You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@kudu.apache.org by to...@apache.org on 2017/02/21 21:51:54 UTC
[1/2] kudu git commit: [security] add --rpc_tls_ciphers flag
Repository: kudu
Updated Branches:
refs/heads/master d03d374ac -> 114056701
[security] add --rpc_tls_ciphers flag
This new flag allows for precise control over the TLS cipher suite
preference list to use for RPC connections on the server and kudu CLI
tool. This is a relatively common security configuration option on
systems which include TLS encryption.
I also took this opportunity to change our default cipher suite list to
match the Mozilla "modern compatibility" recommendation[1], plus some
cipher suites necessary to remain compatible with RHEL 6.5. This
revealed that we are not properly supporting ECDHE ciphers, so I enabled
those as well.
[1] https://wiki.mozilla.org/Security/Server_Side_TLS#Recommended_configurations
Change-Id: I050e2295041a98fe2c3118c6258b910423bd3816
Reviewed-on: http://gerrit.cloudera.org:8080/6055
Reviewed-by: Alexey Serbin <as...@cloudera.com>
Tested-by: Kudu Jenkins
Reviewed-by: Todd Lipcon <to...@apache.org>
Project: http://git-wip-us.apache.org/repos/asf/kudu/repo
Commit: http://git-wip-us.apache.org/repos/asf/kudu/commit/6098da15
Tree: http://git-wip-us.apache.org/repos/asf/kudu/tree/6098da15
Diff: http://git-wip-us.apache.org/repos/asf/kudu/diff/6098da15
Branch: refs/heads/master
Commit: 6098da159dc04e8637d1ccf06349ddf5d03bbe46
Parents: d03d374
Author: Dan Burkert <da...@apache.org>
Authored: Thu Feb 16 23:58:04 2017 -0800
Committer: Todd Lipcon <to...@apache.org>
Committed: Tue Feb 21 21:49:11 2017 +0000
----------------------------------------------------------------------
src/kudu/security/tls_context.cc | 44 ++++++++++++++++++++++++++++++++++-
1 file changed, 43 insertions(+), 1 deletion(-)
----------------------------------------------------------------------
http://git-wip-us.apache.org/repos/asf/kudu/blob/6098da15/src/kudu/security/tls_context.cc
----------------------------------------------------------------------
diff --git a/src/kudu/security/tls_context.cc b/src/kudu/security/tls_context.cc
index 7b14389..9c977e5 100644
--- a/src/kudu/security/tls_context.cc
+++ b/src/kudu/security/tls_context.cc
@@ -42,6 +42,26 @@ DEFINE_int32(ipki_server_key_size, 2048,
"is used for TLS connections to and from clients and other servers.");
TAG_FLAG(ipki_server_key_size, experimental);
+DEFINE_string(rpc_tls_ciphers,
+ // This is the "modern compatibility" cipher list of the Mozilla Security
+ // Server Side TLS recommendations, accessed Feb. 2017, with the addition of
+ // the non ECDH/DH AES cipher suites from the "intermediate compatibility"
+ // list. These additional ciphers maintain compatibility with RHEL 6.5 and
+ // below. The DH AES ciphers are not included since we are not configured to
+ // use DH key agreement.
+ "ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:"
+ "ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:"
+ "ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:"
+ "ECDHE-ECDSA-AES256-SHA384:ECDHE-RSA-AES256-SHA384:"
+ "ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA256"
+ "AES256-GCM-SHA384:AES128-GCM-SHA256:"
+ "AES256-SHA256:AES128-SHA256:"
+ "AES256-SHA:AES128-SHA",
+ "The cipher suite preferences to use for TLS-secured RPC connections. "
+ "Uses the OpenSSL cipher preference list format. See man (1) ciphers "
+ "for more information.");
+TAG_FLAG(rpc_tls_ciphers, advanced);
+
namespace kudu {
namespace security {
@@ -85,9 +105,31 @@ Status TlsContext::Init() {
SSL_OP_NO_SSLv2 | SSL_OP_NO_SSLv3 |
SSL_OP_NO_COMPRESSION);
+ OPENSSL_RET_NOT_OK(
+ SSL_CTX_set_cipher_list(ctx_.get(), FLAGS_rpc_tls_ciphers.c_str()),
+ "failed to set TLS ciphers");
+
+ // Enable ECDH curves. For OpenSSL 1.1.0 and up, this is done automatically.
+#ifndef OPENSSL_NO_ECDH
+#if OPENSSL_VERSION_NUMBER < 0x10002000L
+ // OpenSSL 1.0.1 and below only support setting a single ECDH curve at once.
+ // We choose prime256v1 because it's the first curve listed in the "modern
+ // compatibility" section of the Mozilla Server Side TLS recommendations,
+ // accessed Feb. 2017.
+ c_unique_ptr<EC_KEY> ecdh { EC_KEY_new_by_curve_name(NID_X9_62_prime256v1), &EC_KEY_free };
+ OPENSSL_RET_IF_NULL(ecdh, "failed to create prime256v1 curve");
+ OPENSSL_RET_NOT_OK(SSL_CTX_set_tmp_ecdh(ctx_.get(), ecdh.get()),
+ "failed to set ECDH curve");
+#elif OPENSSL_VERSION_NUMBER < 0x10100000L
+ // OpenSSL 1.0.2 provides the set_ecdh_auto API which internally figures out
+ // the best curve to use.
