szetszwo commented on code in PR #1511:
URL: https://github.com/apache/ratis/pull/1511#discussion_r3560941822
##########
ratis-common/src/main/java/org/apache/ratis/util/NettyUtils.java:
##########
@@ -185,6 +187,32 @@ static SslContextBuilder
initSslContextBuilderForClient(TlsConf tlsConf) {
if (tlsConf.isMutualTls()) {
setKeyManager(b, tlsConf.getKeyManager());
}
+ return configureSslContextBuilder(b, tlsConf);
+ }
+
+ /**
+ * Apply the {@link SslProvider}, enabled TLS protocols and cipher suites
from the given
+ * {@link TlsConf} to the builder, so that the Netty DataStream transport
honours the same
+ * configuration instead of falling back on the provider defaults.
+ *
+ * <p>Unlike the gRPC path ({@code GrpcUtil.configureSslContextBuilder})
this uses
+ * {@link SupportedCipherSuiteFilter}, which intersects the requested cipher
suites with the
+ * ones actually supported by the negotiated provider/engine, rather than
passing them through
+ * verbatim.
+ */
+ static SslContextBuilder configureSslContextBuilder(SslContextBuilder b,
TlsConf tlsConf) {
+ final SslProvider sslProvider = tlsConf.getSslProvider();
+ if (sslProvider != null) {
+ b.sslProvider(sslProvider);
+ }
Review Comment:
GrpcUtil has a getJsseProvider(..) method. Let's move it to NettyUtils and
reuse it, i.e.:
```diff
@@ -185,9 +191,51 @@ public interface NettyUtils {
if (tlsConf.isMutualTls()) {
setKeyManager(b, tlsConf.getKeyManager());
}
+ return configureSslContextBuilder(b, tlsConf);
+ }
+
+ /**
+ * Apply the {@link SslProvider}, enabled TLS protocols and cipher suites
from the given
+ * {@link TlsConf} to the builder, so that the Netty DataStream transport
honours the same
+ * configuration instead of falling back on the provider defaults.
+ *
+ * <p>Unlike the gRPC path ({@code GrpcUtil.configureSslContextBuilder})
this uses
+ * {@link SupportedCipherSuiteFilter}, which intersects the requested
cipher suites with the
+ * ones actually supported by the negotiated provider/engine, rather than
passing them through
+ * verbatim.
+ */
+ static SslContextBuilder configureSslContextBuilder(SslContextBuilder b,
TlsConf tlsConf) {
+ final SslProvider sslProvider = tlsConf.getSslProvider();
+ if (sslProvider != null) {
+ b.sslProvider(sslProvider);
+ }
+ final Provider jsseProvider = getJsseProvider(tlsConf);
+ if (jsseProvider != null) {
+ b.sslContextProvider(jsseProvider);
+ }
+ final List<String> protocols = tlsConf.getProtocols();
+ if (protocols != null && !protocols.isEmpty()) {
+ b.protocols(protocols);
+ }
+ final List<String> cipherSuites = tlsConf.getCipherSuites();
+ if (cipherSuites != null && !cipherSuites.isEmpty()) {
+ b.ciphers(cipherSuites, SupportedCipherSuiteFilter.INSTANCE);
+ }
return b;
}
+ static Provider getJsseProvider(TlsConf tlsConf) {
+ final String providerName = tlsConf.getJsseProviderName();
+ if (providerName == null || providerName.trim().isEmpty()) {
+ return null;
+ }
+ final Provider namedProvider =
Security.getProvider(providerName.trim());
+ if (namedProvider == null) {
+ throw new IllegalArgumentException("JSSE provider not found: " +
providerName);
+ }
+ return namedProvider;
+ }
+
static SslContext buildSslContextForClient(TlsConf tlsConf) {
return buildSslContext("client", tlsConf,
NettyUtils::initSslContextBuilderForClient);
}
diff --git a/ratis-grpc/src/main/java/org/apache/ratis/grpc/GrpcUtil.java
b/ratis-grpc/src/main/java/org/apache/ratis/grpc/GrpcUtil.java
index 36b8e9d65..e51d827ec 100644
--- a/ratis-grpc/src/main/java/org/apache/ratis/grpc/GrpcUtil.java
+++ b/ratis-grpc/src/main/java/org/apache/ratis/grpc/GrpcUtil.java
@@ -58,6 +58,7 @@ import java.util.function.Function;
import java.util.function.Supplier;
import static
org.apache.ratis.thirdparty.io.netty.handler.ssl.SslProvider.OPENSSL;
+import static org.apache.ratis.util.NettyUtils.getJsseProvider;
public interface GrpcUtil {
Logger LOG = LoggerFactory.getLogger(GrpcUtil.class);
@@ -357,18 +358,6 @@ public interface GrpcUtil {
}
}
- static Provider getJsseProvider(TlsConf tlsConf) {
- final String providerName = tlsConf.getJsseProviderName();
- if (providerName == null || providerName.trim().isEmpty()) {
- return null;
- }
- final Provider namedProvider =
Security.getProvider(providerName.trim());
- if (namedProvider == null) {
- throw new IllegalArgumentException("JSSE provider not found: " +
providerName);
- }
- return namedProvider;
- }
-
```
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
