jmeter-issues mailing list archives

Site index · List index
Message view « Date » · « Thread »
Top « Date » · « Thread »
From bugzi...@apache.org
Subject [Bug 62595] New: SMTPSampler does not allow configuring the SSL/TLS protocols to be used on handshake
Date Fri, 03 Aug 2018 05:06:22 GMT
https://bz.apache.org/bugzilla/show_bug.cgi?id=62595

            Bug ID: 62595
           Summary: SMTPSampler does not allow configuring the SSL/TLS
                    protocols to be used on handshake
           Product: JMeter
           Version: 4.0
          Hardware: PC
                OS: All
            Status: NEW
          Severity: enhancement
          Priority: P2
         Component: Main
          Assignee: issues@jmeter.apache.org
          Reporter: felipe.cuozzo@gmail.com
  Target Milestone: ---

Currently the logic on SendMailCommand#prepareMessage method does the
following:


 if (useStartTLS || useSSL) {
    try {
      String allProtocols = StringUtils.join(                  
 SSLContext.getDefault().getSupportedSSLParameters().getProtocols(), " ");
       logger.info("Use ssl/tls protocols for mail: {}", allProtocols);
       props.setProperty("mail." + protocol + ".ssl.protocols", allProtocols);


The default SSLContext will return a list of all supported protocols for the
current JRE, typically "SSLv2Hello TLSv1 TLSv1.1 TLSv1.2"

If for some reason the server does not accept the deprecated SSLv3 protocol
(see https://tools.ietf.org/html/rfc7568) the handshake will fail.

This article describes how to disable SSLv3 (and the SSLv2Hello
pseudo-protocol) 

http://www.oracle.com/technetwork/java/javase/documentation/cve-2014-3566-2342133.html

Which can be done by setting the system property "jdk.tls.client.protocols" at
startup time.

The bug arises because the code is getting the supported not the enabled
protocols.

Expected behavior on the SSL/TLS handshake would be that the SMTPSampler only
used the enabled protocols.

Because the system property changes the settings for the default SSLContext, I
suggest that a new configuration field is added on the GUI panel for the
SMTPSampler that allows to override the list of protocols so one can
specifically set which protocols to be used for the handshake.

-- 
You are receiving this mail because:
You are the assignee for the bug.
Mime
View raw message