ston1th/node_exporter
0
0
Fork 0
Code Issues Releases Activity

tls: enable the selection of more TLS settings (#1695)

Browse source 
tls: enable the selection of more TLS settings
* Rename `tls_config` to `tls_server_config`.
* Add new http server config with HTTP/2 enabled by default.

Signed-off-by: Julien Pivotto <roidelapluie@inuits.eu>
This commit is contained in:
Julien Pivotto 2020-05-13 20:26:01 +02:00 • committed by GitHub
commit f87e566df9
No known key found for this signature in database
GPG key ID: 4AEE18F83AFDEB23
27 changed files with 433 additions and 40 deletions
Download patch file Download diff file Expand all files Collapse all files

2
https/testdata/tls_config_auth_clientCAs_invalid.bad.yml vendored
View file

@ -1,4 +1,4 @@
tls_config :
tls_server_config :
cert_file : "testdata/server.crt"
key_file : "testdata/server.key"
client_ca_file : "somefile"

2
https/testdata/tls_config_auth_clientCAs_missing.bad.yml vendored
View file

@ -1,4 +1,4 @@
tls_config :
tls_server_config :
cert_file : "testdata/server.crt"
key_file : "testdata/server.key"
client_auth_type : "RequireAndVerifyClientCert"

2
https/testdata/tls_config_auth_user_list_invalid.bad.yml vendored
View file

@ -1,4 +1,4 @@
tls_config :
tls_server_config :
cert_file : "testdata/server.crt"
key_file : "testdata/server.key"
basic_auth_users:

2
https/testdata/tls_config_junk_key.yml vendored
View file

@ -1,2 +1,2 @@
tls_config :
tls_server_config :
cert_filse: "testdata/server.crt"

2
https/testdata/tls_config_noAuth.bad.yml vendored
View file

@ -1,4 +1,4 @@
tls_config :
tls_server_config :
cert_file : "testdata/server.crt"
key_file : "testdata/server.key"
client_ca_file : "testdata/tls-ca-chain.pem"

2
https/testdata/tls_config_noAuth.good.blocking.yml vendored
View file

@ -1,4 +1,4 @@
tls_config :
tls_server_config :
cert_file : "testdata/server.crt"
key_file : "testdata/server.key"
client_auth_type : "RequireAndVerifyClientCert"

2
https/testdata/tls_config_noAuth.good.yml vendored
View file

@ -1,4 +1,4 @@
tls_config :
tls_server_config :
cert_file : "testdata/server.crt"
key_file : "testdata/server.key"
client_auth_type : "VerifyClientCertIfGiven"

26
https/testdata/tls_config_noAuth_allCiphers.good.yml vendored Normal file
View file

@ -0,0 +1,26 @@
tls_server_config :
cert_file : "testdata/server.crt"
key_file : "testdata/server.key"
client_auth_type : "VerifyClientCertIfGiven"
client_ca_file : "testdata/tls-ca-chain.pem"
cipher_suites:
- TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256
- TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384
- TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256
- TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384
- TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256
- TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256
- TLS_AES_128_GCM_SHA256
- TLS_AES_256_GCM_SHA384
- TLS_CHACHA20_POLY1305_SHA256
- TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA
- TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA
- TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA
- TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA
- TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA
- TLS_RSA_WITH_3DES_EDE_CBC_SHA
- TLS_RSA_WITH_AES_128_CBC_SHA
- TLS_RSA_WITH_AES_256_CBC_SHA
- TLS_RSA_WITH_AES_128_GCM_SHA256
- TLS_RSA_WITH_AES_256_GCM_SHA384

10
https/testdata/tls_config_noAuth_allCurves.good.yml vendored Normal file
View file

@ -0,0 +1,10 @@
tls_server_config :
cert_file : "testdata/server.crt"
key_file : "testdata/server.key"
client_auth_type : "VerifyClientCertIfGiven"
client_ca_file : "testdata/tls-ca-chain.pem"
curve_preferences:
- CurveP256
- CurveP384
- CurveP521
- X25519

2
https/testdata/tls_config_noAuth_certPath_empty.bad.yml vendored
View file

@ -1,3 +1,3 @@
tls_config :
tls_server_config :
cert_file : ""
key_file : "testdata/server.key"

2
https/testdata/tls_config_noAuth_certPath_invalid.bad.yml vendored
View file

@ -1,3 +1,3 @@
tls_config :
tls_server_config :
cert_file : "somefile"
key_file : "testdata/server.key"

2
https/testdata/tls_config_noAuth_certPath_keyPath_empty.bad.yml vendored
View file

