anton-vinogradov commented on code in PR #13801:
URL: https://github.com/apache/ignite/pull/13801#discussion_r4523680718
##########
modules/clients/src/test/java/org/apache/ignite/jdbc/thin/JdbcThinConnectionSSLTest.java:
##########
@@ -762,19 +763,30 @@ private SSLSocketFactory factory(String protocol) throws
Exception {
return ctx.getSocketFactory();
}
- /** */
+ /**
+ * @return Cipher suites supported by the JDK, but not enabled by default
for the SSL protocol that the JDBC
Review Comment:
The client picks its protocol from `sslProtocol`, not from cipher suites:
`JdbcThinSSLUtil` uses `DFLT_SSL_PROTOCOL` whenever `sslProtocol` is not set.
Please change this to "not enabled by default for the default protocol of the
JDBC client".
##########
modules/clients/src/test/java/org/apache/ignite/jdbc/thin/JdbcThinConnectionSSLTest.java:
##########
@@ -762,19 +763,30 @@ private SSLSocketFactory factory(String protocol) throws
Exception {
return ctx.getSocketFactory();
}
- /** */
+ /**
+ * @return Cipher suites supported by the JDK, but not enabled by default
for the SSL protocol that the JDBC
+ * client uses when no explicit cipher suites are set.
+ * @throws Exception If failed.
+ */
private Set<String> disabledByDefaultCipherSuites() throws Exception {
- SSLSocketFactory factory = factory("TLSv1.2");
+ // The client uses the default protocol when no sslProtocol connection
property is set (JdbcThinSSLUtil
+ // falls back to SslContextFactory.DFLT_SSL_PROTOCOL), so the defaults
of the same protocol must be
+ // subtracted: a suite absent from the defaults of a TLSv1.2 context
only (a TLS 1.3 suite) can still
+ // be enabled by default for the client, which made the selected suite
negotiable with the client's
+ // default ciphers.
+ SSLSocketFactory factory =
factory(SslContextFactory.DFLT_SSL_PROTOCOL);
Set<String> supportedCiphersSuites = new
HashSet<>(Arrays.stream(factory.getSupportedCipherSuites()).toList());
- // Fulter supported, but NOT in the default active list.
+ // Filter supported, but NOT in the default active list.
supportedCiphersSuites.removeAll(Set.of(factory.getDefaultCipherSuites()));
// Current TC settings.
supportedCiphersSuites.removeIf(s -> s.contains("_anon_"));
- assertFalse("No one disabled by default suite found",
supportedCiphersSuites.isEmpty());
+ // Some providers enable every supported suite by default (for
example, OpenJDK 17 with the stock
Review Comment:
The assumption message already says why the tests are skipped. Please remove
this comment.
##########
modules/clients/src/test/java/org/apache/ignite/jdbc/thin/JdbcThinConnectionSSLTest.java:
##########
@@ -762,19 +763,30 @@ private SSLSocketFactory factory(String protocol) throws
Exception {
return ctx.getSocketFactory();
}
- /** */
+ /**
+ * @return Cipher suites supported by the JDK, but not enabled by default
for the SSL protocol that the JDBC
+ * client uses when no explicit cipher suites are set.
+ * @throws Exception If failed.
+ */
private Set<String> disabledByDefaultCipherSuites() throws Exception {
- SSLSocketFactory factory = factory("TLSv1.2");
+ // The client uses the default protocol when no sslProtocol connection
property is set (JdbcThinSSLUtil
Review Comment:
This comment repeats the javadoc and retells the old bug, which a reader of
the fixed code does not need. Please remove it.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
