Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Add static override for JDK TLS disabled/legacy algorithms in Java container #24619

Merged
merged 29 commits into from
Jan 5, 2023
Merged
Show file tree
Hide file tree
Changes from 18 commits
Commits
Show all changes
29 commits
Select commit Hold shift + click to select a range
f5683be
Adding jdk.tls security property options to java containers
cwrothrock Dec 9, 2022
5e78c0c
Merge branch 'apache:master' into master
cwrothrock Dec 9, 2022
59496c7
Merge branch 'apache:master' into master
cwrothrock Dec 9, 2022
86e334d
Merge branch 'master' of https://github.com/cwrothrock/beam
cwrothrock Dec 9, 2022
dbcdec7
Update CHANGES.md
cwrothrock Dec 9, 2022
9b905a8
Fix invalid copy task configuration
cwrothrock Dec 9, 2022
28d6530
Adding license to TLS properties files
cwrothrock Dec 9, 2022
e0b01c1
Merge branch 'master' of https://github.com/cwrothrock/beam
cwrothrock Dec 9, 2022
068f516
Added bugfix description and link to CHANGES.md for #24623
cwrothrock Dec 9, 2022
0ec6ecb
Renaming to match global implications for security properties overrid…
cwrothrock Dec 13, 2022
e4d773a
Add license
cwrothrock Dec 14, 2022
6947e67
Add license
cwrothrock Dec 14, 2022
4a3b8ae
Adding TLS-enabled check to SdkHarnessEnvironment tests
cwrothrock Dec 20, 2022
418f94a
Merge branch 'master' of https://github.com/cwrothrock/beam
cwrothrock Dec 20, 2022
e908a53
Update sdks/java/container/java11/option-java11-security.json
cwrothrock Dec 20, 2022
f8b88c8
Merge branch 'master' of https://github.com/cwrothrock/beam
cwrothrock Dec 20, 2022
f9b35c4
Adjusting version fallback specification for Java
cwrothrock Dec 29, 2022
dc6fb00
Merge branch 'master' into master
cwrothrock Jan 3, 2023
20bcf56
Making suggested fixes
cwrothrock Jan 3, 2023
2020b79
Merge branch 'master' of https://github.com/cwrothrock/beam
cwrothrock Jan 3, 2023
605c888
Fixing indentation
cwrothrock Jan 3, 2023
c822888
Adding SSLContext check to TLS availability test
cwrothrock Jan 4, 2023
ab531d3
Merge branch 'apache:master' into master
cwrothrock Jan 4, 2023
f064c02
Making suggested improvements to test
cwrothrock Jan 4, 2023
d154e87
Removing exception imports no longer needed
cwrothrock Jan 4, 2023
90a977c
Remove whitespace and erroneous context null initialization
cwrothrock Jan 4, 2023
3761f32
Fix typo
cwrothrock Jan 4, 2023
4eeb4e0
Update sdks/java/core/src/test/java/org/apache/beam/sdk/SdkHarnessEnv…
cwrothrock Jan 4, 2023
eb2353e
Fix spotless java precommit formatting error
cwrothrock Jan 5, 2023
File filter

Filter by extension

Filter by extension

Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
5 changes: 5 additions & 0 deletions CHANGES.md
Original file line number Diff line number Diff line change
Expand Up @@ -65,6 +65,9 @@

* RunInference Wrapper with Sklearn Model Handler support added in Go SDK ([#24497](https://github.com/apache/beam/issues/23382)).
* X feature added (Java/Python) ([#X](https://github.com/apache/beam/issues/X)).
* Adding override of allowed TLS algorithms (Java), now maintaining the disabled/legacy algorithms
present in 2.43.0 (up to 1.8.0_342, 11.0.16, 17.0.2 for respective Java versions). This is accompanied
by an explicit re-enabling of TLSv1 and TLSv1.1 for Java 8 and Java 11.

## Breaking Changes

Expand All @@ -80,7 +83,9 @@

## Bugfixes

* Fixed X (Java/Python) ([#X](https://github.com/apache/beam/issues/X)).
cwrothrock marked this conversation as resolved.
Show resolved Hide resolved
* Avoids Cassandra syntax error when user-defined query has no where clause in it (Java) ([#24829](https://github.com/apache/beam/issues/24829)).
* Fixed JDBC connection failures (Java) during handshake due to deprecated TLSv1(.1) protocol for the JDK. ([#24623](https://github.com/apache/beam/issues/24623))

