You are viewing a plain text version of this content. The canonical link for it is here.
Posted to api@directory.apache.org by Shawn McKinney <sm...@apache.org> on 2021/07/03 17:26:11 UTC
[REPOSTED FROM DEV]Issue related to TLSv3 in the LDAP API
Hello,
A problem with Fortress using LDAPS in the API. It was brought on by this commit:
https://github.com/apache/directory-ldap-api/commit/4322886f8ed9fe0d2c588f0c557e92e4d160149f
```
public class LdapNetworkConnection
…
// Default to TLS sslFilter.setEnabledProtocols( new String[]
- { "TLSv1", "TLSv1.1", "TLSv1.2" } );
+ { "TLSv1", "TLSv1.1", "TLSv1.2", "TLSv1.3" } );
```
That is when TLSv1.3 was added as a default enabled protocol in the API, fortress started having LDAPS connections problems.
Specifically, connections hang during bind ops, as they’re retrieved from the pool.
Looking at the server log, the bind was successful, but the API's async handler (ignores?) times out.
When I add this to the Fortress connection pool initialization:
```
config.setEnabledProtocols( new String[] { "TLSv1", "TLSv1.1", "TLSv1.2" } );
```
Everything then works again as it should. In other words, when bypassing TLSv1.3 on the client side, it works again.
Not sure what’s going on, or if my workaround is the best way to handle this situation.
Any ideas on what I'm doing wrong?
Thanks,
—
Shawn
---------------------------------------------------------------------
To unsubscribe, e-mail: api-unsubscribe@directory.apache.org
For additional commands, e-mail: api-help@directory.apache.org
Re: [REPOSTED FROM DEV]Issue related to TLSv3 in the LDAP API
Posted by Shawn McKinney <sm...@apache.org>.
> On Jul 4, 2021, at 9:12 AM, Shawn McKinney <sm...@apache.org> wrote:
>
> I don’t think it’s server dependent as I’ve noticed the TLS connection and binds are successful with OpenLDAP before the timeout in the API.
Stefan,
I’ve got 2.0.6 running on a linode VM along with OpenLDAP using LDAPS.
I can make this available to you if you want to have a look.
Send me your public SSH key and I’ll add you, provide the info on where stuff is.
—
Shawn
---------------------------------------------------------------------
To unsubscribe, e-mail: api-unsubscribe@directory.apache.org
For additional commands, e-mail: api-help@directory.apache.org
Re: [REPOSTED FROM DEV]Issue related to TLSv3 in the LDAP API
Posted by Emmanuel Lécharny <el...@gmail.com>.
We are looking at the TLSV1.3 on MINA side with Jonathan Valière.
On 05/07/2021 14:13, Shawn McKinney wrote:
>
>> On Jul 4, 2021, at 1:16 PM, Stefan Seelmann <ma...@stefan-seelmann.de> wrote:
>>
>> Oh sorry, my question regarding ApacheDS didn't make sense because in
>> ApacheDS only TLSv1.2 is enabled so the negotiation chose 1.2 event if
>> 1.3 is enabled in the API.
>
> No worries. I needed to test LDAPS on ApacheDS anyway as it has been a while since I’ve last tried. Found and solved a glitch or two so it was time well spent.
>
> —
> Shawn
> ---------------------------------------------------------------------
> To unsubscribe, e-mail: api-unsubscribe@directory.apache.org
> For additional commands, e-mail: api-help@directory.apache.org
>
--
*Emmanuel Lécharny - CTO* 205 Promenade des Anglais – 06200 NICE
T. +33 (0)4 89 97 36 50
P. +33 (0)6 08 33 32 61
emmanuel.lecharny@busit.com https://www.busit.com/
---------------------------------------------------------------------
To unsubscribe, e-mail: api-unsubscribe@directory.apache.org
For additional commands, e-mail: api-help@directory.apache.org
Re: [REPOSTED FROM DEV]Issue related to TLSv3 in the LDAP API
Posted by Shawn McKinney <sm...@apache.org>.
> On Jul 4, 2021, at 1:16 PM, Stefan Seelmann <ma...@stefan-seelmann.de> wrote:
>
> Oh sorry, my question regarding ApacheDS didn't make sense because in
> ApacheDS only TLSv1.2 is enabled so the negotiation chose 1.2 event if
> 1.3 is enabled in the API.
No worries. I needed to test LDAPS on ApacheDS anyway as it has been a while since I’ve last tried. Found and solved a glitch or two so it was time well spent.
—
Shawn
---------------------------------------------------------------------
To unsubscribe, e-mail: api-unsubscribe@directory.apache.org
For additional commands, e-mail: api-help@directory.apache.org
Re: [REPOSTED FROM DEV]Issue related to TLSv3 in the LDAP API
Posted by Stefan Seelmann <ma...@stefan-seelmann.de>.
