diff --git a/moto/elbv2/responses.py b/moto/elbv2/responses.py index 2cfc49c7b5a4..b57778c5d448 100644 --- a/moto/elbv2/responses.py +++ b/moto/elbv2/responses.py @@ -7,7 +7,6 @@ SSL_POLICIES = [ { - "name": "ELBSecurityPolicy-2016-08", "ssl_protocols": ["TLSv1", "TLSv1.1", "TLSv1.2"], "ciphers": [ {"name": "ECDHE-ECDSA-AES128-GCM-SHA256", "priority": 1}, @@ -29,9 +28,150 @@ {"name": "AES256-SHA256", "priority": 17}, {"name": "AES256-SHA", "priority": 18}, ], + "name": "ELBSecurityPolicy-2016-08", + }, + { + "ssl_protocols": ["TLSv1.2", "TLSv1.3"], + "ciphers": [ + {"name": "TLS_AES_128_GCM_SHA256", "priority": 1}, + {"name": "TLS_AES_256_GCM_SHA384", "priority": 2}, + {"name": "TLS_CHACHA20_POLY1305_SHA256", "priority": 3}, + {"name": "ECDHE-ECDSA-AES128-GCM-SHA256", "priority": 4}, + {"name": "ECDHE-RSA-AES128-GCM-SHA256", "priority": 5}, + {"name": "ECDHE-ECDSA-AES128-SHA256", "priority": 6}, + {"name": "ECDHE-RSA-AES128-SHA256", "priority": 7}, + {"name": "ECDHE-ECDSA-AES256-GCM-SHA384", "priority": 8}, + {"name": "ECDHE-RSA-AES256-GCM-SHA384", "priority": 9}, + {"name": "ECDHE-ECDSA-AES256-SHA384", "priority": 10}, + {"name": "ECDHE-RSA-AES256-SHA384", "priority": 11}, + ], + "name": "ELBSecurityPolicy-TLS13-1-2-2021-06", + }, + { + "ssl_protocols": ["TLSv1.2", "TLSv1.3"], + "ciphers": [ + {"name": "TLS_AES_128_GCM_SHA256", "priority": 1}, + {"name": "TLS_AES_256_GCM_SHA384", "priority": 2}, + {"name": "TLS_CHACHA20_POLY1305_SHA256", "priority": 3}, + {"name": "ECDHE-ECDSA-AES128-GCM-SHA256", "priority": 4}, + {"name": "ECDHE-RSA-AES128-GCM-SHA256", "priority": 5}, + {"name": "ECDHE-ECDSA-AES256-GCM-SHA384", "priority": 6}, + {"name": "ECDHE-RSA-AES256-GCM-SHA384", "priority": 7}, + ], + "name": "ELBSecurityPolicy-TLS13-1-2-Res-2021-06", + }, + { + "ssl_protocols": ["TLSv1.2", "TLSv1.3"], + "ciphers": [ + {"name": "TLS_AES_128_GCM_SHA256", "priority": 1}, + {"name": "TLS_AES_256_GCM_SHA384", "priority": 2}, + {"name": "TLS_CHACHA20_POLY1305_SHA256", "priority": 3}, + {"name": "ECDHE-ECDSA-AES128-GCM-SHA256", "priority": 4}, + {"name": "ECDHE-RSA-AES128-GCM-SHA256", "priority": 5}, + {"name": "ECDHE-ECDSA-AES128-SHA256", "priority": 6}, + {"name": "ECDHE-RSA-AES128-SHA256", "priority": 7}, + {"name": "ECDHE-ECDSA-AES256-GCM-SHA384", "priority": 8}, + {"name": "ECDHE-RSA-AES256-GCM-SHA384", "priority": 9}, + {"name": "ECDHE-ECDSA-AES256-SHA384", "priority": 10}, + {"name": "ECDHE-RSA-AES256-SHA384", "priority": 11}, + {"name": "AES128-GCM-SHA256", "priority": 12}, + {"name": "AES128-SHA256", "priority": 13}, + {"name": "AES256-GCM-SHA384", "priority": 14}, + {"name": "AES256-SHA256", "priority": 