Add support for specifying SecureRandom in SSLContext initialization #14058
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
chrisvest
reviewed
May 20, 2024
Comment on lines
605
to
606
| /** | ||
| * @param secureRandom the source of randomness for SslContext |
There was a problem hiding this comment.
Suggested change
| /** | |
| * @param secureRandom the source of randomness for SslContext | |
| /** | |
| * Specify a non-default source of randomness for the {@link SSLContext}. | |
| * <p> | |
| * In general, the best practice is to leave this unspecified, or to assign a new random source using the | |
| * default {@code new SecureRandom()} constructor. | |
| * Only assign this something when you have a good reason to. | |
| * | |
| * @param secureRandom the source of randomness for {@link SSLContext} |
There was a problem hiding this comment.
I think this explanation is very good. 56bee2e
My understanding is that this is only used in the JDK SslProvider (JdkSslServerContext JdkSslClientContext), is that correct? If so, what do you think about adding this to the comments?
There was a problem hiding this comment.
@thxwelchs please add this.
There was a problem hiding this comment.
Added!
4408ced
netty/handler/src/main/java/io/netty/handler/ssl/SslContextBuilder.java
Lines 606 to 612 in 047d95a
handler/src/test/java/io/netty/handler/ssl/SslContextBuilderTest.java
Outdated
Show resolved
Hide resolved
|
The JDK 17+ builds are actually failing on the new test, because Mockito can't mock |
chrisvest
requested changes
May 20, 2024
thxwelchs
force-pushed
the
support-build-sslContext-secureRandom
branch
from
939a083
to
608bf20
Compare
normanmaurer
requested changes
May 21, 2024
handler/src/test/java/io/netty/handler/ssl/SslContextBuilderTest.java
Outdated
Show resolved
Hide resolved
handler/src/test/java/io/netty/handler/ssl/SslContextBuilderTest.java
Outdated
Show resolved
Hide resolved
chrisvest
approved these changes
May 21, 2024
Comment on lines
603
to
604
| } | ||
| /** |
There was a problem hiding this comment.
Suggested change
| } | |
| /** | |
| } | |
| /** |
There was a problem hiding this comment.
Fixed!
| @@ -20,6 +20,7 @@ | |||
| import io.netty.util.CharsetUtil; | |||
| import org.junit.jupiter.api.Test; | |||
| import org.junit.jupiter.api.function.Executable; | |||
| import org.mockito.Mockito; | |||
There was a problem hiding this comment.
Suggested change
| import org.mockito.Mockito; |
We don't need to import mockito anymore
There was a problem hiding this comment.
Fixed!
@chrisvest @normanmaurer |
chrisvest
approved these changes
May 22, 2024
normanmaurer
approved these changes
May 22, 2024
|
@thxwelchs thanks a lot! |
normanmaurer
added a commit
that referenced
this pull request
May 22, 2024
…14058) Motivation: Enhance security by supporting specific secure randomness source in SSLContext initialization Modification: Support building SecureRandom in `SslContextBuilder`. Allow passing SecureRandom as a parameter when creating an instance of `JdkSslServerContext` through its constructor. Result: Enhance security Fixes #14026 --------- Co-authored-by: Norman Maurer <norman_maurer@apple.com>
normanmaurer
added a commit
that referenced
this pull request
May 22, 2024
…14058) Motivation: Enhance security by supporting specific secure randomness source in SSLContext initialization Modification: Support building SecureRandom in `SslContextBuilder`. Allow passing SecureRandom as a parameter when creating an instance of `JdkSslServerContext` through its constructor. Result: Enhance security Fixes #14026 --------- Co-authored-by: Norman Maurer <norman_maurer@apple.com>
LuciferYang
pushed a commit
to apache/spark
that referenced
this pull request
May 28, 2024
### What changes were proposed in this pull request? The pr aims to upgrade `netty` from `4.1.109.Final` to `4.1.110.Final`. ### Why are the changes needed? - https://netty.io/news/2024/05/22/4-1-110-Final.html This version has brought some bug fixes and improvements, such as: Fix Zstd throws Exception on read-only volumes (netty/netty#13982) Add unix domain socket transport in netty 4.x via JDK16+ ([#13965](netty/netty#13965)) Backport #13075: Add the AdaptivePoolingAllocator ([#13976](netty/netty#13976)) Add no-value key handling only for form body ([#13998](netty/netty#13998)) Add support for specifying SecureRandom in SSLContext initialization ([#14058](netty/netty#14058)) - https://github.com/netty/netty/issues?q=milestone%3A4.1.110.Final+is%3Aclosed ### Does this PR introduce _any_ user-facing change? No. ### How was this patch tested? Pass GA. ### Was this patch authored or co-authored using generative AI tooling? No. Closes #46744 from panbingkun/SPARK-48420. Authored-by: panbingkun <panbingkun@baidu.com> Signed-off-by: yangjie01 <yangjie01@baidu.com>
riyaverm-db
pushed a commit
to riyaverm-db/spark
that referenced
this pull request
Jun 7, 2024
### What changes were proposed in this pull request? The pr aims to upgrade `netty` from `4.1.109.Final` to `4.1.110.Final`. ### Why are the changes needed? - https://netty.io/news/2024/05/22/4-1-110-Final.html This version has brought some bug fixes and improvements, such as: Fix Zstd throws Exception on read-only volumes (netty/netty#13982) Add unix domain socket transport in netty 4.x via JDK16+ ([apache#13965](netty/netty#13965)) Backport apache#13075: Add the AdaptivePoolingAllocator ([apache#13976](netty/netty#13976)) Add no-value key handling only for form body ([apache#13998](netty/netty#13998)) Add support for specifying SecureRandom in SSLContext initialization ([apache#14058](netty/netty#14058)) - https://github.com/netty/netty/issues?q=milestone%3A4.1.110.Final+is%3Aclosed ### Does this PR introduce _any_ user-facing change? No. ### How was this patch tested? Pass GA. ### Was this patch authored or co-authored using generative AI tooling? No. Closes apache#46744 from panbingkun/SPARK-48420. Authored-by: panbingkun <panbingkun@baidu.com> Signed-off-by: yangjie01 <yangjie01@baidu.com>
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Motivation:
Enhance security by supporting specific secure randomness source in SSLContext initialization
Modification:
Support building SecureRandom in
SslContextBuilder.Allow passing SecureRandom as a parameter when creating an instance of
JdkSslServerContextthrough its constructor.Result:
Enhance security
Fixes #14026