You are viewing a plain text version of this content. The canonical link for it is here.
Posted to issues@flink.apache.org by "balassai (via GitHub)" <gi...@apache.org> on 2026/02/03 16:11:41 UTC
[PR] [FLINK-39022][core] Set security.ssl.algorithms default value to modern cipher suite [flink]
balassai opened a new pull request, #27514:
URL: https://github.com/apache/flink/pull/27514
## What is the purpose of the change
This change updates the security.ssl.algoritms default value to **TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384**
https://bugs.openjdk.org/browse/JDK-8245545 disables the TLS_RSA ciphers. Newer JDK versions won't support the _TLS_RSA_WITH_AES_128_CBC_SHA_ which was the previous default value.
## Brief change log
- SecurityOptions.SSL_ALGORITHM default value is updated
- Documentation updated
## Verifying this change
- A default value check has been introduced in SecurityOptionsTest
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: issues-unsubscribe@flink.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] [FLINK-39022][security] Set security.ssl.algorithms default value to modern cipher suite [flink]
Posted by "balassai (via GitHub)" <gi...@apache.org>.
balassai commented on code in PR #27514:
URL: https://github.com/apache/flink/pull/27514#discussion_r2766458009
##########
docs/content/release-notes/flink-1.20.md:
##########
@@ -431,3 +431,17 @@ The following option has been moved from `org.apache.flink.table.planner.plan.ru
to `org.apache.flink.table.api.config.OptimizerConfigOptions` and promoted to `@PublicEvolving`
- `table.optimizer.incremental-agg-enabled`
+
Review Comment:
Got it, created release 2.3 file.
##########
flink-core/src/main/java/org/apache/flink/configuration/SecurityOptions.java:
##########
Review Comment:
Thanks, updated.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: issues-unsubscribe@flink.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] [FLINK-39022][security] Set security.ssl.algorithms default value to modern cipher suite [flink]
Posted by "davidradl (via GitHub)" <gi...@apache.org>.
davidradl commented on code in PR #27514:
URL: https://github.com/apache/flink/pull/27514#discussion_r2769273027
##########
docs/content.zh/docs/deployment/security/security-ssl.md:
##########
@@ -150,20 +150,15 @@ security.ssl.rest.authentication-enabled: false
### Cipher suites
-{{< hint warning >}}
-The [IETF RFC 7525](https://tools.ietf.org/html/rfc7525) recommends to use a specific set of cipher suites for strong security.
-Because these cipher suites were not available on many setups out of the box, Flink's default value is set to a slightly
-weaker but more compatible cipher suite.
-We recommend that SSL setups update to the stronger cipher suites, if possible, by adding the below entry to the Flink configuration:
+For strong security, it is crucial to use modern and robust cipher suites. [IETF RFC 9325](https://www.rfc-editor.org/info/rfc9325), which supersedes the older RFC 7525, provides current recommendations for the secure use of TLS.
+In response to evolving security standards and to ensure compatibility with modern Java versions, Flink has updated its default cipher suites. Recent JDK updates (affecting versions like 11.0.30+, 17.0.18+, etc.) have disabled older `TLS_RSA_*` cipher suites that lack forward secrecy.
-```yaml
-security.ssl.algorithms: TLS_DHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_DHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384
-```
+To support these secure-by-default JDK versions and align with best practices, Flink's default value for `security.ssl.algorithms` is now:
-If these cipher suites are not supported on your setup, you will see that Flink processes will not be able to connect to each other.
Review Comment:
is it safe to remove this line. Can we have a locked down setup with a reduced set of algorithms - that this warning could still be valid for?
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: issues-unsubscribe@flink.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] [FLINK-39022][security] Set security.ssl.algorithms default value to modern cipher suite [flink]
Posted by "gaborgsomogyi (via GitHub)" <gi...@apache.org>.
gaborgsomogyi commented on code in PR #27514:
URL: https://github.com/apache/flink/pull/27514#discussion_r2769469504
##########
docs/content.zh/docs/deployment/security/security-ssl.md:
##########
@@ -150,20 +150,15 @@ security.ssl.rest.authentication-enabled: false
### Cipher suites
-{{< hint warning >}}
-The [IETF RFC 7525](https://tools.ietf.org/html/rfc7525) recommends to use a specific set of cipher suites for strong security.
-Because these cipher suites were not available on many setups out of the box, Flink's default value is set to a slightly
-weaker but more compatible cipher suite.
-We recommend that SSL setups update to the stronger cipher suites, if possible, by adding the below entry to the Flink configuration:
+For strong security, it is crucial to use modern and robust cipher suites. [IETF RFC 9325](https://www.rfc-editor.org/info/rfc9325), which supersedes the older RFC 7525, provides current recommendations for the secure use of TLS.
+In response to evolving security standards and to ensure compatibility with modern Java versions, Flink has updated its default cipher suites. Recent JDK updates (affecting versions like 11.0.30+, 17.0.18+, etc.) have disabled older `TLS_RSA_*` cipher suites that lack forward secrecy.
-```yaml
-security.ssl.algorithms: TLS_DHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_DHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384
-```
+To support these secure-by-default JDK versions and align with best practices, Flink's default value for `security.ssl.algorithms` is now:
-If these cipher suites are not supported on your setup, you will see that Flink processes will not be able to connect to each other.
Review Comment:
+1 on this, we should keep this mitigation for users.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: issues-unsubscribe@flink.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] [FLINK-39022][security] Set security.ssl.algorithms default value to modern cipher suite [flink]
Posted by "gaborgsomogyi (via GitHub)" <gi...@apache.org>.
gaborgsomogyi commented on code in PR #27514:
URL: https://github.com/apache/flink/pull/27514#discussion_r2769713423
##########
flink-core/src/main/java/org/apache/flink/configuration/SecurityOptions.java:
##########
@@ -498,19 +498,20 @@ public static Configuration forProvider(Configuration configuration, String prov
* The standard SSL algorithms to be supported.
*
* <p>More options here -
- * http://docs.oracle.com/javase/8/docs/technotes/guides/security/StandardNames.html#ciphersuites
+ * https://docs.oracle.com/en/java/javase/17/docs/specs/security/standard-names.html
*/
@Documentation.Section(Documentation.Sections.SECURITY_SSL)
public static final ConfigOption<String> SSL_ALGORITHMS =
key("security.ssl.algorithms")
.stringType()
- .defaultValue("TLS_RSA_WITH_AES_128_CBC_SHA")
+ .defaultValue(
+ "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384")
Review Comment:
Adding such warnig is fair point but I don't understand how do you plan to do that phisically. The latest RFC suggests 4 suites. If the user add stronger/weaker than the suggested then how do you decide from Flink code whether we should give a warning or not? If you can highlight the logic then I would buy that.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: issues-unsubscribe@flink.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] [FLINK-39022][security] Set security.ssl.algorithms default value to modern cipher suite [flink]
Posted by "davidradl (via GitHub)" <gi...@apache.org>.
davidradl commented on code in PR #27514:
URL: https://github.com/apache/flink/pull/27514#discussion_r2781612131
##########
flink-core/src/main/java/org/apache/flink/configuration/SecurityOptions.java:
##########
@@ -498,19 +498,20 @@ public static Configuration forProvider(Configuration configuration, String prov
* The standard SSL algorithms to be supported.
*
* <p>More options here -
- * http://docs.oracle.com/javase/8/docs/technotes/guides/security/StandardNames.html#ciphersuites
+ * https://docs.oracle.com/en/java/javase/17/docs/specs/security/standard-names.html
*/
@Documentation.Section(Documentation.Sections.SECURITY_SSL)
public static final ConfigOption<String> SSL_ALGORITHMS =
key("security.ssl.algorithms")
.stringType()
- .defaultValue("TLS_RSA_WITH_AES_128_CBC_SHA")
+ .defaultValue(
+ "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384")
Review Comment:
we could add a warning if it did not match the RFC cyphers I guess. But I do not think this adds enough value. Let's leave as is.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: issues-unsubscribe@flink.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] [FLINK-39022][security] Set security.ssl.algorithms default value to modern cipher suite [flink]
Posted by "gaborgsomogyi (via GitHub)" <gi...@apache.org>.
gaborgsomogyi commented on PR #27514:
URL: https://github.com/apache/flink/pull/27514#issuecomment-3885232103
@balassai while we're waiting for test results can you plz take a look at this? https://github.com/apache/flink/pull/27503#issuecomment-3860079666
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: issues-unsubscribe@flink.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] [FLINK-39022][security] Set security.ssl.algorithms default value to modern cipher suite [flink]
Posted by "gaborgsomogyi (via GitHub)" <gi...@apache.org>.
gaborgsomogyi commented on code in PR #27514:
URL: https://github.com/apache/flink/pull/27514#discussion_r2769574982
##########
flink-runtime/src/test/java/org/apache/flink/runtime/net/SSLUtilsTest.java:
##########
@@ -392,22 +392,10 @@ void testSetSSLVersionAndCipherSuitesForSSLServerSocket(String sslProvider) thro
@MethodSource("parameters")
void testCreateSSLEngineFactory(String sslProvider) throws Exception {
Configuration serverConfig = createInternalSslConfigWithKeyAndTrustStores(sslProvider);
- final String[] sslAlgorithms;
- final String[] expectedSslProtocols;
- if (sslProvider.equalsIgnoreCase("OPENSSL")) {
- // openSSL does not support the same set of cipher algorithms!
Review Comment:
Is this deletion means that openssl supports the mentioned 2 cipher suites?
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: issues-unsubscribe@flink.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] [FLINK-39022][security] Set security.ssl.algorithms default value to modern cipher suite [flink]
Posted by "gaborgsomogyi (via GitHub)" <gi...@apache.org>.
gaborgsomogyi commented on code in PR #27514:
URL: https://github.com/apache/flink/pull/27514#discussion_r2769443722
##########
flink-core/src/main/java/org/apache/flink/configuration/SecurityOptions.java:
##########
@@ -498,19 +498,20 @@ public static Configuration forProvider(Configuration configuration, String prov
* The standard SSL algorithms to be supported.
*
* <p>More options here -
- * http://docs.oracle.com/javase/8/docs/technotes/guides/security/StandardNames.html#ciphersuites
+ * https://docs.oracle.com/en/java/javase/17/docs/specs/security/standard-names.html
*/
@Documentation.Section(Documentation.Sections.SECURITY_SSL)
public static final ConfigOption<String> SSL_ALGORITHMS =
key("security.ssl.algorithms")
.stringType()
- .defaultValue("TLS_RSA_WITH_AES_128_CBC_SHA")
+ .defaultValue(
+ "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384")
.withDescription(
Description.builder()
.text(
"The comma separated list of standard SSL algorithms to be supported. Read more %s",
link(
- "http://docs.oracle.com/javase/8/docs/technotes/guides/security/StandardNames.html#ciphersuites",
+ "https://docs.oracle.com/en/java/javase/17/docs/specs/security/standard-names.html",
Review Comment:
I would vote on java 11 because that's the minimal supported flink version. The default cipher is always the lowest/available but secure enough so don't see reason to extend it. Any user can uprade freewillingly by changing it.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: issues-unsubscribe@flink.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] [FLINK-39022][security] Set security.ssl.algorithms default value to modern cipher suite [flink]
Posted by "balassai (via GitHub)" <gi...@apache.org>.