15}, + ], + "name": "ELBSecurityPolicy-TLS13-1-2-Ext1-2021-06", + }, + { + "ssl_protocols": ["TLSv1.2", "TLSv1.3"], + "ciphers": [ + {"name": "TLS_AES_128_GCM_SHA256", "priority": 1}, + {"name": "TLS_AES_256_GCM_SHA384", "priority": 2}, + {"name": "TLS_CHACHA20_POLY1305_SHA256", "priority": 3}, + {"name": "ECDHE-ECDSA-AES128-GCM-SHA256", "priority": 4}, + {"name": "ECDHE-RSA-AES128-GCM-SHA256", "priority": 5}, + {"name": "ECDHE-ECDSA-AES128-SHA256", "priority": 6}, + {"name": "ECDHE-RSA-AES128-SHA256", "priority": 7}, + {"name": "ECDHE-ECDSA-AES128-SHA", "priority": 8}, + {"name": "ECDHE-RSA-AES128-SHA", "priority": 9}, + {"name": "ECDHE-ECDSA-AES256-GCM-SHA384", "priority": 10}, + {"name": "ECDHE-RSA-AES256-GCM-SHA384", "priority": 11}, + {"name": "ECDHE-ECDSA-AES256-SHA384", "priority": 12}, + {"name": "ECDHE-RSA-AES256-SHA384", "priority": 13}, + {"name": "ECDHE-ECDSA-AES256-SHA", "priority": 14}, + {"name": "ECDHE-RSA-AES256-SHA", "priority": 15}, + {"name": "AES128-GCM-SHA256", "priority": 16}, + {"name": "AES128-SHA256", "priority": 17}, + {"name": "AES128-SHA", "priority": 18}, + {"name": "AES256-GCM-SHA384", "priority": 19}, + {"name": "AES256-SHA256", "priority": 20}, + {"name": "AES256-SHA", "priority": 21}, + ], + "name": "ELBSecurityPolicy-TLS13-1-2-Ext2-2021-06", + }, + { + "ssl_protocols": ["TLSv1.1", "TLSv1.2", "TLSv1.3"], + "ciphers": [ + {"name": "TLS_AES_128_GCM_SHA256", "priority": 1}, + {"name": "TLS_AES_256_GCM_SHA384", "priority": 2}, + {"name": "TLS_CHACHA20_POLY1305_SHA256", "priority": 3}, + {"name": "ECDHE-ECDSA-AES128-GCM-SHA256", "priority": 4}, + {"name": "ECDHE-RSA-AES128-GCM-SHA256", "priority": 5}, + {"name": "ECDHE-ECDSA-AES128-SHA256", "priority": 6}, + {"name": "ECDHE-RSA-AES128-SHA256", "priority": 7}, + {"name": "ECDHE-ECDSA-AES128-SHA", "priority": 8}, + {"name": "ECDHE-RSA-AES128-SHA", "priority": 9}, + {"name": "ECDHE-ECDSA-AES256-GCM-SHA384", "priority": 10}, + {"name": "ECDHE-RSA-AES256-GCM-SHA384", "priority": 11}, + {"name": "ECDHE-ECDSA-AES256-SHA384", "priority": 12}, + {"name": "ECDHE-RSA-AES256-SHA384", "priority": 13}, + {"name": "ECDHE-RSA-AES256-SHA", "priority": 14}, + {"name": "ECDHE-ECDSA-AES256-SHA", "priority": 15}, + {"name": "AES128-GCM-SHA256", "priority": 16}, + {"name": "AES128-SHA256", "priority": 17}, + {"name": "AES128-SHA", "priority": 18}, + {"name": "AES256-GCM-SHA384", "priority": 19}, + {"name": "AES256-SHA256", "priority": 20}, + {"name": "AES256-SHA", "priority": 21}, + ], + "name": "ELBSecurityPolicy-TLS13-1-1-2021-06", + }, + { + "ssl_protocols": ["TLSv1", "TLSv1.1", "TLSv1.2", "TLSv1.3"], + "ciphers": [ + {"name": "TLS_AES_128_GCM_SHA256", "priority": 1}, + {"name": "TLS_AES_256_GCM_SHA384", "priority": 