[
https://issues.apache.org/jira/browse/IMPALA-15393?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=18118058#comment-18118058
]
ASF subversion and git services commented on IMPALA-15393:
----------------------------------------------------------
Commit ee07fc1720549464faf6de3c3ea6d11303b089dc in impala's branch
refs/heads/master from Csaba Ringhofer
[ https://gitbox.apache.org/repos/asf?p=impala.git;h=ee07fc172 ]
IMPALA-15393: Fix TLS minimum version handling after Thrift 0.24 bump
Thrift 0.24.0 bump (IMPALA-15354) changed SSL_CTX initialization
to use SSL_CTX_set_min_proto_version() instead of SSL_CTX_set_options()
to set (dis)allowed protocol versions. An unintended
consequence was allowing lower versions than the system's default minimum,
which was not possible with flags like SSL_OP_NO_TLSv1.
This caused test failures in some environments (RHEL 8.6) in cases
where the minimum version was not set (ThriftServerBuilder::ssl_version()),
passing default tls1 which overrode 1.2 from the system default. In tests
that disable tls1.2, this could lead to a version list with a gap like
tls1, tls1.1, tls1.3. AFAIK normally tls1.3 would be negotiated in this
case, but on RHEL 8.6 the SSL handshake failed.
In production the tls version is always set, and the only effect was that
Impala may lower the version to 1.2 when the system policy mandates 1.3.
Two separate fixes are added:
- ThriftServerBuilder's default is set to tls1.2 (only affects tests)
- SSL_CTX_set_min_proto_version is only called if the version is
increased, not lowered
Assisted-by: Claude Opus 4.8 (Claude Code)
Change-Id: I7542445bcf6623b15ba8c66aaba585983e11afc7
Reviewed-on: http://gerrit.cloudera.org:8080/24912
Reviewed-by: Peter Rozsa <[email protected]>
Tested-by: Impala Public Jenkins <[email protected]>
> Thrift 0.24 bump broken some ssl tests
> --------------------------------------
>
> Key: IMPALA-15393
> URL: https://issues.apache.org/jira/browse/IMPALA-15393
> Project: IMPALA
> Issue Type: Bug
> Components: Backend
> Reporter: Csaba Ringhofer
> Assignee: Csaba Ringhofer
> Priority: Critical
>
> These pass on Ubuntu 22.04 but fail on RHEL 8.6:
> SslTest.MatchedTlsCiphersuites
> SslTest.OverlappingMatchedTlsCiphersuites
> Msg:
> {code}
> Expected: { ssl_client.iface()->RegisterSubscriber( resp,
> TRegisterSubscriberRequest(), &send_done); } doesn't throw an exception.
> Actual: it throws apache::thrift::transport::TSSLException with description
> "SSL_connect: sslv3 alert handshake failure (SSL_error_code = 1)".
> {code}
> -The cause is a test bug, not a product issue. The Thrift bump brings new ssl
> context initialization logic, the leads to allowed ssl versions with gaps in
> these tests:-
> UPDATA: realized that this actually affects production, allowing lowering to
> tls 1.2 when the system default is 1.3 - this was not possible with old logic
> tls1, tls1.1, tls1.3 <- tls .1.2 is explicitly disabled for the test
> The whole in the allowed versions leads to not finding any cyphers in some
> environments.
> The fix is to not allow tls1/1.1 in the tests, which was never the intention
> of them.
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
