From 032a8d0f8028dfc8d26c90f66daf61e206bbef2e Mon Sep 17 00:00:00 2001
From: zipg <geeky@foxmail.com>
Date: Mon, 13 Jul 2026 21:08:17 +0800
Subject: [PATCH] fix(sqlserver): restore legacy TLS RSA ciphers

---
 .../sqlserverlegacy/SqlServerLegacyAgent.java     |  7 +++++++
 .../sqlserverlegacy/SqlServerLegacyAgentTest.java | 15 ++++++++++++---
 2 files changed, 19 insertions(+), 3 deletions(-)

diff --git a/agents/drivers/sqlserver-legacy/src/main/java/com/dbx/agent/sqlserverlegacy/SqlServerLegacyAgent.java b/agents/drivers/sqlserver-legacy/src/main/java/com/dbx/agent/sqlserverlegacy/SqlServerLegacyAgent.java
index 2a8b7285c..6aac71271 100644
--- a/agents/drivers/sqlserver-legacy/src/main/java/com/dbx/agent/sqlserverlegacy/SqlServerLegacyAgent.java
+++ b/agents/drivers/sqlserver-legacy/src/main/java/com/dbx/agent/sqlserverlegacy/SqlServerLegacyAgent.java
@@ -35,6 +35,10 @@ public final class SqlServerLegacyAgent extends ConfiguredJdbcAgent {
         "RC4",
         "DES",
         "MD5WITHRSA",
+        // Legacy SQL Server TLS 1.0 endpoints commonly rely on static RSA cipher
+        // suites and RSA/SHA-1 handshake signatures disabled by newer JREs.
+        "TLS_RSA_*",
+        "RSA_PKCS1_SHA1 USAGE HANDSHAKESIGNATURE",
         "DH KEYSIZE < 1024",
         "RSA KEYSIZE < 1024"
     );
@@ -184,6 +188,9 @@ public final class SqlServerLegacyAgent extends ConfiguredJdbcAgent {
             + ", jdbc=" + jdbcDriverVersion()
             + ", sslProtocol=TLSv1"
             + ", tlsV1Disabled=" + isDisabled(disabledAlgorithms, "TLSV1")
+            + ", tlsRsaDisabled=" + isDisabled(disabledAlgorithms, "TLS_RSA_*")
+            + ", rsaPkcs1Sha1HandshakeDisabled="
+            + isDisabled(disabledAlgorithms, "RSA_PKCS1_SHA1 USAGE HANDSHAKESIGNATURE")
             + ", 3desDisabled=" + isDisabled(disabledAlgorithms, "3DES_EDE_CBC")
             + ", rc4Disabled=" + isDisabled(disabledAlgorithms, "RC4");
     }
diff --git a/agents/drivers/sqlserver-legacy/src/test/java/com/dbx/agent/sqlserverlegacy/SqlServerLegacyAgentTest.java b/agents/drivers/sqlserver-legacy/src/test/java/com/dbx/agent/sqlserverlegacy/SqlServerLegacyAgentTest.java
index 3cbd5d61c..a52436776 100644
--- a/agents/drivers/sqlserver-legacy/src/test/java/com/dbx/agent/sqlserverlegacy/SqlServerLegacyAgentTest.java
+++ b/agents/drivers/sqlserver-legacy/src/test/java/com/dbx/agent/sqlserverlegacy/SqlServerLegacyAgentTest.java
@@ -13,7 +13,10 @@ class SqlServerLegacyAgentTest {
         String key = "jdk.tls.disabledAlgorithms";
         String original = Security.getProperty(key);
         try {
-            Security.setProperty(key, "TLSv1, TLSv1.1, 3DES_EDE_CBC, EC keySize < 224");
+            Security.setProperty(
+                key,
+                "TLSv1, TLSv1.1, TLS_RSA_*, rsa_pkcs1_sha1 usage HandshakeSignature, 3DES_EDE_CBC, EC keySize < 224"
+            );
 
             new SqlServerLegacyAgent();
 
@@ -21,6 +24,8 @@ class SqlServerLegacyAgentTest {
             String diagnostics = SqlServerLegacyAgent.legacyTlsDiagnostics();
             Assertions.assertTrue(diagnostics.contains("sslProtocol=TLSv1"));
             Assertions.assertTrue(diagnostics.contains("tlsV1Disabled=false"));
+            Assertions.assertTrue(diagnostics.contains("tlsRsaDisabled=false"));
+            Assertions.assertTrue(diagnostics.contains("rsaPkcs1Sha1HandshakeDisabled=false"));
             Assertions.assertTrue(diagnostics.contains("3desDisabled=false"));
             Assertions.assertTrue(diagnostics.contains("rc4Disabled=false"));
         } finally {
@@ -101,10 +106,14 @@ class SqlServerLegacyAgentTest {
     @Test
     void relaxedDisabledAlgorithmsRemovesOnlyLegacyTlsEntries() {
         String current =
-            "SSLv3, TLSv1, TLSv1.1, DTLSv1.0, RC4, DES, MD5withRSA, DH keySize < 1024, EC keySize < 224, 3DES_EDE_CBC, anon, NULL";
+            "SSLv3, TLSv1, TLSv1.1, DTLSv1.0, RC4, DES, MD5withRSA, TLS_RSA_*, "
+                + "rsa_pkcs1_sha1 usage HandshakeSignature, ecdsa_sha1 usage HandshakeSignature, "
+                + "dsa_sha1 usage HandshakeSignature, DH keySize < 1024, EC keySize < 224, "
+                + "3DES_EDE_CBC, anon, NULL";
 
         Assertions.assertEquals(
-            "SSLv3, EC keySize < 224, anon, NULL",
+            "SSLv3, ecdsa_sha1 usage HandshakeSignature, dsa_sha1 usage HandshakeSignature, "
+                + "EC keySize < 224, anon, NULL",
             SqlServerLegacyAgent.relaxedDisabledAlgorithms(current)
         );
     }