You are viewing a plain text version of this content. The canonical link for it is here.

Posted to reviews@impala.apache.org by "Zoltan Borok-Nagy (Code Review)" <ge...@cloudera.org> on 2022/03/23 18:39:05 UTC

[Impala-ASF-CR] IMPALA-11195 (part 1): Disable SSL session renegotiations in the web server

Zoltan Borok-Nagy has uploaded this change for review. ( http://gerrit.cloudera.org:8080/18346

Change subject: IMPALA-11195 (part 1): Disable SSL session renegotiations in the web server
......................................................................

IMPALA-11195 (part 1): Disable SSL session renegotiations in the web server

SSL renegotiation has had a couple of CVEs in the past. This patch
disables TLS ciphers renegotiation for TLSv1.2 and prior protocol
versions in the Impala web server. Renegotiation is not possible in
a TLSv1.3 connection. Disabling renegotiations on the Thrift servers
require Thrift-side changes, hence this is handled in the
native-toolchain.

In case of OpenSSL version 1.1.0h and newer, we are
using SSL_OP_NO_RENEGOTIATION option to disable all renegotiations. In
case of OpenSSL version prior to 1.1.0a, the undocumented flag
SSL3_FLAGS_NO_RENEGOTIATE_CIPHERS is used.

The moot point is the version interval between 1.1.0a and 1.1.0g
(inclusive): the SSL3_FLAGS_NO_RENEGOTIATE_CIPHERS flag is no longer
available from the application side, but SSL_OP_NO_RENEGOTIATION is not
yet present. So, if a server binary has been compiled with OpenSSL in
the specified version range, it's still advertising the renegotiation
option, even if it's run against OpenSSL 1.1.0h or later versions.

Change-Id: I1afbd6dfcad6b8fbc2e82763222996fabba207cf
---
M be/src/thirdparty/squeasel/squeasel.c
1 file changed, 21 insertions(+), 0 deletions(-)

git pull ssh://gerrit.cloudera.org:29418/Impala-ASF refs/changes/46/18346/1
--
To view, visit http://gerrit.cloudera.org:8080/18346
To unsubscribe, visit http://gerrit.cloudera.org:8080/settings

Gerrit-Project: Impala-ASF
Gerrit-Branch: master
Gerrit-MessageType: newchange
Gerrit-Change-Id: I1afbd6dfcad6b8fbc2e82763222996fabba207cf
Gerrit-Change-Number: 18346
Gerrit-PatchSet: 1
Gerrit-Owner: Zoltan Borok-Nagy <bo...@cloudera.com>

[Impala-ASF-CR] IMPALA-11195 (part 1): Disable SSL session renegotiations in the web server

Posted by "Impala Public Jenkins (Code Review)" <ge...@cloudera.org>.

Impala Public Jenkins has submitted this change and it was merged. ( http://gerrit.cloudera.org:8080/18346 )

Change subject: IMPALA-11195 (part 1): Disable SSL session renegotiations in the web server
......................................................................

IMPALA-11195 (part 1): Disable SSL session renegotiations in the web server

SSL renegotiation has had a couple of CVEs in the past. This patch
disables TLS ciphers renegotiation for TLSv1.2 and prior protocol
versions in the Impala web server. Renegotiation is not possible in
a TLSv1.3 connection. Disabling renegotiations on the Thrift servers
require Thrift-side changes, hence this is handled in the
native-toolchain.

This change is based on KUDU-1926.

In case of OpenSSL version 1.1.0h and newer, we are
using SSL_OP_NO_RENEGOTIATION option to disable all renegotiations. In
case of OpenSSL version prior to 1.1.0a, the undocumented flag
SSL3_FLAGS_NO_RENEGOTIATE_CIPHERS is used.

The moot point is the version interval between 1.1.0a and 1.1.0g
(inclusive): the SSL3_FLAGS_NO_RENEGOTIATE_CIPHERS flag is no longer
available from the application side, but SSL_OP_NO_RENEGOTIATION is not
yet present. So, if a server binary has been compiled with OpenSSL in
the specified version range, it's still advertising the renegotiation
option, even if it's run against OpenSSL 1.1.0h or later versions.