balassai commented on code in PR #27514:
URL: https://github.com/apache/flink/pull/27514#discussion_r2771358818
##########
flink-runtime/src/test/java/org/apache/flink/runtime/net/SSLUtilsTest.java:
##########
@@ -523,11 +511,6 @@ public static String getRestCertificateFingerprint(
private static void addSslProviderConfig(Configuration config, String sslProvider) {
if (sslProvider.equalsIgnoreCase("OPENSSL")) {
OpenSsl.ensureAvailability();
-
- // Flink's default algorithm set is not available for openSSL - choose a different one:
Review Comment:
TLSv1.2 is the default for security.ssl.protocol it and TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384 is the default of the new default security.ssl algorithm it is safe to remove here.
https://docs.openssl.org/1.0.2/man1/ciphers/#tls-v12-cipher-suites
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: issues-unsubscribe@flink.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] [FLINK-39022][security] Set security.ssl.algorithms default value to modern cipher suite [flink]
Posted by "gaborgsomogyi (via GitHub)" <gi...@apache.org>.
gaborgsomogyi commented on PR #27514:
URL: https://github.com/apache/flink/pull/27514#issuecomment-3944648326
@flinkbot run azure
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: issues-unsubscribe@flink.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] [FLINK-39022][security] Set security.ssl.algorithms default value to modern cipher suite [flink]
Posted by "balassai (via GitHub)" <gi...@apache.org>.
balassai commented on code in PR #27514:
URL: https://github.com/apache/flink/pull/27514#discussion_r2766458737
##########
flink-core/src/main/java/org/apache/flink/configuration/SecurityOptions.java:
##########
Review Comment:
Same, updated.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: issues-unsubscribe@flink.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] [FLINK-39022][security] Set security.ssl.algorithms default value to modern cipher suite [flink]
Posted by "swapna267 (via GitHub)" <gi...@apache.org>.
swapna267 commented on code in PR #27514:
URL: https://github.com/apache/flink/pull/27514#discussion_r2765147379
##########
flink-core/src/main/java/org/apache/flink/configuration/SecurityOptions.java:
##########
Review Comment:
Doc is pointing to java8. Please update.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: issues-unsubscribe@flink.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] [FLINK-39022][security] Set security.ssl.algorithms default value to modern cipher suite [flink]
Posted by "swapna267 (via GitHub)" <gi...@apache.org>.
swapna267 commented on code in PR #27514:
URL: https://github.com/apache/flink/pull/27514#discussion_r2765149517
##########
flink-core/src/main/java/org/apache/flink/configuration/SecurityOptions.java:
##########
Review Comment:
Same. Doc is pointing to java8.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: issues-unsubscribe@flink.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] [FLINK-39022][security] Set security.ssl.algorithms default value to modern cipher suite [flink]
Posted by "gaborgsomogyi (via GitHub)" <gi...@apache.org>.
gaborgsomogyi commented on code in PR #27514:
URL: https://github.com/apache/flink/pull/27514#discussion_r2769525238
##########
docs/content/release-notes/flink-2.3.md:
##########
@@ -0,0 +1,44 @@
+---
+title: "Release Notes - Flink 2.3"
+---
+
+<!--
+Licensed to the Apache Software Foundation (ASF) under one
+or more contributor license agreements. See the NOTICE file
+distributed with this work for additional information
+regarding copyright ownership. The ASF licenses this file
+to you under the Apache License, Version 2.0 (the
+"License"); you may not use this file except in compliance
+with the License. You may obtain a copy of the License at
+
+ http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing,
+software distributed under the License is distributed on an
+"AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+KIND, either express or implied. See the License for the
+specific language governing permissions and limitations
+under the License.
+-->
+
+# Release notes - Flink 2.3
+
+These release notes discuss important aspects, such as configuration, behavior or dependencies,
+that changed between Flink 2.2 and Flink 2.3. Please read these notes carefully if you are
+planning to upgrade your Flink version to 2.3.
+
+
+### Core
+
+#### Set security.ssl.algorithms default value to modern cipher suite
+
+### [FLINK-39022](https://issues.apache.org/jira/browse/FLINK-39022)
+
+A JDK update (affecting JDK 11.0.30+, 17.0.18+, 21.0.10+, and 24+) disabled `TLS_RSA_*` cipher suites.
+This was done to support forward-secrecy (RFC 9325) and comply with the IETF Draft on *Deprecating Obsolete Key Exchange Methods in TLS*.
+
+To support these and future JDK versions, the default value for the Flink configuration option `security.ssl.algorithms` has been changed to a modern, widely available cipher suite:
+
+`TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384`
+
+
Review Comment:
There is a part of the official doc which is going to tell users the failure symptoms and mitigations (channing ciper suites) which should come here after the suggested reprasing: https://github.com/apache/flink/pull/27514/changes#r2769482689
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: issues-unsubscribe@flink.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] [FLINK-39022][security] Set security.ssl.algorithms default value to modern cipher suite [flink]
Posted by "balassai (via GitHub)" <gi...@apache.org>.
balassai commented on code in PR #27514:
URL: https://github.com/apache/flink/pull/27514#discussion_r2771358818
##########
flink-runtime/src/test/java/org/apache/flink/runtime/net/SSLUtilsTest.java:
##########
@@ -523,11 +511,6 @@ public static String getRestCertificateFingerprint(
private static void addSslProviderConfig(Configuration config, String sslProvider) {
if (sslProvider.equalsIgnoreCase("OPENSSL")) {
OpenSsl.ensureAvailability();
-
- // Flink's default algorithm set is not available for openSSL - choose a different one:
Review Comment:
TLSv1.2 is the default for security.ssl.protocol it and TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384 is the new default value of security.ssl algorithm, therefore it is safe to remove here.
https://docs.openssl.org/1.0.2/man1/ciphers/#tls-v12-cipher-suites
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: issues-unsubscribe@flink.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] [FLINK-39022][security] Set security.ssl.algorithms default value to modern cipher suite [flink]
Posted by "gaborgsomogyi (via GitHub)" <gi...@apache.org>.
gaborgsomogyi commented on PR #27514:
URL: https://github.com/apache/flink/pull/27514#issuecomment-3935888668
@balassai could you plz do a commit SHA change to trigger the CI?
