[
https://issues.apache.org/jira/browse/HDDS-17542?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel
]
Siyao Meng updated HDDS-17542:
------------------------------
Release Note:
Ozone HTTPS endpoints (S3 Gateway and the web UIs of OM, SCM, Datanode, Recon
and HttpFS) accept TLSv1.2 and TLSv1.3 again by default. In Ozone 2.2.0 and
2.2.1 they accepted only TLSv1.2 unless a protocol list was configured.
The enabled protocols are now resolved in this order:
ozone.ssl.enabled.protocols if set; otherwise hadoop.ssl.enabled.protocols if
it is explicitly configured (for example in core-site.xml or ozone-site.xml,
not only inherited from core-default.xml); otherwise TLSv1.2,TLSv1.3. To keep
accepting only TLSv1.2, set ozone.ssl.enabled.protocols to TLSv1.2.
> Re-enable TLSv1.3 by default on Ozone HTTPS endpoints
> -----------------------------------------------------
>
> Key: HDDS-17542
> URL: https://issues.apache.org/jira/browse/HDDS-17542
> Project: Apache Ozone
> Issue Type: Bug
> Components: Security, server-framework
> Affects Versions: 2.2.0, 2.2.1
> Reporter: Siyao Meng
> Assignee: Siyao Meng
> Priority: Major
> Labels: pull-request-available
> Fix For: 2.3.0
>
>
> Since HDDS-15152, {{HttpServer2}} always applies the configured enabled
> protocols to Jetty. When {{ozone.ssl.enabled.protocols}} is not set, it falls
> back to {{hadoop.ssl.enabled.protocols}}, which {{core-default.xml}} sets to
> {{TLSv1.2}}. So with no SSL protocol configuration at all, the S3 Gateway and
> all component web UIs reject TLSv1.3 and only negotiate TLSv1.2. Before
> HDDS-10819, Jetty's defaults (TLSv1.2 and TLSv1.3) were used.
> Reproduce: start S3 Gateway with HTTPS and no {{*.ssl.enabled.protocols}}
> settings, then connect with a TLSv1.3-only client:
> {code}
> openssl s_client -connect <s3g-host>:9879 -tls1_3
> {code}
> The handshake fails with {{protocol_version}}. A client offering both
> versions negotiates TLSv1.2.
> Workaround: set {{ozone.ssl.enabled.protocols}} explicitly in
> {{ozone-site.xml}} for the affected services (S3 Gateway and any component
> whose web UI should accept TLSv1.3), then restart them:
> {code:xml}
> <property>
> <name>ozone.ssl.enabled.protocols</name>
> <value>TLSv1.2,TLSv1.3</value>
> </property>
> {code}
> Proposed fix: use {{hadoop.ssl.enabled.protocols}} only when it is explicitly
> configured (not just inherited from {{core-default.xml}}), otherwise default
> to {{TLSv1.2,TLSv1.3}}. {{ozone.ssl.enabled.protocols}} keeps precedence, and
> an explicit {{TLSv1.2}} (the case HDDS-15152 fixed) is still honored.
--
This message was sent by Atlassian Jira
(v10.3.26#10030026)
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
