433b93d · typeable/oauth2-proxy

git.iko.soy/typeable/oauth2-proxy

Merge pull request #1474 from polarctos/feature/tls-min-version-options

Add option to specify the tls.Config.MinVersion for the server to be able to restrict it to TLS 1.3

commit433b93d08a3d4f87950b5d21b4cd0e8ae95c1a97 authorJoel Speed <Joel.speed@hotmail.co.uk> dateWed 9 Feb 2022, 19:29 (5 years ago) parent11699a8 cbbecb8

9 files changed+94−8

compare with master

unifiedsplit

CHANGELOG.md+1 docs/docs/configuration/alpha_config.md+4−2 docs/docs/configuration/overview.md+1 docs/docs/configuration/tls.md+18−3 pkg/apis/options/legacy_options.go+3 pkg/apis/options/legacy_options_test.go+20 pkg/apis/options/server.go+7−2 pkg/http/server.go+12−1 pkg/http/server_test.go+28

CHANGELOG.md+1

@@ -11,6 +11,7 @@

1111- [#1489](https://github.com/oauth2-proxy/oauth2-proxy/pull/1489) Fix Docker Buildx push to include build version (@JoelSpeed)

1212- [#1477](https://github.com/oauth2-proxy/oauth2-proxy/pull/1477) Remove provider documentation for `Microsoft Azure AD` (@omBratteng)

1313- [#1509](https://github.com/oauth2-proxy/oauth2-proxy/pull/1509) Update LoginGovProvider ValidateSession to pass access_token in Header (@pksheldon4)

14+- [#1474](https://github.com/oauth2-proxy/oauth2-proxy/pull/1474) Support configuration of minimal acceptable TLS version (@polarctos)

1415

1516# V7.2.1

1617

docs/docs/configuration/alpha_config.md+4−2

@@ -349,18 +349,20 @@ Server represents the configuration for an HTTP(S) server

349349| ----- | ---- | ----------- |

350350| `BindAddress` | _string_ | BindAddress is the address on which to serve traffic. Leave blank or set to "-" to disable. |

351351| `SecureBindAddress` | _string_ | SecureBindAddress is the address on which to serve secure traffic. Leave blank or set to "-" to disable. |

352−| `TLS` | _[TLS](#tls)_ | TLS contains the information for loading the certificate and key for the secure traffic. |

352+| `TLS` | _[TLS](#tls)_ | TLS contains the information for loading the certificate and key for the secure traffic and further configuration for the TLS server. |

353353

354354### TLS

355355

356356(**Appears on:** [Server](#server))

357357

358−TLS contains the information for loading a TLS certifcate and key.

358+TLS contains the information for loading a TLS certificate and key

359+as well as an optional minimal TLS version that is acceptable.

359360

360361| Field | Type | Description |

361362| ----- | ---- | ----------- |

362363| `Key` | _[SecretSource](#secretsource)_ | Key is the TLS key data to use. Typically this will come from a file. |

363364| `Cert` | _[SecretSource](#secretsource)_ | Cert is the TLS certificate data to use. Typically this will come from a file. |

365+| `MinVersion` | _string_ | MinVersion is the minimal TLS version that is acceptable. E.g. Set to "TLS1.3" to select TLS version 1.3 |

364366

365367### Upstream

366368

docs/docs/configuration/overview.md+1

@@ -191,6 +191,7 @@ An example [oauth2-proxy.cfg](https://github.com/oauth2-proxy/oauth2-proxy/blob/

docs/docs/configuration/tls.md+18−3

@@ -3,7 +3,11 @@ id: tls

33title: TLS Configuration

44---

6−There are two recommended configurations.

6+There are two recommended configurations:

7+- [At OAuth2 Proxy](#terminate-tls-at-oauth2-proxy)

8+- [At Reverse Proxy](#terminate-tls-at-reverse-proxy-eg-nginx)

10+### Terminate TLS at OAuth2 Proxy

711

8121. Configure SSL Termination with OAuth2 Proxy by providing a `--tls-cert-file=/path/to/cert.pem` and `--tls-key-file=/path/to/cert.key`.

