Add tls-min-version parameter

CHANGELOG.md

@@ -14,6 +14,8 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ### Added
 
+* Add new parameter to specify minimum TLS version [#1103](https://github.com/elastic/package-registry/pull/1103)
+
 ### Deprecated
 
 ### Known Issues

flags.go

@@ -5,29 +5,68 @@
 package main
 
 import (
+	"crypto/tls"
+	"errors"
 	"flag"
+	"fmt"
 	"os"
 	"strings"
 )
 
-func parseFlags() {
-	parseFlagSetWithArgs(flag.CommandLine, os.Args)
+var supportedTLSVersions map[string]uint16 = map[string]uint16{
+	"1.0": tls.VersionTLS10,
+	"1.1": tls.VersionTLS11,
+	"1.2": tls.VersionTLS12,
+	"1.3": tls.VersionTLS13,
 }
 
-func parseFlagSetWithArgs(flagSet *flag.FlagSet, args []string) {
-	flagsFromEnv(flagSet)
+type tlsMinVersionValue struct {
+	version     *string
+	versionCode *uint16
+}
+
+func (t tlsMinVersionValue) String() string {
+	if t.version != nil {
+		return *t.version
+	}
+	return ""
+}
+
+func (t tlsMinVersionValue) Set(s string) error {
+	if _, ok := supportedTLSVersions[s]; !ok {
+		return fmt.Errorf("unsupported TLS version: %s", s)
+	}
+	*t.version = s
+	*t.versionCode = supportedTLSVersions[s]
+	return nil
+}
+
+func parseFlags() error {
+	return parseFlagSetWithArgs(flag.CommandLine, os.Args)
+}
+
+func parseFlagSetWithArgs(flagSet *flag.FlagSet, args []string) error {
+	err := flagsFromEnv(flagSet)
+	if err != nil {
+		return err
+	}
 
 	// Skip args[0] as flag.Parse() does.
 	flagSet.Parse(args[1:])
+	return nil
 }
 
-func flagsFromEnv(flagSet *flag.FlagSet) {
+func flagsFromEnv(flagSet *flag.FlagSet) error {
+	var flagErrors error
 	flagSet.VisitAll(func(f *flag.Flag) {
 		envName := flagEnvName(f.Name)
 		if value, found := os.LookupEnv(envName); found {
-			f.Value.Set(value)
+			if err := f.Value.Set(value); err != nil {
+				flagErrors = errors.Join(flagErrors, fmt.Errorf("failed to set -%s: %v", f.Name, err))
+			}
 		}
 	})
+	return flagErrors
 }
 
 const flagEnvPrefix = "EPR_"

flags_test.go

@@ -36,7 +36,8 @@ func TestFlagsPrecedence(t *testing.T) {
 	require.Equal(t, "default", dummyFlag)
 
 	args := []string{"test", "-test-precedence-dummy=" + expected}
-	parseFlagSetWithArgs(flagSet, args)
+	err := parseFlagSetWithArgs(flagSet, args)
+	require.NoError(t, err)
 	require.Equal(t, expected, dummyFlag)
 }
 

main.go

@@ -6,6 +6,7 @@ package main
 
 import (
 	"context"
+	"crypto/tls"
 	"flag"
 	"fmt"
 	"log"
@@ -53,6 +54,9 @@ var (
 	tlsCertFile string
 	tlsKeyFile  string
 
+	tlsMinVersion     string
+	tlsMinVersionCode uint16
+
 	dryRun     bool
 	configPath string
 
@@ -83,6 +87,7 @@ func init() {
 	flag.StringVar(&logType, "log-type", util.DefaultLoggerType, "log type (ecs, dev)")
 	flag.StringVar(&tlsCertFile, "tls-cert", "", "Path of the TLS certificate.")
 	flag.StringVar(&tlsKeyFile, "tls-key", "", "Path of the TLS key.")
+	flag.Var(&tlsMinVersionValue{version: &tlsMinVersion, versionCode: &tlsMinVersionCode}, "tls-min-version", "Minimum version TLS supported.")
 	flag.StringVar(&configPath, "config", "config.yml", "Path to the configuration file.")
 	flag.StringVar(&httpProfAddress, "httpprof", "", "Enable HTTP profiler listening on the given address.")
 	// This flag is experimental and might be removed in the future or renamed
@@ -108,7 +113,16 @@ type Config struct {
 }
 
 func main() {
-	parseFlags()
+	err := parseFlags()
+	if err != nil {
+		log.Fatal(err)
+	}
+
+	if tlsMinVersion != "" {
+		if tlsCertFile == "" || tlsKeyFile == "" {
+			log.Fatalf("-tls-min-version set but missing TLS cert and key files (-tls-cert and -tls-key)")
+		}
+	}
 
 	if printVersionInfo {
 		fmt.Printf("Elastic Package Registry version %v\n", version)
@@ -241,7 +255,12 @@ func initServer(logger *zap.Logger, apmTracer *apm.Tracer, config *Config) *http
 	router := mustLoadRouter(logger, config, indexer)
 	apmgorilla.Instrument(router, apmgorilla.WithTracer(apmTracer))
 
-	return &http.Server{Addr: address, Handler: router}
+	if tlsMinVersion == "" {
+		return &http.Server{Addr: address, Handler: router}
+	}
+
+	TLSConfig := &tls.Config{MinVersion: tlsMinVersionCode}
+	return &http.Server{Addr: address, Handler: router, TLSConfig: TLSConfig}
 }
 
 func runServer(server *http.Server) error {