Skip to content

Commit

Permalink
[FIXED] TLS: default ciphers not set when tls enabled from command line
Browse files Browse the repository at this point in the history
If running the server with command lines:
```
nats-server --tlsverify --tlscert "cert.pem" --tlskey "key.pem"
```
the default ciphers would not be set, however, they would using this
equivalent config:
```
tls: {
   verify: true
   cert_file: "cert.pem"
   key_file: "key.pem"
}
```

Reported by @DavidSimner

Signed-off-by: Ivan Kozlovic <ivan@synadia.com>
  • Loading branch information
kozlovic committed Apr 29, 2021
1 parent 53a14eb commit ffccc2e
Show file tree
Hide file tree
Showing 2 changed files with 5 additions and 0 deletions.
1 change: 1 addition & 0 deletions server/opts.go
Original file line number Diff line number Diff line change
Expand Up @@ -4342,6 +4342,7 @@ func overrideTLS(opts *Options) error {
tc.KeyFile = opts.TLSKey
tc.CaFile = opts.TLSCaCert
tc.Verify = opts.TLSVerify
tc.Ciphers = defaultCipherSuites()

var err error
opts.TLSConfig, err = GenTLSConfig(&tc)
Expand Down
4 changes: 4 additions & 0 deletions server/opts_test.go
Original file line number Diff line number Diff line change
Expand Up @@ -1522,6 +1522,10 @@ func TestConfigureOptions(t *testing.T) {
if opts.TLSConfig == nil || !opts.TLS {
t.Fatal("Expected TLSConfig to be set")
}
// Check that we use default TLS ciphers
if !reflect.DeepEqual(opts.TLSConfig.CipherSuites, defaultCipherSuites()) {
t.Fatalf("Default ciphers not set, expected %v, got %v", defaultCipherSuites(), opts.TLSConfig.CipherSuites)
}
}

func TestClusterPermissionsConfig(t *testing.T) {
Expand Down

0 comments on commit ffccc2e

Please sign in to comment.