Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Add static override for JDK TLS disabled/legacy algorithms in Java container #24619

Merged
merged 29 commits into from
Jan 5, 2023
Merged
Changes from 4 commits
Commits
Show all changes
29 commits
Select commit Hold shift + click to select a range
f5683be
Adding jdk.tls security property options to java containers
cwrothrock Dec 9, 2022
5e78c0c
Merge branch 'apache:master' into master
cwrothrock Dec 9, 2022
59496c7
Merge branch 'apache:master' into master
cwrothrock Dec 9, 2022
86e334d
Merge branch 'master' of https://github.com/cwrothrock/beam
cwrothrock Dec 9, 2022
dbcdec7
Update CHANGES.md
cwrothrock Dec 9, 2022
9b905a8
Fix invalid copy task configuration
cwrothrock Dec 9, 2022
28d6530
Adding license to TLS properties files
cwrothrock Dec 9, 2022
e0b01c1
Merge branch 'master' of https://github.com/cwrothrock/beam
cwrothrock Dec 9, 2022
068f516
Added bugfix description and link to CHANGES.md for #24623
cwrothrock Dec 9, 2022
0ec6ecb
Renaming to match global implications for security properties overrid…
cwrothrock Dec 13, 2022
e4d773a
Add license
cwrothrock Dec 14, 2022
6947e67
Add license
cwrothrock Dec 14, 2022
4a3b8ae
Adding TLS-enabled check to SdkHarnessEnvironment tests
cwrothrock Dec 20, 2022
418f94a
Merge branch 'master' of https://github.com/cwrothrock/beam
cwrothrock Dec 20, 2022
e908a53
Update sdks/java/container/java11/option-java11-security.json
cwrothrock Dec 20, 2022
f8b88c8
Merge branch 'master' of https://github.com/cwrothrock/beam
cwrothrock Dec 20, 2022
f9b35c4
Adjusting version fallback specification for Java
cwrothrock Dec 29, 2022
dc6fb00
Merge branch 'master' into master
cwrothrock Jan 3, 2023
20bcf56
Making suggested fixes
cwrothrock Jan 3, 2023
2020b79
Merge branch 'master' of https://github.com/cwrothrock/beam
cwrothrock Jan 3, 2023
605c888
Fixing indentation
cwrothrock Jan 3, 2023
c822888
Adding SSLContext check to TLS availability test
cwrothrock Jan 4, 2023
ab531d3
Merge branch 'apache:master' into master
cwrothrock Jan 4, 2023
f064c02
Making suggested improvements to test
cwrothrock Jan 4, 2023
d154e87
Removing exception imports no longer needed
cwrothrock Jan 4, 2023
90a977c
Remove whitespace and erroneous context null initialization
cwrothrock Jan 4, 2023
3761f32
Fix typo
cwrothrock Jan 4, 2023
4eeb4e0
Update sdks/java/core/src/test/java/org/apache/beam/sdk/SdkHarnessEnv…
cwrothrock Jan 4, 2023
eb2353e
Fix spotless java precommit formatting error
cwrothrock Jan 5, 2023
File filter

Filter by extension

Filter by extension

Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
Original file line number Diff line number Diff line change
Expand Up @@ -23,8 +23,6 @@
import static org.hamcrest.Matchers.not;
import static org.junit.Assert.assertNotNull;

import java.security.KeyManagementException;
import java.security.NoSuchAlgorithmException;
import java.security.Security;
import javax.net.ssl.SSLContext;
import org.apache.beam.sdk.coders.StringUtf8Coder;
Expand Down Expand Up @@ -77,22 +75,24 @@ public void testJammAgentAvailable() throws Exception {
/** {@link DoFn} used to validate that TLS was enabled as part of java security properties. */
private static class TLSDoFn extends DoFn<String, String> {
@ProcessElement
public void processElement(ProcessContext c) {
public void processElement(ProcessContext c) throws Exception {
String[] disabledAlgorithms =
Security.getProperty("jdk.tls.disabledAlgorithms").trim().split("\\s*,\\s*");
String[] legacyAlgorithms =
Security.getProperty("jdk.tls.legacyAlgorithms").trim().split("\\s*,\\s*");
assertThat(disabledAlgorithms, not(hasItemInArray("TLSv1")));
assertThat(disabledAlgorithms, not(hasItemInArray("TLSv1.1")));
cwrothrock marked this conversation as resolved.
Show resolved Hide resolved
assertThat(legacyAlgorithms, hasItemInArray("TLSv1"));
assertThat(legacyAlgorithms, hasItemInArray("TLSv1.1"));

SSLContext context = null;
String[] defaultProtocols = null;
try {
context = SSLContext.getInstance("TLS");
context.init(null, null, null);
defaultProtocols = context.getDefaultSSLParameters().getProtocols();
} catch (NoSuchAlgorithmException | KeyManagementException e) {
return;
}
// getSupportedSSLParameters() shows all protocols that JSSE implements thare aren't
// statically prohibited by the policy file
// use getDefaultSSLParameters() to see what is enabled by default -- and is used in your
// socket, since it doesn't override the context's default
cwrothrock marked this conversation as resolved.
Show resolved Hide resolved
SSLContext context = SSLContext.getInstance("TLS");
context.init(null, null, null);
assertNotNull(context);
String[] defaultProtocols = context.getDefaultSSLParameters().getProtocols();
assertThat(defaultProtocols, hasItemInArray("TLSv1"));
assertThat(defaultProtocols, hasItemInArray("TLSv1.1"));

Expand Down