refactor(tls): use IANA cipher suite names instead of OpenSSL names

Switch cipherMap keys and cipherIDToName output from OpenSSL-style
(e.g. ECDHE-RSA-AES128-GCM-SHA256) to IANA format
(e.g. TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256), which matches what
Go's crypto/tls package uses.

cipherIDToName now looks up the name from tls.CipherSuites() and
tls.InsecureCipherSuites() by ID instead of reverse-iterating cipherMap,
so the returned name is always the authoritative Go/IANA name.

Update tests and README accordingly.

Signed-off-by: zhujian <jiazhu@redhat.com>

Author: zhujian7

pkg/tls/README.md

@@ -14,15 +14,16 @@ metadata:
   namespace: <component-namespace>
 data:
   minTLSVersion: VersionTLS13  # tls.ConfigMapKeyMinVersion
-  cipherSuites: ECDHE-RSA-AES128-GCM-SHA256,ECDHE-ECDSA-AES128-GCM-SHA256
+  cipherSuites: TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256
   #             ^ tls.ConfigMapKeyCipherSuites
 ```
 
 Supported `minTLSVersion` values: `VersionTLS10`, `VersionTLS11`, `VersionTLS12` (default),
 `VersionTLS13`.
 
-Supported cipher suite names follow the OpenSSL naming convention. TLS 1.3 cipher suites
-are fixed by the Go runtime and cannot be configured via `cipherSuites`.
+Cipher suite names use the IANA format (e.g. `TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256`),
+which matches what Go's `crypto/tls` package uses. TLS 1.3 cipher suites are fixed by
+the Go runtime and cannot be configured via `cipherSuites`.
 
 ## Use cases
 
@@ -108,6 +109,6 @@ args := []string{
 | `ConfigFromFlags(minVersion, cipherSuites)` | Parse TLS config from flag strings. Returns `nil` if both are empty. |
 | `ConfigToFunc(tlsCfg)` | Returns a `func(*tls.Config)` for use with controller-runtime `TLSOpts`. |
 | `VersionToString(version)` | Convert a `crypto/tls` version constant to its string name. |
-| `CipherSuitesToString(suites)` | Convert cipher suite IDs back to a comma-separated OpenSSL-style string. |
+| `CipherSuitesToString(suites)` | Convert cipher suite IDs back to a comma-separated IANA-format string. |
 
 Constants: `ConfigMapName`, `ConfigMapKeyMinVersion`, `ConfigMapKeyCipherSuites`.

pkg/tls/cipher.go

@@ -2,35 +2,36 @@ package tls
 
 import "crypto/tls"
 
-// cipherMap maps OpenSSL-style cipher names to Go's crypto/tls package constants.
+// cipherMap maps IANA cipher suite names to Go's crypto/tls package constants.
+// IANA names match those returned by tls.CipherSuites() and tls.InsecureCipherSuites().
 var cipherMap = map[string]uint16{
-	// TLS 1.3 cipher suites (standardized names)
+	// TLS 1.3 cipher suites
 	"TLS_AES_128_GCM_SHA256":       tls.TLS_AES_128_GCM_SHA256,
 	"TLS_AES_256_GCM_SHA384":       tls.TLS_AES_256_GCM_SHA384,
 	"TLS_CHACHA20_POLY1305_SHA256": tls.TLS_CHACHA20_POLY1305_SHA256,
 
-	// TLS 1.2 and earlier cipher suites (OpenSSL-style names)
-	"ECDHE-RSA-AES128-GCM-SHA256":   tls.TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,
-	"ECDHE-ECDSA-AES128-GCM-SHA256": tls.TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,
-	"ECDHE-RSA-AES256-GCM-SHA384":   tls.TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,
-	"ECDHE-ECDSA-AES256-GCM-SHA384": tls.TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,
-	"ECDHE-RSA-CHACHA20-POLY1305":   tls.TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305,
-	"ECDHE-ECDSA-CHACHA20-POLY1305": tls.TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,
-	// "DHE-RSA-AES128-GCM-SHA256":     tls.TLS_DHE_RSA_WITH_AES_128_GCM_SHA256,
-	// "DHE-RSA-AES256-GCM-SHA384":     tls.TLS_DHE_RSA_WITH_AES_256_GCM_SHA384,
-	"ECDHE-RSA-AES128-SHA256":   tls.TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256,
-	"ECDHE-ECDSA-AES128-SHA256": tls.TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256,
-	"ECDHE-RSA-AES128-SHA":      tls.TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA,
-	"ECDHE-ECDSA-AES128-SHA":    tls.TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA,
-	// "ECDHE-RSA-AES256-SHA384":       tls.TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384,
-	// "ECDHE-ECDSA-AES256-SHA384":     tls.TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384,
-	"ECDHE-RSA-AES256-SHA":   tls.TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA,
-	"ECDHE-ECDSA-AES256-SHA": tls.TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA,
-	"AES128-GCM-SHA256":      tls.TLS_RSA_WITH_AES_128_GCM_SHA256,
-	"AES256-GCM-SHA384":      tls.TLS_RSA_WITH_AES_256_GCM_SHA384,
-	"AES128-SHA256":          tls.TLS_RSA_WITH_AES_128_CBC_SHA256,
-	// "AES256-SHA256":                 tls.TLS_RSA_WITH_AES_256_CBC_SHA256,
-	"AES128-SHA":   tls.TLS_RSA_WITH_AES_128_CBC_SHA,
