fix(deps): replace bouncycastle jdk15on with jdk18on 1.85 (#4312)

Co-authored-by: aias00 <liuhongyu@apache.org>

hertzbeat-collector/hertzbeat-collector-basic/pom.xml

@@ -151,8 +151,8 @@
         <!--Bouncy Castle-->
         <dependency>
             <groupId>org.bouncycastle</groupId>
-            <artifactId>bcpkix-jdk15on</artifactId>
-            <version>1.68</version>
+            <artifactId>bcpkix-jdk18on</artifactId>
+            <version>${bouncycastle.version}</version>
         </dependency>
 
 

hertzbeat-collector/hertzbeat-collector-basic/src/test/java/org/apache/hertzbeat/collector/collect/mqtt/MqttSslFactoryTest.java

@@ -0,0 +1,88 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one or more
+ * contributor license agreements.  See the NOTICE file distributed with
+ * this work for additional information regarding copyright ownership.
+ * The ASF licenses this file to You under the Apache License, Version 2.0
+ * (the "License"); you may not use this file except in compliance with
+ * the License.  You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package org.apache.hertzbeat.collector.collect.mqtt;
+
+import static org.junit.jupiter.api.Assertions.assertNotNull;
+
+import java.io.StringWriter;
+import java.math.BigInteger;
+import java.security.KeyPair;
+import java.security.KeyPairGenerator;
+import java.security.cert.X509Certificate;
+import java.util.Date;
+import org.apache.hertzbeat.common.entity.job.protocol.MqttProtocol;
+import org.bouncycastle.asn1.x500.X500Name;
+import org.bouncycastle.cert.jcajce.JcaX509CertificateConverter;
+import org.bouncycastle.cert.jcajce.JcaX509v3CertificateBuilder;
+import org.bouncycastle.openssl.jcajce.JcaPEMWriter;
+import org.bouncycastle.openssl.jcajce.JcaPKCS8Generator;
+import org.bouncycastle.operator.jcajce.JcaContentSignerBuilder;
+import org.junit.jupiter.api.BeforeAll;
+import org.junit.jupiter.api.Test;
+
+class MqttSslFactoryTest {
+
+    private static String certPem;
+    private static String pkcs1KeyPem;
+    private static String pkcs8KeyPem;
+
+    @BeforeAll
+    static void generateCertAndKeys() throws Exception {
+        KeyPairGenerator generator = KeyPairGenerator.getInstance("RSA");
+        generator.initialize(2048);
+        KeyPair keyPair = generator.generateKeyPair();
+        X500Name subject = new X500Name("CN=hb-3540-mqtt");
+        JcaX509v3CertificateBuilder certBuilder = new JcaX509v3CertificateBuilder(
+                subject, BigInteger.ONE,
+                new Date(System.currentTimeMillis() - 60_000),
+                new Date(System.currentTimeMillis() + 3_600_000),
+                subject, keyPair.getPublic());
+        X509Certificate cert = new JcaX509CertificateConverter()
+                .getCertificate(certBuilder.build(new JcaContentSignerBuilder("SHA256withRSA").build(keyPair.getPrivate())));
+
+        certPem = writePem(cert);
+        pkcs1KeyPem = writePem(keyPair.getPrivate());
+        pkcs8KeyPem = writePem(new JcaPKCS8Generator(keyPair.getPrivate(), null));
+    }
+
+    @Test
+    void parsesPkcs1ClientKey() {
+        assertNotNull(MqttSslFactory.getMslSocketFactory(mqttProtocol(pkcs1KeyPem), true));
+    }
+
+    @Test
+    void parsesPkcs8ClientKey() {
+        assertNotNull(MqttSslFactory.getMslSocketFactory(mqttProtocol(pkcs8KeyPem), true));
+    }
+
+    private static MqttProtocol mqttProtocol(String clientKey) {
+        return MqttProtocol.builder()
+                .tlsVersion("TLSv1.2")
+                .clientCert(certPem)
+                .clientKey(clientKey)
+                .build();
+    }
+
+    private static String writePem(Object object) throws Exception {
+        StringWriter out = new StringWriter();
+        try (JcaPEMWriter writer = new JcaPEMWriter(out)) {
+            writer.writeObject(object);
+        }
+        return out.toString();
+    }
+}

