add new elbv2 ssl protocols, add scripts to automatically generate (b…

…ut not insert) them
localstack · Nov 10, 2023 · 92645fd · 92645fd
1 parent 0b84eec
commit 92645fd
Show file tree

Hide file tree

Showing 2 changed files with 278 additions and 21 deletions.
diff --git a/moto/elbv2/responses.py b/moto/elbv2/responses.py
@@ -7,7 +7,6 @@
 
 SSL_POLICIES = [
     {
-        "name": "ELBSecurityPolicy-2016-08",
         "ssl_protocols": ["TLSv1", "TLSv1.1", "TLSv1.2"],
         "ciphers": [
             {"name": "ECDHE-ECDSA-AES128-GCM-SHA256", "priority": 1},
@@ -29,9 +28,150 @@
             {"name": "AES256-SHA256", "priority": 17},
             {"name": "AES256-SHA", "priority": 18},
         ],
+        "name": "ELBSecurityPolicy-2016-08",
+    },
+    {
+        "ssl_protocols": ["TLSv1.2", "TLSv1.3"],
+        "ciphers": [
+            {"name": "TLS_AES_128_GCM_SHA256", "priority": 1},
+            {"name": "TLS_AES_256_GCM_SHA384", "priority": 2},
+            {"name": "TLS_CHACHA20_POLY1305_SHA256", "priority": 3},
+            {"name": "ECDHE-ECDSA-AES128-GCM-SHA256", "priority": 4},
+            {"name": "ECDHE-RSA-AES128-GCM-SHA256", "priority": 5},
+            {"name": "ECDHE-ECDSA-AES128-SHA256", "priority": 6},
+            {"name": "ECDHE-RSA-AES128-SHA256", "priority": 7},
+            {"name": "ECDHE-ECDSA-AES256-GCM-SHA384", "priority": 8},
+            {"name": "ECDHE-RSA-AES256-GCM-SHA384", "priority": 9},
+            {"name": "ECDHE-ECDSA-AES256-SHA384", "priority": 10},
+            {"name": "ECDHE-RSA-AES256-SHA384", "priority": 11},
+        ],
+        "name": "ELBSecurityPolicy-TLS13-1-2-2021-06",
+    },
+    {
+        "ssl_protocols": ["TLSv1.2", "TLSv1.3"],
+        "ciphers": [
+            {"name": "TLS_AES_128_GCM_SHA256", "priority": 1},
+            {"name": "TLS_AES_256_GCM_SHA384", "priority": 2},
+            {"name": "TLS_CHACHA20_POLY1305_SHA256", "priority": 3},
+            {"name": "ECDHE-ECDSA-AES128-GCM-SHA256", "priority": 4},
+            {"name": "ECDHE-RSA-AES128-GCM-SHA256", "priority": 5},
+            {"name": "ECDHE-ECDSA-AES256-GCM-SHA384", "priority": 6},
+            {"name": "ECDHE-RSA-AES256-GCM-SHA384", "priority": 7},
+        ],
+        "name": "ELBSecurityPolicy-TLS13-1-2-Res-2021-06",
+    },
+    {
+        "ssl_protocols": ["TLSv1.2", "TLSv1.3"],
+        "ciphers": [
+            {"name": "TLS_AES_128_GCM_SHA256", "priority": 1},
+            {"name": "TLS_AES_256_GCM_SHA384", "priority": 2},
+            {"name": "TLS_CHACHA20_POLY1305_SHA256", "priority": 3},
+            {"name": "ECDHE-ECDSA-AES128-GCM-SHA256", "priority": 4},
+            {"name": "ECDHE-RSA-AES128-GCM-SHA256", "priority": 5},
+            {"name": "ECDHE-ECDSA-AES128-SHA256", "priority": 6},
+            {"name": "ECDHE-RSA-AES128-SHA256", "priority": 7},
+            {"name": "ECDHE-ECDSA-AES256-GCM-SHA384", "priority": 8},
+            {"name": "ECDHE-RSA-AES256-GCM-SHA384", "priority": 9},
+            {"name": "ECDHE-ECDSA-AES256-SHA384", "priority": 10},
+            {"name": "ECDHE-RSA-AES256-SHA384", "priority": 11},
+            {"name": "AES128-GCM-SHA256", "priority": 12},
+            {"name": "AES128-SHA256", "priority": 13},
+            {"name": "AES256-GCM-SHA384", "priority": 14},
+            {"name": "AES256-SHA256", "priority": 15},
+        ],
+        "name": "ELBSecurityPolicy-TLS13-1-2-Ext1-2021-06",
+    },
+    {
+        "ssl_protocols": ["TLSv1.2", "TLSv1.3"],
