Skip to content

Commit eba1e60

Browse files
davidesalernodavidesalerno
committed
Add support for TLS curves in TLSProfile
Signed-off-by: Davide Salerno <dsalerno@redhat.com>
1 parent 0e3c378 commit eba1e60

20 files changed

+711
-63
lines changed

‎config/v1/types_tlssecurityprofile.go‎

Lines changed: 70 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -202,6 +202,27 @@ const (
202202
TLSProfileCustomType TLSProfileType = "Custom"
203203
)
204204

205+
// TLSCurve is a named curve identifier that can be used in TLSProfile.Curves.
206+
// There is a one-to-one mapping between these names and the curve IDs defined
207+
// in crypto/tls package based on IANA's "TLS Supported Groups" registry:
208+
// https://www.iana.org/assignments/tls-parameters/tls-parameters.xhtml#tls-parameters-8
209+
//
210+
// +kubebuilder:validation:Enum=X25519;P-256;P-384;P-521;X25519MLKEM768
211+
type TLSCurve string
212+
213+
const (
214+
// TLSCurveX25519 represents X25519.
215+
TLSCurveX25519 TLSCurve = "X25519"
216+
// TLSCurveP256 represents P-256 (secp256r1).
217+
TLSCurveP256 TLSCurve = "P-256"
218+
// TLSCurveP384 represents P-384 (secp384r1).
219+
TLSCurveP384 TLSCurve = "P-384"
220+
// TLSCurveP521 represents P-521 (secp521r1).
221+
TLSCurveP521 TLSCurve = "P-521"
222+
// TLSCurveX25519MLKEM768 represents X25519MLKEM768.
223+
TLSCurveX25519MLKEM768 TLSCurve = "X25519MLKEM768"
224+
)
225+
205226
// TLSProfileSpec is the desired behavior of a TLSSecurityProfile.
206227
type TLSProfileSpec struct {
207228
// ciphers is used to specify the cipher algorithms that are negotiated
@@ -213,6 +234,37 @@ type TLSProfileSpec struct {
213234
//
214235
// +listType=atomic
215236
Ciphers []string `json:"ciphers"`
237+
// curves is used to specify the elliptic curves that are used during
238+
// the TLS handshake. Operators may remove entries their operands do
239+
// not support.
240+
//
241+
// TLSProfiles Old, Intermediate, Modern are including by default the following
242+
// curves: X25519, P-256, P-384, X25519MLKEM768
243+
// TLSProfiles Custom do not include any curves by default.
244+
// NOTE: since this field is optional, if no curves are specified, the default curves
245+
// used by the underlying TLS library will be used.
246+
//
247+
// For example, to use X25519 and P-256 (yaml):
248+
//
249+
// # Example: Force PQC-only encryption
250+
// apiVersion: config.openshift.io/v1
251+
// kind: APIServer
252+
// spec:
253+
// tlsSecurityProfile:
254+
// type: Custom
255+
// custom:
256+
// ciphers:
257+
// - TLS_AES_128_GCM_SHA256
258+
// - TLS_AES_256_GCM_SHA384
259+
// - TLS_CHACHA20_POLY1305_SHA256
260+
// curves:
261+
// - X25519MLKEM768 # PQC-only: only hybrid quantum-resistant curve
262+
// minTLSVersion: VersionTLS13
263+
//
264+
// +optional
265+
// +listType=atomic
266+
// +kubebuilder:validation:MaxItems=5
267+
Curves []TLSCurve `json:"curves,omitempty"`
216268
// minTLSVersion is used to specify the minimal version of the TLS protocol
217269
// that is negotiated during the TLS handshake. For example, to use TLS
218270
// versions 1.1, 1.2 and 1.3 (yaml):
@@ -283,6 +335,12 @@ var TLSProfiles = map[TLSProfileType]*TLSProfileSpec{
283335
"AES256-SHA",
284336
"DES-CBC3-SHA",
285337
},
338+
Curves: []TLSCurve{
339+
TLSCurveX25519,
340+
TLSCurveP256,
341+
TLSCurveP384,
342+
TLSCurveX25519MLKEM768,
343+
},
286344
MinTLSVersion: VersionTLS10,
287345
},
288346
TLSProfileIntermediateType: {
@@ -299,6 +357,12 @@ var TLSProfiles = map[TLSProfileType]*TLSProfileSpec{
299357
"DHE-RSA-AES128-GCM-SHA256",
300358
"DHE-RSA-AES256-GCM-SHA384",
301359
},
360+
Curves: []TLSCurve{
361+
TLSCurveX25519,
362+
TLSCurveP256,
363+
TLSCurveP384,
364+
TLSCurveX25519MLKEM768,
365+
},
302366
MinTLSVersion: VersionTLS12,
303367
},
304368
TLSProfileModernType: {
@@ -307,6 +371,12 @@ var TLSProfiles = map[TLSProfileType]*TLSProfileSpec{
307371
"TLS_AES_256_GCM_SHA384",
308372
"TLS_CHACHA20_POLY1305_SHA256",
309373
},
374+
Curves: []TLSCurve{
375+
TLSCurveX25519,
376+
TLSCurveP256,
377+
TLSCurveP384,
378+
TLSCurveX25519MLKEM768,
379+
},
310380
MinTLSVersion: VersionTLS13,
311381
},
312382
}

