当使用BouncyCasle库启用FIPS模式时，Cassandra 4在启动时崩溃

gwo2fgha  于 2022-09-27  发布在  Cassandra
关注(0)|答案(1)|浏览(186)

我的应用程序在FIPS和NO FIPS模式下运行。
NO FIPS模式使用默认java。安全提供程序和信任库/密钥库采用JKS格式。
FIPS模式使用BCFKS密钥库/信任库格式并对所有系统进行适当更改（更改java.security providers、cassandra.yaml…，更改后重新启动cassandra服务器）
所以目前我正在使用Cassandra3，计划升级到Cassandra4。
使用默认设置升级NO FIPS后，它将正常工作。但一旦我启用FIPS模式，它就会崩溃，并显示以下消息。

ERROR [main] 2022-08-19T14:15:58,533 CassandraDaemon.java:911 - Exception encountered during startup
org.apache.cassandra.exceptions.ConfigurationException: Failed to initialize SSL
        at org.apache.cassandra.config.DatabaseDescriptor.applySslContext(DatabaseDescriptor.java:1014) ~[apache-cassandra-4.0.4.jar:4.0.4]
        at org.apache.cassandra.config.DatabaseDescriptor.applyAll(DatabaseDescriptor.java:364) ~[apache-cassandra-4.0.4.jar:4.0.4]
        at org.apache.cassandra.config.DatabaseDescriptor.daemonInitialization(DatabaseDescriptor.java:178) ~[apache-cassandra-4.0.4.jar:4.0.4]
        at org.apache.cassandra.config.DatabaseDescriptor.daemonInitialization(DatabaseDescriptor.java:162) ~[apache-cassandra-4.0.4.jar:4.0.4]
        at org.apache.cassandra.service.CassandraDaemon.applyConfig(CassandraDaemon.java:818) [apache-cassandra-4.0.4.jar:4.0.4]
        at org.apache.cassandra.service.CassandraDaemon.activate(CassandraDaemon.java:754) [apache-cassandra-4.0.4.jar:4.0.4]
        at org.apache.cassandra.service.CassandraDaemon.main(CassandraDaemon.java:889) [apache-cassandra-4.0.4.jar:4.0.4]
Caused by: java.io.IOException: Failed to create SSL context using Native transport
        at org.apache.cassandra.security.SSLFactory.validateSslContext(SSLFactory.java:546) ~[apache-cassandra-4.0.4.jar:4.0.4]
        at org.apache.cassandra.config.DatabaseDescriptor.applySslContext(DatabaseDescriptor.java:1009) ~[apache-cassandra-4.0.4.jar:4.0.4]
        ... 6 more
Caused by: javax.net.ssl.SSLException: unable to setup trustmanager
        at io.netty.handler.ssl.ReferenceCountedOpenSslServerContext.newSessionContext(ReferenceCountedOpenSslServerContext.java:183) ~[netty-all-4.1.58.Final.jar:4.1.58.Final]
        at io.netty.handler.ssl.OpenSslServerContext.<init>(OpenSslServerContext.java:353) ~[netty-all-4.1.58.Final.jar:4.1.58.Final]
        at io.netty.handler.ssl.OpenSslServerContext.<init>(OpenSslServerContext.java:334) ~[netty-all-4.1.58.Final.jar:4.1.58.Final]
        at io.netty.handler.ssl.SslContext.newServerContextInternal(SslContext.java:471) ~[netty-all-4.1.58.Final.jar:4.1.58.Final]
        at io.netty.handler.ssl.SslContextBuilder.build(SslContextBuilder.java:571) ~[netty-all-4.1.58.Final.jar:4.1.58.Final]
        at org.apache.cassandra.security.SSLFactory.createNettySslContext(SSLFactory.java:339) ~[apache-cassandra-4.0.4.jar:4.0.4]
        at org.apache.cassandra.security.SSLFactory.validateSslContext(SSLFactory.java:496) ~[apache-cassandra-4.0.4.jar:4.0.4]
        at org.apache.cassandra.config.DatabaseDescriptor.applySslContext(DatabaseDescriptor.java:1009) ~[apache-cassandra-4.0.4.jar:4.0.4]
        ... 6 more
Caused by: java.security.KeyStoreException: Failed to load default?trust store
        at org.bouncycastle.jsse.provider.ProvTrustManagerFactorySpi.engineInit(ProvTrustManagerFactorySpi.java:172) ~[bctls-fips-debug-1.0.11.jar:1.0.11]
        at javax.net.ssl.TrustManagerFactory.init(TrustManagerFactory.java:250) ~[?:1.8.0_321]
        at io.netty.handler.ssl.ReferenceCountedOpenSslServerContext.newSessionContext(ReferenceCountedOpenSslServerContext.java:147) ~[netty-all-4.1.58.Final.jar:4.1.58.Final]
        at io.netty.handler.ssl.OpenSslServerContext.<init>(OpenSslServerContext.java:353) ~[netty-all-4.1.58.Final.jar:4.1.58.Final]
        at io.netty.handler.ssl.OpenSslServerContext.<init>(OpenSslServerContext.java:334) ~[netty-all-4.1.58.Final.jar:4.1.58.Final]
        at io.netty.handler.ssl.SslContext.newServerContextInternal(SslContext.java:471) ~[netty-all-4.1.58.Final.jar:4.1.58.Final]
        at io.netty.handler.ssl.SslContextBuilder.build(SslContextBuilder.java:571) ~[netty-all-4.1.58.Final.jar:4.1.58.Final]
        at org.apache.cassandra.security.SSLFactory.createNettySslContext(SSLFactory.java:339) ~[apache-cassandra-4.0.4.jar:4.0.4]
        at org.apache.cassandra.security.SSLFactory.validateSslContext(SSLFactory.java:496) ~[apache-cassandra-4.0.4.jar:4.0.4]
        at org.apache.cassandra.config.DatabaseDescriptor.applySslContext(DatabaseDescriptor.java:1009) ~[apache-cassandra-4.0.4.jar:4.0.4]
        ... 6 more
Caused by: java.io.IOException: BCFKS KeyStore corrupted: MAC calculation failed.
        at org.bouncycastle.jcajce.provider.ProvBCFKS$BCFIPSKeyStoreSpi.verifyMac(ProvBCFKS.java:945) ~[bc-fips-1.0.2.1.jar:1.0.2.1]
        at org.bouncycastle.jcajce.provider.ProvBCFKS$BCFIPSKeyStoreSpi.engineLoad(ProvBCFKS.java:1236) ~[bc-fips-1.0.2.1.jar:1.0.2.1]
        at java.security.KeyStore.load(KeyStore.java:1445) ~[?:1.8.0_321]
        at org.bouncycastle.jsse.provider.ProvTrustManagerFactorySpi.getDefaultTrustStore(ProvTrustManagerFactorySpi.java:109) ~[bctls-fips-debug-1.0.11.jar:1.0.11]
        at org.bouncycastle.jsse.provider.ProvTrustManagerFactorySpi.engineInit(ProvTrustManagerFactorySpi.java:152) ~[bctls-fips-debug-1.0.11.jar:1.0.11]
        at javax.net.ssl.TrustManagerFactory.init(TrustManagerFactory.java:250) ~[?:1.8.0_321]
        at io.netty.handler.ssl.ReferenceCountedOpenSslServerContext.newSessionContext(ReferenceCountedOpenSslServerContext.java:147) ~[netty-all-4.1.58.Final.jar:4.1.58.Final]
        at io.netty.handler.ssl.OpenSslServerContext.<init>(OpenSslServerContext.java:353) ~[netty-all-4.1.58.Final.jar:4.1.58.Final]
        at io.netty.handler.ssl.OpenSslServerContext.<init>(OpenSslServerContext.java:334) ~[netty-all-4.1.58.Final.jar:4.1.58.Final]
        at io.netty.handler.ssl.SslContext.newServerContextInternal(SslContext.java:471) ~[netty-all-4.1.58.Final.jar:4.1.58.Final]
        at io.netty.handler.ssl.SslContextBuilder.build(SslContextBuilder.java:571) ~[netty-all-4.1.58.Final.jar:4.1.58.Final]
        at org.apache.cassandra.security.SSLFactory.createNettySslContext(SSLFactory.java:339) ~[apache-cassandra-4.0.4.jar:4.0.4]
        at org.apache.cassandra.security.SSLFactory.validateSslContext(SSLFactory.java:496) ~[apache-cassandra-4.0.4.jar:4.0.4]
        at org.apache.cassandra.config.DatabaseDescriptor.applySslContext(DatabaseDescriptor.java:1009) ~[apache-cassandra-4.0.4.jar:4.0.4]
        ... 6 more

