[CORE-8654] Add flag to re-enable TLS client renegotiation #24772

michael-redpanda · 2025-01-10T13:19:12Z

This PR adds a new tunable flag tls_enable_renegotiation. This flag is used to re-enable TLS client initiated renegotiation which, by default is disabled.

Customers should avoid enabling this flag unless absolutely necessary.

Other than this PR, there will be no further public documentation about this flag.

Backports Required

Release Notes

None

Updated to version of Seastar that disables TLS renegotiation by default. Signed-off-by: Michael Boquard <michael@redpanda.com>

BenPope

LGTM

tests/rptest/tests/tls_version_test.py

vbotbuildovich · 2025-01-10T16:28:03Z

Retry command for Build#60590

please wait until all jobs are finished before running the slash command

/ci-repeat 1
tests/rptest/tests/tiered_storage_model_test.py::TieredStorageTest.test_tiered_storage@{"cloud_storage_type_and_url_style":[2,"virtual_host"],"test_case":{"name":"(TS_Read == True, SegmentRolledByTimeout == True)"}}

tests/rptest/tests/tls_version_test.py

vbotbuildovich · 2025-01-10T17:29:38Z

CI test results

test results on build#60590

test_id	test_kind	job_url	test_status	passed
rm_stm_tests_rpunit.rm_stm_tests_rpunit	unit	https://buildkite.com/redpanda/redpanda/builds/60590#0194505f-b371-45ba-a89f-0aca3e9583af	FLAKY	1/2
rm_stm_tests_rpunit.rm_stm_tests_rpunit	unit	https://buildkite.com/redpanda/redpanda/builds/60590#0194505f-b372-4f0d-8b0d-94490222edfa	FLAKY	1/2
rptest.tests.compaction_recovery_test.CompactionRecoveryUpgradeTest.test_index_recovery_after_upgrade	ducktape	https://buildkite.com/redpanda/redpanda/builds/60590#019450a8-07c2-45ab-8de6-a9e3fc794268	FLAKY	5/6
rptest.tests.tiered_storage_model_test.TieredStorageTest.test_tiered_storage.cloud_storage_type_and_url_style=.CloudStorageType.ABS.2.virtual_host.test_case=.TS_Read==True.SegmentRolledByTimeout==True	ducktape	https://buildkite.com/redpanda/redpanda/builds/60590#019450ac-2c65-4b00-ab03-d3d2590bff4b	FAIL	0/1

test results on build#60611

test_id	test_kind	job_url	test_status	passed
rptest.tests.tls_version_test.TLSRenegotiationTest.test_tls_renegotiation.enable_renegotiation=True	ducktape	https://buildkite.com/redpanda/redpanda/builds/60611#01945253-b074-40b1-b13c-5727235c065f	FAIL	0/1
rptest.tests.tls_version_test.TLSRenegotiationTest.test_tls_renegotiation.enable_renegotiation=True	ducktape	https://buildkite.com/redpanda/redpanda/builds/60611#0194525c-196e-4af8-8e64-991ae8750448	FAIL	0/1

Deflaimun · 2025-01-10T17:56:56Z

src/v/config/configuration.cc

+      "TLS client renegotiation was removed in TLSv1.3 due to vulnerabilities "
+      "found in the protocol.  By default, this is disabled for TLSv1.2 and "
+      "below.  It can be re-enabled by setting this property to true and "
+      "restarting Redpanda.  This is considered unsafe.",


if this is unsafe/bad practice, in which scenarios would the users need to enable this flag? We should add this possibility here.

backwards compatibility with legacy systems?

Correct - in case their TLS client for some reason just will not work if it can't perform a client initiated TLS renegotiation. I can't think of any that exist and this is more of an escape hatch just in case.