+        "ciphers": [
+            {"name": "TLS_AES_128_GCM_SHA256", "priority": 1},
+            {"name": "TLS_AES_256_GCM_SHA384", "priority": 2},
+            {"name": "TLS_CHACHA20_POLY1305_SHA256", "priority": 3},
+            {"name": "ECDHE-ECDSA-AES128-GCM-SHA256", "priority": 4},
+            {"name": "ECDHE-RSA-AES128-GCM-SHA256", "priority": 5},
+            {"name": "ECDHE-ECDSA-AES128-SHA256", "priority": 6},
+            {"name": "ECDHE-RSA-AES128-SHA256", "priority": 7},
+            {"name": "ECDHE-ECDSA-AES128-SHA", "priority": 8},
+            {"name": "ECDHE-RSA-AES128-SHA", "priority": 9},
+            {"name": "ECDHE-ECDSA-AES256-GCM-SHA384", "priority": 10},
+            {"name": "ECDHE-RSA-AES256-GCM-SHA384", "priority": 11},
+            {"name": "ECDHE-ECDSA-AES256-SHA384", "priority": 12},
+            {"name": "ECDHE-RSA-AES256-SHA384", "priority": 13},
+            {"name": "ECDHE-ECDSA-AES256-SHA", "priority": 14},
+            {"name": "ECDHE-RSA-AES256-SHA", "priority": 15},
+            {"name": "AES128-GCM-SHA256", "priority": 16},
+            {"name": "AES128-SHA256", "priority": 17},
+            {"name": "AES128-SHA", "priority": 18},
+            {"name": "AES256-GCM-SHA384", "priority": 19},
+            {"name": "AES256-SHA256", "priority": 20},
+            {"name": "AES256-SHA", "priority": 21},
+        ],
+        "name": "ELBSecurityPolicy-TLS13-1-2-Ext2-2021-06",
+    },
+    {
+        "ssl_protocols": ["TLSv1.1", "TLSv1.2", "TLSv1.3"],
+        "ciphers": [
+            {"name": "TLS_AES_128_GCM_SHA256", "priority": 1},
+            {"name": "TLS_AES_256_GCM_SHA384", "priority": 2},
+            {"name": "TLS_CHACHA20_POLY1305_SHA256", "priority": 3},
+            {"name": "ECDHE-ECDSA-AES128-GCM-SHA256", "priority": 4},
+            {"name": "ECDHE-RSA-AES128-GCM-SHA256", "priority": 5},
+            {"name": "ECDHE-ECDSA-AES128-SHA256", "priority": 6},
+            {"name": "ECDHE-RSA-AES128-SHA256", "priority": 7},
+            {"name": "ECDHE-ECDSA-AES128-SHA", "priority": 8},
+            {"name": "ECDHE-RSA-AES128-SHA", "priority": 9},
+            {"name": "ECDHE-ECDSA-AES256-GCM-SHA384", "priority": 10},
+            {"name": "ECDHE-RSA-AES256-GCM-SHA384", "priority": 11},
+            {"name": "ECDHE-ECDSA-AES256-SHA384", "priority": 12},
+            {"name": "ECDHE-RSA-AES256-SHA384", "priority": 13},
+            {"name": "ECDHE-RSA-AES256-SHA", "priority": 14},
+            {"name": "ECDHE-ECDSA-AES256-SHA", "priority": 15},
+            {"name": "AES128-GCM-SHA256", "priority": 16},
+            {"name": "AES128-SHA256", "priority": 17},
+            {"name": "AES128-SHA", "priority": 18},
+            {"name": "AES256-GCM-SHA384", "priority": 19},
+            {"name": "AES256-SHA256", "priority": 20},
+            {"name": "AES256-SHA", "priority": 21},
+        ],
+        "name": "ELBSecurityPolicy-TLS13-1-1-2021-06",
+    },
+    {
+        "ssl_protocols": ["TLSv1", "TLSv1.1", "TLSv1.2", "TLSv1.3"],
+        "ciphers": [
+            {"name": "TLS_AES_128_GCM_SHA256", "priority": 1},
+            {"name": "TLS_AES_256_GCM_SHA384", "priority": 2},
+            {"name": "TLS_CHACHA20_POLY1305_SHA256", "priority": 3},
+            {"name": "ECDHE-ECDSA-AES128-GCM-SHA256", "priority": 4},
+            {"name": "ECDHE-RSA-AES128-GCM-SHA256", "priority": 5},
+            {"name": "ECDHE-ECDSA-AES128-SHA256", "priority": 6},
