Skip to content

ZOOKEEPER-5045: Fall back to TLSv1.2 default in FIPS mode #2383

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
PDavid wants to merge 3 commits into
base: branch-3.9
Choose a base branch
from
Open

ZOOKEEPER-5045: Fall back to TLSv1.2 default in FIPS mode #2383

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
bdef4a3
ZOOKEEPER-5045: Fall back to TLSv1.2 default in FIPS mode
PDavid May 7, 2026
20edc1b
ZOOKEEPER-5045: Fix ClientX509Util
PDavid May 7, 2026
9aae22e
ZOOKEEPER-5045: Fix SSLHostnameVerificationTest tests
PDavid May 8, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 1 addition & 1 deletion zookeeper-server/src/main/java/org/apache/zookeeper/common/ClientX509Util.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -172,7 +172,7 @@ protected void initEngine(SSLEngine sslEngine) {
private String[] getEnabledProtocols(final ZKConfig config) {
String enabledProtocolsInput = config.getProperty(getSslEnabledProtocolsProperty());
if (enabledProtocolsInput == null) {
return new String[]{ config.getProperty(getSslProtocolProperty(), DEFAULT_PROTOCOL) };
return null;
}
return enabledProtocolsInput.split(",");
}
Expand Down
36 changes: 24 additions & 12 deletions zookeeper-server/src/main/java/org/apache/zookeeper/common/X509Util.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -35,7 +35,6 @@
import java.security.cert.PKIXBuilderParameters;
import java.security.cert.PKIXRevocationChecker;
import java.security.cert.X509CertSelector;
import java.util.ArrayList;
import java.util.Arrays;
import java.util.HashSet;
import java.util.List;
Expand Down Expand Up @@ -95,25 +94,38 @@ public abstract class X509Util implements Closeable, AutoCloseable {
}
}

public static final String DEFAULT_PROTOCOL = defaultTlsProtocol();
private static final AtomicReference<String> defaultProtocol = new AtomicReference<>();

/**
* Return TLSv1.3 or TLSv1.2 depending on Java runtime version being used.
* Return TLSv1.2 when FIPS mode is enabled.
* Otherwise, returns TLSv1.3 or TLSv1.2 depending on Java runtime version being used.
* TLSv1.3 was first introduced in JDK11 and back-ported to OpenJDK 8u272.
*/
private static String defaultTlsProtocol() {
String defaultProtocol = TLS_1_2;
List<String> supported = new ArrayList<>();
public static String defaultTlsProtocol(ZKConfig config) {
if (getFipsMode(config)) {
return TLS_1_2;
}

String proto = defaultProtocol.get();
if (proto != null) {
return proto;
}

proto = TLS_1_2;
try {
supported = Arrays.asList(SSLContext.getDefault().getSupportedSSLParameters().getProtocols());
List<String> supported = Arrays.asList(SSLContext.getDefault().getSupportedSSLParameters().getProtocols());
if (supported.contains(TLS_1_3)) {
defaultProtocol = TLS_1_3;
proto = TLS_1_3;
}
if (defaultProtocol.compareAndSet(null, proto)) {
LOG.info("Supported TLS protocols are {}, default TLS protocol is {}", supported, proto);
} else {
proto = defaultProtocol.get();
}
} catch (NoSuchAlgorithmException e) {
// Ignore.
}
LOG.info("Default TLS protocol is {}, supported TLS protocols are {}", defaultProtocol, supported);
return defaultProtocol;
return proto;
}

// ChaCha20 was introduced in OpenJDK 11.0.15 and it is not supported by JDK8.
Expand Down Expand Up @@ -467,8 +479,8 @@ public SSLContextAndOptions createSSLContextAndOptionsFromConfig(ZKConfig config
+ trustStoreTypeProp, e);
}
}

String protocol = config.getProperty(sslProtocolProperty, DEFAULT_PROTOCOL);
String defaultTlsProtocol = defaultTlsProtocol(config);
String protocol = config.getProperty(sslProtocolProperty, defaultTlsProtocol);
try {
SSLContext sslContext = SSLContext.getInstance(protocol);
sslContext.init(keyManagers, trustManagers, null);
Expand Down
33 changes: 26 additions & 7 deletions zookeeper-server/src/test/java/org/apache/zookeeper/common/X509UtilTest.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -18,6 +18,9 @@

package org.apache.zookeeper.common;

import static org.apache.zookeeper.common.X509Util.FIPS_MODE_PROPERTY;
import static org.apache.zookeeper.common.X509Util.TLS_1_2;
import static org.apache.zookeeper.common.X509Util.TLS_1_3;
import static org.junit.jupiter.api.Assertions.assertArrayEquals;
import static org.junit.jupiter.api.Assertions.assertEquals;
import static org.junit.jupiter.api.Assertions.assertThrows;
Expand Down Expand Up @@ -90,6 +93,7 @@ public void cleanUp() {
System.clearProperty(x509Util.getSslHandshakeDetectionTimeoutMillisProperty());
System.clearProperty(ServerCnxnFactory.ZOOKEEPER_SERVER_CNXN_FACTORY);
System.clearProperty(ZKClientConfig.ZOOKEEPER_CLIENT_CNXN_SOCKET);
System.clearProperty(FIPS_MODE_PROPERTY);
x509Util.close();
}

