fix(model): allow tls 1.3 cipher suite names

updates the model cipher suites validation to allow tls 1.3 ciphers
that start with TLS_ and use underscore instead of dash as separator.

Author: felixbuenemann

model/model.go

@@ -212,7 +212,7 @@ func newCertificate(cert string, key string) *Certificate {
 type SSLConfig struct {
 	Enforce           bool        `key:"enforce" constraint:"(?i)^(true|false)$"`
 	Protocols         string      `key:"protocols" constraint:"^((SSLv[2-3]|TLSv1(?:\\.[1-3])?)\\s*)+$"`
-	Ciphers           string      `key:"ciphers" constraint:"^((([aek]?[A-Z\\d]{2,}([rd]|v\\d(\\.\\d)?)?([!+-]?\\b|\\B))+|([A-Z\\d][A-Z\\d-]+[A-Z\\d]([!+]?\\b|\\B))+)(:?@(STRENGTH|SECLEVEL=[0-5]))?(:([!+-]\\b)?|$))*$"`
+	Ciphers           string      `key:"ciphers" constraint:"^((([aek]?[A-Z\\d]{2,}([rd]|v\\d(\\.\\d)?)?([!+-]?\\b|\\B))+|(([A-Z\\d][A-Z\\d-]+|TLS_[A-Z\\d][A-Z\\d_]+)[A-Z\\d]([!+]?\\b|\\B))+)(:?@(STRENGTH|SECLEVEL=[0-5]))?(:([!+-]\\b)?|$))*$"`
 	SessionCache      string      `key:"sessionCache" constraint:"^(off|none|((builtin(:[1-9]\\d*)?|shared:\\w+:[1-9]\\d*[kKmM]?)\\s*){1,2})$"`
 	SessionTimeout    string      `key:"sessionTimeout" constraint:"^[1-9]\\d*(ms|[smhdwMy])?$"`
 	UseSessionTickets bool        `key:"useSessionTickets" constraint:"(?i)^(true|false)$"`

model/model_validation_test.go

@@ -304,11 +304,11 @@ func TestValidSSLProtocols(t *testing.T) {
 }
 
 func TestInvalidSSLCiphers(t *testing.T) {
-	testInvalidValues(t, newTestSSLConfig, "Ciphers", "ciphers", []string{"0", "-1", "foobar", "!DSS", "@STRENGTH"})
+	testInvalidValues(t, newTestSSLConfig, "Ciphers", "ciphers", []string{"0", "-1", "foobar", "!DSS", "@STRENGTH", "!TLS_AES_128_GCM_SHA256"})
 }
 
 func TestValidSSLCiphers(t *testing.T) {
-	testValidValues(t, newTestSSLConfig, "Ciphers", "ciphers", []string{"DHE-RSA-AES256-SHA", "DHE-RSA-AES256-SHA:DHE-DSS-AES256-SHA:AES256-SHA", "EECDH+AES128:RSA+AES128:EECDH+AES256:RSA+AES256:EECDH+3DES:RSA+3DES:!MD5", "DEFAULT@SECLEVEL=3:-TLSv1.2+DH", "TLS13:TLSv1.2", "SUITEB128ONLY", "kEECDH+aRSA!RC4"})
+	testValidValues(t, newTestSSLConfig, "Ciphers", "ciphers", []string{"DHE-RSA-AES256-SHA", "DHE-RSA-AES256-SHA:DHE-DSS-AES256-SHA:AES256-SHA", "EECDH+AES128:RSA+AES128:EECDH+AES256:RSA+AES256:EECDH+3DES:RSA+3DES:!MD5", "DEFAULT@SECLEVEL=3:-TLSv1.2+DH", "TLS13:TLSv1.2", "SUITEB128ONLY", "kEECDH+aRSA!RC4", "TLS_AES_128_GCM_SHA256:EECDH+AES128+SHA256"})
 }
 
 func TestInvalidSSLSessionCache(t *testing.T) {