fix(aihitLoader): Добавлены параметры понижения версии TLS

This commit is contained in:
Mikhail Kuznetsov
2026-06-26 12:23:07 +10:00
parent 65ef0dec92
commit 52bd0d8ce1
6 changed files with 54 additions and 76 deletions

View File

@@ -27,12 +27,14 @@ FROM base AS final
WORKDIR /app
COPY --from=publish /app/publish .
# Понижаем уровень безопасности OpenSSL до уровня 1 и разрешаем TLSv1
#RUN sed -i 's/CipherString = DEFAULT:@SECLEVEL=2/CipherString = DEFAULT:@SECLEVEL=1/g' /etc/ssl/openssl.cnf && \
# sed -i 's/MinProtocol = TLSv1.2/MinProtocol = TLSv1/g' /etc/ssl/openssl.cnf
# 1. Принудительно настраиваем OpenSSL 3 на игнорирование непредвиденных EOF (UnsafeLegacyRenegotiation и IgnoreUnexpectedEOF)
RUN sed -i 's/providers = provider_sect/providers = provider_sect\nssl_conf = ssl_sect/' /etc/ssl/openssl.cnf \
&& printf "\n[ssl_sect]\nsystem_default = system_default_sect\n" >> /etc/ssl/openssl.cnf \
&& printf "\n[system_default_sect]\nOptions = UnsafeLegacyRenegotiation,IgnoreUnexpectedEOF\nMinProtocol = TLSv1\nCipherString = DEFAULT@SECLEVEL=0\n" >> /etc/ssl/openssl.cnf
# 2. Оставляем глобальные переменные совместимости для самого рантайма .NET 9
ENV DOTNET_AppContext_Switch_System_Net_Security_UseUnsafeOldTlsRuntimeBehavior=true
ENV DOTNET_AppContext_Switch_Microsoft_Data_SqlClient_UseOldTlsValue=true
ENV DOTNET_SYSTEM_NET_SECURITY_ALLOWUNSECUREDEFAULTS=true
ENV OPENSSL_SYSTEM_DEFAULT_MIN_PROTOCOL=TLSv1
ENV OPENSSL_SYSTEM_DEFAULT_CIPHER_STRING=DEFAULT@SECLEVEL=0
ENTRYPOINT ["dotnet", "PARR.AIHITLoaderWorker.dll"]

View File

@@ -1,6 +1,6 @@
{
"ConnectionStrings": {
"AihitConnection": "Data Source=10.248.19.97; Initial Catalog=mao2;User ID=awhit-ipp-parr;pwd=ET3h$9y1LH#D;Encrypt=Optional;TrustServerCertificate=true;"
"AihitConnection": "Data Source=10.248.19.97; Initial Catalog=mao2;User ID=awhit-ipp-parr;pwd=ET3h$9y1LH#D;Encrypt=Optional;TrustServerCertificate=true;MultiSubnetFailover=True;"
},
"Logging": {
"LogLevel": {