-
Notifications
You must be signed in to change notification settings - Fork 361
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
GH-524: Use built-in native AES from SunJCE if available
Bouncy Castle apparently only has native implementations in its "LTS" releases. BC 1.78.1 has none. SunJCE uses native code. The "security registrar" architecture in Apache MINA sshd prefers registered providers over the platform providers, and it automatically registers Bouncy Castle if it's present. So with Bouncy Castle on the classpath and an SSH connection for which an AES cipher was specified, Apache MINA sshd would use the much slower Bouncy Castle AES. Add a new "SunJCEWrapper" registrar that brings the SunJCE AES and HmacSHA* to the front of the list, so that they are used even if Bouncy Castle is also registered. The new registrar can be disabled via a system property as usual, and it is only enabled if the JVM indeed has a "SunJCE" security provider registered. See also https://issues.apache.org/jira/browse/SSHD-719 (issue closed as "not needed"). Bug: #524
- Loading branch information
Showing
5 changed files
with
124 additions
and
5 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
102 changes: 102 additions & 0 deletions
102
...n/src/main/java/org/apache/sshd/common/util/security/SunJCESecurityProviderRegistrar.java
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,102 @@ | ||
| /* | ||
| * Licensed to the Apache Software Foundation (ASF) under one | ||
| * or more contributor license agreements. See the NOTICE file | ||
| * distributed with this work for additional information | ||
| * regarding copyright ownership. The ASF licenses this file | ||
| * to you under the Apache License, Version 2.0 (the | ||
| * "License"); you may not use this file except in compliance | ||
| * with the License. You may obtain a copy of the License at | ||
| * | ||
| * http://www.apache.org/licenses/LICENSE-2.0 | ||
| * | ||
| * Unless required by applicable law or agreed to in writing, | ||
| * software distributed under the License is distributed on an | ||
| * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY | ||
| * KIND, either express or implied. See the License for the | ||
| * specific language governing permissions and limitations | ||
| * under the License. | ||
| */ | ||
| package org.apache.sshd.common.util.security; | ||
|
|
||
| import java.security.Provider; | ||
| import java.security.Security; | ||
| import java.util.HashMap; | ||
| import java.util.Map; | ||
|
|
||
| import org.apache.sshd.common.util.GenericUtils; | ||
|
|
||
| /** | ||
| * This is registrar ensures that even if other registrars are active, we still use the Java built-in security provider | ||
| * at least for some security entities. | ||
| * <p> | ||
| * The problem is that if the Bouncy Castle registrar is present and enabled, we'll end up using the Bouncy Castle | ||
| * implementations for just about anything. But not all Bouncy Castle versions have native implementations of the | ||
| * algorithms. If BC AES is used and is implemented in Java, performance will be very poor. SunJCE's AES uses native | ||
| * code and is much faster. | ||
| * </p> | ||
| * <p> | ||
| * If no Bouncy Castle is registered, this extra registrar will not have an effect. Like all registrars, this one can be | ||
| * disabled via a system property {@code org.apache.sshd.security.provider.SunJCEWrapper.enabled=false}. Note that this | ||
| * does <em>not</em> disable the fallback to the platform provider; it only disables this wrapper which can be used to | ||
| * force the use of the "SunJCE" standard Java provider even if some other registrar also supports an algorithm (and | ||
| * would thus normally be preferred). | ||
| * </p> | ||
| * <p> | ||
| * The registrar can be configured as usual. By default it has only the AES cipher and the SHA macs enabled, everything | ||
| * else is disabled. | ||
| * </p> | ||
| * | ||
| * @author <a href="mailto:[email protected]">Apache MINA SSHD Project</a> | ||
| */ | ||
| public class SunJCESecurityProviderRegistrar extends AbstractSecurityProviderRegistrar { | ||
|
|
||
| private final Map<String, String> defaultProperties = new HashMap<>(); | ||
|
|
||
| public SunJCESecurityProviderRegistrar() { | ||
| super("SunJCEWrapper"); | ||
| String baseName = getBasePropertyName(); | ||
| defaultProperties.put(baseName + ".Cipher", "AES"); | ||
| defaultProperties.put(baseName + ".Mac", "HmacSha1,HmacSha224,HmacSha256,HmacSha384,HmacSha512"); | ||
| } | ||
|
|
||
| @Override | ||
| public boolean isEnabled() { | ||
| if (!super.isEnabled()) { | ||
| return false; | ||
| } | ||
| return isSupported(); | ||
| } | ||
|
|
||
| @Override | ||
| public String getDefaultSecurityEntitySupportValue(Class<?> entityType) { | ||
| return ""; | ||
| } | ||
|
|
||
| @Override | ||
| public String getString(String name) { | ||
| String configured = super.getString(name); | ||
| if (GenericUtils.isEmpty(configured)) { | ||
| String byDefault = defaultProperties.get(name); | ||
| if (byDefault != null) { | ||
| return byDefault; | ||
| } | ||
| } | ||
| return configured; | ||
| } | ||
|
|
||
| @Override | ||
| public boolean isNamedProviderUsed() { | ||
| return false; | ||
| } | ||
|
|
||
| @Override | ||
| public Provider getSecurityProvider() { | ||
| return Security.getProvider("SunJCE"); | ||
| } | ||
|
|
||
| @Override | ||
| public boolean isSupported() { | ||
| return getSecurityProvider() != null; | ||
| } | ||
|
|
||
| } |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters