This is an automated email from the ASF dual-hosted git repository.
pjfanning pushed a commit to branch main
in repository https://gitbox.apache.org/repos/asf/pekko-connectors.git
The following commit(s) were added to refs/heads/main by this push:
new f75832d13 require TLS 1.2 min for google and huawei connectors (#1808)
f75832d13 is described below
commit f75832d13a23859027231ddfa837f95353cba0ae
Author: PJ Fanning <[email protected]>
AuthorDate: Tue Aug 4 19:03:29 2026 +0100
require TLS 1.2 min for google and huawei connectors (#1808)
* require TLS 1.2 min for google and huawei connectors
* Update GoogleExt.scala
* add config
* since markers
* scalafmt
* mima
---
.../private-zero-chunk-change.backwards.excludes | 17 +++++++++++++++++
.../min-tls-version.backwards.excludes | 19 +++++++++++++++++++
google-common/src/main/resources/reference.conf | 2 ++
.../pekko/stream/connectors/google/GoogleExt.scala | 2 +-
.../stream/connectors/google/GoogleSettings.scala | 22 +++++++++++++++++++---
.../google/http/ForwardProxyHttpsContext.scala | 12 ++++++++++--
.../min-tls-version.backwards.excludes | 21 +++++++++++++++++++++
huawei-push-kit/src/main/resources/reference.conf | 2 ++
.../huawei/pushkit/ForwardProxyHttpsContext.scala | 15 +++++++++++----
.../connectors/huawei/pushkit/HmsSettings.scala | 19 +++++++++++++++----
10 files changed, 117 insertions(+), 14 deletions(-)
diff --git
a/google-common/src/main/mima-filters/1.1.x.backwards.excludes/private-zero-chunk-change.backwards.excludes
b/google-common/src/main/mima-filters/1.1.x.backwards.excludes/private-zero-chunk-change.backwards.excludes
index 8dc2f205f..d504df4ca 100644
---
a/google-common/src/main/mima-filters/1.1.x.backwards.excludes/private-zero-chunk-change.backwards.excludes
+++
b/google-common/src/main/mima-filters/1.1.x.backwards.excludes/private-zero-chunk-change.backwards.excludes
@@ -1 +1,18 @@
+# Licensed to the Apache Software Foundation (ASF) under one
+# or more contributor license agreements. See the NOTICE file
+# distributed with this work for additional information
+# regarding copyright ownership. The ASF licenses this file
+# to you under the Apache License, Version 2.0 (the
+# "License"); you may not use this file except in compliance
+# with the License. You may obtain a copy of the License at
+#
+# http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing,
+# software distributed under the License is distributed on an
+# "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+# KIND, either express or implied. See the License for the
+# specific language governing permissions and limitations
+# under the License.
+
ProblemFilters.exclude[MissingTypesProblem]("org.apache.pekko.stream.connectors.google.ResumableUpload$Chunk$")
diff --git
a/google-common/src/main/mima-filters/2.0.x.backwards.excludes/min-tls-version.backwards.excludes
b/google-common/src/main/mima-filters/2.0.x.backwards.excludes/min-tls-version.backwards.excludes
new file mode 100644
index 000000000..7a463202b
--- /dev/null
+++
b/google-common/src/main/mima-filters/2.0.x.backwards.excludes/min-tls-version.backwards.excludes
@@ -0,0 +1,19 @@
+# Licensed to the Apache Software Foundation (ASF) under one
+# or more contributor license agreements. See the NOTICE file
+# distributed with this work for additional information
+# regarding copyright ownership. The ASF licenses this file
+# to you under the Apache License, Version 2.0 (the
+# "License"); you may not use this file except in compliance
+# with the License. You may obtain a copy of the License at
+#
+# http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing,
+# software distributed under the License is distributed on an
+# "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+# KIND, either express or implied. See the License for the
+# specific language governing permissions and limitations
+# under the License.
