homelab/traefik
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Change default TLS options for more security

Browse source
This commit is contained in:
Douglas De Toni Machado 2022-09-08 05:56:08 -03:00 • committed by GitHub
parent 703de5331b
commit c84378d649
No known key found for this signature in database
GPG key ID: 4AEE18F83AFDEB23
5 changed files with 59 additions and 75 deletions
Download patch file Download diff file Expand all files Collapse all files

28
pkg/tls/tlsmanager_test.go
View file

@ -347,3 +347,31 @@ func TestClientAuth(t *testing.T) {
})
}
}
func TestManager_Get_DefaultValues(t *testing.T) {
tlsManager := NewManager()
// Ensures we won't break things for Traefik users when updating Go
config, _ := tlsManager.Get("default", "default")
assert.Equal(t, config.MinVersion, uint16(tls.VersionTLS12))
assert.Equal(t, config.NextProtos, []string{"h2", "http/1.1", "acme-tls/1"})
assert.Equal(t, config.CipherSuites, []uint16{
tls.TLS_RSA_WITH_AES_128_CBC_SHA,
tls.TLS_RSA_WITH_AES_256_CBC_SHA,
tls.TLS_RSA_WITH_AES_128_GCM_SHA256,
tls.TLS_RSA_WITH_AES_256_GCM_SHA384,
tls.TLS_AES_128_GCM_SHA256,
tls.TLS_AES_256_GCM_SHA384,
tls.TLS_CHACHA20_POLY1305_SHA256,
tls.TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA,
tls.TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA,
tls.TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA,
tls.TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA,
tls.TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,
tls.TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,
tls.TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,
tls.TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,
tls.TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256,
tls.TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256,
})
}