Skip to content

Commit 0756883

Browse files
gregcorbettgregcorbett
committed
ncm-metaconfig: Update tests with new SSL defaults
1 parent 6e9fc12 commit 0756883

File tree

11 files changed

+62
-23
lines changed

11 files changed

+62
-23
lines changed

‎ncm-metaconfig/src/main/metaconfig/httpd/2.2/tests/profiles/struct/basic_ssl.pan‎

Lines changed: 11 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -2,7 +2,17 @@ structure template struct/basic_ssl;
22

33
"options" = list("-OptRenegotiate", "+StrictRequire", "+StdEnvVars");
44
"engine" = true;
5-
"ciphersuite" = list("TLSv1");
5+
"ciphersuite" = list(
6+
"ECDHE-ECDSA-AES128-GCM-SHA256",
7+
"ECDHE-RSA-AES128-GCM-SHA256",
8+
"ECDHE-ECDSA-AES256-GCM-SHA384",
9+
"ECDHE-RSA-AES256-GCM-SHA384",
10+
"ECDHE-ECDSA-CHACHA20-POLY1305",
11+
"ECDHE-RSA-CHACHA20-POLY1305",
12+
"DHE-RSA-AES128-GCM-SHA256",
13+
"DHE-RSA-AES256-GCM-SHA384",
14+
"DHE-RSA-CHACHA20-POLY1305"
15+
);
616
"certificatefile" = "/etc/cert_file";
717
"certificatekeyfile" = "/etc/key_file";
818
"cacertificatefile" = "/etc/ca_file";

‎ncm-metaconfig/src/main/metaconfig/httpd/2.2/tests/profiles/struct/ssl_conf_el6.pan‎

Lines changed: 12 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -41,9 +41,19 @@ structure template struct/ssl_conf_el6;
4141

4242
"vhosts/base/ssl/engine" = true;
4343
# list("all", "-SSLv2") not allowed
44-
"vhosts/base/ssl/protocol" = list("TLSv1");
44+
"vhosts/base/ssl/protocol" = list("-all", "+TLSv1.2", "+TLSv1.3");
4545
# list("ALL", "!ADH", "!EXPORT", "!SSLv2", "RC4", "RSA", "+HIGH", "+MEDIUM", "+LOW")
46-
"vhosts/base/ssl/ciphersuite" = list("TLSv1");
46+
"vhosts/base/ssl/ciphersuite" = list(
47+
"ECDHE-ECDSA-AES128-GCM-SHA256",
48+
"ECDHE-RSA-AES128-GCM-SHA256",
49+
"ECDHE-ECDSA-AES256-GCM-SHA384",
50+
"ECDHE-RSA-AES256-GCM-SHA384",
51+
"ECDHE-ECDSA-CHACHA20-POLY1305",
52+
"ECDHE-RSA-CHACHA20-POLY1305",
53+
"DHE-RSA-AES128-GCM-SHA256",
54+
"DHE-RSA-AES256-GCM-SHA384",
55+
"DHE-RSA-CHACHA20-POLY1305"
56+
);
4757
"vhosts/base/ssl/certificatefile" = "/etc/pki/tls/certs/localhost.crt";
4858
"vhosts/base/ssl/certificatekeyfile" = "/etc/pki/tls/private/localhost.key";
4959

‎ncm-metaconfig/src/main/metaconfig/httpd/2.2/tests/regexps/graphite-web/base‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -11,10 +11,10 @@ multiline
1111
^\s{4}sslcacertificatefile /etc/pki/CA/certs/cachain.pem$
1212
^\s{4}sslcertificatefile /etc/pki/tls/certs/cert.pem$
1313
^\s{4}sslcertificatekeyfile /etc/pki/tls/private/key.pem$
14-
^\s{4}sslciphersuite TLSv1$
14+
^\s{4}sslciphersuite ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384:DHE-RSA-CHACHA20-POLY1305$
1515
^\s{4}sslengine on$
1616
^\s{4}ssloptions -OptRenegotiate \+StrictRequire \+StdEnvVars$
17-
^\s{4}sslprotocol TLSv1$
17+
^\s{4}sslprotocol -all \+TLSv1\.2 \+TLSv1\.3$
1818
^\s{4}setenvif User-Agent ".\*MSIE.\*" nokeepalive ssl-unclean-shutdown downgrade-1.0 force-response-1.0$
1919
^\s{4}alias /media/ /usr/lib/python2.6/site-packages/django/contrib/admin/media/$
2020
^\s{4}wsgiscriptalias / /usr/share/graphite/graphite-web.wsgi$

