Birthday attack follow: Update additional server configs with tls config containing restricted set of cipher suites

[benjaminapetersen]

Follow-on to #3389

Full list of related PRs

Will need a cherry-pick including both commits for backport.

TODO:

• update test-ciphers.sh to validate that this does fix the problem.

[benjaminapetersen]

/assign @spadgett

[benjaminapetersen]

These are correctly denied.

[benjaminapetersen]

However, these are also denied :)
Working on figuring out what is up with this.

[benjaminapetersen]

@spadgett curious if you have a thought.

[benjaminapetersen]

Didn't really want to create my own test image, but couldn't find the correct mix of tools otherwise.

[benjaminapetersen]

 docker build -f Dockerfile.ciphertest  -t quay.io/benjaminapetersen/console-ciphertest:latest .

and exists here https://quay.io/repository/benjaminapetersen/console-ciphertest

[spadgett]

I'm not sure we want to host this on your personal quay account. We could potentially use OpenShift builds to build the image.

[benjaminapetersen]

+1

[benjaminapetersen]

Final output for this test looks like:

invalid cipher was correctly denied (DES-CBC3-SHA)
invalid cipher was correctly denied (RSA-AES-128-CBC-SHA256)
invalid cipher was correctly denied (ECDHE-RSA-3DES-EDE-CBC-SHA)
invalid cipher was correctly denied (RSA-3DES-EDE-CBC-SHA)
valid cipher was correctly accepted (ECDHE-RSA-AES128-GCM-SHA256)
valid cipher was correctly accepted (ECDHE-RSA-AES256-GCM-SHA384)
valid cipher was correctly accepted (ECDHE-ECDSA-CHACHA20-POLY1305)
valid cipher was correctly accepted (ECDHE-RSA-CHACHA20-POLY1305)
success
server ciphers correctly handled

[benjaminapetersen]

Shouldn't need the RootCAs: x509.NewCertPool(), here, removing.

[spadgett]

@benjaminapetersen I'd suggest we work on the test as a follow on so we don't hold up the basic fix, which is simple. Changes to main.go LGTM.

[spadgett]

I'm not sure we want to host this on your personal quay account. We could potentially use OpenShift builds to build the image.

[benjaminapetersen]

@spadgett agree about hosting (I don't want it on my personal quay either), not sure how much work it is to setup OpenShift builds.

[benjaminapetersen]

Can't use

set -o errexit

As some of the test requires an error. I'm not sure if there is a better approach.

[benjaminapetersen]

Updated, eliminated the cipher tests as we've decided it's not really worth the effort.

[openshift-ci-robot]

@benjaminapetersen: The following test failed, say /retest to rerun all failed tests:

Test name	Commit	Details	Rerun command
ci/prow/verify	86f8df16ba1011afdf847def23670c95977a7430	link	/test verify

Full PR test history. Your PR dashboard. Please help us cut down on flakes by linking to an open issue when you hit one in your PR.

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository. I understand the commands that are listed here.

[spadgett]

/approve
/lgtm

[openshift-ci-robot]

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: benjaminapetersen, spadgett

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Details

Needs approval from an approver in each of these files:

• OWNERS [benjaminapetersen,spadgett]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[spadgett]

/hold
for #5100

[spadgett]

/hold cancel
/retest