XianReallyHot-ZZH commented on code in PR #13801:
URL: https://github.com/apache/ignite/pull/13801#discussion_r4525768769
##########
modules/clients/src/test/java/org/apache/ignite/jdbc/thin/JdbcThinConnectionSSLTest.java:
##########
@@ -762,19 +763,30 @@ private SSLSocketFactory factory(String protocol) throws
Exception {
return ctx.getSocketFactory();
}
- /** */
+ /**
+ * @return Cipher suites supported by the JDK, but not enabled by default
for the SSL protocol that the JDBC
Review Comment:
Done. The javadoc now says "not enabled by default for the default protocol
of the JDBC client".
##########
modules/clients/src/test/java/org/apache/ignite/jdbc/thin/JdbcThinConnectionSSLTest.java:
##########
@@ -762,19 +763,30 @@ private SSLSocketFactory factory(String protocol) throws
Exception {
return ctx.getSocketFactory();
}
- /** */
+ /**
+ * @return Cipher suites supported by the JDK, but not enabled by default
for the SSL protocol that the JDBC
+ * client uses when no explicit cipher suites are set.
+ * @throws Exception If failed.
+ */
private Set<String> disabledByDefaultCipherSuites() throws Exception {
- SSLSocketFactory factory = factory("TLSv1.2");
+ // The client uses the default protocol when no sslProtocol connection
property is set (JdbcThinSSLUtil
Review Comment:
Removed.
##########
modules/clients/src/test/java/org/apache/ignite/jdbc/thin/JdbcThinConnectionSSLTest.java:
##########
@@ -762,19 +763,30 @@ private SSLSocketFactory factory(String protocol) throws
Exception {
return ctx.getSocketFactory();
}
- /** */
+ /**
+ * @return Cipher suites supported by the JDK, but not enabled by default
for the SSL protocol that the JDBC
+ * client uses when no explicit cipher suites are set.
+ * @throws Exception If failed.
+ */
private Set<String> disabledByDefaultCipherSuites() throws Exception {
- SSLSocketFactory factory = factory("TLSv1.2");
+ // The client uses the default protocol when no sslProtocol connection
property is set (JdbcThinSSLUtil
+ // falls back to SslContextFactory.DFLT_SSL_PROTOCOL), so the defaults
of the same protocol must be
+ // subtracted: a suite absent from the defaults of a TLSv1.2 context
only (a TLS 1.3 suite) can still
+ // be enabled by default for the client, which made the selected suite
negotiable with the client's
+ // default ciphers.
+ SSLSocketFactory factory =
factory(SslContextFactory.DFLT_SSL_PROTOCOL);
Set<String> supportedCiphersSuites = new
HashSet<>(Arrays.stream(factory.getSupportedCipherSuites()).toList());
- // Fulter supported, but NOT in the default active list.
+ // Filter supported, but NOT in the default active list.
supportedCiphersSuites.removeAll(Set.of(factory.getDefaultCipherSuites()));
// Current TC settings.
supportedCiphersSuites.removeIf(s -> s.contains("_anon_"));
- assertFalse("No one disabled by default suite found",
supportedCiphersSuites.isEmpty());
+ // Some providers enable every supported suite by default (for
example, OpenJDK 17 with the stock
Review Comment:
Removed.
##########
modules/clients/src/test/java/org/apache/ignite/jdbc/thin/JdbcThinConnectionSSLTest.java:
##########
@@ -762,19 +763,30 @@ private SSLSocketFactory factory(String protocol) throws
Exception {
return ctx.getSocketFactory();
}
- /** */
+ /**
+ * @return Cipher suites supported by the JDK, but not enabled by default
for the SSL protocol that the JDBC
+ * client uses when no explicit cipher suites are set.
+ * @throws Exception If failed.
+ */
private Set<String> disabledByDefaultCipherSuites() throws Exception {
- SSLSocketFactory factory = factory("TLSv1.2");
+ // The client uses the default protocol when no sslProtocol connection
property is set (JdbcThinSSLUtil
+ // falls back to SslContextFactory.DFLT_SSL_PROTOCOL), so the defaults
of the same protocol must be
+ // subtracted: a suite absent from the defaults of a TLSv1.2 context
only (a TLS 1.3 suite) can still
+ // be enabled by default for the client, which made the selected suite
negotiable with the client's
+ // default ciphers.
+ SSLSocketFactory factory =
factory(SslContextFactory.DFLT_SSL_PROTOCOL);
Set<String> supportedCiphersSuites = new
HashSet<>(Arrays.stream(factory.getSupportedCipherSuites()).toList());
- // Fulter supported, but NOT in the default active list.
+ // Filter supported, but NOT in the default active list.
supportedCiphersSuites.removeAll(Set.of(factory.getDefaultCipherSuites()));
// Current TC settings.
supportedCiphersSuites.removeIf(s -> s.contains("_anon_"));
Review Comment:
Replaced, with one addition: `removeIf(s -> !s.contains(\"_RSA_WITH_\") ||
s.contains(\"ECDH_RSA\"))`.
While checking every suite the helper can pick with a direct JSSE handshake
(mutual auth, the test keystores, NULL suites allowed),
`TLS_ECDH_RSA_WITH_NULL_SHA` failed with "no cipher suites in common": static
ECDH needs an EC public key in the server certificate, and `server.jks` has an
RSA key. It passes the `_RSA_WITH_` filter, so on a JDK whose set order picks
it first the tests would still fail for a non-client reason. The extra
`ECDH_RSA` conjunct drops it; every remaining candidate
(`TLS_ECDHE_RSA_WITH_NULL_SHA`, `TLS_RSA_WITH_NULL_SHA256`,
`SSL_RSA_WITH_NULL_SHA`, `SSL_RSA_WITH_NULL_MD5`) completed a handshake in both
NULL-allowed setups. Happy to revert the conjunct if you prefer another way.
The whole class then ran in the four setups from the ticket (results in the
PR description): no failures anywhere; the custom-cipher tests run their cipher
steps in the two NULL-allowed setups and skip elsewhere.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
