This is an automated email from the ASF dual-hosted git repository. alexey pushed a commit to branch master in repository https://gitbox.apache.org/repos/asf/kudu.git
commit efc3f372e8b9254ab6b65d1f884381016329611c Author: Todd Lipcon <[email protected]> AuthorDate: Wed Jun 19 23:49:26 2019 -0700 KUDU-2871 (part 1): disable TLS 1.3. This disables TLS 1.3 for our RPC negotiations, since the 1.5-RTT optimization breaks an assumption that the server sends the last token in the negotiation exchange. Tested that this fixes tls_handshake-test with Ubuntu 18 and libssl 1.1.1. Change-Id: I431a1352ce1b8cca61b60c2dafbebadb4303e08a Reviewed-on: http://gerrit.cloudera.org:8080/13683 Reviewed-by: Alexey Serbin <[email protected]> Tested-by: Kudu Jenkins --- src/kudu/rpc/client_negotiation.cc | 4 +++- src/kudu/security/tls_context.cc | 7 +++++++ 2 files changed, 10 insertions(+), 1 deletion(-) diff --git a/src/kudu/rpc/client_negotiation.cc b/src/kudu/rpc/client_negotiation.cc index d74bdbe..b43f55d 100644 --- a/src/kudu/rpc/client_negotiation.cc +++ b/src/kudu/rpc/client_negotiation.cc @@ -481,7 +481,9 @@ Status ClientNegotiation::HandleTlsHandshake(const NegotiatePB& response) { return Status::NotAuthorized("expected TLS_HANDSHAKE step", NegotiatePB::NegotiateStep_Name(response.step())); } - TRACE("Received TLS_HANDSHAKE response from server"); + if (!response.tls_handshake().empty()) { + TRACE("Received TLS_HANDSHAKE response from server"); + } if (PREDICT_FALSE(!response.has_tls_handshake())) { return Status::NotAuthorized("No TLS handshake token in TLS_HANDSHAKE response from server"); diff --git a/src/kudu/security/tls_context.cc b/src/kudu/security/tls_context.cc index 9bf433d..a01b779 100644 --- a/src/kudu/security/tls_context.cc +++ b/src/kudu/security/tls_context.cc @@ -61,6 +61,9 @@ #ifndef SSL_OP_NO_TLSv1_1 #define SSL_OP_NO_TLSv1_1 0x10000000U #endif +#ifndef SSL_OP_NO_TLSv1_3 +#define SSL_OP_NO_TLSv1_3 0x20000000U +#endif #ifndef TLS1_1_VERSION #define TLS1_1_VERSION 0x0302 #endif @@ -165,6 +168,10 @@ Status TlsContext::Init() { tls_min_protocol_); } + // We don't currently support TLS 1.3 because the one-and-a-half-RTT negotiation + // confuses our RPC negotiation protocol. See KUDU-2871. + options |= SSL_OP_NO_TLSv1_3; + SSL_CTX_set_options(ctx_.get(), options); OPENSSL_RET_NOT_OK(