+
+# Add min-tls-version setting
+ProblemFilters.exclude[DirectMissingMethodProblem]("org.apache.pekko.stream.connectors.google.ForwardProxy.apply")
diff --git a/google-common/src/main/resources/reference.conf
b/google-common/src/main/resources/reference.conf
index 7dcef98ad..d18d78579 100644
--- a/google-common/src/main/resources/reference.conf
+++ b/google-common/src/main/resources/reference.conf
@@ -93,6 +93,8 @@ pekko.connectors.google {
# password = "password"
# }
# trust-pem = "/path/to/file.pem"
+ # # Minimum TLS version to use. Valid values: TLSv1.2, TLSv1.3
+ # min-tls-version = "TLSv1.2"
# }
}
diff --git
a/google-common/src/main/scala/org/apache/pekko/stream/connectors/google/GoogleExt.scala
b/google-common/src/main/scala/org/apache/pekko/stream/connectors/google/GoogleExt.scala
index bb6680a89..2ff9a819e 100644
---
a/google-common/src/main/scala/org/apache/pekko/stream/connectors/google/GoogleExt.scala
+++
b/google-common/src/main/scala/org/apache/pekko/stream/connectors/google/GoogleExt.scala
@@ -32,7 +32,7 @@ import scala.collection.immutable.ListMap
@InternalApi
private[google] final class GoogleExt private (sys: ExtendedActorSystem)
extends Extension {
private var cachedSettings: Map[String, GoogleSettings] = ListMap.empty
- val settings: GoogleSettings = settings(GoogleSettings.ConfigPath)
+ lazy val settings: GoogleSettings = settings(GoogleSettings.ConfigPath)
def settings(path: String): GoogleSettings =
cachedSettings.getOrElse(path, {
diff --git
a/google-common/src/main/scala/org/apache/pekko/stream/connectors/google/GoogleSettings.scala
b/google-common/src/main/scala/org/apache/pekko/stream/connectors/google/GoogleSettings.scala
index c3de5c7ce..3a4989151 100644
---
a/google-common/src/main/scala/org/apache/pekko/stream/connectors/google/GoogleSettings.scala
+++
b/google-common/src/main/scala/org/apache/pekko/stream/connectors/google/GoogleSettings.scala
@@ -242,7 +242,11 @@ object ForwardProxy {
else
None
- ForwardProxy(scheme, c.getString("host"), c.getInt("port"),
maybeCredentials, maybeTrustPem)
+ val minTlsVersion =
+ if (c.hasPath("min-tls-version")) c.getString("min-tls-version")
+ else "TLSv1.2"
+
+ ForwardProxy(scheme, c.getString("host"), c.getInt("port"),
maybeCredentials, maybeTrustPem, minTlsVersion)
}
def create(c: Config, system: ClassicActorSystemProvider) =
@@ -252,9 +256,10 @@ object ForwardProxy {
host: String,
port: Int,
credentials: Option[BasicHttpCredentials],
- trustPem: Option[String])(implicit system: ClassicActorSystemProvider):
ForwardProxy = {
+ trustPem: Option[String],
+ minTlsVersion: String = "TLSv1.2")(implicit system:
ClassicActorSystemProvider): ForwardProxy = {
ForwardProxy(
-
trustPem.fold(Http(system.classicSystem).defaultClientHttpsContext)(ForwardProxyHttpsContext(_)),
+
trustPem.fold(Http(system.classicSystem).defaultClientHttpsContext)(ForwardProxyHttpsContext(_,
minTlsVersion)),
ForwardProxyPoolSettings(scheme, host, port,
credentials)(system.classicSystem))
}
@@ -266,6 +271,17 @@ object ForwardProxy {
system: ClassicActorSystemProvider) =
apply(scheme, host, port,
credentials.toScala.asInstanceOf[Option[BasicHttpCredentials]],
trustPem.toScala)(system)
+ /** @since 2.0.0 */
+ def create(scheme: String,
+ host: String,
+ port: Int,
+ credentials: Optional[jm.headers.BasicHttpCredentials],
+ trustPem: Optional[String],
+ minTlsVersion: String,
+ system: ClassicActorSystemProvider) =
+ apply(scheme, host, port,
credentials.toScala.asInstanceOf[Option[BasicHttpCredentials]],
trustPem.toScala,
+ minTlsVersion)(system)
+
def create(connectionContext: jh.HttpConnectionContext, poolSettings:
jh.settings.ConnectionPoolSettings) =
apply(connectionContext.asInstanceOf[HttpsConnectionContext],
poolSettings.asInstanceOf[ConnectionPoolSettings])
}
diff --git
a/google-common/src/main/scala/org/apache/pekko/stream/connectors/google/http/ForwardProxyHttpsContext.scala
