Jul 9, 2024 · Jul 8, 2024 · Jul 9, 2024 · Jul 9, 2024
diff --git a/.github/workflows/typos.toml b/.github/workflows/typos.toml
 Hashi = "Hashi"
 trialer = "trialer"
 encrypter = "encrypter"
 hel = "hel"             # as in helsinki
 pn = "pn"               # this is used as proto node
 # as in helsinki
 hel = "hel"
 # this is used as proto node
 pn = "pn"
 # typos doesn't like the EDE in TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA
 EDE = "EDE"

 [files]
 extend-exclude = [
diff --git a/cli/server.go b/cli/server.go
 return &cert, nil
 }

 // defaultCipherSuites is a list of safe cipher suites that we default to. This
 // is different from Golang's list of defaults, which unfortunately includes
 // `TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA`.
 var defaultCipherSuites = func() []uint16 {
 ret := []uint16{}

 for _, suite := range tls.CipherSuites() {
 ret = append(ret, suite.ID)
 }

 return ret
 }()

 // configureServerTLS returns the TLS config used for the Coderd server
 // connections to clients. A logger is passed in to allow printing warning
 // messages that do not block startup.
 return nil, err
 }
 tlsConfig.CipherSuites = cipherIDs
 } else {
 tlsConfig.CipherSuites = defaultCipherSuites
 }

 switch tlsClientAuth {
diff --git a/cli/server_internal_test.go b/cli/server_internal_test.go
 "github.com/coder/serpent"
 )

 func Test_configureServerTLS(t *testing.T) {
 t.Parallel()
 t.Run("DefaultNoInsecureCiphers", func(t *testing.T) {
 t.Parallel()
 logger := slogtest.Make(t, nil)
 cfg, err := configureServerTLS(context.Background(), logger, "tls12", "none", nil, nil, "", nil, false)
 require.NoError(t, err)

 require.NotEmpty(t, cfg)

 insecureCiphers := tls.InsecureCipherSuites()
 for _, cipher := range cfg.CipherSuites {
 for _, insecure := range insecureCiphers {
 if cipher == insecure.ID {
 t.Logf("Insecure cipher found by default: %s", insecure.Name)
 t.Fail()
 }
 }
 }
 })
 }

 func Test_configureCipherSuites(t *testing.T) {
 t.Parallel()
Original file line number	Diff line number	Diff line change
Expand Up		@@ -14,8 +14,12 @@ darcula = "darcula"
		Hashi = "Hashi"
		trialer = "trialer"
		encrypter = "encrypter"
		hel = "hel" # as in helsinki
		pn = "pn" # this is used as proto node
		# as in helsinki
		hel = "hel"
		# this is used as proto node
		pn = "pn"
		# typos doesn't like the EDE in TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA
		EDE = "EDE"

		[files]
		extend-exclude = [
Expand Down
Original file line number	Diff line number	Diff line change
Expand Up		@@ -1569,6 +1569,19 @@ func generateSelfSignedCertificate() (*tls.Certificate, error) {
		return &cert, nil
		}

		// defaultCipherSuites is a list of safe cipher suites that we default to. This
		// is different from Golang's list of defaults, which unfortunately includes
		// `TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA`.
		var defaultCipherSuites = func() []uint16 {
		ret := []uint16{}

		for _, suite := range tls.CipherSuites() {
		ret = append(ret, suite.ID)
		}

		return ret
		}()

		// configureServerTLS returns the TLS config used for the Coderd server
		// connections to clients. A logger is passed in to allow printing warning
		// messages that do not block startup.
Expand DownExpand Up		@@ -1599,6 +1612,8 @@ func configureServerTLS(ctx context.Context, logger slog.Logger, tlsMinVersion,
		return nil, err
		}
		tlsConfig.CipherSuites = cipherIDs
		} else {
		tlsConfig.CipherSuites = defaultCipherSuites
		}

		switch tlsClientAuth {
Expand Down
Original file line number	Diff line number	Diff line change
Expand Up		@@ -20,6 +20,28 @@ import (
		"github.com/coder/serpent"
		)

		func Test_configureServerTLS(t *testing.T) {
		t.Parallel()
		t.Run("DefaultNoInsecureCiphers", func(t *testing.T) {
		t.Parallel()
		logger := slogtest.Make(t, nil)
		cfg, err := configureServerTLS(context.Background(), logger, "tls12", "none", nil, nil, "", nil, false)
		require.NoError(t, err)

		require.NotEmpty(t, cfg)

		insecureCiphers := tls.InsecureCipherSuites()
		for _, cipher := range cfg.CipherSuites {
		for _, insecure := range insecureCiphers {
		if cipher == insecure.ID {
		t.Logf("Insecure cipher found by default: %s", insecure.Name)
		t.Fail()
		}
		}
		}
		})
		}

		func Test_configureCipherSuites(t *testing.T) {
		t.Parallel()

Expand Down