Skip to content

Added note tls version below 1.2 should set compatible cipher suites #2502

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
istio-testing merged 3 commits into from
Oct 20, 2022
Merged

Added note tls version below 1.2 should set compatible cipher suites #2502

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
9b7ad16
Added note tls version below 1.2 should set valida cipher suites
hzxuzhonghu Oct 11, 2022
0ec4e2c
Address comment
hzxuzhonghu Oct 14, 2022
e679e52
make gen
hzxuzhonghu Oct 20, 2022
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
6 changes: 5 additions & 1 deletion networking/v1alpha3/gateway.pb.go
View file
Open in desktop

Some generated files are not rendered by default. Learn more about how customized files appear on GitHub.

5 changes: 4 additions & 1 deletion networking/v1alpha3/gateway.pb.html
View file
Open in desktop

Some generated files are not rendered by default. Learn more about how customized files appear on GitHub.

6 changes: 5 additions & 1 deletion networking/v1alpha3/gateway.proto
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -719,7 +719,11 @@ message ServerTLSSettings {
TLSV1_3 = 4;
}

// Optional: Minimum TLS protocol version.
// Optional: Minimum TLS protocol version. By default, it is `TLSV1_2`.
// TLS protocol versions below TLSV1_2 require setting compatible ciphers with the
// `cipherSuites` setting as they no longer include compatible ciphers.
//
// Note: Using TLS protocol versions below TLSV1_2 has serious security considerations and risks.
TLSProtocol min_protocol_version = 7;

// Optional: Maximum TLS protocol version.
Expand Down
6 changes: 5 additions & 1 deletion networking/v1beta1/gateway.pb.go
View file
Open in desktop

Some generated files are not rendered by default. Learn more about how customized files appear on GitHub.

6 changes: 5 additions & 1 deletion networking/v1beta1/gateway.proto
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -719,7 +719,11 @@ message ServerTLSSettings {
TLSV1_3 = 4;
}

// Optional: Minimum TLS protocol version.
// Optional: Minimum TLS protocol version. By default, it is `TLSV1_2`.
Copy link
Contributor

@louiscryan louiscryan Oct 20, 2022

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@lei-tang please review

Copy link
Contributor

@lei-tang lei-tang Oct 20, 2022

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM.
@hzxuzhonghu
Nit: Consider replacing "Using TLS protocol versions below TLSV1_2 has serious security considerations and risks." with "Using TLS protocol versions below TLSV1_2 has serious security risks."

Copy link
Member Author

@hzxuzhonghu hzxuzhonghu Oct 21, 2022

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

SG, i will update

// TLS protocol versions below TLSV1_2 require setting compatible ciphers with the
// `cipherSuites` setting as they no longer include compatible ciphers.
//
// Note: Using TLS protocol versions below TLSV1_2 has serious security considerations and risks.
TLSProtocol min_protocol_version = 7;

// Optional: Maximum TLS protocol version.
Expand Down