[HADOOP-12886] Exclude weak ciphers in SSLFactory through ssl-server.xml

• Type: Improvement
• Status: Resolved
• Priority: Major
• Resolution: Fixed
• Affects Version/s: 2.7.2
• Fix Version/s: 2.8.0, 3.0.0-alpha1
• Labels: Netty datanode security
• Target Version/s: 2.8.0
• Hadoop Flags: Reviewed
• Assignee: Wei-Chiu Chuang
• Reporter: Wei-Chiu Chuang
• Created: 03/Mar/16 23:23
• Updated: 28/Dec/18 07:33
• Resolved: 30/Mar/16 21:21

Description

HADOOP-12668 added support to exclude weak ciphers in HttpServer2, which is good for name nodes. But data node web UI is based on Netty, which uses SSLFactory and does not read ssl-server.xml to exclude the ciphers.

We should also add the same support for Netty for consistency.

I will attach a full patch later.

Issue Links

• breaks: HADOOP-14341 Support multi-line value for ssl.server.exclude.cipher.list
• is related to: HADOOP-16016 TestSSLFactory#testServerWeakCiphers sporadically fails in precommit builds
• relates to: HADOOP-12668 Support excluding weak Ciphers in HttpServer2 through ssl-server.xml