Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Cipher params not work in KeyStoreSSLContext #13322

Merged
merged 1 commit into from Dec 15, 2021
Merged

Cipher params not work in KeyStoreSSLContext #13322

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Jump to
Jump to file
Failed to load files.
Diff view
Diff view
50 changes: 25 additions & 25 deletions ...ar-common/src/main/java/org/apache/pulsar/common/util/keystoretls/KeyStoreSSLContext.java
View file
Open in desktop
Expand Up @@ -22,7 +22,6 @@
import com.google.common.base.Strings;
import io.netty.handler.ssl.util.InsecureTrustManagerFactory;
import java.io.FileInputStream;
import java.io.FileNotFoundException;
import java.io.IOException;
import java.security.GeneralSecurityException;
import java.security.KeyStore;
Expand All @@ -35,7 +34,6 @@
import javax.net.ssl.KeyManagerFactory;
import javax.net.ssl.SSLContext;
import javax.net.ssl.SSLEngine;
import javax.net.ssl.SSLException;
import javax.net.ssl.TrustManagerFactory;
import lombok.Getter;
import lombok.extern.slf4j.Slf4j;
Expand Down Expand Up @@ -66,22 +64,22 @@ public enum Mode {
@Getter
private final Mode mode;

private String sslProviderString;
private String keyStoreTypeString;
private String keyStorePath;
private String keyStorePassword;
private boolean allowInsecureConnection;
private String trustStoreTypeString;
private String trustStorePath;
private String trustStorePassword;
private boolean needClientAuth;
private Set<String> ciphers;
private Set<String> protocols;
private final String sslProviderString;
private final String keyStoreTypeString;
private final String keyStorePath;
private final String keyStorePassword;
private final boolean allowInsecureConnection;
private final String trustStoreTypeString;
private final String trustStorePath;
private final String trustStorePassword;
private final boolean needClientAuth;
private final Set<String> ciphers;
private final Set<String> protocols;
private SSLContext sslContext;

private String protocol = DEFAULT_SSL_PROTOCOL;
private String kmfAlgorithm = DEFAULT_SSL_KEYMANGER_ALGORITHM;
private String tmfAlgorithm = DEFAULT_SSL_TRUSTMANAGER_ALGORITHM;
private final String protocol = DEFAULT_SSL_PROTOCOL;
private final String kmfAlgorithm = DEFAULT_SSL_KEYMANGER_ALGORITHM;
private final String tmfAlgorithm = DEFAULT_SSL_TRUSTMANAGER_ALGORITHM;

// only init vars, before using it, need to call createSSLContext to create ssl context.
public KeyStoreSSLContext(Mode mode,
Expand Down Expand Up @@ -109,8 +107,6 @@ public KeyStoreSSLContext(Mode mode,
this.trustStorePath = trustStorePath;
this.trustStorePassword = trustStorePassword;
this.needClientAuth = requireTrustedClientCertOnConnect;
this.ciphers = ciphers;
this.protocols = protocols;

if (protocols != null && protocols.size() > 0) {
this.protocols = protocols;
Expand Down Expand Up @@ -189,7 +185,11 @@ public SSLEngine createSSLEngine(String peerHost, int peerPort) {

private SSLEngine configureSSLEngine(SSLEngine sslEngine) {
sslEngine.setEnabledProtocols(protocols.toArray(new String[0]));
sslEngine.setEnabledCipherSuites(sslEngine.getSupportedCipherSuites());
if (this.ciphers == null) {
sslEngine.setEnabledCipherSuites(sslEngine.getSupportedCipherSuites());
} else {
sslEngine.setEnabledCipherSuites(this.ciphers.toArray(new String[0]));
}

if (this.mode == Mode.SERVER) {
sslEngine.setNeedClientAuth(this.needClientAuth);
Expand All @@ -210,7 +210,7 @@ public static KeyStoreSSLContext createClientKeyStoreSslContext(String sslProvid
String trustStorePassword,
Set<String> ciphers,
Set<String> protocols)
throws GeneralSecurityException, SSLException, FileNotFoundException, IOException {
throws GeneralSecurityException, IOException {
KeyStoreSSLContext keyStoreSSLContext = new KeyStoreSSLContext(Mode.CLIENT,
sslProviderString,
keyStoreTypeString,
Expand Down Expand Up @@ -240,7 +240,7 @@ public static KeyStoreSSLContext createServerKeyStoreSslContext(String sslProvid
boolean requireTrustedClientCertOnConnect,
Set<String> ciphers,
Set<String> protocols)
throws GeneralSecurityException, SSLException, FileNotFoundException, IOException {
throws GeneralSecurityException, IOException {
KeyStoreSSLContext keyStoreSSLContext = new KeyStoreSSLContext(Mode.SERVER,
sslProviderString,
keyStoreTypeString,
Expand Down Expand Up @@ -268,7 +268,7 @@ public static SSLContext createServerSslContext(String sslProviderString,
String trustStorePath,
String trustStorePassword,
boolean requireTrustedClientCertOnConnect)
throws GeneralSecurityException, SSLException, FileNotFoundException, IOException {
throws GeneralSecurityException, IOException {

return createServerKeyStoreSslContext(
sslProviderString,
Expand All @@ -295,7 +295,7 @@ public static SSLContext createClientSslContext(String sslProviderString,
String trustStorePassword,
Set<String> ciphers,
Set<String> protocol)
throws GeneralSecurityException, SSLException, FileNotFoundException, IOException {
throws GeneralSecurityException, IOException {
KeyStoreSSLContext keyStoreSSLContext = new KeyStoreSSLContext(Mode.CLIENT,
sslProviderString,
keyStoreTypeString,
Expand All @@ -319,7 +319,7 @@ public static SSLContext createClientSslContext(String keyStoreTypeString,
String trustStoreTypeString,
String trustStorePath,
String trustStorePassword)
throws GeneralSecurityException, SSLException, FileNotFoundException, IOException {
throws GeneralSecurityException, IOException {
KeyStoreSSLContext keyStoreSSLContext = new KeyStoreSSLContext(Mode.CLIENT,
null,
keyStoreTypeString,
Expand Down Expand Up @@ -347,7 +347,7 @@ public static SslContextFactory createSslContextFactory(String sslProviderString
String trustStorePassword,
boolean requireTrustedClientCertOnConnect,
long certRefreshInSec)
throws GeneralSecurityException, SSLException, FileNotFoundException, IOException {
throws GeneralSecurityException, IOException {
SslContextFactory sslCtxFactory;

if (sslProviderString == null) {
Expand Down