-
Notifications
You must be signed in to change notification settings - Fork 25k
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
Issue deprecation warning if TLSv1.0 is used without explicit config (#…
…37788) TLSv1.0 will be removed from the default list of supported protocols in v7.0. This change adds deprecation warnings when a TLS v1.0 connection is used without having been explictly configured as a supported protocol. Such situations will fail in Elasticsearch 7.x This covers: - Incoming connections on transport or https. - Outgoing http connections for watcher, monitoring & saml metadata - Outgoing http connections for ldap & AD. Deprecations for incoming HTTP connections are included in the Warning headers sent back to that client. For the other contexts, the deprecation log must be used.
- Loading branch information
Showing
24 changed files
with
842 additions
and
112 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
72 changes: 72 additions & 0 deletions
72
...k/plugin/core/src/main/java/org/elasticsearch/xpack/core/ssl/TLSv1DeprecationHandler.java
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,72 @@ | ||
| /* | ||
| * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one | ||
| * or more contributor license agreements. Licensed under the Elastic License; | ||
| * you may not use this file except in compliance with the Elastic License. | ||
| */ | ||
|
|
||
| package org.elasticsearch.xpack.core.ssl; | ||
|
|
||
| import org.apache.logging.log4j.Logger; | ||
| import org.elasticsearch.common.logging.DeprecationLogger; | ||
| import org.elasticsearch.common.settings.Settings; | ||
|
|
||
| import javax.net.ssl.SSLSession; | ||
| import java.time.LocalDate; | ||
| import java.time.ZoneId; | ||
| import java.util.function.Supplier; | ||
|
|
||
| import static org.elasticsearch.xpack.core.ssl.SSLConfigurationSettings.SUPPORTED_PROTOCOLS_TEMPLATE; | ||
|
|
||
| /** | ||
| * Handles logging deprecation warnings when a TLSv1.0 SSL connection is used, and that SSL context relies on | ||
| * the default list of supported_protocols (in Elasticsearch 7.0, this list will not include TLS 1.0). | ||
| */ | ||
| public class TLSv1DeprecationHandler { | ||
|
|
||
| private final String supportedProtocolsSetting; | ||
| private final boolean shouldLogWarnings; | ||
| private final DeprecationLogger deprecationLogger; | ||
|
|
||
| public TLSv1DeprecationHandler(String settingPrefix, Settings settings, Logger baseLogger) { | ||
| if (settingPrefix.length() > 0 && settingPrefix.endsWith("ssl.") == false) { | ||
| throw new IllegalArgumentException("Setting prefix [" + settingPrefix + "] must end in 'ssl.'"); | ||
| } | ||
| this.supportedProtocolsSetting = settingPrefix + "supported_protocols"; | ||
| this.shouldLogWarnings = SUPPORTED_PROTOCOLS_TEMPLATE.apply(supportedProtocolsSetting).exists(settings) == false; | ||
| if (shouldLogWarnings) { | ||
| deprecationLogger = new DeprecationLogger(baseLogger); | ||
| } else { | ||
| deprecationLogger = null; | ||
| } | ||
| } | ||
|
|
||
| private TLSv1DeprecationHandler(String settingKey, boolean shouldLog, DeprecationLogger logger) { | ||
| this.supportedProtocolsSetting = settingKey; | ||
| this.shouldLogWarnings = shouldLog; | ||
| this.deprecationLogger = logger; | ||
| } | ||
|
|
||
| public static TLSv1DeprecationHandler disabled() { | ||
| return new TLSv1DeprecationHandler(null, false, null); | ||
| } | ||
|
|
||
| public boolean shouldLogWarnings() { | ||
| return shouldLogWarnings; | ||
| } | ||
|
|
||
| public void checkAndLog(SSLSession session, Supplier<String> descriptionSupplier) { | ||
| if (shouldLogWarnings == false) { | ||
| return; | ||
| } | ||
| if ("TLSv1".equals(session.getProtocol())) { | ||
| final String description = descriptionSupplier.get(); | ||
| // Use a "LRU" key that is unique per day. That way each description (source address, etc) will be logged once per day. | ||
| final String key = LocalDate.now(ZoneId.of("UTC")) + ":" + description; | ||
| deprecationLogger.deprecatedAndMaybeLog(key, | ||
| "a TLS v1.0 session was used for [{}], " + | ||
| "this protocol will be disabled by default in a future version. " + | ||
| "The [{}] setting can be used to control this.", | ||
| description, supportedProtocolsSetting); | ||
| } | ||
| } | ||
| } |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Oops, something went wrong.