Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Add cipher suites support in meshConfig for mesh-wide cipher #45620

Merged
merged 2 commits into from
Jun 26, 2023
Merged

Add cipher suites support in meshConfig for mesh-wide cipher #45620

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
cfa689a
Add cipher suites support in meshConfig for mesh-wide cipher
veer051 Jun 23, 2023
a726072
Addressing review comments
veer051 Jun 26, 2023
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Jump to
Jump to file
Failed to load files.
Diff view
Diff view
3 changes: 3 additions & 0 deletions pilot/pkg/networking/core/v1alpha3/cluster_builder.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -1200,6 +1200,9 @@ func applyTLSDefaults(tlsContext *auth.UpstreamTlsContext, tlsDefaults *meshconf
if len(tlsDefaults.EcdhCurves) > 0 {
tlsContext.CommonTlsContext.TlsParams.EcdhCurves = tlsDefaults.EcdhCurves
}
if len(tlsDefaults.CipherSuites) > 0 {
tlsContext.CommonTlsContext.TlsParams.CipherSuites = tlsDefaults.CipherSuites
}
}

// Set auto_sni if EnableAutoSni feature flag is enabled and if sni field is not explicitly set in DR.
Expand Down
21 changes: 13 additions & 8 deletions pilot/pkg/networking/core/v1alpha3/gateway_test.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -681,7 +681,7 @@ func TestBuildGatewayListenerTlsContext(t *testing.T) {
},
},
{
name: "ecdh curves specified in mesh config with tls SIMPLE",
name: "ecdh curves and cipher suites specified in mesh config with tls SIMPLE",
server: &networking.Server{
Hosts: []string{"httpbin.example.com", "bookinfo.example.com"},
Port: &networking.Port{
Expand All @@ -695,14 +695,16 @@ func TestBuildGatewayListenerTlsContext(t *testing.T) {
},
mesh: &meshconfig.MeshConfig{
TlsDefaults: &meshconfig.MeshConfig_TLSConfig{
EcdhCurves: []string{"P-256"},
EcdhCurves: []string{"P-256"},
CipherSuites: []string{"ECDHE-ECDSA-AES128-SHA"},
},
},
result: &auth.DownstreamTlsContext{
CommonTlsContext: &auth.CommonTlsContext{
AlpnProtocols: util.ALPNHttp,
TlsParams: &auth.TlsParameters{
EcdhCurves: []string{"P-256"},
EcdhCurves: []string{"P-256"},
CipherSuites: []string{"ECDHE-ECDSA-AES128-SHA"},
},
TlsCertificateSdsSecretConfigs: []*auth.SdsSecretConfig{
{
Expand Down Expand Up @@ -731,7 +733,7 @@ func TestBuildGatewayListenerTlsContext(t *testing.T) {
},
},
{
name: "ecdh curves specified in mesh config with, tls mode ISTIO_MUTUAL",
name: "ecdh curves and cipher suites specified in mesh config with, tls mode ISTIO_MUTUAL",
server: &networking.Server{
Hosts: []string{"httpbin.example.com"},
Port: &networking.Port{
Expand All @@ -743,7 +745,8 @@ func TestBuildGatewayListenerTlsContext(t *testing.T) {
},
mesh: &meshconfig.MeshConfig{
TlsDefaults: &meshconfig.MeshConfig_TLSConfig{
EcdhCurves: []string{"P-256"},
EcdhCurves: []string{"P-256"},
CipherSuites: []string{"ECDHE-ECDSA-AES128-SHA", "ECDHE-RSA-AES256-GCM-SHA384"},
},
},
result: &auth.DownstreamTlsContext{
Expand Down Expand Up @@ -803,7 +806,7 @@ func TestBuildGatewayListenerTlsContext(t *testing.T) {
},
},
{
name: "ecdh curves specified in mesh config with tls MUTUAL",
name: "ecdh curves and cipher suites specified in mesh config with tls MUTUAL",
server: &networking.Server{
Hosts: []string{"httpbin.example.com", "bookinfo.example.com"},
Port: &networking.Port{
Expand All @@ -819,13 +822,15 @@ func TestBuildGatewayListenerTlsContext(t *testing.T) {
},
mesh: &meshconfig.MeshConfig{
TlsDefaults: &meshconfig.MeshConfig_TLSConfig{
EcdhCurves: []string{"P-256", "P-384"},
EcdhCurves: []string{"P-256", "P-384"},
CipherSuites: []string{"ECDHE-ECDSA-AES128-SHA", "ECDHE-RSA-AES256-GCM-SHA384"},
},
},
result: &auth.DownstreamTlsContext{
CommonTlsContext: &auth.CommonTlsContext{
TlsParams: &auth.TlsParameters{
EcdhCurves: []string{"P-256", "P-384"},
EcdhCurves: []string{"P-256", "P-384"},
CipherSuites: []string{"ECDHE-ECDSA-AES128-SHA", "ECDHE-RSA-AES256-GCM-SHA384"},
},
AlpnProtocols: util.ALPNHttp,
TlsCertificateSdsSecretConfigs: []*auth.SdsSecretConfig{
Expand Down
3 changes: 3 additions & 0 deletions pilot/pkg/networking/core/v1alpha3/listener.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -186,6 +186,9 @@ func applyDownstreamTLSDefaults(tlsDefaults *meshconfig.MeshConfig_TLSConfig, ct
if len(tlsDefaults.EcdhCurves) > 0 {
tlsParamsOrNew(ctx).EcdhCurves = tlsDefaults.EcdhCurves
}
if len(tlsDefaults.CipherSuites) > 0 {
tlsParamsOrNew(ctx).CipherSuites = tlsDefaults.CipherSuites
}
if tlsDefaults.MinProtocolVersion != meshconfig.MeshConfig_TLSConfig_TLS_AUTO {
tlsParamsOrNew(ctx).TlsMinimumProtocolVersion = auth.TlsParameters_TlsProtocol(tlsDefaults.MinProtocolVersion)
}
Expand Down
8 changes: 8 additions & 0 deletions releasenotes/notes/cipher_suites.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,8 @@
apiVersion: release-notes/v2
kind: feature
area: security
issue:
- https://github.com/istio/istio/issues/28996
releaseNotes:
- |
**Added** cipher_suites support for non ISTIO_MUTUAL traffic through MeshConfig API.