Skip to content

Commit 21dd2b2

Browse files
iigoniniigonin
committed
Kerberos, forbiddenApis, SecureRandom, SunJCE, AzureTests
Summery: - replace unsecure kerberos crypto algorithms - add 'java.security.KeyStore' to forbidden-apis - instantiate and use SecureRandom from BCFIPS library - exclude SunJCE from security providers list at runtime, when running in FIPS JVM - exclude Azure tests when running in FIPS JVM Signed-off-by: Iwan Igonin <[email protected]>
1 parent 00ca592 commit 21dd2b2

File tree

42 files changed

+535
-251
lines changed

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

42 files changed

+535
-251
lines changed

‎buildSrc/src/main/java/org/opensearch/gradle/http/WaitForHttpResource.java

+10-4
Original file line numberDiff line numberDiff line change
@@ -32,8 +32,10 @@
3232

3333
package org.opensearch.gradle.http;
3434

35+
import org.bouncycastle.crypto.CryptoServicesRegistrar;
3536
import org.gradle.api.logging.Logger;
3637
import org.gradle.api.logging.Logging;
38+
import org.gradle.internal.impldep.com.jcraft.jsch.annotations.SuppressForbiddenApi;
3739

3840
import javax.net.ssl.HttpsURLConnection;
3941
import javax.net.ssl.KeyManager;
@@ -51,7 +53,6 @@
5153
import java.security.GeneralSecurityException;
5254
import java.security.KeyStore;
5355
import java.security.KeyStoreException;
54-
import java.security.SecureRandom;
5556
import java.security.cert.Certificate;
5657
import java.security.cert.CertificateFactory;
5758
import java.util.Arrays;
@@ -216,15 +217,15 @@ KeyStore buildTrustStore() throws GeneralSecurityException, IOException {
216217
}
217218

218219
private KeyStore buildTrustStoreFromFile() throws GeneralSecurityException, IOException {
219-
KeyStore keyStore = KeyStore.getInstance(trustStoreFile.getName().endsWith(".jks") ? "JKS" : "PKCS12");
220+
var keyStore = getKeyStoreInstance(trustStoreFile.getName().endsWith(".jks") ? "JKS" : "PKCS12");
220221
try (InputStream input = new FileInputStream(trustStoreFile)) {
221222
keyStore.load(input, trustStorePassword == null ? null : trustStorePassword.toCharArray());
222223
}
223224
return keyStore;
224225
}
225226

226227
private KeyStore buildTrustStoreFromCA() throws GeneralSecurityException, IOException {
227-
final KeyStore store = KeyStore.getInstance(KeyStore.getDefaultType());
228+
var store = getKeyStoreInstance(KeyStore.getDefaultType());
228229
store.load(null, null);
229230
final CertificateFactory certFactory = CertificateFactory.getInstance("X.509");
230231
int counter = 0;
@@ -239,12 +240,17 @@ private KeyStore buildTrustStoreFromCA() throws GeneralSecurityException, IOExce
239240
return store;
240241
}
241242

243+
@SuppressForbiddenApi("runs exclusively in test-context without KeyStoreFactory on classpath.")
244+
private KeyStore getKeyStoreInstance(String type) throws KeyStoreException {
245+
return KeyStore.getInstance(type);
246+
}
247+
242248
private SSLContext createSslContext(KeyStore trustStore) throws GeneralSecurityException {
243249
checkForTrustEntry(trustStore);
244250
TrustManagerFactory tmf = TrustManagerFactory.getInstance(TrustManagerFactory.getDefaultAlgorithm());
245251
tmf.init(trustStore);
246252
SSLContext sslContext = SSLContext.getInstance("TLSv1.2");
247-
sslContext.init(new KeyManager[0], tmf.getTrustManagers(), new SecureRandom());
253+
sslContext.init(new KeyManager[0], tmf.getTrustManagers(), CryptoServicesRegistrar.getSecureRandom());
248254
return sslContext;
249255
}
250256

‎buildSrc/src/main/java/org/opensearch/gradle/testclusters/OpenSearchNode.java

+1-1
Original file line numberDiff line numberDiff line change
@@ -548,7 +548,7 @@ public synchronized void start() {
548548

