Skip to content

Commit 292d32a

Browse files
animovscwanimovscw
committed
IGNITE-28444: Fix SSL cipher tests for current JDK defaults
1 parent ad9517c commit 292d32a

File tree

1 file changed

+112
-35
lines changed

1 file changed

+112
-35
lines changed

‎modules/clients/src/test/java/org/apache/ignite/jdbc/thin/JdbcThinConnectionSSLTest.java‎

Lines changed: 112 additions & 35 deletions
Original file line numberDiff line numberDiff line change
@@ -23,6 +23,9 @@
2323
import java.sql.ResultSet;
2424
import java.sql.SQLException;
2525
import java.sql.Statement;
26+
import java.util.Arrays;
27+
import java.util.LinkedHashSet;
28+
import java.util.Set;
2629
import java.util.concurrent.Callable;
2730
import javax.cache.configuration.Factory;
2831
import javax.net.ssl.SSLContext;
@@ -33,6 +36,7 @@
3336
import org.apache.ignite.internal.util.typedef.internal.U;
3437
import org.apache.ignite.ssl.SslContextFactory;
3538
import org.apache.ignite.testframework.GridTestUtils;
39+
import org.junit.Assume;
3640
import org.junit.Test;
3741

3842
/**
@@ -51,6 +55,8 @@ public class JdbcThinConnectionSSLTest extends JdbcThinAbstractSelfTest {
5155
/** Trust key store path. */
5256
private static final String TRUST_KEY_STORE_PATH = U.getIgniteHome() +
5357
"/modules/clients/src/test/keystore/trust-one.jks";
58+
/** Unsupported cipher. */
59+
private static final String UNSUPPORTED_CIPHER = "TLS_ECDH_anon_WITH_3DES_EDE_CBC_SHA";
5460

5561
/** SSL context factory. */
5662
private static Factory<SSLContext> sslCtxFactory;
@@ -96,6 +102,62 @@ public class JdbcThinConnectionSSLTest extends JdbcThinAbstractSelfTest {
96102
return cfg;
97103
}
98104

105+
/**
106+
* @return One of default cipher suites for the current JDK.
107+
* @throws NoSuchAlgorithmException If failed.
108+
*/
109+
private static String defaultCipher() throws NoSuchAlgorithmException {
110+
String[] dflt = SSLContext.getDefault().getSocketFactory().getDefaultCipherSuites();
111+
112+
assertTrue("No default cipher suites available", dflt.length > 0);
113+
114+
return dflt[0];
115+
}
116+
117+
/**
118+
* @param exclude Cipher to exclude.
119+
* @return Another default cipher suite for the current JDK.
120+
* @throws NoSuchAlgorithmException If failed.
121+
*/
122+
private static String anotherDefaultCipher(String exclude) throws NoSuchAlgorithmException {
123+
String[] dflt = SSLContext.getDefault().getSocketFactory().getDefaultCipherSuites();
124+
125+
for (String cipher : dflt) {
126+
if (!cipher.equals(exclude))
127+
return cipher;
128+
}
129+
130+
fail("No alternative default cipher suite found");
131+
132+
return null;
133+
}
134+
135+
/**
136+
* @return Supported RSA cipher suite that is not enabled by default, or null if none found.
137+
* @throws NoSuchAlgorithmException If failed.
138+
*/
139+
private static String supportedButNonDfltCipherOrNull() throws NoSuchAlgorithmException {
140+
SSLSocketFactory factory = SSLContext.getDefault().getSocketFactory();
141+
142+
Set<String> supported = new LinkedHashSet<>(Arrays.asList(factory.getSupportedCipherSuites()));
143+
Set<String> dflt = new LinkedHashSet<>(Arrays.asList(factory.getDefaultCipherSuites()));
144+
145+
for (String cipher : supported) {
146+
if (dflt.contains(cipher))
147+
continue;
148+
149+
if (!cipher.contains("_RSA_"))
150+
continue;
151+
152+
if (cipher.contains("_anon_") || cipher.contains("_NULL_") || cipher.contains("_ECDSA_"))
153+
continue;
154+
155+
return cipher;
156+
}
157+
158+
return null;
159+
}
160+
99161
/**
100162
* @throws Exception If failed.
101163
*/
@@ -232,10 +294,13 @@ public void testCustomCiphersOnClient() throws Exception {
232294
setSslCtxFactoryToCli = true;
233295
sslCtxFactory = getTestSslContextFactory();
234296

