*: add SSL MinVersion

.golangci.yml

@@ -40,7 +40,6 @@ linters-settings:
     # To specify a set of rules to explicitly exclude.
     # Available rules: https://github.com/securego/gosec#available-rules
     excludes:
-      - G402
       - G404
       # TODO: enable G115 after fixing the issues
       - G115

client/pd_service_discovery_test.go

@@ -314,17 +314,17 @@ func TestServiceClientScheme(t *testing.T) {
 	re.Equal("http://127.0.0.1:2379", cli.GetURL())
 	cli = newPDServiceClient(modifyURLScheme("http://127.0.0.1:2379", nil), modifyURLScheme("127.0.0.1:2379", nil), nil, false)
 	re.Equal("http://127.0.0.1:2379", cli.GetURL())
-	cli = newPDServiceClient(modifyURLScheme("127.0.0.1:2379", &tls.Config{}), modifyURLScheme("127.0.0.1:2379", &tls.Config{}), nil, false)
+	cli = newPDServiceClient(modifyURLScheme("127.0.0.1:2379", &tls.Config{MinVersion: tls.VersionTLS12}), modifyURLScheme("127.0.0.1:2379", &tls.Config{MinVersion: tls.VersionTLS12}), nil, false)
 	re.Equal("https://127.0.0.1:2379", cli.GetURL())
-	cli = newPDServiceClient(modifyURLScheme("https://127.0.0.1:2379", &tls.Config{}), modifyURLScheme("127.0.0.1:2379", &tls.Config{}), nil, false)
+	cli = newPDServiceClient(modifyURLScheme("https://127.0.0.1:2379", &tls.Config{MinVersion: tls.VersionTLS12}), modifyURLScheme("127.0.0.1:2379", &tls.Config{MinVersion: tls.VersionTLS12}), nil, false)
 	re.Equal("https://127.0.0.1:2379", cli.GetURL())
-	cli = newPDServiceClient(modifyURLScheme("http://127.0.0.1:2379", &tls.Config{}), modifyURLScheme("127.0.0.1:2379", &tls.Config{}), nil, false)
+	cli = newPDServiceClient(modifyURLScheme("http://127.0.0.1:2379", &tls.Config{MinVersion: tls.VersionTLS12}), modifyURLScheme("127.0.0.1:2379", &tls.Config{MinVersion: tls.VersionTLS12}), nil, false)
 	re.Equal("https://127.0.0.1:2379", cli.GetURL())
 }
 
 func TestSchemeFunction(t *testing.T) {
 	re := require.New(t)
-	tlsCfg := &tls.Config{}
+	tlsCfg := &tls.Config{MinVersion: tls.VersionTLS12}
 
 	endpoints1 := []string{
 		"http://tc-pd:2379",

client/tlsutil/tlsconfig.go

@@ -79,7 +79,7 @@
 			return nil, err
 		}
 	} else {
-		cfg = &tls.Config{ServerName: info.serverName}
+		cfg = &tls.Config{ServerName: info.serverName, MinVersion: tls.VersionTLS12}
 	}
 	cfg.InsecureSkipVerify = info.insecureSkipVerify
 
@@ -190,6 +190,7 @@
 			Certificates: certificates,
 			RootCAs:      certPool,
 			NextProtos:   []string{"h2", "http/1.1"}, // specify `h2` to let Go use HTTP/2.
+			MinVersion:   tls.VersionTLS12,
 		}, nil
 	}
 

pkg/utils/grpcutil/grpcutil.go

@@ -92,6 +92,7 @@ func (s TLSConfig) ToTLSConfig() (*tls.Config, error) {
 			Certificates: certificates,
 			RootCAs:      certPool,
 			NextProtos:   []string{"h2", "http/1.1"}, // specify `h2` to let Go use HTTP/2.
+			MinVersion:   tls.VersionTLS12,
 		}, nil
 	}
 

pkg/utils/netutil/address_test.go

@@ -51,7 +51,7 @@ func TestIsEnableHttps(t *testing.T) {
 	httpClient = &http.Client{
 		Transport: &http.Transport{
 			DisableKeepAlives: true,
-			TLSClientConfig:   &tls.Config{},
+			TLSClientConfig:   &tls.Config{MinVersion: tls.VersionTLS12},
 		},
 	}
 	re.False(IsEnableHTTPS(httpClient))