Skip to content

Commit de7c35a

Browse files
AkhtarAmirAkhtarAmir
authored
TLS Version Changes (#2115)
* TLS Version Changes New * TLS fixes --------- Co-authored-by: AkhtarAmir <AkhtarAmir>
1 parent 4af0f44 commit de7c35a

File tree

4 files changed

+29
-44
lines changed

4 files changed

+29
-44
lines changed

‎plugins/azure/eventhub/eventHubMinimumTLSversion.js

Lines changed: 3 additions & 13 deletions
Original file line numberDiff line numberDiff line change
@@ -11,26 +11,16 @@ module.exports = {
1111
recommended_action: 'Modify Event Hubs namespaces to set the desired minimum TLS version.',
1212
link: 'https://learn.microsoft.com/en-us/azure/event-hubs/transport-layer-security-enforce-minimum-version',
1313
apis: ['eventHub:listEventHub'],
14-
settings: {
15-
event_hub_min_tls_version: {
16-
name: 'Event Hub Minimum TLS Version',
17-
description: 'Minimum desired TLS version for Microsoft Azure Event Hubs',
18-
regex: '^(1.0|1.1|1.2)$',
19-
default: '1.2'
20-
}
21-
},
2214
realtime_triggers: ['microsofteventhub:namespaces:write', 'microsofteventhub:namespaces:delete'],
2315

2416
run: function(cache, settings, callback) {
2517
var results = [];
2618
var source = {};
2719
var locations = helpers.locations(settings.govcloud);
2820

29-
var config = {
30-
event_hub_min_tls_version: settings.event_hub_min_tls_version || this.settings.event_hub_min_tls_version.default
31-
};
21+
var event_hub_min_tls_version = '1.2';
3222

33-
var desiredVersion = parseFloat(config.event_hub_min_tls_version);
23+
var desiredVersion = parseFloat(event_hub_min_tls_version);
3424

3525
async.each(locations.eventHub, function(location, rcb) {
3626
var eventHubs = helpers.addSource(cache, source,
@@ -58,7 +48,7 @@ module.exports = {
5848
location, eventHub.id);
5949
} else {
6050
helpers.addResult(results, 2,
61-
`Event Hubs namespace is using TLS version ${eventHub.minimumTlsVersion} instead of version ${config.event_hub_min_tls_version}`,
51+
`Event Hubs namespace is using TLS version ${eventHub.minimumTlsVersion} instead of version ${event_hub_min_tls_version}`,
6252
location, eventHub.id);
6353
}
6454
}

‎plugins/azure/sqlserver/sqlServerTlsVersion.js

Lines changed: 4 additions & 14 deletions
Original file line numberDiff line numberDiff line change
@@ -11,14 +11,6 @@ module.exports = {
1111
recommended_action: 'Modify SQL server firewall and virtual network settings to set desired minimum TLS version.',
1212
link: 'https://learn.microsoft.com/en-us/azure/azure-sql/database/connectivity-settings#minimal-tls-version',
1313
apis: ['servers:listSql'],
14-
settings: {
15-
sql_server_min_tls_version: {
16-
name: 'SQL Server Minimum TLS Version',
17-
description: 'Minimum desired TLS version for Microsoft Azure SQL servers',
18-
regex: '^(1.0|1.1|1.2)$',
19-
default: '1.2'
20-
}
21-
},
2214
remediation_min_version: '202104012200',
2315
remediation_description: 'TLS version 1.2 will be set for the affected SQL server',
2416
apis_remediate: ['servers:listSql'],
@@ -31,11 +23,9 @@ module.exports = {
3123
var source = {};
3224
var locations = helpers.locations(settings.govcloud);
3325

34-
var config = {
35-
sql_server_min_tls_version: settings.sql_server_min_tls_version || this.settings.sql_server_min_tls_version.default
36-
};
26+
var sql_server_min_tls_version = '1.2';
3727

38-
var desiredVersion = parseFloat(config.sql_server_min_tls_version);
28+
var desiredVersion = parseFloat(sql_server_min_tls_version);
3929

4030
async.each(locations.servers, function(location, rcb) {
4131
var servers = helpers.addSource(cache, source,
@@ -60,11 +50,11 @@ module.exports = {
6050
if (server.minimalTlsVersion) {
6151
if (parseFloat(server.minimalTlsVersion) >= desiredVersion) {
6252
helpers.addResult(results, 0,
63-
`SQL server is using TLS version ${server.minimalTlsVersion} which is equal to or higher than desired TLS version ${config.sql_server_min_tls_version}`,
53+
`SQL server is using TLS version ${server.minimalTlsVersion} which is equal to or higher than desired TLS version ${sql_server_min_tls_version}`,
6454
location, server.id);
6555
} else {
6656
helpers.addResult(results, 2,
67-
`SQL server is using TLS version ${server.minimalTlsVersion} which is less than desired TLS version ${config.sql_server_min_tls_version}`,
57+
`SQL server is using TLS version ${server.minimalTlsVersion} which is less than desired TLS version ${sql_server_min_tls_version}`,
6858
location, server.id);
6959
}
7060
} else {

