Skip to content

Commit 4b796ab

Browse files
metal3-io-botmetal3-io-bot
authored
Merge pull request #276 from Nordix/jawad/tls-flags-1.4
✨ Added TLS configuration flags for IPAM
2 parents 665ee4f + a15311a commit 4b796ab

File tree

2 files changed

+227
-0
lines changed

2 files changed

+227
-0
lines changed

‎main.go‎

Lines changed: 116 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -18,9 +18,11 @@ package main
1818

1919
import (
2020
"context"
21+
"crypto/tls"
2122
"flag"
2223
"fmt"
2324
"os"
25+
"strings"
2426
"time"
2527

2628
ipamv1 "github.com/metal3-io/ip-address-manager/api/v1alpha1"
@@ -30,6 +32,7 @@ import (
3032
"k8s.io/client-go/kubernetes/scheme"
3133
_ "k8s.io/client-go/plugin/pkg/client/auth/gcp"
3234
"k8s.io/client-go/tools/leaderelection/resourcelock"
35+
cliflag "k8s.io/component-base/cli/flag"
3336
"k8s.io/component-base/logs"
3437
logsv1 "k8s.io/component-base/logs/api/v1"
3538
"k8s.io/klog/v2"
@@ -39,6 +42,20 @@ import (
3942
// +kubebuilder:scaffold:imports
4043
)
4144

45+
type TLSVersion string
46+
47+
// Constants for TLS versions.
48+
const (
49+
TLSVersion12 TLSVersion = "TLS12"
50+
TLSVersion13 TLSVersion = "TLS13"
51+
)
52+
53+
type TLSOptions struct {
54+
TLSMaxVersion string
55+
TLSMinVersion string
56+
TLSCipherSuites string
57+
}
58+
4259
var (
4360
myscheme = runtime.NewScheme()
4461
setupLog = ctrl.Log.WithName("setup")
@@ -52,6 +69,8 @@ var (
5269
webhookCertDir string
5370
watchFilterValue string
5471
logOptions = logs.NewOptions()
72+
tlsOptions = TLSOptions{}
73+
tlsSupportedVersions = []string{"TLS12", "TLS13"}
5574
)
5675

5776
func init() {
@@ -89,6 +108,23 @@ func main() {
89108
flag.IntVar(&ippoolConcurrency, "ippool-concurrency", 10,
90109
"Number of ippools to process simultaneously")
91110

111+
flag.StringVar(&tlsOptions.TLSMinVersion, "tls-min-version", "TLS12",
112+
"The minimum TLS version in use by the webhook server.\n"+
113+
fmt.Sprintf("Possible values are %s.", strings.Join(tlsSupportedVersions, ", ")),
114+
)
115+
116+
flag.StringVar(&tlsOptions.TLSMaxVersion, "tls-max-version", "TLS13",
117+
"The maximum TLS version in use by the webhook server.\n"+
118+
fmt.Sprintf("Possible values are %s.", strings.Join(tlsSupportedVersions, ", ")),
119+
)
120+
121+
tlsCipherPreferredValues := cliflag.PreferredTLSCipherNames()
122+
tlsCipherInsecureValues := cliflag.InsecureTLSCipherNames()
123+
flag.StringVar(&tlsOptions.TLSCipherSuites, "tls-cipher-suites", "",
124+
"Comma-separated list of cipher suites for the webhook server. "+
125+
"If omitted, the default Go cipher suites will be used. \n"+
126+
"Preferred values: "+strings.Join(tlsCipherPreferredValues, ", ")+". \n"+
127+
"Insecure values: "+strings.Join(tlsCipherInsecureValues, ", ")+".")
92128
flag.Parse()
93129

94130
if err := logsv1.ValidateAndApply(logOptions, nil); err != nil {
@@ -98,6 +134,11 @@ func main() {
98134

99135
// klog.Background will automatically use the right logger.
100136
ctrl.SetLogger(klog.Background())
137+
tlsOptionOverrides, err := GetTLSOptionOverrideFuncs(tlsOptions)
138+
if err != nil {
139+
setupLog.Error(err, "unable to add TLS settings to the webhook server")
140+
os.Exit(1)
141+
}
101142

