Merge branch 'v2.x/staging' into feature/various-keyring

zowe · Nov 21, 2023 · 848ef7c · 848ef7c
2 parents 12b74f5 + ac02cf3
commit 848ef7c
Show file tree

Hide file tree

Showing 3 changed files with 56 additions and 4 deletions.
diff --git a/CHANGELOG.md b/CHANGELOG.md
@@ -1,7 +1,12 @@
 # Zlux App Server Changelog
 
 All notable changes to the Zlux App Server package will be documented in this file.
-
+
+## v2.13.0
+- Enhancement: Updated schema to allow cipher customization in IANA format. (#284)
+- Enhancement: Updated schema to allow curve customization. (#284)
+- Enhancement: Updated defaults to read TLS settings and IP settings from the "zowe.network.server" attribute of Zowe.yaml. (#284)
+
 ## v2.12.0
 - enhancement: new versions of components can change the location of their plugins, as the app-server will now re-inspect the plugin locations on each startup. (#280)
 - bugfix: Removed error message "components/app-server/bin/configure.sh 26: .: FSUM6807 expression syntax error" seen in startup of Zowe in v2.11.0, caused by incorrect shell syntax. (#283)

diff --git a/defaults/serverConfig/defaults.yaml b/defaults/serverConfig/defaults.yaml
@@ -20,9 +20,17 @@ components:
       hostname: "${{ function a(){ if (process.env.ZWE_INTERNAL_HOST) { return process.env.ZWE_INTERNAL_HOST; } else if (process.env.ZWE_haInstance_hostname) { return process.env.ZWE_haInstance_hostname; } else { return undefined; } }; a() }}"
       https:
         ipAddresses: "${{ function a(){
+                          let addresses;
+                          if (components['app-server'].zowe?.network?.server?.listenAddresses) {
+                            addresses = components['app-server'].zowe.network.server.listenAddresses;
+                          } else if (zowe.network?.server?.listenAddresses) {
+                            addresses = zowe.network.server.listenAddresses;
+                          } else {
+                            addresses = ['0.0.0.0'];
+                          }
                           if (process.env.ZOWE_LOOPBACK_ADDRESS && process.env.BIND_TO_LOOPBACK == 'true') {
-                              return [ process.env.ZOWE_LOOPBACK_ADDRESS , '0.0.0.0' ];
-                            } else { return ['0.0.0.0'] } }; 
+                              return [ process.env.ZOWE_LOOPBACK_ADDRESS ].concat(addresses);
+                            } else { return addresses } }; 
                       a() }}"
         port: "${{ function a(){
                      if (process.env.ZWED_SERVER_HTTPS_PORT) {
@@ -58,6 +66,38 @@ components:
                                           }
                                         } else { return ["../defaults/serverConfig/apiml-localca.cer"]; } };
                                   a() }}'
+        maxTls: '${{ function a(){
+                             if (components["app-server"].zowe?.network?.server?.tls?.maxTls) {
+                               return components["app-server"].zowe.network.server.tls.maxTls;
+                             } else if (zowe.network?.server?.tls?.maxTls) {
+                               return zowe.network.server.tls.maxTls;
+                             } else {
+                               return "TLSv1.3"; } };
+                        a() }}'
+        minTls: '${{ function a(){
+                             if (components["app-server"].zowe?.network?.server?.tls?.minTls) {
+                               return components["app-server"].zowe.network.server.tls.minTls;
+                             } else if (zowe.network?.server?.tls?.minTls) {
+                               return zowe.network.server.tls.minTls;
+                             } else {
+                               return "TLSv1.2"; } };
+                        a() }}'
+        ciphers: '${{ function a(){
+                             if (components["app-server"].zowe?.network?.server?.tls?.ciphers) {
+                               return components["app-server"].zowe.network.server.tls.ciphers.join(":");
+                             } else if (zowe.network?.server?.tls?.ciphers) {
+                               return zowe.network.server.tls.ciphers.join(":");
+                             } else {
+                               return "" } };
+                        a() }}'
+        curves: '${{ function a(){
+                             if (components["app-server"].zowe?.network?.server?.tls?.curves) {
+                               return components["app-server"].zowe.network.server.tls.curves;
+                             } else if (zowe.network?.server?.tls?.curves) {
+                               return zowe.network.server.tls.curves;
+                             } else {
+                               return [] } };
+                        a() }}'
       loopbackAddress: "${{ function a(){ if (process.env.ZOWE_LOOPBACK_ADDRESS) { return process.env.ZOWE_LOOPBACK_ADDRESS; } else { return undefined; } }; a() }}"
       mediationLayer:
         server:

diff --git a/schemas/app-server-config.json b/schemas/app-server-config.json
@@ -55,6 +55,13 @@
                 { "$ref": "#/$defs/customCiphers" }
               ]
             },
+            "curves": {
+              "type": "array",
+              "description": "A list of curve NIDs or names, for example P-521, P-384, P-256",
+              "items": {
+                "type": "string"
+              }
+            },
             "enableTrace": {
               "type": "boolean",
               "default": false
@@ -620,7 +627,7 @@
           { "$ref": "#/$defs/zoweDefaultCiphers" }
         ]
       },
-      "description": "Instructs app-server to use the list of ciphers in this string when using TLS. String must be in the form defined here https://nodejs.org/api/tls.html#modifying-the-default-tls-cipher-suite"
+      "description": "Instructs app-server to use the list of ciphers in this string when using TLS. String is a colon separated list of IANA or openSSL names"
     },
     "headerCustomization": {
       "type": "object",