Mirrors/coredns
1
0
Fork 0
mirror of https://github.com/coredns/coredns.git synced 2026-07-17 05:00:12 -04:00
Code Issues Packages Projects Releases Wiki Activity

fix(tls): use Go TLS defaults (#8227)

Browse Source 
Remove fixed TLS 1.2 cipher suite list and maximum TLS version so
crypto/tls can use its maintained defaults. Keep TLS 1.2 as the
minimum supported version.

Document the shared TLS default behavior for plugins that expose TLS
configuration and add coverage to ensure CoreDNS leaves Go-managed
TLS fields unset.

Signed-off-by: Ville Vesilehto <ville@vesilehto.fi>
This commit is contained in:
Ville Vesilehto
2026-07-05 02:03:02 +03:00
committed by GitHub
parent 679f764ae1
commit bc4343b083
6 changed files with 44 additions and 16 deletions
Download Patch File Download Diff File Expand all files Collapse all files

32
plugin/pkg/tls/tls_test.go
View File

@@ -1,6 +1,7 @@
package tls
import (
"crypto/tls"
"path/filepath"
"testing"
@@ -21,35 +22,55 @@ func getPEMFiles(t *testing.T) (cert, key, ca string) {
return
}
func assertTLSDefaults(t *testing.T, c *tls.Config) {
t.Helper()
if c.MinVersion != tls.VersionTLS12 {
t.Errorf("MinVersion = %d, want %d", c.MinVersion, tls.VersionTLS12)
}
if c.MaxVersion != 0 {
t.Errorf("MaxVersion = %d, want 0 to use Go defaults", c.MaxVersion)
}
if c.CipherSuites != nil {
t.Errorf("CipherSuites = %v, want nil to use Go defaults", c.CipherSuites)
}
if c.CurvePreferences != nil {
t.Errorf("CurvePreferences = %v, want nil to use Go defaults", c.CurvePreferences)
}
}
func TestNewTLSConfig(t *testing.T) {
cert, key, ca := getPEMFiles(t)
_, err := NewTLSConfig(cert, key, ca)
c, err := NewTLSConfig(cert, key, ca)
if err != nil {
t.Errorf("Failed to create TLSConfig: %s", err)
}
assertTLSDefaults(t, c)
}
func TestNewTLSClientConfig(t *testing.T) {
_, _, ca := getPEMFiles(t)
_, err := NewTLSClientConfig(ca)
c, err := NewTLSClientConfig(ca)
if err != nil {
t.Errorf("Failed to create TLSConfig: %s", err)
}
assertTLSDefaults(t, c)
}
func TestNewTLSConfigFromArgs(t *testing.T) {
cert, key, ca := getPEMFiles(t)
_, err := NewTLSConfigFromArgs()
c, err := NewTLSConfigFromArgs()
if err != nil {
t.Errorf("Failed to create TLSConfig: %s", err)
}
assertTLSDefaults(t, c)
c, err := NewTLSConfigFromArgs(ca)
c, err = NewTLSConfigFromArgs(ca)
if err != nil {
t.Errorf("Failed to create TLSConfig: %s", err)
}
assertTLSDefaults(t, c)
if c.RootCAs == nil {
t.Error("RootCAs should not be nil when one arg passed")
}
@@ -58,6 +79,7 @@ func TestNewTLSConfigFromArgs(t *testing.T) {
if err != nil {
t.Errorf("Failed to create TLSConfig: %s", err)
}
assertTLSDefaults(t, c)
if c.RootCAs != nil {
t.Error("RootCAs should be nil when two args passed")
}
@@ -69,6 +91,7 @@ func TestNewTLSConfigFromArgs(t *testing.T) {
if err != nil {
t.Errorf("Failed to create TLSConfig: %s", err)
}
assertTLSDefaults(t, c)
if c.RootCAs == nil {
t.Error("RootCAs should not be nil when three args passed")
}
@@ -92,6 +115,7 @@ func TestNewTLSConfigFromArgsWithRoot(t *testing.T) {
if err != nil {
t.Errorf("Failed to create TLSConfig: %s", err)
}
assertTLSDefaults(t, c)
if c.RootCAs == nil {
t.Error("RootCAs should not be nil when three args passed")
}