[GOBBLIN-2238]Remove unsupported ChaCha20 cipher suites from default SSL configuration #4153
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Dear Gobblin maintainers,
Please accept this PR. I understand that it will not be reviewed until I have checked off all the steps below!
JIRA
https://issues.apache.org/jira/browse/GOBBLIN-2238
Description
Details :
This PR removes the TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256 and
TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256 cipher suites from Gobblin’s default gRPC SSL configuration.
These cipher suites are not supported on Java 8 (1.8.0_282 and below), and their presence was causing:
java.lang.IllegalArgumentException: Unsupported CipherSuite: TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256
when Gobblin Temporal master or Yarn containers attempted to initialize SSL/TLS contexts during job startup.
Affected flows used Java 8u282 (java.home=/export/apps/jdk/JDK-1_8_0_282-msft/jre)
Successful flows used Java 8u172 (java.home=/export/apps/jdk/JDK-1_8_0_172/jre)
The issue surfaced because newer JDK 8 builds perform stricter cipher validation than older ones.
Fix:
Removed ChaCha20-based ciphers from the default SSL_CONFIG_DEFAULT_CIPHER_SUITES.
Retained AES-GCM-based ciphers required for HTTP/2 and supported on all JDK 8+ versions:
TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256
TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384
TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256
TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384
.
Tests
Commits