ZOOKEEPER-5045: Fall back to TLSv1.2 default in FIPS mode

[PDavid]

No description provided.

[anmolnar]

@PDavid Thanks for the patch. Overall lgtm. Just a few comments.

[anmolnar]

I'm still not sure about whether this should be 1.3 or 1.2

[PDavid]

Hmm, X509UtilTest.testCreateSSLContext* tests failed in the PR build. I'll have a look.

[anmolnar]

How about the following?
No static field needed.

    private final AtomicReference<String> defaultProtocol = new AtomicReference<>();

    /**
     * Return TLSv1.2 when FIPS mode is enabled.
     * Otherwise, returns TLSv1.3 or TLSv1.2 depending on Java runtime version being used.
     * TLSv1.3 was first introduced in JDK11 and back-ported to OpenJDK 8u272.
     */
    public String defaultTlsProtocol(ZKConfig config) {
        String proto = defaultProtocol.get();
        if (proto != null) {
            return proto;
        }
        String protocol = TLS_1_2;
        if (!getFipsMode(config)) {
            List<String> supported = new ArrayList<>();
            try {
                supported = Arrays.asList(SSLContext.getDefault().getSupportedSSLParameters().getProtocols());
                LOG.info("Supported TLS protocols are {}", supported);
                if (supported.contains(TLS_1_3)) {
                    protocol = TLS_1_3;
                }
            } catch (NoSuchAlgorithmException e) {
                // Ignore.
            }
        }
        if (defaultProtocol.compareAndSet(null, protocol)) {
            LOG.info("Default TLS protocol is {}", protocol);
        } else {
            protocol = defaultProtocol.get();
        }
        return protocol;
    }

[anmolnar]

@meszibalu Actually it could be static/singleton, we don't need to calculate it for every single instance, do we?

[anmolnar]

I don't think we can implement a test like this. SSLContext.getDefault() will cache the problem and subsequent tests will fail even if the properties are reverted.