```
git commit --amend
git push -f
```
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: issues-unsubscribe@flink.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] [FLINK-39022][core] Set security.ssl.algorithms default value to modern cipher suite [flink]
Posted by "flinkbot (via GitHub)" <gi...@apache.org>.
flinkbot commented on PR #27514:
URL: https://github.com/apache/flink/pull/27514#issuecomment-3842313807
<!--
Meta data
{
"version" : 1,
"metaDataEntries" : [ {
"hash" : "c31c5d3bb80f5e5bc9fb5e09c6a2c5d527b282c6",
"status" : "UNKNOWN",
"url" : "TBD",
"triggerID" : "c31c5d3bb80f5e5bc9fb5e09c6a2c5d527b282c6",
"triggerType" : "PUSH"
} ]
}-->
## CI report:
* c31c5d3bb80f5e5bc9fb5e09c6a2c5d527b282c6 UNKNOWN
<details>
<summary>Bot commands</summary>
The @flinkbot bot supports the following commands:
- `@flinkbot run azure` re-run the last Azure build
</details>
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: issues-unsubscribe@flink.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] [FLINK-39022][core] Set security.ssl.algorithms default value to modern cipher suite [flink]
Posted by "gaborgsomogyi (via GitHub)" <gi...@apache.org>.
gaborgsomogyi commented on PR #27514:
URL: https://github.com/apache/flink/pull/27514#issuecomment-3842533235
Since this change is on critical path we need a better explanation as description:
* What is the exact change becase of the JDK changes
* How that manifests in existing workloads
* Mitigations if there are any
* Changes made here (I think this covered)
* Justification (why these)
* Migration paths with edge cases (what will work and what won't)
I understand this is a lot but I'm 100% sure that this change is going to generate huge interest/impact.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: issues-unsubscribe@flink.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] [FLINK-39022][core] Set security.ssl.algorithms default value to modern cipher suite [flink]
Posted by "gaborgsomogyi (via GitHub)" <gi...@apache.org>.
gaborgsomogyi commented on PR #27514:
URL: https://github.com/apache/flink/pull/27514#issuecomment-3842466042
Thanks for the contribution. Without too deep consideration I miss 2 things:
* Doc update
* Release note which explains the change to users
Maybe there are other implications but we must be extra careful because we touch quite a sensitive part of Flink.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: issues-unsubscribe@flink.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] [FLINK-39022][security] Set security.ssl.algorithms default value to modern cipher suite [flink]
Posted by "swapna267 (via GitHub)" <gi...@apache.org>.
swapna267 commented on PR #27514:
URL: https://github.com/apache/flink/pull/27514#issuecomment-3848813540
Should we also make the tests we fixed before to actually point to default SSL algorithms for Flink-2.3, so we can catch any changes similar to this in the future ?
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: issues-unsubscribe@flink.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] [FLINK-39022][security] Set security.ssl.algorithms default value to modern cipher suite [flink]
Posted by "gaborgsomogyi (via GitHub)" <gi...@apache.org>.
gaborgsomogyi commented on code in PR #27514:
URL: https://github.com/apache/flink/pull/27514#discussion_r2769578712
##########
flink-runtime/src/test/java/org/apache/flink/runtime/net/SSLUtilsTest.java:
##########
@@ -523,11 +511,6 @@ public static String getRestCertificateFingerprint(
private static void addSslProviderConfig(Configuration config, String sslProvider) {
if (sslProvider.equalsIgnoreCase("OPENSSL")) {
OpenSsl.ensureAvailability();
-
- // Flink's default algorithm set is not available for openSSL - choose a different one:
Review Comment:
Same question here
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: issues-unsubscribe@flink.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] [FLINK-39022][security] Set security.ssl.algorithms default value to modern cipher suite [flink]
Posted by "balassai (via GitHub)" <gi...@apache.org>.
balassai commented on code in PR #27514:
URL: https://github.com/apache/flink/pull/27514#discussion_r2771340175
##########
flink-runtime/src/test/java/org/apache/flink/runtime/net/SSLUtilsTest.java:
##########
@@ -392,22 +392,10 @@ void testSetSSLVersionAndCipherSuitesForSSLServerSocket(String sslProvider) thro
@MethodSource("parameters")
void testCreateSSLEngineFactory(String sslProvider) throws Exception {
Configuration serverConfig = createInternalSslConfigWithKeyAndTrustStores(sslProvider);
- final String[] sslAlgorithms;
- final String[] expectedSslProtocols;
- if (sslProvider.equalsIgnoreCase("OPENSSL")) {
- // openSSL does not support the same set of cipher algorithms!
