Skip to content

Commit aac29cc

Browse files
n1v0lgn1v0lg
authored
Drop TLS_RSA ciphers from default cipher suites for JDK 24 (#123600) (#123988)
This PR adjusts the list of supported ciphers to reflect ciphers available in JDK 24. JDK 24 [drops](https://bugs.openjdk.org/browse/JDK-8245545) support for `TLS_RSA` suites. These ciphers will no longer be supported in Elasticsearch with a bundled JDK with version >= 24. JDK's of lower versions will continue to support to dropped ciphers. I will follow up this PR with a separate docs PR.
1 parent 9905fa2 commit aac29cc

File tree

6 files changed

+97
-9
lines changed

6 files changed

+97
-9
lines changed

‎docs/changelog/123600.yaml‎

Lines changed: 17 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,17 @@
1+
pr: 123600
2+
summary: Drop `TLS_RSA` cipher support for JDK 24
3+
area: TLS
4+
type: breaking
5+
issues: []
6+
breaking:
7+
title: Drop `TLS_RSA` cipher support for JDK 24
8+
area: Cluster and node setting
9+
details: >-
10+
This change removes `TLS_RSA` ciphers from the list of default supported ciphers,
11+
for Elasticsearch deployments running on JDK 24.
12+
impact: >-
13+
The dropped ciphers are `TLS_RSA_WITH_AES_256_GCM_SHA384`, `TLS_RSA_WITH_AES_128_GCM_SHA256`,
14+
`TLS_RSA_WITH_AES_256_CBC_SHA256`, `TLS_RSA_WITH_AES_128_CBC_SHA256`, `TLS_RSA_WITH_AES_256_CBC_SHA`,
15+
and `TLS_RSA_WITH_AES_128_CBC_SHA`. TLS connections to Elasticsearch using these ciphers will no longer work.
16+
Please configure your clients to use one of supported cipher suites.
17+
notable: false

‎libs/ssl-config/src/main/java/org/elasticsearch/common/ssl/SslConfigurationLoader.java‎

Lines changed: 39 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -62,7 +62,7 @@ public abstract class SslConfigurationLoader {
6262

6363
static final List<String> DEFAULT_PROTOCOLS = List.of("TLSv1.3", "TLSv1.2");
6464

65-
private static final List<String> JDK12_CIPHERS = List.of(
65+
private static final List<String> PRE_JDK24_CIPHERS = List.of(
6666
// TLSv1.3 cipher has PFS, AEAD, hardware support
6767
"TLS_AES_256_GCM_SHA384",
6868
"TLS_AES_128_GCM_SHA256",
@@ -111,7 +111,44 @@ public abstract class SslConfigurationLoader {
111111
"TLS_RSA_WITH_AES_128_CBC_SHA"
112112
);
113113

114-
static final List<String> DEFAULT_CIPHERS = JDK12_CIPHERS;
114+
private static final List<String> JDK24_CIPHERS = List.of(
115+
// TLSv1.3 cipher has PFS, AEAD, hardware support
116+
"TLS_AES_256_GCM_SHA384",
117+
"TLS_AES_128_GCM_SHA256",
118+
119+
// TLSv1.3 cipher has PFS, AEAD
120+
"TLS_CHACHA20_POLY1305_SHA256",
121+
122+
// PFS, AEAD, hardware support
123+
"TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384",
124+
"TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256",
125+
126+
// PFS, AEAD, hardware support
127+
"TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384",
128+
"TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256",
129+
130+
// PFS, AEAD
131+
"TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256",
132+
"TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256",
133+
134+
// PFS, hardware support
135+
"TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384",
136+
"TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256",
137+
138+
// PFS, hardware support
139+
"TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384",
140+
"TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256",
141+
142+
// PFS, hardware support
143+
"TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA",
144+
"TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA",
145+
146+
// PFS, hardware support
147+
"TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA",
148+
"TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA"
149+
);
150+
151+
static final List<String> DEFAULT_CIPHERS = Runtime.version().feature() < 24 ? PRE_JDK24_CIPHERS : JDK24_CIPHERS;
115152
private static final char[] EMPTY_PASSWORD = new char[0];
116153
public static final List<X509Field> GLOBAL_DEFAULT_RESTRICTED_TRUST_FIELDS = List.of(X509Field.SAN_OTHERNAME_COMMONNAME);
117154

‎x-pack/plugin/core/src/main/java/org/elasticsearch/xpack/core/XPackSettings.java‎

Lines changed: 22 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -212,7 +212,7 @@ public Iterator<Setting<?>> settings() {
212212
Property.NodeScope
213213
);
214214

215-
private static final List<String> JDK12_CIPHERS = List.of(
215+
private static final List<String> PRE_JDK24_CIPHERS = List.of(
216216
"TLS_AES_256_GCM_SHA384",
217217
"TLS_AES_128_GCM_SHA256", // TLSv1.3 cipher has PFS, AEAD, hardware support
218218
"TLS_CHACHA20_POLY1305_SHA256", // TLSv1.3 cipher has PFS, AEAD
@@ -238,7 +238,27 @@ public Iterator<Setting<?>> settings() {
238238
"TLS_RSA_WITH_AES_128_CBC_SHA"
239239
); // hardware support
240240

