TLS v1.3, empty values (default settings) of proxy-listener-cipher-suites and proxy-listener-curve-preferences config parameters will configure default golang TLS CipherSuites and CurvePreferences instead of preconfigured ones.

everesio · everesio · commit 4f3b89fbaecb · 2021-08-21T16:56:52.000+02:00
Naming of provided proxy-listener-cipher-suites names was changed e.g. from ECDHE-ECDSA-AES256-GCM-SHA384 to TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384.
diff --git a/Makefile b/Makefile
@@ -10,7 +10,7 @@ VERSION       ?= $(shell git describe --tags --always --dirty)
 GOPKGS         = $(shell go list ./... | grep -v /vendor/)
 BUILD_FLAGS   ?=
 LDFLAGS       ?= -X github.com/grepplabs/kafka-proxy/config.Version=$(VERSION) -w -s
-TAG           ?= "v0.2.9"
+TAG           ?= "v0.3.0"
 GOARCH        ?= amd64
 GOOS          ?= linux
 
diff --git a/README.md b/README.md
@@ -46,11 +46,11 @@ As not every Kafka release adds new messages/versions which are relevant to the
 
    Linux
 
-        curl -Ls https://github.com/grepplabs/kafka-proxy/releases/download/v0.2.9/kafka-proxy-v0.2.9-linux-amd64.tar.gz | tar xz
+        curl -Ls https://github.com/grepplabs/kafka-proxy/releases/download/v0.3.0/kafka-proxy-v0.3.0-linux-amd64.tar.gz | tar xz
 
    macOS
 
-        curl -Ls https://github.com/grepplabs/kafka-proxy/releases/download/v0.2.9/kafka-proxy-v0.2.9-darwin-amd64.tar.gz | tar xz
+        curl -Ls https://github.com/grepplabs/kafka-proxy/releases/download/v0.3.0/kafka-proxy-v0.3.0-darwin-amd64.tar.gz | tar xz
 
 2. Move the binary in to your PATH.
 
@@ -68,7 +68,7 @@ Docker images are available on [Docker Hub](https://hub.docker.com/r/grepplabs/k
 
 You can launch a kafka-proxy container for trying it out with
 
-    docker run --rm -p 30001-30003:30001-30003 grepplabs/kafka-proxy:v0.2.9 \
+    docker run --rm -p 30001-30003:30001-30003 grepplabs/kafka-proxy:v0.3.0 \
               server \
             --bootstrap-server-mapping "localhost:19092,0.0.0.0:30001" \
             --bootstrap-server-mapping "localhost:29092,0.0.0.0:30002" \
@@ -87,7 +87,7 @@ Docker images with precompiled plugins located in `/opt/kafka-proxy/bin/` are ta
 
 You can launch a kafka-proxy container with auth-ldap plugin for trying it out with
 
-    docker run --rm -p 30001-30003:30001-30003 grepplabs/kafka-proxy:v0.2.9-all \
+    docker run --rm -p 30001-30003:30001-30003 grepplabs/kafka-proxy:v0.3.0-all \
                   server \
                 --bootstrap-server-mapping "localhost:19092,0.0.0.0:30001" \
                 --bootstrap-server-mapping "localhost:29092,0.0.0.0:30002" \
@@ -224,6 +224,17 @@ You can launch a kafka-proxy container with auth-ldap plugin for trying it out w
 
     export BOOTSTRAP_SERVER_MAPPING="192.168.99.100:32401,0.0.0.0:32402 192.168.99.100:32402,0.0.0.0:32403" && kafka-proxy server
 
+
+### Restrict proxy listener cipher suites
+
+    kafka-proxy server --bootstrap-server-mapping "localhost:19092,0.0.0.0:30001,localhost:30001" \
+                       --bootstrap-server-mapping "localhost:29092,0.0.0.0:30002,localhost:30002" \
+                       --bootstrap-server-mapping "localhost:39092,0.0.0.0:30003,localhost:30003" \
+                       --proxy-listener-cert-file "tls/ca-cert.pem" \
+                       --proxy-listener-key-file "tls/ca-key.pem"  \
+                       --proxy-listener-tls-enable \
+                       --proxy-listener-cipher-suites TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_AES_256_GCM_SHA384,TLS_AES_128_GCM_SHA256
+
 ### SASL authentication initiated by proxy example
 
