8279164: Disable TLS_ECDH_* cipher suites

[zzambers]

Backport disables TLS_ECDH_* cipher suites.

Not clean. Differences:

• there is more than one java.security file on 8u (one per system), because it does not have JDK-6997010 (Consolidate java.security files into one file with modifications)
• changeset to test/jdk/javax/net/ssl/DTLS/CipherSuite.java is excluded, as there is no equivalent test on 8u, support for DTLS was only added in 9 by JDK-8043758 (JEP 219: Datagram Transport Layer Security (DTLS))
• Parts of changeset to remaining files had to be done by hand, because of some context differences, as there are some intermediate changes not backported to 8u. (e.g. JDK-8163327 (Remove 3DES from the default enabled cipher suites list))

Testing:
tier1: OK (only known CAInterop failures)
jdk_security: OK (tested with modified GHA on top, modified security tests (by backport) passed, no regressions to master)

---

Progress

• Change must be properly reviewed (1 review required, with at least 1 Reviewer)
• JDK-8279164 needs maintainer approval
• Change must not contain extraneous whitespace
• Commit message must refer to an issue
• Change requires CSR request JDK-8332812 to be approved

Issues

• JDK-8279164: Disable TLS_ECDH_* cipher suites (Enhancement - P3 - Approved)
• JDK-8332812: Disable TLS_ECDH_* cipher suites (CSR)

Reviewers

• Severin Gehwolf (@jerboaa - Reviewer)
• Andrew John Hughes (@gnu-andrew - Reviewer)
• Martin Balao (@martinuy - Reviewer)

Reviewing

Using git

Checkout this PR locally:
$ git fetch https://git.openjdk.org/jdk8u-dev.git pull/519/head:pull/519
$ git checkout pull/519

Update a local copy of the PR:
$ git checkout pull/519
$ git pull https://git.openjdk.org/jdk8u-dev.git pull/519/head

Using Skara CLI tools

Checkout this PR locally:
$ git pr checkout 519

View PR using the GUI difftool:
$ git pr show -t 519

Using diff file

Download this PR as a diff file:
https://git.openjdk.org/jdk8u-dev/pull/519.diff

Webrev

Link to Webrev Comment

[bridgekeeper]

👋 Welcome back zzambers! A progress list of the required criteria for merging this PR into master will be added to the body of your pull request. There are additional pull request commands available for use with this pull request.

[openjdk]

@zzambers This change now passes all automated pre-integration checks.

After integration, the commit message for the final commit will be:

8279164: Disable TLS_ECDH_* cipher suites

Reviewed-by: sgehwolf, andrew, mbalao

You can use pull request commands such as /summary, /contributor and /issue to adjust it as needed.

At the time when this comment was updated there had been 4 new commits pushed to the master branch:

• 6abb3f2: 8035395: sun/management/jmxremote/startstop/JMXStartStopTest.java fails intermittently: Port already in use
• 6838605: 8311666: Disabled tests in test/jdk/sun/java2d/marlin
• bfb1a7d: 4660158: TTY: NumberFormatException while trying to set values by 'set' command
• 0357abb: 8324632: Update Zlib Data Compression Library to Version 1.3.1

Please see this link for an up-to-date comparison between the source branch of this pull request and the master branch.
As there are no conflicts, your changes will automatically be rebased on top of these commits when integrating. If you prefer to avoid this automatic rebasing, please check the documentation for the /integrate command for further details.

➡️ To integrate this PR with the above commit message to the master branch, type /integrate in a new comment.

[openjdk]

This backport pull request has now been updated with issue from the original commit.

[openjdk]

At least one of the issues associated with this backport has a resolved CSR for a different version. As this means that this backport may also need a CSR, the csr label is being added to this pull request to signal this potential requirement. The command /csr unneeded can be used to remove the label in case a CSR is not needed.

[mlbridge]

Webrevs

• 01: Full - Incremental (d926c0c9)
• 00: Full (fd212587)

[jerboaa]

CSR is here: https://bugs.openjdk.org/browse/JDK-8332812

[jerboaa]

@zzambers Could you please try a new PR title? Backport 5dddf69319480251cdc904cf7a1d4fcd81573bb8 which is the OpenJDK 11u commit (instead of the JDK head version's). Hopefully it'll see the correct CSR then. Thanks!

[jerboaa]

Looks good. Only a few nit-picks.

[gnu-andrew]

I think it would be good for @martinuy and/or @franferrax to look this one over as well.

[gnu-andrew]

CSR is here: https://bugs.openjdk.org/browse/JDK-8332812

I've created an openjdk8u432 backport linking to this. Let's see if that appeases Skara.

[gnu-andrew]

I agree with @jerboaa about the ECDH addition. It should match the trunk patch, ugly as it is.