关键错误消息是
BCFKS KeyStore损坏：MAC计算失败
当您要在密钥库（JKS格式）中列出证书时，您使用keytool --list --keystore PATH，但对于BCFKS格式（这是BouncyCase中使用的格式），您还必须传递e1d1e，否则，您将得到相同的消息BCFKS KeyStore corrupted: MAC calculation failed与版本4中的Cassandra 3版本相比，SSL内容生成经过netty lib，似乎在调用中的某个位置密码丢失，我看到相同的错误消息e1d 3d1e
我的Cassandra的相关配置部分。yaml配置。配置中的路径和密码正确。

server_encryption_options:
  keystore_password: PASSWORD
  enable_legacy_ssl_storage_port: true
  require_client_auth: false
  internode_encryption: none
  truststore_password: PASSWORD
  keystore: KEYSTORE_PATH
  truststore: TRUSTSTORE_PATH
  store_type: BCFKS
  cipher_suites: [TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384, TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256]
cassandra

1条答案

按热度按时间
toe95027

toe950271#

Cassandra 4依赖Netty加载密钥库/信任库。在Netty中，默认的SSLContent生成器是SslProvider.OPENSSL。我使用的openssl版本是经过FIPS验证的，可能需要在Netty中进行额外配置，以便在FIPS模式下正确使用openssl。
另一个解决方案是更改默认的SSLProvider。OPENSSL到SSL提供者。JDK允许Netty依赖JDK SSLContent生成器。为此，在cassandra evn中添加以下行。sh文件

JVM_OPTS="$JVM_OPTS -Dcassandra.disable_tcactive_openssl=true"
赞(0）分享  回复(0）举报  2022-09-27
我来回答

相关问题

    查看更多

    热门标签

    更多
    JavaquerypythonNode开发语言requestUtil数据库Table后端算法LoggerMessageElementParser

    最新问答

    更多
    • 蜀ICP备2022004421号-2 NULL123 https://www.null123.com © All rights reserved
    • 本站内容来源互联网,如果侵犯您的权益请联系我们删除, 联系方式：448109455@qq.com