Add static override for JDK TLS disabled/legacy algorithms in Java container

CHANGES.md

@@ -63,6 +63,10 @@
 ## New Features / Improvements
 
 * X feature added (Java/Python) ([#X](https://github.com/apache/beam/issues/X)).
+* Adding override of allowed TLS algorithms (Java), now maintaining the disabled/legacy algorithms
+  present in 2.43.0 (up to 1.8.0_151, 11.0.9, 17.0.2 for respective Java versions). This primarily
+  re-enables TLSv1 and TLSv1.1 for Java 8 and Java 11 by default, and gives control over this
+  property for JVMs in the future.
 
 ## Breaking Changes
 
@@ -78,6 +82,7 @@
 ## Bugfixes
 
 * Fixed X (Java/Python) ([#X](https://github.com/apache/beam/issues/X)).
+* Fixed JDBC connection failures (Java) during handshake due to deprecated TLSv1(.1) protocol for the JDK. ([#24623](https://github.com/apache/beam/issues/24623))
 
 ## Known Issues
 

sdks/java/container/common.gradle

@@ -80,8 +80,10 @@ task copyGolangLicenses(type: Copy) {
 task copyJdkOptions(type: Copy) {
     if (imageJavaVersion == "17" || imageJavaVersion == "11") {
         from "option-jamm.json"
-        into "build/target/options"
     }
+    from "java${imageJavaVersion}-security.properties"
+    from "option-java${imageJavaVersion}-security.json"
+    into "build/target/options"
 }
 
 task skipPullLicenses(type: Exec) {
@@ -129,4 +131,4 @@ dockerPrepare.dependsOn copySdkHarnessLauncher
 dockerPrepare.dependsOn copyDockerfileDependencies
 dockerPrepare.dependsOn ":sdks:java:container:downloadCloudProfilerAgent"
 dockerPrepare.dependsOn copyJdkOptions
-dockerPrepare.dependsOn validateJavaHome
+dockerPrepare.dependsOn validateJavaHome

sdks/java/container/java11/java11-security.properties

@@ -0,0 +1,44 @@
+# Licensed to the Apache Software Foundation (ASF) under one or more
+# contributor license agreements.  See the NOTICE file distributed with
+# this work for additional information regarding copyright ownership.
+# The ASF licenses this file to You under the Apache License, Version 2.0
+# (the "License"); you may not use this file except in compliance with
+# the License.  You may obtain a copy of the License at
+#
+#    http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+# Java 11 java.security properties file override for JVM
+
+# Java has now disabled TLSv1 and TLSv1.1. We specifically put it in the
+# legacy algorithms list to allow it to be used if something better is not
+# available (e.g. TLSv1.2). This will prevent breakages for existing users
+# (for example JDBC with MySQL). See
+# https://bugs.java.com/bugdatabase/view_bug.do?bug_id=JDK-8202343
+# for additional details.
+#
+# GCM is explicitly disabled in Java 8 only because it performs very
+# poorly (https://stackoverflow.com/questions/25992131/slow-aes-gcm-encryption-and-decryption-with-java-8u20)
+# GCM is not disabled in Java 11 or 17 (https://bugs.openjdk.java.net/browse/JDK-8046943)
+#
+# SSLv3 is explicitly disabled due to the potential for the POODLE attack. See
+# https://www.cisa.gov/uscert/ncas/alerts/TA14-290A for additional details.
+# 
+# remaining algorithms derived from:
+# openjdk 11.0.9 2020-10-20
+# OpenJDK Runtime Environment 18.9 (build 11.0.9+11)
+# OpenJDK 64-Bit Server VM 18.9 (build 11.0.9+11, mixed mode)
+jdk.tls.disabledAlgorithms=SSLv3, RC4, DES, MD5withRSA, DH keySize < 1024, \
+    EC keySize < 224, 3DES_EDE_CBC, anon, NULL, \
+    include jdk.disabled.namedCurves
+
+jdk.tls.legacyAlgorithms= \
+        K_NULL, C_NULL, M_NULL, \
+        DH_anon, ECDH_anon, \
+        RC4_128, RC4_40, DES_CBC, DES40_CBC, \
+        3DES_EDE_CBC, TLSv1, TLSv1.1

sdks/java/container/java11/option-java11-security.json

@@ -0,0 +1,10 @@
+{
+    "name": "java-securtiy",
+    "enabled": true,
+    "options": {
+      "properties": {
+        "java.security.properties": "/opt/apache/beam/options/java11-security.properties"
+      }
+    }
+  }
+

