ssl - 努力在 Apache CXF、Java 8、No Spring 中启用 SSLv2Hello

Question

这似乎是倒退的，但我正在开发一个专门用于与第三方客户端交互的网络服务器。此第三方客户端仅支持 SSLv3、TLSv1.0 或 TLSv1.1。

当他们尝试连接时，我也看到了以下错误:

SSLHandshakeException: SSLv2Hello is not enabled

我认为这意味着他们还需要启用 SSLv2Hello。它显然不适合我，尽管它似乎可用。

2019-06-13 15:06:38.831:DBUG:oejus.SslContextFactory:MyProgram: Selected Protocols [TLSv1.1, TLSv1] of [TLSv1.3, TLSv1.2, TLSv1.1, TLSv1, SSLv3, SSLv2Hello]
2019-06-13 15:06:38.831:DBUG:oejus.SslContextFactory:MyProgram: Selected Ciphers   [TLS_AES_128_GCM_SHA256, TLS_AES_256_GCM_SHA384, TLS_CHACHA20_POLY1305_SHA256, TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384, TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256, TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256, TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384, TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256, TLS_RSA_WITH_AES_256_GCM_SHA384, TLS_ECDH_ECDSA_WITH_AES_256_GCM_SHA384, TLS_ECDH_RSA_WITH_AES_256_GCM_SHA384, TLS_DHE_RSA_WITH_AES_256_GCM_SHA384, TLS_DHE_RSA_WITH_CHACHA20_POLY1305_SHA256, TLS_DHE_DSS_WITH_AES_256_GCM_SHA384, TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256, TLS_RSA_WITH_AES_128_GCM_SHA256, TLS_ECDH_ECDSA_WITH_AES_128_GCM_SHA256, TLS_ECDH_RSA_WITH_AES_128_GCM_SHA256, TLS_DHE_RSA_WITH_AES_128_GCM_SHA256, TLS_DHE_DSS_WITH_AES_128_GCM_SHA256, TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384, TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384, TLS_RSA_WITH_AES_256_CBC_SHA256, TLS_ECDH_ECDSA_WITH_AES_256_CBC_SHA384, TLS_ECDH_RSA_WITH_AES_256_CBC_SHA384, TLS_DHE_RSA_WITH_AES_256_CBC_SHA256, TLS_DHE_DSS_WITH_AES_256_CBC_SHA256, TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA, TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA, TLS_RSA_WITH_AES_256_CBC_SHA, TLS_ECDH_ECDSA_WITH_AES_256_CBC_SHA, TLS_ECDH_RSA_WITH_AES_256_CBC_SHA, TLS_DHE_RSA_WITH_AES_256_CBC_SHA, TLS_DHE_DSS_WITH_AES_256_CBC_SHA, TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256, TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256, TLS_RSA_WITH_AES_128_CBC_SHA256, TLS_ECDH_ECDSA_WITH_AES_128_CBC_SHA256, TLS_ECDH_RSA_WITH_AES_128_CBC_SHA256, TLS_DHE_RSA_WITH_AES_128_CBC_SHA256, TLS_DHE_DSS_WITH_AES_128_CBC_SHA256, TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA, TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA, TLS_RSA_WITH_AES_128_CBC_SHA, TLS_ECDH_ECDSA_WITH_AES_128_CBC_SHA, TLS_ECDH_RSA_WITH_AES_128_CBC_SHA, TLS_DHE_RSA_WITH_AES_128_CBC_SHA, TLS_DHE_DSS_WITH_AES_128_CBC_SHA, TLS_EMPTY_RENEGOTIATION_INFO_SCSV] of [TLS_AES_128_GCM_SHA256, TLS_AES_256_GCM_SHA384, TLS_CHACHA20_POLY1305_SHA256, TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384, TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256, TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256, TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384, TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256, TLS_RSA_WITH_AES_256_GCM_SHA384, TLS_ECDH_ECDSA_WITH_AES_256_GCM_SHA384, TLS_ECDH_RSA_WITH_AES_256_GCM_SHA384, TLS_DHE_RSA_WITH_AES_256_GCM_SHA384, TLS_DHE_RSA_WITH_CHACHA20_POLY1305_SHA256, TLS_DHE_DSS_WITH_AES_256_GCM_SHA384, TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256, TLS_RSA_WITH_AES_128_GCM_SHA256, TLS_ECDH_ECDSA_WITH_AES_128_GCM_SHA256, TLS_ECDH_RSA_WITH_AES_128_GCM_SHA256, TLS_DHE_RSA_WITH_AES_128_GCM_SHA256, TLS_DHE_DSS_WITH_AES_128_GCM_SHA256, TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384, TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384, TLS_RSA_WITH_AES_256_CBC_SHA256, TLS_ECDH_ECDSA_WITH_AES_256_CBC_SHA384, TLS_ECDH_RSA_WITH_AES_256_CBC_SHA384, TLS_DHE_RSA_WITH_AES_256_CBC_SHA256, TLS_DHE_DSS_WITH_AES_256_CBC_SHA256, TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA, TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA, TLS_RSA_WITH_AES_256_CBC_SHA, TLS_ECDH_ECDSA_WITH_AES_256_CBC_SHA, TLS_ECDH_RSA_WITH_AES_256_CBC_SHA, TLS_DHE_RSA_WITH_AES_256_CBC_SHA, TLS_DHE_DSS_WITH_AES_256_CBC_SHA, TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256, TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256, TLS_RSA_WITH_AES_128_CBC_SHA256, TLS_ECDH_ECDSA_WITH_AES_128_CBC_SHA256, TLS_ECDH_RSA_WITH_AES_128_CBC_SHA256, TLS_DHE_RSA_WITH_AES_128_CBC_SHA256, TLS_DHE_DSS_WITH_AES_128_CBC_SHA256, TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA, TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA, TLS_RSA_WITH_AES_128_CBC_SHA, TLS_ECDH_ECDSA_WITH_AES_128_CBC_SHA, TLS_ECDH_RSA_WITH_AES_128_CBC_SHA, TLS_DHE_RSA_WITH_AES_128_CBC_SHA, TLS_DHE_DSS_WITH_AES_128_CBC_SHA, TLS_EMPTY_RENEGOTIATION_INFO_SCSV]

