zowe / zss

Zowe System Services Server for enabling low-level microservices
Eclipse Public License 2.0
13 stars 45 forks source link

Add cipher customization support #666

Closed 1000TurquoisePogs closed 9 months ago

1000TurquoisePogs commented 9 months ago

adds reading array of iana cipher suite strings to customize ciphers

this can be tested by setting either zowe.network.server.tls.ciphers or components.zss.zowe.network.server.tls.ciphers to an array of IANA cipher strings.

this PR also externalizes the default ciphers into defaults.yaml so people can see what they are, though its a little hard to read.

when _zss.mvdserver and _zss.httpserver log levels are set to debug (3) or higher, you will see printout about the behavior - which ciphers were requested and which maps were found, and what the final result is.

to test, i set up my yaml like this:

  network:                                                                                                   
    server:                                                                                                  
      listenAddresses:                                                                                       
      - 0.0.0.0                                                                                              
      tls:                                                                                                   
        minTls: TLSv1.2                                                                                      
        maxTls: TLSv1.3                                                                                      
#        ciphers:                                                                                            
#        - TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256                                                             
#        - TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384                                                             
#        - TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256                                                     
#        - TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256                                                       
#        - TLS_CHACHA20_POLY1305_SHA256

by uncommenting or commenting, and switching maxTls to 1.2 or 1.3, I was able to check the site details in firefox to see if the right ciphers were being used and at what tls level image

my testing matched the config & debug output.