From 944993869240ba58beab8958a61dacf927706a68 Mon Sep 17 00:00:00 2001 From: Pawel Wieczorek Date: Fri, 20 Sep 2019 11:42:58 +0200 Subject: k8s: Validate API server crypto ciphers in use This patch verifies if CIS Kubernetes Benchmark v1.3.0 section regarding master node configuration is satisfied (1.1.30). It also covers its duplicate (1.1.39). Issue-ID: SECCOM-235 Change-Id: I0f3031c080cf225e7c2c03e65dd0bfc780326307 Signed-off-by: Pawel Wieczorek --- test/security/k8s/src/check/validators/master/api.go | 10 ++++++++++ 1 file changed, 10 insertions(+) (limited to 'test/security/k8s/src/check/validators/master/api.go') diff --git a/test/security/k8s/src/check/validators/master/api.go b/test/security/k8s/src/check/validators/master/api.go index 95a02d17d..ea0d9ece9 100644 --- a/test/security/k8s/src/check/validators/master/api.go +++ b/test/security/k8s/src/check/validators/master/api.go @@ -13,6 +13,11 @@ const ( auditLogAge = 30 auditLogBackups = 10 auditLogSize = 100 + + strongCryptoCiphers = "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM" + + "_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_AES_256_GCM" + + "_SHA384,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_ECDSA_WITH_AES_256_GCM" + + "_SHA384,TLS_RSA_WITH_AES_256_GCM_SHA384,TLS_RSA_WITH_AES_128_GCM_SHA256" ) // IsBasicAuthFileAbsent validates there is no basic authentication file specified. @@ -64,6 +69,11 @@ func IsServiceAccountLookupEnabled(params []string) bool { return hasSingleFlagArgument("--service-account-lookup=", "true", params) } +// IsStrongCryptoCipherInUse validates there is single "--tls-cipher-suites=" flag and it is set to strong crypto ciphers. +func IsStrongCryptoCipherInUse(params []string) bool { + return hasSingleFlagArgument("--tls-cipher-suites=", strongCryptoCiphers, params) +} + // hasSingleFlagArgument checks whether selected flag was used once and has requested argument. func hasSingleFlagArgument(flag string, argument string, params []string) bool { found := filterFlags(params, flag) -- cgit 1.2.3-korg