b/google-common/src/main/scala/org/apache/pekko/stream/connectors/google/http/ForwardProxyHttpsContext.scala
index 20602c230..db872c3c0 100644
---
a/google-common/src/main/scala/org/apache/pekko/stream/connectors/google/http/ForwardProxyHttpsContext.scala
+++
b/google-common/src/main/scala/org/apache/pekko/stream/connectors/google/http/ForwardProxyHttpsContext.scala
@@ -25,9 +25,13 @@ import javax.net.ssl.{ SSLContext, TrustManagerFactory }
@InternalApi
private[google] object ForwardProxyHttpsContext {
- def apply(trustPemPath: String): HttpsConnectionContext = {
+ private val TlsVersions = Map(
+ "TLSv1.2" -> Array("TLSv1.2", "TLSv1.3"),
+ "TLSv1.3" -> Array("TLSv1.3"))
+
+ def apply(trustPemPath: String, minTlsVersion: String = "TLSv1.2"):
HttpsConnectionContext = {
val certificate = x509Certificate(trustPemPath: String)
- val sslContext = SSLContext.getInstance("SSL")
+ val sslContext = SSLContext.getInstance("TLS")
val alias = certificate.getIssuerX500Principal.getName
val trustStore = KeyStore.getInstance(KeyStore.getDefaultType)
@@ -38,6 +42,10 @@ private[google] object ForwardProxyHttpsContext {
tmf.init(trustStore)
val trustManagers = tmf.getTrustManagers
sslContext.init(null, trustManagers, null)
+ val protocols = TlsVersions.getOrElse(minTlsVersion,
+ throw new IllegalArgumentException(
+ s"Unsupported TLS version: $minTlsVersion. Minimum supported is
TLSv1.2. Valid values: ${TlsVersions.keys.mkString(", ")}"))
+ sslContext.getDefaultSSLParameters.setProtocols(protocols)
ConnectionContext.httpsClient(sslContext)
}
diff --git
a/huawei-push-kit/src/main/mima-filters/2.0.x.backwards.excludes/min-tls-version.backwards.excludes
b/huawei-push-kit/src/main/mima-filters/2.0.x.backwards.excludes/min-tls-version.backwards.excludes
new file mode 100644
index 000000000..2d1bb2802
--- /dev/null
+++
b/huawei-push-kit/src/main/mima-filters/2.0.x.backwards.excludes/min-tls-version.backwards.excludes
@@ -0,0 +1,21 @@
+# Licensed to the Apache Software Foundation (ASF) under one
+# or more contributor license agreements. See the NOTICE file
+# distributed with this work for additional information
+# regarding copyright ownership. The ASF licenses this file
+# to you under the Apache License, Version 2.0 (the
+# "License"); you may not use this file except in compliance
+# with the License. You may obtain a copy of the License at
+#
+# http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing,
+# software distributed under the License is distributed on an
+# "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+# KIND, either express or implied. See the License for the
+# specific language governing permissions and limitations
+# under the License.
+
+# Add min-tls-version setting
+ProblemFilters.exclude[IncompatibleSignatureProblem]("org.apache.pekko.stream.connectors.huawei.pushkit.ForwardProxy.unapply")
+ProblemFilters.exclude[DirectMissingMethodProblem]("org.apache.pekko.stream.connectors.huawei.pushkit.ForwardProxy.apply")
+ProblemFilters.exclude[DirectMissingMethodProblem]("org.apache.pekko.stream.connectors.huawei.pushkit.ForwardProxy.copy")
diff --git a/huawei-push-kit/src/main/resources/reference.conf
b/huawei-push-kit/src/main/resources/reference.conf
index 6b3331d5c..fa9ab6526 100644
--- a/huawei-push-kit/src/main/resources/reference.conf
+++ b/huawei-push-kit/src/main/resources/reference.conf
@@ -15,5 +15,7 @@ pekko.connectors.huawei.pushkit {
# password = "password"
# }
# trust-pem = "/path/to/file.pem"
+ # # Minimum TLS version to use. Valid values: TLSv1.2, TLSv1.3
+ # min-tls-version = "TLSv1.2"
# }
}
diff --git
a/huawei-push-kit/src/main/scala/org/apache/pekko/stream/connectors/huawei/pushkit/ForwardProxyHttpsContext.scala
b/huawei-push-kit/src/main/scala/org/apache/pekko/stream/connectors/huawei/pushkit/ForwardProxyHttpsContext.scala
index e4d54a54d..5b690cdc5 100644
---
a/huawei-push-kit/src/main/scala/org/apache/pekko/stream/connectors/huawei/pushkit/ForwardProxyHttpsContext.scala
