You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@pulsar.apache.org by "izumo27 (via GitHub)" <gi...@apache.org> on 2023/12/31 13:32:46 UTC
[PR] [fix][client] Support for PKCS#8 private key [pulsar]
izumo27 opened a new pull request, #21828:
URL: https://github.com/apache/pulsar/pull/21828
### Motivation
When attempting to load an RSA private key in PKCS#8 format for message encryption, the key loading fails.
### Modifications
When the RSA private key is in PKCS#1 format (begin with ```BEGIN RSA PRIVATE KEY```), the type of ```pemObj``` is ```PEMKeyPair```.
- https://github.com/apache/pulsar/blob/200c925add239115365d16d63559b46399f32eca/pulsar-client-messagecrypto-bc/src/main/java/org/apache/pulsar/client/impl/crypto/MessageCryptoBc.java#L238
- https://github.com/bcgit/bc-java/blob/r1rv75/pkix/src/main/java/org/bouncycastle/openssl/PEMParser.java#L120
- https://github.com/bcgit/bc-java/blob/r1rv75/pkix/src/main/java/org/bouncycastle/openssl/PEMParser.java#L153-L216
- https://github.com/bcgit/bc-java/blob/r1rv75/pkix/src/main/java/org/bouncycastle/openssl/PEMParser.java#L95
- https://github.com/bcgit/bc-java/blob/r1rv75/pkix/src/main/java/org/bouncycastle/openssl/PEMParser.java#L65
- https://github.com/bcgit/bc-java/blob/r1rv75/pkix/src/main/java/org/bouncycastle/openssl/PEMParser.java#L153-L216
However, When the RSA private key is in PKCS#8 format (begin with ```BEGIN PRIVATE KEY```), BouncyCastle utilizes ```PrivateKeyParser```, resulting in the type of ```pemObj``` being ```PrivateKeyInfo```.
- https://github.com/bcgit/bc-java/blob/r1rv75/pkix/src/main/java/org/bouncycastle/openssl/PEMParser.java#L567-L578
- https://github.com/bcgit/bc-java/blob/r1rv75/pkix/src/main/java/org/bouncycastle/openssl/PEMParser.java#L99
- https://github.com/bcgit/bc-java/blob/main/pkix/src/main/java/org/bouncycastle/openssl/PEMParser.java#L69
- https://github.com/bcgit/bc-java/blob/r1rv75/pkix/src/main/java/org/bouncycastle/openssl/PEMParser.java#L572
### Verifying this change
- [x] Make sure that the change passes the CI checks.
This change added tests and can be verified as follows:
- Add a PKCS#8 private key for testing
<!-- DO NOT REMOVE THIS SECTION. CHECK THE PROPER BOX ONLY. -->
*If the box was checked, please highlight the changes*
- [ ] Dependencies (add or upgrade a dependency)
- [ ] The public API
- [ ] The schema
- [ ] The default values of configurations
- [ ] The threading model
- [ ] The binary protocol
- [ ] The REST endpoints
- [ ] The admin CLI options
- [ ] The metrics
- [ ] Anything that affects deployment
### Documentation
<!-- DO NOT REMOVE THIS SECTION. CHECK THE PROPER BOX ONLY. -->
- [ ] `doc` <!-- Your PR contains doc changes. -->
- [ ] `doc-required` <!-- Your PR changes impact docs and you will update later -->
- [x] `doc-not-needed` <!-- Your PR changes do not impact docs -->
- [ ] `doc-complete` <!-- Docs have been already added -->
### Matching PR in forked repository
PR in forked repository:
- https://github.com/izumo27/pulsar/pull/2
- https://github.com/izumo27/pulsar/pull/3 (test failure before this modification)
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@pulsar.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] [fix][client] Support for PKCS#8 private key [pulsar]
Posted by "izumo27 (via GitHub)" <gi...@apache.org>.
izumo27 closed pull request #21828: [fix][client] Support for PKCS#8 private key
URL: https://github.com/apache/pulsar/pull/21828
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@pulsar.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] [fix][client] Support for PKCS#8 private key [pulsar]
Posted by "izumo27 (via GitHub)" <gi...@apache.org>.
izumo27 commented on PR #21828:
URL: https://github.com/apache/pulsar/pull/21828#issuecomment-1874183131
> We should keep the original test with `x.pem`key.
In ```testRSAEncryption```, ```producer``` and ```producer2``` use the same key, so it looks like producer2 is not needed.
https://github.com/apache/pulsar/blob/529e1ab80998143cfe793c018429e9d2bbee5473/pulsar-broker/src/test/java/org/apache/pulsar/client/api/SimpleProducerConsumerTest.java#L2780-L2783
Actually, in ECDSA's test, there is only one producer.
https://github.com/apache/pulsar/blob/529e1ab80998143cfe793c018429e9d2bbee5473/pulsar-broker/src/test/java/org/apache/pulsar/client/api/SimpleProducerConsumerTest.java#L2701-L2703
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@pulsar.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] [fix][client] Support for PKCS#8 private key [pulsar]
Posted by "izumo27 (via GitHub)" <gi...@apache.org>.
izumo27 commented on PR #21828:
URL: https://github.com/apache/pulsar/pull/21828#issuecomment-1923796633
PTAL, thanks. @Technoboy-
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@pulsar.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] [fix][client] Support for PKCS#8 private key [pulsar]
Posted by "izumo27 (via GitHub)" <gi...@apache.org>.
izumo27 commented on PR #21828:
URL: https://github.com/apache/pulsar/pull/21828#issuecomment-1874185519
I missed many tests using ```private-key.client-rsa.pem```.
I modified them.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@pulsar.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org