CLOUDSTACK-9977: Enhance SSL protocol used by Console Proxy #2177
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
GabrielBrascher
force-pushed
the
CLOUDSTACK-9977
branch
from
5cac229
to
4056ea1
Compare
|
LGTM :) |
| @@ -38,6 +38,11 @@ | |||
| private static final Logger s_logger = Logger.getLogger(ConsoleProxySecureServerFactoryImpl.class); | |||
|
|
|||
| private SSLContext sslContext = null; | |||
| private static String[] SSL_PROTOCOLS = { "TLSv1", "TLSv1.1", "TLSv1.2" }; | |||
| private static String[] SSL_CIPHERS = { "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "TLS_DHE_RSA_WITH_AES_128_GCM_SHA256", "TLS_DHE_RSA_WITH_AES_128_CBC_SHA256", | |||
| "TLS_RSA_WITH_AES_128_GCM_SHA256", "TLS_RSA_WITH_AES_128_CBC_SHA256", "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256", "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", | |||
There was a problem hiding this comment.
@GabrielBrascher do you think we can get the list of ciphers moved/refactored to SSLUtils and other parts of the system may use it (now or in future?)
There was a problem hiding this comment.
I will check this approach and provide a feedback soon. Thanks for the hint @rhtyd !
There was a problem hiding this comment.
I transfered those SSL protocols and ciphers to methos getRecommendedProtocols and getRecommendedCiphers in SSLUtils.
|
Re-kicked travis. |
|
@rhtyd a Jenkins job has been kicked to build packages. I'll keep you posted as I make progress. |
|
Packaging result: ✖centos6 ✖centos7 ✖debian. JID-799 |
|
@GabrielBrascher check and fix build/packaging/Travis failures |
GabrielBrascher
changed the title
|
Thanks for the feedback @rhtyd ! |
GabrielBrascher
force-pushed
the
CLOUDSTACK-9977
branch
from
4056ea1
to
a2c91a2
Compare
| /** | ||
| * It returns recommended protocols that are considered secure. | ||
| */ | ||
| public static String[] getRecommendedProtocols() { |
There was a problem hiding this comment.
Thanks @GabrielBrascher much better!
| * It returns recommended protocols that are considered secure. | ||
| */ | ||
| public static String[] getRecommendedProtocols() { | ||
| String[] supportedProtocols = { "TLSv1", "TLSv1.1", "TLSv1.2" }; |
There was a problem hiding this comment.
This is a little cosmetic, but, how about returning directly the array? Instead of assigning it to a variable first?
Also, what about test cases? I mean, if someone starts using this method because it expected the behavior of returning { "TLSv1", "TLSv1.1", "TLSv1.2" }, but later some other person changes it to return only { "TLSv1.1", "TLSv1.2" }, this might affect people using this method
GabrielBrascher
force-pushed
the
CLOUDSTACK-9977
branch
from
a2c91a2
to
fb8c383
Compare
|
Thanks for the comments @rafaelweingartner. Hope I have addressed them all. |
|
|
||
| @Test | ||
| public void getSupportedProtocolsTest() { | ||
| ArrayList<String> protocolsList = new ArrayList<>(Arrays.asList(spySSLUtils.getSupportedProtocols(new String[] { "TLSv1", "TLSv1.1", "TLSv1.2", "SSLv3", "SSLv2Hello" }))); |
There was a problem hiding this comment.
I did not understand this test. You are not using the return of the method, but configuring a return.
There was a problem hiding this comment.
Unfortunately, if I did something like the test getRecommendedCiphersTest (with a simple Assert.assertArrayEquals) it would always fail. This method returns an array where the protocols are in a different position of the expected [TLSv1, TLSv1.1, TLSv1.2]. The input is [TLSv1, TLSv1.1, TLSv1.2, SSLv3, SSLv2Hello] but the output is [TLSv1, TLSv1.2, TLSv1.1].
In order to ensure that it will return the expected protocols without caring with their position in the array, I pick the returned array and set as an ArrayList to use the contains method.
Additionally, if someone in the future changes the method getSupportedProtocols and/or getRecommendedProtocols to return a sorted array according to the most recommended protocols (starting from TLSv1.2 then) this test would not fail because it still returning secure protocols.
I can use the returned array and verify all positions without changing the output to an ArrayList.
There was a problem hiding this comment.
Aha, my bad. I confused the method "getSupportedProtocols" with "getRecommendedProtocols".
Now I understand what you are doing here.
