Update cassandra-stress default cipher suites to support tls 1.3 #4499

omniCoder77 · 2025-11-27T20:14:42Z

Problem

cassandra-stress can not connect to tls 1.3 servers with the current default cipher suites (TLS_RSA_WITH_AES_128_CBC_SHA and TLS_RSA_WITH_AES_256_CBC_SHA) because they don't have perfect forward secrecy, which tls 1.3 needs.

What i changed

I updated the default cipher suites in the ssl-ciphers option to use modern ones that support PFS:
Old ciphers:

TLS_RSA_WITH_AES_128_CBC_SHA,TLS_RSA_WITH_AES_256_CBC_SHA
New ciphers:
TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256

Why This Helps

Fixes the tls 1.3 connection issue
Adds perfect forward secrecy using ecdhe
Switches from cbc to gcm which is more secure
Still works with tls 1.2 servers

This is my first open source contribution, kindly let me know if i need to change anything or if there is any issue with my approach.

…tingsTransport.java Fix cassandra-stress TLS 1.3 handshake failures by updating default ciphers - Replace TLS_RSA_WITH_* cipher suites with TLS_ECDHE_RSA_WITH_* variants - Enable Perfect Forward Secrecy and TLS 1.3 compatibility - Align with NIST SP 800-52 and RFC 8446 security standards - Maintain backward compatibility with existing RSA certificates

Copilot

Pull request overview

This PR updates the default cipher suites for cassandra-stress to support TLS 1.3 connections. The old RSA-based cipher suites (TLS_RSA_WITH_AES_128_CBC_SHA, TLS_RSA_WITH_AES_256_CBC_SHA) lack perfect forward secrecy (PFS), which is required by TLS 1.3, preventing connections to TLS 1.3 servers.

Key Changes:

Updated default cipher suites from RSA-based to ECDHE-based variants that support perfect forward secrecy
Changed from CBC to GCM mode for improved security
Maintained backward compatibility with TLS 1.2 servers

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

tools/stress/src/org/apache/cassandra/stress/settings/SettingsTransport.java

…efore. Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>

bschoening · 2025-12-01T17:14:14Z

@omniCoder77 do we have to force a cipher here? Could it not just auto-negotiate?

See for example tools which don't appear to specify a particular cipher: https://github.com/apache/cassandra/blob/e1e39b074ac61f293d652b516a70c73b65c7ac3f/tools/sstableloader/src/org/apache/cassandra/tools/LoaderOptions.java

omniCoder77 · 2025-12-01T17:43:28Z

That makes sense! auto-negotiation would be better than forcing specific
ciphers.
i'll update the pr to use an empty default.

omniCoder77 · 2025-12-01T17:45:59Z

Shall I add a comment after empty string
// Empty = auto-negotiate

bschoening · 2025-12-01T17:51:35Z

// Default is to auto-negotiate

Copilot

Pull request overview

Copilot reviewed 1 out of 1 changed files in this pull request and generated 2 comments.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

Copilot · 2025-12-01T18:05:08Z

tools/stress/src/org/apache/cassandra/stress/settings/SettingsTransport.java

+        // Default is to auto-negotiate
        final OptionSimple ciphers = new OptionSimple("ssl-ciphers=", ".*",
-                                                      "TLS_RSA_WITH_AES_128_CBC_SHA,TLS_RSA_WITH_AES_256_CBC_SHA",
+                                                      "",


Changing the default for ssl-ciphers to an empty string does not "auto-negotiate" with the current implementation. Because the value is split and passed directly to the cipher suite setter, an empty string yields an invalid suite entry and will break TLS configuration. Recommend keeping the default null/unspecified and only applying withCipherSuites(...) when the option is explicitly set, or update the builder to treat empty as "use provider defaults".

Suggested change

"",

null,

Copilot · 2025-12-01T18:05:08Z

tools/stress/src/org/apache/cassandra/stress/settings/SettingsTransport.java

+                                                      "",
                                                      "SSL: comma delimited list of encryption suites to use", false);


The PR description states new defaults should be TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256, but the code sets the default to an empty string. This is inconsistent and will not achieve the stated goal of supporting TLS 1.3 by default. Recommend setting these modern suites as the default value here, or clarifying in the help text that no default suites are applied and users must specify them.

Suggested change

"",

"SSL: comma delimited list of encryption suites to use", false);

"TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256",

"SSL: comma delimited list of encryption suites to use (default: TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256)", false);

omniCoder77 · 2025-12-01T18:09:14Z

I updated the PR to use null value and similarly updated the explanation comment as the copilot suggested, shall I revert back to empty string, apologies for not asking for you approval.

bschoening · 2025-12-01T18:45:13Z

Ok, did you test it to ensure it works?