913

@@ -22,7 +26,18 @@ There are two recommended configurations.

2226 --client-secret=...

2327 ```

2428

25−2. Configure SSL Termination with [Nginx](http://nginx.org/) (example config below), Amazon ELB, Google Cloud Platform Load Balancing, or ....

29+2. With this configuration approach the customization of the TLS settings is limited.

30+

31+ The minimal acceptable TLS version can be set with `--tls-min-version=TLS1.3`.

32+ The defaults set `TLS1.2` as the minimal version.

33+ Regardless of the minimum version configured, `TLS1.3` is currently always used as the maximal version.

34+

35+ The server side cipher suites are the defaults from [`crypto/tls`](https://pkg.go.dev/crypto/tls#CipherSuites) of

36+ the currently used `go` version for building `oauth2-proxy`.

37+

38+### Terminate TLS at Reverse Proxy, e.g. Nginx

39+

40+1. Configure SSL Termination with [Nginx](http://nginx.org/) (example config below), Amazon ELB, Google Cloud Platform Load Balancing, or ...

2641

2742 Because `oauth2-proxy` listens on `127.0.0.1:4180` by default, to listen on all interfaces (needed when using an

2843 external load balancer like Amazon ELB or Google Platform Load Balancing) use `--http-address="0.0.0.0:4180"` or

@@ -55,7 +70,7 @@ There are two recommended configurations.

5570 }

5671 ```

5772

58− The command line to run `oauth2-proxy` in this configuration would look like this:

73+2. The command line to run `oauth2-proxy` in this configuration would look like this:

5974

6075 ```bash

6176 ./oauth2-proxy \

pkg/apis/options/legacy_options.go+3

@@ -448,6 +448,7 @@ type LegacyServer struct {

448448 HTTPSAddress string `flag:"https-address" cfg:"https_address"`

449449 TLSCertFile string `flag:"tls-cert-file" cfg:"tls_cert_file"`

450450 TLSKeyFile string `flag:"tls-key-file" cfg:"tls_key_file"`

451+ TLSMinVersion string `flag:"tls-min-version" cfg:"tls_min_version"`

451452}

452453

453454func legacyServerFlagset() *pflag.FlagSet {

@@ -461,6 +462,7 @@ func legacyServerFlagset() *pflag.FlagSet {

461462 flagSet.String("https-address", ":443", "<addr>:<port> to listen on for HTTPS clients")

462463 flagSet.String("tls-cert-file", "", "path to certificate file")

463464 flagSet.String("tls-key-file", "", "path to private key file")

465+ flagSet.String("tls-min-version", "", "minimal TLS version for HTTPS clients (either \"TLS1.2\" or \"TLS1.3\")")

464466

465467 return flagSet

466468}

@@ -582,6 +584,7 @@ func (l LegacyServer) convert() (Server, Server) {

582584 Cert: &SecretSource{

583585 FromFile: l.TLSCertFile,

584586 },

587+ MinVersion: l.TLSMinVersion,

585588 }

586589 // Preserve backwards compatibility, only run one server

587590 appServer.BindAddress = ""

pkg/apis/options/legacy_options_test.go+20

@@ -785,6 +785,7 @@ var _ = Describe("Legacy Options", func() {

785785 secureMetricsAddr = ":9443"

786786 crtPath = "tls.crt"

787787 keyPath = "tls.key"

788+ minVersion = "TLS1.3"

788789 )

789790

790791 var tlsConfig = &TLS{

@@ -796,6 +797,12 @@ var _ = Describe("Legacy Options", func() {

796797 },

797798 }

798799

800+ var tlsConfigMinVersion = &TLS{

801+ Cert: tlsConfig.Cert,

802+ Key: tlsConfig.Key,

803+ MinVersion: minVersion,

804+ }

805+

799806 DescribeTable("should convert to app and metrics servers",

800807 func(in legacyServersTableInput) {

801808 appServer, metricsServer := in.legacyServer.convert()

@@ -823,6 +830,19 @@ var _ = Describe("Legacy Options", func() {

823830 TLS: tlsConfig,

824831 },

825832 }),

833+ Entry("with TLS options specified with MinVersion", legacyServersTableInput{

