[CALCITE-2568] Ensure that IBM JDK TLS cipher list matches Oracle/OpenJDK for Travis CI

• Type: Improvement
• Status: Closed
• Priority: Major
• Resolution: Fixed
• Fix Version/s: avatica-1.13.0
• Component/s: avatica
• Assignee: Kevin Risden
• Reporter: Kevin Risden
• Created: 17/Sep/18 17:29
• Updated: 03/Dec/18 00:27
• Resolved: 17/Sep/18 17:51

Description

IBM JDK fails for o.a.c.a.SslDriverTest after update to Jetty 9.4.

ERROR] testReadWrite[0](org.apache.calcite.avatica.SslDriverTest)  Time elapsed: 0.082 s  <<< ERROR!
java.lang.RuntimeException: javax.net.ssl.SSLHandshakeException: Received fatal alert: handshake_failure
	at org.apache.calcite.avatica.SslDriverTest.testReadWrite(SslDriverTest.java:137)
Caused by: javax.net.ssl.SSLHandshakeException: Received fatal alert: handshake_failure
	at org.apache.calcite.avatica.SslDriverTest.testReadWrite(SslDriverTest.java:137)

[ERROR] testReadWrite[1](org.apache.calcite.avatica.SslDriverTest)  Time elapsed: 0.037 s  <<< ERROR!
java.lang.RuntimeException: javax.net.ssl.SSLHandshakeException: Received fatal alert: handshake_failure
	at org.apache.calcite.avatica.SslDriverTest.testReadWrite(SslDriverTest.java:137)
Caused by: javax.net.ssl.SSLHandshakeException: Received fatal alert: handshake_failure
	at org.apache.calcite.avatica.SslDriverTest.testReadWrite(SslDriverTest.java:137)

This seems to be a difference between IBM JDK and Oracle/OpenJDK related to SSL_ vs TLS_ prefixes for ciphers. The fix for this is to force IBM JDK to honor the Oracle/OpenJDK prefixes.

• https://www.ibm.com/developerworks/community/forums/html/topic?id=d34413d1-fc6d-4ea1-9e7b-4e331b591aa9&ps=50
• https://www.ibm.com/support/knowledgecenter/en/SSYKE2_8.0.0/com.ibm.java.security.component.80.doc/security-component/jsse2Docs/matchsslcontext_tls.html

The Java property to add is:

-Dcom.ibm.jsse2.overrideDefaultTLS=true

Oracle/OpenJDK ignores the Java property so we can add the property to .travis.yml to get the tests to pass.

Issue Links

• relates to: CALCITE-2467 Upgrade owasp-dependency-check maven plugin to 3.3.1
• links to: GitHub Pull Request #68