2}, + {"name": "TLS_CHACHA20_POLY1305_SHA256", "priority": 3}, + {"name": "ECDHE-ECDSA-AES128-GCM-SHA256", "priority": 4}, + {"name": "ECDHE-RSA-AES128-GCM-SHA256", "priority": 5}, + {"name": "ECDHE-ECDSA-AES128-SHA256", "priority": 6}, + {"name": "ECDHE-RSA-AES128-SHA256", "priority": 7}, + {"name": "ECDHE-ECDSA-AES128-SHA", "priority": 8}, + {"name": "ECDHE-RSA-AES128-SHA", "priority": 9}, + {"name": "ECDHE-ECDSA-AES256-GCM-SHA384", "priority": 10}, + {"name": "ECDHE-RSA-AES256-GCM-SHA384", "priority": 11}, + {"name": "ECDHE-ECDSA-AES256-SHA384", "priority": 12}, + {"name": "ECDHE-RSA-AES256-SHA384", "priority": 13}, + {"name": "ECDHE-RSA-AES256-SHA", "priority": 14}, + {"name": "ECDHE-ECDSA-AES256-SHA", "priority": 15}, + {"name": "AES128-GCM-SHA256", "priority": 16}, + {"name": "AES128-SHA256", "priority": 17}, + {"name": "AES128-SHA", "priority": 18}, + {"name": "AES256-GCM-SHA384", "priority": 19}, + {"name": "AES256-SHA256", "priority": 20}, + {"name": "AES256-SHA", "priority": 21}, + ], + "name": "ELBSecurityPolicy-TLS13-1-0-2021-06", + }, + { + "ssl_protocols": ["TLSv1.3"], + "ciphers": [ + {"name": "TLS_AES_128_GCM_SHA256", "priority": 1}, + {"name": "TLS_AES_256_GCM_SHA384", "priority": 2}, + {"name": "TLS_CHACHA20_POLY1305_SHA256", "priority": 3}, + ], + "name": "ELBSecurityPolicy-TLS13-1-3-2021-06", }, { - "name": "ELBSecurityPolicy-TLS-1-2-2017-01", "ssl_protocols": ["TLSv1.2"], "ciphers": [ {"name": "ECDHE-ECDSA-AES128-GCM-SHA256", "priority": 1}, @@ -47,9 +187,9 @@ {"name": "AES256-GCM-SHA384", "priority": 11}, {"name": "AES256-SHA256", "priority": 12}, ], + "name": "ELBSecurityPolicy-TLS-1-2-2017-01", }, { - "name": "ELBSecurityPolicy-TLS-1-1-2017-01", "ssl_protocols": ["TLSv1.1", "TLSv1.2"], "ciphers": [ {"name": "ECDHE-ECDSA-AES128-GCM-SHA256", "priority": 1}, @@ -71,9 +211,51 @@ {"name": "AES256-SHA256", "priority": 17}, {"name": "AES256-SHA", "priority": 18}, ], + "name": "ELBSecurityPolicy-TLS-1-1-2017-01", + }, + { + "ssl_protocols": ["TLSv1.2"], + "ciphers": [ + {"name": "ECDHE-ECDSA-AES128-GCM-SHA256", "priority": 1}, + {"name": "ECDHE-RSA-AES128-GCM-SHA256", "priority": 2}, + {"name": "ECDHE-ECDSA-AES128-SHA256", "priority": 3}, + {"name": "ECDHE-RSA-AES128-SHA256", "priority": 4}, + {"name": "ECDHE-ECDSA-AES128-SHA", "priority": 5}, + {"name": "ECDHE-RSA-AES128-SHA", "priority": 6}, + {"name": "ECDHE-ECDSA-AES256-GCM-SHA384", "priority": 7}, + {"name": "ECDHE-RSA-AES256-GCM-SHA384", "priority": 8}, + {"name": "ECDHE-ECDSA-AES256-SHA384", "priority": 9}, + {"name": "ECDHE-RSA-AES256-SHA384", "priority": 10}, + {"name": "ECDHE-RSA-AES256-SHA", "priority": 11}, + {"name": "ECDHE-ECDSA-AES256-SHA", "priority": 