不确定这是否是转移注意力，但如果我尝试对 SSLContext.getInstances 执行以下操作，TLSv1.1 调用工作正常，SSLv2Hello 抛出 NoSuchAlgorithmException。

SSLContext.getInstance( "TLSv1.1" )
SSLContext.getInstance( "SSLv2Hello" )

由于我正在制作原型(prototype)，所以我正在运行的代码仍然是一团糟，但下面是我正在做的事情的要点。

        final String url = "https://myurl.com:443/Notices";

        TLSServerParameters params = new TLSServerParameters();

        List<String> certFilePaths = new ArrayList<>();
        certFilePaths.add( "COMODORSADomainValidationSecureServerCA.crt" );
        certFilePaths.add( "AddTrustExternalCARoot.crt" );
        certFilePaths.add( "COMODORSAAddTrustCA.crt" );
        certFilePaths.add( "MyCert.crt" );

        Utility.loadCertsToServerParams( certFilePaths, "SSL_Export.pfx", "/tmp/tmp.jks", "password", params ); //uses the ssl password as the temporary keystore password as well

        JettyHTTPServerEngineFactory serverEngineFactory = new JettyHTTPServerEngineFactory();
        serverEngineFactory.setTLSServerParametersForPort( 443, params );

        Consumer implementor = new Consumer();
        JaxWsServerFactoryBean factory = new JaxWsServerFactoryBean();
        factory.setServiceClass( Consumer.class );
        factory.setAddress( url );
        factory.setServiceBean( implementor );

        Map<String, Object> properties = Maps.newHashMap();
        properties.put( "mtom-enabled", "false" );
        factory.setProperties( properties );

        final Map<String, Object> inProps = Utility.getWsSecurityPropertiesForSSL( "/tmp/tmp.jks", "SSL_Export.pfx", "password", "SSL_Export" );

        WSS4JInInterceptor wssOut = new WSS4JInInterceptor( inProps );
        factory.getInInterceptors().add( wssOut );

        ServerImpl server = ( ServerImpl ) factory.create();

        server.start();



public static TrustManager[] loadCertsToServerParams( List<String> serverCertFilePaths, String sslTlsKeyPairPath, String tempPathForCertFileKeystore, String sslTslKeyPairPassword, TLSServerParameters params ) throws Exception
{
    char[] sslTslKeyPairPasswordCharArray = sslTslKeyPairPassword.toCharArray();

    //clear out the keystore, we create a new one every time
    if( Files.exists( Paths.get( tempPathForCertFileKeystore ) ) )
        Files.delete( Paths.get( tempPathForCertFileKeystore ) );

    KeyStore ks = KeyStore.getInstance( "PKCS12" );

    ks.load( new FileInputStream( sslTlsKeyPairPath ), sslTslKeyPairPasswordCharArray );

    // Store away the newly created keystore.
    FileOutputStream fos = new FileOutputStream( tempPathForCertFileKeystore );
    ks.store( fos, sslTslKeyPairPasswordCharArray );
    fos.close();

    for( String certFilePath : serverCertFilePaths )
        AddCertToKeystore( ks, sslTslKeyPairPasswordCharArray, tempPathForCertFileKeystore, certFilePath, new File( certFilePath ).getName().replace( '.', '_' ) );

    TrustManagerFactory tmf = TrustManagerFactory.getInstance( TrustManagerFactory.getDefaultAlgorithm() );
    tmf.init( ks );

    KeyManagerFactory kmf = KeyManagerFactory.getInstance( KeyManagerFactory.getDefaultAlgorithm() );
    kmf.init( ks, sslTslKeyPairPasswordCharArray );

    SSLContext tls1_1Context = SSLContext.getInstance( "TLSv1.1" );
    tls1_1Context.init( kmf.getKeyManagers(), tmf.getTrustManagers(), new SecureRandom() );
    SSLContext.setDefault( tls1_1Context );

    SSLContext v2Hello = SSLContext.getInstance( "SSL" );
    v2Hello.init( kmf.getKeyManagers(), tmf.getTrustManagers(), new SecureRandom() );

