|
| 1 | +// Package tlsconfig maps the OpenShift cluster TLS security profile |
| 2 | +// (Old / Intermediate / Modern / Custom) onto a crypto/tls configuration for |
| 3 | +// the operator's served endpoints (metrics and webhook servers), so they |
| 4 | +// honour the cluster's configured TLS policy for OCP 5.0 compliance (TC-5768). |
| 5 | +package tlsconfig |
| 6 | + |
| 7 | +import ( |
| 8 | + "crypto/tls" |
| 9 | + |
| 10 | + configv1 "github.com/openshift/api/config/v1" |
| 11 | + "github.com/openshift/library-go/pkg/crypto" |
| 12 | +) |
| 13 | + |
| 14 | +// Resolve returns the minimum TLS version and Go cipher-suite IDs that satisfy |
| 15 | +// the given cluster TLS security profile. A nil profile (no cluster policy |
| 16 | +// configured) falls back to the OpenShift default, Intermediate. |
| 17 | +// |
| 18 | +// The OpenSSL cipher names in the profile are translated to Go cipher IDs via |
| 19 | +// library-go's crypto helpers (the same mapping OpenShift itself uses), so it |
| 20 | +// stays correct as ciphers evolve. Cipher names Go does not implement are |
| 21 | +// dropped by that mapping. For TLS 1.3 (Modern) no cipher suites are returned, |
| 22 | +// because Go manages TLS 1.3 cipher suites itself and does not allow configuring |
| 23 | +// them. |
| 24 | +func Resolve(profile *configv1.TLSSecurityProfile) (minVersion uint16, cipherSuites []uint16) { |
| 25 | + spec := specFor(profile) |
| 26 | + |
| 27 | + minVersion, err := crypto.TLSVersion(string(spec.MinTLSVersion)) |
| 28 | + if err != nil { |
| 29 | + minVersion = tls.VersionTLS12 |
| 30 | + } |
| 31 | + |
| 32 | + if minVersion >= tls.VersionTLS13 { |
| 33 | + return minVersion, nil |
| 34 | + } |
| 35 | + |
| 36 | + return minVersion, crypto.CipherSuitesOrDie(crypto.OpenSSLToIANACipherSuites(spec.Ciphers)) |
| 37 | +} |
| 38 | + |
| 39 | +// Apply sets the resolved minimum TLS version (and, for TLS < 1.3, the cipher |
| 40 | +// suites) from the cluster TLS security profile onto cfg. |
| 41 | +func Apply(cfg *tls.Config, profile *configv1.TLSSecurityProfile) { |
| 42 | + minVersion, cipherSuites := Resolve(profile) |
| 43 | + cfg.MinVersion = minVersion |
| 44 | + if minVersion < tls.VersionTLS13 { |
| 45 | + cfg.CipherSuites = cipherSuites |
| 46 | + } |
| 47 | +} |
| 48 | + |
| 49 | +// protocolOrder lists TLS protocol versions low→high with their JVM/JSSE names, |
| 50 | +// used to derive the enabled-protocol set for operands (e.g. Quarkus). |
| 51 | +var protocolOrder = []struct { |
| 52 | + version uint16 |
| 53 | + name string |
| 54 | +}{ |
| 55 | + {tls.VersionTLS10, "TLSv1"}, |
| 56 | + {tls.VersionTLS11, "TLSv1.1"}, |
| 57 | + {tls.VersionTLS12, "TLSv1.2"}, |
| 58 | + {tls.VersionTLS13, "TLSv1.3"}, |
| 59 | +} |
| 60 | + |
| 61 | +// QuarkusSSL returns the TLS protocol names and cipher-suite names (JVM/JSSE |
| 62 | +// naming) that honour the given cluster TLS security profile, for configuring a |
| 63 | +// Quarkus operand via `quarkus.http.ssl.protocols` / `quarkus.http.ssl.cipher-suites`. |
| 64 | +// Protocols are every TLS version >= the profile minimum; ciphers are the |
| 65 | +// profile's ciphers mapped to IANA/JVM names (this includes the TLS 1.3 cipher |
| 66 | +// names, which the JVM — unlike Go's crypto/tls — accepts in cipher-suites). A |
| 67 | +// nil profile yields the Intermediate default, matching the operator's own |
| 68 | +// endpoints. |
| 69 | +func QuarkusSSL(profile *configv1.TLSSecurityProfile) (protocols []string, ciphers []string) { |
| 70 | + minVersion, _ := Resolve(profile) |
| 71 | + for _, p := range protocolOrder { |
| 72 | + if p.version >= minVersion { |
| 73 | + protocols = append(protocols, p.name) |
| 74 | + } |
| 75 | + } |
| 76 | + |
| 77 | + return protocols, crypto.OpenSSLToIANACipherSuites(specFor(profile).Ciphers) |
| 78 | +} |
| 79 | + |
| 80 | +// specFor returns the TLSProfileSpec (ciphers + min version) for the given |
| 81 | +// profile: the caller's Custom spec for a Custom profile, the canonical |
| 82 | +// definition for a named profile, or the Intermediate default when the profile |
| 83 | +// is nil or its type is unset/unknown. |
| 84 | +func specFor(profile *configv1.TLSSecurityProfile) configv1.TLSProfileSpec { |
| 85 | + if profile != nil { |
| 86 | + if profile.Type == configv1.TLSProfileCustomType { |
| 87 | + if profile.Custom != nil { |
| 88 | + return profile.Custom.TLSProfileSpec |
| 89 | + } |
| 90 | + } else if spec, ok := configv1.TLSProfiles[profile.Type]; ok { |
| 91 | + return *spec |
| 92 | + } |
| 93 | + } |
| 94 | + |
| 95 | + return *configv1.TLSProfiles[configv1.TLSProfileIntermediateType] |
| 96 | +} |
0 commit comments