[THRIFT-4084] Improve SSL security in thrift by adding a make cross client that checks to make sure SSLv3 protocol cannot be negotiated

• Type: Improvement
• Status: Closed
• Priority: Major
• Resolution: Fixed
• Affects Version/s: 0.10.0
• Fix Version/s: 0.11.0
• Component/s: Test Suite
• Labels: cross-validation security ssl tls

Environment

Ubuntu Dockerfile

• Assignee: James E. King III
• Reporter: James E. King III
• Created: 12/Feb/17 12:13
• Updated: 14/Dec/17 13:55
• Resolved: 20/Feb/17 13:52

Description

Following code review discussions in THRIFT-3369, and seeing THRIFT-3165 in the backlog, I want to add a make cross "language" which isn't a language at all, but a test that checks to see if it is possible to negotiate at various SSL/TLS protocol versions. This would be a client-only test, likely just a bash script that leverages the openssl client and command line options to connect to a test server and see if it handshakes and negotiates protocol successfully.

Without THRIFT-3165 implemented, it will ensure:

• Can handshake using the universal SSLv23 context, however cannot negotiate SSLv3
• Can negotiate TLSv1.0, TLSv1.1, and TLSv1.2

With THRIFT-3165 it needs to change to ensure:

• Can handshake using TLSv1.2 but not any other version

The solution I came up with was to add a new client called "secure" to make crosstest. test_secure is a simple bash script that checks the appropriate rules above (the ones without THRIFT-3165, since it is not done), and I added "secure" to the list of cross test "languages" in the top level configure script.

After code review, it was moved into crossfeature and split into two parts - one called "nosslv3" checks to make sure the server is not negotiating sslv3. The other called "tls" checks ot make sure the server will negotiate at least one of TLSv1.0, TLSv1.1 or TLSv1.2.

Issue Links

• is broken by: THRIFT-3165 Disable unsafe TLSv1.0 and TLSv1.1 by default
• links to: GitHub Pull Request #1185
• links to: GitHub Pull Request #1197