Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

fix: fedramp issues #10092

Merged
merged 9 commits into from Nov 7, 2023
Merged

fix: fedramp issues #10092

Show file tree
Hide file tree
Changes from 2 commits
Commits
Show all changes
9 commits
Select commit Hold shift + click to select a range
ff4a861
fix: fix fedramp issues
aliehsaeedii Oct 16, 2023
ef47865
fix: remove log files
aliehsaeedii Oct 16, 2023
cbc8700
fix: update docs
aliehsaeedii Oct 16, 2023
3cd316d
fix: add bcfks supprt
aliehsaeedii Oct 16, 2023
40207a0
fix: add configs to both server and client side
aliehsaeedii Nov 1, 2023
ba9d0e8
fix: add security providers
aliehsaeedii Nov 2, 2023
4fc7c7d
fix: remove log files
aliehsaeedii Nov 2, 2023
a34d2ba
fix:add providers in appropriate place
aliehsaeedii Nov 3, 2023
7307fe3
fix: remove key pass for trust store
aliehsaeedii Nov 7, 2023
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Jump to
Jump to file
Failed to load files.
Diff view
Diff view
5 changes: 4 additions & 1 deletion ksqldb-rest-app/src/main/java/io/confluent/ksql/rest/server/KsqlRestConfig.java
View file
Open in desktop
Expand Up @@ -126,10 +126,13 @@ public class KsqlRestConfig extends AbstractConfig {

public static final String SSL_STORE_TYPE_JKS = "JKS";
public static final String SSL_STORE_TYPE_PKCS12 = "PKCS12";
public static final String SSL_STORE_TYPE_BCFKS = "BCFKS";

public static final ConfigDef.ValidString SSL_STORE_TYPE_VALIDATOR =
ConfigDef.ValidString.in(
SSL_STORE_TYPE_JKS,
SSL_STORE_TYPE_PKCS12
SSL_STORE_TYPE_PKCS12,
SSL_STORE_TYPE_BCFKS
Comment on lines 131 to +135
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Isn't there a unit test you need to adapt?

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Isn't there a unit test you need to adapt?

For the other two we don't have any.

Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

OK

I think you need to adapt SSL_KEYSTORE_TYPE_DOC and SSL_TRUSTSTORE_TYPE_DOC, though.

);

public static final String SSL_CLIENT_AUTH_CONFIG = "ssl.client.auth";
Expand Down
10 changes: 2 additions & 8 deletions ksqldb-rest-app/src/main/java/io/confluent/ksql/rest/server/KsqlServerMain.java
View file
Open in desktop
Expand Up @@ -220,15 +220,9 @@ private static void validateCipherSuites(
final FipsValidator fipsValidator, final KsqlRestConfig restConfig) {
final Map<String, List<String>> fipsTlsMap = new HashMap<>();
final List<String> cipherSuites = restConfig.getList(KsqlRestConfig.SSL_CIPHER_SUITES_CONFIG);
if (cipherSuites.isEmpty()) {
final String errorMsg = "No cipher suites "
+ "('"
+ KsqlRestConfig.SSL_CIPHER_SUITES_CONFIG
+ "') is specified.";
log.error(errorMsg);
throw new SecurityException(errorMsg);
Comment on lines -223 to -229
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Why did you remove this?

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Why did you remove this?

Based on info form CP team, ssl.cipher.suites must be an optional parameter.

if (!cipherSuites.isEmpty()) {
fipsTlsMap.put(KsqlRestConfig.SSL_CIPHER_SUITES_CONFIG, cipherSuites);
}
fipsTlsMap.put(KsqlRestConfig.SSL_CIPHER_SUITES_CONFIG, cipherSuites);
fipsTlsMap.put(KsqlRestConfig.SSL_ENABLED_PROTOCOLS_CONFIG,
restConfig.getList(KsqlRestConfig.SSL_ENABLED_PROTOCOLS_CONFIG));

Expand Down
24 changes: 0 additions & 24 deletions ksqldb-rest-app/src/test/java/io/confluent/ksql/rest/server/KsqlServerMainTest.java
View file
Open in desktop
Expand Up @@ -266,30 +266,6 @@ public void shouldFailOnInvalidDefaultValueFormat() {
"Invalid value for config '" + KsqlConfig.KSQL_DEFAULT_VALUE_FORMAT_CONFIG + "': bad"));
}

@Test
public void shouldFailOnEmptyCipherSuitesList() {
// Given:
final KsqlConfig config = configWith(ImmutableMap.of(
ConfluentConfigs.ENABLE_FIPS_CONFIG, true
));
final KsqlRestConfig restConfig = new KsqlRestConfig(ImmutableMap.<String, Object>builder()
.build()
);

// When:
final Exception e = assertThrows(
SecurityException.class,
() -> KsqlServerMain.validateFips(config, restConfig)
);

// Then:
assertThat(e.getMessage(), containsString(
"No cipher suites "
+ "('"
+ KsqlRestConfig.SSL_CIPHER_SUITES_CONFIG
+ "') is specified."));
}

@Test
public void shouldFailOnInvalidCipherSuitesList() {
// Given:
Expand Down