@ -1,4 +1,4 @@
tls_config :
tls_server_config :
cert_file : ""
key_file : ""
client_auth_type: "x"

2
https/testdata/tls_config_noAuth_certPath_keyPath_invalid.bad.yml vendored
View file

@ -1,3 +1,3 @@
tls_config :
tls_server_config :
cert_file : "somefile"
key_file : "somefile"

8
https/testdata/tls_config_noAuth_inventedCiphers.bad.yml vendored Normal file
View file

@ -0,0 +1,8 @@
tls_server_config :
cert_file : "testdata/server.crt"
key_file : "testdata/server.key"
client_auth_type : "VerifyClientCertIfGiven"
client_ca_file : "testdata/tls-ca-chain.pem"
cipher_suites:
- TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA2048

7
https/testdata/tls_config_noAuth_inventedCurves.bad.yml vendored Normal file
View file

@ -0,0 +1,7 @@
tls_server_config :
cert_file : "testdata/server.crt"
key_file : "testdata/server.key"
client_auth_type : "VerifyClientCertIfGiven"
client_ca_file : "testdata/tls-ca-chain.pem"
curve_preferences:
- CurveP257

2
https/testdata/tls_config_noAuth_keyPath_empty.bad.yml vendored
View file

@ -1,3 +1,3 @@
tls_config :
tls_server_config :
cert_file : "testdata/server.crt"
key_file : ""

2
https/testdata/tls_config_noAuth_keyPath_invalid.bad.yml vendored
View file

@ -1,3 +1,3 @@
tls_config :
tls_server_config :
cert_file : "testdata/server.cert"
key_file : "somefile"

10
https/testdata/tls_config_noAuth_noHTTP2.good.yml vendored Normal file
View file

@ -0,0 +1,10 @@
tls_server_config :
cert_file : "testdata/server.crt"
key_file : "testdata/server.key"
client_auth_type : "VerifyClientCertIfGiven"
client_ca_file : "testdata/tls-ca-chain.pem"
cipher_suites:
- TLS_RSA_WITH_AES_128_CBC_SHA
max_version: TLS12
http_server_config:
http2: false

8
https/testdata/tls_config_noAuth_noHTTP2Cipher.bad.yml vendored Normal file
View file

@ -0,0 +1,8 @@
tls_server_config :
cert_file : "testdata/server.crt"
key_file : "testdata/server.key"
client_auth_type : "VerifyClientCertIfGiven"
client_ca_file : "testdata/tls-ca-chain.pem"
cipher_suites:
- TLS_RSA_WITH_AES_128_CBC_SHA
max_version: TLS12

10
https/testdata/tls_config_noAuth_someCiphers.good.yml vendored Normal file
View file

@ -0,0 +1,10 @@
tls_server_config :
cert_file : "testdata/server.crt"
key_file : "testdata/server.key"
client_auth_type : "VerifyClientCertIfGiven"
client_ca_file : "testdata/tls-ca-chain.pem"
cipher_suites:
- TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384
- TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256
min_version: TLS12
max_version: TLS12

11
https/testdata/tls_config_noAuth_someCiphers_noOrder.good.yml vendored Normal file
View file

@ -0,0 +1,11 @@
tls_server_config :
cert_file : "testdata/server.crt"
key_file : "testdata/server.key"
client_auth_type : "VerifyClientCertIfGiven"
client_ca_file : "testdata/tls-ca-chain.pem"
cipher_suites:
- TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384
- TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256
prefer_server_cipher_suites: false
min_version: TLS12
max_version: TLS12

8
https/testdata/tls_config_noAuth_someCurves.good.yml vendored Normal file
View file

@ -0,0 +1,8 @@
tls_server_config :
cert_file : "testdata/server.crt"
key_file : "testdata/server.key"
client_auth_type : "VerifyClientCertIfGiven"
client_ca_file : "testdata/tls-ca-chain.pem"
min_version: TLS13
curve_preferences:
- CurveP521

6
https/testdata/tls_config_noAuth_wrongTLSVersion.bad.yml vendored Normal file
View file

@ -0,0 +1,6 @@
tls_server_config :
cert_file : "testdata/server.crt"
key_file : "testdata/server.key"
client_auth_type : "VerifyClientCertIfGiven"
client_ca_file : "testdata/tls-ca-chain.pem"
min_version: TLS111

2
https/testdata/tls_config_users.good.yml vendored
View file

@ -1,4 +1,4 @@
tls_config :
tls_server_config :
cert_file : "testdata/server.crt"
key_file : "testdata/server.key"
basic_auth_users: