From c4cc679c3b34a5f38cc17a01a96e9d69aa370641 Mon Sep 17 00:00:00 2001 From: Rohit Yadav Date: Mon, 26 Mar 2018 14:16:49 +0530 Subject: [PATCH] CLOUDSTACK-10319: Allow TLSv1, v1.1 for XenServer, Vmware (#2507) This reverts changes from #2480, instead moves TLS settings to java ciphers settings config file. It should be sufficient to enforce TLS v1.2 on public facing CloudStack services: - CloudStack webserver (Jetty based) - Apache2 for secondary storage VM - CPVM HTTPs server Signed-off-by: Rohit Yadav --- client/conf/java.security.ciphers.in | 2 +- .../java/org/apache/cloudstack/utils/security/SSLUtils.java | 4 ++-- .../src/test/java/com/cloud/utils/security/SSLUtilsTest.java | 4 ++-- 3 files changed, 5 insertions(+), 5 deletions(-) diff --git a/client/conf/java.security.ciphers.in b/client/conf/java.security.ciphers.in index 986abf61e71..27e2d690ee6 100644 --- a/client/conf/java.security.ciphers.in +++ b/client/conf/java.security.ciphers.in @@ -15,4 +15,4 @@ # specific language governing permissions and limitations # under the License. -jdk.tls.disabledAlgorithms=DH keySize < 128, RSA keySize < 128, DES keySize < 128, SHA1 keySize < 128, MD5 keySize < 128, RC4 \ No newline at end of file +jdk.tls.disabledAlgorithms=SSLv2Hello, SSLv3, TLSv1, TLSv1.1, DH keySize < 128, RSA keySize < 128, DES keySize < 128, SHA1 keySize < 128, MD5 keySize < 128, RC4 diff --git a/utils/src/main/java/org/apache/cloudstack/utils/security/SSLUtils.java b/utils/src/main/java/org/apache/cloudstack/utils/security/SSLUtils.java index 9fbdb4aa553..8016f5a1916 100644 --- a/utils/src/main/java/org/apache/cloudstack/utils/security/SSLUtils.java +++ b/utils/src/main/java/org/apache/cloudstack/utils/security/SSLUtils.java @@ -34,7 +34,7 @@ public class SSLUtils { public static String[] getSupportedProtocols(String[] protocols) { Set set = new HashSet(); for (String s : protocols) { - if (s.equals("TLSv1") || s.equals("TLSv1.1") || s.equals("SSLv3") || s.equals("SSLv2Hello")) { + if (s.equals("SSLv3") || s.equals("SSLv2Hello")) { continue; } set.add(s); @@ -46,7 +46,7 @@ public class SSLUtils { * It returns recommended protocols that are considered secure. */ public static String[] getRecommendedProtocols() { - return new String[] { "TLSv1.2" }; + return new String[] { "TLSv1", "TLSv1.1", "TLSv1.2" }; } /** diff --git a/utils/src/test/java/com/cloud/utils/security/SSLUtilsTest.java b/utils/src/test/java/com/cloud/utils/security/SSLUtilsTest.java index 6c66dcd1bd0..625b538d7f2 100644 --- a/utils/src/test/java/com/cloud/utils/security/SSLUtilsTest.java +++ b/utils/src/test/java/com/cloud/utils/security/SSLUtilsTest.java @@ -69,9 +69,9 @@ public class SSLUtilsTest { } private void verifyProtocols(ArrayList protocolsList) { + Assert.assertTrue(protocolsList.contains("TLSv1")); + Assert.assertTrue(protocolsList.contains("TLSv1.1")); Assert.assertTrue(protocolsList.contains("TLSv1.2")); - Assert.assertFalse(protocolsList.contains("TLSv1")); - Assert.assertFalse(protocolsList.contains("TLSv1.1")); Assert.assertFalse(protocolsList.contains("SSLv3")); Assert.assertFalse(protocolsList.contains("SSLv2Hello")); }