549549
logToProcessStdout("Creating opensearch keystore with password set to [" + keystorePassword + "]");
550550
if (keystorePassword.length() > 0) {
551-
runOpenSearchBinScriptWithInput(keystorePassword + "\n" + keystorePassword, "opensearch-keystore", "create", "-p");
551+
runOpenSearchBinScriptWithInput(keystorePassword + "\n" + keystorePassword + "\n", "opensearch-keystore", "create", "-p");
552552
} else {
553553
runOpenSearchBinScript("opensearch-keystore", "-v", "create");
554554
}

‎buildSrc/src/main/resources/forbidden/jdk-signatures.txt

+6
Original file line numberDiff line numberDiff line change
@@ -37,6 +37,12 @@ java.nio.file.Path#toFile()
3737
java.nio.file.Files#createTempDirectory(java.lang.String,java.nio.file.attribute.FileAttribute[])
3838
java.nio.file.Files#createTempFile(java.lang.String,java.lang.String,java.nio.file.attribute.FileAttribute[])
3939

40+
@defaultMessage Use org.opensearch.common.crypto.KeyStoreFactory instead of java.security.KeyStore
41+
java.security.KeyStore#getInstance(java.lang.String)
42+
java.security.KeyStore#getInstance(java.lang.String,java.lang.String)
43+
java.security.KeyStore#getInstance(java.lang.String,java.security.Provider)
44+
java.security.KeyStore#getInstance(java.io.File,char[])
45+
4046
@defaultMessage Don't use java serialization - this can break BWC without noticing it
4147
java.io.ObjectOutputStream
4248
java.io.ObjectOutput

‎distribution/src/config/fips_java.security

-4
Original file line numberDiff line numberDiff line change
@@ -5,10 +5,6 @@ security.provider.2=org.bouncycastle.jsse.provider.BouncyCastleJsseProvider fips
55
security.provider.3=SUN
66
security.provider.4=SunJGSS
77

8-
securerandom.source=file:/dev/urandom
9-
securerandom.strongAlgorithms=NativePRNGBlocking:SUN,DRBG:SUN
10-
securerandom.drbg.config=
11-
128
login.configuration.provider=sun.security.provider.ConfigFile
139
policy.provider=sun.security.provider.PolicyFile
1410
policy.expandProperties=true

‎distribution/tools/keystore-cli/src/test/java/org/opensearch/common/settings/KeyStoreWrapperTests.java

+9-9
Original file line numberDiff line numberDiff line change
@@ -38,7 +38,7 @@
3838
import org.apache.lucene.store.IOContext;
3939
import org.apache.lucene.store.IndexOutput;
4040
import org.apache.lucene.store.NIOFSDirectory;
41-
import org.opensearch.common.Randomness;
41+
import org.bouncycastle.crypto.CryptoServicesRegistrar;
4242
import org.opensearch.common.crypto.KeyStoreFactory;
4343
import org.opensearch.common.crypto.KeyStoreType;
4444
import org.opensearch.common.util.io.IOUtils;
@@ -205,7 +205,7 @@ public void testFailWhenCannotConsumeSecretStream() throws Exception {
205205
try (IndexOutput indexOutput = directory.createOutput("opensearch.keystore", IOContext.DEFAULT)) {
206206
CodecUtil.writeHeader(indexOutput, "opensearch.keystore", 3);
207207
indexOutput.writeByte((byte) 0); // No password
208-
SecureRandom random = Randomness.createSecure();
208+
SecureRandom random = CryptoServicesRegistrar.getSecureRandom();
209209
byte[] salt = new byte[64];
210210
random.nextBytes(salt);
211211
byte[] iv = new byte[12];
@@ -233,7 +233,7 @@ public void testFailWhenCannotConsumeEncryptedBytesStream() throws Exception {
233233
try (IndexOutput indexOutput = directory.createOutput("opensearch.keystore", IOContext.DEFAULT)) {
234234
CodecUtil.writeHeader(indexOutput, "opensearch.keystore", 3);
235235
indexOutput.writeByte((byte) 0); // No password
236-
SecureRandom random = Randomness.createSecure();
236+
SecureRandom random = CryptoServicesRegistrar.getSecureRandom();
237237
byte[] salt = new byte[64];
238238
random.nextBytes(salt);
239239
byte[] iv = new byte[12];
@@ -262,7 +262,7 @@ public void testFailWhenSecretStreamNotConsumed() throws Exception {
262262
try (IndexOutput indexOutput = directory.createOutput("opensearch.keystore", IOContext.DEFAULT)) {
263263
CodecUtil.writeHeader(indexOutput, "opensearch.keystore", 3);
264264
indexOutput.writeByte((byte) 0); // No password
265-
SecureRandom random = Randomness.createSecure();
265+
SecureRandom random = CryptoServicesRegistrar.getSecureRandom();
266266
byte[] salt = new byte[64];
267267
random.nextBytes(salt);
268268
byte[] iv = new byte[12];
@@ -289,7 +289,7 @@ public void testFailWhenEncryptedBytesStreamIsNotConsumed() throws Exception {
289289
try (IndexOutput indexOutput = directory.createOutput("opensearch.keystore", IOContext.DEFAULT)) {
290290
CodecUtil.writeHeader(indexOutput, "opensearch.keystore", 3);
291291
indexOutput.writeByte((byte) 0); // No password
292-
SecureRandom random = Randomness.createSecure();
292+
SecureRandom random = CryptoServicesRegistrar.getSecureRandom();
293293
byte[] salt = new byte[64];
294294
random.nextBytes(salt);
295295
byte[] iv = new byte[12];
@@ -372,15 +372,15 @@ public void testIllegalSettingName() throws Exception {
372372
public void testFailLoadV1KeystoresInFipsJvm() throws Exception {
373373
assumeTrue("Test in FIPS JVM", inFipsJvm());
374374

