natas_hw
/
cassandra
mirror of https://github.com/apache/cassandra
0
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

Remove hard-coded SSL cipher suites and protocols 

patch by Stefan Podkowinski; reviewed by Robert Stupp for CASSANDRA-10508
This commit is contained in:
Stefan Podkowinski 2016-03-16 20:36:44 +01:00 committed by Robert Stupp
parent e5394f192e
commit e4a0a4bf65
7 changed files with 13 additions and 18 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

1
CHANGES.txt
View File

@ -1,4 +1,5 @@
3.6
* Remove hard-coded SSL cipher suites and protocols (CASSANDRA-10508)
* Improve concurrency in CompactionStrategyManager (CASSANDRA-10099)
* (cqlsh) interpret CQL type for formatting blobs (CASSANDRA-11274)
* Refuse to start and print txn log information in case of disk

12
conf/cassandra.yaml
View File

@ -876,10 +876,14 @@ request_scheduler: org.apache.cassandra.scheduler.NoScheduler
# request_scheduler_id: keyspace
# Enable or disable inter-node encryption
# Default settings are TLS v1, RSA 1024-bit keys (it is imperative that
# users generate their own keys) TLS_RSA_WITH_AES_128_CBC_SHA as the cipher
# suite for authentication, key exchange and encryption of the actual data transfers.
# Use the DHE/ECDHE ciphers if running in FIPS 140 compliant mode.
# JVM defaults for supported SSL socket protocols and cipher suites can
# be replaced using custom encryption options. This is not recommended
# unless you have policies in place that dictate certain settings, or
# need to disable vulnerable ciphers or protocols in case the JVM cannot
# be updated.
# FIPS compliant settings can be configured at JVM level and should not
# involve changing encryption settings here:
# https://docs.oracle.com/javase/8/docs/technotes/guides/security/jsse/FIPS.html
# NOTE: No custom encryption options are enabled at the moment
# The available internode options are : all, none, dc, rack
#

8
src/java/org/apache/cassandra/config/EncryptionOptions.java
View File

@ -17,17 +17,15 @@
*/
package org.apache.cassandra.config;
import javax.net.ssl.SSLSocketFactory;
public abstract class EncryptionOptions
{
public String keystore = "conf/.keystore";
public String keystore_password = "cassandra";
public String truststore = "conf/.truststore";
public String truststore_password = "cassandra";
public String[] cipher_suites = {
"TLS_RSA_WITH_AES_128_CBC_SHA", "TLS_RSA_WITH_AES_256_CBC_SHA",
"TLS_DHE_RSA_WITH_AES_128_CBC_SHA", "TLS_DHE_RSA_WITH_AES_256_CBC_SHA",
"TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA"
};
public String[] cipher_suites = ((SSLSocketFactory)SSLSocketFactory.getDefault()).getDefaultCipherSuites();
public String protocol = "TLS";
public String algorithm = "SunX509";
public String store_type = "JKS";

5
src/java/org/apache/cassandra/security/SSLFactory.java
View File

@ -53,7 +53,6 @@ import com.google.common.collect.Sets;
public final class SSLFactory
{
private static final Logger logger = LoggerFactory.getLogger(SSLFactory.class);
public static final String[] ACCEPTED_PROTOCOLS = new String[] {"SSLv2Hello", "TLSv1", "TLSv1.1", "TLSv1.2"};
private static boolean checkedExpiry = false;
public static SSLServerSocket getServerSocket(EncryptionOptions options, InetAddress address, int port) throws IOException
@ -64,7 +63,6 @@ public final class SSLFactory
String[] suites = filterCipherSuites(serverSocket.getSupportedCipherSuites(), options.cipher_suites);
serverSocket.setEnabledCipherSuites(suites);
serverSocket.setNeedClientAuth(options.require_client_auth);
serverSocket.setEnabledProtocols(ACCEPTED_PROTOCOLS);
serverSocket.bind(new InetSocketAddress(address, port), 500);
return serverSocket;
}
@ -76,7 +74,6 @@ public final class SSLFactory
SSLSocket socket = (SSLSocket) ctx.getSocketFactory().createSocket(address, port, localAddress, localPort);
String[] suites = filterCipherSuites(socket.getSupportedCipherSuites(), options.cipher_suites);
socket.setEnabledCipherSuites(suites);
socket.setEnabledProtocols(ACCEPTED_PROTOCOLS);
return socket;
}
@ -87,7 +84,6 @@ public final class SSLFactory
SSLSocket socket = (SSLSocket) ctx.getSocketFactory().createSocket(address, port);
String[] suites = filterCipherSuites(socket.getSupportedCipherSuites(), options.cipher_suites);
socket.setEnabledCipherSuites(suites);
socket.setEnabledProtocols(ACCEPTED_PROTOCOLS);
return socket;
}
@ -98,7 +94,6 @@ public final class SSLFactory
SSLSocket socket = (SSLSocket) ctx.getSocketFactory().createSocket();
String[] suites = filterCipherSuites(socket.getSupportedCipherSuites(), options.cipher_suites);
socket.setEnabledCipherSuites(suites);
socket.setEnabledProtocols(ACCEPTED_PROTOCOLS);
return socket;
}

3
src/java/org/apache/cassandra/thrift/CustomTThreadPoolServer.java
View File

@ -256,8 +256,7 @@ public class CustomTThreadPoolServer extends TServer
SSLServerSocket sslServerSocket = (SSLServerSocket) sslServer.getServerSocket();
String[] suites = SSLFactory.filterCipherSuites(sslServerSocket.getSupportedCipherSuites(), clientEnc.cipher_suites);
sslServerSocket.setEnabledCipherSuites(suites);
sslServerSocket.setEnabledProtocols(SSLFactory.ACCEPTED_PROTOCOLS);
serverTransport = new TCustomServerSocket(sslServer.getServerSocket(), args.keepAlive, args.sendBufferSize, args.recvBufferSize);
serverTransport = new TCustomServerSocket(sslServerSocket, args.keepAlive, args.sendBufferSize, args.recvBufferSize);
}
else
{

1
src/java/org/apache/cassandra/transport/Server.java
View File

@ -361,7 +361,6 @@ public class Server implements CassandraDaemon.Server
String[] suites = SSLFactory.filterCipherSuites(sslEngine.getSupportedCipherSuites(), encryptionOptions.cipher_suites);
sslEngine.setEnabledCipherSuites(suites);
sslEngine.setNeedClientAuth(encryptionOptions.require_client_auth);
sslEngine.setEnabledProtocols(SSLFactory.ACCEPTED_PROTOCOLS);
return new SslHandler(sslEngine);
}
}

1
src/java/org/apache/cassandra/transport/SimpleClient.java
View File

@ -293,7 +293,6 @@ public class SimpleClient implements Closeable
sslEngine.setUseClientMode(true);
String[] suites = SSLFactory.filterCipherSuites(sslEngine.getSupportedCipherSuites(), encryptionOptions.cipher_suites);
sslEngine.setEnabledCipherSuites(suites);
sslEngine.setEnabledProtocols(SSLFactory.ACCEPTED_PROTOCOLS);
channel.pipeline().addFirst("ssl", new SslHandler(sslEngine));
}
}