HADOOP-11243. SSLFactory shouldn't allow SSLv3. (Wei Yan via kasha)

(cherry picked from commit 3c5f5af) (cherry picked from commit d8212c0)
sangameshs · Nov 5, 2014 · 3fbf587 · 3fbf587
1 parent 112b469
commit 3fbf587
Show file tree

Hide file tree

Showing 3 changed files with 21 additions and 1 deletion.
diff --git a/...common-project/hadoop-common/src/main/java/org/apache/hadoop/security/ssl/SSLFactory.java b/...common-project/hadoop-common/src/main/java/org/apache/hadoop/security/ssl/SSLFactory.java
@@ -66,13 +66,19 @@ public static enum Mode { CLIENT, SERVER }
   public static final String KEYSTORES_FACTORY_CLASS_KEY =
     "hadoop.ssl.keystores.factory.class";
 
+  public static final String SSL_ENABLED_PROTOCOLS =
+      "hadoop.ssl.enabled.protocols";
+  public static final String DEFAULT_SSL_ENABLED_PROTOCOLS = "TLSv1";
+
   private Configuration conf;
   private Mode mode;
   private boolean requireClientCert;
   private SSLContext context;
   private HostnameVerifier hostnameVerifier;
   private KeyStoresFactory keystoresFactory;
 
+  private String[] enabledProtocols = null;
+
   /**
    * Creates an SSLFactory.
    *
@@ -94,6 +100,9 @@ public SSLFactory(Mode mode, Configuration conf) {
       = conf.getClass(KEYSTORES_FACTORY_CLASS_KEY,
                       FileBasedKeyStoresFactory.class, KeyStoresFactory.class);
     keystoresFactory = ReflectionUtils.newInstance(klass, sslConf);
+
+    enabledProtocols = conf.getStrings(SSL_ENABLED_PROTOCOLS,
+        DEFAULT_SSL_ENABLED_PROTOCOLS);
   }
 
   private Configuration readSSLConfiguration(Mode mode) {
@@ -122,7 +131,7 @@ public void init() throws GeneralSecurityException, IOException {
     context = SSLContext.getInstance("TLS");
     context.init(keystoresFactory.getKeyManagers(),
                  keystoresFactory.getTrustManagers(), null);
-
+    context.getDefaultSSLParameters().setProtocols(enabledProtocols);
     hostnameVerifier = getHostnameVerifier(conf);
   }
 
@@ -181,6 +190,7 @@ public SSLEngine createSSLEngine()
       sslEngine.setUseClientMode(false);
       sslEngine.setNeedClientAuth(requireClientCert);
     }
+    sslEngine.setEnabledProtocols(enabledProtocols);
     return sslEngine;
   }
 

diff --git a/hadoop-common-project/hadoop-common/src/main/resources/core-default.xml b/hadoop-common-project/hadoop-common/src/main/resources/core-default.xml
@@ -1284,6 +1284,14 @@ for ldap providers in the same way as above does.
   </description>
 </property>
 
+<property>
+  <name>hadoop.ssl.enabled.protocols</name>
+  <value>TLSv1</value>
+  <description>
+    Protocols supported by the ssl.
+  </description>
+</property>
+
 <property>
   <name>hadoop.jetty.logs.serve.aliases</name>
   <value>true</value>

diff --git a/...hadoop-mapreduce-client/hadoop-mapreduce-client-core/src/site/apt/EncryptedShuffle.apt.vm b/...hadoop-mapreduce-client/hadoop-mapreduce-client-core/src/site/apt/EncryptedShuffle.apt.vm
@@ -53,6 +53,8 @@ Hadoop MapReduce Next Generation - Encrypted Shuffle
 | <<<hadoop.ssl.server.conf>>>         | <<<ss-server.xml>>> | Resource file from which ssl server keystore information will be extracted. This file is looked up in the classpath, typically it should be in Hadoop conf/ directory |
 *--------------------------------------+---------------------+-----------------+
 | <<<hadoop.ssl.client.conf>>>         | <<<ss-client.xml>>> | Resource file from which ssl server keystore information will be extracted. This file is looked up in the classpath, typically it should be in Hadoop conf/ directory |
+*--------------------------------------+---------------------+-----------------+
+| <<<hadoop.ssl.enabled.protocols>>>   | <<<TLSv1>>>         | The supported SSL protocols (JDK6 can use <<TLSv1>>, JDK7+ can use <<TLSv1,TLSv1.1,TLSv1.2>>) |
 *--------------------------------------+---------------------+-----------------+
 
   <<IMPORTANT:>> Currently requiring client certificates should be set to false.