You are viewing a plain text version of this content. The canonical link for it is here.
Posted to common-commits@hadoop.apache.org by ka...@apache.org on 2014/10/29 02:07:45 UTC
git commit: HADOOP-11243. SSLFactory shouldn't allow SSLv3. (Wei Yan
via kasha)
Repository: hadoop
Updated Branches:
refs/heads/trunk 0782f6028 -> 3c5f5af11
HADOOP-11243. SSLFactory shouldn't allow SSLv3. (Wei Yan via kasha)
Project: http://git-wip-us.apache.org/repos/asf/hadoop/repo
Commit: http://git-wip-us.apache.org/repos/asf/hadoop/commit/3c5f5af1
Tree: http://git-wip-us.apache.org/repos/asf/hadoop/tree/3c5f5af1
Diff: http://git-wip-us.apache.org/repos/asf/hadoop/diff/3c5f5af1
Branch: refs/heads/trunk
Commit: 3c5f5af1184e85158dec962df0b0bc2be8d0d1e3
Parents: 0782f60
Author: Karthik Kambatla <ka...@apache.org>
Authored: Tue Oct 28 18:03:00 2014 -0700
Committer: Karthik Kambatla <ka...@apache.org>
Committed: Tue Oct 28 18:03:00 2014 -0700
----------------------------------------------------------------------
hadoop-common-project/hadoop-common/CHANGES.txt | 2 ++
.../java/org/apache/hadoop/security/ssl/SSLFactory.java | 12 +++++++++++-
.../hadoop-common/src/main/resources/core-default.xml | 8 ++++++++
.../src/site/apt/EncryptedShuffle.apt.vm | 2 ++
4 files changed, 23 insertions(+), 1 deletion(-)
----------------------------------------------------------------------
http://git-wip-us.apache.org/repos/asf/hadoop/blob/3c5f5af1/hadoop-common-project/hadoop-common/CHANGES.txt
----------------------------------------------------------------------
diff --git a/hadoop-common-project/hadoop-common/CHANGES.txt b/hadoop-common-project/hadoop-common/CHANGES.txt
index 7358b98..a82cdae 100644
--- a/hadoop-common-project/hadoop-common/CHANGES.txt
+++ b/hadoop-common-project/hadoop-common/CHANGES.txt
@@ -1015,6 +1015,8 @@ Release 2.6.0 - UNRELEASED
HADOOP-11217. Disable SSLv3 in KMS. (Robert Kanter via kasha)
+ HADOOP-11243. SSLFactory shouldn't allow SSLv3. (Wei Yan via kasha)
+
Release 2.5.1 - 2014-09-05
INCOMPATIBLE CHANGES
http://git-wip-us.apache.org/repos/asf/hadoop/blob/3c5f5af1/hadoop-common-project/hadoop-common/src/main/java/org/apache/hadoop/security/ssl/SSLFactory.java
----------------------------------------------------------------------
diff --git a/hadoop-common-project/hadoop-common/src/main/java/org/apache/hadoop/security/ssl/SSLFactory.java b/hadoop-common-project/hadoop-common/src/main/java/org/apache/hadoop/security/ssl/SSLFactory.java
index 404b007..bbea33b 100644
--- a/hadoop-common-project/hadoop-common/src/main/java/org/apache/hadoop/security/ssl/SSLFactory.java
+++ b/hadoop-common-project/hadoop-common/src/main/java/org/apache/hadoop/security/ssl/SSLFactory.java
@@ -66,6 +66,10 @@ public class SSLFactory implements ConnectionConfigurator {
public static final String KEYSTORES_FACTORY_CLASS_KEY =
"hadoop.ssl.keystores.factory.class";
+ public static final String SSL_ENABLED_PROTOCOLS =
+ "hadoop.ssl.enabled.protocols";
+ public static final String DEFAULT_SSL_ENABLED_PROTOCOLS = "TLSv1";
+
private Configuration conf;
private Mode mode;
private boolean requireClientCert;
@@ -73,6 +77,8 @@ public class SSLFactory implements ConnectionConfigurator {
private HostnameVerifier hostnameVerifier;
private KeyStoresFactory keystoresFactory;
+ private String[] enabledProtocols = null;
+
/**
* Creates an SSLFactory.
