enable ssl protocol to the ice endpoints

[karthikvadapalli]

Hi our application is using Ice3.3.1 and 3.4.2(due to the linux versions) with the tcp protocols, below is our configuration

                            <ice.bin>/icestation/Ice-3.4.2/bin</ice.bin>
			<icestorm.service-entry-point>IceStormService,34:createIceStorm</icestorm.service-entry-point>
			<icebox.servicemanager.endpoints>tcp -p 10008</icebox.servicemanager.endpoints>
			<icestorm.topicmanager.endpoints>default -h hostname -p 10010</icestorm.topicmanager.endpoints>
			<icestorm.publish.endpoints>tcp -p 10011:udp -p 10011</icestorm.publish.endpoints>
			<icestorm.assembly.id>assemblyID</icestorm.assembly.id>

now we want to make it work with SSL protocol, can this be possible, if yes how we need to implement the solution?

[pepone]

Ice 3.4 is quite old, you need to upgrade to 3.7.

Using SSL is a matter of adding an SSL endpoint, and configuring IceSSL plug-in:

See 3.4 docs and demo applications

[karthikvadapalli]

Hi
we are creating an adapter on client side with in the run method like below.
communicator().createObjectAdapterWithEndpoints("adapter","ssl -p 10010)

our main class is below:
Map<String, String> props = (Map<String, String>)implementationFactory.getImplFor("IceCommunicatorProperties");
InitializationData initData = new InitializationData();
initData.properties = Util.createProperties();
for (Map.Entry<String, String> e : props.entrySet()) {
initData.properties.setProperty(e.getKey(), e.getValue());
}
int status = new IceGridNode().main("IceStation", args, initData);
LOG.info("IceGridNode Status:" + status);
// start Ice communicator
System.exit(status);

below is the IceCommunicatorProperties bean definition:

while connecting from client with the same above configuration we are getting no cipher suites in common, any help would be appreciated

[pepone]

"no cipher suites in common" means that the client and the server cannot agree on SSL cipher suite that is accepted by both, and the TLS handshakes cannot continue.

The available cipher suites depend on the SSL platforms, for Java it depends on the Java version you are using, and for the C++ side on Linux it depends on the OpenSSL side.

There is also IceSSL.Cipher property to filter-out ciphers, but I would left this out, just ensure you are not setting it to a restricted value that is not available by the peer.

You should really try to upgrade to a more recent Ice versions, one thing that could be happening is that the OS is configured to disallow old SSL protocols, and this old Ice versions is still trying to use them.

[karthikvadapalli]

