From fb31c87c2d6c02563d2d2a1e63d5b62bea2c6f91 Mon Sep 17 00:00:00 2001 From: Mykola Golub Date: Wed, 16 Jun 2021 16:41:44 +0100 Subject: [PATCH] rgw: set default ssl options for beast frontend to 'no_sslv2:no_sslv3:no_tlsv1:no_tlsv1_1' Signed-off-by: Mykola Golub --- PendingReleaseNotes | 5 +++++ doc/radosgw/frontends.rst | 2 +- src/rgw/rgw_asio_frontend.cc | 4 ++++ 3 files changed, 10 insertions(+), 1 deletion(-) diff --git a/PendingReleaseNotes b/PendingReleaseNotes index 4858af5883a..8181b57c119 100644 --- a/PendingReleaseNotes +++ b/PendingReleaseNotes @@ -35,6 +35,11 @@ and eventName values no longer carry the `s3:` prefix, fixing deviations from the message format observed on AWS. +* RGW: It is possible to specify ssl options and ciphers for beast frontend now. + The default ssl options setting is "no_sslv2:no_sslv3:no_tlsv1:no_tlsv1_1". + If you want to return back the old behavior add 'ssl_options=' (empty) to + ``rgw frontends`` configuration. + >=16.0.0 -------- * mgr/nfs: ``nfs`` module is moved out of volumes plugin. Prior using the diff --git a/doc/radosgw/frontends.rst b/doc/radosgw/frontends.rst index 59eb130bb90..7e4f3cf00de 100644 --- a/doc/radosgw/frontends.rst +++ b/doc/radosgw/frontends.rst @@ -85,7 +85,7 @@ Options ``single_dh_use`` Always create a new key when using tmp_dh parameters. :Type: String -:Default: None +:Default: ``no_sslv2:no_sslv3:no_tlsv1:no_tlsv1_1`` ``ssl_ciphers`` diff --git a/src/rgw/rgw_asio_frontend.cc b/src/rgw/rgw_asio_frontend.cc index 72fa41d7a88..5ef28d862aa 100644 --- a/src/rgw/rgw_asio_frontend.cc +++ b/src/rgw/rgw_asio_frontend.cc @@ -809,7 +809,11 @@ int AsioFrontend::init_ssl() lderr(ctx()) << "no ssl_certificate configured for ssl_options" << dendl; return -EINVAL; } + } else if (cert) { + options = "no_sslv2:no_sslv3:no_tlsv1:no_tlsv1_1"; + } + if (options) { for (auto &option : ceph::split(*options, ":")) { if (option == "default_workarounds") { ssl_context->set_options(ssl::context::default_workarounds);