Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Automatically set tls_maximum_protocol_version to opt in to TLS 1.3 #672

Closed
cromefire opened this issue Sep 11, 2018 · 11 comments
Closed

Automatically set tls_maximum_protocol_version to opt in to TLS 1.3 #672

cromefire opened this issue Sep 11, 2018 · 11 comments
Labels
good first issue Denotes an issue ready for a new contributor, according to the "help wanted" guidelines. help wanted Denotes an issue that needs help from a contributor. Must meet "help wanted" guidelines. kind/feature Categorizes issue or PR as related to a new feature. priority/important-longterm Important over the long term, but may not be staffed and/or may need multiple releases to complete.
Milestone
0.7.0

Comments

@cromefire
Copy link
Contributor

Please add support for the tls_maximum_protocol_version envoy api parameter (like you do for tls_minimum_protocol_version) to allow users to opt in to TLS 1.3. See envoyproxy/envoy#3544.
@davecheney davecheney added help wanted Denotes an issue that needs help from a contributor. Must meet "help wanted" guidelines. good first issue Denotes an issue ready for a new contributor, according to the "help wanted" guidelines. priority/important-longterm Important over the long term, but may not be staffed and/or may need multiple releases to complete. labels Sep 12, 2018
@davecheney davecheney added this to the 0.7.0 milestone Sep 12, 2018
@davecheney davecheney changed the title Add support for tls_maximum_protocol_version for TLS 1.3 opt in Automatically set tls_maximum_protocol_version to opt in to TLS 1.3 Sep 12, 2018
@davecheney
Copy link
Contributor

Thank you for raising this issue. I'll schedule this for 0.7; we'll need to upgrade our envoy dependency to 1.7.x first.

For anyone looking to address this issue, the tls_maximum_protocol_version configuration field should be set unconditionally. Please do not make this configurable.

@davecheney davecheney added the kind/feature Categorizes issue or PR as related to a new feature. label Sep 12, 2018
@cromefire
Copy link
Contributor Author

How should that condition look like? Just annotation to enable TLS 1.3? I might try doing that myself, once envoy is updated.

@davecheney
Copy link
Contributor

Just annotation to enable TLS 1.3?

Yup, look at the function tlscontext in internal/contour/listerner.go there is already a TlsMinimumProtocolVersion field set. Hard code the maximum version to 1.3 to enable tls 1.3 unconditionally.

@cromefire
Copy link
Contributor Author

cromefire commented Sep 12, 2018 •
edited
Loading

Hard code the maximum version to 1.3 to enable tls 1.3 unconditionally.

So that TLS 1.3 is just always on?

@davecheney
Copy link
Contributor

So that TLS 1.3 is just always on?

Yes, we'll unconditionally raise the maximum supported TLS version from 1.2 to 1.3.

@cromefire
Copy link
Contributor Author

Okay just tell me when you are done with 1.7.x and I will start try around with go

@davecheney
Copy link
Contributor

Blocked on #650 / #443

@davecheney
Copy link
Contributor

@cromefire the blocking issues have been resolved. You're welcome to work on this for 0.7 which will go into free in the last week of October.

@cromefire
Copy link
Contributor Author

Allright, it would be nice if you could assign, so so I don't loose track of it

@davecheney
Copy link
Contributor

davecheney commented Oct 8, 2018 via email

This was referenced Oct 8, 2018
Closed
Closed
Merged
@cromefire
Copy link
Contributor Author

I gave up due to problems with the sign off constraint and go (and godep) being bad at being user friendly.

So if some one else want's to look at it, the solutions are the but I'm unable to commit them without trying again and again.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees
No one assigned
Labels
good first issue Denotes an issue ready for a new contributor, according to the "help wanted" guidelines. help wanted Denotes an issue that needs help from a contributor. Must meet "help wanted" guidelines. kind/feature Categorizes issue or PR as related to a new feature. priority/important-longterm Important over the long term, but may not be staffed and/or may need multiple releases to complete.
Projects
None yet
Milestone
0.7.0
Development

No branches or pull requests
2 participants
@davecheney @cromefire