), versionNumber)
348+
require.Error(t, err)
349+
require.ErrorContains(t, err, "unsupported TLS version name")
350+
})
351+
352+
t.Run("valid ServerSettings.MinTLSVersion", func(t *testing.T) {
353+
versionNumber, err := parseTLSVersionName("TLS 1.2")
354+
require.Equal(t, uint16(tls.VersionTLS12), versionNumber)
355+
require.NoError(t, err)
356+
})
357+
}

‎server/tls/tlscertificate_retriever.go‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -14,6 +14,7 @@ type TlsSettings struct {
1414
MSIResourceID string
1515
KeyVaultCertificateRefreshInterval time.Duration
1616
UseMTLS bool
17+
MinTLSVersion string
1718
}
1819

1920
func GetTlsCertificateRetriever(settings TlsSettings) (TlsCertificateRetriever, error) {

0 commit comments

Comments
 (0)