+            {"name": "ECDHE-RSA-AES128-SHA256", "priority": 7},
+            {"name": "ECDHE-ECDSA-AES128-SHA", "priority": 8},
+            {"name": "ECDHE-RSA-AES128-SHA", "priority": 9},
+            {"name": "ECDHE-ECDSA-AES256-GCM-SHA384", "priority": 10},
+            {"name": "ECDHE-RSA-AES256-GCM-SHA384", "priority": 11},
+            {"name": "ECDHE-ECDSA-AES256-SHA384", "priority": 12},
+            {"name": "ECDHE-RSA-AES256-SHA384", "priority": 13},
+            {"name": "ECDHE-RSA-AES256-SHA", "priority": 14},
+            {"name": "ECDHE-ECDSA-AES256-SHA", "priority": 15},
+            {"name": "AES128-GCM-SHA256", "priority": 16},
+            {"name": "AES128-SHA256", "priority": 17},
+            {"name": "AES128-SHA", "priority": 18},
+            {"name": "AES256-GCM-SHA384", "priority": 19},
+            {"name": "AES256-SHA256", "priority": 20},
+            {"name": "AES256-SHA", "priority": 21},
+        ],
+        "name": "ELBSecurityPolicy-TLS13-1-0-2021-06",
+    },
+    {
+        "ssl_protocols": ["TLSv1.3"],
+        "ciphers": [
+            {"name": "TLS_AES_128_GCM_SHA256", "priority": 1},
+            {"name": "TLS_AES_256_GCM_SHA384", "priority": 2},
+            {"name": "TLS_CHACHA20_POLY1305_SHA256", "priority": 3},
+        ],
+        "name": "ELBSecurityPolicy-TLS13-1-3-2021-06",
     },
     {
-        "name": "ELBSecurityPolicy-TLS-1-2-2017-01",
         "ssl_protocols": ["TLSv1.2"],
         "ciphers": [
             {"name": "ECDHE-ECDSA-AES128-GCM-SHA256", "priority": 1},
@@ -47,9 +187,9 @@
             {"name": "AES256-GCM-SHA384", "priority": 11},
             {"name": "AES256-SHA256", "priority": 12},
         ],
+        "name": "ELBSecurityPolicy-TLS-1-2-2017-01",
     },
     {
-        "name": "ELBSecurityPolicy-TLS-1-1-2017-01",
         "ssl_protocols": ["TLSv1.1", "TLSv1.2"],
         "ciphers": [
             {"name": "ECDHE-ECDSA-AES128-GCM-SHA256", "priority": 1},
@@ -71,9 +211,51 @@
             {"name": "AES256-SHA256", "priority": 17},
             {"name": "AES256-SHA", "priority": 18},
         ],
+        "name": "ELBSecurityPolicy-TLS-1-1-2017-01",
+    },
+    {
+        "ssl_protocols": ["TLSv1.2"],
+        "ciphers": [
+            {"name": "ECDHE-ECDSA-AES128-GCM-SHA256", "priority": 1},
+            {"name": "ECDHE-RSA-AES128-GCM-SHA256", "priority": 2},
+            {"name": "ECDHE-ECDSA-AES128-SHA256", "priority": 3},
+            {"name": "ECDHE-RSA-AES128-SHA256", "priority": 4},
+            {"name": "ECDHE-ECDSA-AES128-SHA", "priority": 5},
+            {"name": "ECDHE-RSA-AES128-SHA", "priority": 6},
+            {"name": "ECDHE-ECDSA-AES256-GCM-SHA384", "priority": 7},
+            {"name": "ECDHE-RSA-AES256-GCM-SHA384", "priority": 8},
+            {"name": "ECDHE-ECDSA-AES256-SHA384", "priority": 9},
+            {"name": "ECDHE-RSA-AES256-SHA384", "priority": 10},
+            {"name": "ECDHE-RSA-AES256-SHA", "priority": 11},
+            {"name": "ECDHE-ECDSA-AES256-SHA", "priority": 12},
+            {"name": "AES128-GCM-SHA256", "priority": 13},
+            {"name": "AES128-SHA256", "priority": 14},
+            {"name": "AES128-SHA", "priority": 15},
+            {"name": "AES256-GCM-SHA384", "priority": 16},
+            {"name": "AES256-SHA256", "priority": 17},
+            {"name": "AES256-SHA", "priority": 18},
+        ],
+        "name": "ELBSecurityPolicy-TLS-1-2-Ext-2018-06",
+    },
+    {
+        "ssl_protocols": ["TLSv1", "TLSv1.1", "TLSv1.2"],
