public/grafana
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

HTTP: Add TLS version configurability for Grafana server (#67482)

Browse Source 
Co-authored-by: Rao B V Chalapathi <b_v_chalapathi.rao@nokia.com>
Co-authored-by: Christopher Moyer <35463610+chri2547@users.noreply.github.com>
This commit is contained in:
venkatbvc
2023-05-08 17:11:36 +02:00
committed by GitHub
co-authored by Rao B V Chalapathi Christopher Moyer
parent 5155455c55
commit b9e53f628f
9 changed files with 193 additions and 81 deletions
Download Patch File Download Diff File Expand all files Collapse all files
pkg/services/ldap/settings.go
+3 -54
View File
@@ -1,10 +1,8 @@
package ldap
import (
"crypto/tls"
"fmt"
"os"
"strings"
"sync"
"github.com/BurntSushi/toml"
@@ -12,6 +10,7 @@ import (
"github.com/grafana/grafana/pkg/infra/log"
"github.com/grafana/grafana/pkg/services/org"
"github.com/grafana/grafana/pkg/setting"
"github.com/grafana/grafana/pkg/util"
)
const defaultTimeout = 10
@@ -144,14 +143,14 @@ func readConfig(configFile string) (*Config, error) {
}
if server.MinTLSVersion != "" {
server.minTLSVersion, err = tlsNameToVersion(server.MinTLSVersion)
server.minTLSVersion, err = util.TlsNameToVersion(server.MinTLSVersion)
if err != nil {
logger.Error("Failed to set min TLS version. Ignoring", "err", err)
}
}
if len(server.TLSCiphers) > 0 {
server.tlsCiphers, err = tlsCiphersToIDs(server.TLSCiphers)
server.tlsCiphers, err = util.TlsCiphersToIDs(server.TLSCiphers)
if err != nil {
logger.Error("Unrecognized TLS Cipher(s). Ignoring", "err", err)
}
@@ -191,53 +190,3 @@ func assertNotEmptyCfg(val interface{}, propName string) error {
}
return nil
}
// tlsNameToVersion converts a string to a tls version
func tlsNameToVersion(name string) (uint16, error) {
name = strings.ToUpper(name)
switch name {
case "TLS1.0":
return tls.VersionTLS10, nil
case "TLS1.1":
return tls.VersionTLS11, nil
case "TLS1.2":
return tls.VersionTLS12, nil
case "TLS1.3":
return tls.VersionTLS13, nil
}
return 0, fmt.Errorf("unknown tls version: %q", name)
}
// Cipher strings https://go.dev/src/crypto/tls/cipher_suites.go
// Ex: "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256" or "TLS_RSA_WITH_AES_128_CBC_SHA"
func tlsCiphersToIDs(names []string) ([]uint16, error) {
if len(names) == 0 || names == nil {
// no ciphers specified, use defaults
return nil, nil
}
var ids []uint16
var missing []string
ciphers := tls.CipherSuites()
var cipherMap = make(map[string]uint16, len(ciphers))
for _, cipher := range ciphers {
cipherMap[cipher.Name] = cipher.ID
}
for _, name := range names {
name = strings.ToUpper(name)
id, ok := cipherMap[name]
if !ok {
missing = append(missing, name)
continue
}
ids = append(ids, id)
}
if len(missing) > 0 {
return ids, fmt.Errorf("unknown ciphers: %v", missing)
}
return ids, nil
}