[HADOOP-14341] Support multi-line value for ssl.server.exclude.cipher.list

• Type: Bug
• Status: Resolved
• Priority: Major
• Resolution: Fixed
• Affects Version/s: 2.7.4
• Fix Version/s: 2.9.0, 3.0.0-alpha4, 2.8.2
• Target Version/s: 2.8.1, 3.0.0-alpha4
• Assignee: John Zhuge
• Reporter: John Zhuge
• Created: 21/Apr/17 09:08
• Updated: 08/Jun/17 00:13
• Resolved: 26/Apr/17 05:46

Description

The multi-line value for ssl.server.exclude.cipher.list shown in ssl-server.xml.exmple does not work. The property value

<property>
  <name>ssl.server.exclude.cipher.list</name>
  <value>TLS_ECDHE_RSA_WITH_RC4_128_SHA,SSL_DHE_RSA_EXPORT_WITH_DES40_CBC_SHA,
  SSL_RSA_WITH_DES_CBC_SHA,SSL_DHE_RSA_WITH_DES_CBC_SHA,
  SSL_RSA_EXPORT_WITH_RC4_40_MD5,SSL_RSA_EXPORT_WITH_DES40_CBC_SHA,
  SSL_RSA_WITH_RC4_128_MD5</value>
  <description>Optional. The weak security cipher suites that you want excluded
  from SSL communication.</description>
</property>

is actually parsed into:

• "TLS_ECDHE_RSA_WITH_RC4_128_SHA"
• "SSL_DHE_RSA_EXPORT_WITH_DES40_CBC_SHA"
• "\nSSL_RSA_WITH_DES_CBC_SHA"
• "SSL_DHE_RSA_WITH_DES_CBC_SHA"
• "\nSSL_RSA_EXPORT_WITH_RC4_40_MD5"
• "SSL_RSA_EXPORT_WITH_DES40_CBC_SHA"
• "\nSSL_RSA_WITH_RC4_128_MD5"

Issue Links

• is broken by: HADOOP-12668 Support excluding weak Ciphers in HttpServer2 through ssl-server.xml
• is broken by: HADOOP-12886 Exclude weak ciphers in SSLFactory through ssl-server.xml