feat(*) set default LuaSec protocol to 'any' & expose option

Jeremy J. Miller · thibaultcha · commit d742d5ca844a · 2021-02-17T16:19:52.000-08:00
Allows changing the TLS encryption version. The underlying luasec library allows for setting the encryption protocol to 'any' [1]. When set as such, the client negotiates the highest encryption protocol available. This `any` protocol version setting is widely in use in the luasec repository [2]. In my testing, when `any` is set, it resulted in TLSv1.2 being utilized for the conneciton. While I expected TLSv1.3 to be utilized, after some research, I discovered that JDK 8 has had TLSv1.3 support backported to it but TLSv1.3 is not enabled by default and requires extra configuration when starting the JVM [3]. Partially implements #106. [1] - https://github.com/brunoos/luasec/blob/711a98b7605ad87b521ba607024947113bc1f527/CHANGELOG#L101 [2] - https://github.com/brunoos/luasec/search?q=protocol+%3D+%22any%22 [3] - https://www.oracle.com/java/technologies/javase/8u261-relnotes.html#JDK-8145252 Signed-off-by: Jeremy J. Miller <jeremy.miller@konghq.com> Signed-off-by: Thibault Charbonnier <thibaultcha@me.com>
diff --git a/docs/examples/authentication.lua.html b/docs/examples/authentication.lua.html
@@ -108,7 +108,7 @@ <h2>authentication.lua</h2>
 </div> <!-- id="main" -->
 <div id="about">
 <i>generated by <a href="http://github.com/stevedonovan/LDoc">LDoc 1.4.6</a></i>
-<i style="float:right;">Last updated 2019-09-25 17:56:05 </i>
+<i style="float:right;">Last updated 2021-02-17 16:19:34 </i>
 </div> <!-- id="about" -->
 </div> <!-- id="container" -->
 </body>
diff --git a/docs/examples/batch.lua.html b/docs/examples/batch.lua.html
@@ -142,7 +142,7 @@ <h2>batch.lua</h2>
 </div> <!-- id="main" -->
 <div id="about">
 <i>generated by <a href="http://github.com/stevedonovan/LDoc">LDoc 1.4.6</a></i>
-<i style="float:right;">Last updated 2019-09-25 17:56:05 </i>
+<i style="float:right;">Last updated 2021-02-17 16:19:34 </i>
 </div> <!-- id="about" -->
 </div> <!-- id="container" -->
 </body>
diff --git a/docs/examples/intro.lua.html b/docs/examples/intro.lua.html
@@ -187,7 +187,7 @@ <h2>intro.lua</h2>
 </div> <!-- id="main" -->
 <div id="about">
 <i>generated by <a href="http://github.com/stevedonovan/LDoc">LDoc 1.4.6</a></i>
-<i style="float:right;">Last updated 2019-09-25 17:56:05 </i>
+<i style="float:right;">Last updated 2021-02-17 16:19:34 </i>
 </div> <!-- id="about" -->
 </div> <!-- id="container" -->
 </body>
diff --git a/docs/examples/pagination.lua.html b/docs/examples/pagination.lua.html
@@ -118,7 +118,7 @@ <h2>pagination.lua</h2>
 </div> <!-- id="main" -->
 <div id="about">
 <i>generated by <a href="http://github.com/stevedonovan/LDoc">LDoc 1.4.6</a></i>
-<i style="float:right;">Last updated 2019-09-25 17:56:05 </i>
+<i style="float:right;">Last updated 2021-02-17 16:19:34 </i>
 </div> <!-- id="about" -->
 </div> <!-- id="container" -->
 </body>
diff --git a/docs/examples/ssl.lua b/docs/examples/ssl.lua
@@ -35,6 +35,7 @@ http {
           contact_points = {"127.0.0.1", "127.0.0.2"},
           keyspace = "my_keyspace",
           ssl = true,
+          encryption_protocol = 'any'
           verify = true
         }
         if not cluster then
diff --git a/docs/examples/ssl.lua.html b/docs/examples/ssl.lua.html
@@ -100,6 +100,7 @@ <h2>ssl.lua</h2>