 SASL authentication is initiated by the proxy. SASL authentication is disabled on the clients and enabled on the Kafka brokers.   
diff --git a/proxy/protocol/responses_test.go b/proxy/protocol/responses_test.go
@@ -2452,9 +2452,11 @@ func testMetadataResponse(t *testing.T, apiVersion int16, payload string, expect
 	if err != nil {
 		t.Fatal(err)
 	}
-	for _, av := range dc.AttrValues() {
-		fmt.Printf("\"%s\",\n", av)
-	}
+	/*
+		for _, av := range dc.AttrValues() {
+			fmt.Printf("\"%s\",\n", av)
+		}
+	*/
 	a.Equal(expectedInput, dc.AttrValues())
 	resp, err := EncodeSchema(s, schema)
 	a.Nil(err)
diff --git a/proxy/tls.go b/proxy/tls.go
@@ -6,74 +6,48 @@ import (
 	"encoding/pem"
 	"io/ioutil"
 	"net"
+	"reflect"
 	"strings"
 	"time"
 
 	"github.com/grepplabs/kafka-proxy/config"
-	"github.com/klauspost/cpuid"
 	"github.com/pkg/errors"
 )
 
-type clientCertSubjectField string
-
-const (
-	clientCertSubjectCommonName         = "CN"
-	clientCertSubjectCountry            = "C"
-	clientCertSubjectProvince           = "S"
-	clientCertSubjectLocality           = "L"
-	clientCertSubjectOrganization       = "O"
-	clientCertSubjectOrganizationalUnit = "OU"
-)
-
 var (
-	defaultCurvePreferences = []tls.CurveID{
-		tls.CurveP256,
-		tls.X25519,
-	}
-
 	supportedCurvesMap = map[string]tls.CurveID{
 		"X25519": tls.X25519,
 		"P256":   tls.CurveP256,
 		"P384":   tls.CurveP384,
 		"P521":   tls.CurveP521,
 	}
-
-	defaultCiphers = []uint16{
-		tls.TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,
-		tls.TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,
-		tls.TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,
-		tls.TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,
-		tls.TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,
-		tls.TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305,
-	}
-
-	defaultCiphersNonAESNI = []uint16{
-		tls.TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,
-		tls.TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305,
-		tls.TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,
-		tls.TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,
-		tls.TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,
-		tls.TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,
-	}
-	// https://github.com/mholt/caddy/blob/master/caddytls/config.go
 	supportedCiphersMap = map[string]uint16{
-		"ECDHE-ECDSA-AES256-GCM-SHA384":      tls.TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,
-		"ECDHE-RSA-AES256-GCM-SHA384":        tls.TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,
-		"ECDHE-ECDSA-AES128-GCM-SHA256":      tls.TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,
-		"ECDHE-RSA-AES128-GCM-SHA256":        tls.TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,
-		"ECDHE-ECDSA-WITH-CHACHA20-POLY1305": tls.TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,
-		"ECDHE-RSA-WITH-CHACHA20-POLY1305":   tls.TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305,
-		"ECDHE-RSA-AES256-CBC-SHA":           tls.TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA,
-		"ECDHE-RSA-AES128-CBC-SHA":           tls.TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA,
-		"ECDHE-RSA-AES128-CBC-SHA256":        tls.TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256,
-		"ECDHE-ECDSA-AES256-CBC-SHA":         tls.TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA,
-		"ECDHE-ECDSA-AES128-CBC-SHA":         tls.TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA,
-		"RSA-AES256-CBC-SHA":                 tls.TLS_RSA_WITH_AES_256_CBC_SHA,
-		"RSA-AES128-CBC-SHA":                 tls.TLS_RSA_WITH_AES_128_CBC_SHA,
-		"ECDHE-RSA-3DES-EDE-CBC-SHA":         tls.TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA,
-		"RSA-3DES-EDE-CBC-SHA":               tls.TLS_RSA_WITH_3DES_EDE_CBC_SHA,
+		"TLS_RSA_WITH_RC4_128_SHA":                      tls.TLS_RSA_WITH_RC4_128_SHA,
+		"TLS_RSA_WITH_3DES_EDE_CBC_SHA":                 tls.TLS_RSA_WITH_3DES_EDE_CBC_SHA,
+		"TLS_RSA_WITH_AES_128_CBC_SHA":                  tls.TLS_RSA_WITH_AES_128_CBC_SHA,
+		"TLS_RSA_WITH_AES_256_CBC_SHA":                  tls.TLS_RSA_WITH_AES_256_CBC_SHA,
+		"TLS_RSA_WITH_AES_128_CBC_SHA256":               tls.TLS_RSA_WITH_AES_128_CBC_SHA256,
+		"TLS_RSA_WITH_AES_128_GCM_SHA256":               tls.TLS_RSA_WITH_AES_128_GCM_SHA256,
+		"TLS_RSA_WITH_AES_256_GCM_SHA384":               tls.TLS_RSA_WITH_AES_256_GCM_SHA384,
+		"TLS_ECDHE_ECDSA_WITH_RC4_128_SHA":              tls.TLS_ECDHE_ECDSA_WITH_RC4_128_SHA,
+		"TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA":          tls.TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA,
+		"TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA":          tls.TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA,
+		"TLS_ECDHE_RSA_WITH_RC4_128_SHA":                tls.TLS_ECDHE_RSA_WITH_RC4_128_SHA,
+		"TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA":           tls.TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA,
+		"TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA":            tls.TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA,
+		"TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA":            tls.TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA,
+		"TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256":       tls.TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256,
+		"TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256":         tls.TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256,
+		"TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256":         tls.TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,
+		"TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256":       tls.TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,
+		"TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384":         tls.TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,
+		"TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384":       tls.TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,
+		"TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256":   tls.TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256,
+		"TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256": tls.TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256,
+		"TLS_AES_128_GCM_SHA256":                        tls.TLS_AES_128_GCM_SHA256,
+		"TLS_AES_256_GCM_SHA384":                        tls.TLS_AES_256_GCM_SHA384,
+		"TLS_CHACHA20_POLY1305_SHA256":                  tls.TLS_CHACHA20_POLY1305_SHA256,
 	}
-
 	zeroTime = time.Time{}
 )
 