12}, + {"name": "AES128-GCM-SHA256", "priority": 13}, + {"name": "AES128-SHA256", "priority": 14}, + {"name": "AES128-SHA", "priority": 15}, + {"name": "AES256-GCM-SHA384", "priority": 16}, + {"name": "AES256-SHA256", "priority": 17}, + {"name": "AES256-SHA", "priority": 18}, + ], + "name": "ELBSecurityPolicy-TLS-1-2-Ext-2018-06", + }, + { + "ssl_protocols": ["TLSv1", "TLSv1.1", "TLSv1.2"], + "ciphers": [ + {"name": "ECDHE-ECDSA-AES128-GCM-SHA256", "priority": 1}, + {"name": "ECDHE-RSA-AES128-GCM-SHA256", "priority": 2}, + {"name": "ECDHE-ECDSA-AES128-SHA256", "priority": 3}, + {"name": "ECDHE-RSA-AES128-SHA256", "priority": 4}, + {"name": "ECDHE-ECDSA-AES128-SHA", "priority": 5}, + {"name": "ECDHE-RSA-AES128-SHA", "priority": 6}, + {"name": "ECDHE-ECDSA-AES256-GCM-SHA384", "priority": 7}, + {"name": "ECDHE-RSA-AES256-GCM-SHA384", "priority": 8}, + {"name": "ECDHE-ECDSA-AES256-SHA384", "priority": 9}, + {"name": "ECDHE-RSA-AES256-SHA384", "priority": 10}, + {"name": "ECDHE-RSA-AES256-SHA", "priority": 11}, + {"name": "ECDHE-ECDSA-AES256-SHA", "priority": 12}, + ], + "name": "ELBSecurityPolicy-FS-2018-06", }, { - "name": "ELBSecurityPolicy-2015-05", "ssl_protocols": ["TLSv1", "TLSv1.1", "TLSv1.2"], "ciphers": [ {"name": "ECDHE-ECDSA-AES128-GCM-SHA256", "priority": 1}, @@ -95,9 +277,9 @@ {"name": "AES256-SHA256", "priority": 17}, {"name": "AES256-SHA", "priority": 18}, ], + "name": "ELBSecurityPolicy-2015-05", }, { - "name": "ELBSecurityPolicy-TLS-1-0-2015-04", "ssl_protocols": ["TLSv1", "TLSv1.1", "TLSv1.2"], "ciphers": [ {"name": "ECDHE-ECDSA-AES128-GCM-SHA256", "priority": 1}, @@ -120,33 +302,67 @@ {"name": "AES256-SHA", "priority": 18}, {"name": "DES-CBC3-SHA", "priority": 19}, ], + "name": "ELBSecurityPolicy-TLS-1-0-2015-04", }, { - "name": "ELBSecurityPolicy-FS-1-2-Res-2020-10", "ssl_protocols": ["TLSv1.2"], "ciphers": [ {"name": "ECDHE-ECDSA-AES128-GCM-SHA256", "priority": 1}, {"name": "ECDHE-RSA-AES128-GCM-SHA256", "priority": 2}, - {"name": "ECDHE-ECDSA-AES256-GCM-SHA384", "priority": 3}, - {"name": "ECDHE-RSA-AES256-GCM-SHA384", "priority": 4}, + {"name": "ECDHE-ECDSA-AES128-SHA256", "priority": 3}, + {"name": "ECDHE-RSA-AES128-SHA256", "priority": 4}, + {"name": "ECDHE-ECDSA-AES256-GCM-SHA384", "priority": 5}, + {"name": "ECDHE-RSA-AES256-GCM-SHA384", "priority": 6}, + {"name": "ECDHE-ECDSA-AES256-SHA384", "priority": 7}, + {"name": "ECDHE-RSA-AES256-SHA384", "priority": 8}, ], + "name": "ELBSecurityPolicy-FS-1-2-Res-2019-08", }, { - "name": "ELBSecurityPolicy-TLS13-1-2-2021-06", - "ssl_protocols": ["TLSv1.2", "TLSv1.3"], + "ssl_protocols": ["TLSv1.1", "TLSv1.2"], "ciphers": [ - {"name": "TLS_AES_128_GCM_SHA256", "priority": 