Change-Id: I1afbd6dfcad6b8fbc2e82763222996fabba207cf
Reviewed-on: http://gerrit.cloudera.org:8080/18346
Reviewed-by: Impala Public Jenkins <im...@cloudera.com>
Tested-by: Impala Public Jenkins <im...@cloudera.com>
---
M be/src/thirdparty/squeasel/squeasel.c
1 file changed, 21 insertions(+), 0 deletions(-)

Approvals:
  Impala Public Jenkins: Looks good to me, approved; Verified

-- 
To view, visit http://gerrit.cloudera.org:8080/18346
To unsubscribe, visit http://gerrit.cloudera.org:8080/settings

Gerrit-Project: Impala-ASF
Gerrit-Branch: master
Gerrit-MessageType: merged
Gerrit-Change-Id: I1afbd6dfcad6b8fbc2e82763222996fabba207cf
Gerrit-Change-Number: 18346
Gerrit-PatchSet: 5
Gerrit-Owner: Zoltan Borok-Nagy <bo...@cloudera.com>
Gerrit-Reviewer: Impala Public Jenkins <im...@cloudera.com>
Gerrit-Reviewer: Joe McDonnell <jo...@cloudera.com>
Gerrit-Reviewer: Riza Suminto <ri...@cloudera.com>

[Impala-ASF-CR] IMPALA-11195 (part 1): Disable SSL session renegotiations in the web server

Posted by "Impala Public Jenkins (Code Review)" <ge...@cloudera.org>.

Impala Public Jenkins has posted comments on this change. ( http://gerrit.cloudera.org:8080/18346 )

Change subject: IMPALA-11195 (part 1): Disable SSL session renegotiations in the web server
......................................................................


Patch Set 1:

Build Successful 

https://jenkins.impala.io/job/gerrit-code-review-checks/10328/ : Initial code review checks passed. Use gerrit-verify-dryrun-external or gerrit-verify-dryrun to run full precommit tests.


-- 
To view, visit http://gerrit.cloudera.org:8080/18346
To unsubscribe, visit http://gerrit.cloudera.org:8080/settings

Gerrit-Project: Impala-ASF
Gerrit-Branch: master
Gerrit-MessageType: comment
Gerrit-Change-Id: I1afbd6dfcad6b8fbc2e82763222996fabba207cf
Gerrit-Change-Number: 18346
Gerrit-PatchSet: 1
Gerrit-Owner: Zoltan Borok-Nagy <bo...@cloudera.com>
Gerrit-Reviewer: Impala Public Jenkins <im...@cloudera.com>
Gerrit-Reviewer: Joe McDonnell <jo...@cloudera.com>
Gerrit-Reviewer: Riza Suminto <ri...@cloudera.com>
Gerrit-Comment-Date: Wed, 23 Mar 2022 18:58:45 +0000
Gerrit-HasComments: No

[Impala-ASF-CR] IMPALA-11195 (part 1): Disable SSL session renegotiations in the web server

Posted by "Impala Public Jenkins (Code Review)" <ge...@cloudera.org>.

Impala Public Jenkins has posted comments on this change. ( http://gerrit.cloudera.org:8080/18346 )

Change subject: IMPALA-11195 (part 1): Disable SSL session renegotiations in the web server
......................................................................


