mirror of
https://github.com/hanzo-ml/spark-operator.git
synced 2026-10-30 20:39:07 +00:00
e903cc6604
Both branches of the enableHTTP2 conditional in SetupTLS() were setting the same NextProtos value ["h2", "http/1.1"], making the conditional dead code. Remove it and always set NextProtos unconditionally. Also remove the enableHTTP2 CLI flag, variable, and parameter from controller and webhook start commands. The flag was a workaround for CVE-2023-44487 (HTTP/2 rapid reset) which is fixed in Go 1.21.3+. A user-facing flag that silently does nothing is misleading. Signed-off-by: Ugo Giordano <[email protected]> Co-authored-by: Hanzo Dev <[email protected]>
87 lines
2.4 KiB
Go
87 lines
2.4 KiB
Go
/*
|
|
Copyright 2026 The Kubeflow authors.
|
|
|
|
Licensed under the Apache License, Version 2.0 (the "License");
|
|
you may not use this file except in compliance with the License.
|
|
You may obtain a copy of the License at
|
|
|
|
https://www.apache.org/licenses/LICENSE-2.0
|
|
|
|
Unless required by applicable law or agreed to in writing, software
|
|
distributed under the License is distributed on an "AS IS" BASIS,
|
|
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
|
See the License for the specific language governing permissions and
|
|
limitations under the License.
|
|
*/
|
|
|
|
package tls
|
|
|
|
import (
|
|
cryptotls "crypto/tls"
|
|
"fmt"
|
|
"strings"
|
|
)
|
|
|
|
// SetupTLS parses the TLS flags and returns TLS option functions for webhook and metrics servers.
|
|
func SetupTLS(minVersion string, cipherSuites []string) ([]func(*cryptotls.Config), error) {
|
|
var tlsOpts []func(*cryptotls.Config)
|
|
|
|
ver, err := ParseTLSVersion(minVersion)
|
|
if err != nil {
|
|
return nil, fmt.Errorf("invalid --tls-min-version %q: %w", minVersion, err)
|
|
}
|
|
tlsOpts = append(tlsOpts, func(c *cryptotls.Config) {
|
|
c.MinVersion = ver
|
|
})
|
|
|
|
if len(cipherSuites) > 0 {
|
|
cipherIDs, err := ParseCipherSuites(cipherSuites)
|
|
if err != nil {
|
|
return nil, fmt.Errorf("invalid --tls-cipher-suites: %w", err)
|
|
}
|
|
tlsOpts = append(tlsOpts, func(c *cryptotls.Config) {
|
|
c.CipherSuites = cipherIDs
|
|
})
|
|
}
|
|
|
|
tlsOpts = append(tlsOpts, func(c *cryptotls.Config) {
|
|
c.NextProtos = []string{"h2", "http/1.1"}
|
|
})
|
|
|
|
return tlsOpts, nil
|
|
}
|
|
|
|
// ParseTLSVersion converts a version string to a tls.Version constant.
|
|
func ParseTLSVersion(version string) (uint16, error) {
|
|
switch version {
|
|
case "VersionTLS12":
|
|
return cryptotls.VersionTLS12, nil
|
|
case "VersionTLS13":
|
|
return cryptotls.VersionTLS13, nil
|
|
default:
|
|
return 0, fmt.Errorf("unsupported TLS version: %s (use VersionTLS12 or VersionTLS13)", version)
|
|
}
|
|
}
|
|
|
|
// ParseCipherSuites converts cipher suite names to their IDs.
|
|
// Empty strings are silently filtered out.
|
|
func ParseCipherSuites(names []string) ([]uint16, error) {
|
|
allCiphers := make(map[string]uint16)
|
|
for _, cs := range cryptotls.CipherSuites() {
|
|
allCiphers[cs.Name] = cs.ID
|
|
}
|
|
var ids []uint16
|
|
for _, name := range names {
|
|
name = strings.TrimSpace(name)
|
|
if name == "" {
|
|
continue
|
|
}
|
|
id, ok := allCiphers[name]
|
|
if !ok {
|
|
return nil, fmt.Errorf("unknown cipher suite: %s", name)
|
|
}
|
|
ids = append(ids, id)
|
|
}
|
|
return ids, nil
|
|
}
|