From c37bcbf7e9d2b3c8ec4e93aa661d358c9f382edf Mon Sep 17 00:00:00 2001
From: Daniel Jatnieks <jatnieks@pobox.com>
Date: Thu, 8 Jun 2023 14:04:20 -0500
Subject: [PATCH] Include TLSv1.2 in
 negotiatedProtocolMustBeAcceptedProtocolTest Add a comment about the use of
 disabled TLSv1.1 with JDK 8 and higher to
 negotiatedProtocolMustBeAcceptedProtocolTest

Patch by Dan Jatnieks; reviewed by Ekaterina Dimitrova and Brandon Williams for CASSANDRA-18540
---
 .../test/InternodeEncryptionOptionsTest.java  | 19 +++++++++++++++----
 .../NativeTransportEncryptionOptionsTest.java | 17 ++++++++++++++---
 2 files changed, 29 insertions(+), 7 deletions(-)

diff --git a/test/distributed/org/apache/cassandra/distributed/test/InternodeEncryptionOptionsTest.java b/test/distributed/org/apache/cassandra/distributed/test/InternodeEncryptionOptionsTest.java
index 1462b03c91..3fc6a51ff3 100644
--- a/test/distributed/org/apache/cassandra/distributed/test/InternodeEncryptionOptionsTest.java
+++ b/test/distributed/org/apache/cassandra/distributed/test/InternodeEncryptionOptionsTest.java
@@ -21,6 +21,7 @@ package org.apache.cassandra.distributed.test;
 import java.net.InetAddress;
 import java.util.Collections;
 
+import com.google.common.collect.ImmutableList;
 import com.google.common.collect.ImmutableMap;
 import org.junit.Assert;
 import org.junit.Test;
@@ -217,6 +218,16 @@ public class InternodeEncryptionOptionsTest extends AbstractEncryptionOptionsImp
         }
     }
 
+    /**
+     * Tests that the negotiated protocol is the highest common protocol between the client and server.
+     * <p> 
+     * Note: This test uses TLSV1.1, which is disabled by default in JDK 8 and higher. If the test fails with 
+     * FAILED_TO_NEGOTIATE, it may be necessary to check the java.security file in your JDK installation and remove 
+     * TLSv1.1 from the jdk.tls.disabledAlgorithms.
+     * @see <a href="https://issues.apache.org/jira/browse/CASSANDRA-18540">CASSANDRA-18540</a>
+     * @see <a href="https://senthilnayagan.medium.com/tlsv1-and-tlsv1-1-protocols-disabled-by-default-in-javas-latest-patch-released-on-april-20-2021-52c309f6b16d">
+     *     TLSv1 and TLSv1.1 Protocols are Disabled in Java!</a>
+     */
     @Test
     public void negotiatedProtocolMustBeAcceptedProtocolTest() throws Throwable
     {
@@ -225,7 +236,7 @@ public class InternodeEncryptionOptionsTest extends AbstractEncryptionOptionsImp
             c.set("server_encryption_options",
                   ImmutableMap.builder().putAll(validKeystore)
                               .put("internode_encryption", "all")
-                              .put("accepted_protocols", Collections.singletonList("TLSv1.1"))
+                              .put("accepted_protocols", ImmutableList.of("TLSv1.1", "TLSv1.2"))
                               .build());
         }).start())
         {
@@ -243,9 +254,9 @@ public class InternodeEncryptionOptionsTest extends AbstractEncryptionOptionsImp
             Assert.assertEquals("TLSv1.1", tls11Connection.lastProtocol());
 
             TlsConnection tls12Connection = new TlsConnection(address.getHostAddress(), port, Collections.singletonList("TLSv1.2"));
-            Assert.assertEquals("Should not be possible to establish a TLSv1.2 connection",
-                                ConnectResult.FAILED_TO_NEGOTIATE, tls12Connection.connect());
-            tls12Connection.assertReceivedHandshakeException();
+            Assert.assertEquals("Should be possible to establish a TLSv1.2 connection",
+                                ConnectResult.NEGOTIATED, tls12Connection.connect());
+            Assert.assertEquals("TLSv1.2", tls12Connection.lastProtocol());
         }
     }
 
diff --git a/test/distributed/org/apache/cassandra/distributed/test/NativeTransportEncryptionOptionsTest.java b/test/distributed/org/apache/cassandra/distributed/test/NativeTransportEncryptionOptionsTest.java
index c5a810ca25..e5f1a2174a 100644
--- a/test/distributed/org/apache/cassandra/distributed/test/NativeTransportEncryptionOptionsTest.java
+++ b/test/distributed/org/apache/cassandra/distributed/test/NativeTransportEncryptionOptionsTest.java
@@ -21,6 +21,7 @@ package org.apache.cassandra.distributed.test;
 import java.net.InetAddress;
 import java.util.Collections;
 
+import com.google.common.collect.ImmutableList;
 import com.google.common.collect.ImmutableMap;
 import org.junit.Assert;
 import org.junit.Test;
@@ -136,6 +137,16 @@ public class NativeTransportEncryptionOptionsTest extends AbstractEncryptionOpti
     }
 
 
+    /**
+     * Tests that the negotiated protocol is the highest common protocol between the client and server.
+     * <p> 
+     * Note: This test uses TLSV1.1, which is disabled by default in JDK 8 and higher. If the test fails with 
+     * FAILED_TO_NEGOTIATE, it may be necessary to check the java.security file in your JDK installation and remove 
+     * TLSv1.1 from the jdk.tls.disabledAlgorithms.
+     * @see <a href="https://issues.apache.org/jira/browse/CASSANDRA-18540">CASSANDRA-18540</a>
+     * @see <a href="https://senthilnayagan.medium.com/tlsv1-and-tlsv1-1-protocols-disabled-by-default-in-javas-latest-patch-released-on-april-20-2021-52c309f6b16d">
+     *     TLSv1 and TLSv1.1 Protocols are Disabled in Java!</a>
+     */
     @Test
     public void negotiatedProtocolMustBeAcceptedProtocolTest() throws Throwable
     {
@@ -144,7 +155,7 @@ public class NativeTransportEncryptionOptionsTest extends AbstractEncryptionOpti
             c.set("client_encryption_options",
                   ImmutableMap.builder().putAll(validKeystore)
                               .put("enabled", true)
-                              .put("accepted_protocols", Collections.singletonList("TLSv1.1"))
+                              .put("accepted_protocols", ImmutableList.of("TLSv1.1", "TLSv1.2"))
                               .build());
         }).start())
         {
@@ -163,8 +174,8 @@ public class NativeTransportEncryptionOptionsTest extends AbstractEncryptionOpti
 
             TlsConnection tls12Connection = new TlsConnection(address.getHostAddress(), port, Collections.singletonList("TLSv1.2"));
             Assert.assertEquals("Should be possible to establish a TLSv1.2 connection",
-                                ConnectResult.FAILED_TO_NEGOTIATE, tls12Connection.connect());
-            tls12Connection.assertReceivedHandshakeException();
+                                ConnectResult.NEGOTIATED, tls12Connection.connect());
+            Assert.assertEquals("TLSv1.2", tls12Connection.lastProtocol());
         }
     }