102143
mgr, err := ctrl.NewManager(ctrl.GetConfigOrDie(), ctrl.Options{
103144
Scheme: myscheme,
@@ -110,6 +151,7 @@ func main() {
110151
HealthProbeBindAddress: healthAddr,
111152
Namespace: watchNamespace,
112153
CertDir: webhookCertDir,
154+
TLSOpts: tlsOptionOverrides,
113155
})
114156
if err != nil {
115157
setupLog.Error(err, "unable to start manager")
@@ -174,3 +216,77 @@ func setupWebhooks(mgr ctrl.Manager) {
174216
func concurrency(c int) controller.Options {
175217
return controller.Options{MaxConcurrentReconciles: c}
176218
}
219+
220+
// GetTLSOptionOverrideFuncs returns a list of TLS configuration overrides to be used
221+
// by the webhook server.
222+
func GetTLSOptionOverrideFuncs(options TLSOptions) ([]func(*tls.Config), error) {
223+
var tlsOptions []func(config *tls.Config)
224+
225+
tlsMinVersion, err := GetTLSVersion(options.TLSMinVersion)
226+
if err != nil {
227+
return nil, err
228+
}
229+
230+
tlsMaxVersion, err := GetTLSVersion(options.TLSMaxVersion)
231+
if err != nil {
232+
return nil, err
233+
}
234+
235+
if tlsMaxVersion != 0 && tlsMinVersion > tlsMaxVersion {
236+
return nil, fmt.Errorf("TLS version flag min version (%s) is greater than max version (%s)",
237+
options.TLSMinVersion, options.TLSMaxVersion)
238+
}
239+
240+
tlsOptions = append(tlsOptions, func(cfg *tls.Config) {
241+
cfg.MinVersion = tlsMinVersion
242+
})
243+
244+
tlsOptions = append(tlsOptions, func(cfg *tls.Config) {
245+
cfg.MaxVersion = tlsMaxVersion
246+
})
247+
// Cipher suites should not be set if empty.
248+
if options.TLSMinVersion == string(TLSVersion13) &&
249+
options.TLSMaxVersion == string(TLSVersion13) &&
250+
options.TLSCipherSuites != "" {
251+
setupLog.Info("warning: Cipher suites should not be set for TLS version 1.3. Ignoring ciphers")
252+
options.TLSCipherSuites = ""
253+
}
254+
255+
if options.TLSCipherSuites != "" {
256+
tlsCipherSuites := strings.Split(options.TLSCipherSuites, ",")
257+
suites, err := cliflag.TLSCipherSuites(tlsCipherSuites)
258+
if err != nil {
259+
return nil, err
260+
}
261+
262+
insecureCipherValues := cliflag.InsecureTLSCipherNames()
263+
for _, cipher := range tlsCipherSuites {
264+
for _, insecureCipherName := range insecureCipherValues {
265+
if insecureCipherName == cipher {
266+
setupLog.Info(fmt.Sprintf("warning: use of insecure cipher '%s' detected.", cipher))
267+
}
268+
}
269+
}
270+
tlsOptions = append(tlsOptions, func(cfg *tls.Config) {
271+
cfg.CipherSuites = suites
272+
})
273+
}
274+
275+
return tlsOptions, nil
276+
}
277+
278+
// GetTLSVersion returns the corresponding tls.Version or error.
279+
func GetTLSVersion(version string) (uint16, error) {
280+
var v uint16
281+
282+
switch version {
283+
case string(TLSVersion12):
284+
v = tls.VersionTLS12
285+
case string(TLSVersion13):
286+
v = tls.VersionTLS13
287+
default:
288+
return 0, fmt.Errorf("unexpected TLS version %q (must be one of: TLS12, TLS13)", version)
289+
}
290+
291+
return v, nil
292+
}

