You are viewing a plain text version of this content. The canonical link for it is here.
Posted to issues@flink.apache.org by "qiuyanjun888 (via GitHub)" <gi...@apache.org> on 2026/06/25 03:09:57 UTC
[PR] [FLINK-39969] [runtime] Apply configured SSL protocols and algorithms [flink]
qiuyanjun888 opened a new pull request, #28532:
URL: https://github.com/apache/flink/pull/28532
## What is the purpose of the change
This pull request fixes FLINK-39969 so configured SSL protocols and cipher suites are consistently applied to Flink REST SSL services and internal SSL client sockets. Previously, REST server Netty SSL contexts skipped configured protocols/ciphers when no trust manager was installed, and `createSSLClientSocketFactory` returned the raw socket factory without applying Flink's configured SSL protocol and algorithms.
## Brief change log
- Apply configured REST SSL protocols, cipher suites, and client-auth mode directly on the Netty `SslContextBuilder` regardless of whether a trust manager is present.
- Wrap internal SSL client socket factories so each created `SSLSocket` receives the configured protocols and cipher suites, matching the existing server-side socket factory behavior.
- Add regression coverage for REST server Netty SSL context configuration and internal SSL client socket configuration.
## Verifying this change
This change added tests and can be verified as follows:
- `./mvnw -pl flink-runtime -Dtest=SSLUtilsTest#testRestServerAppliesConfiguredProtocolsAndCipherSuites+testSetSSLVersionAndCipherSuitesForSSLClientSocket -DfailIfNoTests=false -DskipITs -Dfast -Drat.skip=true -Dcheckstyle.skip=true -Dspotless.check.skip=true test`
- Verified RED before the fix: the new focused tests failed because configured protocols were not applied.
- Verified GREEN after the fix: `Tests run: 2, Failures: 0, Errors: 0, Skipped: 0`.
- `./mvnw -pl flink-runtime -Dtest=SSLUtilsTest -DfailIfNoTests=false -DskipITs -Dfast -Drat.skip=true -Dspotless.check.skip=true test`
- `Tests run: 28, Failures: 0, Errors: 0, Skipped: 0`.
- `./mvnw -pl flink-runtime -DskipTests -DskipITs -Drat.skip=true spotless:check`
- `BUILD SUCCESS`.
## Does this pull request potentially affect one of the following parts:
- Dependencies (does it add or upgrade a dependency): no
- The public API, i.e., is any changed class annotated with `@Public(Evolving)`: no
- The serializers: no
- The runtime per-record code paths (performance sensitive): no
- Anything that affects deployment or recovery: JobManager (and its components), Checkpointing, Kubernetes/Yarn, ZooKeeper: yes, SSL setup for REST and internal runtime communication
- The S3 file system connector: no
## Documentation
- Does this pull request introduce a new feature? no
- If yes, how is the feature documented? not applicable
---
##### Was generative AI tooling used to co-author this PR?
- [X] Yes (Hermes Agent, OpenAI GPT-5.5)
Generated-by: Hermes Agent (OpenAI GPT-5.5)
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: issues-unsubscribe@flink.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] [FLINK-39969] [runtime] Apply configured SSL protocols and algorithms [flink]
Posted by "qiuyanjun888 (via GitHub)" <gi...@apache.org>.
qiuyanjun888 commented on PR #28532:
URL: https://github.com/apache/flink/pull/28532#issuecomment-4881019249
Thanks for the review. Updated in `92ef4dd9b9`:
- Moved REST `.clientAuth(clientAuth)` out of the common builder chain and now apply it only on the server-side builder when client authentication is enabled.
- Added DEBUG logging for internal/REST SSL settings, including provider, mode, client auth, protocols, cipher suites, and internal session settings.
- Added DEBUG logging for RPC/Pekko SSL settings, including enablement, protocol, algorithms, key/trust store configured flags and types, cert-fingerprint configured flag, mutual auth, and SSL engine provider.
- The new logs do not include passwords or secret material.
Verified locally:
- `git diff --check`
- `JAVA_HOME=/opt/data/tools/jdk-17 ./mvnw -pl flink-runtime -Dtest=SSLUtilsTest test`
- `JAVA_HOME=/opt/data/tools/jdk-17 ./mvnw -pl flink-rpc/flink-rpc-akka -Dtest=PekkoUtilsTest test`
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: issues-unsubscribe@flink.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] [FLINK-39969] [runtime] Apply configured SSL protocols and algorithms [flink]
Posted by "JozsefKuti (via GitHub)" <gi...@apache.org>.
