Skip to content

Commit ff822cf

Browse files
fjssilvafjssilva
committed
Fix for tests failing due to expecting unsupported TLS versions.
Change-Id: I24f8ad9fa2228277509c572cc835466d125007f5
1 parent 429db00 commit ff822cf

File tree

3 files changed

+68
-41
lines changed

3 files changed

+68
-41
lines changed

‎src/test/java/testsuite/BaseTestCase.java

Lines changed: 27 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -52,6 +52,7 @@
5252
import java.sql.SQLException;
5353
import java.sql.Statement;
5454
import java.util.ArrayList;
55+
import java.util.Arrays;
5556
import java.util.Enumeration;
5657
import java.util.HashSet;
5758
import java.util.List;
@@ -61,6 +62,8 @@
6162
import java.util.StringJoiner;
6263
import java.util.concurrent.Callable;
6364

65+
import javax.net.ssl.SSLContext;
66+
6467
import org.junit.jupiter.api.AfterEach;
6568
import org.junit.jupiter.api.BeforeEach;
6669
import org.junit.jupiter.api.TestInfo;
@@ -1294,6 +1297,30 @@ protected boolean supportsTLSv1_2(ServerVersion version) throws Exception {
12941297
|| version.meetsMinimum(new ServerVersion(5, 6, 0)) && Util.isEnterpriseEdition(version.toString());
12951298
}
12961299

1300+
protected String getHighestCommonTlsVersion() throws Exception {
1301+
// Find out which TLS protocol versions are supported by this JVM.
1302+
SSLContext sslContext = SSLContext.getInstance("TLS");
1303+
sslContext.init(null, null, null);
1304+
List<String> jvmSupportedProtocols = Arrays.asList(sslContext.createSSLEngine().getSupportedProtocols());
1305+
1306+
this.rs = this.stmt.executeQuery("SHOW GLOBAL VARIABLES LIKE 'tls_version'");
1307+
assertTrue(this.rs.next());
1308+
String value = this.rs.getString(2);
1309+
1310+
List<String> serverSupportedProtocols = Arrays.asList(value.trim().split("\\s*,\\s*"));
1311+
String highestCommonTlsVersion = "";
1312+
for (String p : new String[] { "TLSv1.3", "TLSv1.2", "TLSv1.1", "TLSv1" }) {
1313+
if (jvmSupportedProtocols.contains(p) && serverSupportedProtocols.contains(p)) {
1314+
highestCommonTlsVersion = p;
1315+
break;
1316+
}
1317+
}
1318+
System.out.println("Server supports TLS protocols: " + serverSupportedProtocols);
1319+
System.out.println("Highest common TLS protocol: " + highestCommonTlsVersion);
1320+
1321+
return highestCommonTlsVersion;
1322+
}
1323+
12971324
protected void assertSessionStatusEquals(Statement st, String statusVariable, String expected) throws Exception {
12981325
ResultSet rs1 = st.executeQuery("SHOW SESSION STATUS LIKE '" + statusVariable + "'");
12991326
assertTrue(rs1.next());

‎src/test/java/testsuite/simple/ConnectionTest.java

Lines changed: 6 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -2267,13 +2267,12 @@ public void testTLSVersionRemoval() throws Exception {
22672267
assumeTrue(supportsTestCertificates(this.stmt),
22682268
"This test requires the server configured with SSL certificates from ConnectorJ/src/test/config/ssl-test-certs");
22692269

2270-
String testCipher = "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256"; // IANA Cipher name
2271-
String expectedCipher = "ECDHE-RSA-AES128-GCM-SHA256"; // OpenSSL Cipher name
2272-
String testTlsVersion = "TLSv1.2";
2273-
if (versionMeetsMinimum(8, 2)) {
2274-
testCipher = "TLS_AES_256_GCM_SHA384"; // IANA Cipher name
2275-
expectedCipher = "TLS_AES_256_GCM_SHA384"; // IANA Cipher name
2276-
testTlsVersion = "TLSv1.3";
2270+
String testCipher = "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256"; // TLSv1.2 IANA Cipher name.
2271+
String expectedCipher = "ECDHE-RSA-AES128-GCM-SHA256"; // TLSv1.2 OpenSSL Cipher name.
2272+
String testTlsVersion = getHighestCommonTlsVersion(); // At least TLSv1.2 is expected to be supported.
2273+
if ("TLSv1.3".equalsIgnoreCase(testTlsVersion)) {
2274+
testCipher = "TLS_AES_256_GCM_SHA384"; // TLSv1.3 IANA Cipher name.
2275+
expectedCipher = "TLS_AES_256_GCM_SHA384"; // TLSv1.3 IANA Cipher name.
22772276
}
22782277

22792278
Connection con = null;

‎src/test/java/testsuite/x/devapi/SecureSessionTest.java

Lines changed: 35 additions & 34 deletions
Original file line numberDiff line numberDiff line change
@@ -804,21 +804,26 @@ private String getHighestCommonTlsVersion(Session sess) throws Exception {
804804

