Docker/portainer
Docker/portainer
1
0
Fork 0
mirror of https://github.com/portainer/portainer.git synced 2025-08-05 05:45:22 +02:00
Code Issues Releases Activity

fix(tls): centralize the TLS configuration to ensure FIPS compliance BE-11979 (#960)

Browse source
This commit is contained in:
andres-portainer 2025-08-01 22:23:59 -03:00 • committed by GitHub
parent 3eab294908
commit 163aa57e5c
25 changed files with 454 additions and 112 deletions
Download patch file Download diff file Expand all files Collapse all files

11
api/stacks/deployments/deploy.go
View file

@ -2,7 +2,6 @@ package deployments
import (
"cmp"
"crypto/tls"
"fmt"
"strconv"
"time"
@ -215,13 +214,9 @@ func isEnvironmentOnline(endpoint *portainer.Endpoint) bool {
return true
}
var err error
var tlsConfig *tls.Config
if endpoint.TLSConfig.TLS {
tlsConfig, err = crypto.CreateTLSConfigurationFromDisk(endpoint.TLSConfig.TLSCACertPath, endpoint.TLSConfig.TLSCertPath, endpoint.TLSConfig.TLSKeyPath, endpoint.TLSConfig.TLSSkipVerify)
if err != nil {
return false
}
tlsConfig, err := crypto.CreateTLSConfigurationFromDisk(endpoint.TLSConfig)
if err != nil {
return false
}
_, _, err = agent.GetAgentVersionAndPlatform(endpoint.URL, tlsConfig)

6
api/stacks/deployments/deploy_test.go
View file

@ -10,6 +10,7 @@ import (
"testing"
portainer "github.com/portainer/portainer/api"
"github.com/portainer/portainer/api/crypto"
"github.com/portainer/portainer/api/datastore"
gittypes "github.com/portainer/portainer/api/git/types"
"github.com/portainer/portainer/api/internal/testhelpers"
@ -127,9 +128,8 @@ func agentServer(t *testing.T) string {
cert, err := tls.X509KeyPair([]byte(localhostCert), []byte(localhostKey))
require.NoError(t, err)
tlsConfig := &tls.Config{
Certificates: []tls.Certificate{cert},
}
tlsConfig := crypto.CreateTLSConfiguration()
tlsConfig.Certificates = []tls.Certificate{cert}
l, err := tls.Listen("tcp", "127.0.0.1:0", tlsConfig)
require.NoError(t, err)