JozsefKuti commented on code in PR #28532:
URL: https://github.com/apache/flink/pull/28532#discussion_r3479656474
##########
flink-runtime/src/main/java/org/apache/flink/runtime/net/SSLUtils.java:
##########
@@ -437,18 +444,15 @@ public static SslContext createRestNettySSLContext(
if (clientMode || clientAuth != ClientAuth.NONE) {
Optional<TrustManagerFactory> tmf = getTrustManagerFactory(config, false);
- tmf.map(
- // Use specific ciphers and protocols if SSL is configured with self-signed
- // certificates (user-supplied truststore)
- tm ->
- sslContextBuilder
- .trustManager(tm)
- .protocols(sslProtocols)
- .ciphers(ciphers)
- .clientAuth(clientAuth));
- }
-
- return sslContextBuilder.sslProvider(provider).build();
+ tmf.ifPresent(sslContextBuilder::trustManager);
+ }
+
+ return sslContextBuilder
+ .sslProvider(provider)
+ .protocols(sslProtocols)
+ .ciphers(ciphers)
+ .clientAuth(clientAuth)
Review Comment:
Move `.clientAuth(clientAuth) `a few lines before where clientAuth is enabled - since it is set even for service side as well at the moment.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: issues-unsubscribe@flink.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] [FLINK-39969] [runtime] Apply configured SSL protocols and algorithms [flink]
Posted by "qiuyanjun888 (via GitHub)" <gi...@apache.org>.
qiuyanjun888 commented on code in PR #28532:
URL: https://github.com/apache/flink/pull/28532#discussion_r3522721728
##########
flink-runtime/src/main/java/org/apache/flink/runtime/net/SSLUtils.java:
##########
@@ -437,18 +444,15 @@ public static SslContext createRestNettySSLContext(
if (clientMode || clientAuth != ClientAuth.NONE) {
Optional<TrustManagerFactory> tmf = getTrustManagerFactory(config, false);
- tmf.map(
- // Use specific ciphers and protocols if SSL is configured with self-signed
- // certificates (user-supplied truststore)
- tm ->
- sslContextBuilder
- .trustManager(tm)
- .protocols(sslProtocols)
- .ciphers(ciphers)
- .clientAuth(clientAuth));
- }
-
- return sslContextBuilder.sslProvider(provider).build();
+ tmf.ifPresent(sslContextBuilder::trustManager);
+ }
+
+ return sslContextBuilder
+ .sslProvider(provider)
+ .protocols(sslProtocols)
+ .ciphers(ciphers)
+ .clientAuth(clientAuth)
Review Comment:
Done — moved `.clientAuth(clientAuth)` out of the common REST builder chain and now only apply it on the server-side builder when REST client authentication is enabled.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: issues-unsubscribe@flink.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] [FLINK-39969] [runtime] Apply configured SSL protocols and algorithms [flink]
Posted by "qiuyanjun888 (via GitHub)" <gi...@apache.org>.
qiuyanjun888 closed pull request #28532: [FLINK-39969] [runtime] Apply configured SSL protocols and algorithms
URL: https://github.com/apache/flink/pull/28532
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: issues-unsubscribe@flink.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] [FLINK-39969] [runtime] Apply configured SSL protocols and algorithms [flink]
Posted by "flinkbot (via GitHub)" <gi...@apache.org>.
flinkbot commented on PR #28532:
URL: https://github.com/apache/flink/pull/28532#issuecomment-4795489940
<!--
Meta data
{
"version" : 1,
"metaDataEntries" : [ {
"hash" : "ac07a105491f36997a95630227863742895eee68",
"status" : "UNKNOWN",
"url" : "TBD",
"triggerID" : "ac07a105491f36997a95630227863742895eee68",
"triggerType" : "PUSH"
} ]
}-->
## CI report:
* ac07a105491f36997a95630227863742895eee68 UNKNOWN
<details>
<summary>Bot commands</summary>
The @flinkbot bot supports the following commands:
- `@flinkbot run azure` re-run the last Azure build
</details>
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: issues-unsubscribe@flink.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] [FLINK-39969] [runtime] Apply configured SSL protocols and algorithms [flink]
Posted by "qiuyanjun888 (via GitHub)" <gi...@apache.org>.
qiuyanjun888 commented on PR #28532:
URL: https://github.com/apache/flink/pull/28532#issuecomment-4805915796
This PR is focused on runtime / SSLUtils protocol and algorithm handling.
@tweise @1996fanrui @RocMarshal could you please take a look when you have time and advise whether this approach is acceptable for this area and can move forward?
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: issues-unsubscribe@flink.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org