Skip to content

Commit 2de8e1f

Browse files
animovscwanimovscw
committed
IGNITE-28444: Fix SSL cipher tests for current JDK defaults
1 parent ad9517c commit 2de8e1f

File tree

1 file changed

+109
-41
lines changed

1 file changed

+109
-41
lines changed

‎modules/clients/src/test/java/org/apache/ignite/jdbc/thin/JdbcThinConnectionSSLTest.java‎

Lines changed: 109 additions & 41 deletions
Original file line numberDiff line numberDiff line change
@@ -23,6 +23,9 @@
2323
import java.sql.ResultSet;
2424
import java.sql.SQLException;
2525
import java.sql.Statement;
26+
import java.util.Arrays;
27+
import java.util.LinkedHashSet;
28+
import java.util.Set;
2629
import java.util.concurrent.Callable;
2730
import javax.cache.configuration.Factory;
2831
import javax.net.ssl.SSLContext;
@@ -33,6 +36,7 @@
3336
import org.apache.ignite.internal.util.typedef.internal.U;
3437
import org.apache.ignite.ssl.SslContextFactory;
3538
import org.apache.ignite.testframework.GridTestUtils;
39+
import org.junit.Assume;
3640
import org.junit.Test;
3741

3842
/**
@@ -52,6 +56,9 @@ public class JdbcThinConnectionSSLTest extends JdbcThinAbstractSelfTest {
5256
private static final String TRUST_KEY_STORE_PATH = U.getIgniteHome() +
5357
"/modules/clients/src/test/keystore/trust-one.jks";
5458

59+
/** Unsupported cipher. */
60+
private static final String UNSUPPORTED_CIPHER = "TLS_ECDH_anon_WITH_3DES_EDE_CBC_SHA";
61+
5562
/** SSL context factory. */
5663
private static Factory<SSLContext> sslCtxFactory;
5764

@@ -96,6 +103,59 @@ public class JdbcThinConnectionSSLTest extends JdbcThinAbstractSelfTest {
96103
return cfg;
97104
}
98105

106+
/**
107+
* @return One of default cipher suites for the current JDK.
108+
* @throws NoSuchAlgorithmException If failed.
109+
*/
110+
private static String dfltCipher() throws NoSuchAlgorithmException {
111+
String[] dflt = SSLContext.getDefault().getSocketFactory().getDefaultCipherSuites();
112+
113+
assertTrue("No default cipher suites available", dflt.length > 0);
114+
115+
return dflt[0];
116+
}
117+
118+
/**
119+
* @param exclude Cipher to exclude.
120+
* @return Another default cipher suite for the current JDK.
121+
* @throws NoSuchAlgorithmException If failed.
122+
*/
123+
private static String anotherDfltCipher(String exclude) throws NoSuchAlgorithmException {
124+
String[] dflt = SSLContext.getDefault().getSocketFactory().getDefaultCipherSuites();
125+
126+
for (String cipher : dflt) {
127+
if (!cipher.equals(exclude))
128+
return cipher;
129+
}
130+
131+
fail("No alternative default cipher suite found");
132+
133+
return null;
134+
}
135+
136+
/**
137+
* @return Supported cipher suite that is not enabled by default, or null if none found.
138+
* @throws NoSuchAlgorithmException If failed.
139+
*/
140+
private static String supportedButNonDfltCipherOrNull() throws NoSuchAlgorithmException {
141+
SSLSocketFactory factory = SSLContext.getDefault().getSocketFactory();
142+
143+
Set<String> supported = new LinkedHashSet<>(Arrays.asList(factory.getSupportedCipherSuites()));
144+
Set<String> dflt = new LinkedHashSet<>(Arrays.asList(factory.getDefaultCipherSuites()));
145+
146+
for (String cipher : supported) {
147+
if (dflt.contains(cipher))
148+
continue;
149+
150+
if (cipher.contains("_anon_") || cipher.contains("_NULL_"))
151+
continue;
152+
153+
return cipher;
154+
}
155+
156+
return null;
157+
}
158+
99159
/**
100160
* @throws Exception If failed.
101161
*/
@@ -232,10 +292,13 @@ public void testCustomCiphersOnClient() throws Exception {
232292
setSslCtxFactoryToCli = true;
233293
sslCtxFactory = getTestSslContextFactory();
234294

