},
				}
			}
		}
	}
}

func defaultUpstreamCommonTLSContext() *tlsv3.CommonTlsContext {
	return &tlsv3.CommonTlsContext{
		TlsParams: &tlsv3.TlsParameters{
			// if not specified, envoy use TLSv1_2 as default for client.
			TlsMaximumProtocolVersion: tlsv3.TlsParameters_TLSv1_3,
			TlsMinimumProtocolVersion: tlsv3.TlsParameters_TLSv1_2,
		},
	}
}

package sds

import (
	"context"
	"fmt"
	"net"
	"os"
	"strings"
	"testing"

	cryptomb "github.com/envoyproxy/go-control-plane/contrib/envoy/extensions/private_key_providers/cryptomb/v3alpha"
	tlsv3 "github.com/envoyproxy/go-control-plane/envoy/extensions/transport_sockets/tls/v3"
	discovery "github.com/envoyproxy/go-control-plane/envoy/service/discovery/v3"
	"github.com/google/go-cmp/cmp"
	"google.golang.org/grpc"

	Port uint32
	// Mode is the mTLS  mode to use
	Mode model.MutualTLSMode
	// TCP describes the tls context to use for TCP filter chains
	TCP *tlsv3.DownstreamTlsContext
	// HTTP describes the tls context to use for HTTP filter chains
	HTTP *tlsv3.DownstreamTlsContext
}

var authnLog = log.RegisterScope("authn", "authn debugging")

// Implementation of authn.PolicyApplier with v1beta1 API.

------------------------

_2019-02-04_

Remove TLSv1.1 and TLSv1 from MODERN_TLS. Change COMPATIBLE_TLS to support all TLS versions.

##### RESTRICTED_TLS versions

* TLSv1.3
* TLSv1.2

##### MODERN_TLS versions

* TLSv1.3
* TLSv1.2
* **REMOVED:** ~~TLSv1.1~~
* **REMOVED:** ~~TLSv1~~

##### COMPATIBLE_TLS versions

* **NEW:** TLSv1.3
* **NEW:** TLSv1.2
* **NEW:** TLSv1.1
* TLSv1

[OkHttp 3.12][OkHttp312]

  // https://github.com/tlswg/tls13-spec/wiki/Implementations
  val urls =
    listOf(
      "https://enabled.tls13.com",
      "https://www.howsmyssl.com/a/check",
      "https://tls13.cloudflare.com",
      "https://www.allizom.org/robots.txt",
      "https://tls13.crypto.mozilla.org/",
      "https://tls.ctf.network/robots.txt",
      "https://rustls.jbp.io/",

 * [javax.net.ssl.SSLSocket.setEnabledProtocols].
 */
enum class TlsVersion(
  @get:JvmName("javaName") val javaName: String,
) {
  TLS_1_3("TLSv1.3"), // 2016.
  TLS_1_2("TLSv1.2"), // 2008.
  TLS_1_1("TLSv1.1"), // 2006.
  TLS_1_0("TLSv1"), // 1999.
  SSL_3_0("SSLv3"), // 1996.
  ;

  @JvmName("-deprecated_javaName")
  @Deprecated(
    message = "moved to val",

        "TrailingMessageData-TLS13-ServerCertificate-TLS": "TODO: first pass, this should be fixed",
        "ResumeTLS12SessionID-TLS13": "TODO: first pass, this should be fixed",
        "SkipEarlyData-TLS13": "TODO: first pass, this should be fixed",
        "DuplicateKeyShares-TLS13": "TODO: first pass, this should be fixed",

      PlatformVersion.majorVersion == 8 ->
        assertThat(s.enabledProtocols.toList()).contains(
          "TLSv1.2",
        )
      else ->
        assertThat(s.enabledProtocols.toList()).containsExactly(
          "TLSv1.3",
          "TLSv1.2",
          "TLSv1.1",
          "TLSv1",
        )
    }
  }

  @Test
  @Disabled
  fun testFacebook() {
    val sessionIds = mutableListOf<String>()

      socket.enabledCipherSuites,
    )
  }

  @Test
  fun applyIntersectionToProtocolVersion() {
    val socket = FakeSslSocket()
    socket.enabledProtocols = arrayOf("TLSv1", "TLSv1.1", "TLSv1.2")
    socket.supportedCipherSuites = arrayOf("TLS_A")
    socket.enabledCipherSuites = arrayOf("TLS_A")
    val connectionSpec =
      ConnectionSpec.Builder(true)

Filippo Valsorda <******@****.***> 1684936196 +0200