Skip to content

[6517][pulsar-client] FIPS BouncyCastle support for cryptography lib(WIP) #6559

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Closed
kemburi wants to merge 4 commits into from
Closed

[6517][pulsar-client] FIPS BouncyCastle support for cryptography lib(WIP) #6559

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
4 commits
Select commit Hold shift + click to select a range
15e4156
Enable bc fips for pulsar client
Mar 19, 2020
a1ddf2a
Enable bc fips for pulsar client
Mar 19, 2020
26ca2e5
Revert "Enable bc fips for pulsar client"
Mar 19, 2020
a3d36fc
Initializing bc fips provider by default.
Mar 19, 2020
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
12 changes: 0 additions & 12 deletions pom.xml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -938,18 +938,6 @@ flexible messaging model and an intuitive client API.</description>
<version>${aspectj.version}</version>
</dependency>

<dependency>
<groupId>org.bouncycastle</groupId>
<artifactId>bcpkix-jdk15on</artifactId>
<version>${bouncycastle.version}</version>
</dependency>

<dependency>
<groupId>org.bouncycastle</groupId>
<artifactId>bcprov-ext-jdk15on</artifactId>
<version>${bouncycastle.version}</version>
</dependency>

<dependency>
<groupId>net.jodah</groupId>
<artifactId>typetools</artifactId>
Expand Down
11 changes: 10 additions & 1 deletion pulsar-client/pom.xml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -114,7 +114,16 @@
</exclusion>
</exclusions>
</dependency>

<dependency>
<groupId>org.bouncycastle</groupId>
<artifactId>bc-fips</artifactId>
<version>1.0.1</version>
</dependency>
<dependency>
<groupId>org.bouncycastle</groupId>
<artifactId>bcpkix-fips</artifactId>
<version>1.0.1</version>
</dependency>
<dependency>
<groupId>com.google.protobuf</groupId>
<artifactId>protobuf-java</artifactId>
Expand Down
29 changes: 14 additions & 15 deletions pulsar-client/src/main/java/org/apache/pulsar/client/impl/MessageCrypto.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -18,12 +18,6 @@
*/
package org.apache.pulsar.client.impl;

import com.google.common.cache.CacheBuilder;
import com.google.common.cache.CacheLoader;
import com.google.common.cache.LoadingCache;

import io.netty.buffer.ByteBuf;

import java.io.IOException;
import java.io.Reader;
import java.io.StringReader;
Expand Down Expand Up @@ -57,6 +51,10 @@
import javax.crypto.spec.GCMParameterSpec;
import javax.crypto.spec.SecretKeySpec;

import com.google.common.cache.CacheBuilder;
import com.google.common.cache.CacheLoader;
import com.google.common.cache.LoadingCache;
import io.netty.buffer.ByteBuf;
import org.apache.pulsar.client.api.CryptoKeyReader;
import org.apache.pulsar.client.api.EncryptionKeyInfo;
import org.apache.pulsar.client.api.PulsarClientException;
Expand All @@ -71,9 +69,9 @@
import org.bouncycastle.asn1.x509.SubjectPublicKeyInfo;
import org.bouncycastle.asn1.x9.ECNamedCurveTable;
import org.bouncycastle.asn1.x9.X9ECParameters;
import org.bouncycastle.jcajce.provider.BouncyCastleFipsProvider;
import org.bouncycastle.jcajce.provider.asymmetric.ec.BCECPrivateKey;
import org.bouncycastle.jcajce.provider.asymmetric.ec.BCECPublicKey;
import org.bouncycastle.jce.provider.BouncyCastleProvider;
import org.bouncycastle.jce.spec.ECParameterSpec;
import org.bouncycastle.jce.spec.ECPrivateKeySpec;
import org.bouncycastle.jce.spec.ECPublicKeySpec;
Expand All @@ -98,6 +96,7 @@ public class MessageCrypto {
private static KeyGenerator keyGenerator;
private static final int tagLen = 16 * 8;
public static final int ivLen = 12;
private final String providerName = BouncyCastleFipsProvider.PROVIDER_NAME;
private byte[] iv = new byte[ivLen];
private Cipher cipher;
MessageDigest digest;
Expand All @@ -113,7 +112,7 @@ public class MessageCrypto {
static final SecureRandom secureRandom;
static {

Security.addProvider(new org.bouncycastle.jce.provider.BouncyCastleProvider());
Security.addProvider(new BouncyCastleFipsProvider());
SecureRandom rand = null;
try {
rand = SecureRandom.getInstance("NativePRNGNonBlocking");
Expand Down Expand Up @@ -143,7 +142,7 @@ public SecretKey load(ByteBuffer key) {

try {

cipher = Cipher.getInstance(AESGCM, BouncyCastleProvider.PROVIDER_NAME);
cipher = Cipher.getInstance(AESGCM, providerName);
// If keygen is not needed(e.g: consumer), data key will be decrypted from the message
if (!keyGenNeeded) {