375-
Exception e = assertThrows(SecurityException.class, () -> generateV1());
376-
assertThat(e.getMessage(), containsString("Only PKCS_11, BCFKS keystores are allowed in FIPS JVM"));
375+
Exception e = assertThrows(NoSuchProviderException.class, this::generateV1);
376+
assertThat(e.getMessage(), containsString("no such provider: SunJCE"));
377377
}
378378

379379
public void testFailLoadV2KeystoresInFipsJvm() throws Exception {
380380
assumeTrue("Test in FIPS JVM", inFipsJvm());
381381

382-
Exception e = assertThrows(SecurityException.class, () -> generateV2());
383-
assertThat(e.getMessage(), containsString("Only PKCS_11, BCFKS keystores are allowed in FIPS JVM"));
382+
Exception e = assertThrows(NoSuchProviderException.class, this::generateV2);
383+
assertThat(e.getMessage(), containsString("no such provider: SunJCE"));
384384
}
385385

386386
public void testBackcompatV1() throws Exception {

‎libs/common/build.gradle

+6
Original file line numberDiff line numberDiff line change
@@ -20,8 +20,10 @@ base {
2020
dependencies {
2121
// This dependency is used only by :libs:core for null-checking interop with other tools
2222
compileOnly "com.google.code.findbugs:jsr305:3.0.2"
23+
2324
compileOnly "org.bouncycastle:bc-fips:${versions.bouncycastle_jce}"
2425
compileOnly "org.bouncycastle:bcutil-fips:${versions.bouncycastle_util}"
26+
api "org.bouncycastle:bcpkix-fips:${versions.bouncycastle_pkix}"
2527

2628
/*******
2729
* !!!! NO THIRD PARTY DEPENDENCIES !!!!
@@ -46,6 +48,10 @@ tasks.named('forbiddenApisMain').configure {
4648
replaceSignatureFiles 'jdk-signatures'
4749
}
4850

51+
tasks.named("dependencyLicenses").configure {
52+
mapping from: /bc.*/, to: 'bouncycastle'
53+
}
54+
4955
// Add support for incubator modules on supported Java versions.
5056
if (BuildParams.runtimeJavaVersion >= JavaVersion.VERSION_20) {
5157
sourceSets {

‎libs/common/licenses/bcpkix-fips-2.0.7.jar.sha1

+1
Original file line numberDiff line numberDiff line change
@@ -0,0 +1 @@
1+
01eea0f325315ca6295b0a6926ff862d8001cdf9

‎libs/common/licenses/bouncycastle-LICENSE.txt

+14
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,14 @@
1+
Copyright (c) 2000 - 2023 The Legion of the Bouncy Castle Inc. (https://www.bouncycastle.org)
2+
3+
Permission is hereby granted, free of charge, to any person obtaining a copy of this software and associated
4+
documentation files (the "Software"), to deal in the Software without restriction, including without limitation
5+
the rights to use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies of the Software,
6+
and to permit persons to whom the Software is furnished to do so, subject to the following conditions:
7+
8+
The above copyright notice and this permission notice shall be included in all copies or substantial portions of the
9+
Software.
10+
11+
THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE
12+
WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR
13+
COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR
14+
OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.