Review Comment:
Thanks, it does not support with TLSv1, only TLSv1.2, going to revert this.
https://docs.openssl.org/1.0.2/man1/ciphers/#tls-v12-cipher-suites
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: issues-unsubscribe@flink.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] [FLINK-39022][security] Set security.ssl.algorithms default value to modern cipher suite [flink]
Posted by "gaborgsomogyi (via GitHub)" <gi...@apache.org>.
gaborgsomogyi commented on PR #27514:
URL: https://github.com/apache/flink/pull/27514#issuecomment-3932186732
@flinkbot run azure
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: issues-unsubscribe@flink.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] [FLINK-39022][security] Set security.ssl.algorithms default value to modern cipher suite [flink]
Posted by "gaborgsomogyi (via GitHub)" <gi...@apache.org>.
gaborgsomogyi closed pull request #27514: [FLINK-39022][security] Set security.ssl.algorithms default value to modern cipher suite
URL: https://github.com/apache/flink/pull/27514
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: issues-unsubscribe@flink.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] [FLINK-39022][security] Set security.ssl.algorithms default value to modern cipher suite [flink]
Posted by "davidradl (via GitHub)" <gi...@apache.org>.
davidradl commented on code in PR #27514:
URL: https://github.com/apache/flink/pull/27514#discussion_r2769249502
##########
flink-core/src/main/java/org/apache/flink/configuration/SecurityOptions.java:
##########
@@ -498,19 +498,20 @@ public static Configuration forProvider(Configuration configuration, String prov
* The standard SSL algorithms to be supported.
*
* <p>More options here -
- * http://docs.oracle.com/javase/8/docs/technotes/guides/security/StandardNames.html#ciphersuites
+ * https://docs.oracle.com/en/java/javase/17/docs/specs/security/standard-names.html
*/
@Documentation.Section(Documentation.Sections.SECURITY_SSL)
public static final ConfigOption<String> SSL_ALGORITHMS =
key("security.ssl.algorithms")
.stringType()
- .defaultValue("TLS_RSA_WITH_AES_128_CBC_SHA")
+ .defaultValue(
+ "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384")
Review Comment:
should be put out a warning if we find an algorithm that we consider insecure; specifically checking for the older algs we used to use?
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: issues-unsubscribe@flink.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] [FLINK-39022][security] Set security.ssl.algorithms default value to modern cipher suite [flink]
Posted by "gaborgsomogyi (via GitHub)" <gi...@apache.org>.
gaborgsomogyi commented on code in PR #27514:
URL: https://github.com/apache/flink/pull/27514#discussion_r2765042701
##########
docs/content/release-notes/flink-1.20.md:
##########
@@ -431,3 +431,17 @@ The following option has been moved from `org.apache.flink.table.planner.plan.ru
to `org.apache.flink.table.api.config.OptimizerConfigOptions` and promoted to `@PublicEvolving`
- `table.optimizer.incremental-agg-enabled`
+
Review Comment:
I think this is not the proper place. We've intended to release 2.3, right?
##########
docs/content/docs/deployment/security/security-ssl.md:
##########
@@ -165,6 +165,11 @@ If these cipher suites are not supported on your setup, you will see that Flink
{{< /hint >}}
+The JDK update [JDK-8245545](https://bugs.openjdk.org/browse/JDK-8245545) (affecting JDK 11.0.30+, 17.0.18+, 21.0.10+, and 24+) disabled `TLS_RSA_*` cipher suites to support forward-secrecy (RFC 9325) and comply with the IETF Draft *Deprecating Obsolete Key Exchange Methods in TLS*.
Review Comment:
I think the actual cipher suite description is not valid anymore: https://nightlies.apache.org/flink/flink-docs-stable/docs/deployment/security/security-ssl/#cipher-suites
Maybe there are other areas, we can look for any cipher suite related entries and handle things as a whole.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: issues-unsubscribe@flink.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] [FLINK-39022][security] Set security.ssl.algorithms default value to modern cipher suite [flink]
Posted by "balassai (via GitHub)" <gi...@apache.org>.
balassai commented on code in PR #27514:
URL: https://github.com/apache/flink/pull/27514#discussion_r2771417534
##########
docs/content/release-notes/flink-2.3.md:
##########
@@ -0,0 +1,44 @@
+---
+title: "Release Notes - Flink 2.3"
+---
+
+<!--
+Licensed to the Apache Software Foundation (ASF) under one
+or more contributor license agreements. See the NOTICE file
+distributed with this work for additional information
+regarding copyright ownership. The ASF licenses this file
+to you under the Apache License, Version 2.0 (the
+"License"); you may not use this file except in compliance
+with the License. You may obtain a copy of the License at
+
+ http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing,
+software distributed under the License is distributed on an
+"AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+KIND, either express or implied. See the License for the
+specific language governing permissions and limitations
+under the License.
+-->
+
+# Release notes - Flink 2.3
+
+These release notes discuss important aspects, such as configuration, behavior or dependencies,
+that changed between Flink 2.2 and Flink 2.3. Please read these notes carefully if you are
+planning to upgrade your Flink version to 2.3.
+
+
+### Core
+
+#### Set security.ssl.algorithms default value to modern cipher suite
+
+### [FLINK-39022](https://issues.apache.org/jira/browse/FLINK-39022)
+
+A JDK update (affecting JDK 11.0.30+, 17.0.18+, 21.0.10+, and 24+) disabled `TLS_RSA_*` cipher suites.
+This was done to support forward-secrecy (RFC 9325) and comply with the IETF Draft on *Deprecating Obsolete Key Exchange Methods in TLS*.
+
+To support these and future JDK versions, the default value for the Flink configuration option `security.ssl.algorithms` has been changed to a modern, widely available cipher suite:
+
+`TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384`
+
+
Review Comment:
Ack. Added it here too.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: issues-unsubscribe@flink.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] [FLINK-39022][security] Set security.ssl.algorithms default value to modern cipher suite [flink]
Posted by "balassai (via GitHub)" <gi...@apache.org>.
balassai commented on code in PR #27514:
URL: https://github.com/apache/flink/pull/27514#discussion_r2771436335
##########
flink-core/src/main/java/org/apache/flink/configuration/SecurityOptions.java:
##########
@@ -498,19 +498,20 @@ public static Configuration forProvider(Configuration configuration, String prov
* The standard SSL algorithms to be supported.