295+
String cipher1 = dfltCipher();
296+
String cipher2 = anotherDfltCipher(cipher1);
297+
235298
startGrids(1);
236299

237300
try {
238-
// Default ciphers
301+
// Default ciphers.
239302
try (Connection conn = DriverManager.getConnection("jdbc:ignite:thin://127.0.0.1/?sslMode=require" +
240303
"&sslClientCertificateKeyStoreUrl=" + CLI_KEY_STORE_PATH +
241304
"&sslClientCertificateKeyStorePassword=123456" +
@@ -244,9 +307,9 @@ public void testCustomCiphersOnClient() throws Exception {
244307
checkConnection(conn);
245308
}
246309

247-
// Explicit cipher (one of defaults).
310+
// Explicit cipher.
248311
try (Connection conn = DriverManager.getConnection("jdbc:ignite:thin://127.0.0.1/?sslMode=require" +
249-
"&sslCipherSuites=TLS_RSA_WITH_AES_256_CBC_SHA256" +
312+
"&sslCipherSuites=" + cipher1 +
250313
"&sslClientCertificateKeyStoreUrl=" + CLI_KEY_STORE_PATH +
251314
"&sslClientCertificateKeyStorePassword=123456" +
252315
"&sslTrustCertificateKeyStoreUrl=" + TRUST_KEY_STORE_PATH +
@@ -256,7 +319,7 @@ public void testCustomCiphersOnClient() throws Exception {
256319

257320
// Explicit ciphers.
258321
try (Connection conn = DriverManager.getConnection("jdbc:ignite:thin://127.0.0.1/?sslMode=require" +
259-
"&sslCipherSuites=TLS_RSA_WITH_NULL_SHA256,TLS_RSA_WITH_AES_256_CBC_SHA256" +
322+
"&sslCipherSuites=" + cipher2 + "," + cipher1 +
260323
"&sslClientCertificateKeyStoreUrl=" + CLI_KEY_STORE_PATH +
261324
"&sslClientCertificateKeyStorePassword=123456" +
262325
"&sslTrustCertificateKeyStoreUrl=" + TRUST_KEY_STORE_PATH +
@@ -275,7 +338,11 @@ public void testCustomCiphersOnClient() throws Exception {
275338
@Test
276339
public void testCustomCiphersOnServer() throws Exception {
277340
setSslCtxFactoryToCli = true;
278-
supportedCiphers = new String[] {"TLS_RSA_WITH_AES_256_CBC_SHA256" /* Enabled by default */};
341+
342+
String cipher1 = dfltCipher();
343+
String cipher2 = anotherDfltCipher(cipher1);
344+
345+
supportedCiphers = new String[] {cipher1};
279346
sslCtxFactory = getTestSslContextFactory();
280347

281348
startGrids(1);
@@ -292,27 +359,27 @@ public void testCustomCiphersOnServer() throws Exception {
292359

293360
// Explicit cipher.
294361
try (Connection conn = DriverManager.getConnection("jdbc:ignite:thin://127.0.0.1/?sslMode=require" +
295-
"&sslCipherSuites=TLS_RSA_WITH_AES_256_CBC_SHA256" +
362+
"&sslCipherSuites=" + cipher1 +
296363
"&sslClientCertificateKeyStoreUrl=" + CLI_KEY_STORE_PATH +
297364
"&sslClientCertificateKeyStorePassword=123456" +
298365
"&sslTrustCertificateKeyStoreUrl=" + TRUST_KEY_STORE_PATH +
299366
"&sslTrustCertificateKeyStorePassword=123456")) {
300367
checkConnection(conn);
301368
}
302369