*
@@ -94,6 +100,9 @@ public class SSLFactory implements ConnectionConfigurator {
= conf.getClass(KEYSTORES_FACTORY_CLASS_KEY,
FileBasedKeyStoresFactory.class, KeyStoresFactory.class);
keystoresFactory = ReflectionUtils.newInstance(klass, sslConf);
+
+ enabledProtocols = conf.getStrings(SSL_ENABLED_PROTOCOLS,
+ DEFAULT_SSL_ENABLED_PROTOCOLS);
}
private Configuration readSSLConfiguration(Mode mode) {
@@ -122,7 +131,7 @@ public class SSLFactory implements ConnectionConfigurator {
context = SSLContext.getInstance("TLS");
context.init(keystoresFactory.getKeyManagers(),
keystoresFactory.getTrustManagers(), null);
-
+ context.getDefaultSSLParameters().setProtocols(enabledProtocols);
hostnameVerifier = getHostnameVerifier(conf);
}
@@ -185,6 +194,7 @@ public class SSLFactory implements ConnectionConfigurator {
sslEngine.setUseClientMode(false);
sslEngine.setNeedClientAuth(requireClientCert);
}
+ sslEngine.setEnabledProtocols(enabledProtocols);
return sslEngine;
}
http://git-wip-us.apache.org/repos/asf/hadoop/blob/3c5f5af1/hadoop-common-project/hadoop-common/src/main/resources/core-default.xml
----------------------------------------------------------------------
diff --git a/hadoop-common-project/hadoop-common/src/main/resources/core-default.xml b/hadoop-common-project/hadoop-common/src/main/resources/core-default.xml
index 69dedfc..e7a382d 100644
--- a/hadoop-common-project/hadoop-common/src/main/resources/core-default.xml
+++ b/hadoop-common-project/hadoop-common/src/main/resources/core-default.xml
@@ -1373,6 +1373,14 @@ for ldap providers in the same way as above does.
</property>
<property>
+ <name>hadoop.ssl.enabled.protocols</name>
+ <value>TLSv1</value>
+ <description>
+ Protocols supported by the ssl.
+ </description>
+</property>
+
+<property>
<name>hadoop.jetty.logs.serve.aliases</name>
<value>true</value>
<description>
http://git-wip-us.apache.org/repos/asf/hadoop/blob/3c5f5af1/hadoop-mapreduce-project/hadoop-mapreduce-client/hadoop-mapreduce-client-core/src/site/apt/EncryptedShuffle.apt.vm
----------------------------------------------------------------------
diff --git a/hadoop-mapreduce-project/hadoop-mapreduce-client/hadoop-mapreduce-client-core/src/site/apt/EncryptedShuffle.apt.vm b/hadoop-mapreduce-project/hadoop-mapreduce-client/hadoop-mapreduce-client-core/src/site/apt/EncryptedShuffle.apt.vm
index e766cbc..da412df 100644
--- a/hadoop-mapreduce-project/hadoop-mapreduce-client/hadoop-mapreduce-client-core/src/site/apt/EncryptedShuffle.apt.vm
+++ b/hadoop-mapreduce-project/hadoop-mapreduce-client/hadoop-mapreduce-client-core/src/site/apt/EncryptedShuffle.apt.vm
@@ -54,6 +54,8 @@ Hadoop MapReduce Next Generation - Encrypted Shuffle
*--------------------------------------+---------------------+-----------------+
| <<<hadoop.ssl.client.conf>>> | <<<ss-client.xml>>> | Resource file from which ssl server keystore information will be extracted. This file is looked up in the classpath, typically it should be in Hadoop conf/ directory |
*--------------------------------------+---------------------+-----------------+
+| <<<hadoop.ssl.enabled.protocols>>> | <<<TLSv1>>> | The supported SSL protocols (JDK6 can use <<TLSv1>>, JDK7+ can use <<TLSv1,TLSv1.1,TLSv1.2>>) |
+*--------------------------------------+---------------------+-----------------+
<<IMPORTANT:>> Currently requiring client certificates should be set to false.
Refer the {{{ClientCertificates}Client Certificates}} section for details.