istio.io/istio@v0.0.0-20240520182934-d79c90f27776/pilot/cmd/pilot-discovery/app/options.go (about)

     1  // Copyright Istio Authors
     2  //
     3  // Licensed under the Apache License, Version 2.0 (the "License");
     4  // you may not use this file except in compliance with the License.
     5  // You may obtain a copy of the License at
     6  //
     7  //     http://www.apache.org/licenses/LICENSE-2.0
     8  //
     9  // Unless required by applicable law or agreed to in writing, software
    10  // distributed under the License is distributed on an "AS IS" BASIS,
    11  // WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
    12  // See the License for the specific language governing permissions and
    13  // limitations under the License.
    14  
    15  package app
    16  
    17  import (
    18  	"crypto/tls"
    19  
    20  	"istio.io/istio/pilot/pkg/bootstrap"
    21  	"istio.io/istio/pkg/config/validation"
    22  	"istio.io/istio/pkg/util/sets"
    23  )
    24  
    25  // insecureTLSCipherNames returns a list of insecure cipher suite names implemented by crypto/tls
    26  // which have security issues.
    27  func insecureTLSCipherNames() []string {
    28  	cipherKeys := sets.New[string]()
    29  	for _, cipher := range tls.InsecureCipherSuites() {
    30  		cipherKeys.Insert(cipher.Name)
    31  	}
    32  	return sets.SortedList(cipherKeys)
    33  }
    34  
    35  // secureTLSCipherNames returns a list of secure cipher suite names implemented by crypto/tls.
    36  func secureTLSCipherNames() []string {
    37  	cipherKeys := sets.New[string]()
    38  	for _, cipher := range tls.CipherSuites() {
    39  		cipherKeys.Insert(cipher.Name)
    40  	}
    41  	return sets.SortedList(cipherKeys)
    42  }
    43  
    44  func validateFlags(serverArgs *bootstrap.PilotArgs) error {
    45  	if serverArgs == nil {
    46  		return nil
    47  	}
    48  
    49  	// If keepaliveMaxServerConnectionAge is negative, istiod crash
    50  	// https://github.com/istio/istio/issues/27257
    51  	if err := validation.ValidateMaxServerConnectionAge(serverArgs.KeepaliveOptions.MaxServerConnectionAge); err != nil {
    52  		return err
    53  	}
    54  
    55  	_, err := bootstrap.TLSCipherSuites(serverArgs.ServerOptions.TLSOptions.TLSCipherSuites)
    56  
    57  	// TODO: add validation for other flags
    58  	return err
    59  }