You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@ignite.apache.org by pt...@apache.org on 2022/07/14 09:22:01 UTC
[ignite] branch master updated: IGNITE-17367 Java thin: Fix hang on deprecated SSL protocols (#10158)
This is an automated email from the ASF dual-hosted git repository.
ptupitsyn pushed a commit to branch master
in repository https://gitbox.apache.org/repos/asf/ignite.git
The following commit(s) were added to refs/heads/master by this push:
new 057a03d43a0 IGNITE-17367 Java thin: Fix hang on deprecated SSL protocols (#10158)
057a03d43a0 is described below
commit 057a03d43a0d255072ed1ce079cc3d01bb21e07f
Author: Pavel Tupitsyn <pt...@apache.org>
AuthorDate: Thu Jul 14 12:21:47 2022 +0300
IGNITE-17367 Java thin: Fix hang on deprecated SSL protocols (#10158)
TLSv1.1 is deprecated. It causes an exception in `GridNioSslFilter.onSessionOpened`. However, `GridNioClientConnectionMultiplexer` waits on `sesFut` first, which never completes in this case.
* Fix `GridNioClientConnectionMultiplexer` to wait on `sslHandshakeFut` first and fail on SSL exceptions instead of hanging.
* Fix `GridNioSslFilter` to propagate exception details correctly.
* Fix tests to use TLSv1.2 where needed.
---
.../internal/client/ClientSslParametersTest.java | 2 +-
.../GridNioClientConnectionMultiplexer.java | 4 ++-
.../internal/util/nio/ssl/GridNioSslFilter.java | 10 +++++--
.../apache/ignite/client/SslParametersTest.java | 31 +++++++++++++++++++---
.../tcp/TcpDiscoverySslParametersTest.java | 6 ++---
5 files changed, 43 insertions(+), 10 deletions(-)
diff --git a/modules/clients/src/test/java/org/apache/ignite/internal/client/ClientSslParametersTest.java b/modules/clients/src/test/java/org/apache/ignite/internal/client/ClientSslParametersTest.java
index 97e66190fa5..325caaaed10 100644
--- a/modules/clients/src/test/java/org/apache/ignite/internal/client/ClientSslParametersTest.java
+++ b/modules/clients/src/test/java/org/apache/ignite/internal/client/ClientSslParametersTest.java
@@ -269,7 +269,7 @@ public class ClientSslParametersTest extends GridCommonAbstractTest {
checkSuccessfulClientStart(
null,
new String[] {
- "TLSv1.1",
+ "TLSv1.2",
"SSLv3"
}
);
diff --git a/modules/core/src/main/java/org/apache/ignite/internal/client/thin/io/gridnioserver/GridNioClientConnectionMultiplexer.java b/modules/core/src/main/java/org/apache/ignite/internal/client/thin/io/gridnioserver/GridNioClientConnectionMultiplexer.java
index dab8d1a60bd..8fe96e91c7a 100644
--- a/modules/core/src/main/java/org/apache/ignite/internal/client/thin/io/gridnioserver/GridNioClientConnectionMultiplexer.java
+++ b/modules/core/src/main/java/org/apache/ignite/internal/client/thin/io/gridnioserver/GridNioClientConnectionMultiplexer.java
@@ -154,11 +154,13 @@ public class GridNioClientConnectionMultiplexer implements ClientConnectionMulti
meta.put(GridNioSslFilter.HANDSHAKE_FUT_META_KEY, sslHandshakeFut);
}
- GridNioSession ses = srv.createSession(ch, meta, false, null).get();
+ GridNioFuture<GridNioSession> sesFut = srv.createSession(ch, meta, false, null);
if (sslHandshakeFut != null)
sslHandshakeFut.get();
+ GridNioSession ses = sesFut.get();
+
return new GridNioClientConnection(ses, msgHnd, stateHnd);
}
catch (Exception e) {
diff --git a/modules/core/src/main/java/org/apache/ignite/internal/util/nio/ssl/GridNioSslFilter.java b/modules/core/src/main/java/org/apache/ignite/internal/util/nio/ssl/GridNioSslFilter.java
index cc722d21e73..3e228322128 100644
--- a/modules/core/src/main/java/org/apache/ignite/internal/util/nio/ssl/GridNioSslFilter.java
+++ b/modules/core/src/main/java/org/apache/ignite/internal/util/nio/ssl/GridNioSslFilter.java
@@ -82,6 +82,9 @@ public class GridNioSslFilter extends GridNioFilterAdapter {
/** Whether direct mode is used. */
private boolean directMode;
+ /** Exception during onSessionOpened */
+ @Nullable private Exception onSessionOpenedException;
+
/** Metric that indicates sessions count that were rejected due to SSL errors. */
@Nullable private final IntMetricImpl rejectedSesCnt;
@@ -189,7 +192,9 @@ public class GridNioSslFilter extends GridNioFilterAdapter {
engine = sslCtx.createSSLEngine();
}
catch (IllegalArgumentException e) {
- throw new IgniteCheckedException("Failed connect to cluster. Check SSL configuration.", e);
