github/distribution
1
0
Fork 0
mirror of https://github.com/distribution/distribution.git synced 2025-09-09 02:40:00 +00:00
Code Issues Projects Releases Wiki Activity

disable insecure cipher suites

Browse Source 
This commit removes the following cipher suites that are known to be insecure:

TLS_RSA_WITH_RC4_128_SHA
TLS_RSA_WITH_AES_128_CBC_SHA256
TLS_ECDHE_ECDSA_WITH_RC4_128_SHA
TLS_ECDHE_RSA_WITH_RC4_128_SHA
TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256
TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256

And this commit deletes the tlsVersions of tls1.0 and tls1.1. The tls1.2 is the minimal supported tls version for creating a safer tls configuration.

Signed-off-by: david.bao <baojn1998@163.com>
This commit is contained in:
baojiangnan
2022-01-24 20:02:57 +08:00
committed by david.bao
parent 5f1974ab8b
commit 4363fb1ef4
4 changed files with 32 additions and 15 deletions
Download Patch File Download Diff File Expand all files Collapse all files

21
registry/registry_test.go
View File

@@ -135,7 +135,10 @@ func TestGetCipherSuite(t *testing.T) {
)
}
resp, err = getCipherSuites([]string{"TLS_RSA_WITH_AES_128_CBC_SHA", "TLS_AES_128_GCM_SHA256"})
resp, err = getCipherSuites([]string{
"TLS_RSA_WITH_AES_128_CBC_SHA",
"TLS_AES_128_GCM_SHA256",
})
if err != nil || len(resp) != 2 ||
resp[0] != tls.TLS_RSA_WITH_AES_128_CBC_SHA || resp[1] != tls.TLS_AES_128_GCM_SHA256 {
t.Errorf("expected cipher suites %q, got %q",
@@ -148,6 +151,22 @@ func TestGetCipherSuite(t *testing.T) {
if err == nil {
t.Error("did not return expected error about unknown cipher suite")
}
var insecureCipherSuites = []string{
"TLS_RSA_WITH_RC4_128_SHA",
"TLS_RSA_WITH_AES_128_CBC_SHA256",
"TLS_ECDHE_ECDSA_WITH_RC4_128_SHA",
"TLS_ECDHE_RSA_WITH_RC4_128_SHA",
"TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256",
"TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256",
}
for _, suite := range insecureCipherSuites {
_, err = getCipherSuites([]string{suite})
if err == nil {
t.Errorf("Unexpected insecure cipher suite: %s", suite)
}
}
}
func buildRegistryTLSConfig(name, keyType string, cipherSuites []string) (*registryTLSConfig, error) {