feat(javanet): Introduce configurable SecurityProviders and SSLSocketConfigurator for NetHttpTransport - #2167
Conversation
Sorry, something went wrong.
| tmf.init((KeyStore) null); | ||
| trustManagers = tmf.getTrustManagers(); | ||
| } catch (Exception e) { | ||
| // Ignore and fall back to default |
There was a problem hiding this comment.
Why this case can be ignored? Shall we log it at least?
Also trustManagers will be null in this. case, would it cause issues when sslContext.init is called?
Sorry, something went wrong.
There was a problem hiding this comment.
Hmm, updating this so we just propagate errors instead. If we can't initialize the custom socket configuration, it may be better to just fail fast instead of silently change to JDK (I will assume there is a reason they require a specific securityprovideR)
Sorry, something went wrong.
| TrustManagerFactory tmf = SslUtils.getDefaultTrustManagerFactory(securityProvider); | ||
| tmf.init((KeyStore) null); | ||
| trustManagers = tmf.getTrustManagers(); | ||
| } catch (Exception e) { |
There was a problem hiding this comment.
If we know what exactly the checked exceptions are, it is better to use the exact exception.
Sorry, something went wrong.
There was a problem hiding this comment.
i'm going to remove catching exceptions alltogether
Sorry, something went wrong.
| } | ||
| sslContext.init(null, trustManagers, null); | ||
| return sslContext.getSocketFactory(); | ||
| } catch (Exception e) { |
There was a problem hiding this comment.
Same comment as https://github.com/googleapis/google-http-java-client/pull/2167/changes#r3605325675. Unless it is meant to be a "catch all and fall back to default" case.
Sorry, something went wrong.
There was a problem hiding this comment.
Updated. On second thought, I don't think we should fall back to the default. I think fail-fast would make more sense here
Sorry, something went wrong.
…cketConfigurator callback Introduces SslSocketConfigurator interface and ConfigurableSSLSocketFactory wrapper. ConfigurableSSLSocketFactory wraps the active SSLSocketFactory, intercepts socket creation, and invokes the configurator callback, enabling client-level socket configuration (e.g. for Conscrypt or BouncyCastle). Includes JreNamedGroupsSslSocketConfigurator implementing reflective named groups configuration natively on JDK 20+. Removes obsolete wrapTrustManagers code and animal-sniffer dependencies from SslUtils. TAG=agy CONV=385b9ab5-874c-4c9a-b331-66dab51fef61
Adds support to configure the SSLSocket. This change allows users a method to enable Post Quantum Cryptography (PQC), but can be used for any other SSLSocket configuration. Allows a method for to configure a SecurityProvider and modify the the corresponding socket factory with the SecurityProvider.
There is no default SecurityProvider set in the http-client and Gax and Java-Core will bundle Conscrypt by default as pass it into the http-client. The Java SDK uses Conscrypt as the default SecurityProvider for PQC and will use the Conscrypt native APIs (e.g. Conscrypt.setNamedGroups) via the SslSocketConfigurator interface.
Changes: