FELIX-4972 : Make SSL renegotiation configurable. Apply patch from Thomas Franconville
git-svn-id: https://svn.apache.org/repos/asf/felix/trunk@1692466 13f79535-47bb-0310-9956-ffa450edef68
diff --git a/http/jetty/src/main/java/org/apache/felix/http/jetty/internal/ConfigMetaTypeProvider.java b/http/jetty/src/main/java/org/apache/felix/http/jetty/internal/ConfigMetaTypeProvider.java
index a0d4ee9..6b8d9c4 100644
--- a/http/jetty/src/main/java/org/apache/felix/http/jetty/internal/ConfigMetaTypeProvider.java
+++ b/http/jetty/src/main/java/org/apache/felix/http/jetty/internal/ConfigMetaTypeProvider.java
@@ -242,13 +242,16 @@
2147483647,
null, null,
bundle.getBundleContext().getProperty(JettyConfig.FELIX_JETTY_EXCLUDED_PROTOCOLS)));
-
+
adList.add(new AttributeDefinitionImpl(JettyConfig.FELIX_PROXY_LOAD_BALANCER_CONNECTION_ENABLE,
"Enable Proxy/Load Balancer Connection",
"Whether or not the Proxy/Load Balancer Connection is enabled. Defaults to false thus disabled.",
false,
bundle.getBundleContext().getProperty(JettyConfig.FELIX_PROXY_LOAD_BALANCER_CONNECTION_ENABLE)));
+ adList.add(new AttributeDefinitionImpl(JettyConfig.FELIX_JETTY_RENEGOTIATION_ALLOWED, "Renegotiation allowed", "Whether TLS renegotiation is allowed (true by default)",
+ true, bundle.getBundleContext().getProperty(JettyConfig.FELIX_JETTY_RENEGOTIATION_ALLOWED)));
+
return new ObjectClassDefinition()
{
diff --git a/http/jetty/src/main/java/org/apache/felix/http/jetty/internal/JettyConfig.java b/http/jetty/src/main/java/org/apache/felix/http/jetty/internal/JettyConfig.java
index 63bf778..6bec280 100644
--- a/http/jetty/src/main/java/org/apache/felix/http/jetty/internal/JettyConfig.java
+++ b/http/jetty/src/main/java/org/apache/felix/http/jetty/internal/JettyConfig.java
@@ -106,13 +106,13 @@
/** Felix specific property to set the list of path exclusions for Web Application Bundles */
public static final String FELIX_HTTP_PATH_EXCLUSIONS = "org.apache.felix.http.path_exclusions";
- /** Felix specific property to configure the excluded cipher suites. @deprecated use {@link #FELIX_JETTY_EXCLUDE_SUITES} instead. */
+ /** Felix specific property to configure the excluded cipher suites. @deprecated use {@link #FELIX_JETTY_EXCLUDED_SUITES} instead. */
@Deprecated
public static final String FELIX_JETTY_EXCLUDED_SUITES_OLD = "org.apache.felix.https.jetty.cipersuites.excluded";
/** Felix specific property to configure the excluded cipher suites */
public static final String FELIX_JETTY_EXCLUDED_SUITES = "org.apache.felix.https.jetty.ciphersuites.excluded";
- /** Felix specific property to configure the included cipher suites. @deprecated use {@link #FELIX_JETTY_INCLUDE_SUITES} instead. */
+ /** Felix specific property to configure the included cipher suites. @deprecated use {@link #FELIX_JETTY_INCLUDED_SUITES} instead. */
@Deprecated
public static final String FELIX_JETTY_INCLUDED_SUITES_OLD = "org.apache.felix.https.jetty.cipersuites.included";
/** Felix specific property to configure the included cipher suites. */
@@ -127,6 +127,9 @@
/** Felix specific property to configure the excluded protocols */
public static final String FELIX_JETTY_EXCLUDED_PROTOCOLS = "org.apache.felix.https.jetty.protocols.excluded";
+ /** Felix specific properties to be able to disable renegotiation protocol for TLSv1 */
+ public static final String FELIX_JETTY_RENEGOTIATION_ALLOWED = "org.apache.felix.https.jetty.renegotiateAllowed";
+
/** Felix specific property to control whether to enable Proxy/Load Balancer Connection */
public static final String FELIX_PROXY_LOAD_BALANCER_CONNECTION_ENABLE = "org.apache.felix.proxy.load.balancer.connection.enable";
@@ -368,6 +371,10 @@
return getBooleanProperty(FELIX_PROXY_LOAD_BALANCER_CONNECTION_ENABLE, false);
}
+ public boolean isRenegotiationAllowed() {
+ return getBooleanProperty(FELIX_JETTY_RENEGOTIATION_ALLOWED, true);
+ }
+
public void reset()
{
update(null);
diff --git a/http/jetty/src/main/java/org/apache/felix/http/jetty/internal/JettyService.java b/http/jetty/src/main/java/org/apache/felix/http/jetty/internal/JettyService.java
index 6520716..4536efc 100644
--- a/http/jetty/src/main/java/org/apache/felix/http/jetty/internal/JettyService.java
+++ b/http/jetty/src/main/java/org/apache/felix/http/jetty/internal/JettyService.java
@@ -418,6 +418,8 @@
{
connector.setExcludeProtocols(this.config.getExcludedProtocols());
}
+
+ connector.setRenegotiationAllowed(this.config.isRenegotiationAllowed());
}
private void configureConnector(final ServerConnector connector, int port)