Skip to content

Commit d3e0d27

Browse files
tmshortclaude
tmshort
and
claude
committed
Replace generated mozilla_data.go with go:embed + runtime parsing
Embed mozilla_data.json and parse it at init() time using the existing cipherSuiteId()/curveId() helpers. Unsupported ciphers are skipped and recorded in skippedCiphers, validated by TestNoSkippedCiphers. Simplify update-tls-profiles.sh to a curl download and drop the gojq dependency. When the profile changes, `make verify` will show a diff of the profile. The build will still complete using the old data. The updated profile will need to be commited in order for it to be included in the build. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com> Signed-off-by: Todd Short <tshort@redhat.com>
1 parent 8614e3b commit d3e0d27

File tree

5 files changed

+171
-168
lines changed

5 files changed

+171
-168
lines changed

‎Makefile‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -221,8 +221,8 @@ fmt: $(YAMLFMT) #EXHELP Formats code
221221
$(YAMLFMT) -gitignore_excludes testdata
222222

223223
.PHONY: update-tls-profiles
224-
update-tls-profiles: $(GOJQ) #EXHELP Update TLS profiles from the Mozilla wiki
225-
env JQ=$(GOJQ) hack/tools/update-tls-profiles.sh
224+
update-tls-profiles: #EXHELP Update TLS profiles from the Mozilla wiki
225+
hack/tools/update-tls-profiles.sh
226226

227227
.PHONY: update-registryv1-bundle-schema
228228
update-registryv1-bundle-schema: #EXHELP Update registry+v1 bundle configuration JSON schema

‎hack/tools/update-tls-profiles.sh‎

Lines changed: 2 additions & 123 deletions
Original file line numberDiff line numberDiff line change
@@ -2,131 +2,10 @@
22

33
set -e
44

5-
if [ -z "${JQ}" ]; then
6-
echo "JQ not defined"
7-
exit 1
8-
fi
9-
10-
OUTPUT=internal/shared/util/tlsprofiles/mozilla_data.go
5+
OUTPUT=internal/shared/util/tlsprofiles/mozilla_data.json
116
INPUT=https://ssl-config.mozilla.org/guidelines/latest.json
127

