Skip to content

Commit 92b7fb3

Browse files
animovscwanimovscw
committed
IGNITE-28444: Fix SSL cipher tests for current JDK defaults
1 parent 78773ff commit 92b7fb3

File tree

1 file changed

+116
-41
lines changed

1 file changed

+116
-41
lines changed

‎modules/clients/src/test/java/org/apache/ignite/jdbc/thin/JdbcThinConnectionSSLTest.java‎

Lines changed: 116 additions & 41 deletions
Original file line numberDiff line numberDiff line change
@@ -23,6 +23,9 @@
2323
import java.sql.ResultSet;
2424
import java.sql.SQLException;
2525
import java.sql.Statement;
26+
import java.util.Arrays;
27+
import java.util.LinkedHashSet;
28+
import java.util.Set;
2629
import java.util.concurrent.Callable;
2730
import javax.cache.configuration.Factory;
2831
import javax.net.ssl.SSLContext;
@@ -33,6 +36,7 @@
3336
import org.apache.ignite.internal.util.typedef.internal.U;
3437
import org.apache.ignite.ssl.SslContextFactory;
3538
import org.apache.ignite.testframework.GridTestUtils;
39+
import org.junit.Assume;
3640
import org.junit.Test;
3741

3842
/**
@@ -52,6 +56,9 @@ public class JdbcThinConnectionSSLTest extends JdbcThinAbstractSelfTest {
5256
private static final String TRUST_KEY_STORE_PATH = U.getIgniteHome() +
5357
"/modules/clients/src/test/keystore/trust-one.jks";
5458

59+
/** Unsupported cipher. */
60+
private static final String UNSUPPORTED_CIPHER = "TLS_ECDH_anon_WITH_3DES_EDE_CBC_SHA";
61+
5562
/** SSL context factory. */
5663
private static Factory<SSLContext> sslCtxFactory;
5764

@@ -96,6 +103,66 @@ public class JdbcThinConnectionSSLTest extends JdbcThinAbstractSelfTest {
96103
return cfg;
97104
}
98105

106+
/**
107+
* @return One of default cipher suites for the current JDK.
108+
* @throws NoSuchAlgorithmException If failed.
109+
*/
110+
private static String dfltCipher() throws NoSuchAlgorithmException {
111+
String[] dflt = SSLContext.getDefault().getSocketFactory().getDefaultCipherSuites();
112+
113+
assertTrue("No default cipher suites available", dflt.length > 0);
114+
115+
return dflt[0];
116+
}
117+
118+
/**
119+
* @param exclude Cipher to exclude.
120+
* @return Another default cipher suite for the current JDK.
121+
* @throws NoSuchAlgorithmException If failed.
122+
*/
123+
private static String anotherDfltCipher(String exclude) throws NoSuchAlgorithmException {
124+
String[] dflt = SSLContext.getDefault().getSocketFactory().getDefaultCipherSuites();
125+
126+
for (String cipher : dflt) {
127+
if (!cipher.equals(exclude))
128+
return cipher;
129+
}
130+
131+
fail("No alternative default cipher suite found");
132+
133+
return null;
134+
}
135+
136+
/**
137+
* @return Supported cipher suite that is not enabled by default, or null if none found.
138+
* @throws NoSuchAlgorithmException If failed.
139+
*/
140+
private static String supportedButNonDfltCipherOrNull() throws NoSuchAlgorithmException {
141+
SSLSocketFactory factory = SSLContext.getDefault().getSocketFactory();
142+
143+
Set<String> supported = new LinkedHashSet<>(Arrays.asList(factory.getSupportedCipherSuites()));
144+
Set<String> dflt = new LinkedHashSet<>(Arrays.asList(factory.getDefaultCipherSuites()));
145+
146+
for (String cipher : supported) {
147+
if (dflt.contains(cipher))
148+
continue;
149+
150+
if (!cipher.contains("_RSA_"))
151+
continue;
152+
153+
if (cipher.contains("_anon_") || cipher.contains("_NULL_") || cipher.contains("_ECDSA_")
154+
|| cipher.contains("_DSS_"))
155+
continue;
156+
157+
if ("TLS_EMPTY_RENEGOTIATION_INFO_SCSV".equals(cipher))
158+
continue;
159+
160+
return cipher;
161+
}
162+
163+
return null;
164+
}
165+
99166
/**
100167
* @throws Exception If failed.
101168
*/
@@ -232,10 +299,13 @@ public void testCustomCiphersOnClient() throws Exception {
232299
setSslCtxFactoryToCli = true;
233300
sslCtxFactory = getTestSslContextFactory();
234301