297+
String cipher1 = defaultCipher();
298+
String cipher2 = anotherDefaultCipher(cipher1);
299+
235300
startGrids(1);
236301

237302
try {
238-
// Default ciphers
303+
// Default ciphers.
239304
try (Connection conn = DriverManager.getConnection("jdbc:ignite:thin://127.0.0.1/?sslMode=require" +
240305
"&sslClientCertificateKeyStoreUrl=" + CLI_KEY_STORE_PATH +
241306
"&sslClientCertificateKeyStorePassword=123456" +
@@ -244,9 +309,9 @@ public void testCustomCiphersOnClient() throws Exception {
244309
checkConnection(conn);
245310
}
246311

247-
// Explicit cipher (one of defaults).
312+
// Explicit cipher.
248313
try (Connection conn = DriverManager.getConnection("jdbc:ignite:thin://127.0.0.1/?sslMode=require" +
249-
"&sslCipherSuites=TLS_RSA_WITH_AES_256_CBC_SHA256" +
314+
"&sslCipherSuites=" + cipher1 +
250315
"&sslClientCertificateKeyStoreUrl=" + CLI_KEY_STORE_PATH +
251316
"&sslClientCertificateKeyStorePassword=123456" +
252317
"&sslTrustCertificateKeyStoreUrl=" + TRUST_KEY_STORE_PATH +
@@ -256,7 +321,7 @@ public void testCustomCiphersOnClient() throws Exception {
256321

257322
// Explicit ciphers.
258323
try (Connection conn = DriverManager.getConnection("jdbc:ignite:thin://127.0.0.1/?sslMode=require" +
259-
"&sslCipherSuites=TLS_RSA_WITH_NULL_SHA256,TLS_RSA_WITH_AES_256_CBC_SHA256" +
324+
"&sslCipherSuites=" + cipher2 + "," + cipher1 +
260325
"&sslClientCertificateKeyStoreUrl=" + CLI_KEY_STORE_PATH +
261326
"&sslClientCertificateKeyStorePassword=123456" +
262327
"&sslTrustCertificateKeyStoreUrl=" + TRUST_KEY_STORE_PATH +
@@ -275,7 +340,11 @@ public void testCustomCiphersOnClient() throws Exception {
275340
@Test
276341
public void testCustomCiphersOnServer() throws Exception {
277342
setSslCtxFactoryToCli = true;
278-
supportedCiphers = new String[] {"TLS_RSA_WITH_AES_256_CBC_SHA256" /* Enabled by default */};
343+
344+
String cipher1 = defaultCipher();
345+
String cipher2 = anotherDefaultCipher(cipher1);
346+
347+
supportedCiphers = new String[] {cipher1};
279348
sslCtxFactory = getTestSslContextFactory();
280349

281350
startGrids(1);
@@ -292,27 +361,28 @@ public void testCustomCiphersOnServer() throws Exception {
292361

293362
// Explicit cipher.
294363
try (Connection conn = DriverManager.getConnection("jdbc:ignite:thin://127.0.0.1/?sslMode=require" +
295-
"&sslCipherSuites=TLS_RSA_WITH_AES_256_CBC_SHA256" +
364+
"&sslCipherSuites=" + cipher1 +
296365
"&sslClientCertificateKeyStoreUrl=" + CLI_KEY_STORE_PATH +
297366
"&sslClientCertificateKeyStorePassword=123456" +
298367
"&sslTrustCertificateKeyStoreUrl=" + TRUST_KEY_STORE_PATH +
299368
"&sslTrustCertificateKeyStorePassword=123456")) {
300369
checkConnection(conn);
301370
}
302371

