Skip to content

Commit 673db85

Browse files
jaymodejaymode
authored
Add ChaCha20 TLS ciphers on Java 12+ (#42155)
Java 12 added support for the ChaCha20 TLS ciphers, so this change conditionally adds these ciphers to the default ciphers if the JVM is Java 12 or later.
1 parent 7e0ffae commit 673db85

File tree

4 files changed

+72
-5
lines changed

4 files changed

+72
-5
lines changed

‎libs/ssl-config/src/main/java/org/elasticsearch/common/ssl/SslConfigurationLoader.java

Lines changed: 20 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -19,6 +19,8 @@
1919

2020
package org.elasticsearch.common.ssl;
2121

22+
import org.elasticsearch.bootstrap.JavaVersion;
23+
2224
import javax.net.ssl.KeyManagerFactory;
2325
import javax.net.ssl.TrustManagerFactory;
2426
import java.nio.file.Path;
@@ -66,10 +68,7 @@ public abstract class SslConfigurationLoader {
6668

6769
static final List<String> DEFAULT_PROTOCOLS = List.of("TLSv1.3", "TLSv1.2", "TLSv1.1");
6870

69-
/**
70-
* This list has been created with ordering
71-
*/
72-
static final List<String> DEFAULT_CIPHERS = List.of(
71+
private static final List<String> JDK11_CIPHERS = List.of(
7372
"TLS_AES_256_GCM_SHA384", "TLS_AES_128_GCM_SHA256", // TLSv1.3 cipher has PFS, AEAD, hardware support
7473
"TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", // PFS, AEAD, hardware support
7574
"TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", // PFS, AEAD, hardware support
@@ -80,6 +79,23 @@ public abstract class SslConfigurationLoader {
8079
"TLS_RSA_WITH_AES_256_GCM_SHA384", "TLS_RSA_WITH_AES_128_GCM_SHA256", // AEAD, hardware support
8180
"TLS_RSA_WITH_AES_256_CBC_SHA256", "TLS_RSA_WITH_AES_128_CBC_SHA256", // hardware support
8281
"TLS_RSA_WITH_AES_256_CBC_SHA", "TLS_RSA_WITH_AES_128_CBC_SHA"); // hardware support
82+
83+
private static final List<String> JDK12_CIPHERS = List.of(
84+
"TLS_AES_256_GCM_SHA384", "TLS_AES_128_GCM_SHA256", // TLSv1.3 cipher has PFS, AEAD, hardware support
85+
"TLS_CHACHA20_POLY1305_SHA256", // TLSv1.3 cipher has PFS, AEAD
86+
"TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", // PFS, AEAD, hardware support
87+
"TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", // PFS, AEAD, hardware support
88+
"TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", // PFS, AEAD
89+
"TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384", "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256", // PFS, hardware support
90+
"TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384", "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256", // PFS, hardware support
91+
"TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", // PFS, hardware support
92+
"TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", // PFS, hardware support
93+
"TLS_RSA_WITH_AES_256_GCM_SHA384", "TLS_RSA_WITH_AES_128_GCM_SHA256", // AEAD, hardware support
94+
"TLS_RSA_WITH_AES_256_CBC_SHA256", "TLS_RSA_WITH_AES_128_CBC_SHA256", // hardware support
95+
"TLS_RSA_WITH_AES_256_CBC_SHA", "TLS_RSA_WITH_AES_128_CBC_SHA"); // hardware support
96+
97+
static final List<String> DEFAULT_CIPHERS =
98+
JavaVersion.current().compareTo(JavaVersion.parse("12")) > -1 ? JDK12_CIPHERS : JDK11_CIPHERS;
8399
private static final char[] EMPTY_PASSWORD = new char[0];
84100

85101
private final String settingPrefix;

‎libs/ssl-config/src/test/java/org/elasticsearch/common/ssl/SslConfigurationLoaderTests.java

Lines changed: 17 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -19,6 +19,7 @@
1919