‎config/v1/zz_generated.crd-manifests/0000_10_config-operator_01_apiservers-CustomNoUpgrade.crd.yaml‎

Lines changed: 32 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -330,6 +330,38 @@ spec:
330330
type: string
331331
type: array
332332
x-kubernetes-list-type: atomic
333+
curves:
334+
description: "curves is used to specify the elliptic curves
335+
that are used during\nthe TLS handshake. Operators may
336+
remove entries their operands do\nnot support.\n\nTLSProfiles
337+
Old, Intermediate, Modern are including by default the following\ncurves:
338+
X25519, P-256, P-384, X25519MLKEM768\nTLSProfiles Custom
339+
do not include any curves by default.\nNOTE: since this
340+
field is optional, if no curves are specified, the default
341+
curves\nused by the underlying TLS library will be used.\n\nFor
342+
example, to use X25519 and P-256 (yaml):\n\n# Example: Force
343+
PQC-only encryption\napiVersion: config.openshift.io/v1\nkind:
344+
APIServer\nspec:\n tlsSecurityProfile:\n type: Custom\n
345+
\ custom:\n ciphers:\n\t - TLS_AES_128_GCM_SHA256\n
346+
\ - TLS_AES_256_GCM_SHA384\n - TLS_CHACHA20_POLY1305_SHA256\n
347+
\ curves:\n - X25519MLKEM768 # PQC-only: only
348+
hybrid quantum-resistant curve\n minTLSVersion: VersionTLS13"
349+
items:
350+
description: |-
351+
TLSCurve is a named curve identifier that can be used in TLSProfile.Curves.
352+
There is a one-to-one mapping between these names and the curve IDs defined
353+
in crypto/tls package based on IANA's "TLS Supported Groups" registry:
354+
https://www.iana.org/assignments/tls-parameters/tls-parameters.xhtml#tls-parameters-8
355+
enum:
356+
- X25519
357+
- P-256
358+
- P-384
359+
- P-521
360+
- X25519MLKEM768
361+
type: string
362+
maxItems: 5
363+
type: array
364+
x-kubernetes-list-type: atomic
333365
minTLSVersion:
334366
description: |-
335367
minTLSVersion is used to specify the minimal version of the TLS protocol

‎config/v1/zz_generated.crd-manifests/0000_10_config-operator_01_apiservers-Default.crd.yaml‎

Lines changed: 32 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -261,6 +261,38 @@ spec:
261261
type: string
262262
type: array
263263
x-kubernetes-list-type: atomic
264+
curves:
265+
description: "curves is used to specify the elliptic curves
266+
that are used during\nthe TLS handshake. Operators may
267+
remove entries their operands do\nnot support.\n\nTLSProfiles
268+
Old, Intermediate, Modern are including by default the following\ncurves:
269+
X25519, P-256, P-384, X25519MLKEM768\nTLSProfiles Custom
270+
do not include any curves by default.\nNOTE: since this
271+
field is optional, if no curves are specified, the default
272+
curves\nused by the underlying TLS library will be used.\n\nFor
273+
example, to use X25519 and P-256 (yaml):\n\n# Example: Force
274+
PQC-only encryption\napiVersion: config.openshift.io/v1\nkind:
275+
APIServer\nspec:\n tlsSecurityProfile:\n type: Custom\n
276+
\ custom:\n ciphers:\n\t - TLS_AES_128_GCM_SHA256\n
277+
\ - TLS_AES_256_GCM_SHA384\n - TLS_CHACHA20_POLY1305_SHA256\n
278+
\ curves:\n - X25519MLKEM768 # PQC-only: only
279+
hybrid quantum-resistant curve\n minTLSVersion: VersionTLS13"
280+
items:
281+
description: |-
282+
TLSCurve is a named curve identifier that can be used in TLSProfile.Curves.
283+
There is a one-to-one mapping between these names and the curve IDs defined
284+
in crypto/tls package based on IANA's "TLS Supported Groups" registry:
285+
https://www.iana.org/assignments/tls-parameters/tls-parameters.xhtml#tls-parameters-8
286+
enum:
287+
- X25519
288+
- P-256
289+
- P-384
290+
- P-521
291+
- X25519MLKEM768
292+
type: string
293+
maxItems: 5
294+
type: array
295+
x-kubernetes-list-type: atomic
264296
minTLSVersion:
265297
description: |-
266298
minTLSVersion is used to specify the minimal version of the TLS protocol

