Skip to content

Commit f6a5781

Browse files
animovscwanimovscw
committed
IGNITE-28444: Fix SSL cipher tests for current JDK defaults
1 parent ca7d8ad commit f6a5781

File tree

1 file changed

+88
-65
lines changed

1 file changed

+88
-65
lines changed

‎modules/clients/src/test/java/org/apache/ignite/jdbc/thin/JdbcThinConnectionSSLTest.java‎

Lines changed: 88 additions & 65 deletions
Original file line numberDiff line numberDiff line change
@@ -23,6 +23,9 @@
2323
import java.sql.ResultSet;
2424
import java.sql.SQLException;
2525
import java.sql.Statement;
26+
import java.util.Arrays;
27+
import java.util.LinkedHashSet;
28+
import java.util.Set;
2629
import java.util.concurrent.Callable;
2730
import javax.cache.configuration.Factory;
2831
import javax.net.ssl.SSLContext;
@@ -33,6 +36,7 @@
3336
import org.apache.ignite.internal.util.typedef.internal.U;
3437
import org.apache.ignite.ssl.SslContextFactory;
3538
import org.apache.ignite.testframework.GridTestUtils;
39+
import org.junit.Assume;
3640
import org.junit.Test;
3741

3842
/**
@@ -52,12 +56,6 @@ public class JdbcThinConnectionSSLTest extends JdbcThinAbstractSelfTest {
5256
private static final String TRUST_KEY_STORE_PATH = U.getIgniteHome() +
5357
"/modules/clients/src/test/keystore/trust-one.jks";
5458

55-
/** Enabled cipher. */
56-
private static final String ENABLED_CIPHER = "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256";
57-
58-
/** Unsupported cipher. */
59-
private static final String UNSUPPORTED_CIPHER = "TLS_ECDH_anon_WITH_3DES_EDE_CBC_SHA";
60-
6159
/** SSL context factory. */
6260
private static Factory<SSLContext> sslCtxFactory;
6361

@@ -70,16 +68,12 @@ public class JdbcThinConnectionSSLTest extends JdbcThinAbstractSelfTest {
7068
/** Supported ciphers. */
7169
private static String[] supportedCiphers;
7270

73-
/** Supported cipher that is not enabled by default on the current JDK. */
74-
private static String disabledByDefaultCipher;
75-
7671
/** {@inheritDoc} */
7772
@Override protected void beforeTest() throws Exception {
7873
setSslCtxFactoryToCli = false;
7974
setSslCtxFactoryToIgnite = false;
8075
supportedCiphers = null;
8176
sslCtxFactory = null;
82-
disabledByDefaultCipher = null;
8377
}
8478

8579
/** {@inheritDoc} */
@@ -107,39 +101,51 @@ public class JdbcThinConnectionSSLTest extends JdbcThinAbstractSelfTest {
107101
}
108102

109103
/**
110-
* @return Supported RSA cipher suite that is not enabled by default on the current JDK.
104+
* @return One of default cipher suites for the current JDK.
111105
* @throws NoSuchAlgorithmException If failed.
112106
*/
113-
private static String disabledByDefaultCipher() throws NoSuchAlgorithmException {
114-
if (disabledByDefaultCipher != null)
115-
return disabledByDefaultCipher;
107+
private static String defaultCipher() throws NoSuchAlgorithmException {
108+
String[] dflt = SSLContext.getDefault().getSocketFactory().getDefaultCipherSuites();
116109

117-
SSLContext ctx = SSLContext.getDefault();
110+
assertTrue("No default cipher suites available", dflt.length > 0);
118111

119-
SSLSocketFactory factory = ctx.getSocketFactory();
112+
return dflt[0];
113+
}
120114

121-
java.util.Set<String> supported = new java.util.HashSet<>();
122-
java.util.Collections.addAll(supported, factory.getSupportedCipherSuites());
115+
/**
116+
* @param exclude Cipher to exclude.
117+
* @return Another default cipher suite for the current JDK.
118+
* @throws NoSuchAlgorithmException If failed.
119+
*/
120+
private static String anotherDefaultCipher(String exclude) throws NoSuchAlgorithmException {
121+
String[] dflt = SSLContext.getDefault().getSocketFactory().getDefaultCipherSuites();
123122

124-
java.util.Set<String> enabled = new java.util.HashSet<>();
125-
java.util.Collections.addAll(enabled, factory.getDefaultCipherSuites());
123+
for (String cipher : dflt) {
124+
if (!cipher.equals(exclude))
125+
return cipher;
126+
}
126127

127-
for (String cipher : supported) {
128-
if (enabled.contains(cipher))
129-
continue;
128+
fail("No alternative default cipher suite found");
130129

131-
if (!cipher.contains("_RSA_"))
132-
continue;
130+
return null;
131+
}
133132

134-
if (cipher.contains("_anon_") || cipher.contains("_NULL_") || cipher.contains("_ECDSA_"))
135-
continue;
133+
/**
134+
* @return Supported cipher suite that is not enabled by default, or {@code null} if none found.
135+
* @throws NoSuchAlgorithmException If failed.
136+
*/
137+
private static String supportedButNonDefaultCipherOrNull() throws NoSuchAlgorithmException {
138+
SSLSocketFactory factory = SSLContext.getDefault().getSocketFactory();
136139

137-
disabledByDefaultCipher = cipher;
140+
Set<String> supported = new LinkedHashSet<>(Arrays.asList(factory.getSupportedCipherSuites()));
141+
Set<String> dflt = new LinkedHashSet<>(Arrays.asList(factory.getDefaultCipherSuites()));
138142

139-
return cipher;
143+
for (String cipher : supported) {
144+
if (!dflt.contains(cipher))
145+
return cipher;
140146
}
141147

142-
throw new IllegalStateException("No supported non-default RSA cipher suite found for the current JDK");
148+
return null;
143149
}
144150

145151
/**
@@ -278,6 +284,9 @@ public void testCustomCiphersOnClient() throws Exception {
278284
setSslCtxFactoryToCli = true;
279285
sslCtxFactory = getTestSslContextFactory();
280286

287+
String cipher1 = defaultCipher();
288+
String cipher2 = anotherDefaultCipher(cipher1);
289+
281290
startGrids(1);
282291

283292
try {
@@ -290,9 +299,9 @@ public void testCustomCiphersOnClient() throws Exception {
290299
checkConnection(conn);
291300
}
292301

293-
// Explicit cipher (one of defaults).
302+
// Explicit cipher.
294303
try (Connection conn = DriverManager.getConnection("jdbc:ignite:thin://127.0.0.1/?sslMode=require" +
295-
"&sslCipherSuites=" + ENABLED_CIPHER +
304+
"&sslCipherSuites=" + cipher1 +
296305
"&sslClientCertificateKeyStoreUrl=" + CLI_KEY_STORE_PATH +
297306
"&sslClientCertificateKeyStorePassword=123456" +
298307
"&sslTrustCertificateKeyStoreUrl=" + TRUST_KEY_STORE_PATH +
@@ -302,7 +311,7 @@ public void testCustomCiphersOnClient() throws Exception {
302311

303312
// Explicit ciphers.
304313
try (Connection conn = DriverManager.getConnection("jdbc:ignite:thin://127.0.0.1/?sslMode=require" +
305-
"&sslCipherSuites=" + disabledByDefaultCipher() + "," + ENABLED_CIPHER +
314+
"&sslCipherSuites=" + cipher2 + "," + cipher1 +
306315
"&sslClientCertificateKeyStoreUrl=" + CLI_KEY_STORE_PATH +
307316
"&sslClientCertificateKeyStorePassword=123456" +
308317
"&sslTrustCertificateKeyStoreUrl=" + TRUST_KEY_STORE_PATH +
@@ -321,7 +330,11 @@ public void testCustomCiphersOnClient() throws Exception {
321330
@Test
322331
public void testCustomCiphersOnServer() throws Exception {
323332
setSslCtxFactoryToCli = true;
324-
supportedCiphers = new String[] {ENABLED_CIPHER};
333+
334+
String cipher1 = defaultCipher();
335+
String cipher2 = anotherDefaultCipher(cipher1);
336+
337+
supportedCiphers = new String[] {cipher1};
325338
sslCtxFactory = getTestSslContextFactory();
326339

327340
startGrids(1);
@@ -338,27 +351,28 @@ public void testCustomCiphersOnServer() throws Exception {
338351

339352
// Explicit cipher.
340353
try (Connection conn = DriverManager.getConnection("jdbc:ignite:thin://127.0.0.1/?sslMode=require" +
341-
"&sslCipherSuites=" + ENABLED_CIPHER +
354+
"&sslCipherSuites=" + cipher1 +
342355
"&sslClientCertificateKeyStoreUrl=" + CLI_KEY_STORE_PATH +
343356
"&sslClientCertificateKeyStorePassword=123456" +
344357
"&sslTrustCertificateKeyStoreUrl=" + TRUST_KEY_STORE_PATH +
345358
"&sslTrustCertificateKeyStorePassword=123456")) {
346359
checkConnection(conn);
347360
}
348361

349-
// Disabled by default cipher.
350-
GridTestUtils.assertThrows(log, () -> {
351-
return DriverManager.getConnection("jdbc:ignite:thin://127.0.0.1/?sslMode=require" +
352-
"&sslCipherSuites=" + disabledByDefaultCipher() +
362+
// Explicit cipher not supported by server.
363+
GridTestUtils.assertThrows(log, () ->
364+
DriverManager.getConnection(
365+
"jdbc:ignite:thin://127.0.0.1/?sslMode=require" +
366+
"&sslCipherSuites=" + cipher2 +
353367
"&sslClientCertificateKeyStoreUrl=" + CLI_KEY_STORE_PATH +
354368
"&sslClientCertificateKeyStorePassword=123456" +
355369
"&sslTrustCertificateKeyStoreUrl=" + TRUST_KEY_STORE_PATH +
356-
"&sslTrustCertificateKeyStorePassword=123456");
357-
}, SQLException.class, "Failed to SSL connect to server");
370+
"&sslTrustCertificateKeyStorePassword=123456"
371+
), SQLException.class, "Failed to SSL connect to server");
358372

359373
// Explicit ciphers.
360374
try (Connection conn = DriverManager.getConnection("jdbc:ignite:thin://127.0.0.1/?sslMode=require" +
361-
"&sslCipherSuites=" + disabledByDefaultCipher() + "," + ENABLED_CIPHER +
375+
"&sslCipherSuites=" + cipher2 + "," + cipher1 +
362376
"&sslClientCertificateKeyStoreUrl=" + CLI_KEY_STORE_PATH +
363377
"&sslClientCertificateKeyStorePassword=123456" +
364378
"&sslTrustCertificateKeyStoreUrl=" + TRUST_KEY_STORE_PATH +
@@ -373,19 +387,26 @@ public void testCustomCiphersOnServer() throws Exception {
373387

374388
/**
375389
* @throws Exception If failed.
390+
*
391+
* Note: Disabled cipher suite can be enabled via Java Security property "jdk.tls.disabledAlgorithms" or in
392+
* &lt;JAVA_HOME&gt;/conf/security/java.security file.
376393
*/
377394
@Test
378395
public void testDisabledCustomCipher() throws Exception {
396+
String nonDfltCipher = supportedButNonDefaultCipherOrNull();
397+
398+
Assume.assumeNotNull(nonDfltCipher);
399+
379400
setSslCtxFactoryToCli = true;
380-
supportedCiphers = new String[] {disabledByDefaultCipher()};
401+
supportedCiphers = new String[] {nonDfltCipher};
381402
sslCtxFactory = getTestSslContextFactory();
382403

383404
startGrids(1);
384405

385406
try {
386-
// Explicit supported ciphers.
407+
// Explicit supported cipher.
387408
try (Connection conn = DriverManager.getConnection("jdbc:ignite:thin://127.0.0.1/?sslMode=require" +
388-
"&sslCipherSuites=" + disabledByDefaultCipher() +
409+
"&sslCipherSuites=" + nonDfltCipher +
389410
"&sslTrustAll=true" +
390411
"&sslClientCertificateKeyStoreUrl=" + CLI_KEY_STORE_PATH +
391412
"&sslClientCertificateKeyStorePassword=123456" +
@@ -395,13 +416,13 @@ public void testDisabledCustomCipher() throws Exception {
395416
}
396417

397418
// Default ciphers.
398-
GridTestUtils.assertThrows(log, () -> {
399-
return DriverManager.getConnection("jdbc:ignite:thin://127.0.0.1/?sslMode=require" +
419+
GridTestUtils.assertThrows(log, () -> DriverManager.getConnection(
420+
"jdbc:ignite:thin://127.0.0.1/?sslMode=require" +
400421
"&sslClientCertificateKeyStoreUrl=" + CLI_KEY_STORE_PATH +
401422
"&sslClientCertificateKeyStorePassword=123456" +
402423
"&sslTrustCertificateKeyStoreUrl=" + TRUST_KEY_STORE_PATH +
403-
"&sslTrustCertificateKeyStorePassword=123456");
404-
}, SQLException.class, "Failed to SSL connect to server");
424+
"&sslTrustCertificateKeyStorePassword=123456"
425+
), SQLException.class, "Failed to SSL connect to server");
405426
}
406427
finally {
407428
stopAllGrids();
@@ -410,33 +431,35 @@ public void testDisabledCustomCipher() throws Exception {
410431

411432
/**
412433
* @throws Exception If failed.
434+
*
435+
* Note: Disabled cipher suite can be enabled via Java Security property "jdk.tls.disabledAlgorithms" or in
436+
* &lt;JAVA_HOME&gt;/conf/security/java.security file.
413437
*/
414438
@Test
415439
public void testUnsupportedCustomCipher() throws Exception {
440+
String nonDfltCipher = supportedButNonDefaultCipherOrNull();
441+
442+
Assume.assumeNotNull(nonDfltCipher);
443+
416444
setSslCtxFactoryToCli = true;
417-
supportedCiphers = new String[] {
418-
disabledByDefaultCipher(),
419-
UNSUPPORTED_CIPHER
420-
};
445+
supportedCiphers = new String[] {nonDfltCipher, "TLS_ECDH_anon_WITH_3DES_EDE_CBC_SHA"};
421446
sslCtxFactory = getTestSslContextFactory();
422447

423448
startGrids(1);
424449

425450
try {
426-
// Enabled ciphers with unsupported algorithm can't be negotiated.
427-
GridTestUtils.assertThrows(log, () -> {
428-
return DriverManager.getConnection("jdbc:ignite:thin://127.0.0.1/?sslMode=require" +
429-
"&sslCipherSuites=" + UNSUPPORTED_CIPHER +
430-
"&sslTrustAll=true" +
451+
// Unsupported cipher can't be negotiated.
452+
GridTestUtils.assertThrows(log, () -> DriverManager.getConnection(
453+
"jdbc:ignite:thin://127.0.0.1/?sslMode=require" +
431454
"&sslClientCertificateKeyStoreUrl=" + CLI_KEY_STORE_PATH +
432455
"&sslClientCertificateKeyStorePassword=123456" +
433456
"&sslTrustCertificateKeyStoreUrl=" + TRUST_KEY_STORE_PATH +
434-
"&sslTrustCertificateKeyStorePassword=123456");
435-
}, SQLException.class, "Failed to SSL connect to server");
457+
"&sslTrustCertificateKeyStorePassword=123456"
458+
), SQLException.class, "Failed to SSL connect to server");
436459

437460
// Supported cipher.
438461
try (Connection conn = DriverManager.getConnection("jdbc:ignite:thin://127.0.0.1/?sslMode=require" +
439-
"&sslCipherSuites=" + disabledByDefaultCipher() +
462+
"&sslCipherSuites=" + nonDfltCipher +
440463
"&sslTrustAll=true" +
441464
"&sslClientCertificateKeyStoreUrl=" + CLI_KEY_STORE_PATH +
442465
"&sslClientCertificateKeyStorePassword=123456" +
@@ -446,13 +469,13 @@ public void testUnsupportedCustomCipher() throws Exception {
446469
}
447470

448471
// Default ciphers.
449-
GridTestUtils.assertThrows(log, () -> {
450-
return DriverManager.getConnection("jdbc:ignite:thin://127.0.0.1/?sslMode=require" +
472+
GridTestUtils.assertThrows(log, () -> DriverManager.getConnection(
473+
"jdbc:ignite:thin://127.0.0.1/?sslMode=require" +
451474
"&sslClientCertificateKeyStoreUrl=" + CLI_KEY_STORE_PATH +
452475
"&sslClientCertificateKeyStorePassword=123456" +
453476
"&sslTrustCertificateKeyStoreUrl=" + TRUST_KEY_STORE_PATH +
454-
"&sslTrustCertificateKeyStorePassword=123456");
455-
}, SQLException.class, "Failed to SSL connect to server");
477+
"&sslTrustCertificateKeyStorePassword=123456"
478+
), SQLException.class, "Failed to SSL connect to server");
456479
}
457480
finally {
458481
stopAllGrids();

0 commit comments

Comments
 (0)