소스 검색

HUE-9106 [core] Add SSL_NO_RENEGOCIATION option

Jean-Francois Desjeans Gauthier 6 년 전
부모
커밋
f50511054a

+ 3 - 0
desktop/conf.dist/hue.ini

@@ -110,6 +110,9 @@
   # Execute this script to produce the SSL password. This will be used when 'ssl_password' is not set.
   # Execute this script to produce the SSL password. This will be used when 'ssl_password' is not set.
   ## ssl_password_script=
   ## ssl_password_script=
 
 
+  # Disable all renegotiation in TLSv1.2 and earlier. Do not send HelloRequest messages, and ignore renegotiation requests via ClientHello. This option is only available with OpenSSL 1.1.0h and later and python 3.7
+  ## ssl_no_renegotiation=python.version >= 3.7
+
   # X-Content-Type-Options: nosniff This is a HTTP response header feature that helps prevent attacks based on MIME-type confusion.
   # X-Content-Type-Options: nosniff This is a HTTP response header feature that helps prevent attacks based on MIME-type confusion.
   ## secure_content_type_nosniff=true
   ## secure_content_type_nosniff=true
 
 

+ 3 - 0
desktop/conf/pseudo-distributed.ini.tmpl

@@ -114,6 +114,9 @@
   # Execute this script to produce the SSL password. This will be used when 'ssl_password' is not set.
   # Execute this script to produce the SSL password. This will be used when 'ssl_password' is not set.
   ## ssl_password_script=
   ## ssl_password_script=
 
 
+  # Disable all renegotiation in TLSv1.2 and earlier. Do not send HelloRequest messages, and ignore renegotiation requests via ClientHello. This option is only available with OpenSSL 1.1.0h and later and python 3.7
+  ## ssl_no_renegotiation=python.version >= 3.7
+
   # X-Content-Type-Options: nosniff This is a HTTP response header feature that helps prevent attacks based on MIME-type confusion.
   # X-Content-Type-Options: nosniff This is a HTTP response header feature that helps prevent attacks based on MIME-type confusion.
   ## secure_content_type_nosniff=true
   ## secure_content_type_nosniff=true
 
 

+ 9 - 0
desktop/core/src/desktop/conf.py

@@ -251,6 +251,15 @@ SSL_CIPHER_LIST = Config(
     '!KRB5-DES-CBC3-SHA',
     '!KRB5-DES-CBC3-SHA',
   ]))
   ]))
 
 
+def has_ssl_no_renegotiation():
+  return sys.version >= (3, 7)
+
+SSL_NO_RENEGOTIATION = Config(
+  key="ssl_no_renegotiation",
+  type=coerce_bool,
+  default=has_ssl_no_renegotiation(),
+  help=_("Disable all renegotiation in TLSv1.2 and earlier. Do not send HelloRequest messages, and ignore renegotiation requests via ClientHello. This option is only available with OpenSSL 1.1.0h and later and python 3.7"))
+
 SSL_PASSWORD = Config(
 SSL_PASSWORD = Config(
   key="ssl_password",
   key="ssl_password",
   help=_("SSL password of the certificate"),
   help=_("SSL password of the certificate"),

+ 5 - 1
desktop/core/src/desktop/lib/wsgiserver.py

@@ -1546,6 +1546,7 @@ class CherryPyWSGIServer(object):
     ssl_certificate_chain = None
     ssl_certificate_chain = None
     ssl_cipher_list = "DEFAULT:!aNULL:!eNULL:!LOW:!EXPORT:!SSLv2"
     ssl_cipher_list = "DEFAULT:!aNULL:!eNULL:!LOW:!EXPORT:!SSLv2"
     ssl_password_cb = None
     ssl_password_cb = None
+    ssl_no_renegotiation = False
     
     
     def __init__(self, bind_addr, wsgi_app, numthreads=10, server_name=None,
     def __init__(self, bind_addr, wsgi_app, numthreads=10, server_name=None,
                  max=-1, request_queue_size=5, timeout=10, shutdown_timeout=5):
                  max=-1, request_queue_size=5, timeout=10, shutdown_timeout=5):
@@ -1718,7 +1719,10 @@ class CherryPyWSGIServer(object):
             except Exception as ex:
             except Exception as ex:
               logging.exception('SSL key and certificate could not be found or have a problem')
               logging.exception('SSL key and certificate could not be found or have a problem')
               raise ex
               raise ex
-            ctx.set_options(SSL.OP_NO_SSLv2 | SSL.OP_NO_SSLv3)
+            options = SSL.OP_NO_SSLv2 | SSL.OP_NO_SSLv3
+            if self.ssl_no_renegotiation:
+              options |= SSL.OP_NO_RENEGOTIATION
+            ctx.set_options(options)
             self.socket = SSLConnection(ctx, self.socket)
             self.socket = SSLConnection(ctx, self.socket)
             self.populate_ssl_environ()
             self.populate_ssl_environ()
  
  

+ 4 - 2
desktop/core/src/desktop/management/commands/runcherrypyserver.py

@@ -45,7 +45,8 @@ CPSERVER_OPTIONS = {
   'ssl_certificate': conf.SSL_CERTIFICATE.get(),
   'ssl_certificate': conf.SSL_CERTIFICATE.get(),
   'ssl_private_key': conf.SSL_PRIVATE_KEY.get(),
   'ssl_private_key': conf.SSL_PRIVATE_KEY.get(),
   'ssl_certificate_chain': conf.SSL_CERTIFICATE_CHAIN.get(),
   'ssl_certificate_chain': conf.SSL_CERTIFICATE_CHAIN.get(),
-  'ssl_cipher_list': conf.SSL_CIPHER_LIST.get()
+  'ssl_cipher_list': conf.SSL_CIPHER_LIST.get(),
+  'ssl_no_renegotiation': conf.SSL_NO_RENEGOTIATION.get()
 }
 }
 
 
 
 
@@ -90,7 +91,8 @@ def start_server(options):
         if options['ssl_certificate_chain']:
         if options['ssl_certificate_chain']:
             server.ssl_certificate_chain = options['ssl_certificate_chain']
             server.ssl_certificate_chain = options['ssl_certificate_chain']
         server.ssl_cipher_list = options['ssl_cipher_list']
         server.ssl_cipher_list = options['ssl_cipher_list']
-
+        server.ssl_no_renegotiation = options['ssl_no_renegotiation']
+        
         ssl_password = conf.get_ssl_password()
         ssl_password = conf.get_ssl_password()
         if ssl_password:
         if ssl_password:
             server.ssl_password_cb = lambda *unused: ssl_password
             server.ssl_password_cb = lambda *unused: ssl_password