‎config/v1/zz_generated.crd-manifests/0000_10_config-operator_01_apiservers-DevPreviewNoUpgrade.crd.yaml‎

Lines changed: 32 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -330,6 +330,38 @@ spec:
330330
type: string
331331
type: array
332332
x-kubernetes-list-type: atomic
333+
curves:
334+
description: "curves is used to specify the elliptic curves
335+
that are used during\nthe TLS handshake. Operators may
336+
remove entries their operands do\nnot support.\n\nTLSProfiles
337+
Old, Intermediate, Modern are including by default the following\ncurves:
338+
X25519, P-256, P-384, X25519MLKEM768\nTLSProfiles Custom
339+
do not include any curves by default.\nNOTE: since this
340+
field is optional, if no curves are specified, the default
341+
curves\nused by the underlying TLS library will be used.\n\nFor
342+
example, to use X25519 and P-256 (yaml):\n\n# Example: Force
343+
PQC-only encryption\napiVersion: config.openshift.io/v1\nkind:
344+
APIServer\nspec:\n tlsSecurityProfile:\n type: Custom\n
345+
\ custom:\n ciphers:\n\t - TLS_AES_128_GCM_SHA256\n
346+
\ - TLS_AES_256_GCM_SHA384\n - TLS_CHACHA20_POLY1305_SHA256\n
347+
\ curves:\n - X25519MLKEM768 # PQC-only: only
348+
hybrid quantum-resistant curve\n minTLSVersion: VersionTLS13"
349+
items:
350+
description: |-
351+
TLSCurve is a named curve identifier that can be used in TLSProfile.Curves.
352+
There is a one-to-one mapping between these names and the curve IDs defined
353+
in crypto/tls package based on IANA's "TLS Supported Groups" registry:
354+
https://www.iana.org/assignments/tls-parameters/tls-parameters.xhtml#tls-parameters-8
355+
enum:
356+
- X25519
357+
- P-256
358+
- P-384
359+
- P-521
360+
- X25519MLKEM768
361+
type: string
362+
maxItems: 5
363+
type: array
364+
x-kubernetes-list-type: atomic
333365
minTLSVersion:
334366
description: |-
335367
minTLSVersion is used to specify the minimal version of the TLS protocol

‎config/v1/zz_generated.crd-manifests/0000_10_config-operator_01_apiservers-TechPreviewNoUpgrade.crd.yaml‎

Lines changed: 32 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -330,6 +330,38 @@ spec:
330330
type: string
331331
type: array
332332
x-kubernetes-list-type: atomic
333+
curves:
334+
description: "curves is used to specify the elliptic curves
335+
that are used during\nthe TLS handshake. Operators may
336+
remove entries their operands do\nnot support.\n\nTLSProfiles
337+
Old, Intermediate, Modern are including by default the following\ncurves:
338+
X25519, P-256, P-384, X25519MLKEM768\nTLSProfiles Custom
339+
do not include any curves by default.\nNOTE: since this
340+
field is optional, if no curves are specified, the default
341+
curves\nused by the underlying TLS library will be used.\n\nFor
342+
example, to use X25519 and P-256 (yaml):\n\n# Example: Force
343+
PQC-only encryption\napiVersion: config.openshift.io/v1\nkind:
344+
APIServer\nspec:\n tlsSecurityProfile:\n type: Custom\n
345+
\ custom:\n ciphers:\n\t - TLS_AES_128_GCM_SHA256\n
346+
\ - TLS_AES_256_GCM_SHA384\n - TLS_CHACHA20_POLY1305_SHA256\n
347+
\ curves:\n - X25519MLKEM768 # PQC-only: only
348+
hybrid quantum-resistant curve\n minTLSVersion: VersionTLS13"
349+
items:
350+
description: |-
351+
TLSCurve is a named curve identifier that can be used in TLSProfile.Curves.
352+
There is a one-to-one mapping between these names and the curve IDs defined
353+
in crypto/tls package based on IANA's "TLS Supported Groups" registry:
354+
https://www.iana.org/assignments/tls-parameters/tls-parameters.xhtml#tls-parameters-8
355+
enum:
356+
- X25519
357+
- P-256
358+
- P-384
359+
- P-521
360+
- X25519MLKEM768
361+
type: string
362+
maxItems: 5
363+
type: array
364+
x-kubernetes-list-type: atomic
333365
minTLSVersion:
334366
description: |-
335367
minTLSVersion is used to specify the minimal version of the TLS protocol