    params.setTrustManagers( tmf.getTrustManagers() );
    params.setKeyManagers( kmf.getKeyManagers() );
    params.setSecureSocketProtocol( "SSL" );
    final List<String> additionalProtocols = new ArrayList<>();
    additionalProtocols.add( "SSLv2Hello" );
    additionalProtocols.add( "SSLv3" );
    additionalProtocols.add( "TLSv1" );
    additionalProtocols.add( "TLSv1.1" );
    additionalProtocols.add( "TLSv1.2" );
    params.setIncludeProtocols( additionalProtocols );
    params.setExcludeProtocols( null );
    final FiltersType cipherFilter = new FiltersType();
    cipherFilter.getInclude().add( ".*NULL.*" );
    cipherFilter.getInclude().add( ".*anon.*" );
    cipherFilter.getInclude().add( ".*EXPORT.*" );
    cipherFilter.getInclude().add( ".*DES.*" );
    cipherFilter.getInclude().add( ".*MD5" );
    cipherFilter.getInclude().add( ".*CBC.*" );
    cipherFilter.getInclude().add( ".*RC4.*" );
    cipherFilter.getInclude().add( ".*_.*" );
    cipherFilter.getInclude().add( ".*AES.*" );
    cipherFilter.getInclude().add( ".*_SHA" );
    cipherFilter.getExclude().add( "" );
    params.setCipherSuitesFilter( cipherFilter );
    final List<String> cipherSuites = new ArrayList<>();
    cipherSuites.add( "TLS_AES_128_GCM_SHA256" );
    cipherSuites.add( "TLS_AES_256_GCM_SHA384" );
    cipherSuites.add( "TLS_CHACHA20_POLY1305_SHA256" );
    cipherSuites.add( "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384" );
    cipherSuites.add( "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256" );
    cipherSuites.add( "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256" );
    cipherSuites.add( "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384" );
    cipherSuites.add( "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256" );
    cipherSuites.add( "TLS_RSA_WITH_AES_256_GCM_SHA384" );
    cipherSuites.add( "TLS_ECDH_ECDSA_WITH_AES_256_GCM_SHA384" );
    cipherSuites.add( "TLS_ECDH_RSA_WITH_AES_256_GCM_SHA384" );
    cipherSuites.add( "TLS_DHE_RSA_WITH_AES_256_GCM_SHA384" );
    cipherSuites.add( "TLS_DHE_RSA_WITH_CHACHA20_POLY1305_SHA256" );
    cipherSuites.add( "TLS_DHE_DSS_WITH_AES_256_GCM_SHA384" );
    cipherSuites.add( "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256" );
    cipherSuites.add( "TLS_RSA_WITH_AES_128_GCM_SHA256" );
    cipherSuites.add( "TLS_ECDH_ECDSA_WITH_AES_128_GCM_SHA256" );
    cipherSuites.add( "TLS_ECDH_RSA_WITH_AES_128_GCM_SHA256" );
    cipherSuites.add( "TLS_DHE_RSA_WITH_AES_128_GCM_SHA256" );
    cipherSuites.add( "TLS_DHE_DSS_WITH_AES_128_GCM_SHA256" );
    cipherSuites.add( "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384" );
    cipherSuites.add( "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384" );
    cipherSuites.add( "TLS_RSA_WITH_AES_256_CBC_SHA256" );
    cipherSuites.add( "TLS_ECDH_ECDSA_WITH_AES_256_CBC_SHA384" );
    cipherSuites.add( "TLS_ECDH_RSA_WITH_AES_256_CBC_SHA384" );
    cipherSuites.add( "TLS_DHE_RSA_WITH_AES_256_CBC_SHA256" );
    cipherSuites.add( "TLS_DHE_DSS_WITH_AES_256_CBC_SHA256" );
    cipherSuites.add( "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA" );
    cipherSuites.add( "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA" );
    cipherSuites.add( "TLS_RSA_WITH_AES_256_CBC_SHA" );
    cipherSuites.add( "TLS_ECDH_ECDSA_WITH_AES_256_CBC_SHA" );
    cipherSuites.add( "TLS_ECDH_RSA_WITH_AES_256_CBC_SHA" );
    cipherSuites.add( "TLS_DHE_RSA_WITH_AES_256_CBC_SHA" );
    cipherSuites.add( "TLS_DHE_DSS_WITH_AES_256_CBC_SHA" );
    cipherSuites.add( "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256" );
    cipherSuites.add( "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256" );
    cipherSuites.add( "TLS_RSA_WITH_AES_128_CBC_SHA256" );
    cipherSuites.add( "TLS_ECDH_ECDSA_WITH_AES_128_CBC_SHA256" );
    cipherSuites.add( "TLS_ECDH_RSA_WITH_AES_128_CBC_SHA256" );
    cipherSuites.add( "TLS_DHE_RSA_WITH_AES_128_CBC_SHA256" );
    cipherSuites.add( "TLS_DHE_DSS_WITH_AES_128_CBC_SHA256" );
    cipherSuites.add( "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA" );
    cipherSuites.add( "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA" );
    cipherSuites.add( "TLS_RSA_WITH_AES_128_CBC_SHA" );
    cipherSuites.add( "TLS_ECDH_ECDSA_WITH_AES_128_CBC_SHA" );
    cipherSuites.add( "TLS_ECDH_RSA_WITH_AES_128_CBC_SHA" );
    cipherSuites.add( "TLS_DHE_RSA_WITH_AES_128_CBC_SHA" );
    cipherSuites.add( "TLS_DHE_DSS_WITH_AES_128_CBC_SHA" );
    cipherSuites.add( "TLS_EMPTY_RENEGOTIATION_INFO_SCSV" );
    params.setCipherSuites( cipherSuites );

    return tmf.getTrustManagers();
}

我明确地将 SSLv2Hello 设置为附加协议(protocol)，如此 Jetty github 问题中所建议的，我缺少什么来启用 SSLv2Hello？

https://github.com/eclipse/jetty.project/issues/866

Answer 1

这似乎是一个 CXF 错误。如果我基于源副本创建自己的 JettyHTTPServerEngine 并添加以下行:

scf.setIncludeProtocols( "TLSv1", "TLSv1.1", "TLSv1.2", "SSLv2Hello" );

这个方法:

protected SSLContext createSSLContext( SslContextFactory scf) throws Exception

然后行为如我所料，其中调试输出表明现在支持这些协议(protocol)，并且连接成功。

Selected Protocols [TLSv1, TLSv1.1, TLSv1.2, SSLv2Hello] of [TLSv1.3, TLSv1.2, TLSv1.1, TLSv1, SSLv3, SSLv2Hello]

我在原始 JettyHTTPServerEngine 代码中的任何地方都看不到 setIncludeProtocols 函数，无论是在我的 3.2.4 版本中还是在 GitHub 的 master 上，所以我无法想象它是如何工作或应该如何工作的。