[CASSANDRA-3278] SSLFactory should not enable cipher suites that aren't supported

• Type: Bug
• Status: Resolved
• Priority: Low
• Resolution: Fixed
• Fix Version/s: 1.0.5

Environment

OpenJDK on debian squeeze

• Severity: Low
• Assignee: Vijay
• Reporter: George

Authors

Vijay

Reviewers

Brandon Williams

• Created: 29/Sep/11 18:21
• Updated: 16/Apr/19 09:32
• Resolved: 29/Nov/11 16:42

Description

The socket creation (server or otherwise) in SSLFactory.java calls setEnabledCipherSuites with the values specified in EncryptionOptions.java:

public String[] cipherSuites = {
    "TLS_RSA_WITH_AES_128_CBC_SHA", 
    "TLS_RSA_WITH_AES_256_CBC_SHA"
};

The call to setEnabledCipherSuites fails on systems that don't have Java Cryptography Extension (JCE) Unlimited Strength Jurisdiction Policy Files 6 because AES256 is not supported.

To avoid installing the unlimited strength policy file the code in SSLFactory.java should call getSupportedCipherSuites to find out which of the suites specified are supported.

Thanks,
George