lxd is too restrictive about ciphers when it comes to proxies

[James Troup]

lxd uses a very restrictive set of ciphers¹ with a stated goal of enforcing PFS. While this is admirable when it comes to communication between the lxc client and lxd servers, it's unreasonable to enforce that same reduced cipher list when talking to proxies. Proxies are very often outside of the control of the lxd user and it's perfectly reasonable to not care about PFS between me and where I get my images from. Please be more pragmatic about this and allow the user to configure a broader range of accepted ciphers for the purpose of talking to proxies.

--
¹ https://github.com/lxc/lxd/blob/master/shared/network.go#L53

[Stéphane Graber (stgraber)]

Well, so most proxies do not intercept TLS and instead let you send "CONNECT" through and connect to the target server, in which case there's no reason for us to compromise on ciphers and allow for a potential downgrade and breaking of PFS.

Since we can't really detect a company proxy which does terminate TLS, I think the best option will be an environment variable.

https://github.com/lxc/lxd/pull/5168

This restricts the scope of this as much as possible and uses an env variable so that the same can apply to client and server. All LXD internal communications (cluster and server to server) will not be respecting this environment variable and will keep enforcing the strict TLS config.

[Stéphane Graber (stgraber)]

The stable snap now contains this code.