Csaba Ringhofer created IMPALA-15393:
----------------------------------------
Summary: Thrift 0.24 bump broken some ssl tests
Key: IMPALA-15393
URL: https://issues.apache.org/jira/browse/IMPALA-15393
Project: IMPALA
Issue Type: Bug
Components: Backend
Reporter: Csaba Ringhofer
These pass on Ubuntu 22.04 but fail on RHEL 8.6:
SslTest.MatchedTlsCiphersuites
SslTest.OverlappingMatchedTlsCiphersuites
Msg:
{code}
Expected: { ssl_client.iface()->RegisterSubscriber( resp,
TRegisterSubscriberRequest(), &send_done); } doesn't throw an exception.
Actual: it throws apache::thrift::transport::TSSLException with description
"SSL_connect: sslv3 alert handshake failure (SSL_error_code = 1)".
{code}
The cause is a test bug, not a product issue. The Thrift bump brings new ssl
context initialization logic, the leads to allowed ssl versions with gaps in
these tests:
tls1, tls1.1, tls1.3 <- tls .1.2 is explicitly disabled for the test
The whole in the allowed versions leads to not finding any cyphers in some
environments.
The fix is to not allow tls1/1.1 in the tests, which was never the intention of
them.
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