13-
TMPFILE="$(mktemp)"
14-
trap 'rm -rf "$TMPFILE"' EXIT
15-
16-
if ! curl -L -s -f "${INPUT}" > "${TMPFILE}"; then
8+
if ! curl -L -s -f "${INPUT}" -o "${OUTPUT}"; then
179
echo "ERROR: Failed to download ${INPUT} (HTTP error or connection failure)" >&2
1810
exit 1
1911
fi
20-
21-
if ! ${JQ} empty "${TMPFILE}" 2>/dev/null; then
22-
echo "ERROR: Downloaded data from ${INPUT} is not valid JSON" >&2
23-
exit 1
24-
fi
25-
26-
# Extract stored version from current output file (may be empty on first run)
27-
STORED_VERSION=$(grep '^// DATA VERSION:' "${OUTPUT}" 2>/dev/null | awk '{print $4}' || true)
28-
29-
# Extract version from downloaded JSON and fail early if missing
30-
NEW_VERSION=$(${JQ} -r '.version' "${TMPFILE}")
31-
if [ -z "${NEW_VERSION}" ] || [ "${NEW_VERSION}" = "null" ]; then
32-
echo "ERROR: Could not read .version from ${INPUT}" >&2
33-
exit 1
34-
fi
35-
36-
if [ "${NEW_VERSION}" = "${STORED_VERSION}" ]; then
37-
echo "Mozilla TLS data is already at version ${NEW_VERSION}, skipping regeneration."
38-
exit 0
39-
fi
40-
echo "Updating Mozilla TLS data from version ${STORED_VERSION:-unknown} to ${NEW_VERSION}"
41-
42-
cat > "${OUTPUT}" <<EOF
43-
package tlsprofiles
44-
45-
// DO NOT EDIT, GENERATED BY ${0}
46-
// DATA SOURCE: ${INPUT}
47-
// DATA VERSION: ${NEW_VERSION}
48-
49-
import (
50-
"crypto/tls"
51-
)
52-
EOF
53-
54-
function generate_profile {
55-
local profile="${1}"
56-
57-
# Validate the profile key exists before writing any output
58-
local exists
59-
exists=$(${JQ} -r ".configurations | has(\"${profile}\")" "${TMPFILE}")
60-
if [ "${exists}" != "true" ]; then
61-
echo "ERROR: Profile '${profile}' not found in ${INPUT} (version ${NEW_VERSION})" >&2
62-
echo "Available profiles: $(${JQ} -r '.configurations | keys | join(", ")' "${TMPFILE}")" >&2
63-
exit 1
64-
fi
65-
66-
# Validate tls_versions is a non-empty array with a non-null first entry
67-
if ! ${JQ} -e ".configurations.${profile}.tls_versions | type == \"array\" and length > 0 and .[0] != null" "${TMPFILE}" >/dev/null; then
68-
echo "ERROR: Missing or empty .configurations.${profile}.tls_versions[0] in ${INPUT}" >&2
69-
exit 1
70-
fi
71-
72-
# Validate that at least one cipher is present across ciphersuites and ciphers.iana
73-
# (modern has only ciphersuites; intermediate has both; either alone is valid)
74-
local cipher_count
75-
cipher_count=$(${JQ} -r "
76-
[
77-
(.configurations.${profile}.ciphersuites // []),
78-
(.configurations.${profile}.ciphers.iana // [])
79-
] | add | length" "${TMPFILE}")
80-
if [ "${cipher_count}" -eq 0 ] 2>/dev/null; then
81-
echo "ERROR: Profile '${profile}' has no ciphers in ciphersuites or ciphers.iana" >&2
82-
exit 1
83-
fi
84-
85-
# Validate tls_curves is non-empty
86-
local curve_count
87-
curve_count=$(${JQ} -r ".configurations.${profile}.tls_curves | length" "${TMPFILE}")
88-
if [ "${curve_count}" -eq 0 ] 2>/dev/null; then
89-
echo "ERROR: Profile '${profile}' has no entries in tls_curves" >&2
90-
exit 1
91-
fi
92-
93-
cat >> "${OUTPUT}" <<EOF
94-
95-
var ${profile}TLSProfile = tlsProfile{
96-
ciphers: cipherSlice{
97-
cipherNums: []uint16{
98-
EOF
99-
100-
${JQ} -r "(.configurations.${profile}.ciphersuites // [])[] | . |= \"tls.\" + . + \",\"" "${TMPFILE}" >> "${OUTPUT}"
101-
${JQ} -r "(.configurations.${profile}.ciphers.iana // [])[] | . |= \"tls.\" + . + \",\"" "${TMPFILE}" >> "${OUTPUT}"
102-
103-
cat >> "${OUTPUT}" <<EOF
104-
},
105-
},
106-
curves: curveSlice{
107-
curveNums: []tls.CurveID{
108-
EOF
109-
110-
${JQ} -r ".configurations.${profile}.tls_curves[] | . |= . + \",\"" "${TMPFILE}" >> "${OUTPUT}"
111-
112-
version=$(${JQ} -r ".configurations.${profile}.tls_versions[0]" "${TMPFILE}")
113-
version=${version/TLSv1./tls.VersionTLS1}
114-
version=${version/TLSv1/tls.VersionTLS10}
115-
116-
cat >> "${OUTPUT}" <<EOF
117-
},
118-
},
119-
minTLSVersion: ${version},
120-
}
121-
EOF
122-
}
123-
124-
generate_profile "modern"
125-
generate_profile "intermediate"
126-
127-
# Remove unsupported ciphers from Go's crypto/tls package
128-
sed -i.bak '/TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384/d; /TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384/d; /TLS_RSA_WITH_AES_256_CBC_SHA256/d' "${OUTPUT}"
129-
rm -f "${OUTPUT}.bak"
130-
131-
# Make go happy
132-
go fmt "${OUTPUT}"

‎internal/shared/util/tlsprofiles/mozilla_data.go‎

Lines changed: 88 additions & 43 deletions
Original file line numberDiff line numberDiff line change
@@ -1,53 +1,98 @@
11
package tlsprofiles
22

3-
// DO NOT EDIT, GENERATED BY hack/tools/update-tls-profiles.sh
4-
// DATA SOURCE: https://ssl-config.mozilla.org/guidelines/latest.json
5-
// DATA VERSION: 6
3+
// This file embeds the Mozilla SSL/TLS Configuration Guidelines JSON and parses
4+
// it at init() time to populate the modern and intermediate TLS profiles.
5+
// Run `make update-tls-profiles` to refresh mozilla_data.json from the upstream spec.
66

77
import (
88
"crypto/tls"
9+
_ "embed"
10+
"encoding/json"
11+
"fmt"
912
)
1013

