Преглед на файлове

HUE-9106 [core] Add SSL_NO_RENEGOCIATION option

Jean-Francois Desjeans Gauthier преди 6 години
родител
ревизия
f50511054a

+ 3 - 0
desktop/conf.dist/hue.ini

@@ -110,6 +110,9 @@
   # Execute this script to produce the SSL password. This will be used when 'ssl_password' is not set.
   ## ssl_password_script=
 
+  # Disable all renegotiation in TLSv1.2 and earlier. Do not send HelloRequest messages, and ignore renegotiation requests via ClientHello. This option is only available with OpenSSL 1.1.0h and later and python 3.7
+  ## ssl_no_renegotiation=python.version >= 3.7
+
   # X-Content-Type-Options: nosniff This is a HTTP response header feature that helps prevent attacks based on MIME-type confusion.
   ## secure_content_type_nosniff=true
 

+ 3 - 0
desktop/conf/pseudo-distributed.ini.tmpl

@@ -114,6 +114,9 @@
   # Execute this script to produce the SSL password. This will be used when 'ssl_password' is not set.
   ## ssl_password_script=
 
+  # Disable all renegotiation in TLSv1.2 and earlier. Do not send HelloRequest messages, and ignore renegotiation requests via ClientHello. This option is only available with OpenSSL 1.1.0h and later and python 3.7
+  ## ssl_no_renegotiation=python.version >= 3.7
+
   # X-Content-Type-Options: nosniff This is a HTTP response header feature that helps prevent attacks based on MIME-type confusion.
   ## secure_content_type_nosniff=true
 

+ 9 - 0
desktop/core/src/desktop/conf.py

@@ -251,6 +251,15 @@ SSL_CIPHER_LIST = Config(
     '!KRB5-DES-CBC3-SHA',
   ]))
 
+def has_ssl_no_renegotiation():
+  return sys.version >= (3, 7)
+
+SSL_NO_RENEGOTIATION = Config(
+  key="ssl_no_renegotiation",
+  type=coerce_bool,
+  default=has_ssl_no_renegotiation(),
+  help=_("Disable all renegotiation in TLSv1.2 and earlier. Do not send HelloRequest messages, and ignore renegotiation requests via ClientHello. This option is only available with OpenSSL 1.1.0h and later and python 3.7"))
+
 SSL_PASSWORD = Config(
   key="ssl_password",
   help=_("SSL password of the certificate"),

+ 5 - 1
desktop/core/src/desktop/lib/wsgiserver.py

@@ -1546,6 +1546,7 @@ class CherryPyWSGIServer(object):
     ssl_certificate_chain = None
     ssl_cipher_list = "DEFAULT:!aNULL:!eNULL:!LOW:!EXPORT:!SSLv2"
     ssl_password_cb = None
+    ssl_no_renegotiation = False
     
     def __init__(self, bind_addr, wsgi_app, numthreads=10, server_name=None,
                  max=-1, request_queue_size=5, timeout=10, shutdown_timeout=5):
@@ -1718,7 +1719,10 @@ class CherryPyWSGIServer(object):
             except Exception as ex:
               logging.exception('SSL key and certificate could not be found or have a problem')
               raise ex
-            ctx.set_options(SSL.OP_NO_SSLv2 | SSL.OP_NO_SSLv3)
+            options = SSL.OP_NO_SSLv2 | SSL.OP_NO_SSLv3
+            if self.ssl_no_renegotiation:
+              options |= SSL.OP_NO_RENEGOTIATION
+            ctx.set_options(options)
             self.socket = SSLConnection(ctx, self.socket)
             self.populate_ssl_environ()
  

+ 4 - 2
desktop/core/src/desktop/management/commands/runcherrypyserver.py

@@ -45,7 +45,8 @@ CPSERVER_OPTIONS = {
   'ssl_certificate': conf.SSL_CERTIFICATE.get(),
   'ssl_private_key': conf.SSL_PRIVATE_KEY.get(),
   'ssl_certificate_chain': conf.SSL_CERTIFICATE_CHAIN.get(),
-  'ssl_cipher_list': conf.SSL_CIPHER_LIST.get()
+  'ssl_cipher_list': conf.SSL_CIPHER_LIST.get(),
+  'ssl_no_renegotiation': conf.SSL_NO_RENEGOTIATION.get()
 }
 
 
@@ -90,7 +91,8 @@ def start_server(options):
         if options['ssl_certificate_chain']:
             server.ssl_certificate_chain = options['ssl_certificate_chain']
         server.ssl_cipher_list = options['ssl_cipher_list']
-
+        server.ssl_no_renegotiation = options['ssl_no_renegotiation']
+        
         ssl_password = conf.get_ssl_password()
         if ssl_password:
             server.ssl_password_cb = lambda *unused: ssl_password