Add static override for JDK TLS disabled/legacy algorithms in Java container

CHANGES.md

@@ -83,7 +83,6 @@
 
 ## Bugfixes
 
-* Fixed X (Java/Python) ([#X](https://github.com/apache/beam/issues/X)).
 * Avoids Cassandra syntax error when user-defined query has no where clause in it (Java) ([#24829](https://github.com/apache/beam/issues/24829)).
 * Fixed JDBC connection failures (Java) during handshake due to deprecated TLSv1(.1) protocol for the JDK. ([#24623](https://github.com/apache/beam/issues/24623))
 

sdks/java/container/java11/java11-security.properties

@@ -28,9 +28,20 @@
 jdk.tls.disabledAlgorithms=SSLv3, RC4, DES, MD5withRSA, \
     DH keySize < 1024, EC keySize < 224, 3DES_EDE_CBC, anon, NULL, \
     include jdk.disabled.namedCurves
-    
+
 jdk.tls.legacyAlgorithms= \
-        K_NULL, C_NULL, M_NULL, \
-        DH_anon, ECDH_anon, \
-        RC4_128, RC4_40, DES_CBC, DES40_CBC, \
-        3DES_EDE_CBC, TLSv1, TLSv1.1
+    K_NULL, C_NULL, M_NULL, \
+    DH_anon, ECDH_anon, \
+    RC4_128, RC4_40, DES_CBC, DES40_CBC, \
+    3DES_EDE_CBC, TLSv1, TLSv1.1
+
+# /dev/random blocks in virtualized environments due to lack of
+# good entropy sources, which makes SecureRandom use impractical.
+# In particular, that affects the performance of HTTPS that relies
+# on SecureRandom.
+#
+# Due to that, /dev/urandom is used as the default.
+#
+# See http://www.2uo.de/myths-about-urandom/ for some background
+# on security of /dev/urandom on Linux.
+securerandom.source=file:/dev/./urandom

sdks/java/container/java11/option-java11-security.json

@@ -1,10 +1,9 @@
 {
-    "name": "java-security",
-    "enabled": true,
-    "options": {
-      "properties": {
-        "java.security.properties": "/opt/apache/beam/options/java11-security.properties"
-      }
+  "name": "java-security",
+  "enabled": true,
+  "options": {
+    "properties": {
+      "java.security.properties": "/opt/apache/beam/options/java11-security.properties"
     }
   }
-  
+}

sdks/java/container/java17/java17-security.properties

@@ -34,3 +34,14 @@ jdk.tls.disabledAlgorithms=SSLv3, RC4, DES, MD5withRSA, \
 # them in legacy (they are disabled in Java 8 and Java 11 as well). Here we 
 # only include TLSv1 and TLSv1.1 which were removed from disabledAlgorithms
 jdk.tls.legacyAlgorithms=TLSv1, TLSv1.1
+
+# /dev/random blocks in virtualized environments due to lack of
+# good entropy sources, which makes SecureRandom use impractical.
+# In particular, that affects the performance of HTTPS that relies
+# on SecureRandom.
+#
+# Due to that, /dev/urandom is used as the default.
+#
+# See http://www.2uo.de/myths-about-urandom/ for some background
+# on security of /dev/urandom on Linux.
+securerandom.source=file:/dev/./urandom

sdks/java/container/java17/option-java17-security.json

@@ -1,10 +1,9 @@
 {
-    "name": "java-security",
-    "enabled": true,
-    "options": {
-      "properties": {
-        "java.security.properties": "/opt/apache/beam/options/java17-security.properties"
-      }
+  "name": "java-security",
+  "enabled": true,
+  "options": {
+    "properties": {
+      "java.security.properties": "/opt/apache/beam/options/java17-security.properties"
     }
   }
-  
+}

sdks/java/container/java8/java8-security.properties

@@ -30,7 +30,18 @@ jdk.tls.disabledAlgorithms=SSLv3, RC4, DES, MD5withRSA, \
     include jdk.disabled.namedCurves
 
 jdk.tls.legacyAlgorithms= \
-        K_NULL, C_NULL, M_NULL, \
-        DH_anon, ECDH_anon, \
-        RC4_128, RC4_40, DES_CBC, DES40_CBC, \
-        3DES_EDE_CBC, TLSv1, TLSv1.1
+    K_NULL, C_NULL, M_NULL, \
+    DH_anon, ECDH_anon, \
+    RC4_128, RC4_40, DES_CBC, DES40_CBC, \
+    3DES_EDE_CBC, TLSv1, TLSv1.1
+
+# /dev/random blocks in virtualized environments due to lack of
+# good entropy sources, which makes SecureRandom use impractical.
+# In particular, that affects the performance of HTTPS that relies
+# on SecureRandom.
+#
+# Due to that, /dev/urandom is used as the default.
+#
+# See http://www.2uo.de/myths-about-urandom/ for some background
+# on security of /dev/urandom on Linux.
+securerandom.source=file:/dev/./urandom

sdks/java/container/java8/option-java8-security.json

@@ -1,10 +1,9 @@
 {
-    "name": "java-security",
-    "enabled": true,
-    "options": {
-      "properties": {
-        "java.security.properties": "/opt/apache/beam/options/java8-security.properties"
-      }
+  "name": "java-security",
+  "enabled": true,
+  "options": {
+    "properties": {
+      "java.security.properties": "/opt/apache/beam/options/java8-security.properties"
     }
   }
-  
+}

sdks/java/core/src/test/java/org/apache/beam/sdk/SdkHarnessEnvironmentTest.java

@@ -21,8 +21,12 @@
 import static org.hamcrest.Matchers.greaterThan;
 import static org.hamcrest.Matchers.hasItemInArray;
 import static org.hamcrest.Matchers.not;
+import static org.junit.Assert.assertNotNull;
 
+import java.security.KeyManagementException;
+import java.security.NoSuchAlgorithmException;
 import java.security.Security;
+import javax.net.ssl.SSLContext;
 import org.apache.beam.sdk.coders.StringUtf8Coder;
 import org.apache.beam.sdk.testing.PAssert;
 import org.apache.beam.sdk.testing.TestPipeline;
@@ -74,12 +78,24 @@ public void testJammAgentAvailable() throws Exception {
   private static class TLSDoFn extends DoFn<String, String> {
     @ProcessElement
     public void processElement(ProcessContext c) {
-      assertThat(
-          Security.getProperty("jdk.tls.disabledAlgorithms").split(",[ ]*"),
-          not(hasItemInArray("TLSv1")));
-      assertThat(
-          Security.getProperty("jdk.tls.disabledAlgorithms").split(",[ ]*"),
-          not(hasItemInArray("TLSv1.1")));
+      String[] disabledAlgorithms =
+          Security.getProperty("jdk.tls.disabledAlgorithms").trim().split("\\s*,\\s*");
+      assertThat(disabledAlgorithms, not(hasItemInArray("TLSv1")));
+      assertThat(disabledAlgorithms, not(hasItemInArray("TLSv1.1")));
+
+      SSLContext context = null;
+      String[] defaultProtocols = null;
+      try {
+        context = SSLContext.getInstance("TLS");
+        context.init(null, null, null);
+        defaultProtocols = context.getDefaultSSLParameters().getProtocols();
+      } catch (NoSuchAlgorithmException | KeyManagementException e) {
+        return;
+      }
+      assertNotNull(context);
+      assertThat(defaultProtocols, hasItemInArray("TLSv1"));
+      assertThat(defaultProtocols, hasItemInArray("TLSv1.1"));
+
       c.output("TLSv1-TLSv1.1 enabled");
     }
   }