Skip to content

[6517][pulsar-client] FIPS BouncyCastle support for cryptography lib(WIP) - #6559

Closed
kemburi wants to merge 4 commits into
apache:masterfrom
kemburi:enable_bc_fips_for_pulsar_client
Closed

[6517][pulsar-client] FIPS BouncyCastle support for cryptography lib(WIP)#6559
kemburi wants to merge 4 commits into
apache:masterfrom
kemburi:enable_bc_fips_for_pulsar_client

Conversation

@kemburi

@kemburi kemburi commented Mar 19, 2020

Copy link
Copy Markdown

(If this PR fixes a github issue, please add Fixes #<xyz>.)

Fixes #6517

(or if this PR is one task of a github issue, please add Master Issue: #<xyz> to link to the master issue.)

Master Issue: #

Motivation

We need to push data to pulsar from a bcfips complaint jboss. But since pulsar clinet has bc hardcoded as security provider we are not able to push data to pulsar in ssl mode.

Explain here the context, and why you're making that change. What is the problem you're trying to solve.

Modifications

Describe the modifications you've done.

Verifying this change

  • Make sure that the change passes the CI checks.

(Please pick either of the following options)

This change is a trivial rework / code cleanup without any test coverage.

(or)

This change is already covered by existing tests, such as (please describe tests).

(or)

This change added tests and can be verified as follows:

(example:)

  • Added integration tests for end-to-end deployment with large payloads (10MB)
  • Extended integration test for recovery after broker failure

Does this pull request potentially affect one of the following parts:

If yes was chosen, please highlight the changes

  • Dependencies (does it add or upgrade a dependency): (no)
  • The public API: (yes)
  • The schema: (no)
  • The default values of configurations: (no)
  • The wire protocol: (no)
  • The rest endpoints: (no)
  • The admin cli options: (no)
  • Anything that affects deployment: (yes)

Documentation

  • Does this pull request introduce a new feature? (no)
  • If yes, how is the feature documented? (not documented)
  • If a feature is not applicable for documentation, explain why?
  • If a feature is not documented yet in this PR, please create a followup issue for adding the documentation

@jiazhai

jiazhai commented Mar 19, 2020

Copy link
Copy Markdown
Member

@kemburi Thanks for the work. But we may need a way to support both BouncyCastleProvider and BouncyCastleFipsProvider. If doing this in current replace way, the other user that use BouncyCastleProvider will also meet problem.

@kemburi

kemburi commented Mar 19, 2020

Copy link
Copy Markdown
Author

@jiazhai yes, I agree, but I wanted to check if my currunt use case on my test systems works or not
hence made these changes, further testing is going on, if i am successful to push data to pulsar, then i will try to address common crypto framework for the same. But i would take more time, i might need some help.

@jiazhai

jiazhai commented Mar 19, 2020

Copy link
Copy Markdown
Member

@kemburi Get it. Marked it as WIP(Work in Progress). Mean while I will also take a look on how to make BouncyCastleProvider and BouncyCastleFipsProvider configurable.

@jiazhai jiazhai changed the title [6517][pulsar-client] [6517][pulsar-client] FIPS BouncyCastle support for cryptography lib Mar 19, 2020
@kemburi kemburi changed the title [6517][pulsar-client] FIPS BouncyCastle support for cryptography lib [6517][pulsar-client] FIPS BouncyCastle support for cryptography lib(WIP) Mar 19, 2020
@sijie

sijie commented Apr 5, 2020

Copy link
Copy Markdown
Member

This FIPS provider is supported in #6588. It will be released in 2.5.1 & 2.6.0.

@sijie sijie closed this Apr 5, 2020
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

BCFIPS not supprted with pulsar client libraray

3 participants