 </span>          contact_points = {<span class="string">"127.0.0.1"</span>, <span class="string">"127.0.0.2"</span>},
           keyspace = <span class="string">"my_keyspace"</span>,
           ssl = <span class="keyword">true</span>,
+          encryption_protocol = <span class="string">'any'</span>
           verify = <span class="keyword">true</span>
         }
         <span class="keyword">if</span> <span class="keyword">not</span> cluster <span class="keyword">then</span>
@@ -124,7 +125,7 @@ <h2>ssl.lua</h2>
 </div> <!-- id="main" -->
 <div id="about">
 <i>generated by <a href="http://github.com/stevedonovan/LDoc">LDoc 1.4.6</a></i>
-<i style="float:right;">Last updated 2019-09-25 17:56:05 </i>
+<i style="float:right;">Last updated 2021-02-17 16:19:34 </i>
 </div> <!-- id="about" -->
 </div> <!-- id="container" -->
 </body>
diff --git a/docs/index.html b/docs/index.html
@@ -135,7 +135,7 @@ <h2>Examples</h2>
 </div> <!-- id="main" -->
 <div id="about">
 <i>generated by <a href="http://github.com/stevedonovan/LDoc">LDoc 1.4.6</a></i>
-<i style="float:right;">Last updated 2019-09-25 17:56:05 </i>
+<i style="float:right;">Last updated 2021-02-17 16:19:34 </i>
 </div> <!-- id="about" -->
 </div> <!-- id="container" -->
 </body>
diff --git a/docs/manual/README.md.html b/docs/manual/README.md.html
@@ -256,7 +256,7 @@ <h2>License</h2>
 </div> <!-- id="main" -->
 <div id="about">
 <i>generated by <a href="http://github.com/stevedonovan/LDoc">LDoc 1.4.6</a></i>
-<i style="float:right;">Last updated 2019-09-25 17:56:05 </i>
+<i style="float:right;">Last updated 2021-02-17 16:19:34 </i>
 </div> <!-- id="about" -->
 </div> <!-- id="container" -->
 </body>
diff --git a/docs/modules/cassandra.html b/docs/modules/cassandra.html
@@ -853,6 +853,12 @@ <h3>Fields:</h3>
         <li><span class="parameter">ssl</span>
          Determines if the client should connect using SSL.
  (<code>boolean</code>, default: <code>false</code>)
+        </li>
+        <li><span class="parameter">ssl_protocol</span>
+         The client encryption protocol version to use
+ if <code>ssl</code> is enabled (LuaSec usage only, see <code>lua_ssl_protocols</code> directive
+ for ngx_lua).
+ (<a href="https://www.lua.org/manual/5.1/manual.html#5.4">string</a>, default: <code>any</code>)
         </li>
         <li><span class="parameter">verify</span>
          Enable server certificate validation if <code>ssl</code> is enabled.
@@ -1123,7 +1129,7 @@ <h3>Usage:</h3>
 </div> <!-- id="main" -->
 <div id="about">
 <i>generated by <a href="http://github.com/stevedonovan/LDoc">LDoc 1.4.6</a></i>
-<i style="float:right;">Last updated 2019-09-25 17:56:05 </i>
+<i style="float:right;">Last updated 2021-02-17 16:19:34 </i>
 </div> <!-- id="about" -->
 </div> <!-- id="container" -->
 </body>
diff --git a/docs/modules/resty.cassandra.cluster.html b/docs/modules/resty.cassandra.cluster.html
@@ -528,7 +528,7 @@ <h3>Fields:</h3>
 </div> <!-- id="main" -->
 <div id="about">
 <i>generated by <a href="http://github.com/stevedonovan/LDoc">LDoc 1.4.6</a></i>
-<i style="float:right;">Last updated 2019-09-25 17:56:05 </i>
+<i style="float:right;">Last updated 2021-02-17 16:19:34 </i>
 </div> <!-- id="about" -->
 </div> <!-- id="container" -->
 </body>
diff --git a/docs/modules/resty.cassandra.policies.lb.dc_rr.html b/docs/modules/resty.cassandra.policies.lb.dc_rr.html
@@ -137,7 +137,7 @@ <h3>Usage:</h3>
 </div> <!-- id="main" -->
