Problems connecting to firebird from JDBC

[Adam McMahon]

Hi,

I am a new FB user.  I have a fresh windows install of FB  (in c:\ folder).  I am using  classic mode (I think).   I am using jaybird-full-4.0.0.java8.jar.

My test code is :

Class.forName("org.firebirdsql.jdbc.FBDriver");

            Connection connection = DriverManager.getConnection(
                    "jdbc:firebirdsql://localhost:3050/C:\\Users\\adams\\firstdb.fdb?charSet=utf-8&wireCrypt=REQUIRED", "sysdba", "54321");

I have tried different options for wireCrypt, but I get the following exception, any thoughts?

org.firebirdsql.gds.ng.wire.crypt.FBSQLEncryptException: Incompatible wire encryption levels requested on client and server [SQLState:28000, ISC error code:335545064]
    at org.firebirdsql.gds.ng.FbExceptionBuilder$Type$4.createSQLException(FbExceptionBuilder.java:577)
    at org.firebirdsql.gds.ng.FbExceptionBuilder.toFlatSQLException(FbExceptionBuilder.java:304)
    at org.firebirdsql.gds.ng.wire.version13.V13WireOperations.tryKnownServerKeys(V13WireOperations.java:213)
    at org.firebirdsql.gds.ng.wire.version13.V13WireOperations.authReceiveResponse(V13WireOperations.java:133)
    at org.firebirdsql.gds.ng.wire.version10.V10Database.authReceiveResponse(V10Database.java:569)
    at org.firebirdsql.gds.ng.wire.WireConnection.identify(WireConnection.java:335)
    at org.firebirdsql.gds.ng.wire.FbWireDatabaseFactory.performConnect(FbWireDatabaseFactory.java:51)
    at org.firebirdsql.gds.ng.wire.FbWireDatabaseFactory.connect(FbWireDatabaseFactory.java:39)
    at org.firebirdsql.gds.ng.wire.FbWireDatabaseFactory.connect(FbWireDatabaseFactory.java:32)
    at org.firebirdsql.jca.FBManagedConnection.<init>(FBManagedConnection.java:143)
    at org.firebirdsql.jca.FBManagedConnectionFactory.createManagedConnection(FBManagedConnectionFactory.java:591)
    at org.firebirdsql.jca.FBStandAloneConnectionManager.allocateConnection(FBStandAloneConnectionManager.java:65)
    at org.firebirdsql.jdbc.FBDataSource.getConnection(FBDataSource.java:109)
    at org.firebirdsql.jdbc.FBDriver.connect(FBDriver.java:115)
    at java.sql.DriverManager.getConnection(DriverManager.java:664)
    at java.sql.DriverManager.getConnection(DriverManager.java:247)
    at firebirdtest.FirebirdTest.main(FirebirdTest.java:15)
Caused by: org.firebirdsql.jdbc.FBSQLExceptionInfo: Incompatible wire encryption levels requested on client and server

[Mark Rotteveel]

On 11-08-2020 19:46, Adam McMahon wrote:
> I am a new FB user.  I have a fresh windows install of FB  (in c:\
> folder).  I am using  classic mode (I think).   I am using
> jaybird-full-4.0.0.java8.jar.
>
> My test code is :
>
> Class.forName("org.firebirdsql.jdbc.FBDriver");
>
>             Connection connection = DriverManager.getConnection(
>
> "jdbc:firebirdsql://localhost:3050/C:\\Users\\adams\\firstdb.fdb?charSet=utf-8&wireCrypt=REQUIRED",
> "sysdba", "54321");
>
> I have tried different options for wireCrypt, but I get the following
> exception, any thoughts?
>
>
> org.firebirdsql.gds.ng.wire.crypt.FBSQLEncryptException: Incompatible
> wire encryption levels requested on client and server [SQLState:28000,
> ISC error code:335545064]

This means that your Firebird instance is configured with
WireCrypt=Disabled in firebird.conf. As you specify wireCrypt=REQUIRED,
the connection cannot be established as it is disabled on the server.