302+
String cipher1 = dfltCipher();
303+
String cipher2 = anotherDfltCipher(cipher1);
304+
235305
startGrids(1);
236306

237307
try {
238-
// Default ciphers
308+
// Default ciphers.
239309
try (Connection conn = DriverManager.getConnection("jdbc:ignite:thin://127.0.0.1/?sslMode=require" +
240310
"&sslClientCertificateKeyStoreUrl=" + CLI_KEY_STORE_PATH +
241311
"&sslClientCertificateKeyStorePassword=123456" +
@@ -244,9 +314,9 @@ public void testCustomCiphersOnClient() throws Exception {
244314
checkConnection(conn);
245315
}
246316

247-
// Explicit cipher (one of defaults).
317+
// Explicit cipher.
248318
try (Connection conn = DriverManager.getConnection("jdbc:ignite:thin://127.0.0.1/?sslMode=require" +
249-
"&sslCipherSuites=TLS_RSA_WITH_AES_256_CBC_SHA256" +
319+
"&sslCipherSuites=" + cipher1 +
250320
"&sslClientCertificateKeyStoreUrl=" + CLI_KEY_STORE_PATH +
251321
"&sslClientCertificateKeyStorePassword=123456" +
252322
"&sslTrustCertificateKeyStoreUrl=" + TRUST_KEY_STORE_PATH +
@@ -256,7 +326,7 @@ public void testCustomCiphersOnClient() throws Exception {
256326

257327
// Explicit ciphers.
258328
try (Connection conn = DriverManager.getConnection("jdbc:ignite:thin://127.0.0.1/?sslMode=require" +
259-
"&sslCipherSuites=TLS_RSA_WITH_NULL_SHA256,TLS_RSA_WITH_AES_256_CBC_SHA256" +
329+
"&sslCipherSuites=" + cipher2 + "," + cipher1 +
260330
"&sslClientCertificateKeyStoreUrl=" + CLI_KEY_STORE_PATH +
261331
"&sslClientCertificateKeyStorePassword=123456" +
262332
"&sslTrustCertificateKeyStoreUrl=" + TRUST_KEY_STORE_PATH +
@@ -275,7 +345,11 @@ public void testCustomCiphersOnClient() throws Exception {
275345
@Test
276346
public void testCustomCiphersOnServer() throws Exception {
277347
setSslCtxFactoryToCli = true;
278-
supportedCiphers = new String[] {"TLS_RSA_WITH_AES_256_CBC_SHA256" /* Enabled by default */};
348+
349+
String cipher1 = dfltCipher();
350+
String cipher2 = anotherDfltCipher(cipher1);
351+
352+
supportedCiphers = new String[] {cipher1};
279353
sslCtxFactory = getTestSslContextFactory();
280354

281355
startGrids(1);
@@ -292,27 +366,27 @@ public void testCustomCiphersOnServer() throws Exception {
292366

293367
// Explicit cipher.
294368
try (Connection conn = DriverManager.getConnection("jdbc:ignite:thin://127.0.0.1/?sslMode=require" +
295-
"&sslCipherSuites=TLS_RSA_WITH_AES_256_CBC_SHA256" +
369+
"&sslCipherSuites=" + cipher1 +
296370
"&sslClientCertificateKeyStoreUrl=" + CLI_KEY_STORE_PATH +
297371
"&sslClientCertificateKeyStorePassword=123456" +
298372
"&sslTrustCertificateKeyStoreUrl=" + TRUST_KEY_STORE_PATH +
299373
"&sslTrustCertificateKeyStorePassword=123456")) {
300374
checkConnection(conn);
301375
}
302376