Otherwise, this looks good. I think, by using trunk, you've also avoided an error which seems to have been introduced in the 11u & 17u backports. They both wrongly add elements of JDK-8163327. I'm going to file an issue to fix this in 11 & 17.

[gnu-andrew]

ECDH change still needs to be made.

[zzambers]

@zzambers Could you please try a new PR title? Backport 5dddf69319480251cdc904cf7a1d4fcd81573bb8 which is the OpenJDK 11u commit (instead of the JDK head version's). Hopefully it'll see the correct CSR then. Thanks!

I have tried to update the title

[openjdk]

This backport pull request has now been updated with issue from the original commit.

[zzambers]

Is there anything more which should be done by me in relation to csr? Or that one should be done automatically, but somehow it does not work?

[jerboaa]

Give the bot a few more minutes.

[martinuy]

Looks good to me.

[martinuy]

Note: I was a bit puzzled to see "SSL_RSA_WITH_3DES_EDE_CBC_SHA" in the 11u-dev patch as 8163327 has not been backported to 11u. Looks like the JDK main line patch was extending the disabled_ciphersuites list in DisabledAlgorithms.java but in 11u they (mistakenly?) added SSL_RSA_WITH_3DES_EDE_CBC_SHA.

[gnu-andrew]

Note: I was a bit puzzled to see "SSL_RSA_WITH_3DES_EDE_CBC_SHA" in the 11u-dev patch as 8163327 has not been backported to 11u. Looks like the JDK main line patch was extending the disabled_ciphersuites list in DisabledAlgorithms.java but in 11u they (mistakenly?) added SSL_RSA_WITH_3DES_EDE_CBC_SHA.

Yes, I noted that above and on the 17u backport: openjdk/jdk17u-dev#2559 (comment) I'll open a bug to fix 11u & 17u. It looks like 8u avoided the issue by starting from the trunk patch.

[jerboaa]

/csr unneeded.

Adding this in order to move this PR forward. We have a CSR that is approved and we'll link it manually (if need be) once pushed.

[openjdk]

@jerboaa usage: /csr [needed|unneeded], requires that the issue the pull request refers to links to an approved CSR request.

[jerboaa]

Filed this skara issue for the CSR trouble: https://bugs.openjdk.org/browse/SKARA-2297

[zzambers]

Note: I was a bit puzzled to see "SSL_RSA_WITH_3DES_EDE_CBC_SHA" in the 11u-dev patch as 8163327 has not been backported to 11u. Looks like the JDK main line patch was extending the disabled_ciphersuites list in DisabledAlgorithms.java but in 11u they (mistakenly?) added SSL_RSA_WITH_3DES_EDE_CBC_SHA.

Yes, I noted that above and on the 17u backport: openjdk/jdk17u-dev#2559 (comment) I'll open a bug to fix 11u & 17u. It looks like 8u avoided the issue by starting from the trunk patch.

Yy, I did backport directly from openjdk/jdk. (I did not wait to 17u/11u, as backport would not be clean anyway.)

[zzambers]

Filed this skara issue for the CSR trouble: https://bugs.openjdk.org/browse/SKARA-2297

thanks

[jerboaa]

I've added openjdk8u432 into Fix Version/s of the CSR. Hopefully that will work-around the skara bug.

[openjdk]

⚠️ @zzambers This change is now ready for you to apply for maintainer approval. This can be done directly in each associated issue or by using the /approval command.

[zzambers]

Good, It worked :)

/approval request Disables TLS_ECDH_* cipher suites, not clean, testing: OK (GHA, jdk_security)

[openjdk]

@zzambers
8279164: The approval request has been created successfully.

[jerboaa]

Looks good. I'll let @gnu-andrew have a look as well.

[gnu-andrew]

Updated version looks good.

[gnu-andrew]

I've added openjdk8u432 into Fix Version/s of the CSR. Hopefully that will work-around the skara bug.

We had to do this on the last issue with a CSR too: #392 (comment)

[gnu-andrew]

/approve yes

[openjdk]

@gnu-andrew
8279164: The approval request has been approved.

[zzambers]

thanks

/integrate

[openjdk]

Going to push as commit b1e2ea8.
Since your change was applied there have been 4 commits pushed to the master branch:

• 6abb3f2: 8035395: sun/management/jmxremote/startstop/JMXStartStopTest.java fails intermittently: Port already in use
• 6838605: 8311666: Disabled tests in test/jdk/sun/java2d/marlin
• bfb1a7d: 4660158: TTY: NumberFormatException while trying to set values by 'set' command
• 0357abb: 8324632: Update Zlib Data Compression Library to Version 1.3.1

Your commit was automatically rebased without conflicts.

[openjdk]

@zzambers Pushed as commit b1e2ea8.

💡 You may see a message that your pull request was closed with unmerged commits. This can be safely ignored.