You either need to change firebird.conf to use WireCrypt=Enabled (or
WireCrypt=Required), or you need to drop the wireCrypt connection
property from your connection string.

See also
https://www.firebirdsql.org/file/documentation/drivers_documentation/java/faq.html#incompatible-wire-encryption-levels-requested-on-client-and-server-335545064

Mark
--
Mark Rotteveel

[Adam McMahon]

Mark,

If I drop the wireCrypt property, I get a similar exception (which is why I put it in).

Connection connection = DriverManager.getConnection(
                    "jdbc:firebirdsql://localhost:3050/C:\\Users\\adams\\firstdb.fdb?charSet=utf-8",
                    "sysdba", "54321");

Aug 11, 2020 3:02:43 PM org.firebirdsql.logging.JulLogger warn
WARNING: Wire encryption established, but some plugins failed; see other loglines for details
Aug 11, 2020 3:02:43 PM org.firebirdsql.logging.JulLogger warn
WARNING: Encryption plugin failed: org.firebirdsql.gds.ng.wire.crypt.FBSQLEncryptException: Encryption key did not meet algorithm requirements of Symmetric/Arc4 [SQLState:28000, ISC error code:337248282]; see debug level for stacktrace
Aug 11, 2020 3:02:43 PM org.firebirdsql.logging.JulLogger warn
WARNING: Encryption plugin failed: org.firebirdsql.gds.ng.wire.crypt.FBSQLEncryptException: Encryption key did not meet algorithm requirements of Symmetric/Arc4 [SQLState:28000, ISC error code:337248282]; see debug level for stacktrace
org.firebirdsql.gds.ng.wire.crypt.FBSQLEncryptException: Client attempted to attach unencrypted but wire encryption is required [SQLState:28000, ISC error code:335545065]

    at org.firebirdsql.gds.ng.FbExceptionBuilder$Type$4.createSQLException(FbExceptionBuilder.java:577)
    at org.firebirdsql.gds.ng.FbExceptionBuilder.toFlatSQLException(FbExceptionBuilder.java:304)

    at org.firebirdsql.gds.ng.wire.AbstractWireOperations.readStatusVector(AbstractWireOperations.java:140)
    at org.firebirdsql.gds.ng.wire.AbstractWireOperations.processOperation(AbstractWireOperations.java:204)
    at org.firebirdsql.gds.ng.wire.AbstractWireOperations.readOperationResponse(AbstractWireOperations.java:163)
    at org.firebirdsql.gds.ng.wire.version13.V13WireOperations.authReceiveResponse(V13WireOperations.java:124)
    at org.firebirdsql.gds.ng.wire.version10.V10Database.authReceiveResponse(V10Database.java:569)
    at org.firebirdsql.gds.ng.wire.version10.V10Database.attachOrCreate(V10Database.java:111)
    at org.firebirdsql.gds.ng.wire.version10.V10Database.attach(V10Database.java:81)
    at org.firebirdsql.jca.FBManagedConnection.<init>(FBManagedConnection.java:146)

    at org.firebirdsql.jca.FBManagedConnectionFactory.createManagedConnection(FBManagedConnectionFactory.java:591)
    at org.firebirdsql.jca.FBStandAloneConnectionManager.allocateConnection(FBStandAloneConnectionManager.java:65)
    at org.firebirdsql.jdbc.FBDataSource.getConnection(FBDataSource.java:109)
    at org.firebirdsql.jdbc.FBDriver.connect(FBDriver.java:115)
    at java.sql.DriverManager.getConnection(DriverManager.java:664)
    at java.sql.DriverManager.getConnection(DriverManager.java:247)
    at firebirdtest.FirebirdTest.main(FirebirdTest.java:15)

Caused by: org.firebirdsql.jdbc.FBSQLExceptionInfo: Client attempted to attach unencrypted but wire encryption is required

[Mark Rotteveel]