On 7/4/21 8:03 PM, Shawn McKinney wrote:
>
>> On Jul 4, 2021, at 9:12 AM, Shawn McKinney <sm...@apache.org> wrote:
>>
>> I don’t think it’s server dependent as I’ve noticed the TLS connection and binds are successful with OpenLDAP before the timeout in the API.
>>
>
> Should know by now not to ‘think’ and just test. Don’t know how many times I’ve been burned by assumptions. :/
>
>>
>> But, testing latest w/ LDAPS and ApacheDS is on my list of todos.
>
>
> After enabling LDAPS on ApacheDS, connections with TLSv3 allowed as an enabled protocol work fine.
>
> So, for some reason OpenLDAP and the LDAP API’s TLS 1.3 as an enabled protocol don’t get along.
Oh sorry, my question regarding ApacheDS didn't make sense because in
ApacheDS only TLSv1.2 is enabled so the negotiation chose 1.2 event if
1.3 is enabled in the API.
---------------------------------------------------------------------
To unsubscribe, e-mail: api-unsubscribe@directory.apache.org
For additional commands, e-mail: api-help@directory.apache.org
Re: [REPOSTED FROM DEV]Issue related to TLSv3 in the LDAP API
Posted by Shawn McKinney <sm...@apache.org>.
> On Jul 4, 2021, at 9:12 AM, Shawn McKinney <sm...@apache.org> wrote:
>
> I don’t think it’s server dependent as I’ve noticed the TLS connection and binds are successful with OpenLDAP before the timeout in the API.
>
Should know by now not to ‘think’ and just test. Don’t know how many times I’ve been burned by assumptions. :/
>
> But, testing latest w/ LDAPS and ApacheDS is on my list of todos.
After enabling LDAPS on ApacheDS, connections with TLSv3 allowed as an enabled protocol work fine.
So, for some reason OpenLDAP and the LDAP API’s TLS 1.3 as an enabled protocol don’t get along.
—
Shawn
---------------------------------------------------------------------
To unsubscribe, e-mail: api-unsubscribe@directory.apache.org
For additional commands, e-mail: api-help@directory.apache.org
Re: [REPOSTED FROM DEV]Issue related to TLSv3 in the LDAP API
Posted by Shawn McKinney <sm...@apache.org>.
> On Jul 4, 2021, at 8:08 AM, Stefan Seelmann <ma...@stefan-seelmann.de> wrote:
>
> On 7/3/21 7:26 PM, Shawn McKinney wrote:
>> That is when TLSv1.3 was added as a default enabled protocol in the API, fortress started having LDAPS connections problems.
>>
>> Specifically, connections hang during bind ops, as they’re retrieved from the pool.
>>
>> Looking at the server log, the bind was successful, but the API's async handler (ignores?) times out.
>
> Can you please explain the steps to reproduce this issue? Does it happen
> when running the Fortress integration tests? Or the load tests? And only
> when testing against OpenDLAP or also when testing against ApacheDS?
Anytime LDAPS is enabled it happens. Oddly, sometimes it'll successfully connects on the first operation, but usually not. Regardless, timeouts always happen on all subsequent binds.
So, yes happens during integration tests with OpenLDAP. Or, when trying to run a load:
https://github.com/apache/directory-fortress-core#section-10-instructions-to-load-policy-data-using-apache-fortress-load-utility
Or, the console:
https://github.com/apache/directory-fortress-core#section-12-instructions-to-run-the-apache-fortress-command-console
I’ve tested the latest with ApacheDS, but not with LDAPS - yet.
I don’t think it’s server dependent as I’ve noticed the TLS connection and binds are successful with OpenLDAP before the timeout in the API.
But, testing latest w/ LDAPS and ApacheDS is on my list of todos.
—
Shawn
---------------------------------------------------------------------
To unsubscribe, e-mail: api-unsubscribe@directory.apache.org
For additional commands, e-mail: api-help@directory.apache.org
Re: [REPOSTED FROM DEV]Issue related to TLSv3 in the LDAP API
Posted by Stefan Seelmann <ma...@stefan-seelmann.de>.
Hi again,
On 7/3/21 7:26 PM, Shawn McKinney wrote:
> That is when TLSv1.3 was added as a default enabled protocol in the API, fortress started having LDAPS connections problems.
>
> Specifically, connections hang during bind ops, as they’re retrieved from the pool.
>
> Looking at the server log, the bind was successful, but the API's async handler (ignores?) times out.
Can you please explain the steps to reproduce this issue? Does it happen
when running the Fortress integration tests? Or the load tests? And only
when testing against OpenDLAP or also when testing against ApacheDS?