*
* <p>More options here -
- * http://docs.oracle.com/javase/8/docs/technotes/guides/security/StandardNames.html#ciphersuites
+ * https://docs.oracle.com/en/java/javase/17/docs/specs/security/standard-names.html
*/
@Documentation.Section(Documentation.Sections.SECURITY_SSL)
public static final ConfigOption<String> SSL_ALGORITHMS =
key("security.ssl.algorithms")
.stringType()
- .defaultValue("TLS_RSA_WITH_AES_128_CBC_SHA")
+ .defaultValue(
+ "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384")
.withDescription(
Description.builder()
.text(
"The comma separated list of standard SSL algorithms to be supported. Read more %s",
link(
- "http://docs.oracle.com/javase/8/docs/technotes/guides/security/StandardNames.html#ciphersuites",
+ "https://docs.oracle.com/en/java/javase/17/docs/specs/security/standard-names.html",
Review Comment:
Ack. using java 11 links.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: issues-unsubscribe@flink.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] [FLINK-39022][security] Set security.ssl.algorithms default value to modern cipher suite [flink]
Posted by "gaborgsomogyi (via GitHub)" <gi...@apache.org>.
gaborgsomogyi commented on PR #27514:
URL: https://github.com/apache/flink/pull/27514#issuecomment-3860698419
I think it's in a good shape to do in-depth testing at least I'm planning to do so. We must be extra careful not to break anything so I will take quite some time. It's good time for everybody in the community to share ideas concern.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: issues-unsubscribe@flink.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] [FLINK-39022][security] Set security.ssl.algorithms default value to modern cipher suite [flink]
Posted by "gaborgsomogyi (via GitHub)" <gi...@apache.org>.
gaborgsomogyi commented on PR #27514:
URL: https://github.com/apache/flink/pull/27514#issuecomment-3932186019
@swapna267 thanks for the confirmation, intended to merge it after recent green CI
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: issues-unsubscribe@flink.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] [FLINK-39022][security] Set security.ssl.algorithms default value to modern cipher suite [flink]
Posted by "balassai (via GitHub)" <gi...@apache.org>.
balassai commented on code in PR #27514:
URL: https://github.com/apache/flink/pull/27514#discussion_r2766454994
##########
docs/content/docs/deployment/security/security-ssl.md:
##########
@@ -165,6 +165,11 @@ If these cipher suites are not supported on your setup, you will see that Flink
{{< /hint >}}
+The JDK update [JDK-8245545](https://bugs.openjdk.org/browse/JDK-8245545) (affecting JDK 11.0.30+, 17.0.18+, 21.0.10+, and 24+) disabled `TLS_RSA_*` cipher suites to support forward-secrecy (RFC 9325) and comply with the IETF Draft *Deprecating Obsolete Key Exchange Methods in TLS*.
Review Comment:
Thanks, updated security-ssl.md.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: issues-unsubscribe@flink.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] [FLINK-39022][security] Set security.ssl.algorithms default value to modern cipher suite [flink]
Posted by "balassai (via GitHub)" <gi...@apache.org>.
balassai commented on PR #27514:
URL: https://github.com/apache/flink/pull/27514#issuecomment-3843836581
> Thanks for the contribution. Without too deep consideration I miss 2 things:
>
> * Doc update
> * Release note which explains the change to users
>
> Maybe there are other implications but we must be extra careful because we touch quite a sensitive part of Flink.
Thank you for the input, I've modified the description.
Regarding Doc update / release note I'm not familiar with the location / process. What is the procedure and where are those located?
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: issues-unsubscribe@flink.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] [FLINK-39022][security] Set security.ssl.algorithms default value to modern cipher suite [flink]
Posted by "balassai (via GitHub)" <gi...@apache.org>.
balassai commented on code in PR #27514:
URL: https://github.com/apache/flink/pull/27514#discussion_r2766462598
##########
docs/layouts/shortcodes/generated/security_ssl_section.html:
##########
@@ -10,7 +10,7 @@
<tbody>
<tr>
<td><h5>security.ssl.algorithms</h5></td>
- <td style="word-wrap: break-word;">"TLS_RSA_WITH_AES_128_CBC_SHA"</td>
+ <td style="word-wrap: break-word;">"TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384"</td>
<td>String</td>
<td>The comma separated list of standard SSL algorithms to be supported. Read more <a href="http://docs.oracle.com/javase/8/docs/technotes/guides/security/StandardNames.html#ciphersuites">here</a></td>
Review Comment:
Thanks, updated.
##########
docs/layouts/shortcodes/generated/security_configuration.html:
##########
@@ -88,7 +88,7 @@
</tr>
<tr>
<td><h5>security.ssl.algorithms</h5></td>
- <td style="word-wrap: break-word;">"TLS_RSA_WITH_AES_128_CBC_SHA"</td>
+ <td style="word-wrap: break-word;">"TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384"</td>
<td>String</td>
<td>The comma separated list of standard SSL algorithms to be supported. Read more <a href="http://docs.oracle.com/javase/8/docs/technotes/guides/security/StandardNames.html#ciphersuites">here</a></td>
Review Comment:
Thanks, updated.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: issues-unsubscribe@flink.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] [FLINK-39022][security] Set security.ssl.algorithms default value to modern cipher suite [flink]
Posted by "davidradl (via GitHub)" <gi...@apache.org>.
davidradl commented on code in PR #27514:
URL: https://github.com/apache/flink/pull/27514#discussion_r2769638264
##########
flink-core/src/main/java/org/apache/flink/configuration/SecurityOptions.java:
##########
@@ -498,19 +498,20 @@ public static Configuration forProvider(Configuration configuration, String prov
* The standard SSL algorithms to be supported.