Deflaimun · 2025-01-10T18:00:11Z

src/v/config/configuration.cc

+      "TLS client renegotiation was removed in TLSv1.3 due to vulnerabilities "
+      "found in the protocol.  By default, this is disabled for TLSv1.2 and "
+      "below.  It can be re-enabled by setting this property to true and "
+      "restarting Redpanda.  This is considered unsafe.",


Suggested change

"TLS client renegotiation was removed in TLSv1.3 due to vulnerabilities "

"found in the protocol. By default, this is disabled for TLSv1.2 and "

"below. It can be re-enabled by setting this property to true and "

"restarting Redpanda. This is considered unsafe.",

"TLS client renegotiation, removed in TLSv1.3 due to vulnerabilities "

"in the protocol, is disabled for TLSv1.2 and earlier. "

"It can be re-enabled by setting this property to true and "

"restarting Redpanda. This is considered unsafe.",

michael-redpanda · 2025-01-10T18:45:20Z

Force push d008988:

Addressed PR comments

kbatuigas · 2025-01-10T19:53:12Z

src/v/config/configuration.cc

+  , tls_enable_renegotiation(
+      *this,
+      "tls_enable_renegotiation",
+      "TLS client initiated renegotiation is considered unsafe and is by "


Suggested change

"TLS client initiated renegotiation is considered unsafe and is by "

"TLS client-initiated renegotiation is considered unsafe and is by "

kbatuigas · 2025-01-10T19:53:23Z

src/v/config/configuration.cc

+      "tls_enable_renegotiation",
+      "TLS client initiated renegotiation is considered unsafe and is by "
+      "default disabled.  Only re-enable it if you are experiencing issues "
+      "with your TLS enabled client.  This option has no effect on TLSv1.3 "


Suggested change

"with your TLS enabled client. This option has no effect on TLSv1.3 "

"with your TLS-enabled client. This option has no effect on TLSv1.3 "

kbatuigas · 2025-01-10T19:53:45Z

src/v/config/configuration.cc

+      "TLS client initiated renegotiation is considered unsafe and is by "
+      "default disabled.  Only re-enable it if you are experiencing issues "
+      "with your TLS enabled client.  This option has no effect on TLSv1.3 "
+      "connections as client initiated renegotiation was removed.",


Suggested change

"connections as client initiated renegotiation was removed.",

"connections as client-initiated renegotiation was removed.",

New config that can be used to re-enable TLS renegotiation if a client absolutely needs that enabled. Has no effect on TLSv1.3 connections. Signed-off-by: Michael Boquard <michael@redpanda.com>

Signed-off-by: Michael Boquard <michael@redpanda.com>

michael-redpanda · 2025-01-10T20:52:55Z

Force push 6667f45:

Updated wording of config

vbotbuildovich · 2025-01-10T23:51:44Z

Retry command for Build#60611

please wait until all jobs are finished before running the slash command


/ci-repeat 1
tests/rptest/tests/tls_version_test.py::TLSRenegotiationTest.test_tls_renegotiation@{"enable_renegotiation":true}

bazel: Updated seastar ref

0b5e13d

Updated to version of Seastar that disables TLS renegotiation by default. Signed-off-by: Michael Boquard <michael@redpanda.com>

michael-redpanda requested a review from a team January 10, 2025 13:19

michael-redpanda self-assigned this Jan 10, 2025

michael-redpanda requested review from IoannisRP and a team and removed request for a team and IoannisRP January 10, 2025 13:19

michael-redpanda requested a review from a team as a code owner January 10, 2025 13:19

michael-redpanda requested review from aanthony-rp and removed request for a team January 10, 2025 13:19

github-actions bot added area/build area/redpanda labels Jan 10, 2025

michael-redpanda requested review from BenPope, pgellert and IoannisRP January 10, 2025 13:19

BenPope previously approved these changes Jan 10, 2025

View reviewed changes

tests/rptest/tests/tls_version_test.py Outdated Show resolved Hide resolved

tests/rptest/tests/tls_version_test.py Outdated Show resolved Hide resolved

michael-redpanda enabled auto-merge January 10, 2025 14:24

pgellert reviewed Jan 10, 2025

View reviewed changes

tests/rptest/tests/tls_version_test.py Outdated Show resolved Hide resolved

tests/rptest/tests/tls_version_test.py Outdated Show resolved Hide resolved

Deflaimun reviewed Jan 10, 2025

View reviewed changes

michael-redpanda dismissed BenPope’s stale review via d008988 January 10, 2025 18:44

