From 1a780823384a9c4289b8bb0b3c73e6b886d78fd0 Mon Sep 17 00:00:00 2001
From: Karthik Kambatla <kasha@apache.org>
Date: Tue, 28 Oct 2014 17:18:24 -0700
Subject: [PATCH] HADOOP-11217. Disable SSLv3 in KMS. (Robert Kanter via kasha)

---
 hadoop-common-project/hadoop-common/CHANGES.txt                 | 2 ++
 hadoop-common-project/hadoop-kms/src/main/tomcat/ssl-server.xml | 2 +-
 2 files changed, 3 insertions(+), 1 deletion(-)

diff --git a/hadoop-common-project/hadoop-common/CHANGES.txt b/hadoop-common-project/hadoop-common/CHANGES.txt
index bdbf89e159..7358b98e6d 100644
--- a/hadoop-common-project/hadoop-common/CHANGES.txt
+++ b/hadoop-common-project/hadoop-common/CHANGES.txt
@@ -1013,6 +1013,8 @@ Release 2.6.0 - UNRELEASED
     HADOOP-11170. ZKDelegationTokenSecretManager fails to renewToken created by 
     a peer. (Arun Suresh and Gregory Chanan via kasha)
 
+    HADOOP-11217. Disable SSLv3 in KMS. (Robert Kanter via kasha)
+
 Release 2.5.1 - 2014-09-05
 
   INCOMPATIBLE CHANGES
diff --git a/hadoop-common-project/hadoop-kms/src/main/tomcat/ssl-server.xml b/hadoop-common-project/hadoop-kms/src/main/tomcat/ssl-server.xml
index 6235b8b6bf..531ad153dc 100644
--- a/hadoop-common-project/hadoop-kms/src/main/tomcat/ssl-server.xml
+++ b/hadoop-common-project/hadoop-kms/src/main/tomcat/ssl-server.xml
@@ -70,7 +70,7 @@
          described in the APR documentation -->
     <Connector port="${kms.http.port}" protocol="HTTP/1.1" SSLEnabled="true"
                maxThreads="${kms.max.threads}" scheme="https" secure="true"
-               clientAuth="false" sslProtocol="TLS"
+               clientAuth="false" sslEnabledProtocols="TLSv1"
                keystoreFile="${kms.ssl.keystore.file}"
                keystorePass="${kms.ssl.keystore.pass}"/>