From 15e4156618267686f0ba8aa09c3f1f6e6aaa881b Mon Sep 17 00:00:00 2001 From: K Narisimha Raju Date: Thu, 19 Mar 2020 10:09:53 +0530 Subject: [PATCH 1/4] Enable bc fips for pulsar client --- pom.xml | 12 -------- pulsar-client/pom.xml | 11 ++++++- .../pulsar/client/impl/MessageCrypto.java | 29 +++++++++---------- .../client/impl/auth/AuthenticationTls.java | 3 +- pulsar-common/pom.xml | 1 + .../pulsar/common/util/SecurityUtility.java | 5 ---- pulsar-proxy/pom.xml | 12 ++++++++ 7 files changed, 39 insertions(+), 34 deletions(-) diff --git a/pom.xml b/pom.xml index 9bdeba5a5f802..550241e1dd61d 100644 --- a/pom.xml +++ b/pom.xml @@ -938,18 +938,6 @@ flexible messaging model and an intuitive client API. ${aspectj.version} - - org.bouncycastle - bcpkix-jdk15on - ${bouncycastle.version} - - - - org.bouncycastle - bcprov-ext-jdk15on - ${bouncycastle.version} - - net.jodah typetools diff --git a/pulsar-client/pom.xml b/pulsar-client/pom.xml index dca5f4f81987d..4c88a35e90698 100644 --- a/pulsar-client/pom.xml +++ b/pulsar-client/pom.xml @@ -114,7 +114,16 @@ - + + org.bouncycastle + bc-fips + 1.0.1 + + + org.bouncycastle + bcpkix-fips + 1.0.1 + com.google.protobuf protobuf-java diff --git a/pulsar-client/src/main/java/org/apache/pulsar/client/impl/MessageCrypto.java b/pulsar-client/src/main/java/org/apache/pulsar/client/impl/MessageCrypto.java index 480750830d64e..3077d2a957714 100644 --- a/pulsar-client/src/main/java/org/apache/pulsar/client/impl/MessageCrypto.java +++ b/pulsar-client/src/main/java/org/apache/pulsar/client/impl/MessageCrypto.java @@ -18,12 +18,6 @@ */ package org.apache.pulsar.client.impl; -import com.google.common.cache.CacheBuilder; -import com.google.common.cache.CacheLoader; -import com.google.common.cache.LoadingCache; - -import io.netty.buffer.ByteBuf; - import java.io.IOException; import java.io.Reader; import java.io.StringReader; @@ -57,6 +51,10 @@ import javax.crypto.spec.GCMParameterSpec; import javax.crypto.spec.SecretKeySpec; +import com.google.common.cache.CacheBuilder; +import com.google.common.cache.CacheLoader; +import com.google.common.cache.LoadingCache; +import io.netty.buffer.ByteBuf; import org.apache.pulsar.client.api.CryptoKeyReader; import org.apache.pulsar.client.api.EncryptionKeyInfo; import org.apache.pulsar.client.api.PulsarClientException; @@ -71,9 +69,9 @@ import org.bouncycastle.asn1.x509.SubjectPublicKeyInfo; import org.bouncycastle.asn1.x9.ECNamedCurveTable; import org.bouncycastle.asn1.x9.X9ECParameters; +import org.bouncycastle.jcajce.provider.BouncyCastleFipsProvider; import org.bouncycastle.jcajce.provider.asymmetric.ec.BCECPrivateKey; import org.bouncycastle.jcajce.provider.asymmetric.ec.BCECPublicKey; -import org.bouncycastle.jce.provider.BouncyCastleProvider; import org.bouncycastle.jce.spec.ECParameterSpec; import org.bouncycastle.jce.spec.ECPrivateKeySpec; import org.bouncycastle.jce.spec.ECPublicKeySpec; @@ -98,6 +96,7 @@ public class MessageCrypto { private static KeyGenerator keyGenerator; private static final int tagLen = 16 * 8; public static final int ivLen = 12; + private final String providerName = BouncyCastleFipsProvider.PROVIDER_NAME; private byte[] iv = new byte[ivLen]; private Cipher cipher; MessageDigest digest; @@ -113,7 +112,7 @@ public class MessageCrypto { static final SecureRandom secureRandom; static { - Security.addProvider(new org.bouncycastle.jce.provider.BouncyCastleProvider()); + Security.addProvider(new BouncyCastleFipsProvider()); SecureRandom rand = null; try { rand = SecureRandom.getInstance("NativePRNGNonBlocking"); @@ -143,7 +142,7 @@ public SecretKey load(ByteBuffer key) { try { - cipher = Cipher.getInstance(AESGCM, BouncyCastleProvider.PROVIDER_NAME); + cipher = Cipher.getInstance(AESGCM, providerName); // If keygen is not needed(e.g: consumer), data key will be decrypted from the message if (!keyGenNeeded) { @@ -215,7 +214,7 @@ private PublicKey loadPublicKey(byte[] keyBytes) throws Exception { if (ecParam != null && ECDSA.equals(publicKey.getAlgorithm())) { ECParameterSpec ecSpec = new