Set minumum TLS version to 1.2

Signed-off-by: Ed Warnicke <[email protected]>
networkservicemesh · May 15, 2022 · d4f73cf · d4f73cf
1 parent 3687416
commit d4f73cf
Show file tree

Hide file tree

Showing 3 changed files with 10 additions and 7 deletions.
diff --git a/internal/imports/gen.go b/internal/imports/gen.go
@@ -18,5 +18,5 @@
 package imports
 
 //go:generate bash -c "rm -rf imports*.go"
-//go:generate bash -c "cd $(mktemp -d) && GO111MODULE=on go get github.com/edwarnicke/[email protected]"
+//go:generate bash -c "cd $(mktemp -d) && GO111MODULE=on go install github.com/edwarnicke/[email protected]"
 //go:generate bash -c "GOOS=linux ${GOPATH}/bin/imports-gen"
diff --git a/internal/imports/imports_linux.go b/internal/imports/imports_linux.go
diff --git a/main.go b/main.go
@@ -21,6 +21,7 @@ package main
 
 import (
 	"context"
+	"crypto/tls"
 	"fmt"
 
 	"github.com/google/uuid"
@@ -232,6 +233,11 @@ func main() {
 	}
 	log.FromContext(ctx).Infof("SVID: %q", svid.ID)
 
+	tlsClientConfig := tlsconfig.MTLSClientConfig(source, source, tlsconfig.AuthorizeAny())
+	tlsClientConfig.MinVersion = tls.VersionTLS12
+	tlsServerConfig := tlsconfig.MTLSServerConfig(source, source, tlsconfig.AuthorizeAny())
+	tlsServerConfig.MinVersion = tls.VersionTLS12
+
 	// ********************************************************************************
 	log.FromContext(ctx).Infof("executing phase 5: create vl3-nse")
 	// ********************************************************************************
@@ -262,9 +268,7 @@ func main() {
 		),
 		grpc.WithTransportCredentials(
 			grpcfd.TransportCredentials(
-				credentials.NewTLS(
-					tlsconfig.MTLSClientConfig(source, source, tlsconfig.AuthorizeAny()),
-				),
+				credentials.NewTLS(tlsClientConfig),
 			),
 		),
 	)
@@ -371,9 +375,7 @@ func createVl3Endpoint(ctx context.Context, config *Config, vppConn vpphelper.Co
 		tracing.WithTracing(),
 		grpc.Creds(
 			grpcfd.TransportCredentials(
-				credentials.NewTLS(
-					tlsconfig.MTLSServerConfig(source, source, tlsconfig.AuthorizeAny()),
-				),
+				credentials.NewTLS(tlsServerConfig),
 			),
 		),
 	)