303-
// Disabled by default cipher.
304-
GridTestUtils.assertThrows(log, () -> {
305-
return DriverManager.getConnection("jdbc:ignite:thin://127.0.0.1/?sslMode=require" +
306-
"&sslCipherSuites=TLS_RSA_WITH_NULL_SHA256" +
370+
// Explicit cipher not supported by server.
371+
GridTestUtils.assertThrows(log, () -> DriverManager.getConnection(
372+
"jdbc:ignite:thin://127.0.0.1/?sslMode=require" +
373+
"&sslCipherSuites=" + cipher2 +
307374
"&sslClientCertificateKeyStoreUrl=" + CLI_KEY_STORE_PATH +
308375
"&sslClientCertificateKeyStorePassword=123456" +
309376
"&sslTrustCertificateKeyStoreUrl=" + TRUST_KEY_STORE_PATH +
310-
"&sslTrustCertificateKeyStorePassword=123456");
311-
}, SQLException.class, "Failed to SSL connect to server");
377+
"&sslTrustCertificateKeyStorePassword=123456"
378+
), SQLException.class, "Failed to SSL connect to server");
312379

313380
// Explicit ciphers.
314381
try (Connection conn = DriverManager.getConnection("jdbc:ignite:thin://127.0.0.1/?sslMode=require" +
315-
"&sslCipherSuites=TLS_RSA_WITH_NULL_SHA256,TLS_RSA_WITH_AES_256_CBC_SHA256" +
382+
"&sslCipherSuites=" + cipher2 + "," + cipher1 +
316383
"&sslClientCertificateKeyStoreUrl=" + CLI_KEY_STORE_PATH +
317384
"&sslClientCertificateKeyStorePassword=123456" +
318385
"&sslTrustCertificateKeyStoreUrl=" + TRUST_KEY_STORE_PATH +
@@ -327,21 +394,23 @@ public void testCustomCiphersOnServer() throws Exception {
327394

328395
/**
329396
* @throws Exception If failed.
330-
*
331-
* Note: Disabled cipher suite can be enabled via Java Security property "jdk.tls.disabledAlgorithms" or in
332-
* &lt;JAVA_HOME&gt;/conf/security/java.security file.
333397
*/
334398
@Test
335399
public void testDisabledCustomCipher() throws Exception {
400+
String nonDfltCipher = supportedButNonDfltCipherOrNull();
401+
402+
Assume.assumeNotNull(nonDfltCipher);
403+
336404
setSslCtxFactoryToCli = true;
337-
supportedCiphers = new String[] {"TLS_RSA_WITH_NULL_SHA256" /* Disabled by default */};
405+
supportedCiphers = new String[] {nonDfltCipher};
338406
sslCtxFactory = getTestSslContextFactory();
339407

340408
startGrids(1);
409+
341410
try {
342-
// Explicit supported ciphers.
411+
// Explicit supported cipher.
343412
try (Connection conn = DriverManager.getConnection("jdbc:ignite:thin://127.0.0.1/?sslMode=require" +
344-
"&sslCipherSuites=TLS_RSA_WITH_NULL_SHA256" +
413+
"&sslCipherSuites=" + nonDfltCipher +
345414
"&sslTrustAll=true" +
346415
"&sslClientCertificateKeyStoreUrl=" + CLI_KEY_STORE_PATH +
347416
"&sslClientCertificateKeyStorePassword=123456" +
@@ -351,13 +420,13 @@ public void testDisabledCustomCipher() throws Exception {
351420
}
352421

353422
// Default ciphers.
354-
GridTestUtils.assertThrows(log, () -> {
355-
return DriverManager.getConnection("jdbc:ignite:thin://127.0.0.1/?sslMode=require" +
423+
GridTestUtils.assertThrows(log, () -> DriverManager.getConnection(
424+
"jdbc:ignite:thin://127.0.0.1/?sslMode=require" +
356425
"&sslClientCertificateKeyStoreUrl=" + CLI_KEY_STORE_PATH +
357426
"&sslClientCertificateKeyStorePassword=123456" +
358427
"&sslTrustCertificateKeyStoreUrl=" + TRUST_KEY_STORE_PATH +
359-
"&sslTrustCertificateKeyStorePassword=123456");
360-
}, SQLException.class, "Failed to SSL connect to server");
428+
"&sslTrustCertificateKeyStorePassword=123456"
429+
), SQLException.class, "Failed to SSL connect to server");
361430
}
362431
finally {
363432
stopAllGrids();
@@ -366,34 +435,34 @@ public void testDisabledCustomCipher() throws Exception {
366435

