[
https://issues.apache.org/jira/browse/HDDS-17542?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel
]
Siyao Meng updated HDDS-17542:
------------------------------
Status: Patch Available (was: Open)
> Ozone HTTPS endpoints only accept TLSv1.2 by default
> ----------------------------------------------------
>
> Key: HDDS-17542
> URL: https://issues.apache.org/jira/browse/HDDS-17542
> Project: Apache Ozone
> Issue Type: Bug
> Components: Security, server-framework
> Reporter: Siyao Meng
> Assignee: Siyao Meng
> Priority: Major
> Labels: pull-request-available
>
> Since HDDS-15152, {{HttpServer2}} always applies the configured enabled
> protocols to Jetty. When {{ozone.ssl.enabled.protocols}} is not set, it falls
> back to {{hadoop.ssl.enabled.protocols}}, which {{core-default.xml}} sets to
> {{TLSv1.2}}. So with no SSL protocol configuration at all, the S3 Gateway and
> all component web UIs reject TLSv1.3 and only negotiate TLSv1.2. Before
> HDDS-10819, Jetty's defaults (TLSv1.2 and TLSv1.3) were used.
> Reproduce: start S3 Gateway with HTTPS and no {{*.ssl.enabled.protocols}}
> settings, then connect with a TLSv1.3-only client:
> {code}
> openssl s_client -connect <s3g-host>:9879 -tls1_3
> {code}
> The handshake fails with {{protocol_version}}. A client offering both
> versions negotiates TLSv1.2.
> Proposed fix: use {{hadoop.ssl.enabled.protocols}} only when it is explicitly
> configured (not just inherited from {{core-default.xml}}), otherwise default
> to {{TLSv1.2,TLSv1.3}}. {{ozone.ssl.enabled.protocols}} keeps precedence, and
> an explicit {{TLSv1.2}} (the case HDDS-15152 fixed) is still honored.
--
This message was sent by Atlassian Jira
(v10.3.26#10030026)
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
