lzc256
/
tailscale
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

cmd/derper: record TLS versions used for requests. 

Surveying the fleet prior to turning off old/unused/insecure
TLS versions.

Updates tailscale/corp#3615

Signed-off-by: David Anderson <danderson@tailscale.com>
pull/3799/head
David Anderson 2022-01-21 14:07:40 -08:00 committed by Dave Anderson
parent 0ada42684b
commit ff3442d92d
1 changed files with 24 additions and 3 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

27
cmd/derper/derper.go
View File

@ -51,9 +51,11 @@ var (
) )
var ( var (
stats = new(metrics.Set) stats = new(metrics.Set)
stunDisposition = &metrics.LabelMap{Label: "disposition"} stunDisposition = &metrics.LabelMap{Label: "disposition"}
stunAddrFamily = &metrics.LabelMap{Label: "family"} stunAddrFamily = &metrics.LabelMap{Label: "family"}
tlsRequestVersion = &metrics.LabelMap{Label: "version"}
tlsActiveVersion = &metrics.LabelMap{Label: "version"}
stunReadError = stunDisposition.Get("read_error") stunReadError = stunDisposition.Get("read_error")
stunNotSTUN = stunDisposition.Get("not_stun") stunNotSTUN = stunDisposition.Get("not_stun")
@ -67,6 +69,8 @@ var (
func init() { func init() {
stats.Set("counter_requests", stunDisposition) stats.Set("counter_requests", stunDisposition)
stats.Set("counter_addrfamily", stunAddrFamily) stats.Set("counter_addrfamily", stunAddrFamily)
stats.Set("tls_request_version", tlsRequestVersion)
stats.Set("gauge_tls_active_version", tlsActiveVersion)
expvar.Publish("stun", stats) expvar.Publish("stun", stats)
} }
@ -238,6 +242,23 @@ func main() {
return cert, nil return cert, nil
} }
httpsrv.Handler = http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) { httpsrv.Handler = http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
if r.TLS != nil {
label := "unknown"
switch r.TLS.Version {
case tls.VersionTLS10:
label = "1.0"
case tls.VersionTLS11:
label = "1.1"
case tls.VersionTLS12:
label = "1.2"
case tls.VersionTLS13:
label = "1.3"
}
tlsRequestVersion.Add(label, 1)
tlsActiveVersion.Add(label, 1)
defer tlsActiveVersion.Add(label, -1)
}
// Set HTTP headers to appease automated security scanners. // Set HTTP headers to appease automated security scanners.
// //
// Security automation gets cranky when HTTPS sites don't // Security automation gets cranky when HTTPS sites don't