how can i check what ciphers ice ssl is using and java is using

the java version we are using is 1.8.0_401 and OS is RHEL 6.10

i setup the flag IceSSL.Trace.Security to 2 am getting the below enabled ciphers:
[ 02/10/24 15:53:59:958 Security: enabling SSL ciphersuites:
TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384
TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384
TLS_RSA_WITH_AES_256_CBC_SHA256
TLS_ECDH_ECDSA_WITH_AES_256_CBC_SHA384
TLS_ECDH_RSA_WITH_AES_256_CBC_SHA384
TLS_DHE_RSA_WITH_AES_256_CBC_SHA256
TLS_DHE_DSS_WITH_AES_256_CBC_SHA256
TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA
TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA
TLS_RSA_WITH_AES_256_CBC_SHA
TLS_ECDH_ECDSA_WITH_AES_256_CBC_SHA
TLS_ECDH_RSA_WITH_AES_256_CBC_SHA
TLS_DHE_RSA_WITH_AES_256_CBC_SHA
TLS_DHE_DSS_WITH_AES_256_CBC_SHA
TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256
TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256
TLS_RSA_WITH_AES_128_CBC_SHA256
TLS_ECDH_ECDSA_WITH_AES_128_CBC_SHA256
TLS_ECDH_RSA_WITH_AES_128_CBC_SHA256
TLS_DHE_RSA_WITH_AES_128_CBC_SHA256
TLS_DHE_DSS_WITH_AES_128_CBC_SHA256
TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA
TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA
TLS_RSA_WITH_AES_128_CBC_SHA
TLS_ECDH_ECDSA_WITH_AES_128_CBC_SHA
TLS_ECDH_RSA_WITH_AES_128_CBC_SHA
TLS_DHE_RSA_WITH_AES_128_CBC_SHA
TLS_DHE_DSS_WITH_AES_128_CBC_SHA
TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384
TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256
TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384
TLS_RSA_WITH_AES_256_GCM_SHA384
TLS_ECDH_ECDSA_WITH_AES_256_GCM_SHA384
TLS_ECDH_RSA_WITH_AES_256_GCM_SHA384
TLS_DHE_RSA_WITH_AES_256_GCM_SHA384
TLS_DHE_DSS_WITH_AES_256_GCM_SHA384
TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256
TLS_RSA_WITH_AES_128_GCM_SHA256
TLS_ECDH_ECDSA_WITH_AES_128_GCM_SHA256
TLS_ECDH_RSA_WITH_AES_128_GCM_SHA256
TLS_DHE_RSA_WITH_AES_128_GCM_SHA256
TLS_DHE_DSS_WITH_AES_128_GCM_SHA256
TLS_ECDHE_ECDSA_WITH_3DES_EDE_CBC_SHA
TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA
SSL_RSA_WITH_3DES_EDE_CBC_SHA
TLS_ECDH_ECDSA_WITH_3DES_EDE_CBC_SHA
TLS_ECDH_RSA_WITH_3DES_EDE_CBC_SHA
SSL_DHE_RSA_WITH_3DES_EDE_CBC_SHA
SSL_DHE_DSS_WITH_3DES_EDE_CBC_SHA
TLS_EMPTY_RENEGOTIATION_INFO_SCSV ]

[karthikvadapalli]

i can see the ciphers on java are matching with most of the above

[karthikvadapalli]

application is struck at the below point, do you have any suggestions to implement?
communicator.stringToProxy("Hello:ssl -h hostname -p 10010");

[pepone]

If you are using the Ice.Application class as show in the stack above, the configuration file used to create the communicator can be passed as an argument to Application.main

See https://github.com/zeroc-ice/ice-demos/blob/c5091b705bd74e2925b249f92e8fc7b3a7769336/demoj/Ice/hello/Server.java#L34

[pepone]

How are you passing this properties to Ice.Application? The XML above doesn't seem like something Ice.Application would read out-of the box.

[karthikvadapalli]

i am setting these properties to InitializationData and using to initialize communicator

[pepone]

Can you show us the code, or better create a self contained example that shows your problem?

[karthikvadapalli]

how to show you the code?
below is the log which shows the proxy is connected but it is unable to activate the listener

INFO 2024-07-30 09:18:36,781 [main] IceAdminGuiServiceImpl: Set IceStationServer.Primary=Icestation:ssl -h hostname -p 4071:tcp -h hostname -p 4091
INFO 2024-07-30 09:18:36,781 [main] IceAdminGuiServiceImpl: Set IceStationServer.Secondary=Icestation:ssl -h hostname -p 4081:tcp -h hostname -p 4051
INFO 2024-07-30 09:18:36,828 [main] IceStationServerConnection: Created connection instance IceStationServer.Primary
INFO 2024-07-30 09:18:40,943 [main] IceStationServerConnection: Created connection instance IceStationServer.Secondary

[karthikvadapalli]

lookslike below is not working,
ObjectPrx p = communicator.propertyToProxy(IceStationServer.Primary);
if (p == null) {
return false;
}
// Disable the locator cache of this proxy: every time a connection is closed, a new
// locate request is made to determine the endpoint for the new connection. Connections
// are closed automatically when they time out, and by us when we detect a change in one
// of the object adapters.
// Note that proxies are immutable, that is why the below call returns a new proxy.
p = p.ice_locatorCacheTimeout(0);
// Cast the proxy to its known type.
proxy = castProxy(p);

[pepone]

i am setting these properties to InitializationData and using to initialize communicator

It would be simpler if you upload a zip file with the code that demostrate the problem, so we can take a look. otherwise is difficult to diagnose the issue.

