horizon: Add SSL protocol option.

chef/cookbooks/horizon/attributes/default.rb

@@ -33,6 +33,7 @@
 default[:horizon][:policy_file][:neutron_fwaas] = "neutron-fwaas-policy.json"
 
 default[:horizon][:apache][:ssl] = false
+default[:horizon][:apache][:ssl_protocol] = "all -SSLv3"
 default[:horizon][:apache][:ssl_crt_file] = "/etc/apache2/ssl.crt/openstack-dashboard-server.crt"
 default[:horizon][:apache][:ssl_key_file] = "/etc/apache2/ssl.key/openstack-dashboard-server.key"
 default[:horizon][:apache][:generate_certs] = false

chef/cookbooks/horizon/recipes/server.rb

@@ -564,6 +564,7 @@
     user: node[:apache][:user],
     group: node[:apache][:group],
     use_ssl: node[:horizon][:apache][:ssl],
+    ssl_protocol: node[:horizon][:apache][:ssl_protocol],
     ssl_crt_file: node[:horizon][:apache][:ssl_crt_file],
     ssl_key_file: node[:horizon][:apache][:ssl_key_file],
     ssl_crt_chain_file: node[:horizon][:apache][:ssl_crt_chain_file],

chef/cookbooks/horizon/templates/suse/openstack-dashboard.conf.erb

@@ -55,7 +55,7 @@ Listen <%= @bind_host %>:<%= @bind_port_ssl %>
 <VirtualHost <%= @bind_host %>:<%= @bind_port_ssl %>>
     SSLEngine On
     SSLCipherSuite DEFAULT_SUSE
-    SSLProtocol all -SSLv2 -SSLv3
+    SSLProtocol <%= @ssl_protocol %>
     # Prevent plaintext downgrade for 180 days
     Header always set Strict-Transport-Security "max-age=15552000"
     SSLCertificateFile <%= @ssl_crt_file %>

chef/data_bags/crowbar/migrate/horizon/303_add_ssl_protocol.rb

@@ -0,0 +1,11 @@
+def upgrade(template_attrs, template_deployment, attrs, deployment)
+  unless attrs["apache"].key? "ssl_protocol"
+    attrs["apache"]["ssl_protocol"] = template_attrs["apache"]["ssl_protocol"]
+  return attrs, deployment
+end
+
+def downgrade(template_attrs, template_deployment, attrs, deployment)
+  unless template_attrs["apache"].key? "ssl_protocol"
+    attrs["apache"].delete("ssl_protocol")
+  return attrs, deployment
+end

chef/data_bags/crowbar/template-horizon.json

@@ -36,6 +36,7 @@
       "apache": {
         "ssl": false,
         "generate_certs": false,
+        "ssl_protocol": "all -SSLv3",
         "ssl_crt_file": "/etc/apache2/ssl.crt/openstack-dashboard-server.crt",
         "ssl_key_file": "/etc/apache2/ssl.key/openstack-dashboard-server.key",
         "ssl_crt_chain_file": ""
@@ -52,7 +53,7 @@
     "horizon": {
       "crowbar-revision": 0,
       "crowbar-applied": false,
-      "schema-revision": 302,
+      "schema-revision": 303,
       "element_states": {
         "horizon-server": [ "readying", "ready", "applying" ]
       },

chef/data_bags/crowbar/template-horizon.schema

@@ -60,6 +60,7 @@
               "mapping": {
                 "ssl": { "type": "bool", "required": true },
                 "generate_certs": { "type": "bool", "required": true },
+                "ssl_protocol": { "type": "str" },
                 "ssl_crt_file": { "type": "str" },
                 "ssl_key_file": { "type": "str" },
                 "ssl_crt_chain_file": { "type": "str" }