Patch Set 4: Verified+1


-- 
To view, visit http://gerrit.cloudera.org:8080/18346
To unsubscribe, visit http://gerrit.cloudera.org:8080/settings

Gerrit-Project: Impala-ASF
Gerrit-Branch: master
Gerrit-MessageType: comment
Gerrit-Change-Id: I1afbd6dfcad6b8fbc2e82763222996fabba207cf
Gerrit-Change-Number: 18346
Gerrit-PatchSet: 4
Gerrit-Owner: Zoltan Borok-Nagy <bo...@cloudera.com>
Gerrit-Reviewer: Impala Public Jenkins <im...@cloudera.com>
Gerrit-Reviewer: Joe McDonnell <jo...@cloudera.com>
Gerrit-Reviewer: Riza Suminto <ri...@cloudera.com>
Gerrit-Comment-Date: Fri, 25 Mar 2022 13:02:34 +0000
Gerrit-HasComments: No

[Impala-ASF-CR] IMPALA-11195 (part 1): Disable SSL session renegotiations in the web server

Posted by "Impala Public Jenkins (Code Review)" <ge...@cloudera.org>.

Impala Public Jenkins has posted comments on this change. ( http://gerrit.cloudera.org:8080/18346 )

Change subject: IMPALA-11195 (part 1): Disable SSL session renegotiations in the web server
......................................................................


Patch Set 3: Code-Review+2


-- 
To view, visit http://gerrit.cloudera.org:8080/18346
To unsubscribe, visit http://gerrit.cloudera.org:8080/settings

Gerrit-Project: Impala-ASF
Gerrit-Branch: master
Gerrit-MessageType: comment
Gerrit-Change-Id: I1afbd6dfcad6b8fbc2e82763222996fabba207cf
Gerrit-Change-Number: 18346
Gerrit-PatchSet: 3
Gerrit-Owner: Zoltan Borok-Nagy <bo...@cloudera.com>
Gerrit-Reviewer: Impala Public Jenkins <im...@cloudera.com>
Gerrit-Reviewer: Joe McDonnell <jo...@cloudera.com>
Gerrit-Reviewer: Riza Suminto <ri...@cloudera.com>
Gerrit-Comment-Date: Thu, 24 Mar 2022 18:24:44 +0000
Gerrit-HasComments: No

[Impala-ASF-CR] IMPALA-11195 (part 1): Disable SSL session renegotiations in the web server

Posted by "Joe McDonnell (Code Review)" <ge...@cloudera.org>.

Joe McDonnell has posted comments on this change. ( http://gerrit.cloudera.org:8080/18346 )

Change subject: IMPALA-11195 (part 1): Disable SSL session renegotiations in the web server
......................................................................


Patch Set 2: Code-Review+2

This looks good to me


-- 
To view, visit http://gerrit.cloudera.org:8080/18346
To unsubscribe, visit http://gerrit.cloudera.org:8080/settings

Gerrit-Project: Impala-ASF
Gerrit-Branch: master
Gerrit-MessageType: comment
Gerrit-Change-Id: I1afbd6dfcad6b8fbc2e82763222996fabba207cf
Gerrit-Change-Number: 18346
Gerrit-PatchSet: 2
Gerrit-Owner: Zoltan Borok-Nagy <bo...@cloudera.com>
Gerrit-Reviewer: Impala Public Jenkins <im...@cloudera.com>
Gerrit-Reviewer: Joe McDonnell <jo...@cloudera.com>
Gerrit-Reviewer: Riza Suminto <ri...@cloudera.com>
Gerrit-Comment-Date: Thu, 24 Mar 2022 16:19:13 +0000
Gerrit-HasComments: No

[Impala-ASF-CR] IMPALA-11195 (part 1): Disable SSL session renegotiations in the web server

Posted by "Riza Suminto (Code Review)" <ge...@cloudera.org>.

Riza Suminto has posted comments on this change. ( http://gerrit.cloudera.org:8080/18346 )

Change subject: IMPALA-11195 (part 1): Disable SSL session renegotiations in the web server
......................................................................