Expand All @@ -100,24 +104,39 @@ public void testCreateSSLContextWithoutCustomProtocol(
X509KeyType caKeyType, X509KeyType certKeyType, String keyPassword, Integer paramIndex)
throws Exception {
init(caKeyType, certKeyType, keyPassword, paramIndex);
System.setProperty(FIPS_MODE_PROPERTY, Boolean.FALSE.toString());
SSLContext sslContext = x509Util.getDefaultSSLContext();
assertEquals(X509Util.DEFAULT_PROTOCOL, sslContext.getProtocol());
String defaultTlsProtocol = X509Util.defaultTlsProtocol(new ZKConfig());
assertEquals(defaultTlsProtocol, sslContext.getProtocol());

// Check that TLSv1.3 is selected in JDKs that support it (OpenJDK 8u272 and later).
List<String> supported = Arrays.asList(SSLContext.getDefault().getSupportedSSLParameters().getProtocols());
if (supported.contains(X509Util.TLS_1_3)) {
if (supported.contains(TLS_1_3)) {
// SSLContext protocol.
assertEquals(X509Util.TLS_1_3, sslContext.getProtocol());
assertEquals(TLS_1_3, sslContext.getProtocol());
// Enabled protocols.
List<String> protos = Arrays.asList(sslContext.getDefaultSSLParameters().getProtocols());
assertTrue(protos.contains(X509Util.TLS_1_2));
assertTrue(protos.contains(X509Util.TLS_1_3));
assertTrue(protos.contains(TLS_1_2));
assertTrue(protos.contains(TLS_1_3));
} else {
assertEquals(X509Util.TLS_1_2, sslContext.getProtocol());
assertArrayEquals(new String[]{X509Util.TLS_1_2}, sslContext.getDefaultSSLParameters().getProtocols());
assertEquals(TLS_1_2, sslContext.getProtocol());
assertArrayEquals(new String[]{TLS_1_2}, sslContext.getDefaultSSLParameters().getProtocols());
}
}

@ParameterizedTest
@MethodSource("data")
@Timeout(value = 5)
public void testCreateSSLContextFIPSModeEnabled(
X509KeyType caKeyType, X509KeyType certKeyType, String keyPassword, Integer paramIndex)
throws Exception {
init(caKeyType, certKeyType, keyPassword, paramIndex);
System.setProperty(FIPS_MODE_PROPERTY, Boolean.TRUE.toString());
SSLContext sslContext = x509Util.getDefaultSSLContext();
assertEquals(TLS_1_2, sslContext.getProtocol());
assertArrayEquals(new String[]{TLS_1_2}, sslContext.getDefaultSSLParameters().getProtocols());
}

@ParameterizedTest
@MethodSource("data")
@Timeout(value = 5)
Expand Down
5 changes: 4 additions & 1 deletion zookeeper-server/src/test/java/org/apache/zookeeper/server/admin/CommandAuthTest.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -48,6 +48,8 @@
import org.apache.zookeeper.common.ClientX509Util;
import org.apache.zookeeper.common.QuorumX509Util;
import org.apache.zookeeper.common.X509Exception;
import org.apache.zookeeper.common.X509Util;
import org.apache.zookeeper.common.ZKConfig;
import org.apache.zookeeper.data.ACL;
import org.apache.zookeeper.data.Id;
import org.apache.zookeeper.server.NettyServerCnxnFactory;
Expand Down Expand Up @@ -281,7 +283,8 @@ private void setupTLS() throws Exception {
System.setProperty("zookeeper.admin.needClientAuth", "true");

// create SSLContext
final SSLContext sslContext = SSLContext.getInstance(ClientX509Util.DEFAULT_PROTOCOL);
String defaultTlsProtocol = X509Util.defaultTlsProtocol(new ZKConfig());
final SSLContext sslContext = SSLContext.getInstance(defaultTlsProtocol);
final X509AuthenticationProvider authProvider = (X509AuthenticationProvider) ProviderRegistry.getProvider("x509");
if (authProvider == null) {
throw new X509Exception.SSLContextException("Could not create SSLContext with x509 auth provider");
Expand Down
Loading