‎ncm-metaconfig/src/main/metaconfig/httpd/2.2/tests/regexps/ssl/value‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,4 @@
1-
Base test for ssl.conf EL6 config
1+
Base test for ssl.conf EL6 config
22
---
33
multiline
44
/etc/httpd/conf.d/ssl.conf
@@ -19,10 +19,10 @@ multiline
1919
^\s{4}sslcacertificatefile /etc/ca_file$
2020
^\s{4}sslcertificatefile /etc/pki/tls/certs/localhost.crt$
2121
^\s{4}sslcertificatekeyfile /etc/pki/tls/private/localhost.key$
22-
^\s{4}sslciphersuite TLSv1$
22+
^\s{4}sslciphersuite ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384:DHE-RSA-CHACHA20-POLY1305$
2323
^\s{4}sslengine on$
2424
^\s{4}ssloptions \-OptRenegotiate \+StrictRequire \+StdEnvVars$
25-
^\s{4}sslprotocol TLSv1$
25+
^\s{4}sslprotocol -all \+TLSv1\.2 \+TLSv1\.3$
2626
^\s{4}setenvif User-Agent "\.\*MSIE\.\*" nokeepalive ssl-unclean-shutdown downgrade-1.0 force-response-1.0$
2727
^\s{4}loglevel warn$
2828
^\s{4}errorlog logs/ssl_error_log$

‎ncm-metaconfig/src/main/metaconfig/httpd/2.2/tests/regexps/wsgi_conf/base‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -12,10 +12,10 @@ multiline
1212
^\s{4}sslcacertificatefile /etc/ca_file$
1313
^\s{4}sslcertificatefile /etc/cert_file$
1414
^\s{4}sslcertificatekeyfile /etc/key_file$
15-
^\s{4}sslciphersuite TLSv1$
15+
^\s{4}sslciphersuite ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384:DHE-RSA-CHACHA20-POLY1305$
1616
^\s{4}sslengine on$
1717
^\s{4}ssloptions -OptRenegotiate \+StrictRequire \+StdEnvVars$
18-
^\s{4}sslprotocol TLSv1$
18+
^\s{4}sslprotocol -all \+TLSv1\.2 \+TLSv1\.3$
1919
^\s{4}alias /django/static/ /var/www/django/static/$
2020
^\s{4}wsgiscriptalias /django /var/www/django/wsgi.py$
2121
^\s{4}wsgipassauthorization on$

‎ncm-metaconfig/src/main/metaconfig/httpd/2.4/tests/profiles/struct/basic_ssl.pan‎

Lines changed: 11 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -2,7 +2,17 @@ structure template struct/basic_ssl;
22

33
"options" = list("-OptRenegotiate", "+StrictRequire", "+StdEnvVars");
44
"engine" = true;
5-
"ciphersuite" = list("TLSv1");
5+
"ciphersuite" = list(
6+
"ECDHE-ECDSA-AES128-GCM-SHA256",
7+
"ECDHE-RSA-AES128-GCM-SHA256",
8+
"ECDHE-ECDSA-AES256-GCM-SHA384",
9+
"ECDHE-RSA-AES256-GCM-SHA384",
10+
"ECDHE-ECDSA-CHACHA20-POLY1305",
11+
"ECDHE-RSA-CHACHA20-POLY1305",
12+
"DHE-RSA-AES128-GCM-SHA256",
13+
"DHE-RSA-AES256-GCM-SHA384",
14+
"DHE-RSA-CHACHA20-POLY1305"
15+
);
616
"certificatefile" = "/etc/cert_file";
717
"certificatekeyfile" = "/etc/key_file";
818
"cacertificatefile" = "/etc/ca_file";

‎ncm-metaconfig/src/main/metaconfig/httpd/2.4/tests/profiles/struct/ssl_conf_el7.pan‎

Lines changed: 12 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -36,9 +36,19 @@ structure template struct/ssl_conf_el7;
3636

3737
"vhosts/base/ssl/engine" = true;
3838
# list("all", "-SSLv2") not allowed
39-
"vhosts/base/ssl/protocol" = list("TLSv1");
39+
"vhosts/base/ssl/protocol" = list("-all", "+TLSv1.2", "+TLSv1.3");
4040
# list("ALL", "!ADH", "!EXPORT", "!SSLv2", "RC4", "RSA", "+HIGH", "+MEDIUM", "+LOW")
41-
"vhosts/base/ssl/ciphersuite" = list("TLSv1");
41+
"vhosts/base/ssl/ciphersuite" = list(
42+
"ECDHE-ECDSA-AES128-GCM-SHA256",
43+
"ECDHE-RSA-AES128-GCM-SHA256",
44+
"ECDHE-ECDSA-AES256-GCM-SHA384",
45+
"ECDHE-RSA-AES256-GCM-SHA384",
46+
"ECDHE-ECDSA-CHACHA20-POLY1305",
47+
"ECDHE-RSA-CHACHA20-POLY1305",
48+
"DHE-RSA-AES128-GCM-SHA256",
49+
"DHE-RSA-AES256-GCM-SHA384",
50+
"DHE-RSA-CHACHA20-POLY1305"
51+
);
4252
"vhosts/base/ssl/certificatefile" = "/etc/pki/tls/certs/localhost.crt";
4353
"vhosts/base/ssl/certificatekeyfile" = "/etc/pki/tls/private/localhost.key";
4454

‎ncm-metaconfig/src/main/metaconfig/httpd/2.4/tests/regexps/davrods/base‎

Lines changed: 2 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -8,10 +8,10 @@ Base test for davrods.conf config
88
^\s{4}sslcacertificatefile /etc/pki/CA/certs/cachain.pem$
99
^\s{4}sslcertificatefile /etc/pki/tls/certs/cert.pem$
1010
^\s{4}sslcertificatekeyfile /etc/pki/tls/private/key.pem$
11-
^\s{4}sslciphersuite TLSv1$
11+
^\s{4}sslciphersuite ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384:DHE-RSA-CHACHA20-POLY1305$
1212
^\s{4}sslengine on$
1313
^\s{4}ssloptions -OptRenegotiate \+StrictRequire \+StdEnvVars$
14-
^\s{4}sslprotocol TLSv1$
14+
^\s{4}sslprotocol -all \+TLSv1\.2 \+TLSv1\.3$
1515
^\s{4}loglevel warn$
1616
^\s{4}errorlog logs/ssl_error_log$
1717
^\s{4}transferlog logs/ssl_access_log$
@@ -32,4 +32,3 @@ Base test for davrods.conf config
3232
^\s{8}directoryindex disabled$
3333
^\s{4}</location>$
3434
^</virtualhost>$
35-

‎ncm-metaconfig/src/main/metaconfig/httpd/2.4/tests/regexps/graphite-web/base‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -11,10 +11,10 @@ multiline
1111
^\s{4}sslcacertificatefile /etc/pki/CA/certs/cachain.pem$
1212
^\s{4}sslcertificatefile /etc/pki/tls/certs/cert.pem$
1313
^\s{4}sslcertificatekeyfile /etc/pki/tls/private/key.pem$
14-
^\s{4}sslciphersuite TLSv1$
14+
^\s{4}sslciphersuite ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384:DHE-RSA-CHACHA20-POLY1305$
1515
^\s{4}sslengine on$
1616
^\s{4}ssloptions -OptRenegotiate \+StrictRequire \+StdEnvVars$
17-
^\s{4}sslprotocol TLSv1$
17+
^\s{4}sslprotocol -all \+TLSv1\.2 \+TLSv1\.3$
1818
^\s{4}alias /media/ /usr/lib/python2.6/site-packages/django/contrib/admin/media/$
1919
^\s{4}wsgiscriptalias / /usr/share/graphite/graphite-web.wsgi$
2020
^\s{4}wsgiimportscript /usr/share/graphite/graphite-web.wsgi process-group=%\{GLOBAL\} application-group=%\{GLOBAL\}$

‎ncm-metaconfig/src/main/metaconfig/httpd/2.4/tests/regexps/ssl/value‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,4 @@
1-
Base test for ssl.conf EL6 config
1+
Base test for ssl.conf EL6 config
22
---
33
multiline
44
/etc/httpd/conf.d/ssl.conf
@@ -19,10 +19,10 @@ multiline
1919
^\s{4}sslcacertificatefile /etc/ca_file$
2020
^\s{4}sslcertificatefile /etc/pki/tls/certs/localhost.crt$
2121
^\s{4}sslcertificatekeyfile /etc/pki/tls/private/localhost.key$
22-
^\s{4}sslciphersuite TLSv1$
22+
^\s{4}sslciphersuite ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384:DHE-RSA-CHACHA20-POLY1305$
2323
^\s{4}sslengine on$
2424
^\s{4}ssloptions \-OptRenegotiate \+StrictRequire \+StdEnvVars$
25-
^\s{4}sslprotocol TLSv1$
25+
^\s{4}sslprotocol -all \+TLSv1\.2 \+TLSv1\.3$
2626
^\s{4}loglevel warn$
2727
^\s{4}errorlog logs/ssl_error_log$
2828
^\s{4}transferlog logs/ssl_access_log$

0 commit comments

Comments
 (0)