+        "ciphers": [
+            {"name": "ECDHE-ECDSA-AES128-GCM-SHA256", "priority": 1},
+            {"name": "ECDHE-RSA-AES128-GCM-SHA256", "priority": 2},
+            {"name": "ECDHE-ECDSA-AES128-SHA256", "priority": 3},
+            {"name": "ECDHE-RSA-AES128-SHA256", "priority": 4},
+            {"name": "ECDHE-ECDSA-AES128-SHA", "priority": 5},
+            {"name": "ECDHE-RSA-AES128-SHA", "priority": 6},
+            {"name": "ECDHE-ECDSA-AES256-GCM-SHA384", "priority": 7},
+            {"name": "ECDHE-RSA-AES256-GCM-SHA384", "priority": 8},
+            {"name": "ECDHE-ECDSA-AES256-SHA384", "priority": 9},
+            {"name": "ECDHE-RSA-AES256-SHA384", "priority": 10},
+            {"name": "ECDHE-RSA-AES256-SHA", "priority": 11},
+            {"name": "ECDHE-ECDSA-AES256-SHA", "priority": 12},
+        ],
+        "name": "ELBSecurityPolicy-FS-2018-06",
     },
     {
-        "name": "ELBSecurityPolicy-2015-05",
         "ssl_protocols": ["TLSv1", "TLSv1.1", "TLSv1.2"],
         "ciphers": [
             {"name": "ECDHE-ECDSA-AES128-GCM-SHA256", "priority": 1},
@@ -95,9 +277,9 @@
             {"name": "AES256-SHA256", "priority": 17},
             {"name": "AES256-SHA", "priority": 18},
         ],
+        "name": "ELBSecurityPolicy-2015-05",
     },
     {
-        "name": "ELBSecurityPolicy-TLS-1-0-2015-04",
         "ssl_protocols": ["TLSv1", "TLSv1.1", "TLSv1.2"],
         "ciphers": [
             {"name": "ECDHE-ECDSA-AES128-GCM-SHA256", "priority": 1},
@@ -120,33 +302,67 @@
             {"name": "AES256-SHA", "priority": 18},
             {"name": "DES-CBC3-SHA", "priority": 19},
         ],
+        "name": "ELBSecurityPolicy-TLS-1-0-2015-04",
     },
     {
-        "name": "ELBSecurityPolicy-FS-1-2-Res-2020-10",
         "ssl_protocols": ["TLSv1.2"],
         "ciphers": [
             {"name": "ECDHE-ECDSA-AES128-GCM-SHA256", "priority": 1},
             {"name": "ECDHE-RSA-AES128-GCM-SHA256", "priority": 2},
-            {"name": "ECDHE-ECDSA-AES256-GCM-SHA384", "priority": 3},
-            {"name": "ECDHE-RSA-AES256-GCM-SHA384", "priority": 4},
+            {"name": "ECDHE-ECDSA-AES128-SHA256", "priority": 3},
+            {"name": "ECDHE-RSA-AES128-SHA256", "priority": 4},
+            {"name": "ECDHE-ECDSA-AES256-GCM-SHA384", "priority": 5},
+            {"name": "ECDHE-RSA-AES256-GCM-SHA384", "priority": 6},
+            {"name": "ECDHE-ECDSA-AES256-SHA384", "priority": 7},
+            {"name": "ECDHE-RSA-AES256-SHA384", "priority": 8},
         ],
+        "name": "ELBSecurityPolicy-FS-1-2-Res-2019-08",
     },
     {
-        "name": "ELBSecurityPolicy-TLS13-1-2-2021-06",
-        "ssl_protocols": ["TLSv1.2", "TLSv1.3"],
+        "ssl_protocols": ["TLSv1.1", "TLSv1.2"],
         "ciphers": [
-            {"name": "TLS_AES_128_GCM_SHA256", "priority": 1},
-            {"name": "TLS_AES_256_GCM_SHA384", "priority": 2},
-            {"name": "TLS_CHACHA20_POLY1305_SHA256", "priority": 3},
-            {"name": "ECDHE-ECDSA-AES128-GCM-SHA256", "priority": 4},
-            {"name": "ECDHE-RSA-AES128-GCM-SHA256", "priority": 5},
-            {"name": "ECDHE-ECDSA-AES128-SHA256", "priority": 6},
-            {"name": "ECDHE-RSA-AES128-SHA256", "priority": 7},
-            {"name": "ECDHE-ECDSA-AES256-GCM-SHA384", "priority": 8},
-            {"name": "ECDHE-RSA-AES256-GCM-SHA384", "priority": 9},
-            {"name": "ECDHE-ECDSA-AES256-SHA384", "priority": 10},
