Skip to content

Commit 37fadd7

Browse files
n1v0lgn1v0lg
authored
Drop TLS_RSA ciphers from default cipher suites for JDK 24 (#123600) (#123989)
This PR adjusts the list of supported ciphers to reflect ciphers available in JDK 24. JDK 24 [drops](https://bugs.openjdk.org/browse/JDK-8245545) support for `TLS_RSA` suites. These ciphers will no longer be supported in Elasticsearch with a bundled JDK with version >= 24. JDK's of lower versions will continue to support to dropped ciphers. I will follow up this PR with a separate docs PR.
1 parent b1ef8ce commit 37fadd7

File tree

6 files changed

+97
-9
lines changed

6 files changed

+97
-9
lines changed

‎docs/changelog/123600.yaml‎

Lines changed: 17 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,17 @@
1+
pr: 123600
2+
summary: Drop `TLS_RSA` cipher support for JDK 24
3+
area: TLS
4+
type: breaking
5+
issues: []
6+
breaking:
7+
title: Drop `TLS_RSA` cipher support for JDK 24
8+
area: Cluster and node setting
9+
details: >-
10+
This change removes `TLS_RSA` ciphers from the list of default supported ciphers,
11+
for Elasticsearch deployments running on JDK 24.
12+
impact: >-
13+
The dropped ciphers are `TLS_RSA_WITH_AES_256_GCM_SHA384`, `TLS_RSA_WITH_AES_128_GCM_SHA256`,
14+
`TLS_RSA_WITH_AES_256_CBC_SHA256`, `TLS_RSA_WITH_AES_128_CBC_SHA256`, `TLS_RSA_WITH_AES_256_CBC_SHA`,
15+
and `TLS_RSA_WITH_AES_128_CBC_SHA`. TLS connections to Elasticsearch using these ciphers will no longer work.
16+
Please configure your clients to use one of supported cipher suites.
17+
notable: false

‎libs/ssl-config/src/main/java/org/elasticsearch/common/ssl/SslConfigurationLoader.java‎

Lines changed: 39 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -69,7 +69,7 @@ public abstract class SslConfigurationLoader {
6969
: Arrays.asList("TLSv1.2", "TLSv1.1")
7070
);
7171

72-
private static final List<String> JDK12_CIPHERS = List.of(
72+
private static final List<String> PRE_JDK24_CIPHERS = List.of(
7373
// TLSv1.3 cipher has PFS, AEAD, hardware support
7474
"TLS_AES_256_GCM_SHA384",
7575
"TLS_AES_128_GCM_SHA256",
@@ -118,7 +118,44 @@ public abstract class SslConfigurationLoader {
118118
"TLS_RSA_WITH_AES_128_CBC_SHA"
119119
);
120120

121-
static final List<String> DEFAULT_CIPHERS = JDK12_CIPHERS;
121+
private static final List<String> JDK24_CIPHERS = List.of(
122+
// TLSv1.3 cipher has PFS, AEAD, hardware support
123+
"TLS_AES_256_GCM_SHA384",
124+
"TLS_AES_128_GCM_SHA256",
125+
126+
// TLSv1.3 cipher has PFS, AEAD
127+
"TLS_CHACHA20_POLY1305_SHA256",
128+
129+
// PFS, AEAD, hardware support
130+
"TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384",
131+
"TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256",
132+
133+
// PFS, AEAD, hardware support
134+
"TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384",
135+
"TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256",
136+
137+
// PFS, AEAD
138+
"TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256",
139+
"TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256",
140+
141+
// PFS, hardware support
142+
"TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384",
143+
"TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256",
144+
145+
// PFS, hardware support
146+
"TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384",
147+
"TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256",
148+
149+
// PFS, hardware support
150+
"TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA",
151+
"TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA",
152+
153+
// PFS, hardware support
154+
"TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA",
155+
"TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA"
156+
);
157+
158+
static final List<String> DEFAULT_CIPHERS = Runtime.version().feature() < 24 ? PRE_JDK24_CIPHERS : JDK24_CIPHERS;
122159
private static final char[] EMPTY_PASSWORD = new char[0];
123160
public static final List<X509Field> GLOBAL_DEFAULT_RESTRICTED_TRUST_FIELDS = List.of(X509Field.SAN_OTHERNAME_COMMONNAME);
124161

‎x-pack/plugin/core/src/main/java/org/elasticsearch/xpack/core/XPackSettings.java‎

Lines changed: 22 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -212,7 +212,7 @@ public Iterator<Setting<?>> settings() {
212212
Property.NodeScope
213213
);
214214

215-
private static final List<String> JDK12_CIPHERS = List.of(
215+
private static final List<String> PRE_JDK24_CIPHERS = List.of(
216216
"TLS_AES_256_GCM_SHA384",
217217
"TLS_AES_128_GCM_SHA256", // TLSv1.3 cipher has PFS, AEAD, hardware support
218218
"TLS_CHACHA20_POLY1305_SHA256", // TLSv1.3 cipher has PFS, AEAD
@@ -238,7 +238,27 @@ public Iterator<Setting<?>> settings() {
238238
"TLS_RSA_WITH_AES_128_CBC_SHA"
239239
); // hardware support
240240

