IGNITE-29051 Several tests from JdbcThinConnectionSSLTest are failed locally

modules/clients/src/test/java/org/apache/ignite/jdbc/thin/JdbcThinConnectionSSLTest.java

@@ -23,6 +23,9 @@
 import java.sql.ResultSet;
 import java.sql.SQLException;
 import java.sql.Statement;
+import java.util.Arrays;
+import java.util.HashSet;
+import java.util.Set;
 import java.util.concurrent.Callable;
 import javax.cache.configuration.Factory;
 import javax.net.ssl.SSLContext;
@@ -333,15 +336,19 @@ public void testCustomCiphersOnServer() throws Exception {
      */
     @Test
     public void testDisabledCustomCipher() throws Exception {
+        String disabledSuite = disabledByDefaultCipherSuites().iterator().next();
+
+        System.out.println("Run test with cipher suite: " + disabledSuite);
+
         setSslCtxFactoryToCli = true;
-        supportedCiphers = new String[] {"TLS_RSA_WITH_NULL_SHA256" /* Disabled by default */};
+        supportedCiphers = new String[] {disabledSuite /* Disabled by default */};
         sslCtxFactory = getTestSslContextFactory();
 
         startGrids(1);
         try {
             // Explicit supported ciphers.
             try (Connection conn = DriverManager.getConnection("jdbc:ignite:thin://127.0.0.1/?sslMode=require" +
-                "&sslCipherSuites=TLS_RSA_WITH_NULL_SHA256" +
+                "&sslCipherSuites=" + disabledSuite +
                 "&sslTrustAll=true" +
                 "&sslClientCertificateKeyStoreUrl=" + CLI_KEY_STORE_PATH +
                 "&sslClientCertificateKeyStorePassword=123456" +
@@ -350,9 +357,30 @@ public void testDisabledCustomCipher() throws Exception {
                 checkConnection(conn);
             }
 
-            // Default ciphers.
+            //completely disabled jdk 17+
+
+            //DES (56-bit):
+            //TLS_RSA_WITH_DES_CBC_SHA, TLS_DHE_RSA_WITH_DES_CBC_SHA,
+            //    TLS_DHE_DSS_WITH_DES_CBC_SHA, TLS_ECDHE_ECDSA_WITH_DES_CBC_SHA,
+            //    TLS_ECDHE_RSA_WITH_DES_CBC_SHA, TLS_ECDHE_PSK_WITH_DES_CBC_SHA,
+            //    TLS_ECDH_ECDSA_WITH_DES_CBC_SHA, TLS_ECDH_RSA_WITH_DES_CBC_SHA,
+            //    TLS_ECDH_anon_WITH_DES_CBC_SHA
+
+            //3DES/DESede:
+            //TLS_RSA_WITH_3DES_EDE_CBC_SHA, TLS_DHE_RSA_WITH_3DES_EDE_CBC_SHA,
+            //    TLS_DHE_DSS_WITH_3DES_EDE_CBC_SHA,
+            //    TLS_ECDHE_ECDSA_WITH_3DES_EDE_CBC_SHA, TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA,
+            //    TLS_ECDHE_PSK_WITH_3DES_EDE_CBC_SHA, TLS_ECDH_ECDSA_WITH_3DES_EDE_CBC_SHA,
+            //    TLS_ECDH_RSA_WITH_3DES_EDE_CBC_SHA, TLS_ECDH_anon_WITH_3DES_EDE_CBC_SHA
+
+            String completelyDisabledSuite = "TLS_RSA_WITH_DES_CBC_SHA";
+
+            assertFalse(Set.of(factory("TLS").getSupportedCipherSuites()).contains(completelyDisabledSuite));
+
+            // Java 17+, the cipher suite TLS_RSA_WITH_NULL_SHA256 is completely disabled by default.
             GridTestUtils.assertThrows(log, () -> {
                 return DriverManager.getConnection("jdbc:ignite:thin://127.0.0.1/?sslMode=require" +
+                    "&sslCipherSuites=" + completelyDisabledSuite +
                     "&sslClientCertificateKeyStoreUrl=" + CLI_KEY_STORE_PATH +
                     "&sslClientCertificateKeyStorePassword=123456" +
                     "&sslTrustCertificateKeyStoreUrl=" + TRUST_KEY_STORE_PATH +
@@ -372,10 +400,12 @@ public void testDisabledCustomCipher() throws Exception {
      */
     @Test
     public void testUnsupportedCustomCipher() throws Exception {
+        String disabledSuite = disabledByDefaultCipherSuites().iterator().next();
+
         setSslCtxFactoryToCli = true;
         supportedCiphers = new String[] {
-            "TLS_RSA_WITH_NULL_SHA256" /* Disabled by default */,
-            "TLS_ECDH_anon_WITH_3DES_EDE_CBC_SHA" /* With disabled protocol*/};
+            disabledSuite /* Supported by JDK */,
+            "TLS_ECDH_anon_WITH_3DES_EDE_CBC_SHA" /* Anonymous cipher is disabled by default */};
         sslCtxFactory = getTestSslContextFactory();
 
         startGrids(1);
@@ -393,7 +423,7 @@ public void testUnsupportedCustomCipher() throws Exception {
 
             // Supported cipher.
             try (Connection conn = DriverManager.getConnection("jdbc:ignite:thin://127.0.0.1/?sslMode=require" +
-                "&sslCipherSuites=TLS_RSA_WITH_NULL_SHA256" +
+                "&sslCipherSuites=" + disabledSuite +
                 "&sslTrustAll=true" +
                 "&sslClientCertificateKeyStoreUrl=" + CLI_KEY_STORE_PATH +
                 "&sslClientCertificateKeyStorePassword=123456" +
@@ -403,14 +433,14 @@ public void testUnsupportedCustomCipher() throws Exception {
             }
 
             // Default ciphers.
+            // Behavior can be different for local and TC runs due to different: java.security settings
             GridTestUtils.assertThrows(log, () -> {
                 return DriverManager.getConnection("jdbc:ignite:thin://127.0.0.1/?sslMode=require" +
                     "&sslClientCertificateKeyStoreUrl=" + CLI_KEY_STORE_PATH +
                     "&sslClientCertificateKeyStorePassword=123456" +
                     "&sslTrustCertificateKeyStoreUrl=" + TRUST_KEY_STORE_PATH +
                     "&sslTrustCertificateKeyStorePassword=123456");
             }, SQLException.class, "Failed to SSL connect to server");
-
         }
         finally {
             stopAllGrids();
@@ -723,4 +753,29 @@ public static class TestSSLFactory implements Factory<SSLSocketFactory> {
             return getTestSslContextFactory().create().getSocketFactory();
         }
     }
+
+    /** */
+    private SSLSocketFactory factory(String protocol) throws Exception {
+        SSLContext ctx = SSLContext.getInstance(protocol);
+        ctx.init(null, null, null);
+
+        return ctx.getSocketFactory();
+    }
+
+    /** */
+    private Set<String> disabledByDefaultCipherSuites() throws Exception {
+        SSLSocketFactory factory = factory("TLSv1.2");
+
+        Set<String> supportedCiphersSuites = new HashSet<>(Arrays.stream(factory.getSupportedCipherSuites()).toList());
+
+        // Fulter supported, but NOT in the default active list.
+        supportedCiphersSuites.removeAll(Set.of(factory.getDefaultCipherSuites()));
+
+        // Current TC settings.
+        supportedCiphersSuites.removeIf(s -> s.contains("_anon_"));
+
+        assertFalse("No one disabled by default suite found", supportedCiphersSuites.isEmpty());
+
+        return supportedCiphersSuites;
+    }
 }