Skip to content

Commit 8f781dd

Browse files
willyborankinwillyborankin
committed
Bump BouncyCastle to jdk18on
Signed-off-by: Andrey Pleskach <ples@aiven.io>
1 parent d871af3 commit 8f781dd

File tree

2 files changed

+59
-65
lines changed

2 files changed

+59
-65
lines changed

‎plugin-security.policy‎

Lines changed: 5 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -55,10 +55,13 @@ grant {
5555
permission java.net.NetPermission "getNetworkInformation";
5656
permission java.net.NetPermission "getProxySelector";
5757
permission java.net.SocketPermission "*", "connect,accept,resolve";
58-
58+
59+
// BouncyCastle permissions
5960
permission java.security.SecurityPermission "putProviderProperty.BC";
6061
permission java.security.SecurityPermission "insertProvider.BC";
61-
62+
permission java.security.SecurityPermission "removeProviderProperty.BC";
63+
permission java.util.PropertyPermission "jdk.tls.rejectClientInitiatedRenegotiation", "write";
64+
6265
permission java.lang.RuntimePermission "accessUserInformation";
6366

6467
permission java.security.SecurityPermission "org.apache.xml.security.register";

‎src/main/java/org/opensearch/security/ssl/DefaultSecurityKeyStore.java‎

Lines changed: 54 additions & 63 deletions
Original file line numberDiff line numberDiff line change
@@ -17,41 +17,7 @@
1717

1818
package org.opensearch.security.ssl;
1919

20-
import java.io.ByteArrayInputStream;
21-
import java.io.File;
22-
import java.io.IOException;
23-
import java.nio.charset.StandardCharsets;
24-
import java.nio.file.Files;
25-
import java.nio.file.LinkOption;
26-
import java.nio.file.Path;
27-
import java.nio.file.Paths;
28-
import java.security.AccessController;
29-
import java.security.NoSuchAlgorithmException;
30-
import java.security.PrivateKey;
31-
import java.security.PrivilegedActionException;
32-
import java.security.PrivilegedExceptionAction;
33-
import java.security.cert.CertificateParsingException;
34-
import java.security.cert.X509Certificate;
35-
import java.util.ArrayList;
36-
import java.util.Arrays;
37-
import java.util.Collection;
38-
import java.util.Collections;
39-
import java.util.Date;
40-
import java.util.HashSet;
41-
import java.util.List;
42-
import java.util.Objects;
43-
import java.util.Set;
44-
import java.util.function.Function;
45-
import java.util.stream.Collectors;
46-
import java.util.stream.Stream;
47-
import java.util.stream.StreamSupport;
48-
49-
import javax.crypto.Cipher;
50-
import javax.net.ssl.SSLContext;
51-
import javax.net.ssl.SSLEngine;
52-
import javax.net.ssl.SSLException;
53-
import javax.net.ssl.SSLParameters;
54-
20+
import com.google.common.collect.ImmutableList;
5521
import io.netty.handler.codec.http2.Http2SecurityUtil;
5622
import io.netty.handler.ssl.ApplicationProtocolConfig;
5723
import io.netty.handler.ssl.ApplicationProtocolConfig.Protocol;
@@ -68,12 +34,12 @@
6834
import org.apache.logging.log4j.LogManager;
6935
import org.apache.logging.log4j.Logger;
7036
import org.bouncycastle.asn1.ASN1InputStream;
37+
import org.bouncycastle.asn1.ASN1Object;
7138
import org.bouncycastle.asn1.ASN1ObjectIdentifier;
7239
import org.bouncycastle.asn1.ASN1Primitive;
7340
import org.bouncycastle.asn1.ASN1Sequence;
7441
import org.bouncycastle.asn1.ASN1String;
7542
import org.bouncycastle.asn1.ASN1TaggedObject;
76-
7743
import org.opensearch.OpenSearchException;
7844
import org.opensearch.OpenSearchSecurityException;
7945
import org.opensearch.SpecialPermission;
@@ -88,6 +54,38 @@
8854
import org.opensearch.security.ssl.util.SSLConfigConstants;
8955
import org.opensearch.transport.NettyAllocator;
9056

