Re: Re: ZEO SSL support and Daft docs
Julien Muchembled <[email protected]>
| Newsgroups | gmane.comp.web.zope.zodb |
|---|---|
| Message-ID | <[email protected]> |
In NEO but it applies also to ZEO, client nodes (like zopes) have the potential to do enough damage so other nodes have to trust them. Which means we treat a NEO cluster as _single_ application, that consists of master/storage/admin nodes but also client nodes. And from SSL point of view, all nodes are equal in NEO: there's no only-client or only-server auth. ssl.create_default_context didn't really fit for us. We somehow copied and pasted, with the following changes: - OP_CIPHER_SERVER_PREFERENCE and _RESTRICTED_SERVER_CIPHERS like CLIENT_AUTH - verify_mode = CERT_REQUIRED like SERVER_AUTH - no check_hostname We also enable VERIFY_X509_STRICT and CRL check if there's one. All nodes must be configured with a ca, cert and key. System certs ignored. About the TLS version, we force the use of the maximum TLS version supported by the platform, to ensure all nodes use the same as expected when setting up them (IOW, no downgrade). So NEO is usable with TLS 1.0, but it won't mix TLS 1.0 & TLS 1.2. The resulting code is quite small: https://lab.nexedi.com/nexedi/neoppod/blob/master/neo/lib/app.py Julien -- You received this message because you are subscribed to the Google Groups "zodb" group. To unsubscribe from this group and stop receiving emails from it, send an email to [email protected]. For more options, visit https://groups.google.com/d/optout.