-	"AES256-SHA":   tls.TLS_RSA_WITH_AES_256_CBC_SHA,
-	"DES-CBC3-SHA": tls.TLS_RSA_WITH_3DES_EDE_CBC_SHA,
+	// TLS 1.2 and earlier cipher suites (IANA names)
+	"TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256":   tls.TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,
+	"TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256": tls.TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,
+	"TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384":   tls.TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,
+	"TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384": tls.TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,
+	"TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256":   tls.TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305,
+	"TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256": tls.TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,
+	// "TLS_DHE_RSA_WITH_AES_128_GCM_SHA256":           tls.TLS_DHE_RSA_WITH_AES_128_GCM_SHA256,
+	// "TLS_DHE_RSA_WITH_AES_256_GCM_SHA384":           tls.TLS_DHE_RSA_WITH_AES_256_GCM_SHA384,
+	"TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256":   tls.TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256,
+	"TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256": tls.TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256,
+	"TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA":      tls.TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA,
+	"TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA":    tls.TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA,
+	// "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384":          tls.TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384,
+	// "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384":        tls.TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384,
+	"TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA":   tls.TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA,
+	"TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA": tls.TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA,
+	"TLS_RSA_WITH_AES_128_GCM_SHA256":      tls.TLS_RSA_WITH_AES_128_GCM_SHA256,
+	"TLS_RSA_WITH_AES_256_GCM_SHA384":      tls.TLS_RSA_WITH_AES_256_GCM_SHA384,
+	"TLS_RSA_WITH_AES_128_CBC_SHA256":      tls.TLS_RSA_WITH_AES_128_CBC_SHA256,
+	// "TLS_RSA_WITH_AES_256_CBC_SHA256":               tls.TLS_RSA_WITH_AES_256_CBC_SHA256,
+	"TLS_RSA_WITH_AES_128_CBC_SHA":      tls.TLS_RSA_WITH_AES_128_CBC_SHA,
+	"TLS_RSA_WITH_AES_256_CBC_SHA":      tls.TLS_RSA_WITH_AES_256_CBC_SHA,
+	"TLS_RSA_WITH_3DES_EDE_CBC_SHA":     tls.TLS_RSA_WITH_3DES_EDE_CBC_SHA,
 }

pkg/tls/config.go

@@ -44,7 +44,7 @@ func parseTLSVersion(version string) (uint16, error) {
 	}
 }
 
-// parseCipherSuites converts OpenSSL-style cipher names to Go crypto/tls constants.
+// parseCipherSuites converts IANA cipher suite names to Go crypto/tls constants.
 // Returns a list of cipher suite IDs and a list of unsupported cipher names.
 func parseCipherSuites(cipherString string) ([]uint16, []string) {
 	if strings.TrimSpace(cipherString) == "" {
@@ -126,7 +126,7 @@ func VersionToString(version uint16) string {
 	}
 }
 
-// CipherSuitesToString converts cipher suite IDs back to OpenSSL-style names
+// CipherSuitesToString converts cipher suite IDs back to IANA names
 func CipherSuitesToString(suites []uint16) string {
 	if len(suites) == 0 {
 		return ""
@@ -160,11 +160,11 @@ func ConfigToFunc(tlsCfg *TLSConfig) func(*tls.Config) {
 	}
 }
 
-// cipherIDToName converts a cipher suite ID to its OpenSSL-style name
+// cipherIDToName converts a cipher suite ID to its IANA name.
 func cipherIDToName(id uint16) string {
-	for name, suiteID := range cipherMap {
-		if suiteID == id {
-			return name
+	for _, s := range append(tls.CipherSuites(), tls.InsecureCipherSuites()...) {
+		if s.ID == id {
+			return s.Name
 		}
 	}
 	return ""

pkg/tls/tls_test.go

@@ -69,15 +69,15 @@ func TestConfigFromFlags(t *testing.T) {
 		{
 			name:         "valid single cipher",
 			minVersion:   "VersionTLS12",
-			cipherSuites: "ECDHE-RSA-AES128-GCM-SHA256",
+			cipherSuites: "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256",
 			expectError:  false,
 			expectedMin:  tls.VersionTLS12,
 			expectedLen:  1,
 		},
 		{
 			name:         "valid multiple ciphers",
 			minVersion:   "VersionTLS12",
-			cipherSuites: "ECDHE-RSA-AES128-GCM-SHA256,ECDHE-ECDSA-AES128-GCM-SHA256",
+			cipherSuites: "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256",
 			expectError:  false,
 			expectedMin:  tls.VersionTLS12,
 			expectedLen:  2,