Expand Down Expand Up @@ -215,7 +214,7 @@ private PublicKey loadPublicKey(byte[] keyBytes) throws Exception {
if (ecParam != null && ECDSA.equals(publicKey.getAlgorithm())) {
ECParameterSpec ecSpec = new ECParameterSpec(ecParam.getCurve(), ecParam.getG(), ecParam.getN(),
ecParam.getH(), ecParam.getSeed());
KeyFactory keyFactory = KeyFactory.getInstance(ECDSA, BouncyCastleProvider.PROVIDER_NAME);
KeyFactory keyFactory = KeyFactory.getInstance(ECDSA, providerName);
ECPublicKeySpec keySpec = new ECPublicKeySpec(((BCECPublicKey) publicKey).getQ(), ecSpec);
publicKey = (PublicKey) keyFactory.generatePublic(keySpec);
}
Expand Down Expand Up @@ -268,7 +267,7 @@ private PrivateKey loadPrivateKey(byte[] keyBytes) throws Exception {
if (ecParam != null && ECDSA.equals(privateKey.getAlgorithm())) {
ECParameterSpec ecSpec = new ECParameterSpec(ecParam.getCurve(), ecParam.getG(), ecParam.getN(),
ecParam.getH(), ecParam.getSeed());
KeyFactory keyFactory = KeyFactory.getInstance(ECDSA, BouncyCastleProvider.PROVIDER_NAME);
KeyFactory keyFactory = KeyFactory.getInstance(ECDSA, providerName);
ECPrivateKeySpec keySpec = new ECPrivateKeySpec(((BCECPrivateKey) privateKey).getS(), ecSpec);
privateKey = (PrivateKey) keyFactory.generatePrivate(keySpec);
}
Expand Down Expand Up @@ -326,9 +325,9 @@ private void addPublicKeyCipher(String keyName, CryptoKeyReader keyReader) throw

// Encrypt data key using public key
if (RSA.equals(pubKey.getAlgorithm())) {
dataKeyCipher = Cipher.getInstance(RSA_TRANS, BouncyCastleProvider.PROVIDER_NAME);
dataKeyCipher = Cipher.getInstance(RSA_TRANS, providerName);
} else if (ECDSA.equals(pubKey.getAlgorithm())) {
dataKeyCipher = Cipher.getInstance(ECIES, BouncyCastleProvider.PROVIDER_NAME);
dataKeyCipher = Cipher.getInstance(ECIES, providerName);
} else {
String msg = logCtx + "Unsupported key type " + pubKey.getAlgorithm() + " for key " + keyName;
log.error(msg);
Expand Down Expand Up @@ -477,9 +476,9 @@ private boolean decryptDataKey(String keyName, byte[] encryptedDataKey, List<Key

// Decrypt data key using private key
if (RSA.equals(privateKey.getAlgorithm())) {
dataKeyCipher = Cipher.getInstance(RSA_TRANS, BouncyCastleProvider.PROVIDER_NAME);
dataKeyCipher = Cipher.getInstance(RSA_TRANS, providerName);
} else if (ECDSA.equals(privateKey.getAlgorithm())) {
dataKeyCipher = Cipher.getInstance(ECIES, BouncyCastleProvider.PROVIDER_NAME);
dataKeyCipher = Cipher.getInstance(ECIES, providerName);
} else {
log.error("Unsupported key type {} for key {}.", privateKey.getAlgorithm(), keyName);
return false;
Expand Down
3 changes: 2 additions & 1 deletion pulsar-client/src/main/java/org/apache/pulsar/client/impl/auth/AuthenticationTls.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -29,6 +29,7 @@
import org.apache.pulsar.client.impl.AuthenticationUtil;

import com.google.common.annotations.VisibleForTesting;
import org.bouncycastle.jcajce.provider.BouncyCastleFipsProvider;

/**
*
Expand All @@ -46,7 +47,7 @@ public class AuthenticationTls implements Authentication, EncodedAuthenticationP

// Load Bouncy Castle
static {
Security.addProvider(new org.bouncycastle.jce.provider.BouncyCastleProvider());
Security.addProvider(new BouncyCastleFipsProvider());
}

public AuthenticationTls() {
Expand Down
7 changes: 6 additions & 1 deletion pulsar-common/pom.xml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -113,8 +113,13 @@
<dependency>
<groupId>org.bouncycastle</groupId>
<artifactId>bcpkix-jdk15on</artifactId>
<version>${bouncycastle.version}</version>
</dependency>
<dependency>
<groupId>org.bouncycastle</groupId>
<artifactId>bcpkix-fips</artifactId>
<version>1.0.1</version>
</dependency>

<dependency>
<groupId>org.apache.bookkeeper</groupId>
<artifactId>circe-checksum</artifactId>
Expand Down
6 changes: 3 additions & 3 deletions pulsar-common/src/main/java/org/apache/pulsar/common/util/SecurityUtility.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -51,18 +51,18 @@
import javax.net.ssl.SSLException;
import javax.net.ssl.TrustManager;
import javax.net.ssl.TrustManagerFactory;

import org.bouncycastle.jcajce.provider.BouncyCastleFipsProvider;
import org.eclipse.jetty.util.ssl.SslContextFactory;

/**
* Helper class for the security domain.
*/
public class SecurityUtility {

static {
// Fixes loading PKCS8Key file: https://stackoverflow.com/a/18912362
java.security.Security.addProvider(new org.bouncycastle.jce.provider.BouncyCastleProvider());
java.security.Security.addProvider(new BouncyCastleFipsProvider());
}

public static SSLContext createSslContext(boolean allowInsecureConnection, Certificate[] trustCertificates)
throws GeneralSecurityException {
return createSslContext(allowInsecureConnection, trustCertificates, (Certificate[]) null, (PrivateKey) null);
Expand Down
12 changes: 12 additions & 0 deletions pulsar-proxy/pom.xml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -165,5 +165,17 @@
<groupId>com.beust</groupId>
<artifactId>jcommander</artifactId>
</dependency>
<dependency>
<groupId>org.bouncycastle</groupId>
<artifactId>bcpkix-jdk15on</artifactId>
<version>${bouncycastle.version}</version>
</dependency>

<dependency>
<groupId>org.bouncycastle</groupId>
<artifactId>bcprov-ext-jdk15on</artifactId>
<version>${bouncycastle.version}</version>
</dependency>
</dependencies>

</project>