anton-vinogradov commented on code in PR #13801:
URL: https://github.com/apache/ignite/pull/13801#discussion_r4524058966
##########
modules/clients/src/test/java/org/apache/ignite/jdbc/thin/JdbcThinConnectionSSLTest.java:
##########
@@ -762,19 +763,30 @@ private SSLSocketFactory factory(String protocol) throws
Exception {
return ctx.getSocketFactory();
}
- /** */
+ /**
+ * @return Cipher suites supported by the JDK, but not enabled by default
for the SSL protocol that the JDBC
+ * client uses when no explicit cipher suites are set.
+ * @throws Exception If failed.
+ */
private Set<String> disabledByDefaultCipherSuites() throws Exception {
- SSLSocketFactory factory = factory("TLSv1.2");
+ // The client uses the default protocol when no sslProtocol connection
property is set (JdbcThinSSLUtil
+ // falls back to SslContextFactory.DFLT_SSL_PROTOCOL), so the defaults
of the same protocol must be
+ // subtracted: a suite absent from the defaults of a TLSv1.2 context
only (a TLS 1.3 suite) can still
+ // be enabled by default for the client, which made the selected suite
negotiable with the client's
+ // default ciphers.
+ SSLSocketFactory factory =
factory(SslContextFactory.DFLT_SSL_PROTOCOL);
Set<String> supportedCiphersSuites = new
HashSet<>(Arrays.stream(factory.getSupportedCipherSuites()).toList());
- // Fulter supported, but NOT in the default active list.
+ // Filter supported, but NOT in the default active list.
supportedCiphersSuites.removeAll(Set.of(factory.getDefaultCipherSuites()));
// Current TC settings.
supportedCiphersSuites.removeIf(s -> s.contains("_anon_"));
Review Comment:
With `-Djdk.tls.client.protocols=TLSv1.2` the helper still returns the three
TLS 1.3 suites, and both tests fail with "Failed to SSL connect to server"
because the client cannot use TLS 1.3 at all. Please also drop TLS 1.3 suites,
for example with `removeIf(s -> !s.contains("_WITH_"))`: when the client can
use TLS 1.3 they are enabled by default, and when it cannot, they never connect.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
