Loading...

Type: Bug
Resolution: Done
Priority: Major
Fix Version/s: 7.1.0.DR8
Affects Version/s: 7.1.0.DR7
Component/s: Security, Server
Labels:
- wildfly-openssl

CDW devel_ack:
CDW docs_ack:
CDW pm_ack:
CDW qa_ack:
CDW release:
Target Release:

7.1.0.GA
Steps to Reproduce:
Hide

unzip eap

./bin/standalone.sh

/core-service=management/security-realm=ApplicationRealm/server-identity=ssl:write-attribute(name=protocol,value=openssl.TLS)

/core-service=management/security-realm=ApplicationRealm/server-identity=ssl:write-attribute(name=enabled-cipher-suites,value=[ALL_ECDHE_RSA_WITH_AES_128_GCM_SHA256])

reload

perform request to https://localhost:8443 from browser or via curl --insecure --http2 https://localhost:8443
Show
unzip eap ./bin/standalone.sh /core-service=management/security-realm=ApplicationRealm/server-identity=ssl:write-attribute(name=protocol,value=openssl.TLS) /core-service=management/security-realm=ApplicationRealm/server-identity=ssl:write-attribute(name=enabled-cipher-suites,value=[ALL_ECDHE_RSA_WITH_AES_128_GCM_SHA256]) reload perform request to https://localhost:8443 from browser or via curl --insecure --http2 https://localhost:8443

SFDC Cases Counter:
SFDC Cases Open:
SFDC Cases Links:

I tried to set custom cipher for SSL on the EAP server. I checked via Wireshark what cipher is negotiated between Chrome and EAP server when JSSE is in place and picked that cipher - TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256

First I checked that my openssl knows it:

$ openssl ciphers | grep ECDHE-RSA-AES128-GCM-SHA256
ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-SHA384:ECDHE-ECDSA-AES256-SHA384:ECDHE-RSA-AES256-SHA:ECDHE-ECDSA-AES256-SHA:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-SHA256:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA:ECDHE-ECDSA-AES128-SHA:AES256-GCM-SHA384:AES256-SHA256:AES256-SHA:CAMELLIA256-SHA:AES128-GCM-SHA256:AES128-SHA256:AES128-SHA:CAMELLIA128-SHA:DHE-DSS-AES256-GCM-SHA384:DHE-RSA-AES256-GCM-SHA384:DHE-RSA-AES256-SHA256:DHE-DSS-AES256-SHA256:DHE-RSA-AES256-SHA:DHE-DSS-AES256-SHA:DHE-RSA-CAMELLIA256-SHA:DHE-DSS-CAMELLIA256-SHA:DHE-DSS-AES128-GCM-SHA256:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES128-SHA256:DHE-DSS-AES128-SHA256:DHE-RSA-AES128-SHA:DHE-DSS-AES128-SHA:DHE-RSA-CAMELLIA128-SHA:DHE-DSS-CAMELLIA128-SHA:PSK-AES256-CBC-SHA:PSK-AES128-CBC-SHA:ECDHE-RSA-DES-CBC3-SHA:ECDHE-ECDSA-DES-CBC3-SHA:DES-CBC3-SHA:EDH-RSA-DES-CBC3-SHA:EDH-DSS-DES-CBC3-SHA:PSK-3DES-EDE-CBC-SHA

Then I set 'openssl.TLS' protocol and enabled only ALL_ECDHE_RSA_WITH_AES_128_GCM_SHA256 cipher (see 'Steps for reproduction' for more info) and performed request to server both from Chrome 54 and from curl, following exception is printed in server.log:

16:48:30,721 ERROR [org.xnio.listener] (default I/O-6) XNIO001007: A channel event listener threw an exception: java.lang.IllegalStateException: Failed cypher suite ALL_ECDHE_RSA_WITH_AES_128_GCM_SHA256
	at org.wildfly.openssl.OpenSSLEngine.setEnabledCipherSuites(OpenSSLEngine.java:704)
	at org.jboss.as.domain.management.security.WrapperSSLContext$WrapperSpi.setSslParams(WrapperSSLContext.java:84)
	at org.jboss.as.domain.management.security.WrapperSSLContext$WrapperSpi.engineCreateSSLEngine(WrapperSSLContext.java:78)
	at javax.net.ssl.SSLContext.createSSLEngine(SSLContext.java:361)
	at io.undertow.protocols.ssl.UndertowAcceptingSslChannel.accept(UndertowAcceptingSslChannel.java:139)
	at io.undertow.protocols.ssl.UndertowAcceptingSslChannel.accept(UndertowAcceptingSslChannel.java:56)
	at org.xnio.ChannelListeners$10.handleEvent(ChannelListeners.java:289)
	at org.xnio.ChannelListeners$10.handleEvent(ChannelListeners.java:286)
	at org.xnio.ChannelListeners.invokeChannelListener(ChannelListeners.java:92)
	at org.xnio.ChannelListeners$DelegatingChannelListener.handleEvent(ChannelListeners.java:1092)
	at org.xnio.ChannelListeners.invokeChannelListener(ChannelListeners.java:92)
	at org.xnio.nio.QueuedNioTcpServer$1.run(QueuedNioTcpServer.java:128)
	at org.xnio.nio.WorkerThread.safeRun(WorkerThread.java:588)
	at org.xnio.nio.WorkerThread.run(WorkerThread.java:468)
Caused by: java.lang.IllegalStateException: error:140E6118:SSL routines:SSL_CIPHER_PROCESS_RULESTR:invalid command
	at org.wildfly.openssl.SSLImpl.setCipherSuites0(Native Method)
	at org.wildfly.openssl.SSLImpl.setCipherSuites(SSLImpl.java:423)
	at org.wildfly.openssl.OpenSSLEngine.setEnabledCipherSuites(OpenSSLEngine.java:702)
	... 13 more

Are cipher names ALL_ECDHE_RSA_WITH_AES_128_GCM_SHA256 and ECDHE-RSA-AES128-GCM-SHA256 actually reffering to the same cipher?

My expectation was this configuration should work as both client knows this cipher (Chrome can use it when EAP is using JSSE) and my OpenSSL also lists it among available ciphers (thus I believe EAP with 'openssl.TLS' should also know it). Is there something wrong in my expectation?

is incorporated by

JBEAP-6556 (7.1.0) Upgrade to WildFly Core 3.0.0.Alpha12

Closed

Details

Description

Attachments

Issue Links

Easy Agile Planning Poker

Activity

People

Dates