From f5ffa56b77f1ea853430e5689a040fbe69a33022 Mon Sep 17 00:00:00 2001 From: Balazs Meszaros Date: Wed, 10 Jun 2026 16:06:48 +0200 Subject: [PATCH 1/2] ZOOKEEPER-5054: Netty client should allow every supported TLS ciphers We allow every supported ciphers at the client-side by default. This change does not affect the server-side and still allows to override the allowed ciphers at client-side. --- .../zookeeper/common/ClientNettyX509Util.java | 4 ++- .../apache/zookeeper/common/X509UtilTest.java | 31 +++++++++++++++++-- 2 files changed, 32 insertions(+), 3 deletions(-) diff --git a/zookeeper-server/src/main/java/org/apache/zookeeper/common/ClientNettyX509Util.java b/zookeeper-server/src/main/java/org/apache/zookeeper/common/ClientNettyX509Util.java index 227fdde8c82..09e9ee8a69f 100644 --- a/zookeeper-server/src/main/java/org/apache/zookeeper/common/ClientNettyX509Util.java +++ b/zookeeper-server/src/main/java/org/apache/zookeeper/common/ClientNettyX509Util.java @@ -72,7 +72,9 @@ public SslContext createNettySslContextForClient(ZKConfig config) sslContextBuilder.protocols(enabledProtocols); } Iterable enabledCiphers = getCipherSuites(config); - if (enabledCiphers != null) { + if (enabledCiphers == null) { + sslContextBuilder.ciphers(null, IdentityCipherSuiteFilter.INSTANCE_DEFAULTING_TO_SUPPORTED_CIPHERS); + } else { sslContextBuilder.ciphers(enabledCiphers); } sslContextBuilder.sslProvider(getSslProvider(config)); diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/common/X509UtilTest.java b/zookeeper-server/src/test/java/org/apache/zookeeper/common/X509UtilTest.java index 494bf6c1ef7..c22a0d01085 100644 --- a/zookeeper-server/src/test/java/org/apache/zookeeper/common/X509UtilTest.java +++ b/zookeeper-server/src/test/java/org/apache/zookeeper/common/X509UtilTest.java @@ -29,6 +29,7 @@ import io.netty.buffer.UnpooledByteBufAllocator; import io.netty.handler.ssl.JdkSslContext; import io.netty.handler.ssl.SslContext; + import java.io.File; import java.io.FileOutputStream; import java.io.IOException; @@ -60,6 +61,7 @@ import javax.net.ssl.SSLSocket; import javax.net.ssl.X509KeyManager; import javax.net.ssl.X509TrustManager; + import org.apache.zookeeper.PortAssignment; import org.apache.zookeeper.client.ZKClientConfig; import org.apache.zookeeper.server.ServerCnxnFactory; @@ -68,7 +70,6 @@ import org.junit.jupiter.params.ParameterizedTest; import org.junit.jupiter.params.provider.MethodSource; - public class X509UtilTest extends BaseX509ParameterizedTestCase { private X509Util x509Util; @@ -798,7 +799,7 @@ public void testCreateSSLContext_ocspWithJreProvider( throws Exception { init(caKeyType, certKeyType, keyPassword, paramIndex); ZKConfig zkConfig = new ZKConfig(); - try (ClientX509Util clientX509Util = new ClientX509Util();) { + try (ClientX509Util clientX509Util = new ClientX509Util()) { zkConfig.setProperty(clientX509Util.getSslOcspEnabledProperty(), "true"); // Must not throw IllegalArgumentException clientX509Util.createSSLContext(zkConfig); @@ -827,6 +828,32 @@ public void testCreateSSLContext_hostnameVerificationNoCustomTrustStore(X509KeyT } } + @ParameterizedTest + @MethodSource("data") + public void testCreateSSLContext_ChaCha20Cipher(X509KeyType caKeyType, + X509KeyType certKeyType, String keyPassword, Integer paramIndex) throws Exception { + init(caKeyType, certKeyType, keyPassword, paramIndex); + + // TLS_CHACHA20_POLY1305_SHA256 cipher is a mandatory cipher suite on TLSv1.3, + // so a client with default configuration must support it. + + ZKConfig zkConfig = new ZKConfig(); + zkConfig.setProperty(x509Util.getSslEnabledProtocolsProperty(), "TLSv1.3"); + + try (ClientNettyX509Util clientX509Util = new ClientNettyX509Util()) { + SslContext context = clientX509Util.createNettySslContextForClient(zkConfig); + + UnpooledByteBufAllocator byteBufAllocator = new UnpooledByteBufAllocator(false); + SSLEngine engine = context.newEngine(byteBufAllocator); + + String[] enabledProtocols = engine.getEnabledProtocols(); + assertArrayEquals(new String[] { "TLSv1.3" }, enabledProtocols); + + List enabledCipherSuites = Arrays.asList(engine.getEnabledCipherSuites()); + assertTrue(enabledCipherSuites.contains("TLS_CHACHA20_POLY1305_SHA256")); + } + } + private static void forceClose(Socket s) { if (s == null || s.isClosed()) { return; From d596bf6202fa3d2738651c1f9cd0710d7cf38f33 Mon Sep 17 00:00:00 2001 From: Balazs Meszaros Date: Wed, 30 Sep 2026 14:13:21 +0200 Subject: [PATCH 2/2] checkstyle fix --- .../src/test/java/org/apache/zookeeper/common/X509UtilTest.java | 2 -- 1 file changed, 2 deletions(-) diff --git a/zookeeper-server/src/test/java/org/apache/zookeeper/common/X509UtilTest.java b/zookeeper-server/src/test/java/org/apache/zookeeper/common/X509UtilTest.java index c22a0d01085..d11590e971e 100644 --- a/zookeeper-server/src/test/java/org/apache/zookeeper/common/X509UtilTest.java +++ b/zookeeper-server/src/test/java/org/apache/zookeeper/common/X509UtilTest.java @@ -29,7 +29,6 @@ import io.netty.buffer.UnpooledByteBufAllocator; import io.netty.handler.ssl.JdkSslContext; import io.netty.handler.ssl.SslContext; - import java.io.File; import java.io.FileOutputStream; import java.io.IOException; @@ -61,7 +60,6 @@ import javax.net.ssl.SSLSocket; import javax.net.ssl.X509KeyManager; import javax.net.ssl.X509TrustManager; - import org.apache.zookeeper.PortAssignment; import org.apache.zookeeper.client.ZKClientConfig; import org.apache.zookeeper.server.ServerCnxnFactory;