*
* <p>More options here -
- * http://docs.oracle.com/javase/8/docs/technotes/guides/security/StandardNames.html#ciphersuites
+ * https://docs.oracle.com/en/java/javase/17/docs/specs/security/standard-names.html
*/
@Documentation.Section(Documentation.Sections.SECURITY_SSL)
public static final ConfigOption<String> SSL_ALGORITHMS =
key("security.ssl.algorithms")
.stringType()
- .defaultValue("TLS_RSA_WITH_AES_128_CBC_SHA")
+ .defaultValue(
+ "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384")
Review Comment:
Does it make sense to you, that If a custom cipher is supplied that does not comply with the latest RFC, then we put out a warning to draw the users attention to something that looks insecure, because it does not comply with the latest RFC ?
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: issues-unsubscribe@flink.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] [FLINK-39022][security] Set security.ssl.algorithms default value to modern cipher suite [flink]
Posted by "gaborgsomogyi (via GitHub)" <gi...@apache.org>.
gaborgsomogyi commented on code in PR #27514:
URL: https://github.com/apache/flink/pull/27514#discussion_r2769430901
##########
flink-core/src/main/java/org/apache/flink/configuration/SecurityOptions.java:
##########
@@ -498,19 +498,20 @@ public static Configuration forProvider(Configuration configuration, String prov
* The standard SSL algorithms to be supported.
*
* <p>More options here -
- * http://docs.oracle.com/javase/8/docs/technotes/guides/security/StandardNames.html#ciphersuites
+ * https://docs.oracle.com/en/java/javase/17/docs/specs/security/standard-names.html
*/
@Documentation.Section(Documentation.Sections.SECURITY_SSL)
public static final ConfigOption<String> SSL_ALGORITHMS =
key("security.ssl.algorithms")
.stringType()
- .defaultValue("TLS_RSA_WITH_AES_128_CBC_SHA")
+ .defaultValue(
+ "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384")
Review Comment:
We just want to make it more secure which will comply with the latest RFC. Not yet understand what insecure cipher you mean here🤔
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: issues-unsubscribe@flink.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] [FLINK-39022][security] Set security.ssl.algorithms default value to modern cipher suite [flink]
Posted by "swapna267 (via GitHub)" <gi...@apache.org>.
swapna267 commented on PR #27514:
URL: https://github.com/apache/flink/pull/27514#issuecomment-3929430315
Tested internally with `JDK-17.0.18` .
Enabled internal SSL using configs listed here, https://nightlies.apache.org/flink/flink-docs-stable/docs/deployment/security/security-ssl/
Could reproduce following error without the fix,
```
javax.net.ssl.SSLHandshakeException: No appropriate protocol (protocol is disabled or cipher suites are inappropriate)
at java.base/sun.security.ssl.HandshakeContext.<init>(HandshakeContext.java:173) ~[?:?]
at java.base/sun.security.ssl.ServerHandshakeContext.<init>(ServerHandshakeContext.java:63) ~[?:?]
at java.base/sun.security.ssl.TransportContext.kickstart(TransportContext.java:253) ~[?:?]
at java.base/sun.security.ssl.SSLSocketImpl.startHandshake(SSLSocketImpl.java:450) ~[?:?]
at java.base/sun.security.ssl.SSLSocketImpl.ensureNegotiated(SSLSocketImpl.java:927) ~[?:?]
at java.base/sun.security.ssl.SSLSocketImpl$AppInputStream.read(SSLSocketImpl.java:1018) ~[?:?]
at java.base/sun.security.ssl.SSLSocketImpl$AppInputStream.read(SSLSocketImpl.java:978) ~[?:?]
at org.apache.flink.runtime.blob.BlobServerConnection.run(BlobServerConnection.java:102)
```
And it passes through with the changes in this PR.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: issues-unsubscribe@flink.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] [FLINK-39022][security] Set security.ssl.algorithms default value to modern cipher suite [flink]
Posted by "swapna267 (via GitHub)" <gi...@apache.org>.
swapna267 commented on code in PR #27514:
URL: https://github.com/apache/flink/pull/27514#discussion_r2765165021
##########
docs/layouts/shortcodes/generated/security_configuration.html:
##########
@@ -88,7 +88,7 @@
</tr>
<tr>
<td><h5>security.ssl.algorithms</h5></td>
- <td style="word-wrap: break-word;">"TLS_RSA_WITH_AES_128_CBC_SHA"</td>
+ <td style="word-wrap: break-word;">"TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384"</td>
<td>String</td>
<td>The comma separated list of standard SSL algorithms to be supported. Read more <a href="http://docs.oracle.com/javase/8/docs/technotes/guides/security/StandardNames.html#ciphersuites">here</a></td>
Review Comment:
Change to java17 here too
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: issues-unsubscribe@flink.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] [FLINK-39022][security] Set security.ssl.algorithms default value to modern cipher suite [flink]
Posted by "swapna267 (via GitHub)" <gi...@apache.org>.