‎libs/common/licenses/bouncycastle-NOTICE.txt

+1
Original file line numberDiff line numberDiff line change
@@ -0,0 +1 @@
1+

‎libs/common/src/main/java/org/opensearch/common/SecureRandomHolder.java

+3-1
Original file line numberDiff line numberDiff line change
@@ -32,6 +32,8 @@
3232

3333
package org.opensearch.common;
3434

35+
import org.bouncycastle.crypto.CryptoServicesRegistrar;
36+
3537
import java.security.SecureRandom;
3638

3739
/**
@@ -41,5 +43,5 @@
4143
*/
4244
class SecureRandomHolder {
4345
// class loading is atomic - this is a lazy & safe singleton to be used by this package
44-
public static final SecureRandom INSTANCE = new SecureRandom();
46+
public static final SecureRandom INSTANCE = CryptoServicesRegistrar.getSecureRandom();
4547
}

‎libs/common/src/main/java/org/opensearch/common/crypto/KeyStoreFactory.java

+5
Original file line numberDiff line numberDiff line change
@@ -9,6 +9,7 @@
99
package org.opensearch.common.crypto;
1010

1111
import org.bouncycastle.crypto.CryptoServicesRegistrar;
12+
import org.opensearch.common.SuppressForbidden;
1213

1314
import java.security.KeyStore;
1415
import java.security.KeyStoreException;
@@ -55,7 +56,11 @@ public static KeyStore getInstance(KeyStoreType type, String provider) {
5556
}
5657
provider = FIPS_PROVIDER;
5758
}
59+
return get(type, provider);
60+
}
5861

62+
@SuppressForbidden(reason = "centralized instantiation of a KeyStore")
63+
private static KeyStore get(KeyStoreType type, String provider) {
5964
try {
6065
if (provider == null) {
6166
return KeyStore.getInstance(type.getJcaName());

‎modules/transport-netty4/build.gradle

-11
Original file line numberDiff line numberDiff line change
@@ -147,17 +147,6 @@ thirdPartyAudit {
147147
'io.netty.internal.tcnative.SSLContext',
148148
'io.netty.internal.tcnative.SSLPrivateKeyMethod',
149149

150-
// from io.netty.handler.ssl.util.BouncyCastleSelfSignedCertGenerator (netty)
151-
'org.bouncycastle.cert.X509v3CertificateBuilder',
152-
'org.bouncycastle.cert.jcajce.JcaX509CertificateConverter',
153-
'org.bouncycastle.operator.jcajce.JcaContentSignerBuilder',
154-
'org.bouncycastle.openssl.PEMEncryptedKeyPair',
155-
'org.bouncycastle.openssl.PEMParser',
156-
'org.bouncycastle.openssl.jcajce.JcaPEMKeyConverter',
157-
'org.bouncycastle.openssl.jcajce.JceOpenSSLPKCS8DecryptorProviderBuilder',
158-
'org.bouncycastle.openssl.jcajce.JcePEMDecryptorProviderBuilder',
159-
'org.bouncycastle.pkcs.PKCS8EncryptedPrivateKeyInfo',
160-
161150
// from io.netty.handler.ssl.JettyNpnSslEngine (netty)
162151
'org.eclipse.jetty.npn.NextProtoNego$ClientProvider',
163152
'org.eclipse.jetty.npn.NextProtoNego$ServerProvider',

‎plugins/analysis-icu/src/test/java/org/opensearch/index/analysis/IcuAnalyzerTests.java

+5
Original file line numberDiff line numberDiff line change
@@ -35,6 +35,7 @@
3535
import org.apache.lucene.analysis.Analyzer;
3636
import org.apache.lucene.tests.analysis.BaseTokenStreamTestCase;
3737
import org.opensearch.Version;
38+
import org.opensearch.bootstrap.SecureRandomInitializer;
3839
import org.opensearch.cluster.metadata.IndexMetadata;
3940
import org.opensearch.common.settings.Settings;
4041
import org.opensearch.index.IndexSettings;
@@ -47,6 +48,10 @@
4748

