Sy/beta tls

requirements-agent-release.txt

@@ -181,7 +181,7 @@ datadog-temporal==3.1.0
 datadog-tenable==3.0.0
 datadog-teradata==4.0.0; sys_platform != 'darwin'
 datadog-tibco-ems==2.1.0; sys_platform != 'win32'
-datadog-tls==4.0.0
+datadog-tls==4.1.0-beta.1
 datadog-tokumx==3.2.0
 datadog-tomcat==4.0.0
 datadog-torchserve==3.1.0

tls/CHANGELOG.md

@@ -2,6 +2,12 @@
 
 <!-- towncrier release notes start -->
 
+## 4.1.0-beta.1 / 2024-12-16
+
+***Added***:
+
+* Allow for different TLS Ciphers to be included or excluded. ([#19270](https://github.com/DataDog/integrations-core/pull/19270))
+
 ## 4.0.0 / 2024-10-04
 
 ***Removed***:

tls/assets/configuration/spec.yaml

@@ -77,6 +77,51 @@ files:
         example:
           - 'TLSv1.2'
           - 'TLSv1.3'
+    - name: tls_ciphers
+      description: |
+        The list of ciphers to use when connecting to `server`. If not specified, the default
+        list of ciphers is used. The list of ciphers is a colon-separated list of cipher names.
+        See: https://www.openssl.org/docs/man1.0.2/man1/ciphers.html
+        Defaults are: 
+        "TLS_AES_256_GCM_SHA384", 
+        "TLS_CHACHA20_POLY1305_SHA256", 
+        "TLS_AES_128_GCM_SHA256",
+        "ECDHE-ECDSA-AES256-GCM-SHA384", 
+        "ECDHE-RSA-AES256-GCM-SHA384", 
+        "ECDHE-ECDSA-AES128-GCM-SHA256",
+        "ECDHE-RSA-AES128-GCM-SHA256", 
+        "ECDHE-ECDSA-CHACHA20-POLY1305", 
+        "ECDHE-RSA-CHACHA20-POLY1305", 
+        "ECDHE-ECDSA-AES256-SHA384", 
+        "ECDHE-RSA-AES256-SHA384", 
+        "ECDHE-ECDSA-AES128-SHA256", 
+        "ECDHE-RSA-AES128-SHA256", 
+        "DHE-RSA-AES256-GCM-SHA384", 
+        "DHE-RSA-AES128-GCM-SHA256", 
+        "DHE-RSA-AES256-SHA256", 
+        "DHE-RSA-AES128-SHA256"
+      value:
+        type: array
+        items:
+          type: string
+        example:
+          - 'TLS_AES_256_GCM_SHA384'
+          - 'TLS_CHACHA20_POLY1305_SHA256'
+          - 'TLS_AES_128_GCM_SHA256'
+          - 'ECDHE-ECDSA-AES256-GCM-SHA384'
+          - 'ECDHE-RSA-AES256-GCM-SHA384'
+          - 'ECDHE-ECDSA-AES128-GCM-SHA256'
+          - 'ECDHE-RSA-AES128-GCM-SHA256'
+          - 'ECDHE-ECDSA-CHACHA20-POLY1305'
+          - 'ECDHE-RSA-CHACHA20-POLY1305'
+          - 'ECDHE-ECDSA-AES256-SHA384'
+          - 'ECDHE-RSA-AES256-SHA384'
+          - 'ECDHE-ECDSA-AES128-SHA256'
+          - 'ECDHE-RSA-AES128-SHA256'
+          - 'DHE-RSA-AES256-GCM-SHA384'
+          - 'DHE-RSA-AES128-GCM-SHA256'
+          - 'DHE-RSA-AES256-SHA256'
+          - 'DHE-RSA-AES128-SHA256'
     - name: fetch_intermediate_certs
       description: |
         Whether or not to perform AIA chasing in order to load the full certificate chain.

