Skip to content

fix(ingress): retain classical TLS group fallbacks #120

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
h4x3rotab merged 1 commit into from
Sep 3, 2026
+23 −15
Merged

fix(ingress): retain classical TLS group fallbacks #120

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 1 addition & 1 deletion custom-domain/dstack-ingress/scripts/haproxy-lib.sh
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -31,7 +31,7 @@ global
ssl-default-bind-ciphers ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305
ssl-default-bind-ciphersuites TLS_AES_128_GCM_SHA256:TLS_AES_256_GCM_SHA384:TLS_CHACHA20_POLY1305_SHA256
ssl-default-bind-options ssl-min-ver TLSv1.2 no-tls-tickets
ssl-default-bind-curves X25519MLKEM768:secp384r1
ssl-default-bind-curves X25519MLKEM768:X25519:secp256r1:secp384r1

defaults
log global
Expand Down
36 changes: 22 additions & 14 deletions custom-domain/dstack-ingress/scripts/tests/test_x25519mlkem768.sh
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,7 +1,7 @@
#!/bin/bash

# Verify that the ingress image can terminate TLS 1.3 with the
# X25519MLKEM768 hybrid key-exchange group.
# Verify that the ingress image can terminate TLS 1.3 with the configured
# post-quantum hybrid group and classical fallback groups.
#
# Usage: ./scripts/tests/test_x25519mlkem768.sh <image>

Expand Down Expand Up @@ -42,17 +42,25 @@ EOF
exec haproxy -W -db -f /etc/haproxy/haproxy.cfg
' >/dev/null

for _ in {1..20}; do
handshake="$(docker exec "${CONTAINER}" bash -c \
'openssl s_client -connect 127.0.0.1:24443 -servername localhost -tls1_3 -groups X25519MLKEM768 </dev/null 2>&1' \
|| true)"
if grep -Fq 'Negotiated TLS1.3 group: X25519MLKEM768' <<<"${handshake}"; then
grep -F 'Negotiated TLS1.3 group: X25519MLKEM768' <<<"${handshake}"
exit 0
for group in X25519MLKEM768 X25519 secp256r1 secp384r1; do
handshake=""
for _ in {1..20}; do
handshake="$(docker exec "${CONTAINER}" bash -c \
"openssl s_client -connect 127.0.0.1:24443 -servername localhost -tls1_3 -groups ${group} </dev/null 2>&1" \
|| true)"
# Each client offers exactly one group, so a successful TLS 1.3
# handshake proves HAProxy selected that configured group. OpenSSL
# only prints "Negotiated TLS1.3 group" for some group types.
if grep -Fq 'Protocol: TLSv1.3' <<<"${handshake}"; then
echo "TLS 1.3 handshake completed with ${group}"
break
fi
sleep 0.1
done

if ! grep -Fq 'Protocol: TLSv1.3' <<<"${handshake}"; then
printf '%s\n' "${handshake}" >&2
echo "${group} TLS handshake did not complete" >&2
exit 1
fi
sleep 0.1
done

printf '%s\n' "${handshake}" >&2
echo 'X25519MLKEM768 TLS handshake did not complete' >&2
exit 1
Loading