From 16df54eaa532025f674cffcf7e7d2b1bde56e98f Mon Sep 17 00:00:00 2001
From: Kevin Tibi <kevintibi@hotmail.com>
Date: Thu, 19 Jul 2018 11:38:53 +0200
Subject: [PATCH] Disable TLS 1.1 on haproxy
While it is possible to implement countermeasures against some attacks
on TLS, migrating to a later version of TLS (TLS 1.2 is strongly
encouraged) is the only reliable method to protect against
the current protocol vulnerabilities.[1]
[1] https://blog.pcisecuritystandards.org/are-you-ready-for-30-june-2018-sayin-goodbye-to-ssl-early-tls
Change-Id: I44f67e3a49bb00fea069d29c46b3e86404c7df0b
---
ansible/roles/haproxy/templates/haproxy.cfg.j2 | 2 +-
releasenotes/notes/disable_tlsv11-51d6be67d593f7ab.yaml | 5 +++++
2 files changed, 6 insertions(+), 1 deletion(-)
create mode 100644 releasenotes/notes/disable_tlsv11-51d6be67d593f7ab.yaml
diff --git a/ansible/roles/haproxy/templates/haproxy.cfg.j2 b/ansible/roles/haproxy/templates/haproxy.cfg.j2
index fffe96fa89..4d87acde80 100644
--- a/ansible/roles/haproxy/templates/haproxy.cfg.j2
+++ b/ansible/roles/haproxy/templates/haproxy.cfg.j2
@@ -16,7 +16,7 @@ global
stats socket /var/lib/kolla/haproxy/haproxy.sock group kolla mode 660
{% if kolla_enable_tls_external | bool %}
ssl-default-bind-ciphers DEFAULT:!MEDIUM:!3DES
- ssl-default-bind-options no-sslv3 no-tlsv10
+ ssl-default-bind-options no-sslv3 no-tlsv10 no-tlsv11
tune.ssl.default-dh-param 4096
{% endif %}
diff --git a/releasenotes/notes/disable_tlsv11-51d6be67d593f7ab.yaml b/releasenotes/notes/disable_tlsv11-51d6be67d593f7ab.yaml
new file mode 100644
index 0000000000..e8ee865ca1
--- /dev/null
+++ b/releasenotes/notes/disable_tlsv11-51d6be67d593f7ab.yaml
@@ -0,0 +1,5 @@
+---
+security:
+ - |
+ Disable TLS 1.1 on haproxy for external network if
+ tls is enabled.
--
GitLab