834+ legacyServer: LegacyServer{

835+ HTTPAddress: insecureAddr,

836+ HTTPSAddress: secureAddr,

837+ TLSKeyFile: keyPath,

838+ TLSCertFile: crtPath,

839+ TLSMinVersion: minVersion,

840+ },

841+ expectedAppServer: Server{

842+ SecureBindAddress: secureAddr,

843+ TLS: tlsConfigMinVersion,

844+ },

845+ }),

826846 Entry("with metrics HTTP and HTTPS addresses", legacyServersTableInput{

827847 legacyServer: LegacyServer{

828848 HTTPAddress: insecureAddr,

pkg/apis/options/server.go+7−2

@@ -11,11 +11,12 @@ type Server struct {

1111 SecureBindAddress string

1212

1313 // TLS contains the information for loading the certificate and key for the

14− // secure traffic.

14+ // secure traffic and further configuration for the TLS server.

1515 TLS *TLS

1616}

1717

18−// TLS contains the information for loading a TLS certifcate and key.

18+// TLS contains the information for loading a TLS certificate and key

19+// as well as an optional minimal TLS version that is acceptable.

1920type TLS struct {

2021 // Key is the TLS key data to use.

2122 // Typically this will come from a file.

@@ -24,4 +25,8 @@ type TLS struct {

2425 // Cert is the TLS certificate data to use.

2526 // Typically this will come from a file.

2627 Cert *SecretSource

28+

29+ // MinVersion is the minimal TLS version that is acceptable.

30+ // E.g. Set to "TLS1.3" to select TLS version 1.3

31+ MinVersion string

2732}

pkg/http/server.go+12−1

@@ -91,7 +91,7 @@ func (s *server) setupTLSListener(opts Opts) error {

9191 }

9292

9393 config := &tls.Config{

94− MinVersion: tls.VersionTLS12,

94+ MinVersion: tls.VersionTLS12, // default, override below

9595 MaxVersion: tls.VersionTLS13,

9696 NextProtos: []string{"http/1.1"},

9797 }

@@ -104,6 +104,17 @@ func (s *server) setupTLSListener(opts Opts) error {

104104 }

105105 config.Certificates = []tls.Certificate{cert}

106106

107+ if len(opts.TLS.MinVersion) > 0 {

108+ switch opts.TLS.MinVersion {

109+ case "TLS1.2":

110+ config.MinVersion = tls.VersionTLS12

111+ case "TLS1.3":

112+ config.MinVersion = tls.VersionTLS13

113+ default:

114+ return errors.New("unknown TLS MinVersion config provided")

115+ }

116+ }

117+

107118 listenAddr := getListenAddress(opts.SecureBindAddress)

108119

109120 listener, err := net.Listen("tcp", listenAddr)

pkg/http/server_test.go+28

@@ -233,6 +233,34 @@ var _ = Describe("Server", func() {

233233 expectHTTPListener: false,

234234 expectTLSListener: true,

235235 }),

236+ Entry("with a valid https bind address, and valid TLS config with MinVersion", &newServerTableInput{

237+ opts: Opts{

238+ Handler: handler,

239+ SecureBindAddress: "127.0.0.1:0",

240+ TLS: &options.TLS{

241+ Key: &keyDataSource,

242+ Cert: &certDataSource,

243+ MinVersion: "TLS1.3",

244+ },

245+ },

246+ expectedErr: nil,

247+ expectHTTPListener: false,

248+ expectTLSListener: true,

249+ }),

250+ Entry("with a valid https bind address, and invalid TLS config with unknown MinVersion", &newServerTableInput{

251+ opts: Opts{

252+ Handler: handler,

253+ SecureBindAddress: "127.0.0.1:0",

254+ TLS: &options.TLS{

255+ Key: &keyDataSource,

256+ Cert: &certDataSource,

257+ MinVersion: "TLS1.42",

258+ },

259+ },

260+ expectedErr: errors.New("error setting up TLS listener: unknown TLS MinVersion config provided"),

261+ expectHTTPListener: false,

262+ expectTLSListener: true,

263+ }),

236264 )

237265 })

238266