[karthikvadapalli]

-- 09/23/24 14:25:00.056 /opt/Ice-3.4.2/bin/icebox-IceStorm: Network: failed to establish ssl connection
local address: ipaddress:10020
remote address: :-1
TransceiverI.cpp:234: Ice::ProtocolException:
protocol exception:
SSL error occurred for new incoming connection:
remote address = ipaddress:33316
no shared cipher

this is what i can see when i am starting the icestorm process

[pepone]

no shared cipher

This means that the client and server cannot negotiate a common SSL cipher to use. There can be a number of reason why this happens, for example OpenSSL and Java version used in your setup. Setting IceSSL.Trace.Security=1 might give you additional info about what ciphers are available in each application.

The best would be to upgrade your application to a recent Ice release, if you cannot and need commercial support for this older versions try contact [email protected] for available support options.

Cheers,
Jose

[karthikvadapalli]

error # = 336109761
message = error:1408A0C1:SSL routines:SSL3_GET_CLIENT_HELLO:no shared cipher
location = s3_srvr.c, 1407

this is the only information i am getting after adding IceSSL.Trace.Security=1

[karthikvadapalli]

is there any restrictions of java versions or Openssl we need to use to connect to icessl?
currently we are using java 1.8 and OpenSSL 1.0.1e-fips 11 Feb 2013

[karthikvadapalli]

any help with the below error
Couldn't connect to IceStorm
Ice.SecurityException: null
at IceSSL.TransceiverI.handshakeNonBlocking(TransceiverI.java:454) ~[ice-3.3.1.jar:?]
at IceSSL.TransceiverI.initialize(TransceiverI.java:43) ~[ice-3.3.1.jar:?]
at Ice.ConnectionI.initialize(ConnectionI.java:1536) ~[ice-3.3.1.jar:?]
at Ice.ConnectionI.socketReady(ConnectionI.java:1116) ~[ice-3.3.1.jar:?]
at Ice.ConnectionI$SocketReadyCallback.socketReady(ConnectionI.java:2299) ~[ice-3.3.1.jar:?]
at IceInternal.SelectorThread.run(SelectorThread.java:203) ~[ice-3.3.1.jar:?]
at IceInternal.SelectorThread$HelperThread.run(SelectorThread.java:273) ~[ice-3.3.1.jar:?]
Caused by: javax.net.ssl.SSLHandshakeException: Received fatal alert: handshake_failure
at sun.security.ssl.Alert.createSSLException(Alert.java:131) ~[?:1.8.0_401]
at sun.security.ssl.Alert.createSSLException(Alert.java:117) ~[?:1.8.0_401]
at sun.security.ssl.TransportContext.fatal(TransportContext.java:342) ~[?:1.8.0_401]
at sun.security.ssl.Alert$AlertConsumer.consume(Alert.java:293) ~[?:1.8.0_401]
at sun.security.ssl.TransportContext.dispatch(TransportContext.java:185) ~[?:1.8.0_401]
at sun.security.ssl.SSLTransport.decode(SSLTransport.java:156) ~[?:1.8.0_401]
at sun.security.ssl.SSLEngineImpl.decode(SSLEngineImpl.java:588) ~[?:1.8.0_401]
at sun.security.ssl.SSLEngineImpl.readRecord(SSLEngineImpl.java:544) ~[?:1.8.0_401]
at sun.security.ssl.SSLEngineImpl.unwrap(SSLEngineImpl.java:411) ~[?:1.8.0_401]
at sun.security.ssl.SSLEngineImpl.unwrap(SSLEngineImpl.java:390) ~[?:1.8.0_401]
at javax.net.ssl.SSLEngine.unwrap(SSLEngine.java:629) ~[?:1.8.0_401]
at IceSSL.TransceiverI.handshakeNonBlocking(TransceiverI.java:380) ~[ice-3.3.1.jar:?]
... 6 more