303-
// Disabled by default cipher.
304-
GridTestUtils.assertThrows(log, () -> {
305-
return DriverManager.getConnection("jdbc:ignite:thin://127.0.0.1/?sslMode=require" +
306-
"&sslCipherSuites=TLS_RSA_WITH_NULL_SHA256" +
377+
// Explicit cipher not supported by server.
378+
GridTestUtils.assertThrows(log, () -> DriverManager.getConnection(
379+
"jdbc:ignite:thin://127.0.0.1/?sslMode=require" +
380+
"&sslCipherSuites=" + cipher2 +
307381
"&sslClientCertificateKeyStoreUrl=" + CLI_KEY_STORE_PATH +
308382
"&sslClientCertificateKeyStorePassword=123456" +
309383
"&sslTrustCertificateKeyStoreUrl=" + TRUST_KEY_STORE_PATH +
310-
"&sslTrustCertificateKeyStorePassword=123456");
311-
}, SQLException.class, "Failed to SSL connect to server");
384+
"&sslTrustCertificateKeyStorePassword=123456"
385+
), SQLException.class, "Failed to SSL connect to server");
312386

313387
// Explicit ciphers.
314388
try (Connection conn = DriverManager.getConnection("jdbc:ignite:thin://127.0.0.1/?sslMode=require" +
315-
"&sslCipherSuites=TLS_RSA_WITH_NULL_SHA256,TLS_RSA_WITH_AES_256_CBC_SHA256" +
389+
"&sslCipherSuites=" + cipher2 + "," + cipher1 +
316390
"&sslClientCertificateKeyStoreUrl=" + CLI_KEY_STORE_PATH +
317391
"&sslClientCertificateKeyStorePassword=123456" +
318392
"&sslTrustCertificateKeyStoreUrl=" + TRUST_KEY_STORE_PATH +
@@ -327,21 +401,23 @@ public void testCustomCiphersOnServer() throws Exception {
327401

328402
/**
329403
* @throws Exception If failed.
330-
*
331-
* Note: Disabled cipher suite can be enabled via Java Security property "jdk.tls.disabledAlgorithms" or in
332-
* &lt;JAVA_HOME&gt;/conf/security/java.security file.
333404
*/
334405
@Test
335406
public void testDisabledCustomCipher() throws Exception {
407+
String nonDfltCipher = supportedButNonDfltCipherOrNull();
408+
409+
Assume.assumeNotNull(nonDfltCipher);
410+
336411
setSslCtxFactoryToCli = true;
337-
supportedCiphers = new String[] {"TLS_RSA_WITH_NULL_SHA256" /* Disabled by default */};
412+
supportedCiphers = new String[] {nonDfltCipher};
338413
sslCtxFactory = getTestSslContextFactory();
339414

340415
startGrids(1);
416+
341417
try {
342-
// Explicit supported ciphers.
418+
// Explicit supported cipher.
343419
try (Connection conn = DriverManager.getConnection("jdbc:ignite:thin://127.0.0.1/?sslMode=require" +
344-
"&sslCipherSuites=TLS_RSA_WITH_NULL_SHA256" +
420+
"&sslCipherSuites=" + nonDfltCipher +
345421
"&sslTrustAll=true" +
346422
"&sslClientCertificateKeyStoreUrl=" + CLI_KEY_STORE_PATH +
347423
"&sslClientCertificateKeyStorePassword=123456" +
@@ -351,13 +427,13 @@ public void testDisabledCustomCipher() throws Exception {
351427
}
352428

353429
// Default ciphers.
354-
GridTestUtils.assertThrows(log, () -> {
355-
return DriverManager.getConnection("jdbc:ignite:thin://127.0.0.1/?sslMode=require" +
430+
GridTestUtils.assertThrows(log, () -> DriverManager.getConnection(
431+
"jdbc:ignite:thin://127.0.0.1/?sslMode=require" +
356432
"&sslClientCertificateKeyStoreUrl=" + CLI_KEY_STORE_PATH +
357433
"&sslClientCertificateKeyStorePassword=123456" +
358434
"&sslTrustCertificateKeyStoreUrl=" + TRUST_KEY_STORE_PATH +
359-
"&sslTrustCertificateKeyStorePassword=123456");
360-
}, SQLException.class, "Failed to SSL connect to server");
435+
"&sslTrustCertificateKeyStorePassword=123456"
436+
), SQLException.class, "Failed to SSL connect to server");
361437
}
362438
finally {
363439
stopAllGrids();
@@ -366,34 +442,34 @@ public void testDisabledCustomCipher() throws Exception {
366442