@@ -91,21 +91,21 @@ func TestConfigFromFlags(t *testing.T) {
 		{
 			name:         "mixed valid and invalid ciphers",
 			minVersion:   "VersionTLS12",
-			cipherSuites: "ECDHE-RSA-AES128-GCM-SHA256,INVALID-CIPHER",
+			cipherSuites: "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,INVALID-CIPHER",
 			expectError:  true,
 		},
 		{
 			name:         "only cipher suites without version defaults to TLS 1.2",
 			minVersion:   "",
-			cipherSuites: "ECDHE-RSA-AES128-GCM-SHA256",
+			cipherSuites: "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256",
 			expectError:  false,
 			expectedMin:  tls.VersionTLS12,
 			expectedLen:  1,
 		},
 		{
 			name:         "cipher suites with whitespace",
 			minVersion:   "VersionTLS12",
-			cipherSuites: " ECDHE-RSA-AES128-GCM-SHA256 , ECDHE-ECDSA-AES128-GCM-SHA256 ",
+			cipherSuites: " TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256 , TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256 ",
 			expectError:  false,
 			expectedMin:  tls.VersionTLS12,
 			expectedLen:  2,
@@ -212,15 +212,15 @@ func TestCipherSuitesToString(t *testing.T) {
 		{
 			name:     "single cipher",
 			suites:   []uint16{tls.TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256},
-			expected: "ECDHE-RSA-AES128-GCM-SHA256",
+			expected: "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256",
 		},
 		{
 			name: "multiple ciphers",
 			suites: []uint16{
 				tls.TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,
 				tls.TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,
 			},
-			expected: "ECDHE-RSA-AES128-GCM-SHA256,ECDHE-ECDSA-AES128-GCM-SHA256",
+			expected: "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256",
 		},
 		{
 			name: "unknown cipher ID skipped",
@@ -229,7 +229,7 @@ func TestCipherSuitesToString(t *testing.T) {
 				0x9999, // unknown cipher
 				tls.TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,
 			},
-			expected: "ECDHE-RSA-AES128-GCM-SHA256,ECDHE-ECDSA-AES128-GCM-SHA256",
+			expected: "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256",
 		},
 	}
 
@@ -387,7 +387,7 @@ func TestLoadTLSConfigFromConfigMap(t *testing.T) {
 					},
 					Data: map[string]string{
 						ConfigMapKeyMinVersion:   "VersionTLS12",
-						ConfigMapKeyCipherSuites: "ECDHE-RSA-AES128-GCM-SHA256",
+						ConfigMapKeyCipherSuites: "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256",
 					},
 				}
 				return fake.NewClientset(cm)
@@ -441,7 +441,7 @@ func TestLoadTLSConfigFromConfigMap(t *testing.T) {
 					},
 					Data: map[string]string{
 						ConfigMapKeyMinVersion:   "VersionTLS12",
-						ConfigMapKeyCipherSuites: "ECDHE-RSA-AES128-GCM-SHA256,UNKNOWN-CIPHER",
+						ConfigMapKeyCipherSuites: "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,UNKNOWN-CIPHER",
 					},
 				}
 				return fake.NewClientset(cm)
@@ -888,12 +888,12 @@ func TestParseCipherSuites(t *testing.T) {
 		},
 		{
 			name:          "single valid cipher",
-			cipherString:  "ECDHE-RSA-AES128-GCM-SHA256",
+			cipherString:  "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256",
 			expectedCount: 1,
 		},
 		{
 			name:          "multiple valid ciphers",
-			cipherString:  "ECDHE-RSA-AES128-GCM-SHA256,ECDHE-ECDSA-AES128-GCM-SHA256",
+			cipherString:  "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256",
 			expectedCount: 2,
 		},
 		{
@@ -904,18 +904,18 @@ func TestParseCipherSuites(t *testing.T) {
 		},
 		{
 			name:                "mixed valid and unsupported",
-			cipherString:        "ECDHE-RSA-AES128-GCM-SHA256,UNKNOWN-CIPHER",
+			cipherString:        "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,UNKNOWN-CIPHER",
 			expectedCount:       1,
 			expectedUnsupported: 1,
 		},
 		{
 			name:          "ciphers with whitespace",
-			cipherString:  " ECDHE-RSA-AES128-GCM-SHA256 , ECDHE-ECDSA-AES128-GCM-SHA256 ",
+			cipherString:  " TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256 , TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256 ",
 			expectedCount: 2,
 		},
 		{
 			name:          "empty entries in list",
-			cipherString:  "ECDHE-RSA-AES128-GCM-SHA256,,ECDHE-ECDSA-AES128-GCM-SHA256",
+			cipherString:  "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,,TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256",
 			expectedCount: 2,
 		},
 	}
@@ -944,7 +944,7 @@ func TestCipherIDToName(t *testing.T) {
 		{
 			name:     "known cipher",
 			id:       tls.TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,
-			expected: "ECDHE-RSA-AES128-GCM-SHA256",
+			expected: "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256",
 		},
 		{
 			name:     "unknown cipher",