Skip to content

Commit c3dd463

Browse files
markus-hentschbitkeksanjastrunk
authored
Add Secure Connections Standard (#548)
* Add first part of the secure connections standard Signed-off-by: Markus Hentsch <[email protected]> * Add notes about the classifications Signed-off-by: Markus Hentsch <[email protected]> * Add considered options and open questions Signed-off-by: Markus Hentsch <[email protected]> * Fix linter problems Signed-off-by: Markus Hentsch <[email protected]> * Add TLS standardization Signed-off-by: Markus Hentsch <[email protected]> * Add database and message queue channel security, extend TLS cipher rules Signed-off-by: Markus Hentsch <[email protected]> * Add remaining decision sections Signed-off-by: Markus Hentsch <[email protected]> * Add testing script for secure connection standard (WIP) Signed-off-by: Markus Hentsch <[email protected]> * Turn avoiding CBC mode into a recommendation. https://crypto.stackexchange.com/a/95660 Signed-off-by: Markus Hentsch <[email protected]> * Refactor the TLS test script to use SSLyze and implement all tests based on the current standard draft Signed-off-by: Markus Hentsch <[email protected]> * Add testing README and reference Signed-off-by: Markus Hentsch <[email protected]> * Address review feedback Signed-off-by: Markus Hentsch <[email protected]> * Fix typo in test script comment Signed-off-by: Markus Hentsch <[email protected]> * Add glossary and rephrase "SCS" to "SCS project" Signed-off-by: Markus Hentsch <[email protected]> * Rename standard filename due to conflicting counter Signed-off-by: Markus Hentsch <[email protected]> * Refine the scope in regards to the communication channels Signed-off-by: Markus Hentsch <[email protected]> * s/IPsec/WireGuard/ Signed-off-by: Markus Hentsch <[email protected]> * Fix option references for oslo.messaging ssl Signed-off-by: Markus Hentsch <[email protected]> * Add RFC link for TLS deprecation Signed-off-by: Markus Hentsch <[email protected]> * Don't endorse internal CAs specifically Signed-off-by: Markus Hentsch <[email protected]> * Refactor test script to check Mozilla TLS recommendations Signed-off-by: Markus Hentsch <[email protected]> * Update standard to reference Mozilla's TLS recommendations Signed-off-by: Markus Hentsch <[email protected]> * Migrate test script requirements to requirements.in Signed-off-by: Markus Hentsch <[email protected]> * Add libvirt security choices to design considerations Signed-off-by: Markus Hentsch <[email protected]> * Add open question about libvirt hardening Signed-off-by: Markus Hentsch <[email protected]> * Relax the requirement for the libvirt port Signed-off-by: Markus Hentsch <[email protected]> * Rephrase and clarify libvirt security recommendations and questions Signed-off-by: Markus Hentsch <[email protected]> * Add Mozilla TLS JSON override option to test script Signed-off-by: Markus Hentsch <[email protected]> * Fully parameterize Mozilla TLS config in test script Signed-off-by: Markus Hentsch <[email protected]> * Rename cli args in test script Signed-off-by: Markus Hentsch <[email protected]> * Add Mozilla TLS JSON copy and staging YAML entry Signed-off-by: Markus Hentsch <[email protected]> * Add remark about internal audits Signed-off-by: Markus Hentsch <[email protected]> * Remove specific MQ SSL config examples, refer to docs Signed-off-by: Markus Hentsch <[email protected]> * Align header naming with latest standards template Signed-off-by: Markus Hentsch <[email protected]> * Add storage channels Signed-off-by: Markus Hentsch <[email protected]> * Assign document number 0122 Signed-off-by: Markus Hentsch <[email protected]> * Update scs-compatible-test.yaml Signed-off-by: Markus Hentsch <[email protected]> * Remove bare URLs Signed-off-by: Anja Strunk <[email protected]> * Remove tailing whitespaces Signed-off-by: Anja Strunk <[email protected]> * Fix markdown linter Signed-off-by: Anja Strunk <[email protected]> * remove bare URLs Signed-off-by: Anja Strunk <[email protected]> * Fix markdown lint errors Signed-off-by: Anja Strunk <[email protected]> * Fix markdown lint errors Signed-off-by: Anja Strunk <[email protected]> * Fix markdown lint errors Signed-off-by: Anja Strunk <[email protected]> * Fix markdown lint errors Signed-off-by: Anja Strunk <[email protected]> * Fix markdown lint errors Signed-off-by: Anja Strunk <[email protected]> * Change verison number of secure connection standard as it conflicts with node to node encryption DR Signed-off-by: Anja Strunk <[email protected]> * Add new linke char at the end of file to fix MD047 Signed-off-by: Anja Strunk <[email protected]> * Replace absolute dead links with relative links Signed-off-by: Anja Strunk <[email protected]> * Fix dead links Signed-off-by: Anja Strunk <[email protected]> * Use absolute path as relative pathes are not allowed Signed-off-by: Anja Strunk <[email protected]> --------- Signed-off-by: Markus Hentsch <[email protected]> Signed-off-by: Anja Strunk <[email protected]> Co-authored-by: Dominik Pataky <[email protected]> Co-authored-by: anjastrunk <[email protected]> Co-authored-by: Anja Strunk <[email protected]>
1 parent ebfaa1a commit c3dd463

File tree

9 files changed

+914
-3
lines changed

9 files changed

+914
-3
lines changed

‎Standards/scs-0125-v1-secure-connections.md‎

Lines changed: 277 additions & 0 deletions
Large diffs are not rendered by default.

‎Standards/scs-0214-v1-k8s-node-distribution.md‎

Lines changed: 0 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -84,4 +84,3 @@ If the standard is used by a provider, the following decisions are binding and v
8484
[k8s-ha]: https://kubernetes.io/docs/setup/production-environment/tools/kubeadm/high-availability/
8585
[k8s-large-clusters]: https://kubernetes.io/docs/setup/best-practices/cluster-large/
8686
[scs-0213-v1]: https://github.com/SovereignCloudStack/standards/blob/main/Standards/scs-0213-v1-k8s-nodes-anti-affinity.md
87-
[k8s-labels-docs]: https://kubernetes.io/docs/reference/labels-annotations-taints/#topologykubernetesiozone

‎Tests/iaas/secure-connections/README.md‎

Lines changed: 61 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,61 @@
1+
# Secure Connections Standard Test Suite
2+
3+
## Test Environment Setup
4+
5+
> **NOTE:** The test execution procedure does not require cloud admin rights.
6+
7+
A valid cloud configuration for the OpenStack SDK in the shape of "`clouds.yaml`" is mandatory[^1].
8+
**This file is expected to be located in the current working directory where the test script is executed unless configured otherwise.**
9+
10+
[^1]: [OpenStack Documentation: Configuring OpenStack SDK Applications](https://docs.openstack.org/openstacksdk/latest/user/config/configuration.html)
11+
12+
The test execution environment can be located on any system outside of the cloud infrastructure that has OpenStack API access.
13+
Make sure that the API access is configured properly in "`clouds.yaml`".
14+
15+
It is recommended to use a Python virtual environment[^2].
16+
Next, install the libraries required by the test suite:
17+
18+
```bash
19+
pip3 install openstacksdk sslyze
20+
```
21+
22+
> Note: the version of the sslyze library determines the [version of the Mozilla TLS recommendation JSON](https://wiki.mozilla.org/Security/Server_Side_TLS#JSON_version_of_the_recommendations) that it checks against.
23+
24+
Within this environment execute the test suite.
25+
26+
[^2]: [Python 3 Documentation: Virtual Environments and Packages](https://docs.python.org/3/tutorial/venv.html)
27+
28+
## Test Execution
29+
30+
The test suite is executed as follows:
31+
32+
```bash
33+
python3 tls-checker.py --os-cloud mycloud
34+
```
35+
36+
As an alternative to "`--os-cloud`", the "`OS_CLOUD`" environment variable may be specified instead.
37+
The parameter is used to look up the correct cloud configuration in "`clouds.yaml`".
38+
For the example command above, this file should contain a `clouds.mycloud` section like this:
39+
40+
```yaml
41+
---
42+
clouds:
43+
mycloud:
44+
auth:
45+
auth_url: ...
46+
...
47+
...
48+
```
49+
50+
For any further options consult the output of "`python3 tls-checker.py --help`".
51+
52+
### Script Behavior & Test Results
53+
54+
The script will print all actions and passed tests to `stdout`.
55+
56+
If all tests pass, the script will return with an exit code of `0`.
57+
58+
If any test fails, the script will halt, print the exact error to `stderr` and return with a non-zero exit code.
59+
60+
Any tests that indicate a recommendation of the standard is not met, will print a warning message under the corresponding endpoint output.
61+
However, unmet recommendations will not count as errors.