‎plugins/azure/sqlserver/sqlServerTlsVersion.spec.js

Lines changed: 17 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -30,6 +30,21 @@ const servers = [
3030
"fullyQualifiedDomainName": "test-server.database.windows.net",
3131
"privateEndpointConnections": [],
3232
"publicNetworkAccess": "Enabled"
33+
},
34+
{
35+
"kind": "v12.0",
36+
"location": "eastus",
37+
"tags": {},
38+
"id": "/subscriptions/123/resourceGroups/akhtar-rg/providers/Microsoft.Sql/servers/test-server",
39+
"name": "test-server",
40+
"type": "Microsoft.Sql/servers",
41+
"administratorLogin": "aqua",
42+
"version": "12.0",
43+
"state": "Ready",
44+
"fullyQualifiedDomainName": "test-server.database.windows.net",
45+
"privateEndpointConnections": [],
46+
"minimalTlsVersion": "1.2",
47+
"publicNetworkAccess": "Enabled"
3348
}
3449
];
3550

@@ -106,10 +121,10 @@ describe('sqlServerTlsVersion', function() {
106121
};
107122

108123
const cache = createCache(
109-
[servers[0]]
124+
[servers[2]]
110125
);
111126

112-
sqlServerTlsVersion.run(cache, { sql_server_min_tls_version: '1.0' }, callback);
127+
sqlServerTlsVersion.run(cache, { sql_server_min_tls_version: '1.2' }, callback);
113128
});
114129

115130
it('should give unknown result if unable to query for SQL servers', function(done) {

‎plugins/azure/storageaccounts/storageAccountsTlsVersion.js

Lines changed: 5 additions & 15 deletions
Original file line numberDiff line numberDiff line change
@@ -12,14 +12,6 @@ module.exports = {
1212
recommended_action: 'Modify Storage Account configuration and set desired minimum TLS version',
1313
link: 'https://learn.microsoft.com/en-us/azure/storage/common/transport-layer-security-configure-minimum-version',
1414
apis: ['storageAccounts:list'],
15-
settings: {
16-
sa_min_tls_version: {
17-
name: 'Storage Account Minimum TLS Version',
18-
description: 'Minimum desired TLS version for Microsoft Azure Storage Accounts',
19-
regex: '^(1.0|1.1|1.2)$',
20-
default: '1.2'
21-
}
22-
},
2315
remediation_min_version: '202112312200',
2416
remediation_description: 'TLS version 1.2 will be set for the affected Storage Accounts',
2517
apis_remediate: ['storageAccounts:list'],
@@ -32,11 +24,9 @@ module.exports = {
3224
var source = {};
3325
var locations = helpers.locations(settings.govcloud);
3426

35-
var config = {
36-
sa_min_tls_version: settings.sa_min_tls_version || this.settings.sa_min_tls_version.default
37-
};
27+
var sa_min_tls_version = '1.2';
3828

39-
var desiredVersion = parseFloat(config.sa_min_tls_version);
29+
var desiredVersion = parseFloat(sa_min_tls_version);
4030

4131
async.each(locations.storageAccounts, function(location, rcb) {
4232
var storageAccounts = helpers.addSource(cache, source,
@@ -58,17 +48,17 @@ module.exports = {
5848
storageAccounts.data.forEach(function(storageAccount) {
5949
if (!storageAccount.id) return;
6050

61-
let tlsVersion = storageAccount.minimumTlsVersion ? storageAccount.minimumTlsVersion : 'TLS1.0'; //Default is TLS 1.0
51+
let tlsVersion = storageAccount.minimumTlsVersion ? storageAccount.minimumTlsVersion : 'TLS1.2'; //Default is TLS 1.2
6252
tlsVersion = tlsVersion.replace('TLS', '');
6353
tlsVersion = tlsVersion.replace('_', '.');
6454

6555
if (parseFloat(tlsVersion) >= desiredVersion) {
6656
helpers.addResult(results, 0,
67-
`Storage Account is using TLS version ${tlsVersion} which is equal to or higher than desired TLS version ${config.sa_min_tls_version}`,
57+
`Storage Account is using TLS version ${tlsVersion} which is equal to or higher than desired TLS version ${sa_min_tls_version}`,
6858
location, storageAccount.id);
6959
} else {
7060
helpers.addResult(results, 2,
71-
`Storage Account is using TLS version ${tlsVersion} which is less than desired TLS version ${config.sa_min_tls_version}`,
61+
`Storage Account is using TLS version ${tlsVersion} which is less than desired TLS version ${sa_min_tls_version}`,
7262
location, storageAccount.id);
7363
}
7464
});

0 commit comments

Comments
 (0)