istio.io/istio@v0.0.0-20240520182934-d79c90f27776/pilot/pkg/security/authn/utils/utils.go (about)

     1  // Copyright Istio Authors
     2  //
     3  // Licensed under the Apache License, Version 2.0 (the "License");
     4  // you may not use this file except in compliance with the License.
     5  // You may obtain a copy of the License at
     6  //
     7  //     http://www.apache.org/licenses/LICENSE-2.0
     8  //
     9  // Unless required by applicable law or agreed to in writing, software
    10  // distributed under the License is distributed on an "AS IS" BASIS,
    11  // WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
    12  // See the License for the specific language governing permissions and
    13  // limitations under the License.
    14  
    15  package utils
    16  
    17  import (
    18  	tls "github.com/envoyproxy/go-control-plane/envoy/extensions/transport_sockets/tls/v3"
    19  
    20  	meshconfig "istio.io/api/mesh/v1alpha1"
    21  	"istio.io/istio/pilot/pkg/features"
    22  	"istio.io/istio/pilot/pkg/model"
    23  	"istio.io/istio/pilot/pkg/networking"
    24  	"istio.io/istio/pilot/pkg/networking/util"
    25  	authn_model "istio.io/istio/pilot/pkg/security/model"
    26  	protovalue "istio.io/istio/pkg/proto"
    27  )
    28  
    29  // SupportedCiphers for server side TLS configuration.
    30  var SupportedCiphers = []string{
    31  	"ECDHE-ECDSA-AES256-GCM-SHA384",
    32  	"ECDHE-RSA-AES256-GCM-SHA384",
    33  	"ECDHE-ECDSA-AES128-GCM-SHA256",
    34  	"ECDHE-RSA-AES128-GCM-SHA256",
    35  	"AES256-GCM-SHA384",
    36  	"AES128-GCM-SHA256",
    37  }
    38  
    39  // BuildInboundTLS returns the TLS context corresponding to the mTLS mode.
    40  func BuildInboundTLS(mTLSMode model.MutualTLSMode, node *model.Proxy,
    41  	protocol networking.ListenerProtocol, trustDomainAliases []string, minTLSVersion tls.TlsParameters_TlsProtocol,
    42  	mc *meshconfig.MeshConfig,
    43  ) *tls.DownstreamTlsContext {
    44  	if mTLSMode == model.MTLSDisable || mTLSMode == model.MTLSUnknown {
    45  		return nil
    46  	}
    47  	ctx := &tls.DownstreamTlsContext{
    48  		CommonTlsContext:         &tls.CommonTlsContext{},
    49  		RequireClientCertificate: protovalue.BoolTrue,
    50  	}
    51  	if protocol == networking.ListenerProtocolTCP && features.MetadataExchange {
    52  		// For TCP with mTLS, we advertise "istio-peer-exchange" from client and
    53  		// expect the same from server. This  is so that secure metadata exchange
    54  		// transfer can take place between sidecars for TCP with mTLS.
    55  		if features.DisableMxALPN {
    56  			ctx.CommonTlsContext.AlpnProtocols = util.ALPNDownstream
    57  		} else {
    58  			ctx.CommonTlsContext.AlpnProtocols = util.ALPNDownstreamWithMxc
    59  		}
    60  	} else {
    61  		// Note that in the PERMISSIVE mode, we match filter chain on "istio" ALPN,
    62  		// which is used to differentiate between service mesh and legacy traffic.
    63  		//
    64  		// Client sidecar outbound cluster's TLSContext.ALPN must include "istio".
    65  		//
    66  		// Server sidecar filter chain's FilterChainMatch.ApplicationProtocols must
    67  		// include "istio" for the secure traffic, but its TLSContext.ALPN must not
    68  		// include "istio", which would interfere with negotiation of the underlying
    69  		// protocol, e.g. HTTP/2.
    70  		ctx.CommonTlsContext.AlpnProtocols = util.ALPNHttp
    71  	}
    72  	ciphers := SupportedCiphers
    73  	if mc != nil && mc.MeshMTLS != nil && mc.MeshMTLS.CipherSuites != nil {
    74  		ciphers = mc.MeshMTLS.CipherSuites
    75  	}
    76  	// Set Minimum TLS version to match the default client version and allowed strong cipher suites for sidecars.
    77  	ctx.CommonTlsContext.TlsParams = &tls.TlsParameters{
    78  		CipherSuites:              ciphers,
    79  		TlsMinimumProtocolVersion: minTLSVersion,
    80  		TlsMaximumProtocolVersion: tls.TlsParameters_TLSv1_3,
    81  	}
    82  	authn_model.ApplyToCommonTLSContext(ctx.CommonTlsContext, node, []string{}, /*subjectAltNames*/
    83  		"", /*crl*/
    84  		trustDomainAliases, ctx.RequireClientCertificate.Value)
    85  
    86  	// Compliance for downstream mesh mTLS.
    87  	authn_model.EnforceCompliance(ctx.CommonTlsContext)
    88  	return ctx
    89  }
    90  
    91  // GetMinTLSVersion returns the minimum TLS version for workloads based on the mesh config.
    92  func GetMinTLSVersion(ver meshconfig.MeshConfig_TLSConfig_TLSProtocol) tls.TlsParameters_TlsProtocol {
    93  	switch ver {
    94  	case meshconfig.MeshConfig_TLSConfig_TLSV1_3:
    95  		return tls.TlsParameters_TLSv1_3
    96  	default:
    97  		return tls.TlsParameters_TLSv1_2
    98  	}
    99  }