‎Tests/iaas/secure-connections/mozilla-tls-profiles/5.7.json‎

Lines changed: 209 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,209 @@
1+
{
2+
"version": 5.7,
3+
"href": "https://ssl-config.mozilla.org/guidelines/5.7.json",
4+
"configurations": {
5+
"modern": {
6+
"certificate_curves": ["prime256v1", "secp384r1"],
7+
"certificate_signatures": ["ecdsa-with-SHA256", "ecdsa-with-SHA384", "ecdsa-with-SHA512"],
8+
"certificate_types": ["ecdsa"],
9+
"ciphers": {
10+
"caddy": [],
11+
"go": [],
12+
"iana": [],
13+
"openssl": []
14+
},
15+
"ciphersuites": [
16+
"TLS_AES_128_GCM_SHA256",
17+
"TLS_AES_256_GCM_SHA384",
18+
"TLS_CHACHA20_POLY1305_SHA256"
19+
],
20+
"dh_param_size": null,
21+
"ecdh_param_size": 256,
22+
"hsts_min_age": 63072000,
23+
"maximum_certificate_lifespan": 90,
24+
"ocsp_staple": true,
25+
"oldest_clients": ["Firefox 63", "Android 10.0", "Chrome 70", "Edge 75", "Java 11", "OpenSSL 1.1.1", "Opera 57", "Safari 12.1"],
26+
"recommended_certificate_lifespan": 90,
27+
"rsa_key_size": null,
28+
"server_preferred_order": false,
29+
"tls_curves": ["X25519", "prime256v1", "secp384r1"],
30+
"tls_versions": ["TLSv1.3"]
31+
},
32+
"intermediate": {
33+
"certificate_curves": ["prime256v1", "secp384r1"],
34+
"certificate_signatures": ["sha256WithRSAEncryption", "ecdsa-with-SHA256", "ecdsa-with-SHA384", "ecdsa-with-SHA512"],
35+
"certificate_types": ["ecdsa", "rsa"],
36+
"ciphers": {
37+
"caddy": [
38+
"TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256",
39+
"TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256",
40+
"TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384",
41+
"TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384",
42+
"TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256",
43+
"TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256"
44+
],
45+
"go": [
46+
"TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256",
47+
"TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256",
48+
"TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384",
49+
"TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384",
50+
"TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305",
51+
"TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305"
52+
],
53+
"iana": [
54+
"TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256",
55+
"TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256",
56+
"TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384",
57+
"TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384",
58+
"TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256",
59+
"TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256",
60+
"TLS_DHE_RSA_WITH_AES_256_GCM_SHA384",
61+
"TLS_DHE_RSA_WITH_AES_128_GCM_SHA256",
62+
"TLS_DHE_RSA_WITH_CHACHA20_POLY1305_SHA256"
63+
],
64+
"openssl": [
65+
"ECDHE-ECDSA-AES128-GCM-SHA256",
66+
"ECDHE-RSA-AES128-GCM-SHA256",
67+
"ECDHE-ECDSA-AES256-GCM-SHA384",
68+
"ECDHE-RSA-AES256-GCM-SHA384",
69+
"ECDHE-ECDSA-CHACHA20-POLY1305",
70+
"ECDHE-RSA-CHACHA20-POLY1305",
71+
"DHE-RSA-AES128-GCM-SHA256",