2020
package org.elasticsearch.common.ssl;
2121

22+
import org.elasticsearch.bootstrap.JavaVersion;
2223
import org.elasticsearch.common.settings.MockSecureSettings;
2324
import org.elasticsearch.common.settings.SecureString;
2425
import org.elasticsearch.common.settings.Settings;
@@ -33,8 +34,10 @@
3334

3435
import static org.hamcrest.Matchers.containsInAnyOrder;
3536
import static org.hamcrest.Matchers.equalTo;
37+
import static org.hamcrest.Matchers.hasItem;
3638
import static org.hamcrest.Matchers.instanceOf;
3739
import static org.hamcrest.Matchers.is;
40+
import static org.hamcrest.Matchers.not;
3841
import static org.hamcrest.Matchers.notNullValue;
3942

4043
public class SslConfigurationLoaderTests extends ESTestCase {
@@ -217,4 +220,18 @@ public void testLoadKeysFromJKS() {
217220
assertThat(keyConfig.getDependentFiles(), containsInAnyOrder(getDataPath("/certs/cert-all/certs.jks")));
218221
assertThat(keyConfig.createKeyManager(), notNullValue());
219222
}
223+
224+
public void testChaCha20InCiphersOnJdk12Plus() {
225+
assumeTrue("Test is only valid on JDK 12+ JVM", JavaVersion.current().compareTo(JavaVersion.parse("12")) > -1);
226+
assertThat(SslConfigurationLoader.DEFAULT_CIPHERS, hasItem("TLS_CHACHA20_POLY1305_SHA256"));
227+
assertThat(SslConfigurationLoader.DEFAULT_CIPHERS, hasItem("TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256"));
228+
assertThat(SslConfigurationLoader.DEFAULT_CIPHERS, hasItem("TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256"));
229+
}
230+
231+
public void testChaCha20NotInCiphersOnPreJdk12() {
232+
assumeTrue("Test is only valid on pre JDK 12 JVM", JavaVersion.current().compareTo(JavaVersion.parse("12")) < 0);
233+
assertThat(SslConfigurationLoader.DEFAULT_CIPHERS, not(hasItem("TLS_CHACHA20_POLY1305_SHA256")));
234+
assertThat(SslConfigurationLoader.DEFAULT_CIPHERS, not(hasItem("TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256")));
235+
assertThat(SslConfigurationLoader.DEFAULT_CIPHERS, not(hasItem("TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256")));
236+
}
220237
}

‎x-pack/plugin/core/src/main/java/org/elasticsearch/xpack/core/XPackSettings.java

Lines changed: 19 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -6,6 +6,7 @@
66

77
package org.elasticsearch.xpack.core;
88

9+
import org.elasticsearch.bootstrap.JavaVersion;
910
import org.elasticsearch.common.settings.Setting;
1011
import org.elasticsearch.common.settings.Setting.Property;
1112
import org.elasticsearch.xpack.core.security.SecurityField;
@@ -117,7 +118,7 @@ private XPackSettings() {
117118
* SSL settings. These are the settings that are specifically registered for SSL. Many are private as we do not explicitly use them
118119
* but instead parse based on a prefix (eg *.ssl.*)
119120
*/
120-
public static final List<String> DEFAULT_CIPHERS = List.of(
121+
private static final List<String> JDK11_CIPHERS = List.of(
121122
"TLS_AES_256_GCM_SHA384", "TLS_AES_128_GCM_SHA256", // TLSv1.3 cipher has PFS, AEAD, hardware support
122123
"TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", // PFS, AEAD, hardware support
123124
"TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", // PFS, AEAD, hardware support
@@ -129,6 +130,23 @@ private XPackSettings() {
129130
"TLS_RSA_WITH_AES_256_CBC_SHA256", "TLS_RSA_WITH_AES_128_CBC_SHA256", // hardware support
130131
"TLS_RSA_WITH_AES_256_CBC_SHA", "TLS_RSA_WITH_AES_128_CBC_SHA"); // hardware support
131132