303-
// Disabled by default cipher.
304-
GridTestUtils.assertThrows(log, () -> {
305-
return DriverManager.getConnection("jdbc:ignite:thin://127.0.0.1/?sslMode=require" +
306-
"&sslCipherSuites=TLS_RSA_WITH_NULL_SHA256" +
372+
// Explicit cipher not supported by server.
373+
GridTestUtils.assertThrows(log, () ->
374+
DriverManager.getConnection(
375+
"jdbc:ignite:thin://127.0.0.1/?sslMode=require" +
376+
"&sslCipherSuites=" + cipher2 +
307377
"&sslClientCertificateKeyStoreUrl=" + CLI_KEY_STORE_PATH +
308378
"&sslClientCertificateKeyStorePassword=123456" +
309379
"&sslTrustCertificateKeyStoreUrl=" + TRUST_KEY_STORE_PATH +
310-
"&sslTrustCertificateKeyStorePassword=123456");
311-
}, SQLException.class, "Failed to SSL connect to server");
380+
"&sslTrustCertificateKeyStorePassword=123456"
381+
), SQLException.class, "Failed to SSL connect to server");
312382

313383
// Explicit ciphers.
314384
try (Connection conn = DriverManager.getConnection("jdbc:ignite:thin://127.0.0.1/?sslMode=require" +
315-
"&sslCipherSuites=TLS_RSA_WITH_NULL_SHA256,TLS_RSA_WITH_AES_256_CBC_SHA256" +
385+
"&sslCipherSuites=" + cipher2 + "," + cipher1 +
316386
"&sslClientCertificateKeyStoreUrl=" + CLI_KEY_STORE_PATH +
317387
"&sslClientCertificateKeyStorePassword=123456" +
318388
"&sslTrustCertificateKeyStoreUrl=" + TRUST_KEY_STORE_PATH +
@@ -333,15 +403,20 @@ public void testCustomCiphersOnServer() throws Exception {
333403
*/
334404
@Test
335405
public void testDisabledCustomCipher() throws Exception {
406+
String nonDfltCipher = supportedButNonDfltCipherOrNull();
407+
408+
Assume.assumeNotNull(nonDfltCipher);
409+
336410
setSslCtxFactoryToCli = true;
337-
supportedCiphers = new String[] {"TLS_RSA_WITH_NULL_SHA256" /* Disabled by default */};
411+
supportedCiphers = new String[] {nonDfltCipher};
338412
sslCtxFactory = getTestSslContextFactory();
339413

340414
startGrids(1);
415+
341416
try {
342-
// Explicit supported ciphers.
417+
// Explicit supported cipher.
343418
try (Connection conn = DriverManager.getConnection("jdbc:ignite:thin://127.0.0.1/?sslMode=require" +
344-
"&sslCipherSuites=TLS_RSA_WITH_NULL_SHA256" +
419+
"&sslCipherSuites=" + nonDfltCipher +
345420
"&sslTrustAll=true" +
346421
"&sslClientCertificateKeyStoreUrl=" + CLI_KEY_STORE_PATH +
347422
"&sslClientCertificateKeyStorePassword=123456" +
@@ -351,13 +426,13 @@ public void testDisabledCustomCipher() throws Exception {
351426
}
352427