hertzbeat-collector/hertzbeat-collector-nebulagraph/pom.xml

@@ -54,7 +54,20 @@
                     <groupId>com.alibaba</groupId>
                     <artifactId>fastjson</artifactId>
                 </exclusion>
+                <exclusion>
+                    <groupId>org.bouncycastle</groupId>
+                    <artifactId>bcpkix-jdk15on</artifactId>
+                </exclusion>
+                <exclusion>
+                    <groupId>org.bouncycastle</groupId>
+                    <artifactId>bcprov-jdk15on</artifactId>
+                </exclusion>
             </exclusions>
         </dependency>
+        <dependency>
+            <groupId>org.bouncycastle</groupId>
+            <artifactId>bcpkix-jdk18on</artifactId>
+            <version>${bouncycastle.version}</version>
+        </dependency>
     </dependencies>
 </project>

hertzbeat-collector/hertzbeat-collector-nebulagraph/src/test/java/org/apache/hertzbeat/collector/collect/nebulagraph/VesoftSslBouncyCastleSmokeTest.java

@@ -0,0 +1,67 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one or more
+ * contributor license agreements.  See the NOTICE file distributed with
+ * this work for additional information regarding copyright ownership.
+ * The ASF licenses this file to You under the Apache License, Version 2.0
+ * (the "License"); you may not use this file except in compliance with
+ * the License.  You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package org.apache.hertzbeat.collector.collect.nebulagraph;
+
+import static org.junit.jupiter.api.Assertions.assertNotNull;
+
+import com.vesoft.nebula.client.graph.data.CASignedSSLParam;
+import com.vesoft.nebula.util.SslUtil;
+import java.io.FileWriter;
+import java.math.BigInteger;
+import java.nio.file.Path;
+import java.security.KeyPair;
+import java.security.KeyPairGenerator;
+import java.security.cert.X509Certificate;
+import java.util.Date;
+import org.bouncycastle.asn1.x500.X500Name;
+import org.bouncycastle.cert.jcajce.JcaX509CertificateConverter;
+import org.bouncycastle.cert.jcajce.JcaX509v3CertificateBuilder;
+import org.bouncycastle.openssl.jcajce.JcaPEMWriter;
+import org.bouncycastle.operator.jcajce.JcaContentSignerBuilder;
+import org.junit.jupiter.api.Test;
+import org.junit.jupiter.api.io.TempDir;
+
+class VesoftSslBouncyCastleSmokeTest {
+
+    @Test
+    void vesoftSslUtilWorksWithBouncyCastleJdk18on(@TempDir Path dir) throws Exception {
+        KeyPairGenerator generator = KeyPairGenerator.getInstance("RSA");
+        generator.initialize(2048);
+        KeyPair keyPair = generator.generateKeyPair();
+        X500Name subject = new X500Name("CN=hb-3540-smoke");
+        JcaX509v3CertificateBuilder certBuilder = new JcaX509v3CertificateBuilder(
+                subject, BigInteger.ONE,
+                new Date(System.currentTimeMillis() - 60_000),
+                new Date(System.currentTimeMillis() + 3_600_000),
+                subject, keyPair.getPublic());
+        X509Certificate cert = new JcaX509CertificateConverter()
+                .getCertificate(certBuilder.build(new JcaContentSignerBuilder("SHA256withRSA").build(keyPair.getPrivate())));
+
+        Path crt = dir.resolve("smoke.crt");
+        Path key = dir.resolve("smoke.key");
+        try (JcaPEMWriter writer = new JcaPEMWriter(new FileWriter(crt.toFile()))) {
+            writer.writeObject(cert);
+        }
+        try (JcaPEMWriter writer = new JcaPEMWriter(new FileWriter(key.toFile()))) {
+            writer.writeObject(keyPair.getPrivate());
+        }
+
+        CASignedSSLParam param = new CASignedSSLParam(crt.toString(), crt.toString(), key.toString());
+        assertNotNull(SslUtil.getSSLSocketFactoryWithCA(param));
+    }
+}

material/licenses/LICENSE

@@ -525,9 +525,9 @@ The following components are provided under the MIT License. See project link fo
 The text of each license is also included in licenses/LICENSE-[project].txt.
 