1}, - {"name": "TLS_AES_256_GCM_SHA384", "priority": 2}, - {"name": "TLS_CHACHA20_POLY1305_SHA256", "priority": 3}, - {"name": "ECDHE-ECDSA-AES128-GCM-SHA256", "priority": 4}, - {"name": "ECDHE-RSA-AES128-GCM-SHA256", "priority": 5}, - {"name": "ECDHE-ECDSA-AES128-SHA256", "priority": 6}, - {"name": "ECDHE-RSA-AES128-SHA256", "priority": 7}, - {"name": "ECDHE-ECDSA-AES256-GCM-SHA384", "priority": 8}, - {"name": "ECDHE-RSA-AES256-GCM-SHA384", "priority": 9}, - {"name": "ECDHE-ECDSA-AES256-SHA384", "priority": 10}, - {"name": "ECDHE-RSA-AES256-SHA384", "priority": 11}, + {"name": "ECDHE-ECDSA-AES128-GCM-SHA256", "priority": 1}, + {"name": "ECDHE-RSA-AES128-GCM-SHA256", "priority": 2}, + {"name": "ECDHE-ECDSA-AES128-SHA256", "priority": 3}, + {"name": "ECDHE-RSA-AES128-SHA256", "priority": 4}, + {"name": "ECDHE-ECDSA-AES128-SHA", "priority": 5}, + {"name": "ECDHE-RSA-AES128-SHA", "priority": 6}, + {"name": "ECDHE-ECDSA-AES256-GCM-SHA384", "priority": 7}, + {"name": "ECDHE-RSA-AES256-GCM-SHA384", "priority": 8}, + {"name": "ECDHE-ECDSA-AES256-SHA384", "priority": 9}, + {"name": "ECDHE-RSA-AES256-SHA384", "priority": 10}, + {"name": "ECDHE-RSA-AES256-SHA", "priority": 11}, + {"name": "ECDHE-ECDSA-AES256-SHA", "priority": 12}, ], + "name": "ELBSecurityPolicy-FS-1-1-2019-08", + }, + { + "ssl_protocols": ["TLSv1.2"], + "ciphers": [ + {"name": "ECDHE-ECDSA-AES128-GCM-SHA256", "priority": 1}, + {"name": "ECDHE-RSA-AES128-GCM-SHA256", "priority": 2}, + {"name": "ECDHE-ECDSA-AES128-SHA256", "priority": 3}, + {"name": "ECDHE-RSA-AES128-SHA256", "priority": 4}, + {"name": "ECDHE-ECDSA-AES128-SHA", "priority": 5}, + {"name": "ECDHE-RSA-AES128-SHA", "priority": 6}, + {"name": "ECDHE-ECDSA-AES256-GCM-SHA384", "priority": 7}, + {"name": "ECDHE-RSA-AES256-GCM-SHA384", "priority": 8}, + {"name": "ECDHE-ECDSA-AES256-SHA384", "priority": 9}, + {"name": "ECDHE-RSA-AES256-SHA384", "priority": 10}, + {"name": "ECDHE-RSA-AES256-SHA", "priority": 11}, + {"name": "ECDHE-ECDSA-AES256-SHA", "priority": 12}, + ], + "name": "ELBSecurityPolicy-FS-1-2-2019-08", + }, + { + "ssl_protocols": ["TLSv1.2"], + "ciphers": [ + {"name": "ECDHE-ECDSA-AES128-GCM-SHA256", "priority": 1}, + {"name": "ECDHE-RSA-AES128-GCM-SHA256", "priority": 2}, + {"name": "ECDHE-ECDSA-AES256-GCM-SHA384", "priority": 3}, + {"name": "ECDHE-RSA-AES256-GCM-SHA384", "priority": 4}, + ], + "name": "ELBSecurityPolicy-FS-1-2-Res-2020-10", }, ] diff --git a/scripts/update_ssl_policies.py b/scripts/update_ssl_policies.py new file mode 100755 index 000000000000..ea77d515b13d --- /dev/null +++ b/scripts/update_ssl_policies.py @@ -0,0 +1,41 @@ +#!/bin/bash +import json + +import boto3 +import re + +CAMEL_CASE_PATTERN = re.compile(r"(?