kemko/nomad
1
0
Fork 0
mirror of https://github.com/kemko/nomad.git synced 2026-01-01 16:05:42 +03:00
Code Issues Packages Projects Releases Wiki Activity

tls: support setting min version to TLS1.3 (#23713)

Browse Source 
Nomad already supports TLS1.3, but not as a minimum version
configuration. Update our config validation to allow setting `tls_min_version`
to 1.3. Update the documentation to match Vault and warn that the
`tls_cipher_suites` field is ignored when TLS is 1.3

Fixes: https://github.com/hashicorp/nomad/issues/20131
Ref: https://hashicorp.atlassian.net/browse/NET-10530
This commit is contained in:
Tim Gross
2024-08-01 08:46:32 -04:00
committed by GitHub
parent 2e62c37676
commit 2ee6043cab
5 changed files with 13 additions and 5 deletions
Download Patch File Download Diff File Expand all files Collapse all files

3
.changelog/23713.txt Normal file
View File

@@ -0,0 +1,3 @@
```release-note:improvement
tls: Allow setting the `tls_min_version` field to `"tls13"`
```

1
helper/tlsutil/config.go
View File

@@ -22,6 +22,7 @@ var supportedTLSVersions = map[string]uint16{
"tls10": tls.VersionTLS10, "tls10": tls.VersionTLS10,
"tls11": tls.VersionTLS11, "tls11": tls.VersionTLS11,
"tls12": tls.VersionTLS12, "tls12": tls.VersionTLS12,
"tls13": tls.VersionTLS13,
} }
// supportedTLSCiphers are the complete list of TLS ciphers supported by Nomad // supportedTLSCiphers are the complete list of TLS ciphers supported by Nomad

4
helper/tlsutil/config_test.go
View File

@@ -949,9 +949,7 @@ func TestConfig_ParseMinVersion_Invalid(t *testing.T) {
require := require.New(t) require := require.New(t)
invalidVersions := []string{"tls13", invalidVersions := []string{"ssl3", "tls14", "tls15"}
"tls15",
}
for _, version := range invalidVersions { for _, version := range invalidVersions {
parsedVersion, err := ParseMinVersion(version) parsedVersion, err := ParseMinVersion(version)

2
nomad/structs/config/tls.go
View File

@@ -64,7 +64,7 @@ type TLSConfig struct {
TLSCipherSuites string `hcl:"tls_cipher_suites"` TLSCipherSuites string `hcl:"tls_cipher_suites"`
// TLSMinVersion is used to set the minimum TLS version used for TLS // TLSMinVersion is used to set the minimum TLS version used for TLS
// connections. Should be either "tls10", "tls11", or "tls12". // connections. Should be either "tls10", "tls11", "tls12", "tls13".
TLSMinVersion string `hcl:"tls_min_version"` TLSMinVersion string `hcl:"tls_min_version"`
// TLSPreferServerCipherSuites controls whether the server selects the // TLSPreferServerCipherSuites controls whether the server selects the

8
website/content/docs/configuration/tls.mdx
View File

@@ -73,10 +73,15 @@ the [Enable TLS Encryption for Nomad Tutorial](/nomad/tutorials/transport-securi
TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256 and TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256 and
TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256. TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256.
Nomad does not accept explicit ciphersuite configuration when for TLS 1.3
because the Go team has already designated a select set of ciphers that align
with the broadly-accepted Mozilla Security/Server Side TLS guidance for
[modern TLS configuration][modern-tls].
~> **Warning:** the use of insecure cipher suites such as TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256, TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256, and TLS_RSA_WITH_AES_128_CBC_SHA256 is now unsupported. ~> **Warning:** the use of insecure cipher suites such as TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256, TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256, and TLS_RSA_WITH_AES_128_CBC_SHA256 is now unsupported.
- `tls_min_version` `(string: "tls12")`- Specifies the minimum supported version - `tls_min_version` `(string: "tls12")`- Specifies the minimum supported version
of TLS. Accepted values are "tls10", "tls11", "tls12". of TLS. Accepted values are "tls10", "tls11", "tls12", "tls13".
- `tls_prefer_server_cipher_suites` `(bool: false)` - Specifies whether - `tls_prefer_server_cipher_suites` `(bool: false)` - Specifies whether
TLS connections should prefer the server's ciphersuites over the client's. TLS connections should prefer the server's ciphersuites over the client's.
@@ -129,3 +134,4 @@ connections will be closed. This process works when upgrading to TLS,
downgrading from it, as well as rolling certificates. downgrading from it, as well as rolling certificates.
[raft]: https://github.com/hashicorp/serf 'Serf by HashiCorp' [raft]: https://github.com/hashicorp/serf 'Serf by HashiCorp'
[modern-tls]: https://wiki.mozilla.org/Security/Server_Side_TLS#Modern_compatibility