michael-redpanda force-pushed the tls-renegotiation/core-8654/cluster-config-tls-reneg branch from acc9670 to d008988 Compare January 10, 2025 18:44

michael-redpanda requested review from BenPope, Deflaimun and pgellert January 10, 2025 18:44

pgellert previously approved these changes Jan 10, 2025

View reviewed changes

kbatuigas reviewed Jan 10, 2025

View reviewed changes

michael-redpanda added 3 commits January 10, 2025 15:52

config: Added tls_enable_renegotiation

2e71f57

New config that can be used to re-enable TLS renegotiation if a client absolutely needs that enabled. Has no effect on TLSv1.3 connections. Signed-off-by: Michael Boquard <michael@redpanda.com>

tls: Use new tls_enable_renegotiation config

d10ed83

Signed-off-by: Michael Boquard <michael@redpanda.com>

dt/tls: Added tests to validate renegotiation

6667f45

Signed-off-by: Michael Boquard <michael@redpanda.com>

michael-redpanda dismissed pgellert’s stale review via 6667f45 January 10, 2025 20:52

michael-redpanda force-pushed the tls-renegotiation/core-8654/cluster-config-tls-reneg branch from d008988 to 6667f45 Compare January 10, 2025 20:52

michael-redpanda requested review from pgellert and kbatuigas January 10, 2025 20:53

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

[CORE-8654] Add flag to re-enable TLS client renegotiation #24772

[CORE-8654] Add flag to re-enable TLS client renegotiation #24772

michael-redpanda commented Jan 10, 2025

BenPope left a comment

vbotbuildovich commented Jan 10, 2025

vbotbuildovich commented Jan 10, 2025 •

edited

Loading

Deflaimun Jan 10, 2025 •

edited

Loading

michael-redpanda Jan 10, 2025

Deflaimun Jan 10, 2025 •

edited

Loading

michael-redpanda commented Jan 10, 2025

kbatuigas Jan 10, 2025

kbatuigas Jan 10, 2025

kbatuigas Jan 10, 2025

michael-redpanda commented Jan 10, 2025

vbotbuildovich commented Jan 10, 2025 •

edited

Loading

	"TLS client initiated renegotiation is considered unsafe and is by "
	"TLS client-initiated renegotiation is considered unsafe and is by "

	"with your TLS enabled client. This option has no effect on TLSv1.3 "
	"with your TLS-enabled client. This option has no effect on TLSv1.3 "

	"connections as client initiated renegotiation was removed.",
	"connections as client-initiated renegotiation was removed.",

[CORE-8654] Add flag to re-enable TLS client renegotiation #24772

Are you sure you want to change the base?

[CORE-8654] Add flag to re-enable TLS client renegotiation #24772

Conversation

michael-redpanda commented Jan 10, 2025

Backports Required

Release Notes

BenPope left a comment

Choose a reason for hiding this comment

vbotbuildovich commented Jan 10, 2025

Retry command for Build#60590

vbotbuildovich commented Jan 10, 2025 • edited Loading

CI test results

Deflaimun Jan 10, 2025 • edited Loading

Choose a reason for hiding this comment

michael-redpanda Jan 10, 2025

Choose a reason for hiding this comment

Deflaimun Jan 10, 2025 • edited Loading

Choose a reason for hiding this comment

michael-redpanda commented Jan 10, 2025

kbatuigas Jan 10, 2025

Choose a reason for hiding this comment

kbatuigas Jan 10, 2025

Choose a reason for hiding this comment

kbatuigas Jan 10, 2025

Choose a reason for hiding this comment

michael-redpanda commented Jan 10, 2025

vbotbuildovich commented Jan 10, 2025 • edited Loading

Retry command for Build#60611

vbotbuildovich commented Jan 10, 2025 •

edited

Loading

Deflaimun Jan 10, 2025 •

edited

Loading

Deflaimun Jan 10, 2025 •

edited

Loading

vbotbuildovich commented Jan 10, 2025 •

edited

Loading