From d3f3e6c969dca256f736f3eb3725af22efc823de Mon Sep 17 00:00:00 2001 From: Victor Garcia Date: Tue, 24 May 2016 16:18:28 +0200 Subject: [PATCH] Setting TLS1.2 minimum because TLS1.0 and TLS1.1 are vulnerable Adding comments to explain what is wrong with each version --- cmd/kubelet/app/server.go | 6 ++++-- pkg/client/transport/transport.go | 6 ++++-- pkg/genericapiserver/genericapiserver.go | 6 ++++-- 3 files changed, 12 insertions(+), 6 deletions(-) diff --git a/cmd/kubelet/app/server.go b/cmd/kubelet/app/server.go index 6e852cd5aed..a5ed0e8fdcc 100644 --- a/cmd/kubelet/app/server.go +++ b/cmd/kubelet/app/server.go @@ -413,8 +413,10 @@ func InitializeTLS(s *options.KubeletServer) (*server.TLSOptions, error) { } tlsOptions := &server.TLSOptions{ Config: &tls.Config{ - // Change default from SSLv3 to TLSv1.0 (because of POODLE vulnerability). - MinVersion: tls.VersionTLS10, + // Can't use SSLv3 because of POODLE and BEAST + // Can't use TLSv1.0 because of POODLE and BEAST using CBC cipher + // Can't use TLSv1.1 because of RC4 cipher usage + MinVersion: tls.VersionTLS12, // Populate PeerCertificates in requests, but don't yet reject connections without certificates. ClientAuth: tls.RequestClientCert, }, diff --git a/pkg/client/transport/transport.go b/pkg/client/transport/transport.go index 94d9c0fbed0..6b41c52e571 100644 --- a/pkg/client/transport/transport.go +++ b/pkg/client/transport/transport.go @@ -63,8 +63,10 @@ func TLSConfigFor(c *Config) (*tls.Config, error) { } tlsConfig := &tls.Config{ - // Change default from SSLv3 to TLSv1.0 (because of POODLE vulnerability) - MinVersion: tls.VersionTLS10, + // Can't use SSLv4 because of POODLE and BEAST + // Can't use TLSv1.0 because of POODLE and BEAST using CBC cipher + // Can't use TLSv1.1 because of RC4 cipher usage + MinVersion: tls.VersionTLS12, InsecureSkipVerify: c.TLS.Insecure, } diff --git a/pkg/genericapiserver/genericapiserver.go b/pkg/genericapiserver/genericapiserver.go index 2930ac5c208..29d37bf2e07 100644 --- a/pkg/genericapiserver/genericapiserver.go +++ b/pkg/genericapiserver/genericapiserver.go @@ -666,8 +666,10 @@ func (s *GenericAPIServer) Run(options *options.ServerRunOptions) { Handler: apiserver.MaxInFlightLimit(sem, longRunningRequestCheck, apiserver.RecoverPanics(handler)), MaxHeaderBytes: 1 << 20, TLSConfig: &tls.Config{ - // Change default from SSLv3 to TLSv1.0 (because of POODLE vulnerability) - MinVersion: tls.VersionTLS10, + // Can't use SSLv3 because of POODLE and BEAST + // Can't use TLSv1.0 because of POODLE and BEAST using CBC cipher + // Can't use TLSv1.1 because of RC4 cipher usage + MinVersion: tls.VersionTLS12, }, }