kubernetes
/
apiserver
mirror of https://github.com/kubernetes/apiserver.git
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

Warn when insecure TLS ciphers are selected. 

Kubernetes-commit: 550a67869a7290688dde4aeedbcdd72a10e448cf
This commit is contained in:
Paulo Gomes 2020-05-13 16:11:28 +01:00 committed by Kubernetes Publisher
parent 211b614cb6
commit 749479fedb
2 changed files with 14 additions and 3 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

8
pkg/server/options/serving.go
View File

@ -171,11 +171,13 @@ func (s *SecureServingOptions) AddFlags(fs *pflag.FlagSet) {
fs.StringVar(&s.ServerCert.CertKey.KeyFile, "tls-private-key-file", s.ServerCert.CertKey.KeyFile, fs.StringVar(&s.ServerCert.CertKey.KeyFile, "tls-private-key-file", s.ServerCert.CertKey.KeyFile,
"File containing the default x509 private key matching --tls-cert-file.") "File containing the default x509 private key matching --tls-cert-file.")
tlsCipherPossibleValues := cliflag.TLSCipherPossibleValues() tlsCipherPreferredValues := cliflag.PreferredTLSCipherNames()
tlsCipherInsecureValues := cliflag.InsecureTLSCipherNames()
fs.StringSliceVar(&s.CipherSuites, "tls-cipher-suites", s.CipherSuites, fs.StringSliceVar(&s.CipherSuites, "tls-cipher-suites", s.CipherSuites,
"Comma-separated list of cipher suites for the server. "+ "Comma-separated list of cipher suites for the server. "+
"If omitted, the default Go cipher suites will be use. "+ "If omitted, the default Go cipher suites will be used. \n"+
"Possible values: "+strings.Join(tlsCipherPossibleValues, ",")) "Preferred values: "+strings.Join(tlsCipherPreferredValues, ", ")+". \n"+
"Insecure values: "+strings.Join(tlsCipherInsecureValues, ", ")+".")
tlsPossibleVersions := cliflag.TLSPossibleVersions() tlsPossibleVersions := cliflag.TLSPossibleVersions()
fs.StringVar(&s.MinTLSVersion, "tls-min-version", s.MinTLSVersion, fs.StringVar(&s.MinTLSVersion, "tls-min-version", s.MinTLSVersion,

9
pkg/server/secure_serving.go
View File

@ -25,6 +25,7 @@ import (
"time" "time"
"golang.org/x/net/http2" "golang.org/x/net/http2"
"k8s.io/component-base/cli/flag"
"k8s.io/klog/v2" "k8s.io/klog/v2"
utilruntime "k8s.io/apimachinery/pkg/util/runtime" utilruntime "k8s.io/apimachinery/pkg/util/runtime"
@ -56,6 +57,14 @@ func (s *SecureServingInfo) tlsConfig(stopCh <-chan struct{}) (*tls.Config, erro
} }
if len(s.CipherSuites) > 0 { if len(s.CipherSuites) > 0 {
tlsConfig.CipherSuites = s.CipherSuites tlsConfig.CipherSuites = s.CipherSuites
insecureCiphers := flag.InsecureTLSCiphers()
for i := 0; i < len(s.CipherSuites); i++ {
for cipherName, cipherID := range insecureCiphers {
if s.CipherSuites[i] == cipherID {
klog.Warningf("Use of insecure cipher '%s' detected.", cipherName)
}
}
}
} }
if s.ClientCA != nil { if s.ClientCA != nil {