consul

Branch: NET-10248-consul-cross-namespace-requests-to-a-terminating-gateway-fail-with-no-healthy-upstream

Author	SHA1	Message	Date
Hans Hasselberg	786b3b1095	Centralise tls configuration part 1 (#5366 ) In order to be able to reload the TLS configuration, we need one way to generate the different configurations. This PR introduces a `tlsutil.Configurator` which holds a `tlsutil.Config`. Afterwards it is responsible for rendering every `tls.Config`. In this particular PR I moved `IncomingHTTPSConfig`, `IncomingTLSConfig`, and `OutgoingTLSWrapper` into `tlsutil.Configurator`. This PR is a pure refactoring - not a single feature added. And not a single test added. I only slightly modified existing tests as necessary.	6 years ago
Hans Hasselberg	787f3f8aa6	agent: honor when ca is set but verify_outgoing is disabled (#4826 ) * honor when verify_outgoing is false but ca is set * Remove code that exists only for tests * fix formatting	6 years ago
Jack Pearkes	b64e8b262f	Documentation and changes for `verify_server_hostname` (#5069 ) * verify_server_hostname implies verify_outgoing * mention CVE in the docs.	6 years ago
Devin Canterberry	a61abcd931	🐛 Formatting changes only; add missing trailing commas	7 years ago
Devin Canterberry	c901307a47	🔒 Update supported TLS cipher suites The list of cipher suites included in this commit are consistent with the values and precedence in the [Golang TLS documentation](https://golang.org/src/crypto/tls/cipher_suites.go). > Note: Cipher suites with RC4 are still included within the list > of accepted values for compatibility, but these cipher suites are > not safe to use and should be deprecated with warnings and > subsequently removed. Support for RC4 ciphers has already been > removed or disabled by default in many prominent browsers and tools, > including Golang. > > References: > > * [RC4 on Wikipedia](https://en.wikipedia.org/wiki/RC4) > * [Mozilla Security Blog](https://blog.mozilla.org/security/2015/09/11/deprecating-the-rc4-cipher/)	7 years ago
Kyle Havlovitz	b70e419aeb	Add TLS cipher suite options and CA path support (#2963 ) This patch adds options to configure the available TLS cipher suites and adds support for a path for multiple CA certificates. Fixes #2959	8 years ago
Kyle Havlovitz	07ba3ddb6e	Add TLSMinVersion to config options	8 years ago
James Phillips	6de74c60a4	Upgrades to Go 1.7 and fixes vet finding and TLS behavior change. (#2281 ) * Upgrades to Go 1.7 and fixes vet finding and TLS behavior change. * Fixes unit tests in a better manner by closing the client connection on errors. We traced through and realized that https://github.com/golang/go/issues/15709 causes the output from the client to get buffered, which cuts off the alert feedback due to the flush() call getting bypassed by the error return.	8 years ago
Armon Dadgar	53f2d8868c	tlsutil: Testing hostname verification	10 years ago
Armon Dadgar	7665b65834	tlsutil: Testing VerifyServerHostname on OutgoingConfig	10 years ago
Atin Malaviya	f1f8c88228	Moved TLS Config stuff to tlsutil package	10 years ago
Nelson Elhage	12a7f765b6	Add some basic smoke tests for wrapTLSclient. Check the success case, and check that we reject a self-signed certificate.	11 years ago
Nelson Elhage	d174cbe7f4	Restore the 0.2 TLS verification behavior. Namely, don't check the DNS names in TLS certificates when connecting to other servers. As of golang 1.3, crypto/tls no longer natively supports doing partial verification (verifying the cert issuer but not the hostname), so we have to disable verification entirely and then do the issuer verification ourselves. Fortunately, crypto/x509 makes this relatively straightforward. If the "server_name" configuration option is passed, we preserve the existing behavior of checking that server name everywhere. No option is provided to retain the current behavior of checking the remote certificate against the local node name, since that behavior seems clearly buggy and unintentional, and I have difficulty imagining it is actually being used anywhere. It would be relatively straightforward to restore if desired, however.	11 years ago
Nelson Elhage	fe4ec67488	Allow multiple PEM-encoded certificates in the ca_file. fixes #167	11 years ago
Armon Dadgar	2c212516ee	consul: Adding configuration tests	11 years ago

1 2

61 Commits (NET-10248-consul-cross-namespace-requests-to-a-terminating-gateway-fail-with-no-healthy-upstream)