netbird/dex
0
0
Fork 0
mirror of https://github.com/netbirdio/dex.git synced 2026-05-22 18:43:53 -07:00
Code Issues Packages Projects Releases Wiki Activity

feat: add TLS versions configuration

Browse Source 
Add configuration options for TLSMinVersion and TLSMaxVersion.
This enables setting TLS 1.3 as minimum version for example for both
GRPC and Web, or enforcing TLS 1.2 only for easier debugging of
secure connections.

Signed-off-by: Tuomo Tanskanen <tuomo.tanskanen@est.tech>
This commit is contained in:
Tuomo Tanskanen
2024-01-25 13:55:55 +02:00
parent 7ca42d7f6e
commit 5bbdb44202
4 changed files with 49 additions and 9 deletions
Download Patch File Download Diff File Expand all files Collapse all files
cmd/dex/config.go
+15 -5
View File
@@ -64,10 +64,16 @@ func (c Config) Validate() error {
{c.Web.HTTP == "" && c.Web.HTTPS == "", "must supply a HTTP/HTTPS address to listen on"},
{c.Web.HTTPS != "" && c.Web.TLSCert == "", "no cert specified for HTTPS"},
{c.Web.HTTPS != "" && c.Web.TLSKey == "", "no private key specified for HTTPS"},
{c.Web.TLSMinVersion != "" && c.Web.TLSMinVersion != "1.2" && c.Web.TLSMinVersion != "1.3", "supported TLS versions are: 1.2, 1.3"},
{c.Web.TLSMaxVersion != "" && c.Web.TLSMaxVersion != "1.2" && c.Web.TLSMaxVersion != "1.3", "supported TLS versions are: 1.2, 1.3"},
{c.Web.TLSMaxVersion != "" && c.Web.TLSMinVersion != "" && c.Web.TLSMinVersion > c.Web.TLSMaxVersion, "TLSMinVersion greater than TLSMaxVersion"},
{c.GRPC.TLSCert != "" && c.GRPC.Addr == "", "no address specified for gRPC"},
{c.GRPC.TLSKey != "" && c.GRPC.Addr == "", "no address specified for gRPC"},
{(c.GRPC.TLSCert == "") != (c.GRPC.TLSKey == ""), "must specific both a gRPC TLS cert and key"},
{c.GRPC.TLSCert == "" && c.GRPC.TLSClientCA != "", "cannot specify gRPC TLS client CA without a gRPC TLS cert"},
{c.GRPC.TLSMinVersion != "" && c.GRPC.TLSMinVersion != "1.2" && c.GRPC.TLSMinVersion != "1.3", "supported TLS versions are: 1.2, 1.3"},
{c.GRPC.TLSMaxVersion != "" && c.GRPC.TLSMaxVersion != "1.2" && c.GRPC.TLSMaxVersion != "1.3", "supported TLS versions are: 1.2, 1.3"},
{c.GRPC.TLSMaxVersion != "" && c.GRPC.TLSMinVersion != "" && c.GRPC.TLSMinVersion > c.GRPC.TLSMaxVersion, "TLSMinVersion greater than TLSMaxVersion"},
}
var checkErrors []string
@@ -149,6 +155,8 @@ type Web struct {
HTTPS string `json:"https"`
TLSCert string `json:"tlsCert"`
TLSKey string `json:"tlsKey"`
TLSMinVersion string `json:"tlsMinVersion"`
TLSMaxVersion string `json:"tlsMaxVersion"`
AllowedOrigins []string `json:"allowedOrigins"`
AllowedHeaders []string `json:"allowedHeaders"`
}
@@ -163,11 +171,13 @@ type Telemetry struct {
// GRPC is the config for the gRPC API.
type GRPC struct {
// The port to listen on.
Addr string `json:"addr"`
TLSCert string `json:"tlsCert"`
TLSKey string `json:"tlsKey"`
TLSClientCA string `json:"tlsClientCA"`
Reflection bool `json:"reflection"`
Addr string `json:"addr"`
TLSCert string `json:"tlsCert"`
TLSKey string `json:"tlsKey"`
TLSClientCA string `json:"tlsClientCA"`
TLSMinVersion string `json:"tlsMinVersion"`
TLSMaxVersion string `json:"tlsMaxVersion"`
Reflection bool `json:"reflection"`
}
// Storage holds app's storage configuration.
cmd/dex/config_test.go
+6 -2
View File
@@ -71,7 +71,9 @@ storage:
connMaxLifetime: 30
connectionTimeout: 3
web:
http: 127.0.0.1:5556
https: 127.0.0.1:5556
tlsMinVersion: 1.3
tlsMaxVersion: 1.2
frontend:
dir: ./web
@@ -144,7 +146,9 @@ logger:
},
},
Web: Web{
HTTP: "127.0.0.1:5556",
HTTPS: "127.0.0.1:5556",
TLSMinVersion: "1.3",
TLSMaxVersion: "1.2",
},
Frontend: server.WebConfig{
Dir: "./web",
cmd/dex/serve.go
+26 -2
View File
@@ -145,9 +145,23 @@ func runServe(options serveOptions) error {
tls.TLS_RSA_WITH_AES_256_GCM_SHA384,
}
allowedTLSVersions := map[string]int{
"1.2": tls.VersionTLS12,
"1.3": tls.VersionTLS13,
}
if c.GRPC.TLSCert != "" {
tlsMinVersion := tls.VersionTLS12
if c.GRPC.TLSMinVersion != "" {
tlsMinVersion = allowedTLSVersions[c.GRPC.TLSMinVersion]
}
tlsMaxVersion := 0 // default for max is whatever Go defaults to
if c.GRPC.TLSMaxVersion != "" {
tlsMaxVersion = allowedTLSVersions[c.GRPC.TLSMaxVersion]
}
baseTLSConfig := &tls.Config{
MinVersion: tls.VersionTLS12,
MinVersion: uint16(tlsMinVersion),
MaxVersion: uint16(tlsMaxVersion),
CipherSuites: allowedTLSCiphers,
PreferServerCipherSuites: true,
}
@@ -422,8 +436,18 @@ func runServe(options serveOptions) error {
return fmt.Errorf("listening (%s) on %s: %v", name, c.Web.HTTPS, err)
}
tlsMinVersion := tls.VersionTLS12
if c.Web.TLSMinVersion != "" {
tlsMinVersion = allowedTLSVersions[c.Web.TLSMinVersion]
}
tlsMaxVersion := 0 // default for max is whatever Go defaults to
if c.Web.TLSMaxVersion != "" {
tlsMaxVersion = allowedTLSVersions[c.Web.TLSMaxVersion]
}
baseTLSConfig := &tls.Config{
MinVersion: tls.VersionTLS12,
MinVersion: uint16(tlsMinVersion),
MaxVersion: uint16(tlsMaxVersion),
CipherSuites: allowedTLSCiphers,
PreferServerCipherSuites: true,
}
config.yaml.dist
+2
View File
@@ -55,6 +55,8 @@ web:
# https: 127.0.0.1:5554
# tlsCert: /etc/dex/tls.crt
# tlsKey: /etc/dex/tls.key
# tlsMinVersion: 1.2
# tlsMaxVersion: 1.3
# Dex UI configuration
# frontend: