[
https://issues.apache.org/jira/browse/RATIS-2596?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=18095544#comment-18095544
]
Haonan Hou commented on RATIS-2596:
-----------------------------------
Thanks for the fix. I found a compatibility issue with protocol-specific
cipher suites provided by a custom JSSE provider.
Tencent Kona SM Suite (Kona SDK) is a Java security provider library that can
be registered with a standard OpenJDK. It provides SM2, SM3, SM4, and
TLCPv1.1 support through its JSSE provider named "Kona".
For example, Kona SDK provides the following protocol-specific cipher suite:
TLCP_ECDHE_SM4_GCM_SM3
I tested this with OpenJDK 17 and Kona SDK 1.0.20. The cipher suite is enabled
by the TLCPv1.1 SSLContext:
SSLContext.getInstance("TLCPv1.1", "Kona")
.createSSLEngine()
.getEnabledCipherSuites()
However, the same provider's generic TLS context does not include this suite
in getSupportedCipherSuites():
SSLContext.getInstance("TLS", "Kona")
.createSSLEngine()
.getSupportedCipherSuites()
Although it is not reported there, the generic TLS SSLEngine accepts and uses
TLCP_ECDHE_SM4_GCM_SM3 when TLCPv1.1 is explicitly enabled.
With IdentityCipherSuiteFilter, the configured suite is preserved and the
connection works. With SupportedCipherSuiteFilter, it is removed:
Configured cipher suites:
[TLCP_ECDHE_SM4_GCM_SM3]
Filtered cipher suites:
[]
The resulting SSLEngine has no enabled cipher suites, and the handshake fails
with:
javax.net.ssl.SSLHandshakeException:
No appropriate protocol
(protocol is disabled or cipher suites are inappropriate)
Would it be possible to keep IdentityCipherSuiteFilter for an explicitly
configured JSSE provider, while using SupportedCipherSuiteFilter for the
default/OpenSSL paths?
Alternatively, configured suites could be validated by attempting to set them
on an SSLEngine created from the selected provider, instead of relying only on
getSupportedCipherSuites().
> Unsupported TLS cipher suites may crash gRPC servers
> ----------------------------------------------------
>
> Key: RATIS-2596
> URL: https://issues.apache.org/jira/browse/RATIS-2596
> Project: Ratis
> Issue Type: Improvement
> Components: gRPC
> Affects Versions: 3.3.0
> Reporter: István Fajth
> Assignee: István Fajth
> Priority: Major
> Fix For: 3.3.0
>
> Time Spent: 20m
> Remaining Estimate: 0h
>
> In HDDS-15176 we realized that letting the SSL ciphers to be configured for
> gRPC with Netty can lead to misconfiguration where a cipher that is not
> supported by Netty is configured, and that crashed the gRPC endpoint in Ozone.
> In order to avoid similar situations in Ratis, I propose to change from the
> IdentityCipherSuiteFilter to the SupportedCipherSuiteFilter in the gRPC TLS
> setup in GrpcUtil#configureSslContextBuilder.
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