-            {"name": "ECDHE-RSA-AES256-SHA384", "priority": 11},
+            {"name": "ECDHE-ECDSA-AES128-GCM-SHA256", "priority": 1},
+            {"name": "ECDHE-RSA-AES128-GCM-SHA256", "priority": 2},
+            {"name": "ECDHE-ECDSA-AES128-SHA256", "priority": 3},
+            {"name": "ECDHE-RSA-AES128-SHA256", "priority": 4},
+            {"name": "ECDHE-ECDSA-AES128-SHA", "priority": 5},
+            {"name": "ECDHE-RSA-AES128-SHA", "priority": 6},
+            {"name": "ECDHE-ECDSA-AES256-GCM-SHA384", "priority": 7},
+            {"name": "ECDHE-RSA-AES256-GCM-SHA384", "priority": 8},
+            {"name": "ECDHE-ECDSA-AES256-SHA384", "priority": 9},
+            {"name": "ECDHE-RSA-AES256-SHA384", "priority": 10},
+            {"name": "ECDHE-RSA-AES256-SHA", "priority": 11},
+            {"name": "ECDHE-ECDSA-AES256-SHA", "priority": 12},
         ],
+        "name": "ELBSecurityPolicy-FS-1-1-2019-08",
+    },
+    {
+        "ssl_protocols": ["TLSv1.2"],
+        "ciphers": [
+            {"name": "ECDHE-ECDSA-AES128-GCM-SHA256", "priority": 1},
+            {"name": "ECDHE-RSA-AES128-GCM-SHA256", "priority": 2},
+            {"name": "ECDHE-ECDSA-AES128-SHA256", "priority": 3},
+            {"name": "ECDHE-RSA-AES128-SHA256", "priority": 4},
+            {"name": "ECDHE-ECDSA-AES128-SHA", "priority": 5},
+            {"name": "ECDHE-RSA-AES128-SHA", "priority": 6},
+            {"name": "ECDHE-ECDSA-AES256-GCM-SHA384", "priority": 7},
+            {"name": "ECDHE-RSA-AES256-GCM-SHA384", "priority": 8},
+            {"name": "ECDHE-ECDSA-AES256-SHA384", "priority": 9},
+            {"name": "ECDHE-RSA-AES256-SHA384", "priority": 10},
+            {"name": "ECDHE-RSA-AES256-SHA", "priority": 11},
+            {"name": "ECDHE-ECDSA-AES256-SHA", "priority": 12},
+        ],
+        "name": "ELBSecurityPolicy-FS-1-2-2019-08",
+    },
+    {
+        "ssl_protocols": ["TLSv1.2"],
+        "ciphers": [
+            {"name": "ECDHE-ECDSA-AES128-GCM-SHA256", "priority": 1},
+            {"name": "ECDHE-RSA-AES128-GCM-SHA256", "priority": 2},
+            {"name": "ECDHE-ECDSA-AES256-GCM-SHA384", "priority": 3},
+            {"name": "ECDHE-RSA-AES256-GCM-SHA384", "priority": 4},
+        ],
+        "name": "ELBSecurityPolicy-FS-1-2-Res-2020-10",
     },
 ]
 

diff --git a/scripts/update_ssl_policies.py b/scripts/update_ssl_policies.py
@@ -0,0 +1,41 @@
+#!/bin/bash
+import json
+
+import boto3
+import re
+
+CAMEL_CASE_PATTERN = re.compile(r"(?<!^)(?=[A-Z])")
+
+KEY_BLACKLIST = ["SupportedLoadBalancerTypes"]
+
+def camel_case_to_snake_case(name: str):
+    return CAMEL_CASE_PATTERN.sub("_", name).lower()
+
+
+def get_ssl_elb_ssl_policies():
+    elbv2_client = boto3.client("elbv2")
+    return elbv2_client.describe_ssl_policies()["SslPolicies"]
+
+
+def transform_policies(ssl_policies: dict):
+    if isinstance(ssl_policies, list):
+        return [transform_policies(item) for item in ssl_policies]
+    if not isinstance(ssl_policies, dict):
+        return ssl_policies
+    result = {}
+    for key, value in ssl_policies.items():
+        if key in KEY_BLACKLIST:
+            continue
+        new_key = camel_case_to_snake_case(key)
+        result[new_key] = transform_policies(value)
+    return result
+
+
+def main():
+    policies = get_ssl_elb_ssl_policies()
+    transformed_policies = transform_policies(policies)
+    print(json.dumps(transformed_policies, indent=4))
+
+
+if __name__ == "__main__":
+    main()