+ OPENSSL_RET_NOT_OK(SSL_CTX_set_ecdh_auto(ctx_.get(), 1),
+ "failed to configure ECDH support");
+#endif
+#endif
+
// TODO(PKI): is it possible to disable client-side renegotiation? it seems there
// have been various CVEs related to this feature that we don't need.
- // TODO(PKI): set desired cipher suites?
return Status::OK();
}
[2/2] kudu git commit: [security] add --rpc_tls_min_protocol flag
Posted by to...@apache.org.
[security] add --rpc_tls_min_protocol flag
Allows administrators to configure the minimum TLS protocol version. We
default to TLSv1 in order to support ancient versions of RHEL out of the
box, but clusters which don't need to support C++ clients or servers on
RHEL 6.5 or below should set this flag to TLSv1.2.
Change-Id: I5785a22102f1c9aa083e63aefdd1cdfdd43ede9f
Reviewed-on: http://gerrit.cloudera.org:8080/6059
Tested-by: Kudu Jenkins
Reviewed-by: Todd Lipcon <to...@apache.org>
Project: http://git-wip-us.apache.org/repos/asf/kudu/repo
Commit: http://git-wip-us.apache.org/repos/asf/kudu/commit/11405670
Tree: http://git-wip-us.apache.org/repos/asf/kudu/tree/11405670
Diff: http://git-wip-us.apache.org/repos/asf/kudu/diff/11405670
Branch: refs/heads/master
Commit: 1140567010ffbb7522d7ceacc246fd0983d1e178
Parents: 6098da1
Author: Dan Burkert <da...@apache.org>
Authored: Fri Feb 17 10:34:28 2017 -0800
Committer: Todd Lipcon <to...@apache.org>
Committed: Tue Feb 21 21:51:31 2017 +0000
----------------------------------------------------------------------
src/kudu/security/tls_context.cc | 34 +++++++++++++++++++++++++++++++---
1 file changed, 31 insertions(+), 3 deletions(-)
----------------------------------------------------------------------
http://git-wip-us.apache.org/repos/asf/kudu/blob/11405670/src/kudu/security/tls_context.cc
----------------------------------------------------------------------
diff --git a/src/kudu/security/tls_context.cc b/src/kudu/security/tls_context.cc
index 9c977e5..61d9aba 100644
--- a/src/kudu/security/tls_context.cc
+++ b/src/kudu/security/tls_context.cc
@@ -19,6 +19,7 @@
#include <string>
+#include <boost/algorithm/string/predicate.hpp>
#include <gflags/gflags.h>
#include <openssl/err.h>
#include <openssl/ssl.h>
@@ -62,6 +63,12 @@ DEFINE_string(rpc_tls_ciphers,
"for more information.");
TAG_FLAG(rpc_tls_ciphers, advanced);
+DEFINE_string(rpc_tls_min_protocol, "TLSv1",
+ "The minimum protocol version to allow when for securing RPC "
+ "connections with TLS. May be one of 'TLSv1', 'TLSv1.1', or "
+ "'TLSv1.2'.");
+TAG_FLAG(rpc_tls_min_protocol, advanced);
+
namespace kudu {
namespace security {
@@ -101,9 +108,30 @@ Status TlsContext::Init() {
// Disable SSL/TLS compression to free up CPU resources and be less prone
// to attacks exploiting the compression feature:
// https://tools.ietf.org/html/rfc7525#section-3.3
- SSL_CTX_set_options(ctx_.get(),
- SSL_OP_NO_SSLv2 | SSL_OP_NO_SSLv3 |
- SSL_OP_NO_COMPRESSION);
+ auto options = SSL_OP_NO_SSLv2 | SSL_OP_NO_SSLv3 | SSL_OP_NO_COMPRESSION;
+
+ if (boost::iequals(FLAGS_rpc_tls_min_protocol, "TLSv1.2")) {
+#if OPENSSL_VERSION_NUMBER < 0x10001000L
+ return Status::InvalidArgument(
+ "--rpc_tls_min_protocol=TLSv1.2 is not be supported on this platform. "
+ "TLSv1 is the latest supported TLS protocol.");
+#else
+ options |= SSL_OP_NO_TLSv1 | SSL_OP_NO_TLSv1_1;
+#endif
+ } else if (boost::iequals(FLAGS_rpc_tls_min_protocol, "TLSv1.1")) {
+#if OPENSSL_VERSION_NUMBER < 0x10001000L
+ return Status::InvalidArgument(
+ "--rpc_tls_min_protocol=TLSv1.1 is not be supported on this platform. "
+ "TLSv1 is the latest supported TLS protocol.");
+#else
+ options |= SSL_OP_NO_TLSv1;
+#endif
+ } else if (!boost::iequals(FLAGS_rpc_tls_min_protocol, "TLSv1")) {
+ return Status::InvalidArgument("unknown value provided for --rpc_tls_min_protocol flag",
+ FLAGS_rpc_tls_min_protocol);
+ }
+
+ SSL_CTX_set_options(ctx_.get(), options);
OPENSSL_RET_NOT_OK(
SSL_CTX_set_cipher_list(ctx_.get(), FLAGS_rpc_tls_ciphers.c_str()),