@@ -103,10 +77,6 @@ func newTLSListenerConfig(conf *config.Config) (*tls.Config, error) {
 	if err != nil {
 		return nil, err
 	}
-	// for security, ensure TLS_FALLBACK_SCSV is always included first
-	if len(cipherSuites) == 0 || cipherSuites[0] != tls.TLS_FALLBACK_SCSV {
-		cipherSuites = append([]uint16{tls.TLS_FALLBACK_SCSV}, cipherSuites...)
-	}
 	curvePreferences, err := getCurvePreferences(opts.ListenerCurvePreferences)
 	if err != nil {
 		return nil, err
@@ -142,56 +112,32 @@ func newTLSListenerConfig(conf *config.Config) (*tls.Config, error) {
 	return cfg, nil
 }
 
-func removeEmptyStrings(input []string) []string {
-	output := []string{}
-	for _, value := range input {
-		if value == "" {
-			continue
-		}
-		output = append(output, value)
-	}
-	return output
-}
-
 func getCipherSuites(enabledCipherSuites []string) ([]uint16, error) {
 	suites := make([]uint16, 0)
 	for _, suite := range enabledCipherSuites {
 		cipher, ok := supportedCiphersMap[strings.TrimSpace(suite)]
 		if !ok {
-			return nil, errors.Errorf("invalid cipher suite '%s' selected", suite)
+			return nil, errors.Errorf("invalid cipher suite '%s' selected, supported ciphers %v", suite, reflect.ValueOf(supportedCiphersMap).MapKeys())
 		}
 		suites = append(suites, cipher)
 	}
 	if len(suites) == 0 {
-		return getPreferredDefaultCiphers(), nil
+		return nil, nil
 	}
 	return suites, nil
 }
 
-// getPreferredDefaultCiphers returns an appropriate cipher suite to use, depending on
-// the hardware support available for AES-NI.
-//
-// See https://github.com/mholt/caddy/issues/1674
-func getPreferredDefaultCiphers() []uint16 {
-	if cpuid.CPU.AesNi() {
-		return defaultCiphers
-	}
-
-	// Return a cipher suite that prefers ChaCha20
-	return defaultCiphersNonAESNI
-}
-
 func getCurvePreferences(enabledCurvePreferences []string) ([]tls.CurveID, error) {
 	curvePreferences := make([]tls.CurveID, 0)
 	for _, curveID := range enabledCurvePreferences {
 		curvePreference, ok := supportedCurvesMap[strings.TrimSpace(curveID)]
 		if !ok {
-			return nil, errors.Errorf("invalid curveID '%s' selected", curveID)
+			return nil, errors.Errorf("invalid curveID '%s' selected, supported curveIDs %v", curveID, reflect.ValueOf(supportedCurvesMap).MapKeys())
 		}
 		curvePreferences = append(curvePreferences, curvePreference)
 	}
 	if len(curvePreferences) == 0 {
-		return defaultCurvePreferences, nil
+		return nil, nil
 	}
 	return curvePreferences, nil
 }
diff --git a/proxy/tls_test.go b/proxy/tls_test.go
@@ -25,15 +25,16 @@ func TestDefaultCipherSuites(t *testing.T) {
 	c := new(config.Config)
 	c.Proxy.TLS.ListenerCertFile = bundle.ServerCert.Name()
 	c.Proxy.TLS.ListenerKeyFile = bundle.ServerKey.Name()
+	c.Proxy.TLS.ListenerCipherSuites = []string{}
+	c.Proxy.TLS.ListenerCurvePreferences = []string{}
 
