Documentation
¶
Overview ¶
The TLS parsing helpers in this file mirror k8s.io/component-base/cli/flag (TLSVersion, TLSCipherSuites, InsecureTLSCiphers, TLSCurvePreferences, and related functions). SPIRE does not import that package directly because component-base does not provide compatibility guarantees for its APIs for non k8s workloads.
Package tlspolicy provides for configuration and enforcement of policies relating to TLS.
Index ¶
- func ApplyPolicy(config *tls.Config, policy Policy, opts ...ApplyOption) error
- func DefaultTLSVersion() uint16
- func InsecureTLSCiphers() map[string]uint16
- func LogPolicy(policy Policy, logger hclog.Logger)
- func TLSCipherSuites(cipherNames []string) ([]uint16, error)
- func TLSCurvePreferences(curveIDs []int32) ([]tls.CurveID, error)
- func TLSVersion(versionName string) (uint16, error)
- type ApplyOption
- type ParsedTLSConfig
- type Policy
- type TLSConfig
Constants ¶
This section is empty.
Variables ¶
This section is empty.
Functions ¶
func ApplyPolicy ¶
func ApplyPolicy(config *tls.Config, policy Policy, opts ...ApplyOption) error
ApplyPolicy applies policy to config. RequirePQKEM is always honored when set. TLSConfig fields are applied only when WithServerTLSConfig() is passed. TLSConfig is applied before RequirePQKEM so PQ settings take precedence for backward compatibility.
func DefaultTLSVersion ¶ added in v1.15.4
func DefaultTLSVersion() uint16
DefaultTLSVersion defines the default TLS Version.
func InsecureTLSCiphers ¶ added in v1.15.4
InsecureTLSCiphers returns the cipher suites implemented by crypto/tls which have security issues.
func LogPolicy ¶
LogPolicy logs an informational message reporting the configured policy, aiding administrators to determine what policy options have been successfully enabled.
func TLSCipherSuites ¶ added in v1.15.4
TLSCipherSuites returns a list of cipher suite IDs from the cipher suite names passed.
func TLSCurvePreferences ¶ added in v1.15.4
TLSCurvePreferences returns a list of Go's crypto/tls CurveID values from the ids passed. The supported values depend on the Go version used. See https://pkg.go.dev/crypto/tls#CurveID for values supported for each Go version.
func TLSVersion ¶ added in v1.15.4
TLSVersion returns the TLS Version ID for the version name passed.
Types ¶
type ApplyOption ¶ added in v1.15.4
ApplyOption selects optional parts of Policy to apply.
func WithServerTLSConfig ¶ added in v1.15.4
func WithServerTLSConfig() ApplyOption
WithServerTLSConfig applies policy.TLSCfg (min_tls_version, cipher_suites, curve_preferences) to the tls.Config.
Intended for terminating TCP listeners only: the server controls what it accepts. Outbound clients should negotiate with peers instead; imposing these settings on a client can break handshakes with external servers that do not support the configured parameters.
type ParsedTLSConfig ¶ added in v1.15.4
type ParsedTLSConfig struct {
MinTLSVersion uint16
CipherSuites []uint16
CurvePreferences []tls.CurveID
}
ParsedTLSConfig holds tls_config values parsed once at startup.
func ParseTLSConfig ¶ added in v1.15.4
func ParseTLSConfig(cfg *TLSConfig, logger hclog.Logger) (*ParsedTLSConfig, error)
ParseTLSConfig parses tls_config strings into typed TLS settings.
type Policy ¶
type Policy struct {
// RequirePQKEM determines if a post-quantum-safe KEM should be required for
// TLS connections. When enabled it takes precedence over TLSConfig curve and
// minimum version settings.
RequirePQKEM bool
// TLSCfg holds parsed tls_config settings. Populated by NewPolicy or ParseTLSConfig.
TLSCfg *ParsedTLSConfig
}
Policy describes policy options to be applied to a TLS configuration.
A zero-initialised Policy provides reasonable defaults.
type TLSConfig ¶ added in v1.15.4
type TLSConfig struct {
CipherSuites []string `hcl:"cipher_suites"`
CurvePreferences []string `hcl:"curve_preferences"`
MinTLSVersion string `hcl:"min_tls_version"`
}
TLSConfig describes TLS configuration settings for terminating endpoints. Unset fields are not applied.
Source Files