+++
b/huawei-push-kit/src/main/scala/org/apache/pekko/stream/connectors/huawei/pushkit/ForwardProxyHttpsContext.scala
@@ -29,22 +29,25 @@ import javax.net.ssl.{ SSLContext, TrustManagerFactory }
@InternalApi
private[pushkit] object ForwardProxyHttpsContext {
- val SSL = "SSL"
val X509 = "X509"
+ private val TlsVersions = Map(
+ "TLSv1.2" -> Array("TLSv1.2", "TLSv1.3"),
+ "TLSv1.3" -> Array("TLSv1.3"))
+
implicit class ForwardProxyHttpsContext(forwardProxy: ForwardProxy) {
def httpsContext(system: ActorSystem): HttpsConnectionContext = {
forwardProxy.trustPem match {
- case Some(trustPem) => createHttpsContext(trustPem)
+ case Some(trustPem) => createHttpsContext(trustPem,
forwardProxy.minTlsVersion)
case None => Http()(system).defaultClientHttpsContext
}
}
}
- private def createHttpsContext(trustPem: ForwardProxyTrustPem) = {
+ private def createHttpsContext(trustPem: ForwardProxyTrustPem,
minTlsVersion: String) = {
val certificate = x509Certificate(trustPem)
- val sslContext = SSLContext.getInstance(SSL)
+ val sslContext = SSLContext.getInstance("TLS")
val alias = certificate.getIssuerX500Principal.getName
val trustStore = KeyStore.getInstance(KeyStore.getDefaultType)
@@ -55,6 +58,10 @@ private[pushkit] object ForwardProxyHttpsContext {
tmf.init(trustStore)
val trustManagers = tmf.getTrustManagers
sslContext.init(null, trustManagers, null)
+ val protocols = TlsVersions.getOrElse(minTlsVersion,
+ throw new IllegalArgumentException(
+ s"Unsupported TLS version: $minTlsVersion. Minimum supported is
TLSv1.2. Valid values: ${TlsVersions.keys.mkString(", ")}"))
+ sslContext.getDefaultSSLParameters.setProtocols(protocols)
ConnectionContext.httpsClient(sslContext)
}
diff --git
a/huawei-push-kit/src/main/scala/org/apache/pekko/stream/connectors/huawei/pushkit/HmsSettings.scala
b/huawei-push-kit/src/main/scala/org/apache/pekko/stream/connectors/huawei/pushkit/HmsSettings.scala
index 4e37007a7..d818b19f6 100644
---
a/huawei-push-kit/src/main/scala/org/apache/pekko/stream/connectors/huawei/pushkit/HmsSettings.scala
+++
b/huawei-push-kit/src/main/scala/org/apache/pekko/stream/connectors/huawei/pushkit/HmsSettings.scala
@@ -171,7 +171,10 @@ object ForwardProxy {
Some(ForwardProxyTrustPem(c.getString("trust-pem")))
else
None
- ForwardProxy(c.getString("host"), c.getInt("port"), maybeCredentials,
maybeTrustPem)
+ val minTlsVersion =
+ if (c.hasPath("min-tls-version")) c.getString("min-tls-version")
+ else "TLSv1.2"
+ ForwardProxy(c.getString("host"), c.getInt("port"), maybeCredentials,
maybeTrustPem, minTlsVersion)
}
/**
@@ -182,8 +185,9 @@ object ForwardProxy {
def apply(host: String,
port: Int,
credentials: Option[ForwardProxyCredentials],
- trustPem: Option[ForwardProxyTrustPem]) =
- new ForwardProxy(host, port, credentials, trustPem)
+ trustPem: Option[ForwardProxyTrustPem],
+ minTlsVersion: String = "TLSv1.2") =
+ new ForwardProxy(host, port, credentials, trustPem, minTlsVersion)
/**
* Java API.
@@ -216,17 +220,24 @@ object ForwardProxy {
final case class ForwardProxy @InternalApi private (host: String,
port: Int,
credentials: Option[ForwardProxyCredentials],
- trustPem: Option[ForwardProxyTrustPem]) {
+ trustPem: Option[ForwardProxyTrustPem],
+ minTlsVersion: String = "TLSv1.2") {
def getHost = host
def getPort = port
def getCredentials = credentials
def getForwardProxyTrustPem = trustPem
+ /** @since 2.0.0 */
+ def getMinTlsVersion = minTlsVersion
+
def withHost(host: String) = copy(host = host)
def withPort(port: Int) = copy(port = port)
def withCredentials(credentials: ForwardProxyCredentials) = copy(credentials
= Option(credentials))
def withTrustPem(trustPem: ForwardProxyTrustPem) = copy(trustPem =
Option(trustPem))
+
+ /** @since 2.0.0 */
+ def withMinTlsVersion(minTlsVersion: String) = copy(minTlsVersion =
minTlsVersion)
}
object ForwardProxyCredentials {
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