Kind Regards,
Stefan
[1]
https://github.com/apache/directory-fortress-core#section-9-instructions-to-integration-test
[2]
https://github.com/apache/directory-fortress-core/blob/master/README-LOAD-TESTING.md
---------------------------------------------------------------------
To unsubscribe, e-mail: api-unsubscribe@directory.apache.org
For additional commands, e-mail: api-help@directory.apache.org
Re: [REPOSTED FROM DEV]Issue related to TLSv3 in the LDAP API
Posted by Shawn McKinney <sm...@apache.org>.
> On Jul 3, 2021, at 2:10 PM, Stefan Seelmann <ma...@stefan-seelmann.de> wrote:
>
> I added TLSv1.3 to the default protocols in [1]. There is an open issue
> for Mina [2] that describes timeouts when using v1.3, please see my
> comment there. When used in Studio I didn't encounter any issue in tests
> against OpenLDAP or 389ds, only when using it in ApacheDS, so I assumed
> it's only a server-side problem. But your observations proves that my
> assumption was wrong.
>
> Which Java version are you using? I ask because I only tested with Java
> 11 and 17-ea, but not with Java 8.
>
Hi Stefan,
Problem first observed on a Centos8 VM:
Java version: 1.8.0_292, vendor: Red Hat, Inc., runtime: /usr/lib/jvm/java-1.8.0-openjdk-1.8.0.292.b10-1.el8_4.x86_64/jre
But, later, also on my dev workstation:
Java version: 11.0.11, vendor: Ubuntu, runtime: /usr/lib/jvm/java-11-openjdk-amd64
> Otherwise I think you aren't doing anything wrong. Either continue with
> your workaround, or we need to revert that change in the LDAP API until
> the problem is fixed in Mina.
OK, cool, not going to worry about it then.
I’ll parameterize the supported TLS protocols (in fortress) providing a default that leaves out TLSv1.3 for this release.
Users can supply their own list of protocols, in the properties file, making 1.3 possible.
Appreciate the quick response.
—
Shawn
---------------------------------------------------------------------
To unsubscribe, e-mail: api-unsubscribe@directory.apache.org
For additional commands, e-mail: api-help@directory.apache.org
Re: [REPOSTED FROM DEV]Issue related to TLSv3 in the LDAP API
Posted by Stefan Seelmann <ma...@stefan-seelmann.de>.
Hi Shawn,
I added TLSv1.3 to the default protocols in [1]. There is an open issue
for Mina [2] that describes timeouts when using v1.3, please see my
comment there. When used in Studio I didn't encounter any issue in tests
against OpenLDAP or 389ds, only when using it in ApacheDS, so I assumed
it's only a server-side problem. But your observations proves that my
assumption was wrong.
Which Java version are you using? I ask because I only tested with Java
11 and 17-ea, but not with Java 8.
Otherwise I think you aren't doing anything wrong. Either continue with
your workaround, or we need to revert that change in the LDAP API until
the problem is fixed in Mina.
Kind Regards,
Stefan
[1] https://issues.apache.org/jira/browse/DIRAPI-375
[2] https://issues.apache.org/jira/browse/DIRMINA-1132
On 7/3/21 7:26 PM, Shawn McKinney wrote:
> Hello,
>
> A problem with Fortress using LDAPS in the API. It was brought on by this commit:
>
> https://github.com/apache/directory-ldap-api/commit/4322886f8ed9fe0d2c588f0c557e92e4d160149f
>
>
> ```
> public class LdapNetworkConnection
> …
>
> // Default to TLS sslFilter.setEnabledProtocols( new String[]
> - { "TLSv1", "TLSv1.1", "TLSv1.2" } );
> + { "TLSv1", "TLSv1.1", "TLSv1.2", "TLSv1.3" } );
> ```
>
> That is when TLSv1.3 was added as a default enabled protocol in the API, fortress started having LDAPS connections problems.
>
> Specifically, connections hang during bind ops, as they’re retrieved from the pool.
>
> Looking at the server log, the bind was successful, but the API's async handler (ignores?) times out.
>
> When I add this to the Fortress connection pool initialization:
>
> ```
> config.setEnabledProtocols( new String[] { "TLSv1", "TLSv1.1", "TLSv1.2" } );
> ```
>
> Everything then works again as it should. In other words, when bypassing TLSv1.3 on the client side, it works again.
>
> Not sure what’s going on, or if my workaround is the best way to handle this situation.
>
> Any ideas on what I'm doing wrong?
>
> Thanks,
>
> —
> Shawn
> ---------------------------------------------------------------------
> To unsubscribe, e-mail: api-unsubscribe@directory.apache.org
> For additional commands, e-mail: api-help@directory.apache.org
>
---------------------------------------------------------------------
To unsubscribe, e-mail: api-unsubscribe@directory.apache.org
For additional commands, e-mail: api-help@directory.apache.org