57+
import javax.crypto.Cipher;
58+
import javax.net.ssl.SSLContext;
59+
import javax.net.ssl.SSLEngine;
60+
import javax.net.ssl.SSLException;
61+
import javax.net.ssl.SSLParameters;
62+
import java.io.File;
63+
import java.nio.charset.StandardCharsets;
64+
import java.nio.file.Files;
65+
import java.nio.file.LinkOption;
66+
import java.nio.file.Path;
67+
import java.nio.file.Paths;
68+
import java.security.AccessController;
69+
import java.security.NoSuchAlgorithmException;
70+
import java.security.PrivateKey;
71+
import java.security.PrivilegedActionException;
72+
import java.security.PrivilegedExceptionAction;
73+
import java.security.cert.CertificateParsingException;
74+
import java.security.cert.X509Certificate;
75+
import java.util.ArrayList;
76+
import java.util.Arrays;
77+
import java.util.Collection;
78+
import java.util.Collections;
79+
import java.util.Date;
80+
import java.util.HashSet;
81+
import java.util.List;
82+
import java.util.Objects;
83+
import java.util.Set;
84+
import java.util.function.Function;
85+
import java.util.stream.Collectors;
86+
import java.util.stream.Stream;
87+
import java.util.stream.StreamSupport;
88+
9189
import static org.opensearch.security.ssl.SecureSSLSettings.SSLSetting.SECURITY_SSL_HTTP_KEYSTORE_KEYPASSWORD;
9290
import static org.opensearch.security.ssl.SecureSSLSettings.SSLSetting.SECURITY_SSL_HTTP_KEYSTORE_PASSWORD;
9391
import static org.opensearch.security.ssl.SecureSSLSettings.SSLSetting.SECURITY_SSL_HTTP_PEMKEY_PASSWORD;
@@ -1171,34 +1169,27 @@ public String getSubjectAlternativeNames(X509Certificate cert) {
11711169
}
11721170

11731171
private List<String> getOtherName(List<?> altName) {
1174-
ASN1Primitive oct = null;
1175-
try {
1176-
byte[] altNameBytes = (byte[]) altName.get(1);
1177-
oct = (new ASN1InputStream(new ByteArrayInputStream(altNameBytes)).readObject());
1178-
} catch (IOException e) {
1179-
throw new RuntimeException("Could not read ASN1InputStream", e);
1180-
}
1181-
if (oct instanceof ASN1TaggedObject) {
1182-
oct = ((ASN1TaggedObject) oct).getObject();
1172+
if (altName.size() < 2) {
1173+
log.warn("Couldn't parse subject alternative names");
1174+
return null;
11831175
}
1184-
ASN1Sequence seq = ASN1Sequence.getInstance(oct);
1185-
1186-
// Get object identifier from first in sequence
1187-
ASN1ObjectIdentifier asnOID = (ASN1ObjectIdentifier) seq.getObjectAt(0);
1188-
String oid = asnOID.getId();
1189-
1190-
// Get value of object from second element
1191-
final ASN1TaggedObject obj = (ASN1TaggedObject) seq.getObjectAt(1);
1192-
// Could be tagged twice due to bug in java cert.getSubjectAltName
1193-
ASN1Primitive prim = obj.getObject();
1194-
if (prim instanceof ASN1TaggedObject) {
1195-
prim = ASN1TaggedObject.getInstance(((ASN1TaggedObject) prim)).getObject();
1196-
}
1197-
1198-
if (prim instanceof ASN1String) {
1199-
return Collections.unmodifiableList(Arrays.asList(oid, ((ASN1String) prim).getString()));
1176+
try (final ASN1InputStream in = new ASN1InputStream((byte[]) altName.get(1))) {
1177+
final ASN1Primitive asn1Primitive = in.readObject();
1178+
final ASN1Sequence sequence = ASN1Sequence.getInstance(asn1Primitive);
1179+
final ASN1ObjectIdentifier asn1ObjectIdentifier = ASN1ObjectIdentifier.getInstance(sequence.getObjectAt(0));
1180+
final ASN1TaggedObject asn1TaggedObject = ASN1TaggedObject.getInstance(sequence.getObjectAt(1));
1181+
ASN1Object maybeTaggedAsn1Primitive = asn1TaggedObject.getBaseObject();
1182+
if (maybeTaggedAsn1Primitive instanceof ASN1TaggedObject) {
1183+
maybeTaggedAsn1Primitive = ASN1TaggedObject.getInstance(maybeTaggedAsn1Primitive).getBaseObject();
1184+
}
1185+
if (maybeTaggedAsn1Primitive instanceof ASN1String) {
1186+
return ImmutableList.of(asn1ObjectIdentifier.getId(), maybeTaggedAsn1Primitive.toString());
1187+
} else {
1188+
log.warn("Couldn't parse subject alternative names");
1189+
return null;
1190+
}
1191+
} catch (final Exception ioe) { // catch all exception here since BC throws diff exceptions
1192+
throw new RuntimeException("Couldn't parse subject alternative names", ioe);
12001193
}
1201-
1202-
return null;
12031194
}
12041195
}

0 commit comments

Comments
 (0)