anton-vinogradov commented on code in PR #13801:
URL: https://github.com/apache/ignite/pull/13801#discussion_r4524058966
##########
modules/clients/src/test/java/org/apache/ignite/jdbc/thin/JdbcThinConnectionSSLTest.java:
##########
@@ -762,19 +763,30 @@ private SSLSocketFactory factory(String protocol) throws
Exception {
return ctx.getSocketFactory();
}
- /** */
+ /**
+ * @return Cipher suites supported by the JDK, but not enabled by default
for the SSL protocol that the JDBC
+ * client uses when no explicit cipher suites are set.
+ * @throws Exception If failed.
+ */
private Set<String> disabledByDefaultCipherSuites() throws Exception {
- SSLSocketFactory factory = factory("TLSv1.2");
+ // The client uses the default protocol when no sslProtocol connection
property is set (JdbcThinSSLUtil
+ // falls back to SslContextFactory.DFLT_SSL_PROTOCOL), so the defaults
of the same protocol must be
+ // subtracted: a suite absent from the defaults of a TLSv1.2 context
only (a TLS 1.3 suite) can still
+ // be enabled by default for the client, which made the selected suite
negotiable with the client's
+ // default ciphers.
+ SSLSocketFactory factory =
factory(SslContextFactory.DFLT_SSL_PROTOCOL);
Set<String> supportedCiphersSuites = new
HashSet<>(Arrays.stream(factory.getSupportedCipherSuites()).toList());
- // Fulter supported, but NOT in the default active list.
+ // Filter supported, but NOT in the default active list.
supportedCiphersSuites.removeAll(Set.of(factory.getDefaultCipherSuites()));
// Current TC settings.
supportedCiphersSuites.removeIf(s -> s.contains("_anon_"));
Review Comment:
The helper can still pick a suite that the test cannot use: a TLS 1.3 suite
with `-Djdk.tls.client.protocols=TLSv1.2`, or `TLS_ECDHE_ECDSA_WITH_NULL_SHA`
with the RSA server key. Please replace this line with `removeIf(s ->
!s.contains("_RSA_WITH_"))`: it drops TLS 1.3, ECDSA and anonymous suites at
once, and with it the class has no failures in all four setups from the ticket.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
