curben
/
cloudflared-mirror
mirror of https://github.com/cloudflare/cloudflared.git
1
0
Fork 0
Code Issues Projects Releases Wiki Activity

TUN-8857: remove restriction for using FIPS and PQ 

## Summary

When the FIPS compliance was achieved with HTTP/2 Transport the technology at the time wasn't available or certified to be used in tandem with Post-Quantum encryption. Nowadays, that is possible, thus, we can also remove this restriction from Cloudflared.

 Closes TUN-8857
This commit is contained in:
Luis Neto 2025-01-30 05:47:07 -08:00
parent 31a870b291
commit 9695829e5b
3 changed files with 9 additions and 12 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
cmd/cloudflared/tunnel/cmd.go
View File

@ -31,7 +31,6 @@ import (
"github.com/cloudflare/cloudflared/credentials" "github.com/cloudflare/cloudflared/credentials"
"github.com/cloudflare/cloudflared/diagnostic" "github.com/cloudflare/cloudflared/diagnostic"
"github.com/cloudflare/cloudflared/edgediscovery" "github.com/cloudflare/cloudflared/edgediscovery"
"github.com/cloudflare/cloudflared/fips"
"github.com/cloudflare/cloudflared/ingress" "github.com/cloudflare/cloudflared/ingress"
"github.com/cloudflare/cloudflared/logger" "github.com/cloudflare/cloudflared/logger"
"github.com/cloudflare/cloudflared/management" "github.com/cloudflare/cloudflared/management"
@ -926,7 +925,6 @@ func tunnelFlags(shouldHide bool) []cli.Flag {
Usage: "When given creates an experimental post-quantum secure tunnel", Usage: "When given creates an experimental post-quantum secure tunnel",
Aliases: []string{"pq"}, Aliases: []string{"pq"},
EnvVars: []string{"TUNNEL_POST_QUANTUM"}, EnvVars: []string{"TUNNEL_POST_QUANTUM"},
Hidden: fips.IsFipsEnabled(),
}), }),
altsrc.NewBoolFlag(&cli.BoolFlag{ altsrc.NewBoolFlag(&cli.BoolFlag{
Name: "management-diagnostics", Name: "management-diagnostics",

5
cmd/cloudflared/tunnel/configuration.go
View File

@ -23,7 +23,6 @@ import (
"github.com/cloudflare/cloudflared/edgediscovery" "github.com/cloudflare/cloudflared/edgediscovery"
"github.com/cloudflare/cloudflared/edgediscovery/allregions" "github.com/cloudflare/cloudflared/edgediscovery/allregions"
"github.com/cloudflare/cloudflared/features" "github.com/cloudflare/cloudflared/features"
"github.com/cloudflare/cloudflared/fips"
"github.com/cloudflare/cloudflared/ingress" "github.com/cloudflare/cloudflared/ingress"
"github.com/cloudflare/cloudflared/orchestration" "github.com/cloudflare/cloudflared/orchestration"
"github.com/cloudflare/cloudflared/supervisor" "github.com/cloudflare/cloudflared/supervisor"
@ -125,10 +124,6 @@ func prepareTunnelConfig(
transportProtocol := c.String("protocol") transportProtocol := c.String("protocol")
if c.Bool("post-quantum") && fips.IsFipsEnabled() {
return nil, nil, fmt.Errorf("post-quantum not supported in FIPS mode")
}
featureSelector, err := features.NewFeatureSelector(ctx, namedTunnel.Credentials.AccountTag, c.StringSlice("features"), c.Bool("post-quantum"), log) featureSelector, err := features.NewFeatureSelector(ctx, namedTunnel.Credentials.AccountTag, c.StringSlice("features"), c.Bool("post-quantum"), log)
if err != nil { if err != nil {
return nil, nil, errors.Wrap(err, "Failed to create feature selector") return nil, nil, errors.Wrap(err, "Failed to create feature selector")

14
component-tests/test_pq.py
View File

@ -1,7 +1,6 @@
from util import LOGGER, nofips, start_cloudflared, wait_tunnel_ready from util import LOGGER, start_cloudflared, wait_tunnel_ready
@nofips
class TestPostQuantum: class TestPostQuantum:
def _extra_config(self): def _extra_config(self):
config = { config = {
@ -12,6 +11,11 @@ class TestPostQuantum:
def test_post_quantum(self, tmp_path, component_tests_config): def test_post_quantum(self, tmp_path, component_tests_config):
config = component_tests_config(self._extra_config()) config = component_tests_config(self._extra_config())
LOGGER.debug(config) LOGGER.debug(config)
with start_cloudflared(tmp_path, config, cfd_pre_args=["tunnel", "--ha-connections", "1"], cfd_args=["run", "--post-quantum"], new_process=True): with start_cloudflared(
wait_tunnel_ready(tunnel_url=config.get_url(), tmp_path,
require_min_connections=1) config,
cfd_pre_args=["tunnel", "--ha-connections", "1"],
cfd_args=["run", "--post-quantum"],
new_process=True,
):
wait_tunnel_ready(tunnel_url=config.get_url(), require_min_connections=1)