szetszwo commented on code in PR #1511:
URL: https://github.com/apache/ratis/pull/1511#discussion_r3560896866
##########
ratis-common/src/main/java/org/apache/ratis/util/NettyUtils.java:
##########
@@ -185,6 +187,32 @@ static SslContextBuilder
initSslContextBuilderForClient(TlsConf tlsConf) {
if (tlsConf.isMutualTls()) {
setKeyManager(b, tlsConf.getKeyManager());
}
+ return configureSslContextBuilder(b, tlsConf);
+ }
+
+ /**
+ * Apply the {@link SslProvider}, enabled TLS protocols and cipher suites
from the given
+ * {@link TlsConf} to the builder, so that the Netty DataStream transport
honours the same
+ * configuration instead of falling back on the provider defaults.
+ *
+ * <p>Unlike the gRPC path ({@code GrpcUtil.configureSslContextBuilder})
this uses
+ * {@link SupportedCipherSuiteFilter}, which intersects the requested cipher
suites with the
+ * ones actually supported by the negotiated provider/engine, rather than
passing them through
+ * verbatim.
+ */
+ static SslContextBuilder configureSslContextBuilder(SslContextBuilder b,
TlsConf tlsConf) {
+ final SslProvider sslProvider = tlsConf.getSslProvider();
+ if (sslProvider != null) {
+ b.sslProvider(sslProvider);
+ }
Review Comment:
We should set also jsseProvider:
```java
final String jsseProviderName = tlsConf.getJsseProviderName();
if (jsseProviderName != null) {
final Provider jsseProvider = Security.getProvider(jsseProviderName);
b.sslContextProvider(jsseProvider);
}
```
##########
ratis-common/src/main/java/org/apache/ratis/util/NettyUtils.java:
##########
@@ -185,6 +187,32 @@ static SslContextBuilder
initSslContextBuilderForClient(TlsConf tlsConf) {
if (tlsConf.isMutualTls()) {
setKeyManager(b, tlsConf.getKeyManager());
}
+ return configureSslContextBuilder(b, tlsConf);
+ }
+
+ /**
+ * Apply the {@link SslProvider}, enabled TLS protocols and cipher suites
from the given
+ * {@link TlsConf} to the builder, so that the Netty DataStream transport
honours the same
+ * configuration instead of falling back on the provider defaults.
+ *
+ * <p>Unlike the gRPC path ({@code GrpcUtil.configureSslContextBuilder})
this uses
+ * {@link SupportedCipherSuiteFilter}, which intersects the requested cipher
suites with the
+ * ones actually supported by the negotiated provider/engine, rather than
passing them through
+ * verbatim.
+ */
+ static SslContextBuilder configureSslContextBuilder(SslContextBuilder b,
TlsConf tlsConf) {
+ final SslProvider sslProvider = tlsConf.getSslProvider();
+ if (sslProvider != null) {
+ b.sslProvider(sslProvider);
+ }
+ final List<String> protocols = tlsConf.getProtocols();
+ if (protocols != null && !protocols.isEmpty()) {
+ b.protocols(protocols.toArray(new String[0]));
Review Comment:
toArray is not needed, i.e.
```java
b.protocols(protocols);
```
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