 <div id="about">
 <i>generated by <a href="http://github.com/stevedonovan/LDoc">LDoc 1.4.6</a></i>
-<i style="float:right;">Last updated 2019-09-25 17:56:05 </i>
+<i style="float:right;">Last updated 2021-02-17 16:19:34 </i>
 </div> <!-- id="about" -->
 </div> <!-- id="container" -->
 </body>
diff --git a/docs/modules/resty.cassandra.policies.lb.req_dc_rr.html b/docs/modules/resty.cassandra.policies.lb.req_dc_rr.html
@@ -147,7 +147,7 @@ <h3>Usage:</h3>
 </div> <!-- id="main" -->
 <div id="about">
 <i>generated by <a href="http://github.com/stevedonovan/LDoc">LDoc 1.4.6</a></i>
-<i style="float:right;">Last updated 2019-09-25 17:56:05 </i>
+<i style="float:right;">Last updated 2021-02-17 16:19:34 </i>
 </div> <!-- id="about" -->
 </div> <!-- id="container" -->
 </body>
diff --git a/docs/modules/resty.cassandra.policies.lb.req_rr.html b/docs/modules/resty.cassandra.policies.lb.req_rr.html
@@ -135,7 +135,7 @@ <h3>Usage:</h3>
 </div> <!-- id="main" -->
 <div id="about">
 <i>generated by <a href="http://github.com/stevedonovan/LDoc">LDoc 1.4.6</a></i>
-<i style="float:right;">Last updated 2019-09-25 17:56:05 </i>
+<i style="float:right;">Last updated 2021-02-17 16:19:34 </i>
 </div> <!-- id="about" -->
 </div> <!-- id="container" -->
 </body>
diff --git a/docs/modules/resty.cassandra.policies.lb.rr.html b/docs/modules/resty.cassandra.policies.lb.rr.html
@@ -129,7 +129,7 @@ <h3>Usage:</h3>
 </div> <!-- id="main" -->
 <div id="about">
 <i>generated by <a href="http://github.com/stevedonovan/LDoc">LDoc 1.4.6</a></i>
-<i style="float:right;">Last updated 2019-09-25 17:56:05 </i>
+<i style="float:right;">Last updated 2021-02-17 16:19:34 </i>
 </div> <!-- id="about" -->
 </div> <!-- id="container" -->
 </body>
diff --git a/docs/modules/resty.cassandra.policies.reconnection.const.html b/docs/modules/resty.cassandra.policies.reconnection.const.html
@@ -136,7 +136,7 @@ <h3>Usage:</h3>
 </div> <!-- id="main" -->
 <div id="about">
 <i>generated by <a href="http://github.com/stevedonovan/LDoc">LDoc 1.4.6</a></i>
-<i style="float:right;">Last updated 2019-09-25 17:56:05 </i>
+<i style="float:right;">Last updated 2021-02-17 16:19:34 </i>
 </div> <!-- id="about" -->
 </div> <!-- id="container" -->
 </body>
diff --git a/docs/modules/resty.cassandra.policies.reconnection.exp.html b/docs/modules/resty.cassandra.policies.reconnection.exp.html
@@ -143,7 +143,7 @@ <h3>Usage:</h3>
 </div> <!-- id="main" -->
 <div id="about">
 <i>generated by <a href="http://github.com/stevedonovan/LDoc">LDoc 1.4.6</a></i>
-<i style="float:right;">Last updated 2019-09-25 17:56:05 </i>
+<i style="float:right;">Last updated 2021-02-17 16:19:34 </i>
 </div> <!-- id="about" -->
 </div> <!-- id="container" -->
 </body>
diff --git a/docs/modules/resty.cassandra.policies.retry.simple.html b/docs/modules/resty.cassandra.policies.retry.simple.html
@@ -138,7 +138,7 @@ <h3>Usage:</h3>
 </div> <!-- id="main" -->
 <div id="about">
 <i>generated by <a href="http://github.com/stevedonovan/LDoc">LDoc 1.4.6</a></i>
-<i style="float:right;">Last updated 2019-09-25 17:56:05 </i>
+<i style="float:right;">Last updated 2021-02-17 16:19:34 </i>
 </div> <!-- id="about" -->
 </div> <!-- id="container" -->
 </body>
diff --git a/lib/cassandra/init.lua b/lib/cassandra/init.lua
@@ -93,6 +93,10 @@ _Host.__index = _Host
 -- (`number`, default: `3`)
 -- @field ssl Determines if the client should connect using SSL.
