[
https://issues.apache.org/jira/browse/HDDS-17542?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel
]
Siyao Meng updated HDDS-17542:
------------------------------
Description:
Since HDDS-15152, {{HttpServer2}} always applies the configured enabled
protocols to Jetty. When {{ozone.ssl.enabled.protocols}} is not set, it falls
back to {{hadoop.ssl.enabled.protocols}}, which {{core-default.xml}} sets to
{{TLSv1.2}}. So with no SSL protocol configuration at all, the S3 Gateway and
all component web UIs reject TLSv1.3 and only negotiate TLSv1.2. Before
HDDS-10819, Jetty's defaults (TLSv1.2 and TLSv1.3) were used.
Reproduce: start S3 Gateway with HTTPS and no {{*.ssl.enabled.protocols}}
settings, then connect with a TLSv1.3-only client:
{code}
openssl s_client -connect <s3g-host>:9879 -tls1_3
{code}
The handshake fails with {{protocol_version}}. A client offering both versions
negotiates TLSv1.2.
Workaround: set {{ozone.ssl.enabled.protocols}} explicitly in
{{ozone-site.xml}} for the affected services (S3 Gateway and any component
whose web UI should accept TLSv1.3), then restart them:
{code:xml}
<property>
<name>ozone.ssl.enabled.protocols</name>
<value>TLSv1.2,TLSv1.3</value>
</property>
{code}
Proposed fix: use {{hadoop.ssl.enabled.protocols}} only when it is explicitly
configured (not just inherited from {{core-default.xml}}), otherwise default to
{{TLSv1.2,TLSv1.3}}. {{ozone.ssl.enabled.protocols}} keeps precedence, and an
explicit {{TLSv1.2}} (the case HDDS-15152 fixed) is still honored.
was:
Since HDDS-15152, {{HttpServer2}} always applies the configured enabled
protocols to Jetty. When {{ozone.ssl.enabled.protocols}} is not set, it falls
back to {{hadoop.ssl.enabled.protocols}}, which {{core-default.xml}} sets to
{{TLSv1.2}}. So with no SSL protocol configuration at all, the S3 Gateway and
all component web UIs reject TLSv1.3 and only negotiate TLSv1.2. Before
HDDS-10819, Jetty's defaults (TLSv1.2 and TLSv1.3) were used.
Reproduce: start S3 Gateway with HTTPS and no {{*.ssl.enabled.protocols}}
settings, then connect with a TLSv1.3-only client:
{code}
openssl s_client -connect <s3g-host>:9879 -tls1_3
{code}
The handshake fails with {{protocol_version}}. A client offering both versions
negotiates TLSv1.2.
Proposed fix: use {{hadoop.ssl.enabled.protocols}} only when it is explicitly
configured (not just inherited from {{core-default.xml}}), otherwise default to
{{TLSv1.2,TLSv1.3}}. {{ozone.ssl.enabled.protocols}} keeps precedence, and an
explicit {{TLSv1.2}} (the case HDDS-15152 fixed) is still honored.
> Re-enable TLSv1.3 by default on Ozone HTTPS endpoints
> -----------------------------------------------------
>
> Key: HDDS-17542
> URL: https://issues.apache.org/jira/browse/HDDS-17542
> Project: Apache Ozone
> Issue Type: Bug
> Components: Security, server-framework
> Affects Versions: 2.2.0, 2.2.1
> Reporter: Siyao Meng
> Assignee: Siyao Meng
> Priority: Major
> Labels: pull-request-available
>
> Since HDDS-15152, {{HttpServer2}} always applies the configured enabled
> protocols to Jetty. When {{ozone.ssl.enabled.protocols}} is not set, it falls
> back to {{hadoop.ssl.enabled.protocols}}, which {{core-default.xml}} sets to
> {{TLSv1.2}}. So with no SSL protocol configuration at all, the S3 Gateway and
> all component web UIs reject TLSv1.3 and only negotiate TLSv1.2. Before
> HDDS-10819, Jetty's defaults (TLSv1.2 and TLSv1.3) were used.
> Reproduce: start S3 Gateway with HTTPS and no {{*.ssl.enabled.protocols}}
> settings, then connect with a TLSv1.3-only client:
> {code}
> openssl s_client -connect <s3g-host>:9879 -tls1_3
> {code}
> The handshake fails with {{protocol_version}}. A client offering both
> versions negotiates TLSv1.2.
> Workaround: set {{ozone.ssl.enabled.protocols}} explicitly in
> {{ozone-site.xml}} for the affected services (S3 Gateway and any component
> whose web UI should accept TLSv1.3), then restart them:
> {code:xml}
> <property>
> <name>ozone.ssl.enabled.protocols</name>
> <value>TLSv1.2,TLSv1.3</value>
> </property>
> {code}
> Proposed fix: use {{hadoop.ssl.enabled.protocols}} only when it is explicitly
> configured (not just inherited from {{core-default.xml}}), otherwise default
> to {{TLSv1.2,TLSv1.3}}. {{ozone.ssl.enabled.protocols}} keeps precedence, and
> an explicit {{TLSv1.2}} (the case HDDS-15152 fixed) is still honored.
--
This message was sent by Atlassian Jira
(v10.3.26#10030026)
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