ECParameterSpec(ecParam.getCurve(), ecParam.getG(), ecParam.getN(), ecParam.getH(), ecParam.getSeed()); - KeyFactory keyFactory = KeyFactory.getInstance(ECDSA, BouncyCastleProvider.PROVIDER_NAME); + KeyFactory keyFactory = KeyFactory.getInstance(ECDSA, providerName); ECPublicKeySpec keySpec = new ECPublicKeySpec(((BCECPublicKey) publicKey).getQ(), ecSpec); publicKey = (PublicKey) keyFactory.generatePublic(keySpec); } @@ -268,7 +267,7 @@ private PrivateKey loadPrivateKey(byte[] keyBytes) throws Exception { if (ecParam != null && ECDSA.equals(privateKey.getAlgorithm())) { ECParameterSpec ecSpec = new ECParameterSpec(ecParam.getCurve(), ecParam.getG(), ecParam.getN(), ecParam.getH(), ecParam.getSeed()); - KeyFactory keyFactory = KeyFactory.getInstance(ECDSA, BouncyCastleProvider.PROVIDER_NAME); + KeyFactory keyFactory = KeyFactory.getInstance(ECDSA, providerName); ECPrivateKeySpec keySpec = new ECPrivateKeySpec(((BCECPrivateKey) privateKey).getS(), ecSpec); privateKey = (PrivateKey) keyFactory.generatePrivate(keySpec); } @@ -326,9 +325,9 @@ private void addPublicKeyCipher(String keyName, CryptoKeyReader keyReader) throw // Encrypt data key using public key if (RSA.equals(pubKey.getAlgorithm())) { - dataKeyCipher = Cipher.getInstance(RSA_TRANS, BouncyCastleProvider.PROVIDER_NAME); + dataKeyCipher = Cipher.getInstance(RSA_TRANS, providerName); } else if (ECDSA.equals(pubKey.getAlgorithm())) { - dataKeyCipher = Cipher.getInstance(ECIES, BouncyCastleProvider.PROVIDER_NAME); + dataKeyCipher = Cipher.getInstance(ECIES, providerName); } else { String msg = logCtx + "Unsupported key type " + pubKey.getAlgorithm() + " for key " + keyName; log.error(msg); @@ -477,9 +476,9 @@ private boolean decryptDataKey(String keyName, byte[] encryptedDataKey, List org.bouncycastle bcpkix-jdk15on + ${bouncycastle.version} diff --git a/pulsar-common/src/main/java/org/apache/pulsar/common/util/SecurityUtility.java b/pulsar-common/src/main/java/org/apache/pulsar/common/util/SecurityUtility.java index f77743faf0475..87d07424e3216 100644 --- a/pulsar-common/src/main/java/org/apache/pulsar/common/util/SecurityUtility.java +++ b/pulsar-common/src/main/java/org/apache/pulsar/common/util/SecurityUtility.java @@ -58,11 +58,6 @@ */ public class SecurityUtility { - static { - // Fixes loading PKCS8Key file: https://stackoverflow.com/a/18912362 - java.security.Security.addProvider(new org.bouncycastle.jce.provider.BouncyCastleProvider()); - } - public static SSLContext createSslContext(boolean allowInsecureConnection, Certificate[] trustCertificates) throws GeneralSecurityException { return createSslContext(allowInsecureConnection, trustCertificates, (Certificate[]) null, (PrivateKey) null); diff --git a/pulsar-proxy/pom.xml b/pulsar-proxy/pom.xml index b5e60ecbb7eca..c76b7e9b41021 100644 --- a/pulsar-proxy/pom.xml +++ b/pulsar-proxy/pom.xml @@ -165,5 +165,17 @@ com.beust jcommander + + org.bouncycastle + bcpkix-jdk15on + ${bouncycastle.version} + + + + org.bouncycastle + bcprov-ext-jdk15on + ${bouncycastle.version} + + From a1ddf2a19d47a418ba83a80249864b6059c1b8b6 Mon Sep 17 00:00:00 2001 From: K Narisimha Raju Date: Thu, 19 Mar 2020 11:08:38 +0530 Subject: [PATCH 2/4] Enable bc fips for pulsar client --- pulsar-common/pom.xml | 6 ++---- .../java/org/apache/pulsar/common/util/SecurityUtility.java | 6 ++++++ 2 files changed, 8 insertions(+), 4 deletions(-) diff --git a/pulsar-common/pom.xml b/pulsar-common/pom.xml index ed2645714a96e..e7e5d8d5e4650 100644 --- a/pulsar-common/pom.xml +++ b/pulsar-common/pom.xml @@ -109,13 +109,11 @@ org.xerial.snappy snappy-java - org.bouncycastle - bcpkix-jdk15on - ${bouncycastle.version} + bcpkix-fips + 1.0.1 - org.apache.bookkeeper circe-checksum diff --git a/pulsar-common/src/main/java/org/apache/pulsar/common/util/SecurityUtility.java b/pulsar-common/src/main/java/org/apache/pulsar/common/util/SecurityUtility.java index 87d07424e3216..e788eef0ee77b 100644 --- a/pulsar-common/src/main/java/org/apache/pulsar/common/util/SecurityUtility.java +++ b/pulsar-common/src/main/java/org/apache/pulsar/common/util/SecurityUtility.java @@ -51,12 +51,18 @@ import