11-
var modernTLSProfile = tlsProfile{
12-
ciphers: cipherSlice{
13-
cipherNums: []uint16{
14-
tls.TLS_AES_128_GCM_SHA256,
15-
tls.TLS_AES_256_GCM_SHA384,
16-
tls.TLS_CHACHA20_POLY1305_SHA256,
17-
},
18-
},
19-
curves: curveSlice{
20-
curveNums: []tls.CurveID{
21-
X25519MLKEM768,
22-
X25519,
23-
prime256v1,
24-
secp384r1,
25-
},
26-
},
27-
minTLSVersion: tls.VersionTLS13,
14+
//go:embed mozilla_data.json
15+
var mozillaDataJSON []byte
16+
17+
// skippedCiphers records cipher names from mozilla_data.json that are not
18+
// supported by Go's crypto/tls and were omitted from the profiles.
19+
var skippedCiphers []string
20+
21+
var (
22+
modernTLSProfile tlsProfile
23+
intermediateTLSProfile tlsProfile
24+
)
25+
26+
type mozillaConfiguration struct {
27+
Ciphersuites []string `json:"ciphersuites"`
28+
Ciphers struct {
29+
IANA []string `json:"iana"`
30+
} `json:"ciphers"`
31+
TLSCurves []string `json:"tls_curves"`
32+
TLSVersions []string `json:"tls_versions"`
2833
}
2934

30-
var intermediateTLSProfile = tlsProfile{
31-
ciphers: cipherSlice{
32-
cipherNums: []uint16{
33-
tls.TLS_AES_128_GCM_SHA256,
34-
tls.TLS_AES_256_GCM_SHA384,
35-
tls.TLS_CHACHA20_POLY1305_SHA256,
36-
tls.TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,
37-
tls.TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,
38-
tls.TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,
39-
tls.TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,
40-
tls.TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256,
41-
tls.TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256,
42-
},
43-
},
44-
curves: curveSlice{
45-
curveNums: []tls.CurveID{
46-
X25519MLKEM768,
47-
X25519,
48-
prime256v1,
49-
secp384r1,
50-
},
51-
},
52-
minTLSVersion: tls.VersionTLS12,
35+
type mozillaSpec struct {
36+
Configurations map[string]mozillaConfiguration `json:"configurations"`
37+
}
38+
39+
func init() {
40+
var spec mozillaSpec
41+
if err := json.Unmarshal(mozillaDataJSON, &spec); err != nil {
42+
panic(fmt.Sprintf("tlsprofiles: failed to parse embedded mozilla_data.json: %v", err))
43+
}
44+
45+
for _, name := range []string{"modern", "intermediate"} {
46+
cfg, ok := spec.Configurations[name]
47+
if !ok {
48+
panic(fmt.Sprintf("tlsprofiles: profile %q not found in embedded mozilla_data.json", name))
49+
}
50+
51+
p, skipped := parseProfile(name, cfg)
52+
skippedCiphers = append(skippedCiphers, skipped...)
53+
54+
switch name {
55+
case "modern":
56+
modernTLSProfile = p
57+
case "intermediate":
58+
intermediateTLSProfile = p
59+
}
60+
}
61+
}
62+
63+
func parseProfile(name string, cfg mozillaConfiguration) (tlsProfile, []string) {
64+
var skipped []string
65+
var cipherNums []uint16
66+
for _, c := range append(cfg.Ciphersuites, cfg.Ciphers.IANA...) {
67+
id := cipherSuiteId(c)
68+
if id == 0 {
69+
skipped = append(skipped, c)
70+
continue
71+
}
72+
cipherNums = append(cipherNums, id)
73+
}
74+
75+
var curveNums []tls.CurveID
76+
for _, c := range cfg.TLSCurves {
77+
id := curveId(c)
78+
if id == 0 {
79+
continue
80+
}
81+
curveNums = append(curveNums, id)
82+
}
83+
84+
if len(cfg.TLSVersions) == 0 {
85+
panic(fmt.Sprintf("tlsprofiles: profile %q has no tls_versions in embedded mozilla_data.json", name))
86+
}
87+
88+
var version tlsVersion
89+
if err := version.Set(cfg.TLSVersions[0]); err != nil {
90+
panic(fmt.Sprintf("tlsprofiles: profile %q has unrecognized tls_versions[0] %q: %v", name, cfg.TLSVersions[0], err))
91+
}
92+
93+
return tlsProfile{
94+
ciphers: cipherSlice{cipherNums: cipherNums},
95+
curves: curveSlice{curveNums: curveNums},
96+
minTLSVersion: version,
97+
}, skipped
5398
}

