From 1f793335a78931ae3c15ced7b1a70ffaac403e74 Mon Sep 17 00:00:00 2001 From: Hongkai Liu Date: Fri, 29 May 2026 11:02:33 -0400 Subject: [PATCH 1/2] EnforcesSecuritySettings deprecates SecureTLSConfig The returned value of `SecureTLSConfig` seems redundant, and it is not clear from its description how to use the function: `SecureTLSConfig(config)` or `config:=SecureTLSConfig(config)` (they are equivalent with the current implementation). The intention of the returned value is not explained either in the commit [1] where it was introduced. This pull makes it clear by introducing a new function `EnforcesSecuritySettings` whose name comes from the description. I believe I should not modify the signature of any existing functions to avoid breaking changes. [1]. https://github.com/openshift/library-go/commit/699695d1217317b048d53dc99b1a6b4edcc27e67 --- pkg/crypto/crypto.go | 8 +++++++- 1 file changed, 7 insertions(+), 1 deletion(-) diff --git a/pkg/crypto/crypto.go b/pkg/crypto/crypto.go index be0337b900..df8638e7fb 100644 --- a/pkg/crypto/crypto.go +++ b/pkg/crypto/crypto.go @@ -309,7 +309,14 @@ func DefaultCiphers() []uint16 { } // SecureTLSConfig enforces the default minimum security settings for the cluster. +// Deprecated: use EnforcesSecuritySettings instead. func SecureTLSConfig(config *tls.Config) *tls.Config { + EnforcesSecuritySettings(config) + return config +} + +// EnforcesSecuritySettings enforces the default minimum security settings for the cluster on the given TLS config. +func EnforcesSecuritySettings(config *tls.Config) { if config.MinVersion == 0 { config.MinVersion = DefaultTLSVersion() } @@ -318,7 +325,6 @@ func SecureTLSConfig(config *tls.Config) *tls.Config { if len(config.CipherSuites) == 0 { config.CipherSuites = DefaultCiphers() } - return config } // OpenSSLToIANACipherSuites maps input OpenSSL Cipher Suite names to their From cb8b4fe8978860975a0d7566146ede9d2766a2fa Mon Sep 17 00:00:00 2001 From: Hongkai Liu Date: Fri, 29 May 2026 11:08:41 -0400 Subject: [PATCH 2/2] Do not modify tls.Config's PreferServerCipherSuites With go1.25.0 [1], `PreferServerCipherSuites` has no effect. ``` // PreferServerCipherSuites is a legacy field and has no effect. // // It used to control whether the server would follow the client's or the // server's preference. Servers now select the best mutually supported // cipher suite based on logic that takes into account inferred client // hardware, server hardware, and security. // // Deprecated: PreferServerCipherSuites is ignored. PreferServerCipherSuites bool ``` lib-go uses Go 1.25.0 at the comment. https://github.com/openshift/library-go/blob/c7d432293c132035eb34b61c409b37f756ed2e6e/go.mod#L3 [1]. https://pkg.go.dev/crypto/tls@go1.25.0 --- pkg/crypto/crypto.go | 1 - 1 file changed, 1 deletion(-) diff --git a/pkg/crypto/crypto.go b/pkg/crypto/crypto.go index df8638e7fb..bb32061c25 100644 --- a/pkg/crypto/crypto.go +++ b/pkg/crypto/crypto.go @@ -321,7 +321,6 @@ func EnforcesSecuritySettings(config *tls.Config) { config.MinVersion = DefaultTLSVersion() } - config.PreferServerCipherSuites = true if len(config.CipherSuites) == 0 { config.CipherSuites = DefaultCiphers() }