ikshwaks commented on code in PR #181:
URL: https://github.com/apache/qpid-broker-j/pull/181#discussion_r4247388144
##########
broker-core/src/main/java/org/apache/qpid/server/transport/network/security/ssl/SSLUtil.java:
##########
@@ -92,108 +111,25 @@ public class SSLUtil
private static final Logger LOGGER =
LoggerFactory.getLogger(SSLUtil.class);
private static final Integer DNS_NAME_TYPE = 2;
- private static final String[] TLS_PROTOCOL_PREFERENCES = new
String[]{"TLSv1.3", "TLSv1.2", "TLSv1.1", "TLS", "TLSv1"};
-
-
- private static final Constructor<?> CONSTRUCTOR;
- private static final Method GENERATE_METHOD;
- private static final Method GET_PRIVATE_KEY_METHOD;
- private static final Method GET_SELF_CERTIFICATE_METHOD;
- private static final Constructor<?> X500_NAME_CONSTRUCTOR;
- private static final Constructor<?> DNS_NAME_CONSTRUCTOR;
- private static final Constructor<?> IP_ADDR_NAME_CONSTRUCTOR;
- private static final Constructor<?> GENERAL_NAMES_CONSTRUCTOR;
- private static final Constructor<?> GENERAL_NAME_CONSTRUCTOR;
- private static final Method ADD_NAME_TO_NAMES_METHOD;
- private static final Constructor<?> ALT_NAMES_CONSTRUCTOR;
- private static final Constructor<?> CERTIFICATE_EXTENSIONS_CONSTRUCTOR;
- private static final Method SET_EXTENSION_METHOD;
- private static final Method EXTENSION_GET_NAME_METHOD;
- private static final boolean CAN_GENERATE_CERTS;
+ private static final String[] TLS_PROTOCOL_PREFERENCES = new String[] {
"TLSv1.3", "TLSv1.2", "TLSv1.1", "TLS", "TLSv1" };
+ private static final Pattern DNS_NAME_PATTERN =
Pattern.compile("[\\w&&[^\\d]][\\w\\d.-]*");
+
+ private static final Provider PROVIDER = new BouncyCastleProvider();
Review Comment:
@dakirily Sorry to comment on an old PR. I'd like to understand the reason
for setting the provider explicitly in
`SSLUtil.generateSelfSignedCertificate()`:
```java
private static final Provider PROVIDER = new BouncyCastleProvider();
...
new JcaX509CertificateConverter().setProvider(PROVIDER).getCertificate(...)
```
Based on my understanding, without `setProvider`,
`JcaX509CertificateConverter` calls `CertificateFactory.getInstance("X.509")`,
so JCA picks the most-preferred registered provider that supports X.509
(normally `SUN`). Key-pair generation
(`KeyPairGenerator.getInstance(keyAlgorithm)`) and signing
(`JcaContentSignerBuilder` without a provider) in the same method already rely
on JCA's provider selection (Please feel free to correct me here).
**Why I'm asking:** I am trying to run the broker on a FIPS-enabled JVM in
my local, where BC-FIPS (`bc-fips`) is installed and its classes take
precedence over `bcprov-jdk18on`. In that setup, the static initializer `new
BouncyCastleProvider()` fails:
```
java.lang.NoSuchMethodError: 'void
org.bouncycastle.crypto.CryptoServicesRegistrar.checkConstraints(org.bouncycastle.crypto.CryptoServiceProperties)'
at org.bouncycastle.jce.provider.BouncyCastleProvider.loadAlgorithms(...)
at org.bouncycastle.jce.provider.BouncyCastleProvider.<init>(...)
```
Because this happens in a static field initializer, `SSLUtil` fails with
`ExceptionInInitializerError` and the broker can't start. In FIPS mode I
wouldn't want the non-FIPS `BouncyCastleProvider` instantiated at all.
Was there a specific case on Java 17 where the default provider didn't work
and `BouncyCastleProvider` was required? If not, would you be open to a small
change that drops the explicit provider? I'm happy to raise a JIRA and a PR.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