Everything is just fine +1
GabrielBrascher
force-pushed
the
CLOUDSTACK-9977
branch
from
fb8c383
to
2c996f3
Compare
rafaelweingartner
approved these changes
Jul 21, 2017
|
|
||
| @Test | ||
| public void getSupportedProtocolsTest() { | ||
| ArrayList<String> protocolsList = new ArrayList<>(Arrays.asList(spySSLUtils.getSupportedProtocols(new String[] { "TLSv1", "TLSv1.1", "TLSv1.2", "SSLv3", "SSLv2Hello" }))); |
There was a problem hiding this comment.
Aha, my bad. I confused the method "getSupportedProtocols" with "getRecommendedProtocols".
Now I understand what you are doing here.
Everything is just fine +1
sateesh-chodapuneedi
approved these changes
Jul 21, 2017
|
LGTM. |
GabrielBrascher
force-pushed
the
CLOUDSTACK-9977
branch
from
2c996f3
to
fcd40f7
Compare
|
@blueorangutan package |
|
@rhtyd a Jenkins job has been kicked to build packages. I'll keep you posted as I make progress. |
|
Packaging result: ✔centos6 ✔centos7 ✔debian. JID-819 |
|
@blueorangutan test |
|
@rhtyd a Trillian-Jenkins test job (centos7 mgmt + kvm-centos7) has been kicked to run smoke tests |
GabrielBrascher
force-pushed
the
CLOUDSTACK-9977
branch
from
fcd40f7
to
d10e824
Compare
|
Trillian test result (tid-1217)
|
| @@ -49,10 +66,10 @@ | |||
| } | |||
|
|
|||
| public static SSLContext getSSLContext() throws NoSuchAlgorithmException { | |||
| return SSLContext.getInstance("TLSv1"); | |||
| return SSLContext.getInstance("TLSv1.2"); | |||
There was a problem hiding this comment.
This might break clients (non-browser) for some cases where TLSv1.2 is not supported.
| } | ||
|
|
||
| public static SSLContext getSSLContext(String provider) throws NoSuchAlgorithmException, NoSuchProviderException { | ||
| return SSLContext.getInstance("TLSv1", provider); | ||
| return SSLContext.getInstance("TLSv1.2", provider); |
There was a problem hiding this comment.
This might break clients (non-browser) for some cases where TLSv1.2 is not supported.
|
@blueorangutan test centos7 vmware55u3 |
|
@rhtyd unsupported parameters provided. Supported mgmt server os are: |
|
@blueorangutan test centos7 vmware-55u3 |
|
@rhtyd a Trillian-Jenkins test job (centos7 mgmt + vmware-55u3) has been kicked to run smoke tests |
|
LGTM! I think that any client that doesn't support TLSv1.2 shouldn't be out there anyway. |
|
@blueorangutan package |
|
@rhtyd a Jenkins job has been kicked to build packages. I'll keep you posted as I make progress. |
|
Packaging result: ✔centos6 ✔centos7 ✔debian. JID-857 |
|
Trillian test result (tid-1242)
|
Current SSL protocol and ciphers used in SystemVMs are not the recommended. To analyze it is possible to use tests such as from SSL Labs (https://www.ssllabs.com/ssltest/). This commit changes the grade from C to -A
GabrielBrascher
force-pushed
the
CLOUDSTACK-9977
branch
from
d10e824
to
f6bd590
Compare
ACS CI BVT RunSumarry: Link to logs Folder (search by build_no): https://www.dropbox.com/sh/r2si930m8xxzavs/AAAzNrnoF1fC3auFrvsKo_8-a?dl=0 Failed tests:
Skipped tests: Passed test suits: |
|
@blueorangutan package |
|
@rhtyd a Jenkins job has been kicked to build packages. I'll keep you posted as I make progress. |
rohityadavcloud
approved these changes
Jul 26, 2017
|
Packaging result: ✔centos6 ✔centos7 ✔debian. JID-860 |
|
@blueorangutan test matrix |
|
@rhtyd a Trillian-Jenkins matrix job (centos6 mgmt + xs65sp1, centos7 mgmt + vmware55u3, centos7 mgmt + kvmcentos7) has been kicked to run smoke tests |
|
Trillian test result (tid-1251)
|
|
Trillian test result (tid-1252)
|
|
Trillian test result (tid-1253)
|
|
Test LGTM, the failed tests are intermittent (for r/vpc) and some env induced errors for vmware/xenserver. |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Current SSL protocol and ciphers used in SystemVMs are not the recommended. One can verify this with tests such as the one from SSL Labs (https://www.ssllabs.com/ssltest/). The grade was capped to C because of SSL ciphers and protocol. The grade was capped to B because it was allowed to use Diffie-Hellman keys with size lesser than 2048 bits. This commit changes the grade from C to A-.
The following image shows the test result before any changes.
After including the changes from this commit the test result was A-.