4849
public class IcuAnalyzerTests extends BaseTokenStreamTestCase {
4950

51+
static {
52+
SecureRandomInitializer.init();
53+
}
54+
5055
public void testMixedAlphabetTokenization() throws IOException {
5156

5257
Settings settings = Settings.builder().put(IndexMetadata.SETTING_VERSION_CREATED, Version.CURRENT).build();

‎plugins/repository-azure/build.gradle

+4-7
Original file line numberDiff line numberDiff line change
@@ -214,13 +214,6 @@ thirdPartyAudit {
214214
// Worth nothing that, the latest dependency "net.shibboleth.utilities:java-support:8.0.0" has many vulnerabilities.
215215
// Hence ignored.
216216
'net.shibboleth.utilities.java.support.xml.SerializeSupport',
217-
'org.bouncycastle.cert.X509CertificateHolder',
218-
'org.bouncycastle.cert.jcajce.JcaX509CertificateHolder',
219-
'org.bouncycastle.cert.jcajce.JcaX509v3CertificateBuilder',
220-
'org.bouncycastle.openssl.PEMKeyPair',
221-
'org.bouncycastle.openssl.PEMParser',
222-
'org.bouncycastle.openssl.jcajce.JcaPEMKeyConverter',
223-
'org.bouncycastle.operator.jcajce.JcaContentSignerBuilder',
224217
'org.cryptomator.siv.SivMode',
225218
'org.opensaml.core.config.InitializationException',
226219
'org.opensaml.core.config.InitializationService',
@@ -311,6 +304,10 @@ Map<String, Object> expansions = [
311304
'base_path': azureBasePath + "_integration_tests"
312305
]
313306

307+
tasks.withType(Test).configureEach {
308+
onlyIf { BuildParams.inFipsJvm == false }
309+
}
310+
314311
processYamlRestTestResources {
315312
inputs.properties(expansions)
316313
MavenFilteringHack.filter(it, expansions)

‎plugins/repository-s3/build.gradle

-11
Original file line numberDiff line numberDiff line change
@@ -486,17 +486,6 @@ thirdPartyAudit {
486486
'net.jpountz.xxhash.XXHash32',
487487
'net.jpountz.xxhash.XXHashFactory',
488488
489-
// from io.netty.handler.ssl.util.BouncyCastleSelfSignedCertGenerator (netty)
490-
'org.bouncycastle.cert.X509v3CertificateBuilder',
491-
'org.bouncycastle.cert.jcajce.JcaX509CertificateConverter',
492-
'org.bouncycastle.operator.jcajce.JcaContentSignerBuilder',
493-
'org.bouncycastle.openssl.PEMEncryptedKeyPair',
494-
'org.bouncycastle.openssl.PEMParser',
495-
'org.bouncycastle.openssl.jcajce.JcaPEMKeyConverter',
496-
'org.bouncycastle.openssl.jcajce.JceOpenSSLPKCS8DecryptorProviderBuilder',
497-
'org.bouncycastle.openssl.jcajce.JcePEMDecryptorProviderBuilder',
498-
'org.bouncycastle.pkcs.PKCS8EncryptedPrivateKeyInfo',
499-
500489
'org.conscrypt.AllocatedBuffer',
501490
'org.conscrypt.BufferAllocator',
502491
'org.conscrypt.Conscrypt',

‎plugins/repository-s3/src/internalClusterTest/java/org/opensearch/repositories/s3/S3BlobStoreRepositoryTests.java

+1-1
Original file line numberDiff line numberDiff line change
@@ -143,7 +143,7 @@ protected HttpHandler createErroneousHttpHandler(final HttpHandler delegate) {
143143
protected Settings nodeSettings(int nodeOrdinal) {
144144
final MockSecureSettings secureSettings = new MockSecureSettings();
145145
secureSettings.setString(S3ClientSettings.ACCESS_KEY_SETTING.getConcreteSettingForNamespace("test").getKey(), "access");
146-
secureSettings.setString(S3ClientSettings.SECRET_KEY_SETTING.getConcreteSettingForNamespace("test").getKey(), "secret");
146+
secureSettings.setString(S3ClientSettings.SECRET_KEY_SETTING.getConcreteSettingForNamespace("test").getKey(), "secret_password");
147147

148148
final Settings.Builder builder = Settings.builder()
149149
.put(ThreadPool.ESTIMATED_TIME_INTERVAL_SETTING.getKey(), 0) // We have tests that verify an exact wait time

