Roland Elek created HDDS-15924:
----------------------------------
Summary: Allow configuration of client-side TLS parameters for EC
Key: HDDS-15924
URL: https://issues.apache.org/jira/browse/HDDS-15924
Project: Apache Ozone
Issue Type: Improvement
Affects Versions: 2.2.0
Reporter: Roland Elek
Assignee: Roland Elek
HDDS-15094 adds configurable TLS protocol version and cipher list to the server
side of gRPC interfaces. One of these is the DataNode standalone client
interface, used for EC operations.
The client side of this interface (XceiverClientGrpc) uses default settings.
These are fairly permissive, but some TLSv1.2 ciphers that can reasonably be
expected to see real-world use are not included.
If the server-side configuration only allows TLSv1.2 and ciphers of this kind,
TLS handshakes fail. This blocks EC operations with less-than-obvious symptoms.
For example, the CLI shows errors like {{{}No enough datanodes to choose{}}},
or (after enough attempts, each creating a new EC pipeline) {{{}Pipeline limit
(5) reached{}}}.
Configuring the client-side cipher list in a way that intersects the
server-side settings has been shown to solve this in a quick proof of concept,
even when the server-side ciphers do not include the one mandated by HTTP/2.
The goal of this improvement is to expose the client-side TLS settings in
configuration. As protocol versions are closely related, they are included here
as well.
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