 	serverConfig, err := newTLSListenerConfig(c)
 	a.Nil(err)
-	// TLS_FALLBACK_SCSV is added as first
-	a.Equal(len(getPreferredDefaultCiphers())+1, len(serverConfig.CipherSuites))
-	a.Equal(len(defaultCurvePreferences), len(serverConfig.CurvePreferences))
+	a.Nil(serverConfig.CipherSuites)
+	a.Nil(serverConfig.CurvePreferences)
 }
 
-func TestEnabledCipherSuites(t *testing.T) {
+func TestEnabledCipherSuitesAndCurves(t *testing.T) {
 	a := assert.New(t)
 
 	bundle := NewCertsBundle()
@@ -42,16 +43,72 @@ func TestEnabledCipherSuites(t *testing.T) {
 	c := new(config.Config)
 	c.Proxy.TLS.ListenerCertFile = bundle.ServerCert.Name()
 	c.Proxy.TLS.ListenerKeyFile = bundle.ServerKey.Name()
-	c.Proxy.TLS.ListenerCipherSuites = []string{"ECDHE-ECDSA-AES256-GCM-SHA384", "ECDHE-RSA-AES256-GCM-SHA384"}
+	c.Proxy.TLS.ListenerCipherSuites = []string{"TLS_AES_128_GCM_SHA256", "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384"}
 	c.Proxy.TLS.ListenerCurvePreferences = []string{"P521"}
 
 	serverConfig, err := newTLSListenerConfig(c)
 	a.Nil(err)
-	// TLS_FALLBACK_SCSV is added as first
-	a.Equal(3, len(serverConfig.CipherSuites))
+	a.Equal(2, len(serverConfig.CipherSuites))
 	a.Equal(1, len(serverConfig.CurvePreferences))
 }
 
+func TestAllCipherSuitesAndCurves(t *testing.T) {
+	a := assert.New(t)
+
+	bundle := NewCertsBundle()
+	defer bundle.Close()
+
+	allSupportedCipherSuites := make([]string, 0)
+	for k := range supportedCiphersMap {
+		allSupportedCipherSuites = append(allSupportedCipherSuites, k)
+	}
+	allSupportedCurvesSuites := make([]string, 0)
+	for k := range supportedCurvesMap {
+		allSupportedCurvesSuites = append(allSupportedCurvesSuites, k)
+	}
+
+	c := new(config.Config)
+	c.Proxy.TLS.ListenerCertFile = bundle.ServerCert.Name()
+	c.Proxy.TLS.ListenerKeyFile = bundle.ServerKey.Name()
+	c.Proxy.TLS.ListenerCipherSuites = allSupportedCipherSuites
+	c.Proxy.TLS.ListenerCurvePreferences = allSupportedCurvesSuites
+
+	serverConfig, err := newTLSListenerConfig(c)
+	a.Nil(err)
+	a.Equal(len(allSupportedCipherSuites), len(serverConfig.CipherSuites))
+	a.Equal(len(allSupportedCurvesSuites), len(serverConfig.CurvePreferences))
+}
+
+func TestUnsupportedCipherSuite(t *testing.T) {
+	a := assert.New(t)
+
+	bundle := NewCertsBundle()
+	defer bundle.Close()
+
+	c := new(config.Config)
+	c.Proxy.TLS.ListenerCertFile = bundle.ServerCert.Name()
+	c.Proxy.TLS.ListenerKeyFile = bundle.ServerKey.Name()
+	c.Proxy.TLS.ListenerCipherSuites = []string{"TLS_unknown"}
+
+	_, err := newTLSListenerConfig(c)
+	a.NotNil(err)
+}
+
+func TestUnsupportedCurve(t *testing.T) {
+	a := assert.New(t)
+
+	bundle := NewCertsBundle()
+	defer bundle.Close()
+
+	c := new(config.Config)
+	c.Proxy.TLS.ListenerCertFile = bundle.ServerCert.Name()
+	c.Proxy.TLS.ListenerKeyFile = bundle.ServerKey.Name()
+	c.Proxy.TLS.ListenerCurvePreferences = []string{"unknown"}
+
+	_, err := newTLSListenerConfig(c)
+	a.NotNil(err)
+}
+
 func TestTLSUnknownAuthorityNoCAChainCert(t *testing.T) {
 	a := assert.New(t)
 