Would be good to run 'nodetool clientstats' to show the successful TLS 1.3 connection and put the output in the Jira

omniCoder77 · 2025-12-01T18:49:27Z

Thanks for the suggestion. I’ll run nodetool clientstats and attach the output here shortly to confirm the TLS connection.

omniCoder77 · 2025-12-02T17:42:03Z

I have confirmed and updated the connection status, connection using TLS 1.3 status and query execution check using null parameter for auto-negotiating on JIRA.

omniCoder77 · 2025-12-07T17:41:39Z

Hi @bschoening , just just checking if there's anything else needed from my side for this to be merged. I have updated the JIRA as you said.

jyothsnakonisa · 2025-12-15T16:43:22Z

@omniCoder77 do you want help in merging this?

omniCoder77 · 2025-12-15T17:42:32Z

@jyothsnakonisa Yes. I have updated the issue on JIRA. Just want to know if anything remains from my side for this PR to be merged. I'll be happy to do it.

jyothsnakonisa · 2025-12-15T18:12:02Z

@omniCoder77 I can help you with that, I do not see a test for validating the change that you made. can you confirm whether you have tested changes you made in this patch may be by running tlp-stress at least

bschoening · 2025-12-15T18:12:07Z

@omniCoder77 I have not had the time to test this yet, @jyothsnakonisa were you able to test the fix here?

omniCoder77 · 2025-12-15T18:18:47Z

@jyothsnakonisa Could you clarify what tlp-stress refers to? Is it the same as cassandra-stress?
If so, I have tested the patch using cassandra-stress and uploaded the results here at the bottom of the page.

jyothsnakonisa · 2025-12-15T18:21:21Z

Oh sorry I meant Cassandra-stress, missed the result that you posted on the JIRA. I am going to merge this now.

omniCoder77 · 2025-12-15T18:26:21Z

@jyothsnakonisa Thanks again for reviewing and merging, really appreciate it.

Copilot

Pull request overview

Copilot reviewed 1 out of 1 changed files in this pull request and generated 1 comment.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

tools/stress/src/org/apache/cassandra/stress/settings/SettingsTransport.java

omniCoder77 · 2025-12-15T18:32:23Z

@bschoening should i commit the suggestions copilot suggested?

bschoening · 2025-12-15T18:33:29Z

yes, please

…Transport.java with proper indentations Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>

bschoening requested a review from Copilot November 29, 2025 22:07

Copilot started reviewing on behalf of bschoening November 29, 2025 22:08 View session

Copilot finished reviewing on behalf of bschoening November 29, 2025 22:09

Copilot AI reviewed Nov 29, 2025

View reviewed changes

tools/stress/src/org/apache/cassandra/stress/settings/SettingsTransport.java Outdated Show resolved Hide resolved

tools/stress/src/org/apache/cassandra/stress/settings/SettingsTransport.java Outdated Show resolved Hide resolved

omniCoder77 and others added 2 commits November 30, 2025 09:49

Reorder cipher suites for better performance, putting 128 bit ciper b…

2c4a0df

…efore. Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>

Merge branch 'apache:trunk' into fix-cassandra-stress-tls

b75c335

Allow cipher auto-negotiation instead of forcing defaults

acb5d56

bschoening approved these changes Dec 1, 2025

View reviewed changes

Add comment explaining auto-negotiation default

8cd2beb

bschoening requested a review from Copilot December 1, 2025 17:55

Copilot started reviewing on behalf of bschoening December 1, 2025 17:56 View session

Copilot finished reviewing on behalf of bschoening December 1, 2025 17:57

Copilot AI reviewed Dec 1, 2025

View reviewed changes

Update default cipher value to null for auto-negotiation

d4704b6

jyothsnakonisa approved these changes Dec 15, 2025

View reviewed changes

Refactor cipher suites handling in SettingsTransport

88d3e31

bschoening requested a review from Copilot December 15, 2025 18:30

Copilot AI reviewed Dec 15, 2025

View reviewed changes

tools/stress/src/org/apache/cassandra/stress/settings/SettingsTransport.java Outdated Show resolved Hide resolved

Update tools/stress/src/org/apache/cassandra/stress/settings/Settings…

53a3f35

…Transport.java with proper indentations Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>

		"",
		"SSL: comma delimited list of encryption suites to use", false);

-                                                      "",
-                                                      "SSL: comma delimited list of encryption suites to use", false);
+                                                      "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256",
+                                                      "SSL: comma delimited list of encryption suites to use (default: TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256)", false);

Update cassandra-stress default cipher suites to support tls 1.3 #4499

Are you sure you want to change the base?

Update cassandra-stress default cipher suites to support tls 1.3 #4499

Conversation

omniCoder77 commented Nov 27, 2025

Problem

What i changed

Why This Helps

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Uh oh!

Uh oh!

bschoening commented Dec 1, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

omniCoder77 commented Dec 1, 2025

Uh oh!

omniCoder77 commented Dec 1, 2025

Uh oh!

bschoening commented Dec 1, 2025

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Copilot AI Dec 1, 2025

Choose a reason for hiding this comment

Uh oh!

Copilot AI Dec 1, 2025

Choose a reason for hiding this comment

Uh oh!

omniCoder77 commented Dec 1, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

bschoening commented Dec 1, 2025

Uh oh!

omniCoder77 commented Dec 1, 2025

Uh oh!

omniCoder77 commented Dec 2, 2025

Uh oh!

omniCoder77 commented Dec 7, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

jyothsnakonisa commented Dec 15, 2025

Uh oh!

omniCoder77 commented Dec 15, 2025

Uh oh!

jyothsnakonisa commented Dec 15, 2025

Uh oh!

bschoening commented Dec 15, 2025

Uh oh!

omniCoder77 commented Dec 15, 2025

Uh oh!

jyothsnakonisa commented Dec 15, 2025

Uh oh!

omniCoder77 commented Dec 15, 2025

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Uh oh!

omniCoder77 commented Dec 15, 2025

Uh oh!

bschoening commented Dec 15, 2025

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

bschoening commented Dec 1, 2025 •

edited

Loading

omniCoder77 commented Dec 1, 2025 •

edited

Loading

omniCoder77 commented Dec 7, 2025 •

edited

Loading