‎plugins/repository-s3/src/main/java/org/opensearch/repositories/s3/S3Service.java

+3-2
Original file line numberDiff line numberDiff line change
@@ -64,6 +64,7 @@
6464
import org.apache.http.protocol.HttpContext;
6565
import org.apache.logging.log4j.LogManager;
6666
import org.apache.logging.log4j.Logger;
67+
import org.bouncycastle.crypto.CryptoServicesRegistrar;
6768
import org.opensearch.cluster.metadata.RepositoryMetadata;
6869
import org.opensearch.common.Nullable;
6970
import org.opensearch.common.SuppressForbidden;
@@ -88,7 +89,6 @@
8889
import java.nio.file.Path;
8990
import java.security.KeyManagementException;
9091
import java.security.NoSuchAlgorithmException;
91-
import java.security.SecureRandom;
9292
import java.time.Duration;
9393
import java.util.Map;
9494
import java.util.concurrent.ConcurrentHashMap;
@@ -341,7 +341,8 @@ private static SSLConnectionSocketFactory createSocksSslConnectionSocketFactory(
341341
// This part was taken from AWS settings
342342
try {
343343
final SSLContext sslCtx = SSLContext.getInstance("TLS");
344-
sslCtx.init(SystemPropertyTlsKeyManagersProvider.create().keyManagers(), null, new SecureRandom());
344+
sslCtx.init(SystemPropertyTlsKeyManagersProvider.create().keyManagers(), null, CryptoServicesRegistrar.getSecureRandom());
345+
345346
return new SdkTlsSocketFactory(sslCtx, new DefaultHostnameVerifier()) {
346347
@Override
347348
public Socket createSocket(final HttpContext ctx) throws IOException {

‎plugins/repository-s3/src/test/java/org/opensearch/repositories/s3/S3BlobContainerRetriesTests.java

+4-1
Original file line numberDiff line numberDiff line change
@@ -222,7 +222,10 @@ protected AsyncMultiStreamBlobContainer createBlobContainer(
222222

223223
final MockSecureSettings secureSettings = new MockSecureSettings();
224224
secureSettings.setString(S3ClientSettings.ACCESS_KEY_SETTING.getConcreteSettingForNamespace(clientName).getKey(), "access");
225-
secureSettings.setString(S3ClientSettings.SECRET_KEY_SETTING.getConcreteSettingForNamespace(clientName).getKey(), "secret");
225+
secureSettings.setString(
226+
S3ClientSettings.SECRET_KEY_SETTING.getConcreteSettingForNamespace(clientName).getKey(),
227+
"secret_password"
228+
);
226229
clientSettings.setSecureSettings(secureSettings);
227230
service.refreshAndClearCache(S3ClientSettings.load(clientSettings.build(), configPath()));
228231
asyncService.refreshAndClearCache(S3ClientSettings.load(clientSettings.build(), configPath()));

‎plugins/transport-nio/build.gradle

-11
Original file line numberDiff line numberDiff line change
@@ -74,17 +74,6 @@ thirdPartyAudit {
7474
'org.apache.log4j.Level',
7575
'org.apache.log4j.Logger',
7676

77-
// from io.netty.handler.ssl.util.BouncyCastleSelfSignedCertGenerator (netty)
78-
'org.bouncycastle.cert.X509v3CertificateBuilder',
79-
'org.bouncycastle.cert.jcajce.JcaX509CertificateConverter',
80-
'org.bouncycastle.operator.jcajce.JcaContentSignerBuilder',
81-
'org.bouncycastle.openssl.PEMEncryptedKeyPair',
82-
'org.bouncycastle.openssl.PEMParser',
83-
'org.bouncycastle.openssl.jcajce.JcaPEMKeyConverter',
84-
'org.bouncycastle.openssl.jcajce.JceOpenSSLPKCS8DecryptorProviderBuilder',
85-
'org.bouncycastle.openssl.jcajce.JcePEMDecryptorProviderBuilder',
86-
'org.bouncycastle.pkcs.PKCS8EncryptedPrivateKeyInfo',
87-
8877
// from io.netty.handler.ssl.JettyNpnSslEngine (netty)
8978
'org.eclipse.jetty.npn.NextProtoNego$ClientProvider',
9079
'org.eclipse.jetty.npn.NextProtoNego$ServerProvider',

0 commit comments

Comments
 (0)