javax.net.ssl.SSLException; import javax.net.ssl.TrustManager; import javax.net.ssl.TrustManagerFactory; + +import org.bouncycastle.jcajce.provider.BouncyCastleFipsProvider; import org.eclipse.jetty.util.ssl.SslContextFactory; /** * Helper class for the security domain. */ public class SecurityUtility { + static { + // Fixes loading PKCS8Key file: https://stackoverflow.com/a/18912362 + java.security.Security.addProvider(new BouncyCastleFipsProvider()); + } public static SSLContext createSslContext(boolean allowInsecureConnection, Certificate[] trustCertificates) throws GeneralSecurityException { From 26ca2e53a2d2b01c38ab910b4172cc541ae22fda Mon Sep 17 00:00:00 2001 From: K Narisimha Raju Date: Thu, 19 Mar 2020 11:54:12 +0530 Subject: [PATCH 3/4] Revert "Enable bc fips for pulsar client" This reverts commit a1ddf2a1 --- pulsar-common/pom.xml | 6 ++++-- .../java/org/apache/pulsar/common/util/SecurityUtility.java | 6 ------ 2 files changed, 4 insertions(+), 8 deletions(-) diff --git a/pulsar-common/pom.xml b/pulsar-common/pom.xml index e7e5d8d5e4650..ed2645714a96e 100644 --- a/pulsar-common/pom.xml +++ b/pulsar-common/pom.xml @@ -109,11 +109,13 @@ org.xerial.snappy snappy-java + org.bouncycastle - bcpkix-fips - 1.0.1 + bcpkix-jdk15on + ${bouncycastle.version} + org.apache.bookkeeper circe-checksum diff --git a/pulsar-common/src/main/java/org/apache/pulsar/common/util/SecurityUtility.java b/pulsar-common/src/main/java/org/apache/pulsar/common/util/SecurityUtility.java index e788eef0ee77b..87d07424e3216 100644 --- a/pulsar-common/src/main/java/org/apache/pulsar/common/util/SecurityUtility.java +++ b/pulsar-common/src/main/java/org/apache/pulsar/common/util/SecurityUtility.java @@ -51,18 +51,12 @@ import javax.net.ssl.SSLException; import javax.net.ssl.TrustManager; import javax.net.ssl.TrustManagerFactory; - -import org.bouncycastle.jcajce.provider.BouncyCastleFipsProvider; import org.eclipse.jetty.util.ssl.SslContextFactory; /** * Helper class for the security domain. */ public class SecurityUtility { - static { - // Fixes loading PKCS8Key file: https://stackoverflow.com/a/18912362 - java.security.Security.addProvider(new BouncyCastleFipsProvider()); - } public static SSLContext createSslContext(boolean allowInsecureConnection, Certificate[] trustCertificates) throws GeneralSecurityException { From a3d36fc16378641451c83e667c0acb2d46dd89a0 Mon Sep 17 00:00:00 2001 From: K Narisimha Raju Date: Thu, 19 Mar 2020 12:04:16 +0530 Subject: [PATCH 4/4] Initializing bc fips provider by default. --- pulsar-common/pom.xml | 6 +++++- .../org/apache/pulsar/common/util/SecurityUtility.java | 7 ++++++- 2 files changed, 11 insertions(+), 2 deletions(-) diff --git a/pulsar-common/pom.xml b/pulsar-common/pom.xml index ed2645714a96e..5dfe7739ff49b 100644 --- a/pulsar-common/pom.xml +++ b/pulsar-common/pom.xml @@ -115,7 +115,11 @@ bcpkix-jdk15on ${bouncycastle.version} - + + org.bouncycastle + bcpkix-fips + 1.0.1 + org.apache.bookkeeper circe-checksum diff --git a/pulsar-common/src/main/java/org/apache/pulsar/common/util/SecurityUtility.java b/pulsar-common/src/main/java/org/apache/pulsar/common/util/SecurityUtility.java index 87d07424e3216..03783b3fc7ba6 100644 --- a/pulsar-common/src/main/java/org/apache/pulsar/common/util/SecurityUtility.java +++ b/pulsar-common/src/main/java/org/apache/pulsar/common/util/SecurityUtility.java @@ -51,13 +51,18 @@ import javax.net.ssl.SSLException; import javax.net.ssl.TrustManager; import javax.net.ssl.TrustManagerFactory; + +import org.bouncycastle.jcajce.provider.BouncyCastleFipsProvider; import org.eclipse.jetty.util.ssl.SslContextFactory; /** * Helper class for the security domain. */ public class SecurityUtility { - + static { + // Fixes loading PKCS8Key file: https://stackoverflow.com/a/18912362 + java.security.Security.addProvider(new BouncyCastleFipsProvider()); + } public static SSLContext createSslContext(boolean allowInsecureConnection, Certificate[] trustCertificates) throws GeneralSecurityException { return createSslContext(allowInsecureConnection, trustCertificates, (Certificate[]) null, (PrivateKey) null);