On 11-08-2020 21:04, Adam McMahon wrote:
> If I drop the wireCrypt property, I get a similar exception (which is
> why I put it in).
>
> Connection connection = DriverManager.getConnection(
>
> "jdbc:firebirdsql://localhost:3050/C:\\Users\\adams\\firstdb.fdb?charSet=utf-8",
>                     "sysdba", "54321");
>
> Aug 11, 2020 3:02:43 PM org.firebirdsql.logging.JulLogger warn
> WARNING: Wire encryption established, but some plugins failed; see other
> loglines for details
> Aug 11, 2020 3:02:43 PM org.firebirdsql.logging.JulLogger warn
> WARNING: Encryption plugin failed:
> org.firebirdsql.gds.ng.wire.crypt.FBSQLEncryptException: Encryption key
> did not meet algorithm requirements of Symmetric/Arc4 [SQLState:28000,
> ISC error code:337248282]; see debug level for stacktrace
> Aug 11, 2020 3:02:43 PM org.firebirdsql.logging.JulLogger warn
> WARNING: Encryption plugin failed:
> org.firebirdsql.gds.ng.wire.crypt.FBSQLEncryptException: Encryption key
> did not meet algorithm requirements of Symmetric/Arc4 [SQLState:28000,
> ISC error code:337248282]; see debug level for stacktrace
> org.firebirdsql.gds.ng.wire.crypt.FBSQLEncryptException: Client
> attempted to attach unencrypted but wire encryption is required
> [SQLState:28000, ISC error code:335545065]

Hmm, interesting combination of logging. On the one hand it suggests
encryption was established, but the subsequent error returned from the
server suggests it wasn't.

What is your Java version (the full version)? Is there anything in the
firebird.log?

Mark
--
Mark Rotteveel

[Adam McMahon]

I am using 1.8.0_131 on windows.  There is no log file in my firebird directory (which seems very odd).  My install folder is simply Firebird_3_0. 

-Adam

[Mark Rotteveel]

On 11-08-2020 21:24, Adam McMahon wrote:
> I am using 1.8.0_131 on windows.  There is no log file in my firebird
> directory (which seems very odd).  My install folder is simply
> Firebird_3_0.

I am pretty certain that the problem is that you don't have the
unlimited strength cryptography jurisdiction policy in your Java
installation, which causes Jaybird not being able to initialize
encryption (which is also the cause for the exception you initially had).

I would recommend updating to a more recent Java 8 version (current
latest is Java 8 update 262), as since Java 8 update 161 the unlimited
strength cryptography jurisdiction policy is enabled by default.

For Java 8 update 131, see
https://stackoverflow.com/questions/3862800/invalidkeyexception-illegal-key-size/3864276#3864276
how to enable this. However, I see that the necessary policy file can no
longer be downloaded from the Oracle site. When upgrading to a more
recent version, keep in mind that the license changed of Oracle Java
(after update 202 if I'm not mistaken), so you might want to consider
switching to AdoptOpenJDK instead)

Alternatively, disable wire crypt in firebird.conf by setting WireCrypt
= Disabled and restart the server.

See also
https://www.firebirdsql.org/file/documentation/drivers_documentation/java/faq.html#encryption-key-did-not-meet-algorithm-requirements-of-symmetricarc4-337248282

I do see some things in the way Jaybird creates these exceptions and the
logging that make this harder to diagnose than necessary.

Mark
--
Mark Rotteveel

[Adam McMahon]

Updating the Java 8 JDK to the latest fixes the problem.   The new license does not directly impact me right now, but it might in the future.  Thanks for your help.

-Adam

[Arioch The]

installation, which causes Jaybird not being able to initialize
encryption (which is also the cause for the exception you initially had).

May Jaybird test early for this condition and log better warning? 

I guess all it takes is seeing if encryption was enabled in JDBC URI/props and then trying to create any cipher object with key length exceeding USA export restrictions

[Mark Rotteveel]

I had thought of that, but that is not an option, because it is possible
that a different plugin uses a cipher that does not exceed the policy,
or that a different authentication plugin generates a smaller key (and
thus does not exceed that policy).

In addition, with all recent Java versions (since Java 8 update 161),
this is less of a concern as since that version the default policy is
unlimited.

However, the exceptions and logging were less clear than they could, so
I have improved that a bit.

Mark
--
Mark Rotteveel