Add the ability to specify the maximum acceptable TLS version

.yamllint

@@ -14,6 +14,7 @@ rules:
   document-start: disable
   indentation:
     spaces: consistent
+    indent-sequences: consistent
   key-duplicates:
     ignore: |
       config/testdata/section_key_dup.bad.yml

CODE_OF_CONDUCT.md

@@ -1,3 +1,3 @@
-## Prometheus Community Code of Conduct
+# Prometheus Community Code of Conduct
 
-Prometheus follows the [CNCF Code of Conduct](https://github.com/cncf/foundation/blob/master/code-of-conduct.md).
+Prometheus follows the [CNCF Code of Conduct](https://github.com/cncf/foundation/blob/main/code-of-conduct.md).

SECURITY.md

@@ -3,4 +3,4 @@
 The Prometheus security policy, including how to report vulnerabilities, can be
 found here:
 
-https://prometheus.io/docs/operating/security/
+<https://prometheus.io/docs/operating/security/>

config/http_config.go

@@ -21,6 +21,7 @@ import (
 	"crypto/x509"
 	"encoding/json"
 	"fmt"
+	"io/ioutil"
 	"net"
 	"net/http"
 	"net/url"
@@ -779,6 +780,7 @@ func NewTLSConfig(cfg *TLSConfig) (*tls.Config, error) {
 	tlsConfig := &tls.Config{
 		InsecureSkipVerify: cfg.InsecureSkipVerify,
 		MinVersion:         uint16(cfg.MinVersion),
+		MaxVersion:         uint16(cfg.MaxVersion),
 	}
 
 	// If a CA cert is provided then let's read it in so we can validate the
@@ -826,6 +828,8 @@ type TLSConfig struct {
 	InsecureSkipVerify bool `yaml:"insecure_skip_verify" json:"insecure_skip_verify"`
 	// Minimum TLS version.
 	MinVersion TLSVersion `yaml:"min_version,omitempty" json:"min_version,omitempty"`
+	// Maximum TLS version.
+	MaxVersion TLSVersion `yaml:"max_version,omitempty" json:"max_version,omitempty"`
 }
 
 // SetDirectory joins any relative file paths with dir.

config/http_config_test.go

@@ -21,6 +21,7 @@ import (
 	"errors"
 	"fmt"
 	"io"
+	"io/ioutil"
 	"net"
 	"net/http"
 	"net/http/httptest"

config/testdata/tls_config.max_version.good.json

@@ -0,0 +1 @@
+{"max_version": "TLS12"}

config/testdata/tls_config.max_version.good.yml

@@ -0,0 +1 @@
+max_version: TLS12

config/tls_config_test.go

@@ -64,6 +64,9 @@ var expectedTLSConfigs = []struct {
 	}, {
 		filename: "tls_config.tlsversion.good.json",
 		config:   &tls.Config{MinVersion: tls.VersionTLS11},
+	}, {
+		filename: "tls_config.max_version.good.json",
+		config:   &tls.Config{MaxVersion: tls.VersionTLS12},
 	},
 	{
 		filename: "tls_config.empty.good.yml",
@@ -74,6 +77,9 @@ var expectedTLSConfigs = []struct {
 	}, {
 		filename: "tls_config.tlsversion.good.yml",
 		config:   &tls.Config{MinVersion: tls.VersionTLS11},
+	}, {
+		filename: "tls_config.max_version.good.yml",
+		config:   &tls.Config{MaxVersion: tls.VersionTLS12},
 	},
 }