dCache/dcache — pull request #86 by gbehrmann (2013-06-04 15:00:46+00:00)
Title: Ban elliptic-curve ciphers to prevent unsupported ciphers from being sel...

...ected

Elliptic-Curve (EC) based ciphers offer advantages over RSA- and
DSA-based ciphers and are being introduced, albeit slowly. OpenJDK (6 &
7) use external libraries, such as libnss3, to provide support for
various cipher-suites, including support for EC ciphers. The libnss3
library provide only partial support for all of the EC-based ciphers.

Unfortuantely, the generic front-end believes all ciphers are supported.
So, if during an SSL/TLS negotiation, the client requests an EC cipher
that libnss3 doesn't support, the SSLEngine may choose that cipher. The
result is an exception being thrown with the cryptic
'CKR_DOMAIN_PARAMS_INVALID' message.

Rather than trying to deploy work-arounds in the client or trying to
document how to disable EC-support in the server using JVM-related
configuration, this patch bans the EC ciphers programatically.

Patch: http://rb.dcache.org/r/5527/
Acked-by: Gerd Behrmann
Target: master
Request: 2.6
(cherry picked from commit 137e1365954713879e87be014e19f5044fabb13d)

Conflicts:
modules/dcache-ftp/src/main/java/diskCacheV111/doors/GsiFtpDoorV1.java
modules/javatunnel/src/main/java/javatunnel/GsiTunnel.java