133+
private static final List<String> JDK12_CIPHERS = List.of(
134+
"TLS_AES_256_GCM_SHA384", "TLS_AES_128_GCM_SHA256", // TLSv1.3 cipher has PFS, AEAD, hardware support
135+
"TLS_CHACHA20_POLY1305_SHA256", // TLSv1.3 cipher has PFS, AEAD
136+
"TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", // PFS, AEAD, hardware support
137+
"TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", // PFS, AEAD, hardware support
138+
"TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", // PFS, AEAD
139+
"TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384", "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256", // PFS, hardware support
140+
"TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384", "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256", // PFS, hardware support
141+
"TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", // PFS, hardware support
142+
"TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", // PFS, hardware support
143+
"TLS_RSA_WITH_AES_256_GCM_SHA384", "TLS_RSA_WITH_AES_128_GCM_SHA256", // AEAD, hardware support
144+
"TLS_RSA_WITH_AES_256_CBC_SHA256", "TLS_RSA_WITH_AES_128_CBC_SHA256", // hardware support
145+
"TLS_RSA_WITH_AES_256_CBC_SHA", "TLS_RSA_WITH_AES_128_CBC_SHA"); // hardware support
146+
147+
public static final List<String> DEFAULT_CIPHERS =
148+
JavaVersion.current().compareTo(JavaVersion.parse("12")) > -1 ? JDK12_CIPHERS : JDK11_CIPHERS;
149+
132150
/*
133151
* Do not allow insecure hashing algorithms to be used for password hashing
134152
*/

‎x-pack/plugin/core/src/test/java/org/elasticsearch/xpack/core/XPackSettingsTests.java

Lines changed: 16 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -5,6 +5,7 @@
55
*/
66
package org.elasticsearch.xpack.core;
77

8+
import org.elasticsearch.bootstrap.JavaVersion;
89
import org.elasticsearch.common.settings.Settings;
910
import org.elasticsearch.test.ESTestCase;
1011
import javax.crypto.SecretKeyFactory;
@@ -14,6 +15,7 @@
1415
import static org.hamcrest.Matchers.contains;
1516
import static org.hamcrest.Matchers.containsString;
1617
import static org.hamcrest.Matchers.hasItem;
18+
import static org.hamcrest.Matchers.not;
1719

1820
public class XPackSettingsTests extends ESTestCase {
1921

@@ -22,6 +24,20 @@ public void testDefaultSSLCiphers() {
2224
assertThat(XPackSettings.DEFAULT_CIPHERS, hasItem("TLS_RSA_WITH_AES_256_CBC_SHA"));
2325
}
2426

27+
public void testChaCha20InCiphersOnJdk12Plus() {
28+
assumeTrue("Test is only valid on JDK 12+ JVM", JavaVersion.current().compareTo(JavaVersion.parse("12")) > -1);
29+
assertThat(XPackSettings.DEFAULT_CIPHERS, hasItem("TLS_CHACHA20_POLY1305_SHA256"));
30+
assertThat(XPackSettings.DEFAULT_CIPHERS, hasItem("TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256"));
31+
assertThat(XPackSettings.DEFAULT_CIPHERS, hasItem("TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256"));
32+
}
33+
34+
public void testChaCha20NotInCiphersOnPreJdk12() {
35+
assumeTrue("Test is only valid on pre JDK 12 JVM", JavaVersion.current().compareTo(JavaVersion.parse("12")) < 0);
36+
assertThat(XPackSettings.DEFAULT_CIPHERS, not(hasItem("TLS_CHACHA20_POLY1305_SHA256")));
37+
assertThat(XPackSettings.DEFAULT_CIPHERS, not(hasItem("TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256")));
38+
assertThat(XPackSettings.DEFAULT_CIPHERS, not(hasItem("TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256")));
39+
}
40+
2541
public void testPasswordHashingAlgorithmSettingValidation() {
2642
final boolean isPBKDF2Available = isSecretkeyFactoryAlgoAvailable("PBKDF2WithHMACSHA512");
2743
final String pbkdf2Algo = randomFrom("PBKDF2_10000", "PBKDF2");

0 commit comments

Comments
 (0)