This is an automated email from the ASF dual-hosted git repository.
bennoe pushed a commit to branch 1.8.x
in repository https://gitbox.apache.org/repos/asf/mesos.git
commit 9342fd1989064caa109621b0dc1812c724451eea
Author: Stéphane Cottin <stephane.cot...@vixns.com>
AuthorDate: Mon Apr 29 13:27:04 2019 +0200
Added LIBPROCESS_SSL_ENABLE_TLS_V1_3 environment variable.
When building mesos with libopenssl >= 1.1.1, TLS1.3 is enabled by
default. This causes major communication issues between executors
and agents.
This patch adds a new `LIBPROCESS_SSL_ENABLE_TLS_V1_3` env var,
disabled by default. It should be changed to enabled by default when
full openssl >= 1.1 support will land.
Review: https://reviews.apache.org/r/70562/
---
3rdparty/libprocess/include/process/ssl/flags.hpp | 1 +
3rdparty/libprocess/include/process/ssl/gtest.hpp | 1 +
3rdparty/libprocess/src/openssl.cpp | 15 ++++++++++++++-
3rdparty/libprocess/src/openssl.hpp | 1 +
3rdparty/libprocess/src/tests/ssl_tests.cpp | 7 ++++++-
5 files changed, 23 insertions(+), 2 deletions(-)
diff --git a/3rdparty/libprocess/include/process/ssl/flags.hpp
b/3rdparty/libprocess/include/process/ssl/flags.hpp
index 3806266..f3483f9 100644
--- a/3rdparty/libprocess/include/process/ssl/flags.hpp
+++ b/3rdparty/libprocess/include/process/ssl/flags.hpp
@@ -50,6 +50,7 @@ public:
bool enable_tls_v1_0;
bool enable_tls_v1_1;
bool enable_tls_v1_2;
+ bool enable_tls_v1_3;
};
diff --git a/3rdparty/libprocess/include/process/ssl/gtest.hpp
b/3rdparty/libprocess/include/process/ssl/gtest.hpp
index e173b32..6cdd781 100644
--- a/3rdparty/libprocess/include/process/ssl/gtest.hpp
+++ b/3rdparty/libprocess/include/process/ssl/gtest.hpp
@@ -131,6 +131,7 @@ protected:
os::unsetenv("LIBPROCESS_SSL_ENABLE_TLS_V1_0");
os::unsetenv("LIBPROCESS_SSL_ENABLE_TLS_V1_1");
os::unsetenv("LIBPROCESS_SSL_ENABLE_TLS_V1_2");
+ os::unsetenv("LIBPROCESS_SSL_ENABLE_TLS_V1_3");
// Copy the given map into the clean slate.
foreachpair (
diff --git a/3rdparty/libprocess/src/openssl.cpp
b/3rdparty/libprocess/src/openssl.cpp
index a4d5036..789bef6 100644
--- a/3rdparty/libprocess/src/openssl.cpp
+++ b/3rdparty/libprocess/src/openssl.cpp
@@ -159,6 +159,11 @@ Flags::Flags()
"enable_tls_v1_2",
"Enable SSLV1.2.",
true);
+
+ add(&Flags::enable_tls_v1_3,
+ "enable_tls_v1_3",
+ "Enable SSLV1.3.",
+ false);
}
@@ -654,7 +659,11 @@ void reinitialize()
SSL_OP_NO_SSLv3 |
SSL_OP_NO_TLSv1 |
SSL_OP_NO_TLSv1_1 |
- SSL_OP_NO_TLSv1_2);
+ SSL_OP_NO_TLSv1_2
+#if defined(SSL_OP_NO_TLSv1_3)
+ | SSL_OP_NO_TLSv1_3
+#endif
+ );
// Use server preference for cipher.
long ssl_options = SSL_OP_CIPHER_SERVER_PREFERENCE;
@@ -672,6 +681,10 @@ void reinitialize()
if (!ssl_flags->enable_tls_v1_1) { ssl_options |= SSL_OP_NO_TLSv1_1; }
// Disable TLSv1.2.
if (!ssl_flags->enable_tls_v1_2) { ssl_options |= SSL_OP_NO_TLSv1_2; }
+#if defined(SSL_OP_NO_TLSv1_3)
+ // Disable TLSv1.3.
+ if (!ssl_flags->enable_tls_v1_3) { ssl_options |= SSL_OP_NO_TLSv1_3; }
+#endif
SSL_CTX_set_options(ctx, ssl_options);
diff --git a/3rdparty/libprocess/src/openssl.hpp
b/3rdparty/libprocess/src/openssl.hpp
index 0c4192f..17bec24 100644
--- a/3rdparty/libprocess/src/openssl.hpp
+++ b/3rdparty/libprocess/src/openssl.hpp
@@ -51,6 +51,7 @@ namespace openssl {
// LIBPROCESS_SSL_ENABLE_TLS_V1_0=(false|0,true|1)
// LIBPROCESS_SSL_ENABLE_TLS_V1_1=(false|0,true|1)
// LIBPROCESS_SSL_ENABLE_TLS_V1_2=(false|0,true|1)
+// LIBPROCESS_SSL_ENABLE_TLS_V1_3=(false|0,true|1)
// LIBPROCESS_SSL_ECDH_CURVES=(auto|list of curves separated by ':')
//
// TODO(benh): When/If we need to support multiple contexts in the
diff --git a/3rdparty/libprocess/src/tests/ssl_tests.cpp
b/3rdparty/libprocess/src/tests/ssl_tests.cpp
index 5e99449..6b8496a 100644
--- a/3rdparty/libprocess/src/tests/ssl_tests.cpp
+++ b/3rdparty/libprocess/src/tests/ssl_tests.cpp
@@ -121,7 +121,12 @@ static const vector<string> protocols = {
#endif
"LIBPROCESS_SSL_ENABLE_TLS_V1_0",
"LIBPROCESS_SSL_ENABLE_TLS_V1_1",
- "LIBPROCESS_SSL_ENABLE_TLS_V1_2"
+ "LIBPROCESS_SSL_ENABLE_TLS_V1_2",
+// On some platforms, we need to build against OpenSSL versions that
+// do not support TLS 1.3 yet.
+#ifdef SSL_OP_NO_TLSv1_3
+ "LIBPROCESS_SSL_ENABLE_TLS_V1_3",
+#endif
};