241-
public static final List<String> DEFAULT_CIPHERS = JDK12_CIPHERS;
241+
private static final List<String> JDK24_CIPHERS = List.of(
242+
"TLS_AES_256_GCM_SHA384",
243+
"TLS_AES_128_GCM_SHA256", // TLSv1.3 cipher has PFS, AEAD, hardware support
244+
"TLS_CHACHA20_POLY1305_SHA256", // TLSv1.3 cipher has PFS, AEAD
245+
"TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384",
246+
"TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", // PFS, AEAD, hardware support
247+
"TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384",
248+
"TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", // PFS, AEAD, hardware support
249+
"TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256",
250+
"TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", // PFS, AEAD
251+
"TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384",
252+
"TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256", // PFS, hardware support
253+
"TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384",
254+
"TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256", // PFS, hardware support
255+
"TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA",
256+
"TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", // PFS, hardware support
257+
"TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA",
258+
"TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA" // PFS, hardware support
259+
); // hardware support
260+
261+
public static final List<String> DEFAULT_CIPHERS = Runtime.version().feature() < 24 ? PRE_JDK24_CIPHERS : JDK24_CIPHERS;
242262

243263
public static final Setting<String> PASSWORD_HASHING_ALGORITHM = defaultStoredPasswordHashAlgorithmSetting(
244264
"xpack.security.authc.password_hashing.algorithm",

‎x-pack/plugin/core/src/test/java/org/elasticsearch/xpack/core/XPackSettingsTests.java‎

Lines changed: 16 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -30,8 +30,22 @@
3030
public class XPackSettingsTests extends ESTestCase {
3131

3232
public void testDefaultSSLCiphers() {
33-
assertThat(XPackSettings.DEFAULT_CIPHERS, hasItem("TLS_RSA_WITH_AES_128_CBC_SHA"));
34-
assertThat(XPackSettings.DEFAULT_CIPHERS, hasItem("TLS_RSA_WITH_AES_256_CBC_SHA"));
33+
assertThat(XPackSettings.DEFAULT_CIPHERS, hasItem("TLS_AES_256_GCM_SHA384"));
34+
assertThat(XPackSettings.DEFAULT_CIPHERS, hasItem("TLS_AES_128_GCM_SHA256"));
35+
assertThat(XPackSettings.DEFAULT_CIPHERS, hasItem("TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256"));
36+
assertThat(XPackSettings.DEFAULT_CIPHERS, hasItem("TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384"));
37+
38+
if (Runtime.version().feature() < 24) {
39+
assertThat(XPackSettings.DEFAULT_CIPHERS, hasItem("TLS_RSA_WITH_AES_256_CBC_SHA256"));
40+
assertThat(XPackSettings.DEFAULT_CIPHERS, hasItem("TLS_RSA_WITH_AES_128_CBC_SHA256"));
41+
assertThat(XPackSettings.DEFAULT_CIPHERS, hasItem("TLS_RSA_WITH_AES_256_CBC_SHA"));
42+
assertThat(XPackSettings.DEFAULT_CIPHERS, hasItem("TLS_RSA_WITH_AES_128_CBC_SHA"));
43+
} else {
44+
assertThat(XPackSettings.DEFAULT_CIPHERS, not(hasItem("TLS_RSA_WITH_AES_256_CBC_SHA256")));
45+
assertThat(XPackSettings.DEFAULT_CIPHERS, not(hasItem("TLS_RSA_WITH_AES_128_CBC_SHA256")));
46+
assertThat(XPackSettings.DEFAULT_CIPHERS, not(hasItem("TLS_RSA_WITH_AES_256_CBC_SHA")));
47+
assertThat(XPackSettings.DEFAULT_CIPHERS, not(hasItem("TLS_RSA_WITH_AES_128_CBC_SHA")));
48+
}
3549
}
3650

3751
public void testChaCha20InCiphersOnJdk12Plus() {

‎x-pack/plugin/core/src/test/java/org/elasticsearch/xpack/core/ssl/SSLConfigurationSettingsTests.java‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -35,15 +35,15 @@ public void testParseCipherSettingsWithoutPrefix() {
3535
final Settings settings = Settings.builder()
3636
.put("cipher_suites.0", "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256")
3737
.put("cipher_suites.1", "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256")
38-
.put("cipher_suites.2", "TLS_RSA_WITH_AES_128_CBC_SHA256")
38+
.put("cipher_suites.2", Runtime.version().feature() < 24 ? "TLS_RSA_WITH_AES_128_CBC_SHA256" : "TLS_AES_256_GCM_SHA384")
3939
.build();
4040
assertThat(
4141
ssl.ciphers.get(settings),
4242
is(
4343
Arrays.asList(
4444
"TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256",
4545
"TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256",
46-
"TLS_RSA_WITH_AES_128_CBC_SHA256"
46+
Runtime.version().feature() < 24 ? "TLS_RSA_WITH_AES_128_CBC_SHA256" : "TLS_AES_256_GCM_SHA384"
4747
)
4848
)
4949
);

‎x-pack/plugin/security/src/test/java/org/elasticsearch/xpack/security/transport/SecurityServerTransportInterceptorTests.java‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1130,7 +1130,7 @@ public void testProfileFiltersCreatedDifferentlyForDifferentTransportAndRemoteCl
11301130
mock(SslKeyConfig.class),
11311131
randomFrom(SslVerificationMode.values()),
11321132
SslClientAuthenticationMode.NONE,
1133-
List.of("TLS_RSA_WITH_AES_256_GCM_SHA384"),
1133+
List.of(Runtime.version().feature() < 24 ? "TLS_RSA_WITH_AES_256_GCM_SHA384" : "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256"),
11341134
List.of("TLSv1.2")
11351135
)
11361136
);

0 commit comments

Comments
 (0)