241-
public static final List<String> DEFAULT_CIPHERS = JDK12_CIPHERS;
241+
private static final List<String> JDK24_CIPHERS = List.of(
242+
"TLS_AES_256_GCM_SHA384",
243+
"TLS_AES_128_GCM_SHA256", // TLSv1.3 cipher has PFS, AEAD, hardware support
244+
"TLS_CHACHA20_POLY1305_SHA256", // TLSv1.3 cipher has PFS, AEAD
245+
"TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384",
246+
"TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", // PFS, AEAD, hardware support
247+
"TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384",
248+
"TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", // PFS, AEAD, hardware support
249+
"TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256",
250+
"TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", // PFS, AEAD
251+
"TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384",
252+
"TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256", // PFS, hardware support
253+
"TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384",
254+
"TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256", // PFS, hardware support
255+
"TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA",
256+
"TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", // PFS, hardware support
257+
"TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA",
258+
"TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA" // PFS, hardware support
259+
); // hardware support
260+
261+
public static final List<String> DEFAULT_CIPHERS = Runtime.version().feature() < 24 ? PRE_JDK24_CIPHERS : JDK24_CIPHERS;
242262

243263
public static final Setting<String> PASSWORD_HASHING_ALGORITHM = defaultStoredPasswordHashAlgorithmSetting(
244264
"xpack.security.authc.password_hashing.algorithm",

‎x-pack/plugin/core/src/test/java/org/elasticsearch/xpack/core/XPackSettingsTests.java‎

Lines changed: 16 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -30,8 +30,22 @@
3030
public class XPackSettingsTests extends ESTestCase {
3131

3232
public void testDefaultSSLCiphers() {
33-
assertThat(XPackSettings.DEFAULT_CIPHERS, hasItem("TLS_RSA_WITH_AES_128_CBC_SHA"));
34-
assertThat(XPackSettings.DEFAULT_CIPHERS, hasItem("TLS_RSA_WITH_AES_256_CBC_SHA"));
33+
assertThat(XPackSettings.DEFAULT_CIPHERS, hasItem("TLS_AES_256_GCM_SHA384"));
34+
assertThat(XPackSettings.DEFAULT_CIPHERS, hasItem("TLS_AES_128_GCM_SHA256"));
35+
assertThat(XPackSettings.DEFAULT_CIPHERS, hasItem("TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256"));
36+
assertThat(XPackSettings.DEFAULT_CIPHERS, hasItem("TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384"));
37+
38+
if (Runtime.version().feature() < 24) {
39+
assertThat(XPackSettings.DEFAULT_CIPHERS, hasItem("TLS_RSA_WITH_AES_256_CBC_SHA256"));
40+
assertThat(XPackSettings.DEFAULT_CIPHERS, hasItem("TLS_RSA_WITH_AES_128_CBC_SHA256"));
41+
assertThat(XPackSettings.DEFAULT_CIPHERS, hasItem("TLS_RSA_WITH_AES_256_CBC_SHA"));
42+
assertThat(XPackSettings.DEFAULT_CIPHERS, hasItem("TLS_RSA_WITH_AES_128_CBC_SHA"));
43+
} else {
44+
assertThat(XPackSettings.DEFAULT_CIPHERS, not(hasItem("TLS_RSA_WITH_AES_256_CBC_SHA256")));
45+
assertThat(XPackSettings.DEFAULT_CIPHERS, not(hasItem("TLS_RSA_WITH_AES_128_CBC_SHA256")));
46+
assertThat(XPackSettings.DEFAULT_CIPHERS, not(hasItem("TLS_RSA_WITH_AES_256_CBC_SHA")));
47+
assertThat(XPackSettings.DEFAULT_CIPHERS, not(hasItem("TLS_RSA_WITH_AES_128_CBC_SHA")));
48+
}
3549
}
3650

3751
public void testChaCha20InCiphersOnJdk12Plus() {

‎x-pack/plugin/core/src/test/java/org/elasticsearch/xpack/core/ssl/SSLConfigurationSettingsTests.java‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -35,15 +35,15 @@ public void testParseCipherSettingsWithoutPrefix() {
3535
final Settings settings = Settings.builder()
3636
.put("cipher_suites.0", "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256")
3737
.put("cipher_suites.1", "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256")
38-
.put("cipher_suites.2", "TLS_RSA_WITH_AES_128_CBC_SHA256")
38+
.put("cipher_suites.2", Runtime.version().feature() < 24 ? "TLS_RSA_WITH_AES_128_CBC_SHA256" : "TLS_AES_256_GCM_SHA384")
3939
.build();
4040
assertThat(
4141
ssl.ciphers.get(settings),
4242
is(
4343
Arrays.asList(
4444
"TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256",
4545
"TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256",
46-
"TLS_RSA_WITH_AES_128_CBC_SHA256"
46+
Runtime.version().feature() < 24 ? "TLS_RSA_WITH_AES_128_CBC_SHA256" : "TLS_AES_256_GCM_SHA384"
4747
)
4848
)
4949
);

‎x-pack/plugin/security/src/test/java/org/elasticsearch/xpack/security/transport/SecurityServerTransportInterceptorTests.java‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1130,7 +1130,7 @@ public void testProfileFiltersCreatedDifferentlyForDifferentTransportAndRemoteCl
11301130
mock(SslKeyConfig.class),
11311131
randomFrom(SslVerificationMode.values()),
11321132
SslClientAuthenticationMode.NONE,
1133-
List.of("TLS_RSA_WITH_AES_256_GCM_SHA384"),
1133+
List.of(Runtime.version().feature() < 24 ? "TLS_RSA_WITH_AES_256_GCM_SHA384" : "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256"),
11341134
List.of("TLSv1.2")
11351135
)
11361136
);

0 commit comments

Comments
 (0)