[
https://issues.apache.org/jira/browse/IMPALA-14897?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=18075724#comment-18075724
]
ASF subversion and git services commented on IMPALA-14897:
----------------------------------------------------------
Commit 417ba2d3eb1d252eb21834d1cf6f9e4f21ba49f9 in impala's branch
refs/heads/master from jasonmfehr
[ https://gitbox.apache.org/repos/asf?p=impala.git;h=417ba2d3e ]
IMPALA-14897: [Patch 1 of 2] Configure TLS v1.3 Cipher Suites on Thrift Servers
Adds configuration of Impala Thrift servers to set the
TLS 1.3 allowed ciphersuites.
The '--tls_ciphersuites' parameter sets the list of
TLS 1.3 ciphersuites that each Thrift server is allowed to
choose from during TLS handshakes from inbound client
connections. The value of this parameter is now being set
on all 'ThriftServerBuilder' instances so that each Thrift
server only uses the configured allowed TLS 1.3
ciphersuites. Before, 'ThriftServerBuilder' instances used
all supported OS OpenSSL TLS 1.3 ciphersuites.
The lone exception is the external frontend Thrift server
since that Thrift server does not support any TLS
connections. IMPALA-14898 was opened to add TLS support to
that Thrift server.
The following supporting changes are included:
1. start-impala-cluster.py: New startup flag '--enable_tls'
added to spin up a TLS 1.2/1.3 localhost cluster.
2. localhost.pem: Regenerated certificate to be signed by
the wildcardCA.pem CA certificate. This certificate was
not used during testing until test_server_tls.py.
3. certificates-info.txt: Added details about the localhost
certificate/key.
4. network.py: Added generic TLS-related functions that can
be used in future TLS testing.
5. custom_cluster_test_suite.py: Added 'admissiond_args'
parameter to CustomClusterTestSuite.with_args' to enable
specifying the '--admissiond_args' parameter when
starting the cluster.
Testing accomplished by manual checks using
openssl s_client and a new custom cluster test that does
both positive assertions that ciphersuites configured on
the cluster are allowed and negative assertions that
ciphersuites supported by the OS OpenSSL but not configured
on the cluster are not allowed.
kRPC testing will be handled in patch 2.
Change-Id: Id88a4e10fbad3132d14e35bcbbbc73d343c7761a
Generated-by: Github Copilot (GPT-5.3-Codex)
Reviewed-on: http://gerrit.cloudera.org:8080/24198
Reviewed-by: Impala Public Jenkins <[email protected]>
Tested-by: Impala Public Jenkins <[email protected]>
> Thrift Servers Must Set TLS v1.3 Ciphersuites
> ---------------------------------------------
>
> Key: IMPALA-14897
> URL: https://issues.apache.org/jira/browse/IMPALA-14897
> Project: IMPALA
> Issue Type: Bug
> Reporter: Jason Fehr
> Assignee: Jason Fehr
> Priority: Critical
>
> When `ThriftServerBuilder` is used to create Thrift servers, TLS ciphersuites
> are never set by calling the `tls_ciphersuites` function:
> https://github.com/apache/impala/blob/cefeb760a886d28c05f98917cdfeac864728f270/be/src/statestore/statestore-subscriber.cc#L313-L317
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
