From 9fbb552031bea112ad5cbfd3bd9a632039483e87 Mon Sep 17 00:00:00 2001 From: Jeff Mitchell Date: Tue, 9 Mar 2021 08:33:35 -0500 Subject: [PATCH] Update shared-secure-libs to support tls_max_version --- go.mod | 4 ++-- go.sum | 8 ++++---- website/content/docs/configuration/listener/tcp.mdx | 6 ++++++ website/content/docs/configuration/listener/unix.mdx | 6 ++++++ 4 files changed, 18 insertions(+), 6 deletions(-) diff --git a/go.mod b/go.mod index 12afcb97f..075531d61 100644 --- a/go.mod +++ b/go.mod @@ -29,7 +29,7 @@ require ( github.com/hashicorp/go-retryablehttp v0.6.8 github.com/hashicorp/go-uuid v1.0.2 github.com/hashicorp/hcl v1.0.0 - github.com/hashicorp/shared-secure-libs v0.0.3 + github.com/hashicorp/shared-secure-libs v0.0.4 github.com/hashicorp/vault/sdk v0.1.14-0.20200916184745-5576096032f8 github.com/iancoleman/strcase v0.1.3 github.com/jefferai/keyring v1.1.7-0.20210105022822-8749b3d9ce79 @@ -47,7 +47,7 @@ require ( github.com/oligot/go-mod-upgrade v0.4.0 github.com/ory/dockertest/v3 v3.6.0 github.com/patrickmn/go-cache v2.1.0+incompatible - github.com/pires/go-proxyproto v0.4.2 + github.com/pires/go-proxyproto v0.5.0 github.com/pkg/errors v0.9.1 github.com/posener/complete v1.2.3 github.com/stretchr/testify v1.7.0 diff --git a/go.sum b/go.sum index c043ff90d..667490139 100644 --- a/go.sum +++ b/go.sum @@ -640,8 +640,8 @@ github.com/hashicorp/mdns v1.0.0/go.mod h1:tL+uN++7HEJ6SQLQ2/p+z2pH24WQKWjBPkE0m github.com/hashicorp/memberlist v0.1.3/go.mod h1:ajVTdAv/9Im8oMAAj5G31PhhMCZJV2pPBoIllUwCN7I= github.com/hashicorp/serf v0.8.2/go.mod h1:6hOLApaqBFA1NXqRQAsxw9QxuDEvNxSQRwA/JwenrHc= github.com/hashicorp/shared-secure-libs v0.0.2/go.mod h1:xhtA0FH6AYYFOy0sir7u0O0zzdLi7ofU6oWxy+gjnuc= -github.com/hashicorp/shared-secure-libs v0.0.3 h1:R1ublyNsxQ1EKHdiKlglZ8uhkzPvBcWstFJ85s1me3A= -github.com/hashicorp/shared-secure-libs v0.0.3/go.mod h1:xhtA0FH6AYYFOy0sir7u0O0zzdLi7ofU6oWxy+gjnuc= +github.com/hashicorp/shared-secure-libs v0.0.4 h1:aRm7/wnJ70z5hSX8cLdyupwI8QNKklfViRstg/ZtUdw= +github.com/hashicorp/shared-secure-libs v0.0.4/go.mod h1:xhtA0FH6AYYFOy0sir7u0O0zzdLi7ofU6oWxy+gjnuc= github.com/hashicorp/vault/api v1.0.5-0.20200514164214-89b1987e38c2/go.mod h1:P8A7gn1a6j/7qQ4zOaWI6FC/Q9jQWEBRTOwZH33tC9o= github.com/hashicorp/vault/api v1.0.5-0.20200519221902-385fac77e20f/go.mod h1:euTFbi2YJgwcju3imEt919lhJKF68nN1cQPq3aA+kBE= github.com/hashicorp/vault/api v1.0.5-0.20200805123347-1ef507638af6 h1:ChHpobQse3kjVX7GmbpUFVqaMTf4lb1gcLrJltsUmS4= @@ -953,8 +953,8 @@ github.com/pierrec/lz4 v1.0.2-0.20190131084431-473cd7ce01a1/go.mod h1:3/3N9NVKO0 github.com/pierrec/lz4 v2.0.5+incompatible/go.mod