‎internal/shared/util/tlsprofiles/mozilla_data.json‎

Lines changed: 70 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,70 @@
1+
{
2+
"version": 6.0,
3+
"href": "https://ssl-config.mozilla.org/guidelines/6.0.json",
4+
"configurations": {
5+
"modern": {
6+
"certificate_curves": ["prime256v1", "secp384r1"],
7+
"certificate_signatures": ["ecdsa-with-SHA256", "ecdsa-with-SHA384", "ecdsa-with-SHA512"],
8+
"certificate_types": ["ecdsa"],
9+
"ciphers": {
10+
"iana": [],
11+
"openssl": []
12+
},
13+
"ciphersuites": [
14+
"TLS_AES_128_GCM_SHA256",
15+
"TLS_AES_256_GCM_SHA384",
16+
"TLS_CHACHA20_POLY1305_SHA256"
17+
],
18+
"dh_param_size": null,
19+
"ecdh_param_size": 256,
20+
"hsts_min_age": 63072000,
21+
"maximum_certificate_lifespan": 90,
22+
"ocsp_staple": true,
23+
"oldest_clients": ["Firefox 63", "Android 10.0", "Chrome 70", "Edge 75", "Java 11", "OpenSSL 1.1.1", "Opera 57", "Safari 12.1"],
24+
"recommended_certificate_lifespan": 90,
25+
"rsa_key_size": null,
26+
"server_preferred_order": false,
27+
"tls_curves": ["X25519MLKEM768", "X25519", "prime256v1", "secp384r1"],
28+
"tls_versions": ["TLSv1.3"]
29+
},
30+
"intermediate": {
31+
"certificate_curves": ["prime256v1", "secp384r1"],
32+
"certificate_signatures": ["sha256WithRSAEncryption", "ecdsa-with-SHA256", "ecdsa-with-SHA384", "ecdsa-with-SHA512"],
33+
"certificate_types": ["ecdsa", "rsa"],
34+
"ciphers": {
35+
"iana": [
36+
"TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256",
37+
"TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256",
38+
"TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384",
39+
"TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384",
40+
"TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256",
41+
"TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256"
42+
],
43+
"openssl": [
44+
"ECDHE-ECDSA-AES128-GCM-SHA256",
45+
"ECDHE-RSA-AES128-GCM-SHA256",
46+
"ECDHE-ECDSA-AES256-GCM-SHA384",
47+
"ECDHE-RSA-AES256-GCM-SHA384",
48+
"ECDHE-ECDSA-CHACHA20-POLY1305",
49+
"ECDHE-RSA-CHACHA20-POLY1305"
50+
]
51+
},
52+
"ciphersuites": [
53+
"TLS_AES_128_GCM_SHA256",
54+
"TLS_AES_256_GCM_SHA384",
55+
"TLS_CHACHA20_POLY1305_SHA256"
56+
],
57+
"dh_param_size": 2048,
58+
"ecdh_param_size": 256,
59+
"hsts_min_age": 63072000,
60+
"maximum_certificate_lifespan": 366,
61+
"ocsp_staple": true,
62+
"oldest_clients": ["Firefox 31.3.0", "Android 4.4.2", "Chrome 49", "Edge 15 on Windows 10", "IE 11 on Windows 10", "Java 8u161", "OpenSSL 1.0.1l", "Opera 20", "Safari 9"],
63+
"recommended_certificate_lifespan": 90,
64+
"rsa_key_size": 2048,
65+
"server_preferred_order": false,
66+
"tls_curves": ["X25519MLKEM768", "X25519", "prime256v1", "secp384r1"],
67+
"tls_versions": ["TLSv1.2", "TLSv1.3"]
68+
}
69+
}
70+
}

‎internal/shared/util/tlsprofiles/tlsprofiles_test.go‎

Lines changed: 9 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -164,3 +164,12 @@ func TestProfilesMapCompleteness(t *testing.T) {
164164
}
165165
require.GreaterOrEqual(t, len(profiles), 4, "profiles map must contain at least the required built-in profiles")
166166
}
167+
168+
// TestNoSkippedCiphers verifies that all ciphers in mozilla_data.json are
169+
// supported by Go's crypto/tls. If this fails, the JSON contains a cipher that
170+
// needs to be handled — either it has been added to Go's crypto/tls, or it must
171+
// be explicitly excluded from the profiles.
172+
func TestNoSkippedCiphers(t *testing.T) {
173+
require.Empty(t, skippedCiphers,
174+
"cipher(s) in mozilla_data.json are not supported by Go's crypto/tls and were omitted: %v", skippedCiphers)
175+
}

0 commit comments

Comments
 (0)