Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

(#19884) Intermittent SSL handshake error #512

Merged
merged 3 commits into from May 14, 2013
Merged

(#19884) Intermittent SSL handshake error #512

Show file tree
Hide file tree
Changes from 1 commit
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
03e020d
(#19884) Intermittent SSL handshake error
grimradical May 10, 2013
6233ba4
Only restrict the cipher suites on affected JVMs
grimradical May 13, 2013
1f3f45d
Tweak docs for cipher-suites option
grimradical May 14, 2013
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Jump to
Jump to file
Failed to load files.
Diff view
Diff view
6 changes: 6 additions & 0 deletions documentation/configure.markdown
View file
Open in desktop
Expand Up @@ -394,6 +394,12 @@ Optional. This describes the path to a file that contains a list of certificate

If not supplied, PuppetDB uses standard HTTPS without any additional authorization. All HTTPS clients must still supply valid, verifiable SSL client certificates.

### `cipher-suites`

Optional. A comma-separated list of cryptographic ciphers to allow for incoming SSL connections. Valid names are listed in the [official JDK cryptographic providers documentation](http://docs.oracle.com/javase/7/docs/technotes/guides/security/SunProviders.html#SupportedCipherSuites); you'll need to use the all-caps cipher suite name.

If not supplied, PuppetDB uses the complete, non-DHE set of ciphers.
Copy link

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Is it worth mentioning that we do this only for the known affected versions of the JDK?


`[repl]` Settings
-----

Expand Down
31 changes: 27 additions & 4 deletions src/com/puppetlabs/jetty.clj
View file
Open in desktop
Expand Up @@ -4,7 +4,8 @@
(:import (org.eclipse.jetty.server Server)
(org.eclipse.jetty.server.nio SelectChannelConnector))
(:require [ring.adapter.jetty :as jetty])
(:use [clojure.tools.logging :as log]))
(:use [clojure.tools.logging :as log]
[clojure.string :only (split trim)]))

;; We need to monkey-patch `add-ssl-connector!` in order to set the
;; appropriate options for Client Certificate Authentication, and use
Expand All @@ -26,6 +27,22 @@
(catch Throwable e
(log/error e "Could not remove security providers; HTTPS may not work!"))))

;; TODO: Only do this on certain 1.7 jdks
;;
;; Due to weird issues between JSSE and OpenSSL clients on some 1.7
;; jdks when using Diffie-Hellman exchange, we need to only enable
;; RSA-based ciphers.
;;
;; https://forums.oracle.com/forums/thread.jspa?messageID=10999587
;; https://issues.apache.org/jira/browse/APLO-287
Copy link

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Can we file an official bug report w/Oracle so that we have a link in the code here that allows us to track when this has been resolved? How hard would it be to put together a repro jar for them?

Failing that it would be good to find somewhere to put your repro case code / docs so that we have a way to test this again in the future.

(def acceptable-ciphers ["TLS_RSA_WITH_AES_256_CBC_SHA256"
"TLS_RSA_WITH_AES_256_CBC_SHA"
"TLS_RSA_WITH_AES_128_CBC_SHA256"
"TLS_RSA_WITH_AES_128_CBC_SHA"
"SSL_RSA_WITH_RC4_128_SHA"
"SSL_RSA_WITH_3DES_EDE_CBC_SHA"
"SSL_RSA_WITH_RC4_128_MD5"])

;; Monkey-patched version of `create-server` that will only create a
;; non-SSL connector if the options specifically dictate it.

Expand All @@ -44,9 +61,15 @@
(.addConnector server (plaintext-connector options)))

(when (or (options :ssl?) (options :ssl-port))
(let [ssl-host (options :ssl-host (options :host "localhost"))
options (assoc options :host ssl-host)]
(.addConnector server (#'jetty/ssl-connector options))))
(let [ssl-host (options :ssl-host (options :host "localhost"))
options (assoc options :host ssl-host)
connector (#'jetty/ssl-connector options)
ciphers (if-let [txt (options :cipher-suites)]
(map trim (split txt #","))
acceptable-ciphers)]
(doto (.getSslContextFactory connector)
(.setIncludeCipherSuites (into-array ciphers)))
Copy link

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Do you have any idea what happens here if there is a bogus ciper name in the list?

Copy link
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Jetty ignores ciphers it doesn't recognize. Under the hood, it takes the list of ciphers available in the JVM and does an intersection with the list you supply as the whitelist. The bogus cipher name won't exist in the JVM list, and will hence fall out of the intersection.

(.addConnector server connector)))
server))

(defn run-jetty
Expand Down