367436
/**
368437
* @throws Exception If failed.
369-
*
370-
* Note: Disabled cipher suite can be enabled via Java Security property "jdk.tls.disabledAlgorithms" or in
371-
* &lt;JAVA_HOME&gt;/conf/security/java.security file.
372438
*/
373439
@Test
374440
public void testUnsupportedCustomCipher() throws Exception {
441+
String nonDfltCipher = supportedButNonDfltCipherOrNull();
442+
443+
Assume.assumeNotNull(nonDfltCipher);
444+
375445
setSslCtxFactoryToCli = true;
376-
supportedCiphers = new String[] {
377-
"TLS_RSA_WITH_NULL_SHA256" /* Disabled by default */,
378-
"TLS_ECDH_anon_WITH_3DES_EDE_CBC_SHA" /* With disabled protocol*/};
446+
supportedCiphers = new String[] {nonDfltCipher, UNSUPPORTED_CIPHER};
379447
sslCtxFactory = getTestSslContextFactory();
380448

381449
startGrids(1);
450+
382451
try {
383-
// Enabled ciphers with unsupported algorithm can't be negotiated.
384-
GridTestUtils.assertThrows(log, () -> {
385-
return DriverManager.getConnection("jdbc:ignite:thin://127.0.0.1/?sslMode=require" +
386-
"&sslCipherSuites=TLS_ECDH_anon_WITH_3DES_EDE_CBC_SHA" +
452+
// Unsupported cipher can't be negotiated.
453+
GridTestUtils.assertThrows(log, () -> DriverManager.getConnection(
454+
"jdbc:ignite:thin://127.0.0.1/?sslMode=require" +
455+
"&sslCipherSuites=" + UNSUPPORTED_CIPHER +
387456
"&sslTrustAll=true" +
388457
"&sslClientCertificateKeyStoreUrl=" + CLI_KEY_STORE_PATH +
389458
"&sslClientCertificateKeyStorePassword=123456" +
390459
"&sslTrustCertificateKeyStoreUrl=" + TRUST_KEY_STORE_PATH +
391-
"&sslTrustCertificateKeyStorePassword=123456");
392-
}, SQLException.class, "Failed to SSL connect to server");
460+
"&sslTrustCertificateKeyStorePassword=123456"
461+
), SQLException.class, "Failed to SSL connect to server");
393462

394463
// Supported cipher.
395464
try (Connection conn = DriverManager.getConnection("jdbc:ignite:thin://127.0.0.1/?sslMode=require" +
396-
"&sslCipherSuites=TLS_RSA_WITH_NULL_SHA256" +
465+
"&sslCipherSuites=" + nonDfltCipher +
397466
"&sslTrustAll=true" +
398467
"&sslClientCertificateKeyStoreUrl=" + CLI_KEY_STORE_PATH +
399468
"&sslClientCertificateKeyStorePassword=123456" +
@@ -403,14 +472,13 @@ public void testUnsupportedCustomCipher() throws Exception {
403472
}
404473

405474
// Default ciphers.
406-
GridTestUtils.assertThrows(log, () -> {
407-
return DriverManager.getConnection("jdbc:ignite:thin://127.0.0.1/?sslMode=require" +
475+
GridTestUtils.assertThrows(log, () -> DriverManager.getConnection(
476+
"jdbc:ignite:thin://127.0.0.1/?sslMode=require" +
408477
"&sslClientCertificateKeyStoreUrl=" + CLI_KEY_STORE_PATH +
409478
"&sslClientCertificateKeyStorePassword=123456" +
410479
"&sslTrustCertificateKeyStoreUrl=" + TRUST_KEY_STORE_PATH +
411-
"&sslTrustCertificateKeyStorePassword=123456");
412-
}, SQLException.class, "Failed to SSL connect to server");
413-
480+
"&sslTrustCertificateKeyStorePassword=123456"
481+
), SQLException.class, "Failed to SSL connect to server");
414482
}
415483
finally {
416484
stopAllGrids();

0 commit comments

Comments
 (0)