805805
/**
806806
* Tests fix for Bug#25494338, ENABLEDSSLCIPHERSUITES PARAMETER NOT WORKING AS EXPECTED WITH X-PLUGIN.
807+
*
808+
* @throws Exception
807809
*/
808810
@Test
809-
public void testBug25494338() {
811+
public void testBug25494338() throws Exception {
810812
assumeTrue(supportsTestCertificates(this.session),
811813
"This test requires the server configured with SSL certificates from ConnectorJ/src/test/config/ssl-test-certs");
812814

813-
String testCipher1 = "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256"; // IANA Cipher name
814-
String expectedCipher1 = "ECDHE-RSA-AES128-GCM-SHA256"; // OpenSSL Cipher name
815-
String testCipher2 = "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384"; // IANA Cipher name
816-
String expectedCipher2 = "ECDHE-RSA-AES256-GCM-SHA384"; // OpenSSL Cipher name
817-
if (mysqlVersionMeetsMinimum(ServerVersion.parseVersion("8.2.0"))) {
818-
testCipher1 = "TLS_AES_256_GCM_SHA384"; // IANA Cipher name
819-
expectedCipher1 = "TLS_AES_256_GCM_SHA384"; // IANA Cipher name
820-
testCipher2 = "TLS_AES_128_GCM_SHA256"; // IANA Cipher name
821-
expectedCipher2 = "TLS_AES_128_GCM_SHA256"; // IANA Cipher name
815+
String testCipher1 = "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256"; // TLSv1.2 IANA Cipher name.
816+
String expectedCipher1 = "ECDHE-RSA-AES128-GCM-SHA256"; // TLSv1.2 OpenSSL Cipher name.
817+
String testCipher2 = "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384"; // TLSv1.2 IANA Cipher name.
818+
String expectedCipher2 = "ECDHE-RSA-AES256-GCM-SHA384"; // TLSv1.2 OpenSSL Cipher name.
819+
Session sess = this.fact.getSession(this.baseUrl);
820+
String testTlsVersion = getHighestCommonTlsVersion(sess); // At least TLSv1.2 is expected to be supported.
821+
sess.close();
822+
if ("TLSv1.3".equalsIgnoreCase(testTlsVersion)) {
823+
testCipher1 = "TLS_AES_256_GCM_SHA384"; // TLSv1.3 IANA Cipher name.
824+
expectedCipher1 = "TLS_AES_256_GCM_SHA384"; // TLSv1.3 IANA Cipher name.
825+
testCipher2 = "TLS_AES_128_GCM_SHA256"; // TLSv1.3 IANA Cipher name.
826+
expectedCipher2 = "TLS_AES_128_GCM_SHA256"; // TLSv1.3 IANA Cipher name.
822827
}
823828

824829
Session testSession = null;
@@ -838,7 +843,7 @@ public void testBug25494338() {
838843

839844
// 1. Allow only TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256/TLS_AES_256_GCM_SHA384 cipher
840845
props.setProperty(PropertyKey.tlsCiphersuites.getKeyName(), testCipher1);
841-
Session sess = this.fact.getSession(props);
846+
sess = this.fact.getSession(props);
842847
assertSessionStatusEquals(sess, "mysqlx_ssl_cipher", expectedCipher1);
843848
sess.close();
844849

@@ -949,22 +954,18 @@ public void testXdevapiTlsVersionsAndCiphersuites() throws Exception {
949954
"This test requires the server configured with SSL certificates from ConnectorJ/src/test/config/ssl-test-certs");
950955
assumeTrue(supportsTestCertificates(this.session), "This test requires the server with RSA support.");
951956

952-
String testCipher = "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256"; // IANA Cipher name
953-
String expectedCipher = "ECDHE-RSA-AES128-GCM-SHA256"; // OpenSSL Cipher name
954-
String testTlsVersion = "TLSv1.2";
957+
String testCipher = "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256"; // TLSv1.2 IANA Cipher name.
958+
String expectedCipher = "ECDHE-RSA-AES128-GCM-SHA256"; // TLSv1.2 OpenSSL Cipher name.
959+
Session sess = this.fact.getSession(this.baseUrl);
960+
String testTlsVersion = getHighestCommonTlsVersion(sess); // At least TLSv1.2 is expected to be supported.
955961
String testCipher2 = "DHE-RSA-AES128-GCM-SHA256";
956-
if (mysqlVersionMeetsMinimum(ServerVersion.parseVersion("8.2.0"))) {
957-
testCipher = "TLS_AES_256_GCM_SHA384"; // IANA Cipher name
958-
expectedCipher = "TLS_AES_256_GCM_SHA384"; // IANA Cipher name
959-
testTlsVersion = "TLSv1.3";
962+
sess.close();
963+
if ("TLSv1.3".equalsIgnoreCase(testTlsVersion)) {
964+
testCipher = "TLS_AES_256_GCM_SHA384"; // TLSv1.3 IANA Cipher name.
965+
expectedCipher = "TLS_AES_256_GCM_SHA384"; // TLSv1.3 IANA Cipher name.
960966
testCipher2 = "TLS_AES_128_GCM_SHA256";
961967
}
962968