Patch Set 2: Code-Review+1


-- 
To view, visit http://gerrit.cloudera.org:8080/18346
To unsubscribe, visit http://gerrit.cloudera.org:8080/settings

Gerrit-Project: Impala-ASF
Gerrit-Branch: master
Gerrit-MessageType: comment
Gerrit-Change-Id: I1afbd6dfcad6b8fbc2e82763222996fabba207cf
Gerrit-Change-Number: 18346
Gerrit-PatchSet: 2
Gerrit-Owner: Zoltan Borok-Nagy <bo...@cloudera.com>
Gerrit-Reviewer: Impala Public Jenkins <im...@cloudera.com>
Gerrit-Reviewer: Joe McDonnell <jo...@cloudera.com>
Gerrit-Reviewer: Riza Suminto <ri...@cloudera.com>
Gerrit-Comment-Date: Wed, 23 Mar 2022 23:23:59 +0000
Gerrit-HasComments: No

[Impala-ASF-CR] IMPALA-11195 (part 1): Disable SSL session renegotiations in the web server

Posted by "Impala Public Jenkins (Code Review)" <ge...@cloudera.org>.

Impala Public Jenkins has posted comments on this change. ( http://gerrit.cloudera.org:8080/18346 )

Change subject: IMPALA-11195 (part 1): Disable SSL session renegotiations in the web server
......................................................................


Patch Set 4: Code-Review+2


-- 
To view, visit http://gerrit.cloudera.org:8080/18346
To unsubscribe, visit http://gerrit.cloudera.org:8080/settings

Gerrit-Project: Impala-ASF
Gerrit-Branch: master
Gerrit-MessageType: comment
Gerrit-Change-Id: I1afbd6dfcad6b8fbc2e82763222996fabba207cf
Gerrit-Change-Number: 18346
Gerrit-PatchSet: 4
Gerrit-Owner: Zoltan Borok-Nagy <bo...@cloudera.com>
Gerrit-Reviewer: Impala Public Jenkins <im...@cloudera.com>
Gerrit-Reviewer: Joe McDonnell <jo...@cloudera.com>
Gerrit-Reviewer: Riza Suminto <ri...@cloudera.com>
Gerrit-Comment-Date: Fri, 25 Mar 2022 08:34:07 +0000
Gerrit-HasComments: No

[Impala-ASF-CR] IMPALA-11195 (part 1): Disable SSL session renegotiations in the web server

Posted by "Zoltan Borok-Nagy (Code Review)" <ge...@cloudera.org>.

Hello Riza Suminto, Joe McDonnell, Impala Public Jenkins,

I'd like you to reexamine a change. Please visit

http://gerrit.cloudera.org:8080/18346

to look at the new patch set (#2).

Change subject: IMPALA-11195 (part 1): Disable SSL session renegotiations in the web server
......................................................................

IMPALA-11195 (part 1): Disable SSL session renegotiations in the web server

This change is based on KUDU-1926.

Change-Id: I1afbd6dfcad6b8fbc2e82763222996fabba207cf
---
M be/src/thirdparty/squeasel/squeasel.c
1 file changed, 21 insertions(+), 0 deletions(-)

git pull ssh://gerrit.cloudera.org:29418/Impala-ASF refs/changes/46/18346/2
--
To view, visit http://gerrit.cloudera.org:8080/18346
To unsubscribe, visit http://gerrit.cloudera.org:8080/settings

Gerrit-Project: Impala-ASF
Gerrit-Branch: master
Gerrit-MessageType: newpatchset
Gerrit-Change-Id: I1afbd6dfcad6b8fbc2e82763222996fabba207cf
Gerrit-Change-Number: 18346
Gerrit-PatchSet: 2
Gerrit-Owner: Zoltan Borok-Nagy <bo...@cloudera.com>
Gerrit-Reviewer: Impala Public Jenkins <im...@cloudera.com>
Gerrit-Reviewer: Joe McDonnell <jo...@cloudera.com>
Gerrit-Reviewer: Riza Suminto <ri...@cloudera.com>

[Impala-ASF-CR] IMPALA-11195 (part 1): Disable SSL session renegotiations in the web server

Posted by "Impala Public Jenkins (Code Review)" <ge...@cloudera.org>.

Impala Public Jenkins has posted comments on this change. ( http://gerrit.cloudera.org:8080/18346 )

Change subject: IMPALA-11195 (part 1): Disable SSL session renegotiations in the web server
......................................................................


