[pbs-devel] [PATCH proxmox-backup v3 1/4] config: add tls ciphers to NodeConfig

[Fabian Grünbichler]

On January 10, 2022 6:40 am, Dietmar Maurer wrote:
> Why do you use a different naming scheme here?
> 
> OPENSSL_CIPHER_LIST_REGEX vs. TLS_CIPHERSUITE_LIST_REGEX
> 
> What about the following:
> 
> TLS1_2_CIPHERSUITE_LIST_REGEX TLS1_3_CIPHERSUITE_LIST_REGEX
> 
> And why do the have different syntax at all??
> 
> Also, AFAIK there is no TLS version 2 or version 3 (its 1.2 and 1.3). So 
> "ciphers-tls2" and "ciphers-tls3" are a bit misleading.
> 
> Apache only has a single config called "SSLCipherSuite". Why do we need 
> two different configs?

we could do it like Apache[0] and have an optional prefix before the 
cipher spec indicating whether its for <= TLS 1.2 or for TLS 1.3, and 
allow specifying it multiple times - but that is not really less 
confusing than two parameters?

the contents are incompatible, openssl has different methods for setting 
them (with different semantics!), so having two parameters doesn't seem 
too bad..

I'll follow whatever the result of this discussion here is for my perl 
(PVE/PMG) series in any case ;)

> nginx also use a single config "ssl_ciphers"

but doesn't support TLS 1.3 cipher suites AFAICT (requiring a workaround 
of injecting them via a 'set arbitrary openssl.cnf parameters' nginx 
config parameter![1]).

0: https://httpd.apache.org/docs/trunk/mod/mod_ssl.html#sslciphersuite
1: https://trac.nginx.org/nginx/ticket/1529

> On 1/8/22 08:08, Hannes Laimer wrote:
>> diff --git a/pbs-api-types/src/lib.rs b/pbs-api-types/src/lib.rs
>> index 0a0dd33d..b4882064 100644
>> --- a/pbs-api-types/src/lib.rs
>> +++ b/pbs-api-types/src/lib.rs
>> @@ -124,6 +124,10 @@ const_regex! {
>>   
>>       pub FINGERPRINT_SHA256_REGEX = r"^(?:[0-9a-fA-F][0-9a-fA-F])(?::[0-9a-fA-F][0-9a-fA-F]){31}$";
>>   
>> +    pub OPENSSL_CIPHER_LIST_REGEX = r"^[A-Za-z0-9!\-+=@, :]+$";
>> +
>> +    pub TLS_CIPHERSUITE_LIST_REGEX = r"^[A-Za-z0-9_:]+$";
>> +
> 
> 
> _______________________________________________
> pbs-devel mailing list
> pbs-devel at lists.proxmox.com
> https://lists.proxmox.com/cgi-bin/mailman/listinfo/pbs-devel
> 
> 
>