natas_hw
/
cassandra
mirror of https://github.com/apache/cassandra
0
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

Add extra SSL cipher suites. 

Patch by brandonwilliams, reviewed by Ray Sinnema for CASSANDRA-6613
This commit is contained in:
Brandon Williams 2014-03-17 12:05:35 -05:00
parent 8526347cad
commit 3876eefd11
3 changed files with 9 additions and 3 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

1
CHANGES.txt
View File

@ -1,4 +1,5 @@
1.2.16 1.2.16
* add extra SSL cipher suites (CASSANDRA-6613)
* fix nodetool getsstables for blob PK (CASSANDRA-6803) * fix nodetool getsstables for blob PK (CASSANDRA-6803)
* Add CMSClassUnloadingEnabled JVM option (CASSANDRA-6541) * Add CMSClassUnloadingEnabled JVM option (CASSANDRA-6541)
* Catch memtable flush exceptions during shutdown (CASSANDRA-6735) * Catch memtable flush exceptions during shutdown (CASSANDRA-6735)

5
conf/cassandra.yaml
View File

@ -651,6 +651,7 @@ index_interval: 128
# Default settings are TLS v1, RSA 1024-bit keys (it is imperative that # Default settings are TLS v1, RSA 1024-bit keys (it is imperative that
# users generate their own keys) TLS_RSA_WITH_AES_128_CBC_SHA as the cipher # users generate their own keys) TLS_RSA_WITH_AES_128_CBC_SHA as the cipher
# suite for authentication, key exchange and encryption of the actual data transfers. # suite for authentication, key exchange and encryption of the actual data transfers.
# Use the DHE/ECDHE ciphers if running in FIPS 140 compliant mode.
# NOTE: No custom encryption options are enabled at the moment # NOTE: No custom encryption options are enabled at the moment
# The available internode options are : all, none, dc, rack # The available internode options are : all, none, dc, rack
# #
@ -671,7 +672,7 @@ server_encryption_options:
# protocol: TLS # protocol: TLS
# algorithm: SunX509 # algorithm: SunX509
# store_type: JKS # store_type: JKS
# cipher_suites: [TLS_RSA_WITH_AES_128_CBC_SHA,TLS_RSA_WITH_AES_256_CBC_SHA] # cipher_suites: [TLS_RSA_WITH_AES_128_CBC_SHA,TLS_RSA_WITH_AES_256_CBC_SHA,TLS_DHE_RSA_WITH_AES_128_CBC_SHA,TLS_DHE_RSA_WITH_AES_256_CBC_SHA,TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA,TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA]
# require_client_auth: false # require_client_auth: false
# enable or disable client/server encryption. # enable or disable client/server encryption.
@ -687,7 +688,7 @@ client_encryption_options:
# protocol: TLS # protocol: TLS
# algorithm: SunX509 # algorithm: SunX509
# store_type: JKS # store_type: JKS
# cipher_suites: [TLS_RSA_WITH_AES_128_CBC_SHA,TLS_RSA_WITH_AES_256_CBC_SHA] # cipher_suites: [TLS_RSA_WITH_AES_128_CBC_SHA,TLS_RSA_WITH_AES_256_CBC_SHA,TLS_DHE_RSA_WITH_AES_128_CBC_SHA,TLS_DHE_RSA_WITH_AES_256_CBC_SHA,TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA,TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA]
# internode_compression controls whether traffic between nodes is # internode_compression controls whether traffic between nodes is
# compressed. # compressed.

6
src/java/org/apache/cassandra/config/EncryptionOptions.java
View File

@ -23,7 +23,11 @@ public abstract class EncryptionOptions
public String keystore_password = "cassandra"; public String keystore_password = "cassandra";
public String truststore = "conf/.truststore"; public String truststore = "conf/.truststore";
public String truststore_password = "cassandra"; public String truststore_password = "cassandra";
public String[] cipher_suites = {"TLS_RSA_WITH_AES_128_CBC_SHA", "TLS_RSA_WITH_AES_256_CBC_SHA"}; public String[] cipher_suites = {
"TLS_RSA_WITH_AES_128_CBC_SHA", "TLS_RSA_WITH_AES_256_CBC_SHA",
"TLS_DHE_RSA_WITH_AES_128_CBC_SHA", "TLS_DHE_RSA_WITH_AES_256_CBC_SHA",
"TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA"
};
public String protocol = "TLS"; public String protocol = "TLS";
public String algorithm = "SunX509"; public String algorithm = "SunX509";
public String store_type = "JKS"; public String store_type = "JKS";