 -- (`boolean`, default: `false`)
+-- @field ssl_protocol The client encryption protocol version to use
+-- if `ssl` is enabled (LuaSec usage only, see `lua_ssl_protocols` directive
+-- for ngx_lua).
+-- (`string`, default: `any`)
 -- @field verify Enable server certificate validation if `ssl` is enabled.
 -- (`boolean`, default: `false`)
 -- @field cafile Path to the server certificate (LuaSec usage only, see
@@ -134,6 +138,7 @@ function _Host.new(opts)
     verify = opts.verify,
     cert = opts.cert,
     cafile = opts.cafile,
+    ssl_protocol = opts.ssl_protocol,
     key = opts.key,
     auth = opts.auth
   }
@@ -194,6 +199,7 @@ local function ssl_handshake(self)
   local params = {
     key = self.key,
     cafile = self.cafile,
+    protocol = self.ssl_protocol,
     cert = self.cert
   }
 
diff --git a/lib/cassandra/socket.lua b/lib/cassandra/socket.lua
@@ -56,7 +56,7 @@ do
       local ssl = require 'ssl'
       local params = {
         mode = 'client',
-        protocol = 'tlsv1',
+        protocol = opts.protocol or 'any',
         key = opts.key,
         certificate = opts.cert,
         cafile = opts.cafile,
diff --git a/lib/resty/cassandra/cluster.lua b/lib/resty/cassandra/cluster.lua
@@ -372,6 +372,11 @@ function _Cluster.new(opts)
         return nil, 'cafile must be a string'
       end
       peers_opts.cafile = v
+    elseif k == 'ssl_protocol' then
+      if type(v) ~= 'string' then
+        return nil, 'ssl_protocol must be a string'
+      end
+      peers_opts.ssl_protocol = v
     elseif k == 'auth' then
       if type(v) ~= 'table' then
         return nil, 'auth seems not to be an auth provider'
diff --git a/spec/02-integration/02-ssl_spec.lua b/spec/02-integration/02-ssl_spec.lua
@@ -31,5 +31,32 @@ describe("SSL", function()
       local rows = assert(peer:execute "SELECT * FROM system.local")
       assert.equal(1, #rows)
     end)
+    it("connects with TLSv1_1 encryption", function()
+      local peer = assert(cassandra.new {
+        ssl = true,
+        ssl_protocol = 'tlsv1_1',
+      })
+      assert(peer:connect())
+      local rows = assert(peer:execute "SELECT * FROM system.local")
+      assert.equal(1, #rows)
+    end)
+    it("connects with TLSv1_2 encryption", function()
+      local peer = assert(cassandra.new {
+        ssl = true,
+        ssl_protocol = 'tlsv1_2',
+      })
+      assert(peer:connect())
+      local rows = assert(peer:execute "SELECT * FROM system.local")
+      assert.equal(1, #rows)
+    end)
+    it("connects with negotiated highest possible encryption", function()
+      local peer = assert(cassandra.new {
+        ssl = true,
+        ssl_protocol = 'any',
+      })
+      assert(peer:connect())
+      local rows = assert(peer:execute "SELECT * FROM system.local")
+      assert.equal(1, #rows)
+    end)
   end)
 end)

Original file line number	Diff line number	Diff line change
`@@ -35,6 +35,7 @@ http {`
`35`	`35`	`contact_points = {"127.0.0.1", "127.0.0.2"},`
`36`	`36`	`keyspace = "my_keyspace",`
`37`	`37`	`ssl = true,`
	`38`	`+ encryption_protocol = 'any'`
`38`	`39`	`verify = true`
`39`	`40`	`}`
`40`	`41`	`if not cluster then`