xiaoxue_admin
/
dbx
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

fix(sqlserver): restore legacy TLS RSA ciphers

This commit is contained in:
zipg 2026-07-13 21:08:17 +08:00 committed by GitHub
parent 8de5becdef
commit 032a8d0f80
No known key found for this signature in database
GPG Key ID: B5690EEEBB952194
2 changed files with 19 additions and 3 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

7
agents/drivers/sqlserver-legacy/src/main/java/com/dbx/agent/sqlserverlegacy/SqlServerLegacyAgent.java
View File

@ -35,6 +35,10 @@ public final class SqlServerLegacyAgent extends ConfiguredJdbcAgent {
"RC4",
"DES",
"MD5WITHRSA",
// Legacy SQL Server TLS 1.0 endpoints commonly rely on static RSA cipher
// suites and RSA/SHA-1 handshake signatures disabled by newer JREs.
"TLS_RSA_*",
"RSA_PKCS1_SHA1 USAGE HANDSHAKESIGNATURE",
"DH KEYSIZE < 1024",
"RSA KEYSIZE < 1024"
);
@ -184,6 +188,9 @@ public final class SqlServerLegacyAgent extends ConfiguredJdbcAgent {
+ ", jdbc=" + jdbcDriverVersion()
+ ", sslProtocol=TLSv1"
+ ", tlsV1Disabled=" + isDisabled(disabledAlgorithms, "TLSV1")
+ ", tlsRsaDisabled=" + isDisabled(disabledAlgorithms, "TLS_RSA_*")
+ ", rsaPkcs1Sha1HandshakeDisabled="
+ isDisabled(disabledAlgorithms, "RSA_PKCS1_SHA1 USAGE HANDSHAKESIGNATURE")
+ ", 3desDisabled=" + isDisabled(disabledAlgorithms, "3DES_EDE_CBC")
+ ", rc4Disabled=" + isDisabled(disabledAlgorithms, "RC4");
}

15
agents/drivers/sqlserver-legacy/src/test/java/com/dbx/agent/sqlserverlegacy/SqlServerLegacyAgentTest.java
View File

@ -13,7 +13,10 @@ class SqlServerLegacyAgentTest {
String key = "jdk.tls.disabledAlgorithms";
String original = Security.getProperty(key);
try {
Security.setProperty(key, "TLSv1, TLSv1.1, 3DES_EDE_CBC, EC keySize < 224");
Security.setProperty(
key,
"TLSv1, TLSv1.1, TLS_RSA_*, rsa_pkcs1_sha1 usage HandshakeSignature, 3DES_EDE_CBC, EC keySize < 224"
);
new SqlServerLegacyAgent();
@ -21,6 +24,8 @@ class SqlServerLegacyAgentTest {
String diagnostics = SqlServerLegacyAgent.legacyTlsDiagnostics();
Assertions.assertTrue(diagnostics.contains("sslProtocol=TLSv1"));
Assertions.assertTrue(diagnostics.contains("tlsV1Disabled=false"));
Assertions.assertTrue(diagnostics.contains("tlsRsaDisabled=false"));
Assertions.assertTrue(diagnostics.contains("rsaPkcs1Sha1HandshakeDisabled=false"));
Assertions.assertTrue(diagnostics.contains("3desDisabled=false"));
Assertions.assertTrue(diagnostics.contains("rc4Disabled=false"));
} finally {
@ -101,10 +106,14 @@ class SqlServerLegacyAgentTest {
@Test
void relaxedDisabledAlgorithmsRemovesOnlyLegacyTlsEntries() {
String current =
"SSLv3, TLSv1, TLSv1.1, DTLSv1.0, RC4, DES, MD5withRSA, DH keySize < 1024, EC keySize < 224, 3DES_EDE_CBC, anon, NULL";
"SSLv3, TLSv1, TLSv1.1, DTLSv1.0, RC4, DES, MD5withRSA, TLS_RSA_*, "
+ "rsa_pkcs1_sha1 usage HandshakeSignature, ecdsa_sha1 usage HandshakeSignature, "
+ "dsa_sha1 usage HandshakeSignature, DH keySize < 1024, EC keySize < 224, "
+ "3DES_EDE_CBC, anon, NULL";
Assertions.assertEquals(
"SSLv3, EC keySize < 224, anon, NULL",
"SSLv3, ecdsa_sha1 usage HandshakeSignature, dsa_sha1 usage HandshakeSignature, "
+ "EC keySize < 224, anon, NULL",
SqlServerLegacyAgent.relaxedDisabledAlgorithms(current)
);
}