Require TLS 1.2 for Cluster & REST API

refs #7041

diff --git a/doc/09-object-types.md b/doc/09-object-types.md
index c78d588e65ff075aa925dc77f0c56f3900b8772f..660b1e34b941441d5887af5e7712f6819e055729 100644 (file)
--- a/doc/09-object-types.md
+++ b/doc/09-object-types.md
@@ -1122,7 +1122,7 @@ Configuration Attributes:
   accept\_commands                      | Boolean               | **Optional.** Accept remote commands. Defaults to `false`.
   max\_anonymous\_clients               | Number                | **Optional.** Limit the number of anonymous client connections (not configured endpoints and signing requests).
   cipher\_list                          | String                | **Optional.** Cipher list that is allowed. For a list of available ciphers run `openssl ciphers`. Defaults to `ALL:!LOW:!WEAK:!MEDIUM:!EXP:!NULL`.
-  tls\_protocolmin                      | String                | **Optional.** Minimum TLS protocol version. Must be one of `TLSv1`, `TLSv1.1` or `TLSv1.2`. Defaults to `TLSv1`.
+  tls\_protocolmin                      | String                | **Optional.** Minimum TLS protocol version. Since v2.11, only `TLSv1.2` is supported. Defaults to `TLSv1.2`.
   tls\_handshake\_timeout               | Number                | **Optional.** TLS Handshake timeout. Defaults to `10s`.
   access\_control\_allow\_origin        | Array                 | **Optional.** Specifies an array of origin URLs that may access the API. [(MDN docs)](https://developer.mozilla.org/en-US/docs/Web/HTTP/Access_control_CORS#Access-Control-Allow-Origin)
   access\_control\_allow\_credentials   | Boolean               | **Deprecated.** Indicates whether or not the actual request can be made using credentials. Defaults to `true`. [(MDN docs)](https://developer.mozilla.org/en-US/docs/Web/HTTP/Access_control_CORS#Access-Control-Allow-Credentials)

diff --git a/doc/16-upgrading-icinga-2.md b/doc/16-upgrading-icinga-2.md
index d8d9ac221d445cc3b95d6dfcd5400e3a3276dc72..1068907a1c8e4978f46565ccc4d2efd581902067 100644 (file)
--- a/doc/16-upgrading-icinga-2.md
+++ b/doc/16-upgrading-icinga-2.md
@@ -53,6 +53,17 @@ and compiled into the binary as header only include. It helps our way to C++11 a
 to fix additional UTF8 issues more easily. Read more about its [design goals](https://github.com/nlohmann/json#design-goals)
 and [benchmarks](https://github.com/miloyip/nativejson-benchmark#parsing-time).
 
+### TLS 1.2 <a id="upgrading-to-2-11-tls-1-2"></a>
+
+v2.11 raises the minimum required TLS version to 1.2.
+This is available since OpenSSL 1.0.1 (EL6 & Debian Jessie).
+
+Older Icinga satellites/agents need to support TLS 1.2 during the TLS
+handshake.
+
+The `api` feature attribute `tls_protocolmin` now only supports the
+value `TLSv1.2` being the default.
+
 ### HA-aware Features <a id="upgrading-to-2-11-ha-aware-features"></a>
 
 v2.11 introduces additional HA functionality similar to the DB IDO feature.

diff --git a/lib/base/tlsutility.cpp b/lib/base/tlsutility.cpp
index 59bf54bf0610bb48813d4b3fb08b3e9fe7d2942c..2a3bd1ec08521cfaa8ce0c3f94c9868a61ee3fb2 100644 (file)
--- a/lib/base/tlsutility.cpp
+++ b/lib/base/tlsutility.cpp
@@ -162,7 +162,7 @@ std::shared_ptr<boost::asio::ssl::context> MakeAsioSslContext(const String& pubk
 
        InitializeOpenSSL();
 
-       auto context (std::make_shared<ssl::context>(ssl::context::sslv23));
+       auto context (std::make_shared<ssl::context>(ssl::context::tlsv12));
 
        SetupSslContext(context->native_handle(), pubkey, privkey, cakey);
 
