[HADOOP-12668] Support excluding weak Ciphers in HttpServer2 through ssl-server.xml

• Type: Improvement
• Status: Resolved
• Priority: Critical
• Resolution: Fixed
• Affects Version/s: 2.7.1
• Fix Version/s: 2.8.0, 2.7.4, 3.0.0-alpha1
• Component/s: security
• Labels: common ha hadoop hdfs security
• Target Version/s: 2.8.0
• Hadoop Flags: Reviewed

Release Note

The Code Changes include following:
- Modified DFSUtil.java in Apache HDFS project for supplying new parameter ssl.server.exclude.cipher.list
- Modified HttpServer2.java in Apache Hadoop-common project to work with new parameter and exclude ciphers using jetty setExcludeCihers method.
- Modfied associated test classes to owrk with existing code and also cover the newfunctionality in junit

• Tags: security ssl tls hadoop
• Assignee: Vijay Singh
• Reporter: Vijay Singh
• Created: 22/Dec/15 17:16
• Updated: 21/Apr/17 09:09
• Resolved: 22/Feb/16 22:16

Description

Currently Embeded jetty Server used across all hadoop services is configured through ssl-server.xml file from their respective configuration section. However, the SSL/TLS protocol being used for this jetty servers can be downgraded to weak cipher suites. This code changes aims to add following functionality:
1) Add logic in hadoop common (HttpServer2.java and associated interfaces) to spawn jetty servers with ability to exclude weak cipher suites. I propose we make this though ssl-server.xml and hence each service can choose to disable specific ciphers.
2) Modify DFSUtil.java used by HDFS code to supply new parameter ssl.server.exclude.cipher.list for hadoop-common code, so it can exclude the ciphers supplied through this key.

Issue Links

• breaks: HADOOP-14341 Support multi-line value for ssl.server.exclude.cipher.list
• is depended upon by: HADOOP-14340 Enable KMS and HttpFS to exclude SSL ciphers
• is related to: HADOOP-12886 Exclude weak ciphers in SSLFactory through ssl-server.xml