72+
"DHE-RSA-AES256-GCM-SHA384",
73+
"DHE-RSA-CHACHA20-POLY1305"
74+
]
75+
},
76+
"ciphersuites": [
77+
"TLS_AES_128_GCM_SHA256",
78+
"TLS_AES_256_GCM_SHA384",
79+
"TLS_CHACHA20_POLY1305_SHA256"
80+
],
81+
"dh_param_size": 2048,
82+
"ecdh_param_size": 256,
83+
"hsts_min_age": 63072000,
84+
"maximum_certificate_lifespan": 366,
85+
"ocsp_staple": true,
86+
"oldest_clients": ["Firefox 27", "Android 4.4.2", "Chrome 31", "Edge", "IE 11 on Windows 7", "Java 8u31", "OpenSSL 1.0.1", "Opera 20", "Safari 9"],
87+
"recommended_certificate_lifespan": 90,
88+
"rsa_key_size": 2048,
89+
"server_preferred_order": false,
90+
"tls_curves": ["X25519", "prime256v1", "secp384r1"],
91+
"tls_versions": ["TLSv1.2", "TLSv1.3"]
92+
},
93+
"old": {
94+
"certificate_curves": ["prime256v1", "secp384r1"],
95+
"certificate_signatures": ["sha256WithRSAEncryption"],
96+
"certificate_types": ["rsa"],
97+
"ciphers": {
98+
"caddy": [
99+
"TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256",
100+
"TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256",
101+
"TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384",
102+
"TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256",
103+
"TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256",
104+
"TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA",
105+
"TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA",
106+
"TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA",
107+
"TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA",
108+
"TLS_RSA_WITH_AES_128_GCM_SHA256",
109+
"TLS_RSA_WITH_AES_256_GCM_SHA384",
110+
"TLS_RSA_WITH_AES_128_CBC_SHA",
111+
"TLS_RSA_WITH_AES_256_CBC_SHA",
112+
"TLS_RSA_WITH_3DES_EDE_CBC_SHA"
113+
],
114+
"go": [
115+
"TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256",
116+
"TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256",
117+
"TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384",
118+
"TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384",
119+
"TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305",
120+
"TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305",
121+
"TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256",
122+
"TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256",
123+
"TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA",
124+
"TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA",
125+
"TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA",
126+
"TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA",
127+
"TLS_RSA_WITH_AES_128_GCM_SHA256",
128+
"TLS_RSA_WITH_AES_256_GCM_SHA384",
129+
"TLS_RSA_WITH_AES_128_CBC_SHA256",
130+
"TLS_RSA_WITH_AES_128_CBC_SHA",
131+
"TLS_RSA_WITH_AES_256_CBC_SHA",
132+
"TLS_RSA_WITH_3DES_EDE_CBC_SHA"
133+
],
134+
"iana": [
135+
"TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256",
136+
"TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256",
137+
"TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384",
138+
"TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384",
139+
"TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256",
140+
"TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256",
141+
"TLS_DHE_RSA_WITH_AES_128_GCM_SHA256",
142+
"TLS_DHE_RSA_WITH_AES_256_GCM_SHA384",
143+
"TLS_DHE_RSA_WITH_CHACHA20_POLY1305_SHA256",
144+
"TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256",
145+
"TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256",
146+
"TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA",
147+
"TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA",
148+
"TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384",
149+
"TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384",
150+
"TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA",
151+
"TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA",
152+
"TLS_DHE_RSA_WITH_AES_128_CBC_SHA256",
153+
"TLS_DHE_RSA_WITH_AES_256_CBC_SHA256",
154+
"TLS_RSA_WITH_AES_128_GCM_SHA256",
155+
"TLS_RSA_WITH_AES_256_GCM_SHA384",
156+
"TLS_RSA_WITH_AES_128_CBC_SHA256",
157+
"TLS_RSA_WITH_AES_256_CBC_SHA256",
158+
"TLS_RSA_WITH_AES_128_CBC_SHA",
159+
"TLS_RSA_WITH_AES_256_CBC_SHA",
160+
"TLS_RSA_WITH_3DES_EDE_CBC_SHA"
161+
],
162+
"openssl": [
163+
"ECDHE-ECDSA-AES128-GCM-SHA256",
164+
"ECDHE-RSA-AES128-GCM-SHA256",
165+
"ECDHE-ECDSA-AES256-GCM-SHA384",
166+
"ECDHE-RSA-AES256-GCM-SHA384",
167+
"ECDHE-ECDSA-CHACHA20-POLY1305",
168+
"ECDHE-RSA-CHACHA20-POLY1305",
169+
"DHE-RSA-AES128-GCM-SHA256",
170+
"DHE-RSA-AES256-GCM-SHA384",
171+
"DHE-RSA-CHACHA20-POLY1305",
172+
"ECDHE-ECDSA-AES128-SHA256",
173+
"ECDHE-RSA-AES128-SHA256",
174+
"ECDHE-ECDSA-AES128-SHA",
175+
"ECDHE-RSA-AES128-SHA",
176+
"ECDHE-ECDSA-AES256-SHA384",
177+
"ECDHE-RSA-AES256-SHA384",
178+
"ECDHE-ECDSA-AES256-SHA",
179+
"ECDHE-RSA-AES256-SHA",
180+
"DHE-RSA-AES128-SHA256",
181+
"DHE-RSA-AES256-SHA256",
182+
"AES128-GCM-SHA256",
183+
"AES256-GCM-SHA384",
184+
"AES128-SHA256",
185+
"AES256-SHA256",
186+
"AES128-SHA",
187+
"AES256-SHA",
188+
"DES-CBC3-SHA"
189+
]
190+
},
191+
"ciphersuites": [
192+
"TLS_AES_128_GCM_SHA256",
193+
"TLS_AES_256_GCM_SHA384",
194+
"TLS_CHACHA20_POLY1305_SHA256"
195+
],
196+
"dh_param_size": 1024,
197+
"ecdh_param_size": 256,
198+
"hsts_min_age": 63072000,
199+
"maximum_certificate_lifespan": 366,
200+
"ocsp_staple": true,
201+
"oldest_clients": ["Firefox 1", "Android 2.3", "Chrome 1", "Edge 12", "IE8 on Windows XP", "Java 6", "OpenSSL 0.9.8", "Opera 5", "Safari 1"],
202+
"recommended_certificate_lifespan": 90,
203+
"rsa_key_size": 2048,
204+
"server_preferred_order": true,
205+
"tls_curves": ["X25519", "prime256v1", "secp384r1"],
206+
"tls_versions": ["TLSv1", "TLSv1.1", "TLSv1.2", "TLSv1.3"]
207+
}
208+
}
209+
}

‎Tests/iaas/secure-connections/mozilla-tls-profiles/README.md‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,4 @@
1+
# Mozilla TLS Profiles
2+
3+
Files in this folder are used for automated testing.
4+
They are pulled from [Mozilla Wiki: Security/Server Side TLS](https://wiki.mozilla.org/Security/Server_Side_TLS#JSON_version_of_the_recommendations)

0 commit comments

Comments
 (0)