chore(conf): disable TLSv1.1 and lower in openssl 3.x #12420
Conversation
|
Tested the Kong with And if we use openssl |
|
@Water-Melon does it mean we cannot get this @fffonion is that right? If so, then we need to remove the whole |
But it (3.x) works on server with TLSv1.1/TLSv1.0? Or not? |
|
@bungle This PR has two objectives: the first is to remove unsupported TLS versions from default configurations, and the second is to support communication with old versions of OpenSSL clients using TLSv1.1. |
Water-Melon
force-pushed
the
chore/disable_tls1_in_v3
branch
from
45e564c to
89a1150
Compare
let's mention this in the kong.conf.default comments, so it will become docs on konghq.com |
Water-Melon
force-pushed
the
chore/disable_tls1_in_v3
branch
2 times, most recently
from
ee92f48 to
d390920
Compare
Water-Melon
force-pushed
the
chore/disable_tls1_in_v3
branch
from
d390920 to
3c03154
Compare
Water-Melon
force-pushed
the
chore/disable_tls1_in_v3
branch
2 times, most recently
from
516a523 to
7305825
Compare
Water-Melon
force-pushed
the
chore/disable_tls1_in_v3
branch
from
7305825 to
7ba02d4
Compare
| @@ -432,6 +432,20 @@ local function check_and_parse(conf, opts) | |||
| conf.ssl_dhparam = suite.dhparams | |||
| conf.nginx_http_ssl_dhparam = suite.dhparams | |||
| conf.nginx_stream_ssl_dhparam = suite.dhparams | |||
| else | |||
| for _, key in ipairs({ | |||
| "nginx_http_ssl_conf_command", | |||
There was a problem hiding this comment.
The only usage of those conf fields I can find is here. Could you elaborate?
There was a problem hiding this comment.
Since this set of configurations is the only one related to the security level, I believe there shouldn't be any issues.
There was a problem hiding this comment.
Since this set of configurations is the only one related to the security level, I believe there shouldn't be any issues.
It's surprising to find that we simply ignore anything other than the SECLEVEL in this field. Could we just name it "nginx_http_ssl_security_level" or something?
There was a problem hiding this comment.
In nginx, there is no specific configuration that is solely responsible for modifying the security level.
Nginx does not support using a single ssl_conf_command to apply multiple commands.
It is acceptable to use multiple ssl_conf_command directives in the Nginx configuration.
But it seems that kong's conf_load cannot support this unless we do special processing for these instructions.
Adding a Kong configuration as you said or making the conf_loader support array-type configurations could solve this problem. However, this would require significant changes, and there might be few users who would actually configure these settings. Therefore, this is just a most cost-effective strategy. Although I still believe that enabling conf_loader to support array-type values would provide better configurability.
|
Backport failed for Please cherry-pick the changes locally and resolve any conflicts. git fetch origin release/3.5.x
git worktree add -d .worktree/backport-12420-to-release/3.5.x origin/release/3.5.x
cd .worktree/backport-12420-to-release/3.5.x
git switch --create backport-12420-to-release/3.5.x
git cherry-pick -x 2516c5035f8a2406a3add38370b520f54aac6a11 |
|
Backport failed for Please cherry-pick the changes locally and resolve any conflicts. git fetch origin release/3.4.x
git worktree add -d .worktree/backport-12420-to-release/3.4.x origin/release/3.4.x
cd .worktree/backport-12420-to-release/3.4.x
git switch --create backport-12420-to-release/3.4.x
git cherry-pick -x 2516c5035f8a2406a3add38370b520f54aac6a11 |
|
Backport failed for Please cherry-pick the changes locally and resolve any conflicts. git fetch origin release/3.5.x
git worktree add -d .worktree/backport-12420-to-release/3.5.x origin/release/3.5.x
cd .worktree/backport-12420-to-release/3.5.x
git switch --create backport-12420-to-release/3.5.x
git cherry-pick -x 2516c5035f8a2406a3add38370b520f54aac6a11 |
|
Successfully created backport PR for |
|
Git push to origin failed for release/3.6.x with exitcode 1 |
|
Backport failed for Please cherry-pick the changes locally and resolve any conflicts. git fetch origin release/3.4.x
git worktree add -d .worktree/backport-12420-to-release/3.4.x origin/release/3.4.x
cd .worktree/backport-12420-to-release/3.4.x
git switch --create backport-12420-to-release/3.4.x
git cherry-pick -x 2516c5035f8a2406a3add38370b520f54aac6a11 |
|
Backport failed for Please cherry-pick the changes locally and resolve any conflicts. git fetch origin release/3.5.x
git worktree add -d .worktree/backport-12420-to-release/3.5.x origin/release/3.5.x
cd .worktree/backport-12420-to-release/3.5.x
git switch --create backport-12420-to-release/3.5.x
git cherry-pick -x 2516c5035f8a2406a3add38370b520f54aac6a11 |
|
Git push to origin failed for release/3.6.x with exitcode 1 |
### Summary The #12420 by @Water-Melon forgot to add `grpc_ssl_conf_command`. This commit adds that. Signed-off-by: Aapo Talvensaari <[email protected]>
The #12420 by @Water-Melon forgot to add `grpc_ssl_conf_command`. This commit adds that. Signed-off-by: Aapo Talvensaari <[email protected]> (cherry picked from commit 84cb1be)
The #12420 by @Water-Melon forgot to add `grpc_ssl_conf_command`. This commit adds that. Signed-off-by: Aapo Talvensaari <[email protected]> (cherry picked from commit 84cb1be)
### Summary The #12420 by @Water-Melon forgot to add `grpc_ssl_conf_command`. This commit adds that. Signed-off-by: Aapo Talvensaari <[email protected]> (cherry picked from commit 84cb1be)
### Summary The #12420 by @Water-Melon forgot to add `grpc_ssl_conf_command`. This commit adds that. Signed-off-by: Aapo Talvensaari <[email protected]> (cherry picked from commit 84cb1be)
The #12420 by @Water-Melon forgot to add `grpc_ssl_conf_command`. This commit adds that. Signed-off-by: Aapo Talvensaari <[email protected]> (cherry picked from commit 84cb1be)
The #12420 by @Water-Melon forgot to add `grpc_ssl_conf_command`. This commit adds that. Signed-off-by: Aapo Talvensaari <[email protected]> (cherry picked from commit 84cb1be)
Summary
Issue reference
KAG-3259