JdkSslContext produces invalid supported ciphers

[slandelle]

Expected behavior

JdkSslContext should produce valid ciphers that are actually supported by the platform.
Typically, it should be possible to use them in a custom CipherSuiteFilter to configure a SSLEngine.

Actual behavior

Netty 4.1.13.Final introduced a workaround for IBM certs naming scheme.
This workaround is based on IBM's statement:

According to IBM's documentation [2] the "SSL_" prefix is "interchangeable" with the "TLS_" prefix.

This statement is wrong and transformed names cause SSLEngine#setEnabledCipherSuites to crash.

On my machine, the following ciphers get transformed with the SSL prefix being replaced with TLS and cause SSLEngine to crash:

• SSL_DH_anon_WITH_DES_CBC_SHA
• SSL_DHE_DSS_WITH_3DES_EDE_CBC_SHA
• SSL_DH_anon_WITH_3DES_EDE_CBC_SHA
• SSL_DHE_RSA_WITH_DES_CBC_SHA
• SSL_RSA_WITH_DES_CBC_SHA
• SSL_DHE_DSS_WITH_DES_CBC_SHA
• SSL_RSA_WITH_NULL_SHA
• SSL_RSA_WITH_3DES_EDE_CBC_SHA
• SSL_RSA_WITH_NULL_MD5
• SSL_DHE_RSA_WITH_3DES_EDE_CBC_SHA

Steps to reproduce

See reproducer below.

Minimal yet complete reproducer code (or URL to code)

SSLContext sslcontext = SSLContext.getInstance("TLS");
sslcontext.init(null, null, null);
SSLEngine sslEngine = sslcontext.createSSLEngine();

// works
sslEngine.setEnabledCipherSuites(new String[] {"SSL_DH_anon_WITH_DES_CBC_SHA"});

// crashes with IllegalArgumentException: Unsupported ciphersuite TLS_DH_anon_WITH_DES_CBC_SHA
sslEngine.setEnabledCipherSuites(new String[] {"TLS_DH_anon_WITH_DES_CBC_SHA"});

Netty version

Tested on 4.1.20.Final

JVM version (e.g. java -version)

Java HotSpot(TM) 64-Bit Server VM (build 25.152-b16, mixed mode)

OS version (e.g. uname -a)

Not relevant

[normanmaurer]

@slandelle are you sure this was introduced in 4.1.20 ?

[slandelle]

@normanmaurer This renaming was introduced in 449befa which is tagged as 4.1.20.

[slandelle]

My bad, I didn't get what those tags meant in the GH interface. I guess it's from 4.1.13.

[slandelle]

I guess this went unnoticed as SslUtils#DEFAULT_CIPHER_SUITES only contains names prefixed with TLS.

[johnou]

cc @Scottmitch @rkapsi

[Scottmitch]

http://docs.oracle.com/javase/8/docs/technotes/guides/security/StandardNames.html#ciphersuites

The names mentioned in the TLS RFCs prefixed with TLS_ are functionally equivalent to the JSSE cipher suites prefixed with SSL_.

Arg. I guess the names aren't quite interchangeable. See #7677