consul

Tree: 7350bc7729

Author	SHA1	Message	Date
Hans Hasselberg	edcc64da74	tests: switch to WithinDuration to improve test (#6860 ) * Switch to WithinDuration to improve test This test was flaky before because of the time logic. Now it uses WithinDuration and should be correct. Fixes https://github.com/hashicorp/consul/issues/6857.	5 years ago
Hans Hasselberg	9ff69194a2	tls: auto_encrypt and verify_incoming (#6811 ) (#6899 ) * relax requirements for auto_encrypt on server * better error message when auto_encrypt and verify_incoming on * docs: explain verify_incoming on Consul clients.	5 years ago
Hans Hasselberg	a3f49109e6	tls: return auto_encrypt cert for listeners (#6489 ) * fix cert check * fix lock * add tests * test: add comments describing expected behavior for auto-encrypt and manual certificates * test: expect nil *tls.Certificate for empty string certFile or keyFile arg	5 years ago
R.B. Boyer	af01d397a5	connect: don't colon-hex-encode the AuthorityKeyId and SubjectKeyId fields in connect certs (#6492 ) The fields in the certs are meant to hold the original binary representation of this data, not some ascii-encoded version. The only time we should be colon-hex-encoding fields is for display purposes or marshaling through non-TLS mediums (like RPC).	5 years ago
Todd Radel	2552f4a11a	connect: Support RSA keys in addition to ECDSA (#6055 ) Support RSA keys in addition to ECDSA	5 years ago
Hans Hasselberg	33a7df3330	tls: auto_encrypt enables automatic RPC cert provisioning for consul clients (#5597 )	5 years ago
Hans Hasselberg	7e11dd82aa	agent: enable reloading of tls config (#5419 ) This PR introduces reloading tls configuration. Consul will now be able to reload the TLS configuration which previously required a restart. It is not yet possible to turn TLS ON or OFF with these changes. Only when TLS is already turned on, the configuration can be reloaded. Most importantly the certificates and CAs.	6 years ago
R.B. Boyer	f4a3b9d518	fix typos reported by golangci-lint:misspell (#5434 )	6 years ago
Hans Hasselberg	eb0895c5fb	tlsutil: don't use `server_name` config for RPC connections (#5394 ) * server name only for outgoing https for checks	6 years ago
Hans Hasselberg	80e7d63fc2	Centralise tls configuration part 2 (#5374 ) This PR is based on #5366 and continues to centralise the tls configuration in order to be reloadable eventually! This PR is another refactoring. No tests are changed, beyond calling other functions or cosmetic stuff. I added a bunch of tests, even though they might be redundant.	6 years ago
Hans Hasselberg	786b3b1095	Centralise tls configuration part 1 (#5366 ) In order to be able to reload the TLS configuration, we need one way to generate the different configurations. This PR introduces a `tlsutil.Configurator` which holds a `tlsutil.Config`. Afterwards it is responsible for rendering every `tls.Config`. In this particular PR I moved `IncomingHTTPSConfig`, `IncomingTLSConfig`, and `OutgoingTLSWrapper` into `tlsutil.Configurator`. This PR is a pure refactoring - not a single feature added. And not a single test added. I only slightly modified existing tests as necessary.	6 years ago
Hans Hasselberg	787f3f8aa6	agent: honor when ca is set but verify_outgoing is disabled (#4826 ) * honor when verify_outgoing is false but ca is set * Remove code that exists only for tests * fix formatting	6 years ago
Jack Pearkes	b64e8b262f	Documentation and changes for `verify_server_hostname` (#5069 ) * verify_server_hostname implies verify_outgoing * mention CVE in the docs.	6 years ago
Devin Canterberry	a61abcd931	🐛 Formatting changes only; add missing trailing commas	7 years ago
Devin Canterberry	c901307a47	🔒 Update supported TLS cipher suites The list of cipher suites included in this commit are consistent with the values and precedence in the [Golang TLS documentation](https://golang.org/src/crypto/tls/cipher_suites.go). > Note: Cipher suites with RC4 are still included within the list > of accepted values for compatibility, but these cipher suites are > not safe to use and should be deprecated with warnings and > subsequently removed. Support for RC4 ciphers has already been > removed or disabled by default in many prominent browsers and tools, > including Golang. > > References: > > * [RC4 on Wikipedia](https://en.wikipedia.org/wiki/RC4) > * [Mozilla Security Blog](https://blog.mozilla.org/security/2015/09/11/deprecating-the-rc4-cipher/)	7 years ago
James Phillips	8324c1b9a6	Removes stale TLS config clone() in favor of new supported method.	7 years ago
Kyle Havlovitz	5bab68b9bb	Add a path for transitioning to TLS on an existing cluster (#3001 ) Fixes #1705	8 years ago
Kyle Havlovitz	b70e419aeb	Add TLS cipher suite options and CA path support (#2963 ) This patch adds options to configure the available TLS cipher suites and adds support for a path for multiple CA certificates. Fixes #2959	8 years ago
Frank Schroeder	3e00e36f41	golint: Untangle if blocks with return in else	8 years ago
Kyle Havlovitz	07ba3ddb6e	Add TLSMinVersion to config options	8 years ago
James Phillips	6de74c60a4	Upgrades to Go 1.7 and fixes vet finding and TLS behavior change. (#2281 ) * Upgrades to Go 1.7 and fixes vet finding and TLS behavior change. * Fixes unit tests in a better manner by closing the client connection on errors. We traced through and realized that https://github.com/golang/go/issues/15709 causes the output from the client to get buffered, which cuts off the alert feedback due to the flush() call getting bypassed by the error return.	8 years ago
Armon Dadgar	53f2d8868c	tlsutil: Testing hostname verification	10 years ago
Armon Dadgar	7665b65834	tlsutil: Testing VerifyServerHostname on OutgoingConfig	10 years ago
Armon Dadgar	cfe788646d	tlsutil: Adding wrappers for hostname verification	10 years ago
Armon Dadgar	6b2390833d	tls: define wrapper type	10 years ago
Atin Malaviya	f1f8c88228	Moved TLS Config stuff to tlsutil package	10 years ago

1 2

79 Commits (7350bc7729686dc4b7c80e0a07807c244783ccc1)