## Known Issues

Expand Down
6 changes: 4 additions & 2 deletions sdks/java/container/common.gradle
Original file line number Diff line number Diff line change
Expand Up @@ -80,8 +80,10 @@ task copyGolangLicenses(type: Copy) {
task copyJdkOptions(type: Copy) {
if (imageJavaVersion == "17" || imageJavaVersion == "11") {
from "option-jamm.json"
into "build/target/options"
}
from "java${imageJavaVersion}-security.properties"
from "option-java${imageJavaVersion}-security.json"
into "build/target/options"
}

task skipPullLicenses(type: Exec) {
Expand Down Expand Up @@ -129,4 +131,4 @@ dockerPrepare.dependsOn copySdkHarnessLauncher
dockerPrepare.dependsOn copyDockerfileDependencies
dockerPrepare.dependsOn ":sdks:java:container:downloadCloudProfilerAgent"
dockerPrepare.dependsOn copyJdkOptions
dockerPrepare.dependsOn validateJavaHome
dockerPrepare.dependsOn validateJavaHome
36 changes: 36 additions & 0 deletions sdks/java/container/java11/java11-security.properties
Original file line number Diff line number Diff line change
@@ -0,0 +1,36 @@
# Licensed to the Apache Software Foundation (ASF) under one or more
# contributor license agreements. See the NOTICE file distributed with
# this work for additional information regarding copyright ownership.
# The ASF licenses this file to You under the Apache License, Version 2.0
# (the "License"); you may not use this file except in compliance with
# the License. You may obtain a copy of the License at
#
# http://www.apache.org/licenses/LICENSE-2.0
#
# Unless required by applicable law or agreed to in writing, software
# distributed under the License is distributed on an "AS IS" BASIS,
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
# See the License for the specific language governing permissions and
# limitations under the License.

# Java 11 java.security properties file override for JVM
# base properties derived from:
# openjdk version "11.0.16" 2022-07-19
# OpenJDK Runtime Environment 18.9 (build 11.0.16+8)
# OpenJDK 64-Bit Server VM 18.9 (build 11.0.16+8, mixed mode, sharing)

# Java has now disabled TLSv1 and TLSv1.1. We specifically put it in the
# legacy algorithms list to allow it to be used if something better is not
# available (e.g. TLSv1.2). This will prevent breakages for existing users
# (for example JDBC with MySQL). See
# https://bugs.java.com/bugdatabase/view_bug.do?bug_id=JDK-8202343
# for additional details.
jdk.tls.disabledAlgorithms=SSLv3, RC4, DES, MD5withRSA, \
DH keySize < 1024, EC keySize < 224, 3DES_EDE_CBC, anon, NULL, \
include jdk.disabled.namedCurves

jdk.tls.legacyAlgorithms= \
K_NULL, C_NULL, M_NULL, \
DH_anon, ECDH_anon, \
RC4_128, RC4_40, DES_CBC, DES40_CBC, \
3DES_EDE_CBC, TLSv1, TLSv1.1
cwrothrock marked this conversation as resolved.
Show resolved Hide resolved
10 changes: 10 additions & 0 deletions sdks/java/container/java11/option-java11-security.json
Original file line number Diff line number Diff line change
@@ -0,0 +1,10 @@
{
"name": "java-security",
"enabled": true,
cwrothrock marked this conversation as resolved.
Show resolved Hide resolved
"options": {
"properties": {
"java.security.properties": "/opt/apache/beam/options/java11-security.properties"
}
}
}

36 changes: 36 additions & 0 deletions sdks/java/container/java17/java17-security.properties
Original file line number Diff line number Diff line change
@@ -0,0 +1,36 @@
# Licensed to the Apache Software Foundation (ASF) under one or more
# contributor license agreements. See the NOTICE file distributed with
# this work for additional information regarding copyright ownership.
# The ASF licenses this file to You under the Apache License, Version 2.0
# (the "License"); you may not use this file except in compliance with
# the License. You may obtain a copy of the License at
#
# http://www.apache.org/licenses/LICENSE-2.0
#
# Unless required by applicable law or agreed to in writing, software
# distributed under the License is distributed on an "AS IS" BASIS,
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
# See the License for the specific language governing permissions and
# limitations under the License.

# Java 17 java.security properties file override for JVM
# base properties derived from:
# openjdk version "17.0.2" 2022-01-18
# OpenJDK Runtime Environment (build 17.0.2+8-86)
# OpenJDK 64-Bit Server VM (build 17.0.2+8-86, mixed mode, sharing)

# Java has now disabled TLSv1 and TLSv1.1. We specifically put it in the
# legacy algorithms list to allow it to be used if something better is not
# available (e.g. TLSv1.2). This will prevent breakages for existing users
# (for example JDBC with MySQL). See
# https://bugs.java.com/bugdatabase/view_bug.do?bug_id=JDK-8202343
# for additional details.
jdk.tls.disabledAlgorithms=SSLv3, RC4, DES, MD5withRSA, \
DH keySize < 1024, EC keySize < 224, 3DES_EDE_CBC, anon, NULL