Patch Set 3: Verified-1

Build failed: https://jenkins.impala.io/job/gerrit-verify-dryrun/7962/


-- 
To view, visit http://gerrit.cloudera.org:8080/18346
To unsubscribe, visit http://gerrit.cloudera.org:8080/settings

Gerrit-Project: Impala-ASF
Gerrit-Branch: master
Gerrit-MessageType: comment
Gerrit-Change-Id: I1afbd6dfcad6b8fbc2e82763222996fabba207cf
Gerrit-Change-Number: 18346
Gerrit-PatchSet: 3
Gerrit-Owner: Zoltan Borok-Nagy <bo...@cloudera.com>
Gerrit-Reviewer: Impala Public Jenkins <im...@cloudera.com>
Gerrit-Reviewer: Joe McDonnell <jo...@cloudera.com>
Gerrit-Reviewer: Riza Suminto <ri...@cloudera.com>
Gerrit-Comment-Date: Thu, 24 Mar 2022 22:51:57 +0000
Gerrit-HasComments: No

[Impala-ASF-CR] IMPALA-11195 (part 1): Disable SSL session renegotiations in the web server

Posted by "Impala Public Jenkins (Code Review)" <ge...@cloudera.org>.

Impala Public Jenkins has posted comments on this change. ( http://gerrit.cloudera.org:8080/18346 )

Change subject: IMPALA-11195 (part 1): Disable SSL session renegotiations in the web server
......................................................................


Patch Set 3:

Build started: https://jenkins.impala.io/job/gerrit-verify-dryrun/7962/ DRY_RUN=false


-- 
To view, visit http://gerrit.cloudera.org:8080/18346
To unsubscribe, visit http://gerrit.cloudera.org:8080/settings

Gerrit-Project: Impala-ASF
Gerrit-Branch: master
Gerrit-MessageType: comment
Gerrit-Change-Id: I1afbd6dfcad6b8fbc2e82763222996fabba207cf
Gerrit-Change-Number: 18346
Gerrit-PatchSet: 3
Gerrit-Owner: Zoltan Borok-Nagy <bo...@cloudera.com>
Gerrit-Reviewer: Impala Public Jenkins <im...@cloudera.com>
Gerrit-Reviewer: Joe McDonnell <jo...@cloudera.com>
Gerrit-Reviewer: Riza Suminto <ri...@cloudera.com>
Gerrit-Comment-Date: Thu, 24 Mar 2022 18:24:44 +0000
Gerrit-HasComments: No

[Impala-ASF-CR] IMPALA-11195 (part 1): Disable SSL session renegotiations in the web server

Posted by "Impala Public Jenkins (Code Review)" <ge...@cloudera.org>.

Impala Public Jenkins has posted comments on this change. ( http://gerrit.cloudera.org:8080/18346 )

Change subject: IMPALA-11195 (part 1): Disable SSL session renegotiations in the web server
......................................................................


Patch Set 4:

Build started: https://jenkins.impala.io/job/gerrit-verify-dryrun/7964/ DRY_RUN=false


-- 
To view, visit http://gerrit.cloudera.org:8080/18346
To unsubscribe, visit http://gerrit.cloudera.org:8080/settings

Gerrit-Project: Impala-ASF
Gerrit-Branch: master
Gerrit-MessageType: comment
Gerrit-Change-Id: I1afbd6dfcad6b8fbc2e82763222996fabba207cf
Gerrit-Change-Number: 18346
Gerrit-PatchSet: 4
Gerrit-Owner: Zoltan Borok-Nagy <bo...@cloudera.com>
Gerrit-Reviewer: Impala Public Jenkins <im...@cloudera.com>
Gerrit-Reviewer: Joe McDonnell <jo...@cloudera.com>
Gerrit-Reviewer: Riza Suminto <ri...@cloudera.com>
Gerrit-Comment-Date: Fri, 25 Mar 2022 08:34:08 +0000
Gerrit-HasComments: No