Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

chore: configure and allow cipher suites (WPB-5448) #2233

Merged
merged 4 commits into from
Nov 17, 2023

Conversation

yamilmedina
Copy link
Contributor

@yamilmedina yamilmedina commented Nov 16, 2023


PR Submission Checklist for internal contributors

  • The PR Title

    • conforms to the style of semantic commits messages¹ supported in Wire's Github Workflow²
    • contains a reference JIRA issue number like SQPIT-764
    • answers the question: If merged, this PR will: ... ³
  • The PR Description

    • is free of optional paragraphs and you have filled the relevant parts to the best of your ability

What's new in this PR?

Issues

https://wearezeta.atlassian.net/browse/WPB-5448
Follow up of #2193

Causes (Optional)

Allowed list of specific cipher suites.

Solutions

Configure and add tests for the allowed cipher suites.

Testing

Test Coverage (Optional)

  • I have added automated test to this contribution

PR Post Submission Checklist for internal contributors (Optional)

  • Wire's Github Workflow has automatically linked the PR to a JIRA issue

PR Post Merge Checklist for internal contributors

  • If any soft of configuration variable was introduced by this PR, it has been added to the relevant documents and the CI jobs have been updated.

References
  1. https://sparkbox.com/foundry/semantic_commit_messages
  2. https://github.com/wireapp/.github#usage
  3. E.g. feat(conversation-list): Sort conversations by most emojis in the title #SQPIT-764.

@yamilmedina yamilmedina self-assigned this Nov 16, 2023
@yamilmedina yamilmedina requested review from a team, typfel, gongracr, alexandreferris, MohamadJaara and ohassine and removed request for a team November 16, 2023 15:44
Copy link
Contributor

github-actions bot commented Nov 16, 2023

Unit Test Results

   386 files   -   86     386 suites   - 86   8s ⏱️ - 2m 11s
2 028 tests  - 602  1 986 ✔️  - 540  42 💤  - 62  0 ±0 

Results for commit 151761f. ± Comparison against base commit 78a0841.

♻️ This comment has been updated with latest results.

@codecov-commenter
Copy link

codecov-commenter commented Nov 16, 2023

Codecov Report

Merging #2233 (151761f) into develop (78a0841) will decrease coverage by 0.01%.
The diff coverage is n/a.

Additional details and impacted files
@@              Coverage Diff              @@
##             develop    #2233      +/-   ##
=============================================
- Coverage      58.00%   58.00%   -0.01%     
  Complexity        21       21              
=============================================
  Files           1075     1075              
  Lines          40807    40807              
  Branches        3777     3777              
=============================================
- Hits           23671    23669       -2     
- Misses         15517    15518       +1     
- Partials        1619     1620       +1     

see 2 files with indirect coverage changes


Continue to review full report in Codecov by Sentry.

Legend - Click here to learn more
Δ = absolute <relative> (impact), ø = not affected, ? = missing data
Powered by Codecov. Last update 78a0841...151761f. Read the comment docs.

Comment on lines 129 to 133
.cipherSuites(
TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,
TLS_AES_128_GCM_SHA256,
TLS_AES_256_GCM_SHA384
)
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Question: the same okHttp is reused not only to connect to wire server but also to other servers (fetch custom e.g. server config), do we want to limit this change to only okhttp instances that are used to connect to wire servers?

Copy link
Contributor Author

@yamilmedina yamilmedina Nov 16, 2023

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Yes, that's the case, for custom and wire cloud, accordingly to the latest deployments in prod envs.
But anyway I will check if we are able to use a broader spectrum, just in case to be on the safer side.

Copy link
Member

@MohamadJaara MohamadJaara left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Approved for now, and we can later look into if this will affect other use cases

@datadog-wireapp
Copy link

datadog-wireapp bot commented Nov 16, 2023

Datadog Report

All test runs 2a76d22 🔗

2 Total Test Services: 0 Failed, 0 with New Flaky, 2 Passed

Test Services
Service Name Failed Known Flaky New Flaky Passed Skipped Wall Time Branch View
kalium-ios 0 0 0 1986 42 4m 23.08s Link
kalium-jvm 0 0 0 2526 104 8m 32.06s Link

@MohamadJaara MohamadJaara added this pull request to the merge queue Nov 17, 2023
Merged via the queue into develop with commit 21ae14c Nov 17, 2023
15 checks passed
@MohamadJaara MohamadJaara deleted the chore/allowed-cipher-suites branch November 17, 2023 09:41
@yamilmedina yamilmedina restored the chore/allowed-cipher-suites branch November 17, 2023 14:37
@yamilmedina yamilmedina deleted the chore/allowed-cipher-suites branch November 17, 2023 14:39
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Projects
None yet
Development

Successfully merging this pull request may close these issues.

4 participants