‎main_test.go‎

Lines changed: 111 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,111 @@
1+
/*
2+
Copyright 2023 The Metal3 Authors.
3+
4+
Licensed under the Apache License, Version 2.0 (the "License");
5+
you may not use this file except in compliance with the License.
6+
You may obtain a copy of the License at
7+
8+
http://www.apache.org/licenses/LICENSE-2.0
9+
10+
Unless required by applicable law or agreed to in writing, software
11+
distributed under the License is distributed on an "AS IS" BASIS,
12+
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
13+
See the License for the specific language governing permissions and
14+
limitations under the License.
15+
*/
16+
17+
package main
18+
19+
import (
20+
"bytes"
21+
"testing"
22+
23+
. "github.com/onsi/gomega"
24+
"k8s.io/klog/v2"
25+
ctrl "sigs.k8s.io/controller-runtime"
26+
)
27+
28+
func TestTLSInsecureCiperSuite(t *testing.T) {
29+
t.Run("test insecure cipher suite passed as TLS flag", func(t *testing.T) {
30+
g := NewWithT(t)
31+
tlsMockOptions := TLSOptions{
32+
TLSMaxVersion: "TLS13",
33+
TLSMinVersion: "TLS12",
34+
TLSCipherSuites: "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256",
35+
}
36+
ctrl.Log.WithName("setup")
37+
ctrl.SetLogger(klog.Background())
38+
39+
bufWriter := bytes.NewBuffer(nil)
40+
klog.SetOutput(bufWriter)
41+
klog.LogToStderr(false) // this is important, because klog by default logs to stderr only
42+
_, err := GetTLSOptionOverrideFuncs(tlsMockOptions)
43+
g.Expect(err).Should(BeNil())
44+
g.Expect(bufWriter.String()).Should(ContainSubstring("use of insecure cipher 'TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256' detected."))
45+
})
46+
}
47+
48+
func TestTLSMinAndMaxVersion(t *testing.T) {
49+
t.Run("should fail if TLS min version is greater than max version.", func(t *testing.T) {
50+
g := NewWithT(t)
51+
tlsMockOptions := TLSOptions{
52+
TLSMaxVersion: "TLS12",
53+
TLSMinVersion: "TLS13",
54+
}
55+
_, err := GetTLSOptionOverrideFuncs(tlsMockOptions)
56+
g.Expect(err.Error()).To(Equal("TLS version flag min version (TLS13) is greater than max version (TLS12)"))
57+
})
58+
}
59+
60+
func Test13CipherSuite(t *testing.T) {
61+
t.Run("should reset ciphersuite flag if TLS min and max version are set to 1.3", func(t *testing.T) {
62+
g := NewWithT(t)
63+
64+
// Here TLS_RSA_WITH_AES_128_CBC_SHA is a tls12 cipher suite.
65+
tlsMockOptions := TLSOptions{
66+
TLSMaxVersion: "TLS13",
67+
TLSMinVersion: "TLS13",
68+
TLSCipherSuites: "TLS_RSA_WITH_AES_128_CBC_SHA,TLS_AES_256_GCM_SHA384",
69+
}
70+
71+
ctrl.Log.WithName("setup")
72+
ctrl.SetLogger(klog.Background())
73+
74+
bufWriter := bytes.NewBuffer(nil)
75+
klog.SetOutput(bufWriter)
76+
klog.LogToStderr(false) // this is important, because klog by default logs to stderr only
77+
_, err := GetTLSOptionOverrideFuncs(tlsMockOptions)
78+
g.Expect(bufWriter.String()).Should(ContainSubstring("warning: Cipher suites should not be set for TLS version 1.3. Ignoring ciphers"))
79+
g.Expect(err).Should(BeNil())
80+
})
81+
}
82+
83+
func TestGetTLSVersion(t *testing.T) {
84+
t.Run("should error out when incorrect tls version passed", func(t *testing.T) {
85+
g := NewWithT(t)
86+
tlsVersion := "TLS11"
87+
_, err := GetTLSVersion(tlsVersion)
88+
g.Expect(err.Error()).Should(Equal("unexpected TLS version \"TLS11\" (must be one of: TLS12, TLS13)"))
89+
})
90+
t.Run("should pass and output correct tls version", func(t *testing.T) {
91+
const VersionTLS12 uint16 = 771
92+
g := NewWithT(t)
93+
tlsVersion := "TLS12"
94+
version, err := GetTLSVersion(tlsVersion)
95+
g.Expect(version).To(Equal(VersionTLS12))
96+
g.Expect(err).Should(BeNil())
97+
})
98+
}
99+
100+
func TestTLSOptions(t *testing.T) {
101+
t.Run("should pass with all the correct options below with no error.", func(t *testing.T) {
102+
g := NewWithT(t)
103+
tlsMockOptions := TLSOptions{
104+
TLSMinVersion: "TLS12",
105+
TLSMaxVersion: "TLS13",
106+
TLSCipherSuites: "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384",
107+
}
108+
_, err := GetTLSOptionOverrideFuncs(tlsMockOptions)
109+
g.Expect(err).Should(BeNil())
110+
})
111+
}

0 commit comments

Comments
 (0)