e2e tests for min/max TLS protocol version and cipher suite

[ijsnellf]

There are no e2e tests for min/max TLS protocol version and cipher suite. See istio/api#645 and #9103

Go doesn't seem to have an easy way to use an older version of TLS so we can easily test this.

[stale]

This issue has been automatically marked as stale because it has not had activity in the last 90 days. It will be closed in the next 30 days unless it is tagged "help wanted" or other activity occurs. Thank you for your contributions.

[PiotrSikora]

You should be able to use tls.Config to set min/max protocol versions in Go, e.g.

cfg := &tls.Config{
    MinVersion:    tls.VersionTLS10,
    MaxVersion:    tls.VersionTLS11,
}

conn, err := tls.Dial("tcp", "127.0.0.1:443", cfg)
if err != nil {
    ...
}
defer conn.Close()

Background: I'm in process of modernizing TLS defaults in Envoy, so it would be great to make sure that configuring TLS protocol versions in Istio works, so that users can re-enable older protocols if needed.

[PiotrSikora]

@ijsnellf any chance this could make it before 1.1? Thanks!

[iftachsc]

+1. when is this expected to be out? thanks.

[stale]

This issue has been automatically marked as stale because it has not had activity in the last 90 days. It will be closed in the next 30 days unless it is tagged "help wanted" or other activity occurs. Thank you for your contributions.

[stale]

This issue has been automatically closed because it has not had activity in the last month and a half. If this issue is still valid, please ping a maintainer and ask them to label it as "help wanted". Thank you for your contributions.

[myidpt]

This is a nice to have test, but not high priority in the short term. I added "help wanted". It would be great if someone from community can help out.

[PiotrSikora]

This would be good to add since upstream changed defaults (removed TLS 1.0 and TLS 1.1 from client-side defaults), so not having this might bite us in 1.5.

[istio-policy-bot]

🚧 This issue or pull request has been closed due to not having had activity from an Istio team member since 2019-11-14. If you feel this issue or pull request deserves attention, please reopen the issue. Please see this wiki page for more information. Thank you for your contributions.

Created by the issue and PR lifecycle manager.