367443
/**
368444
* @throws Exception If failed.
369-
*
370-
* Note: Disabled cipher suite can be enabled via Java Security property "jdk.tls.disabledAlgorithms" or in
371-
* &lt;JAVA_HOME&gt;/conf/security/java.security file.
372445
*/
373446
@Test
374447
public void testUnsupportedCustomCipher() throws Exception {
448+
String nonDfltCipher = supportedButNonDfltCipherOrNull();
449+
450+
Assume.assumeNotNull(nonDfltCipher);
451+
375452
setSslCtxFactoryToCli = true;
376-
supportedCiphers = new String[] {
377-
"TLS_RSA_WITH_NULL_SHA256" /* Disabled by default */,
378-
"TLS_ECDH_anon_WITH_3DES_EDE_CBC_SHA" /* With disabled protocol*/};
453+
supportedCiphers = new String[] {nonDfltCipher, UNSUPPORTED_CIPHER};
379454
sslCtxFactory = getTestSslContextFactory();
380455

381456
startGrids(1);
457+
382458
try {
383-
// Enabled ciphers with unsupported algorithm can't be negotiated.
384-
GridTestUtils.assertThrows(log, () -> {
385-
return DriverManager.getConnection("jdbc:ignite:thin://127.0.0.1/?sslMode=require" +
386-
"&sslCipherSuites=TLS_ECDH_anon_WITH_3DES_EDE_CBC_SHA" +
459+
// Unsupported cipher can't be negotiated.
460+
GridTestUtils.assertThrows(log, () -> DriverManager.getConnection(
461+
"jdbc:ignite:thin://127.0.0.1/?sslMode=require" +
462+
"&sslCipherSuites=" + UNSUPPORTED_CIPHER +
387463
"&sslTrustAll=true" +
388464
"&sslClientCertificateKeyStoreUrl=" + CLI_KEY_STORE_PATH +
389465
"&sslClientCertificateKeyStorePassword=123456" +
390466
"&sslTrustCertificateKeyStoreUrl=" + TRUST_KEY_STORE_PATH +
391-
"&sslTrustCertificateKeyStorePassword=123456");
392-
}, SQLException.class, "Failed to SSL connect to server");
467+
"&sslTrustCertificateKeyStorePassword=123456"
468+
), SQLException.class, "Failed to SSL connect to server");
393469

394470
// Supported cipher.
395471
try (Connection conn = DriverManager.getConnection("jdbc:ignite:thin://127.0.0.1/?sslMode=require" +
396-
"&sslCipherSuites=TLS_RSA_WITH_NULL_SHA256" +
472+
"&sslCipherSuites=" + nonDfltCipher +
397473
"&sslTrustAll=true" +
398474
"&sslClientCertificateKeyStoreUrl=" + CLI_KEY_STORE_PATH +
399475
"&sslClientCertificateKeyStorePassword=123456" +
@@ -403,14 +479,13 @@ public void testUnsupportedCustomCipher() throws Exception {
403479
}
404480

405481
// Default ciphers.
406-
GridTestUtils.assertThrows(log, () -> {
407-
return DriverManager.getConnection("jdbc:ignite:thin://127.0.0.1/?sslMode=require" +
482+
GridTestUtils.assertThrows(log, () -> DriverManager.getConnection(
483+
"jdbc:ignite:thin://127.0.0.1/?sslMode=require" +
408484
"&sslClientCertificateKeyStoreUrl=" + CLI_KEY_STORE_PATH +
409485
"&sslClientCertificateKeyStorePassword=123456" +
410486
"&sslTrustCertificateKeyStoreUrl=" + TRUST_KEY_STORE_PATH +
411-
"&sslTrustCertificateKeyStorePassword=123456");
412-
}, SQLException.class, "Failed to SSL connect to server");
413-
487+
"&sslTrustCertificateKeyStorePassword=123456"
488+
), SQLException.class, "Failed to SSL connect to server");
414489
}
415490
finally {
416491
stopAllGrids();

0 commit comments

Comments
 (0)