[KUDU-1926] Disable SSL session renegotiation

• Type: Improvement
• Status: Resolved
• Priority: Minor
• Resolution: Fixed
• Affects Version/s: 1.3.0
• Fix Version/s: 1.15.0
• Component/s: rpc, security
• Target Version/s: Backlog
• Code Review: https://gerrit.cloudera.org/#/c/17204/
• Assignee: Alexey Serbin
• Reporter: Todd Lipcon
• Created: 09/Mar/17 23:16
• Updated: 23/Mar/21 02:32
• Resolved: 23/Mar/21 02:32

Description

SSL renegotiation has had a couple of CVEs in the past. We should figure out if it's easy to disable it and do so, since we don't expect to use it in KRPC.

(it may already be the case that it's disabled by virtue of us not handling SSL_WANT_READ return from ssl_write, and SSL_WANT_WRITE from ssl_read).