@@ -200,24 +200,15 @@ void SetCipherListToSSLContext(const std::shared_ptr<boost::asio::ssl::context>&
  */
 void SetTlsProtocolminToSSLContext(const std::shared_ptr<boost::asio::ssl::context>& context, const String& tlsProtocolmin)
 {
-       long flags = SSL_CTX_get_options(context->native_handle());
-
-       flags |= SSL_OP_NO_SSLv2 | SSL_OP_NO_SSLv3;
-
-#ifdef SSL_TXT_TLSV1_1
-       if (tlsProtocolmin == SSL_TXT_TLSV1_1)
-               flags |= SSL_OP_NO_TLSv1;
-       else
-#endif /* SSL_TXT_TLSV1_1 */
-#ifdef SSL_TXT_TLSV1_2
-       if (tlsProtocolmin == SSL_TXT_TLSV1_2)
-               flags |= SSL_OP_NO_TLSv1 | SSL_OP_NO_TLSv1_1;
-       else
-#endif /* SSL_TXT_TLSV1_2 */
-       if (tlsProtocolmin != SSL_TXT_TLSV1)
-               BOOST_THROW_EXCEPTION(std::invalid_argument("Invalid TLS protocol version specified."));
-
-       SSL_CTX_set_options(context->native_handle(), flags);
+       // tlsProtocolmin has no effect since we enforce TLS 1.2 since 2.11.
+
+       context->set_options(
+               boost::asio::ssl::context::default_workarounds |
+               boost::asio::ssl::context::no_sslv2 |
+               boost::asio::ssl::context::no_sslv3 |
+               boost::asio::ssl::context::no_tlsv1 |
+               boost::asio::ssl::context::no_tlsv1_1
+       );
 }
 
 /**

diff --git a/lib/remote/apilistener.cpp b/lib/remote/apilistener.cpp
index cfd207a31baf8f7f244f3d0211baf195580ec77e..42553bdcc0d1f62ac6a563cf3311530204fb80e2 100644 (file)
--- a/lib/remote/apilistener.cpp
+++ b/lib/remote/apilistener.cpp
@@ -1631,16 +1631,8 @@ void ApiListener::ValidateTlsProtocolmin(const Lazy<String>& lvalue, const Valid
 {
        ObjectImpl<ApiListener>::ValidateTlsProtocolmin(lvalue, utils);
 
-       if (lvalue() != SSL_TXT_TLSV1
-#ifdef SSL_TXT_TLSV1_1
-               && lvalue() != SSL_TXT_TLSV1_1 &&
-               lvalue() != SSL_TXT_TLSV1_2
-#endif /* SSL_TXT_TLSV1_1 */
-               ) {
-               String message = "Invalid TLS version. Must be one of '" SSL_TXT_TLSV1 "'";
-#ifdef SSL_TXT_TLSV1_1
-               message += ", '" SSL_TXT_TLSV1_1 "' or '" SSL_TXT_TLSV1_2 "'";
-#endif /* SSL_TXT_TLSV1_1 */
+       if (lvalue() != SSL_TXT_TLSV1_2) {
+               String message = "Invalid TLS version. Must be '" SSL_TXT_TLSV1_2 "'";
 
                BOOST_THROW_EXCEPTION(ValidationError(this, { "tls_protocolmin" }, message));
        }

diff --git a/lib/remote/apilistener.ti b/lib/remote/apilistener.ti
index 779dde0d12843f28148f84fe14b3eecc3b656bb2..20f59bb12fab691fa202b10c34890ca5c22fcf2f 100644 (file)
--- a/lib/remote/apilistener.ti
+++ b/lib/remote/apilistener.ti
@@ -21,7 +21,7 @@ class ApiListener : ConfigObject
                default {{{ return "ALL:!LOW:!WEAK:!MEDIUM:!EXP:!NULL"; }}}
        };
        [config] String tls_protocolmin {
-               default {{{ return "TLSv1"; }}}
+               default {{{ return "TLSv1.2"; }}}
        };
 
        [config] String bind_host {