# The raw value from 17.0.2 for legacyAlgorithms is
# NULL, anon, RC4, DES, 3DES_EDE_CBC
# Because these values are in disabledAlgorithms, it is erroneous to include
# them in legacy (they are disabled in Java 8 and Java 11 as well). Here we
# only include TLSv1 and TLSv1.1 which were removed from disabledAlgorithms
jdk.tls.legacyAlgorithms=TLSv1, TLSv1.1
cwrothrock marked this conversation as resolved.
Show resolved Hide resolved
10 changes: 10 additions & 0 deletions sdks/java/container/java17/option-java17-security.json
Original file line number Diff line number Diff line change
@@ -0,0 +1,10 @@
{
"name": "java-security",
"enabled": true,
"options": {
"properties": {
"java.security.properties": "/opt/apache/beam/options/java17-security.properties"
}
cwrothrock marked this conversation as resolved.
Show resolved Hide resolved
}
}

36 changes: 36 additions & 0 deletions sdks/java/container/java8/java8-security.properties
Original file line number Diff line number Diff line change
@@ -0,0 +1,36 @@
# Licensed to the Apache Software Foundation (ASF) under one or more
# contributor license agreements. See the NOTICE file distributed with
# this work for additional information regarding copyright ownership.
# The ASF licenses this file to You under the Apache License, Version 2.0
# (the "License"); you may not use this file except in compliance with
# the License. You may obtain a copy of the License at
#
# http://www.apache.org/licenses/LICENSE-2.0
#
# Unless required by applicable law or agreed to in writing, software
# distributed under the License is distributed on an "AS IS" BASIS,
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
# See the License for the specific language governing permissions and
# limitations under the License.

# Java 8 java.security properties file override for JVM
# base properties derived from:
# openjdk version "1.8.0_342"
# OpenJDK Runtime Environment (build 1.8.0_342-b07)
# OpenJDK 64-Bit Server VM (build 25.342-b07, mixed mode)

# Java has now disabled TLSv1 and TLSv1.1. We specifically put it in the
# legacy algorithms list to allow it to be used if something better is not
# available (e.g. TLSv1.2). This will prevent breakages for existing users
# (for example JDBC with MySQL). See
# https://bugs.java.com/bugdatabase/view_bug.do?bug_id=JDK-8202343
# for additional details.
jdk.tls.disabledAlgorithms=SSLv3, RC4, DES, MD5withRSA, \
DH keySize < 1024, EC keySize < 224, 3DES_EDE_CBC, anon, NULL, \
include jdk.disabled.namedCurves

jdk.tls.legacyAlgorithms= \
K_NULL, C_NULL, M_NULL, \
DH_anon, ECDH_anon, \
RC4_128, RC4_40, DES_CBC, DES40_CBC, \
3DES_EDE_CBC, TLSv1, TLSv1.1
cwrothrock marked this conversation as resolved.
Show resolved Hide resolved
10 changes: 10 additions & 0 deletions sdks/java/container/java8/option-java8-security.json
Original file line number Diff line number Diff line change
@@ -0,0 +1,10 @@
{
"name": "java-security",
"enabled": true,
"options": {
"properties": {
"java.security.properties": "/opt/apache/beam/options/java8-security.properties"
cwrothrock marked this conversation as resolved.
Show resolved Hide resolved
}
}
}

Original file line number Diff line number Diff line change
Expand Up @@ -19,7 +19,10 @@

import static org.hamcrest.MatcherAssert.assertThat;
import static org.hamcrest.Matchers.greaterThan;
import static org.hamcrest.Matchers.hasItemInArray;
import static org.hamcrest.Matchers.not;

import java.security.Security;
import org.apache.beam.sdk.coders.StringUtf8Coder;
import org.apache.beam.sdk.testing.PAssert;
import org.apache.beam.sdk.testing.TestPipeline;
Expand Down Expand Up @@ -66,4 +69,30 @@ public void testJammAgentAvailable() throws Exception {
PAssert.that(output).containsInAnyOrder("measured");
p.run().waitUntilFinish();
}

/** {@link DoFn} used to validate that TLS was enabled as part of java security properties. */
private static class TLSDoFn extends DoFn<String, String> {
@ProcessElement
public void processElement(ProcessContext c) {
cwrothrock marked this conversation as resolved.
Show resolved Hide resolved
assertThat(
Security.getProperty("jdk.tls.disabledAlgorithms").split(",[ ]*"),
not(hasItemInArray("TLSv1")));
assertThat(
Security.getProperty("jdk.tls.disabledAlgorithms").split(",[ ]*"),
not(hasItemInArray("TLSv1.1")));
cwrothrock marked this conversation as resolved.
Show resolved Hide resolved
c.output("TLSv1-TLSv1.1 enabled");
}
}

@Test
@Category({ValidatesRunner.class, UsesSdkHarnessEnvironment.class})
public void testTlsAvailable() throws Exception {
PCollection<String> input = p.apply(Create.of("TLS").withCoder(StringUtf8Coder.of()));

PCollection<String> output = input.apply(ParDo.of(new TLSDoFn()));

PAssert.that(output).containsInAnyOrder("TLSv1-TLSv1.1 enabled");

p.run().waitUntilFinish();
}
}