sdks/java/container/java17/java17-security.properties

@@ -0,0 +1,44 @@
+# Licensed to the Apache Software Foundation (ASF) under one or more
+# contributor license agreements.  See the NOTICE file distributed with
+# this work for additional information regarding copyright ownership.
+# The ASF licenses this file to You under the Apache License, Version 2.0
+# (the "License"); you may not use this file except in compliance with
+# the License.  You may obtain a copy of the License at
+#
+#    http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+# Java 17 java.security properties file override for JVM
+
+# Java has now disabled TLSv1 and TLSv1.1. We specifically put it in the
+# legacy algorithms list to allow it to be used if something better is not
+# available (e.g. TLSv1.2). This will prevent breakages for existing users
+# (for example JDBC with MySQL). See
+# https://bugs.java.com/bugdatabase/view_bug.do?bug_id=JDK-8202343
+# for additional details.
+#
+# GCM is explicitly disabled in Java 8 only because it performs very
+# poorly (https://stackoverflow.com/questions/25992131/slow-aes-gcm-encryption-and-decryption-with-java-8u20)
+# GCM is not disabled in Java 11 or 17 (https://bugs.openjdk.java.net/browse/JDK-8046943)
+#
+# SSLv3 is explicitly disabled due to the potential for the POODLE attack. See
+# https://www.cisa.gov/uscert/ncas/alerts/TA14-290A for additional details.
+#
+# remaining algorithms derived from:
+# openjdk 17.0.2 2022-01-18
+# OpenJDK Runtime Environment (build 17.0.2+8-86)
+# OpenJDK 64-Bit Server VM (build 17.0.2+8-86, mixed mode, sharing)
+jdk.tls.disabledAlgorithms=SSLv3, RC4, DES, MD5withRSA, \
+    DH keySize < 1024, EC keySize < 224, 3DES_EDE_CBC, anon, NULL
+
+# The raw value from 17.0.2 for legacyAlgorithms is
+#   NULL, anon, RC4, DES, 3DES_EDE_CBC
+# Because these values are in disabledAlgorithms, it is erroneous to include
+# them in legacy (they are disabled in Java 8 and Java 11 as well). Here we 
+# only include TLSv1 and TLSv1.1 which were removed from disabledAlgorithms
+jdk.tls.legacyAlgorithms=TLSv1, TLSv1.1

sdks/java/container/java17/option-java17-security.json

@@ -0,0 +1,10 @@
+{
+    "name": "java-security",
+    "enabled": true,
+    "options": {
+      "properties": {
+        "java.security.properties": "/opt/apache/beam/options/java17-security.properties"
+      }
+    }
+  }
+

sdks/java/container/java8/java8-security.properties

@@ -0,0 +1,37 @@
+# Licensed to the Apache Software Foundation (ASF) under one or more
+# contributor license agreements.  See the NOTICE file distributed with
+# this work for additional information regarding copyright ownership.
+# The ASF licenses this file to You under the Apache License, Version 2.0
+# (the "License"); you may not use this file except in compliance with
+# the License.  You may obtain a copy of the License at
+#
+#    http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+# Java 8 java.security properties file override for JVM
+# base properties derived from:
+# java version "1.8.0_151"
+# Java(TM) SE Runtime Environment (build 1.8.0_151-b12)
+# Java HotSpot(TM) 64-Bit Server VM (build 25.151-b12, mixed mode)
+
+# New versions of Java have now disabled TLSv1 and TLSv1.1
+# 
+# To prevent breakages caused by the deprecation of algorithms during JDK
+# updates, we are explictly passing an override to these properties
+# to the JVM as a meta option.
+# NOTE: GCM is explicitly disabled in Java 8 only, not in Java 11 or 17
+jdk.tls.disabledAlgorithms=SSLv3, GCM, RC4, MD5withRSA, DH keySize < 768, \
+    EC keySize < 224
+
+jdk.tls.legacyAlgorithms= \
+        K_NULL, C_NULL, M_NULL, \
+        DHE_DSS_EXPORT, DHE_RSA_EXPORT, DH_anon_EXPORT, DH_DSS_EXPORT, \
+        DH_RSA_EXPORT, RSA_EXPORT, \
+        DH_anon, ECDH_anon, \
+        RC4_128, RC4_40, DES_CBC, DES40_CBC, \
+        3DES_EDE_CBC

sdks/java/container/java8/option-java8-security.json

@@ -0,0 +1,10 @@
+{
+    "name": "java-security",
+    "enabled": true,
+    "options": {
+      "properties": {
+        "java.security.properties": "/opt/apache/beam/options/java8-security.properties"
+      }
+    }
+  }
+