h1:pdkljMzZIN41W+lC3N2tnIh5sFi+IEE17M5jbnwPHcY= github.com/pierrec/lz4 v2.5.2+incompatible h1:WCjObylUIOlKy/+7Abdn34TLIkXiA4UWUMhxq9m9ZXI= github.com/pierrec/lz4 v2.5.2+incompatible/go.mod h1:pdkljMzZIN41W+lC3N2tnIh5sFi+IEE17M5jbnwPHcY= -github.com/pires/go-proxyproto v0.4.2 h1:VRAvsUCTrmiahoU5fqQqkbY0GWcJ1Q0F7b7CkFaipSU= -github.com/pires/go-proxyproto v0.4.2/go.mod h1:Odh9VFOZJCf9G8cLW5o435Xf1J95Jw9Gw5rnCjcwzAY= +github.com/pires/go-proxyproto v0.5.0 h1:A4Jv4ZCaV3AFJeGh5mGwkz4iuWUYMlQ7IoO/GTuSuLo= +github.com/pires/go-proxyproto v0.5.0/go.mod h1:Odh9VFOZJCf9G8cLW5o435Xf1J95Jw9Gw5rnCjcwzAY= github.com/pkg/browser v0.0.0-20180916011732-0a3d74bf9ce4/go.mod h1:4OwLy04Bl9Ef3GJJCoec+30X3LQs/0/m4HFRt/2LUSA= github.com/pkg/errors v0.8.0/go.mod h1:bwawxfHBFNV+L2hUp1rHADufV3IMtnDRdf1r5NINEl0= github.com/pkg/errors v0.8.1-0.20171018195549-f15c970de5b7/go.mod h1:bwawxfHBFNV+L2hUp1rHADufV3IMtnDRdf1r5NINEl0= diff --git a/website/content/docs/configuration/listener/tcp.mdx b/website/content/docs/configuration/listener/tcp.mdx index 19db1f997..d348d7fc2 100644 --- a/website/content/docs/configuration/listener/tcp.mdx +++ b/website/content/docs/configuration/listener/tcp.mdx @@ -84,6 +84,12 @@ allowed. ~> **Warning**: TLS 1.1 and lower are generally considered insecure. +- `tls_max_version` `(string: "tls13")` – Specifies the maximum supported + version of TLS, useful if appliances (e.g. load balancers) are not yet capable + of higher levels. Accepted values are "tls10", "tls11", "tls12" or "tls13". + + ~> **Warning**: TLS 1.1 and lower are generally considered insecure. + - `tls_cipher_suites` `(string: "")` – Override the default list of supported ciphersuites (which varies by TLS version) with the the specified comma-delimited list. The list of all available ciphersuites is available in diff --git a/website/content/docs/configuration/listener/unix.mdx b/website/content/docs/configuration/listener/unix.mdx index 4aea9e8a4..66b2f99e1 100644 --- a/website/content/docs/configuration/listener/unix.mdx +++ b/website/content/docs/configuration/listener/unix.mdx @@ -85,6 +85,12 @@ allowed. ~> **Warning**: TLS 1.1 and lower are generally considered insecure. +- `tls_max_version` `(string: "tls13")` – Specifies the maximum supported + version of TLS, useful if appliances (e.g. load balancers) are not yet capable + of higher levels. Accepted values are "tls10", "tls11", "tls12" or "tls13". + + ~> **Warning**: TLS 1.1 and lower are generally considered insecure. + - `tls_cipher_suites` `(string: "")` – Specifies the list of supported ciphersuites as a comma-separated-list. The list of all available ciphersuites is available in the [Golang TLS documentation][golang-tls].