tls/datadog_checks/tls/__about__.py

@@ -1,4 +1,4 @@
 # (C) Datadog, Inc. 2019-present
 # All rights reserved
 # Licensed under a 3-clause BSD style license (see LICENSE)
-__version__ = '4.0.0'
+__version__ = '4.1.0-beta.1'

tls/datadog_checks/tls/data/conf.yaml.example

@@ -75,6 +75,48 @@ instances:
     #   - TLSv1.2
     #   - TLSv1.3
 
+    ## @param tls_ciphers - list of strings - optional
+    ## The list of ciphers to use when connecting to `server`. If not specified, the default
+    ## list of ciphers is used. The list of ciphers is a colon-separated list of cipher names.
+    ## See: https://www.openssl.org/docs/man1.0.2/man1/ciphers.html
+    ## Defaults are: 
+    ## "TLS_AES_256_GCM_SHA384", 
+    ## "TLS_CHACHA20_POLY1305_SHA256", 
+    ## "TLS_AES_128_GCM_SHA256",
+    ## "ECDHE-ECDSA-AES256-GCM-SHA384", 
+    ## "ECDHE-RSA-AES256-GCM-SHA384", 
+    ## "ECDHE-ECDSA-AES128-GCM-SHA256",
+    ## "ECDHE-RSA-AES128-GCM-SHA256", 
+    ## "ECDHE-ECDSA-CHACHA20-POLY1305", 
+    ## "ECDHE-RSA-CHACHA20-POLY1305", 
+    ## "ECDHE-ECDSA-AES256-SHA384", 
+    ## "ECDHE-RSA-AES256-SHA384", 
+    ## "ECDHE-ECDSA-AES128-SHA256", 
+    ## "ECDHE-RSA-AES128-SHA256", 
+    ## "DHE-RSA-AES256-GCM-SHA384", 
+    ## "DHE-RSA-AES128-GCM-SHA256", 
+    ## "DHE-RSA-AES256-SHA256", 
+    ## "DHE-RSA-AES128-SHA256"
+    #
+    # tls_ciphers:
+    #   - TLS_AES_256_GCM_SHA384
+    #   - TLS_CHACHA20_POLY1305_SHA256
+    #   - TLS_AES_128_GCM_SHA256
+    #   - ECDHE-ECDSA-AES256-GCM-SHA384
+    #   - ECDHE-RSA-AES256-GCM-SHA384
+    #   - ECDHE-ECDSA-AES128-GCM-SHA256
+    #   - ECDHE-RSA-AES128-GCM-SHA256
+    #   - ECDHE-ECDSA-CHACHA20-POLY1305
+    #   - ECDHE-RSA-CHACHA20-POLY1305
+    #   - ECDHE-ECDSA-AES256-SHA384
+    #   - ECDHE-RSA-AES256-SHA384
+    #   - ECDHE-ECDSA-AES128-SHA256
+    #   - ECDHE-RSA-AES128-SHA256
+    #   - DHE-RSA-AES256-GCM-SHA384
+    #   - DHE-RSA-AES128-GCM-SHA256
+    #   - DHE-RSA-AES256-SHA256
+    #   - DHE-RSA-AES128-SHA256
+
     ## @param fetch_intermediate_certs - boolean - optional - default: false
     ## Whether or not to perform AIA chasing in order to load the full certificate chain.
     ##

tls/datadog_checks/tls/tls_remote.py

@@ -60,6 +60,25 @@ def _get_cert_and_protocol_version(self, sock):
         with sock:
             self.log.debug('Getting cert and TLS protocol version')
             try:
+                context = self.agent_check.get_tls_context()
+                ciphers = self.agent_check.instance.get('tls_ciphers', None)
+                if ciphers:
+                    if 'ALL' in ciphers:
+                        updated_ciphers = "ALL"
+                    else:
+                        current_ciphers = ":".join(cipher['name'] for cipher in context.get_ciphers())
+                        new_cipher = self.agent_check.instance.get('tls_ciphers')
+                        new_ciphers = ":".join(new_cipher)
+                        updated_ciphers = f"{current_ciphers}:{new_ciphers}"
+
+                    self.log.debug('Updated ciphers to %s', updated_ciphers)
+                    context.set_ciphers(updated_ciphers)
+                    self.log.debug('Set ciphers to %s', context.get_ciphers())
+                    self.log.debug('Context options %s', context.options)
+                    self.log.debug('Context verify mode %s', context.verify_mode.name)
+                    self.log.debug('Context check hostname %s', context.check_hostname)
+                    self.log.debug('Context minimum version %s', context.minimum_version.name)
+                    self.log.debug('Context maximum version %s', context.maximum_version.name)
                 with self.agent_check.get_tls_context().wrap_socket(
                     sock, server_hostname=self.agent_check._server_hostname
                 ) as secure_sock: