Introducing configurable setting for tls 1.3. as min version

Author: pebanb

internal/cmd/run.go

@@ -29,6 +29,7 @@ func newRunCommand() *runCommand {
 	runCommand.cmd.Flags().IntVar(&globalConfig.HttpsPort, "https-port", getEnvInt("HTTPS_PORT", server.DefaultHttpsPort), "Port to serve HTTPS traffic on")
 	runCommand.cmd.Flags().IntVar(&globalConfig.MetricsPort, "metrics-port", getEnvInt("METRICS_PORT", 0), "Publish metrics on the specified port (default zero to disable)")
 	runCommand.cmd.Flags().BoolVar(&globalConfig.HTTP3Enabled, "http3", false, "Enable HTTP/3")
+	runCommand.cmd.Flags().BoolVar(&globalConfig.MinTLS13, "min-tls13", getEnvBool("MIN_TLS13", false), "Set TLS 1.3 as the minimum TLS version on the HTTPS server")
 
 	return runCommand
 }

internal/server/config.go

@@ -18,6 +18,7 @@ type Config struct {
 	HttpsPort    int
 	MetricsPort  int
 	HTTP3Enabled bool
+	MinTLS13     bool
 
 	AlternateConfigDir string
 }

internal/server/server.go

@@ -150,6 +150,14 @@ func (s *Server) startHTTPServers() error {
 		return err
 	}
 	s.httpsListener = httpsListener
+	tlsConfig := &tls.Config{
+		NextProtos:     []string{"h2", "http/1.1", acme.ALPNProto},
+		GetCertificate: s.router.GetCertificate,
+	}
+	if s.config.MinTLS13 {
+		tlsConfig.MinVersion = tls.VersionTLS13
+	}
+
 	s.httpsServer = &http.Server{
 		Handler: http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
 			if s.config.HTTP3Enabled {
@@ -158,10 +166,7 @@ func (s *Server) startHTTPServers() error {
 
 			handler.ServeHTTP(w, r)
 		}),
-		TLSConfig: &tls.Config{
-			NextProtos:     []string{"h2", "http/1.1", acme.ALPNProto},
-			GetCertificate: s.router.GetCertificate,
-		},
+		TLSConfig: tlsConfig,
 	}
 
 	go s.httpServer.Serve(s.httpListener)

internal/server/server_test.go

@@ -14,7 +14,7 @@ import (
 
 func TestServer_Deploying(t *testing.T) {
 	target := testTarget(t, func(w http.ResponseWriter, r *http.Request) {})
-	server := testServer(t, true)
+	server := testServer(t, false, false)
 
 	testDeployTarget(t, target, server, defaultServiceOptions)
 
@@ -24,9 +24,9 @@ func TestServer_Deploying(t *testing.T) {
 }
 
 func TestServer_DeployingHTTPS(t *testing.T) {
-	startDeployment := func(http3Enabled bool) *Server {
+	startDeployment := func(http3Enabled bool, minTLS13 bool) *Server {
 		target := testTarget(t, func(w http.ResponseWriter, r *http.Request) {})
-		server := testServer(t, http3Enabled)
+		server := testServer(t, http3Enabled, minTLS13)
 
 		certPath, keyPath := prepareTestCertificateFiles(t)
 		serviceOptions := defaultServiceOptions
@@ -40,7 +40,7 @@ func TestServer_DeployingHTTPS(t *testing.T) {
 	}
 
 	t.Run("with HTTP/3 enabled", func(t *testing.T) {
-		server := startDeployment(true)
+		server := startDeployment(true, false)
 
 		t.Run("http/1.1", func(t *testing.T) {
 			resp, err := testRequestUsingHTTP11(t, server)
@@ -72,8 +72,20 @@ func TestServer_DeployingHTTPS(t *testing.T) {
 		})
 	})
 
+	t.Run("with min TLS 1.3", func(t *testing.T) {
+		server := startDeployment(false, true)
+
+		t.Run("http/1.1", func(t *testing.T) {
+			resp, err := testRequestUsingHTTP11(t, server)
+			require.NoError(t, err)
+			assert.Equal(t, http.StatusOK, resp.StatusCode)
+			assert.Equal(t, "HTTP/1.1", resp.Proto)
+			assert.Equal(t, uint16(tls.VersionTLS13), resp.TLS.Version)
+		})
+	})
+
 	t.Run("with HTTP/3 disabled", func(t *testing.T) {
-		server := startDeployment(false)
+		server := startDeployment(false, false)
 
 		t.Run("http/1.1", func(t *testing.T) {
 			resp, err := testRequestUsingHTTP11(t, server)

internal/server/testing.go

@@ -11,11 +11,11 @@ import (
 )
 
 var (
-	defaultHealthCheckConfig  = HealthCheckConfig{Path: DefaultHealthCheckPath, Port: DefaultHealthCheckPort, Interval: DefaultHealthCheckInterval, Timeout: time.Second * 5}
-	defaultEmptyReaders       = []string{}
-	defaultServiceOptions     = ServiceOptions{TLSRedirect: true}
-	defaultTargetOptions      = TargetOptions{HealthCheckConfig: defaultHealthCheckConfig, ResponseTimeout: DefaultTargetTimeout}
-	defaultDeploymentOptions  = DeploymentOptions{DeployTimeout: DefaultDeployTimeout, DrainTimeout: DefaultDrainTimeout, Force: false}
+	defaultHealthCheckConfig = HealthCheckConfig{Path: DefaultHealthCheckPath, Port: DefaultHealthCheckPort, Interval: DefaultHealthCheckInterval, Timeout: time.Second * 5}
+	defaultEmptyReaders      = []string{}
+	defaultServiceOptions    = ServiceOptions{TLSRedirect: true}
+	defaultTargetOptions     = TargetOptions{HealthCheckConfig: defaultHealthCheckConfig, ResponseTimeout: DefaultTargetTimeout}
+	defaultDeploymentOptions = DeploymentOptions{DeployTimeout: DefaultDeployTimeout, DrainTimeout: DefaultDrainTimeout, Force: false}
 )
 
 func testTarget(t testing.TB, handler http.HandlerFunc) *Target {
@@ -69,7 +69,7 @@ func testBackendWithHandler(t testing.TB, handler http.HandlerFunc) (*httptest.S
 	return server, serverURL.Host
 }
 
-func testServer(t testing.TB, http3Enabled bool) *Server {
+func testServer(t testing.TB, http3Enabled bool, minTLS13 bool) *Server {
 	t.Helper()
 
 	config := &Config{
@@ -78,6 +78,7 @@ func testServer(t testing.TB, http3Enabled bool) *Server {
 		HttpsPort:          0,
 		AlternateConfigDir: t.TempDir(),
 		HTTP3Enabled:       http3Enabled,
+		MinTLS13:           minTLS13,
 	}
 	router := NewRouter(config.StatePath())
 	server := NewServer(config, router)