Decide on go-connections/tlsconfig version / alternatives

[mtrmac]

c/image currently vendors github.com/docker/go-connections 7beb39f0b969; meanwhile podman is 4 commits ahead at v0.4.0, but that’s a pretty significant behavior difference that some users are actually hitting.

Do we want to update c/image (and other users) to v0.4.0 as well?
Or revert podman back, for more compatibility and less security?
Or update much more, to keep up with upstream?
Or do something else entirely?

[ewolinetz]

Currently I'm trying to use a squid proxy with aes256 keys for a CI proxy test for OCP.
There is a bootstrap node that uses podman to pull down an image from the ci registry and fails to do so when using the tls end point for the proxy. If its configured to use a non-tls end point I don't see any issues where the handshake fails.

The intermediate CA has been added to the trusts for the node because curl to the registry end point works just fine, as does a skopeo test (both using the tls end point). Only podman fails.

[mtrmac]

@baude FYI (Not sure who to point this at):

podman may refuse to connect to some servers that skopeo works with. (podman may well be doing the more right thing.)

[wking]

It seems like security vs. broad-compat would be something a sysadmin would want knobs for. That doesn't get us off the hook for picking reasonable defaults, but providing a way to configure these would give us a safety valve for folks who wanted to diverge from the defaults.

[mtrmac]

Well, there is https://docs.fedoraproject.org/en-US/packaging-guidelines/CryptoPolicies/ ; if we are going to introduce knobs, that would be the knob to introduce.

But we need to figure out the right default first; if we add knobs, it will never be important enough to have the right default, but the default matters for most users.

[ewolinetz]

Another issue that we noticed playing around with this is the TLS version that the proxy supports. When tested with squid 3.5 it would only use up to 1.2 but when i bumped up the squid proxy to be squid 4.x it would handshake with 1.3

[therevoman]

Following this thread. I'm working with some financial institutions, which are notorious for wanting both bleeding edge security and EOL security.

[mtrmac]

Hum, we have updated go-connections in #874 . But the research / decisions are still basically outstanding, primarily to consider whether similar code in docker/docker_client.go needs updating.

[mtrmac]

Let’s consolidate this with containers/container-libs#277.