963-
// newer GPL servers, like 8.0.4+, are using OpenSSL and can use RSA encryption, while old ones compiled with yaSSL cannot
964-
Session sess = this.fact.getSession(this.sslFreeBaseUrl);
965-
String highestCommonTlsVersion = getHighestCommonTlsVersion(sess);
966-
sess.close();
967-
968969
Properties props = new Properties(this.sslFreeTestProperties);
969970
props.setProperty(PropertyKey.xdevapiSslMode.getKeyName(), PropertyDefinitions.XdevapiSslMode.VERIFY_CA.toString());
970971
props.setProperty(PropertyKey.xdevapiSslTrustStoreUrl.getKeyName(), this.trustStoreUrl);
@@ -1189,7 +1190,7 @@ public void testXdevapiTlsVersionsAndCiphersuites() throws Exception {
11891190
// Assess that the session is created successfully and the connection properties are initialized with the expected values.
11901191
testSession = this.fact.getSession(this.sslFreeBaseUrl);
11911192
assertSecureSession(testSession);
1192-
assertTlsVersion(testSession, highestCommonTlsVersion);
1193+
assertTlsVersion(testSession, testTlsVersion);
11931194
testSession.close();
11941195

11951196
// TS.FR.5_2. Create an X DevAPI session using a connection string with the connection property xdevapi.tls-versions but without
@@ -1216,7 +1217,7 @@ public void testXdevapiTlsVersionsAndCiphersuites() throws Exception {
12161217
props.remove(PropertyKey.xdevapiTlsCiphersuites.getKeyName());
12171218
testSession = this.fact.getSession(props);
12181219
assertSecureSession(testSession);
1219-
assertTlsVersion(testSession, highestCommonTlsVersion);
1220+
assertTlsVersion(testSession, testTlsVersion);
12201221
testSession.close();
12211222

12221223
// TS.FR.5_5. Create an X DevAPI session using a connection properties map with the connection property xdevapi.tls-versions but without
@@ -1243,7 +1244,7 @@ public void testXdevapiTlsVersionsAndCiphersuites() throws Exception {
12431244
cli = cf.getClient(this.sslFreeBaseUrl, "{\"pooling\": {\"enabled\": true}}");
12441245
testSession = cli.getSession();
12451246
assertSecureSession(testSession);
1246-
assertTlsVersion(testSession, highestCommonTlsVersion);
1247+
assertTlsVersion(testSession, testTlsVersion);
12471248
cli.close();
12481249

12491250
cli = cf.getClient(this.sslFreeBaseUrl + makeParam(PropertyKey.xdevapiTlsVersions, testTlsVersion), "{\"pooling\": {\"enabled\": true}}");
@@ -1734,16 +1735,16 @@ public void testTLSVersionRemoval() throws Exception {
17341735
assumeTrue(supportsTestCertificates(this.session),
17351736
"This test requires the server configured with SSL certificates from ConnectorJ/src/test/config/ssl-test-certs");
17361737

1737-
String testCipher = "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256"; // IANA Cipher name
1738-
String expectedCipher = "ECDHE-RSA-AES128-GCM-SHA256"; // OpenSSL Cipher name
1739-
String testTlsVersion = "TLSv1.2";
1740-
if (mysqlVersionMeetsMinimum(ServerVersion.parseVersion("8.2.0"))) {
1741-
testCipher = "TLS_AES_256_GCM_SHA384"; // IANA Cipher name
1742-
expectedCipher = "TLS_AES_256_GCM_SHA384"; // IANA Cipher name
1743-
testTlsVersion = "TLSv1.3";
1738+
String testCipher = "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256"; // TLSv1.2 IANA Cipher name.
1739+
String expectedCipher = "ECDHE-RSA-AES128-GCM-SHA256"; // TLSv1.2 OpenSSL Cipher name.
1740+
Session sess = this.fact.getSession(this.baseUrl);
1741+
String testTlsVersion = getHighestCommonTlsVersion(sess); // At least TLSv1.2 is expected to be supported.
1742+
sess.close();
1743+
if ("TLSv1.3".equalsIgnoreCase(testTlsVersion)) {
1744+
testCipher = "TLS_AES_256_GCM_SHA384"; // TLSv1.3 IANA Cipher name.
1745+
expectedCipher = "TLS_AES_256_GCM_SHA384"; // TLSv1.3 IANA Cipher name.
17441746
}
17451747

1746-
Session sess = null;
17471748
Properties props = new Properties(this.sslFreeTestProperties);
17481749
props.setProperty(PropertyKey.sslMode.getKeyName(), SslMode.REQUIRED.name());
17491750
props.setProperty(PropertyKey.allowPublicKeyRetrieval.getKeyName(), "true");

0 commit comments

Comments
 (0)