‎config/v1/zz_generated.deepcopy.go‎

Lines changed: 5 additions & 0 deletions
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

‎config/v1/zz_generated.featuregated-crd-manifests/apiservers.config.openshift.io/AAA_ungated.yaml‎

Lines changed: 32 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -261,6 +261,38 @@ spec:
261261
type: string
262262
type: array
263263
x-kubernetes-list-type: atomic
264+
curves:
265+
description: "curves is used to specify the elliptic curves
266+
that are used during\nthe TLS handshake. Operators may
267+
remove entries their operands do\nnot support.\n\nTLSProfiles
268+
Old, Intermediate, Modern are including by default the following\ncurves:
269+
X25519, P-256, P-384, X25519MLKEM768\nTLSProfiles Custom
270+
do not include any curves by default.\nNOTE: since this
271+
field is optional, if no curves are specified, the default
272+
curves\nused by the underlying TLS library will be used.\n\nFor
273+
example, to use X25519 and P-256 (yaml):\n\n# Example: Force
274+
PQC-only encryption\napiVersion: config.openshift.io/v1\nkind:
275+
APIServer\nspec:\n tlsSecurityProfile:\n type: Custom\n
276+
\ custom:\n ciphers:\n\t - TLS_AES_128_GCM_SHA256\n
277+
\ - TLS_AES_256_GCM_SHA384\n - TLS_CHACHA20_POLY1305_SHA256\n
278+
\ curves:\n - X25519MLKEM768 # PQC-only: only
279+
hybrid quantum-resistant curve\n minTLSVersion: VersionTLS13"
280+
items:
281+
description: |-
282+
TLSCurve is a named curve identifier that can be used in TLSProfile.Curves.
283+
There is a one-to-one mapping between these names and the curve IDs defined
284+
in crypto/tls package based on IANA's "TLS Supported Groups" registry:
285+
https://www.iana.org/assignments/tls-parameters/tls-parameters.xhtml#tls-parameters-8
286+
enum:
287+
- X25519
288+
- P-256
289+
- P-384
290+
- P-521
291+
- X25519MLKEM768
292+
type: string
293+
maxItems: 5
294+
type: array
295+
x-kubernetes-list-type: atomic
264296
minTLSVersion:
265297
description: |-
266298
minTLSVersion is used to specify the minimal version of the TLS protocol

‎config/v1/zz_generated.featuregated-crd-manifests/apiservers.config.openshift.io/KMSEncryptionProvider.yaml‎

Lines changed: 32 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -330,6 +330,38 @@ spec:
330330
type: string
331331
type: array
332332
x-kubernetes-list-type: atomic
333+
curves:
334+
description: "curves is used to specify the elliptic curves
335+
that are used during\nthe TLS handshake. Operators may
336+
remove entries their operands do\nnot support.\n\nTLSProfiles
337+
Old, Intermediate, Modern are including by default the following\ncurves:
338+
X25519, P-256, P-384, X25519MLKEM768\nTLSProfiles Custom
339+
do not include any curves by default.\nNOTE: since this
340+
field is optional, if no curves are specified, the default
341+
curves\nused by the underlying TLS library will be used.\n\nFor
342+
example, to use X25519 and P-256 (yaml):\n\n# Example: Force
343+
PQC-only encryption\napiVersion: config.openshift.io/v1\nkind:
344+
APIServer\nspec:\n tlsSecurityProfile:\n type: Custom\n
345+
\ custom:\n ciphers:\n\t - TLS_AES_128_GCM_SHA256\n
346+
\ - TLS_AES_256_GCM_SHA384\n - TLS_CHACHA20_POLY1305_SHA256\n
347+
\ curves:\n - X25519MLKEM768 # PQC-only: only
348+
hybrid quantum-resistant curve\n minTLSVersion: VersionTLS13"
349+
items:
350+
description: |-
351+
TLSCurve is a named curve identifier that can be used in TLSProfile.Curves.
352+
There is a one-to-one mapping between these names and the curve IDs defined
353+
in crypto/tls package based on IANA's "TLS Supported Groups" registry:
354+
https://www.iana.org/assignments/tls-parameters/tls-parameters.xhtml#tls-parameters-8
355+
enum:
356+
- X25519
357+
- P-256
358+
- P-384
359+
- P-521
360+
- X25519MLKEM768
361+
type: string
362+
maxItems: 5
363+
type: array
364+
x-kubernetes-list-type: atomic
333365
minTLSVersion:
334366
description: |-
335367
minTLSVersion is used to specify the minimal version of the TLS protocol

0 commit comments

Comments
 (0)