353428
// Default ciphers.
354-
GridTestUtils.assertThrows(log, () -> {
355-
return DriverManager.getConnection("jdbc:ignite:thin://127.0.0.1/?sslMode=require" +
429+
GridTestUtils.assertThrows(log, () -> DriverManager.getConnection(
430+
"jdbc:ignite:thin://127.0.0.1/?sslMode=require" +
356431
"&sslClientCertificateKeyStoreUrl=" + CLI_KEY_STORE_PATH +
357432
"&sslClientCertificateKeyStorePassword=123456" +
358433
"&sslTrustCertificateKeyStoreUrl=" + TRUST_KEY_STORE_PATH +
359-
"&sslTrustCertificateKeyStorePassword=123456");
360-
}, SQLException.class, "Failed to SSL connect to server");
434+
"&sslTrustCertificateKeyStorePassword=123456"
435+
), SQLException.class, "Failed to SSL connect to server");
361436
}
362437
finally {
363438
stopAllGrids();
@@ -372,28 +447,31 @@ public void testDisabledCustomCipher() throws Exception {
372447
*/
373448
@Test
374449
public void testUnsupportedCustomCipher() throws Exception {
450+
String nonDfltCipher = supportedButNonDfltCipherOrNull();
451+
452+
Assume.assumeNotNull(nonDfltCipher);
453+
375454
setSslCtxFactoryToCli = true;
376-
supportedCiphers = new String[] {
377-
"TLS_RSA_WITH_NULL_SHA256" /* Disabled by default */,
378-
"TLS_ECDH_anon_WITH_3DES_EDE_CBC_SHA" /* With disabled protocol*/};
455+
supportedCiphers = new String[] {nonDfltCipher, UNSUPPORTED_CIPHER};
379456
sslCtxFactory = getTestSslContextFactory();
380457

381458
startGrids(1);
459+
382460
try {
383-
// Enabled ciphers with unsupported algorithm can't be negotiated.
384-
GridTestUtils.assertThrows(log, () -> {
385-
return DriverManager.getConnection("jdbc:ignite:thin://127.0.0.1/?sslMode=require" +
386-
"&sslCipherSuites=TLS_ECDH_anon_WITH_3DES_EDE_CBC_SHA" +
461+
// Unsupported cipher can't be negotiated.
462+
GridTestUtils.assertThrows(log, () -> DriverManager.getConnection(
463+
"jdbc:ignite:thin://127.0.0.1/?sslMode=require" +
464+
"&sslCipherSuites=" + UNSUPPORTED_CIPHER +
387465
"&sslTrustAll=true" +
388466
"&sslClientCertificateKeyStoreUrl=" + CLI_KEY_STORE_PATH +
389467
"&sslClientCertificateKeyStorePassword=123456" +
390468
"&sslTrustCertificateKeyStoreUrl=" + TRUST_KEY_STORE_PATH +
391-
"&sslTrustCertificateKeyStorePassword=123456");
392-
}, SQLException.class, "Failed to SSL connect to server");
469+
"&sslTrustCertificateKeyStorePassword=123456"
470+
), SQLException.class, "Failed to SSL connect to server");
393471

394472
// Supported cipher.
395473
try (Connection conn = DriverManager.getConnection("jdbc:ignite:thin://127.0.0.1/?sslMode=require" +
396-
"&sslCipherSuites=TLS_RSA_WITH_NULL_SHA256" +
474+
"&sslCipherSuites=" + nonDfltCipher +
397475
"&sslTrustAll=true" +
398476
"&sslClientCertificateKeyStoreUrl=" + CLI_KEY_STORE_PATH +
399477
"&sslClientCertificateKeyStorePassword=123456" +
@@ -403,14 +481,13 @@ public void testUnsupportedCustomCipher() throws Exception {
403481
}
404482

405483
// Default ciphers.
406-
GridTestUtils.assertThrows(log, () -> {
407-
return DriverManager.getConnection("jdbc:ignite:thin://127.0.0.1/?sslMode=require" +
484+
GridTestUtils.assertThrows(log, () -> DriverManager.getConnection(
485+
"jdbc:ignite:thin://127.0.0.1/?sslMode=require" +
408486
"&sslClientCertificateKeyStoreUrl=" + CLI_KEY_STORE_PATH +
409487
"&sslClientCertificateKeyStorePassword=123456" +
410488
"&sslTrustCertificateKeyStoreUrl=" + TRUST_KEY_STORE_PATH +
411-
"&sslTrustCertificateKeyStorePassword=123456");
412-
}, SQLException.class, "Failed to SSL connect to server");
413-
489+
"&sslTrustCertificateKeyStorePassword=123456"
490+
), SQLException.class, "Failed to SSL connect to server");
414491
}
415492
finally {
416493
stopAllGrids();

0 commit comments

Comments
 (0)