swapna267 commented on code in PR #27514:
URL: https://github.com/apache/flink/pull/27514#discussion_r2765166269
##########
docs/layouts/shortcodes/generated/security_ssl_section.html:
##########
@@ -10,7 +10,7 @@
<tbody>
<tr>
<td><h5>security.ssl.algorithms</h5></td>
- <td style="word-wrap: break-word;">"TLS_RSA_WITH_AES_128_CBC_SHA"</td>
+ <td style="word-wrap: break-word;">"TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384"</td>
<td>String</td>
<td>The comma separated list of standard SSL algorithms to be supported. Read more <a href="http://docs.oracle.com/javase/8/docs/technotes/guides/security/StandardNames.html#ciphersuites">here</a></td>
Review Comment:
Change to java17
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: issues-unsubscribe@flink.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] [FLINK-39022][security] Set security.ssl.algorithms default value to modern cipher suite [flink]
Posted by "davidradl (via GitHub)" <gi...@apache.org>.
davidradl commented on code in PR #27514:
URL: https://github.com/apache/flink/pull/27514#discussion_r2769260644
##########
flink-core/src/main/java/org/apache/flink/configuration/SecurityOptions.java:
##########
@@ -498,19 +498,20 @@ public static Configuration forProvider(Configuration configuration, String prov
* The standard SSL algorithms to be supported.
*
* <p>More options here -
- * http://docs.oracle.com/javase/8/docs/technotes/guides/security/StandardNames.html#ciphersuites
+ * https://docs.oracle.com/en/java/javase/17/docs/specs/security/standard-names.html
*/
@Documentation.Section(Documentation.Sections.SECURITY_SSL)
public static final ConfigOption<String> SSL_ALGORITHMS =
key("security.ssl.algorithms")
.stringType()
- .defaultValue("TLS_RSA_WITH_AES_128_CBC_SHA")
+ .defaultValue(
+ "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384")
.withDescription(
Description.builder()
.text(
"The comma separated list of standard SSL algorithms to be supported. Read more %s",
link(
- "http://docs.oracle.com/javase/8/docs/technotes/guides/security/StandardNames.html#ciphersuites",
+ "https://docs.oracle.com/en/java/javase/17/docs/specs/security/standard-names.html",
Review Comment:
I not not know if this list changes much between java levels. Should this link be JAVA 11 as this is the lowest level we support? Are there java 21 algorithms that could be used if Flink was compiled with that profile?
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: issues-unsubscribe@flink.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] [FLINK-39022][security] Set security.ssl.algorithms default value to modern cipher suite [flink]
Posted by "gaborgsomogyi (via GitHub)" <gi...@apache.org>.
gaborgsomogyi commented on code in PR #27514:
URL: https://github.com/apache/flink/pull/27514#discussion_r2769482689
##########
docs/content.zh/docs/deployment/security/security-ssl.md:
##########
@@ -150,20 +150,15 @@ security.ssl.rest.authentication-enabled: false
### Cipher suites
-{{< hint warning >}}
-The [IETF RFC 7525](https://tools.ietf.org/html/rfc7525) recommends to use a specific set of cipher suites for strong security.
-Because these cipher suites were not available on many setups out of the box, Flink's default value is set to a slightly
-weaker but more compatible cipher suite.
-We recommend that SSL setups update to the stronger cipher suites, if possible, by adding the below entry to the Flink configuration:
+For strong security, it is crucial to use modern and robust cipher suites. [IETF RFC 9325](https://www.rfc-editor.org/info/rfc9325), which supersedes the older RFC 7525, provides current recommendations for the secure use of TLS.
+In response to evolving security standards and to ensure compatibility with modern Java versions, Flink has updated its default cipher suites. Recent JDK updates (affecting versions like 11.0.30+, 17.0.18+, etc.) have disabled older `TLS_RSA_*` cipher suites that lack forward secrecy.
-```yaml
-security.ssl.algorithms: TLS_DHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_DHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384
-```
+To support these secure-by-default JDK versions and align with best practices, Flink's default value for `security.ssl.algorithms` is now:
-If these cipher suites are not supported on your setup, you will see that Flink processes will not be able to connect to each other.
Review Comment:
Well, the sentences later are touching cipher customization but not telling what are be the visible symptoms. I would say we should add the visible symptoms into the upcoming new paragpraph together.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: issues-unsubscribe@flink.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] [FLINK-39022][security] Set security.ssl.algorithms default value to modern cipher suite [flink]
Posted by "balassai (via GitHub)" <gi...@apache.org>.
balassai commented on code in PR #27514:
URL: https://github.com/apache/flink/pull/27514#discussion_r2771401243
##########
docs/content.zh/docs/deployment/security/security-ssl.md:
##########
@@ -150,20 +150,15 @@ security.ssl.rest.authentication-enabled: false
### Cipher suites
-{{< hint warning >}}
-The [IETF RFC 7525](https://tools.ietf.org/html/rfc7525) recommends to use a specific set of cipher suites for strong security.
-Because these cipher suites were not available on many setups out of the box, Flink's default value is set to a slightly
-weaker but more compatible cipher suite.
-We recommend that SSL setups update to the stronger cipher suites, if possible, by adding the below entry to the Flink configuration:
+For strong security, it is crucial to use modern and robust cipher suites. [IETF RFC 9325](https://www.rfc-editor.org/info/rfc9325), which supersedes the older RFC 7525, provides current recommendations for the secure use of TLS.
+In response to evolving security standards and to ensure compatibility with modern Java versions, Flink has updated its default cipher suites. Recent JDK updates (affecting versions like 11.0.30+, 17.0.18+, etc.) have disabled older `TLS_RSA_*` cipher suites that lack forward secrecy.
-```yaml
-security.ssl.algorithms: TLS_DHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_DHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384
-```
+To support these secure-by-default JDK versions and align with best practices, Flink's default value for `security.ssl.algorithms` is now:
-If these cipher suites are not supported on your setup, you will see that Flink processes will not be able to connect to each other.
Review Comment:
Ack, adding back the visible warning line.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: issues-unsubscribe@flink.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org