[
https://issues.apache.org/jira/browse/RATIS-2596?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel
]
Tsz-wo Sze resolved RATIS-2596.
-------------------------------
Fix Version/s: 3.3.0
Assignee: István Fajth
Resolution: Fixed
The pull request is now merged. Thanks, [~pifta]!
> Unsupported TLS cipher suites may crash gRPC servers
> ----------------------------------------------------
>
> Key: RATIS-2596
> URL: https://issues.apache.org/jira/browse/RATIS-2596
> Project: Ratis
> Issue Type: Improvement
> Components: gRPC
> Affects Versions: 3.3.0
> Reporter: István Fajth
> Assignee: István Fajth
> Priority: Major
> Fix For: 3.3.0
>
> Time Spent: 20m
> Remaining Estimate: 0h
>
> In HDDS-15176 we realized that letting the SSL ciphers to be configured for
> gRPC with Netty can lead to misconfiguration where a cipher that is not
> supported by Netty is configured, and that crashed the gRPC endpoint in Ozone.
> In order to avoid similar situations in Ratis, I propose to change from the
> IdentityCipherSuiteFilter to the SupportedCipherSuiteFilter in the gRPC TLS
> setup in GrpcUtil#configureSslContextBuilder.
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