     https://mvnrepository.com/artifact/com.microsoft.sqlserver/mssql-jdbc/10.2.0.jre8 MIT
-    https://mvnrepository.com/artifact/org.bouncycastle/bcpkix-jdk15on/1.69 MIT
-    https://mvnrepository.com/artifact/org.bouncycastle/bcprov-jdk15on/1.69 MIT
-    https://mvnrepository.com/artifact/org.bouncycastle/bcutil-jdk15on/1.69 MIT
+    https://mvnrepository.com/artifact/org.bouncycastle/bcpkix-jdk18on/1.85 MIT
+    https://mvnrepository.com/artifact/org.bouncycastle/bcprov-jdk18on/1.85 MIT
+    https://mvnrepository.com/artifact/org.bouncycastle/bcutil-jdk18on/1.85 MIT
     https://mvnrepository.com/artifact/org.checkerframework/checker-qual/3.33.0 MIT
     https://mvnrepository.com/artifact/org.codehaus.mojo/animal-sniffer-annotations/1.21 MIT
     https://mvnrepository.com/artifact/org.influxdb/influxdb-java/2.23 MIT

material/licenses/backend/LICENSE

@@ -524,9 +524,9 @@ The following components are provided under the MIT License. See project link fo
 The text of each license is also included in licenses/LICENSE-[project].txt.
 
     https://mvnrepository.com/artifact/com.microsoft.sqlserver/mssql-jdbc/10.2.0.jre8 MIT
-    https://mvnrepository.com/artifact/org.bouncycastle/bcpkix-jdk15on/1.69 MIT
-    https://mvnrepository.com/artifact/org.bouncycastle/bcprov-jdk15on/1.69 MIT
-    https://mvnrepository.com/artifact/org.bouncycastle/bcutil-jdk15on/1.69 MIT
+    https://mvnrepository.com/artifact/org.bouncycastle/bcpkix-jdk18on/1.85 MIT
+    https://mvnrepository.com/artifact/org.bouncycastle/bcprov-jdk18on/1.85 MIT
+    https://mvnrepository.com/artifact/org.bouncycastle/bcutil-jdk18on/1.85 MIT
     https://mvnrepository.com/artifact/org.checkerframework/checker-qual/3.33.0 MIT
     https://mvnrepository.com/artifact/org.codehaus.mojo/animal-sniffer-annotations/1.21 MIT
     https://mvnrepository.com/artifact/org.influxdb/influxdb-java/2.23 MIT

material/licenses/collector/LICENSE

@@ -396,9 +396,9 @@ The following components are provided under the MIT License. See project link fo
 The text of each license is also included in licenses/LICENSE-[project].txt.
 
     https://mvnrepository.com/artifact/com.microsoft.sqlserver/mssql-jdbc/10.2.0.jre8 MIT
-    https://mvnrepository.com/artifact/org.bouncycastle/bcpkix-jdk15on/1.69 MIT
-    https://mvnrepository.com/artifact/org.bouncycastle/bcprov-jdk15on/1.69 MIT
-    https://mvnrepository.com/artifact/org.bouncycastle/bcutil-jdk15on/1.69 MIT
+    https://mvnrepository.com/artifact/org.bouncycastle/bcpkix-jdk18on/1.85 MIT
+    https://mvnrepository.com/artifact/org.bouncycastle/bcprov-jdk18on/1.85 MIT
+    https://mvnrepository.com/artifact/org.bouncycastle/bcutil-jdk18on/1.85 MIT
     https://mvnrepository.com/artifact/org.checkerframework/checker-qual/3.33.0 MIT
     https://mvnrepository.com/artifact/org.slf4j/jcl-over-slf4j/2.0.9 MIT
     https://mvnrepository.com/artifact/org.slf4j/jul-to-slf4j/2.0.9 MIT

pom.xml

@@ -165,6 +165,7 @@
         <consul-api.version>1.4.5</consul-api.version>
         <nacos-client.version>3.1.1</nacos-client.version>
         <vesoft-client.version>3.6.0</vesoft-client.version>
+        <bouncycastle.version>1.85</bouncycastle.version>
         <jutf7.version>1.0.0</jutf7.version>
         <huawei.sdk.version>3.1.37</huawei.sdk.version>
         <huawei.obs.version>3.23.5</huawei.obs.version>