You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@pulsar.apache.org by mm...@apache.org on 2023/06/27 20:40:27 UTC
[pulsar-client-go] branch master updated: Allow user to specify TLS ciphers an min/max TLS version (#1041)
This is an automated email from the ASF dual-hosted git repository.
mmarshall pushed a commit to branch master
in repository https://gitbox.apache.org/repos/asf/pulsar-client-go.git
The following commit(s) were added to refs/heads/master by this push:
new 5f82516 Allow user to specify TLS ciphers an min/max TLS version (#1041)
5f82516 is described below
commit 5f825166530bdb89ae2cb785511092b98038d78e
Author: Don Inghram <do...@microfocus.com>
AuthorDate: Tue Jun 27 14:40:21 2023 -0600
Allow user to specify TLS ciphers an min/max TLS version (#1041)
---
pulsar/client.go | 9 +++++++++
pulsar/client_impl.go | 3 +++
pulsar/internal/connection.go | 6 ++++++
pulsar/internal/http_client.go | 3 +++
4 files changed, 21 insertions(+)
diff --git a/pulsar/client.go b/pulsar/client.go
index 7e6725d..d6f18c9 100644
--- a/pulsar/client.go
+++ b/pulsar/client.go
@@ -120,6 +120,15 @@ type ClientOptions struct {
// Configure whether the Pulsar client verify the validity of the host name from broker (default: false)
TLSValidateHostname bool
+ // TLSCipherSuites is a list of enabled TLS 1.0–1.2 cipher suites. See tls.Config CipherSuites for more information.
+ TLSCipherSuites []uint16
+
+ // TLSMinVersion contains the minimum TLS version that is acceptable. See tls.Config MinVersion for more information.
+ TLSMinVersion uint16
+
+ // TLSMaxVersion contains the maximum TLS version that is acceptable. See tls.Config MaxVersion for more information.
+ TLSMaxVersion uint16
+
// Configure the net model for vpc user to connect the pulsar broker
ListenerName string
diff --git a/pulsar/client_impl.go b/pulsar/client_impl.go
index 9b44987..c283f5a 100644
--- a/pulsar/client_impl.go
+++ b/pulsar/client_impl.go
@@ -91,6 +91,9 @@ func newClient(options ClientOptions) (Client, error) {
TrustCertsFilePath: options.TLSTrustCertsFilePath,
ValidateHostname: options.TLSValidateHostname,
ServerName: url.Hostname(),
+ CipherSuites: options.TLSCipherSuites,
+ MinVersion: options.TLSMinVersion,
+ MaxVersion: options.TLSMaxVersion,
}
default:
return nil, newError(InvalidConfiguration, fmt.Sprintf("Invalid URL scheme '%s'", url.Scheme))
diff --git a/pulsar/internal/connection.go b/pulsar/internal/connection.go
index 59aad16..1f80d20 100644
--- a/pulsar/internal/connection.go
+++ b/pulsar/internal/connection.go
@@ -50,6 +50,9 @@ type TLSOptions struct {
AllowInsecureConnection bool
ValidateHostname bool
ServerName string
+ CipherSuites []uint16
+ MinVersion uint16
+ MaxVersion uint16
}
var (
@@ -1046,6 +1049,9 @@ func (c *connection) closed() bool {
func (c *connection) getTLSConfig() (*tls.Config, error) {
tlsConfig := &tls.Config{
InsecureSkipVerify: c.tlsOptions.AllowInsecureConnection,
+ CipherSuites: c.tlsOptions.CipherSuites,
+ MinVersion: c.tlsOptions.MinVersion,
+ MaxVersion: c.tlsOptions.MaxVersion,
}
if c.tlsOptions.TrustCertsFilePath != "" {
diff --git a/pulsar/internal/http_client.go b/pulsar/internal/http_client.go
index 2d440d6..e68bd17 100644
--- a/pulsar/internal/http_client.go
+++ b/pulsar/internal/http_client.go
@@ -339,6 +339,9 @@ func getDefaultTransport(tlsConfig *TLSOptions) (http.RoundTripper, error) {
if tlsConfig != nil {
cfg := &tls.Config{
InsecureSkipVerify: tlsConfig.AllowInsecureConnection,
+ CipherSuites: tlsConfig.CipherSuites,
+ MinVersion: tlsConfig.MinVersion,
+ MaxVersion: tlsConfig.MaxVersion,
}
if len(tlsConfig.TrustCertsFilePath) > 0 {
rootCA, err := os.ReadFile(tlsConfig.TrustCertsFilePath)