+ IgniteCheckedException ex = new IgniteCheckedException("Failed connect to cluster. Check SSL configuration.", e);
+ onSessionOpenedException = ex;
+ throw ex;
}
boolean clientMode = !ses.accepted();
@@ -258,6 +263,7 @@ public class GridNioSslFilter extends GridNioFilterAdapter {
proceedMessageReceived(ses, alreadyDecoded);
}
catch (SSLException e) {
+ onSessionOpenedException = e;
U.error(log, "Failed to start SSL handshake (will close inbound connection): " + ses, e);
if (rejectedSesCnt != null)
@@ -273,7 +279,7 @@ public class GridNioSslFilter extends GridNioFilterAdapter {
GridNioFutureImpl<?> fut = ses.removeMeta(HANDSHAKE_FUT_META_KEY);
if (fut != null)
- fut.onDone(new IgniteCheckedException("SSL handshake failed (connection closed)."));
+ fut.onDone(new IgniteCheckedException("SSL handshake failed (connection closed).", onSessionOpenedException));
if (ses.meta(SSL_META.ordinal()) == null)
return;
diff --git a/modules/core/src/test/java/org/apache/ignite/client/SslParametersTest.java b/modules/core/src/test/java/org/apache/ignite/client/SslParametersTest.java
index b1d34fd62ea..d7a1bdbb474 100644
--- a/modules/core/src/test/java/org/apache/ignite/client/SslParametersTest.java
+++ b/modules/core/src/test/java/org/apache/ignite/client/SslParametersTest.java
@@ -18,6 +18,7 @@
package org.apache.ignite.client;
import java.util.concurrent.Callable;
+import javax.net.ssl.SSLHandshakeException;
import org.apache.ignite.Ignition;
import org.apache.ignite.configuration.CacheConfiguration;
import org.apache.ignite.configuration.ClientConfiguration;
@@ -28,6 +29,7 @@ import org.apache.ignite.ssl.SslContextFactory;
import org.apache.ignite.testframework.GridTestUtils;
import org.apache.ignite.testframework.junits.common.GridCommonAbstractTest;
import org.jetbrains.annotations.NotNull;
+import org.junit.Ignore;
import org.junit.Test;
/**
@@ -44,6 +46,7 @@ public class SslParametersTest extends GridCommonAbstractTest {
private volatile String[] protocols;
/** {@inheritDoc} */
+ @SuppressWarnings("rawtypes")
@Override protected IgniteConfiguration getConfiguration(String gridName) throws Exception {
IgniteConfiguration cfg = super.getConfiguration(gridName);
@@ -220,6 +223,29 @@ public class SslParametersTest extends GridCommonAbstractTest {
);
}
+ /**
+ * @throws Exception If failed.
+ */
+ @Test
+ @Ignore("Outdated machines do not consider TLS 1.1 deprecated.")
+ public void testDeprecatedProtocolThrows() throws Exception {
+ protocols = new String[] {
+ "TLSv1.1",
+ "TLSv1.2"
+ };
+
+ startGrid();
+
+ checkClientStartFailure(
+ null,
+ new String[] {
+ "TLSv1.1",
+ },
+ SSLHandshakeException.class,
+ "No appropriate protocol (protocol is disabled or cipher suites are inappropriate)"
+ );
+ }
+
/**
* @throws Exception If failed.
*/
@@ -255,7 +281,7 @@ public class SslParametersTest extends GridCommonAbstractTest {
checkSuccessfulClientStart(null,
new String[] {
- "TLSv1.1",
+ "TLSv1.2",
"SSLv3"
}
);
@@ -264,9 +290,8 @@ public class SslParametersTest extends GridCommonAbstractTest {
/**
* @param cipherSuites list of cipher suites
* @param protocols list of protocols
- * @throws Exception If failed.
*/
- private void checkSuccessfulClientStart(String[] cipherSuites, String[] protocols) throws Exception {
+ private void checkSuccessfulClientStart(String[] cipherSuites, String[] protocols) {
this.cipherSuites = F.isEmpty(cipherSuites) ? null : cipherSuites;
this.protocols = F.isEmpty(protocols) ? null : protocols;
diff --git a/modules/core/src/test/java/org/apache/ignite/spi/discovery/tcp/TcpDiscoverySslParametersTest.java b/modules/core/src/test/java/org/apache/ignite/spi/discovery/tcp/TcpDiscoverySslParametersTest.java
index 131a6eda3d5..e6da699b05f 100644
--- a/modules/core/src/test/java/org/apache/ignite/spi/discovery/tcp/TcpDiscoverySslParametersTest.java
+++ b/modules/core/src/test/java/org/apache/ignite/spi/discovery/tcp/TcpDiscoverySslParametersTest.java
@@ -150,12 +150,12 @@ public class TcpDiscoverySslParametersTest extends GridCommonAbstractTest {
null,
new String[][] {
new String[] {
- "TLSv1.1",
+ "TLSv1.2",
"SSLv3"
},
new String[] {
"TLSv1",
- "TLSv1.2",
+ "TLSv1.3",
}
}
);
@@ -214,7 +214,7 @@ public class TcpDiscoverySslParametersTest extends GridCommonAbstractTest {
"TLSv1.2",
},
new String[] {
- "TLSv1.1",
+ "TLSv1.2",
"SSLv3"
}
}