Package org.mariadb.jdbc.plugin.tls.main

Class DefaultTlsSocketPlugin

java.lang.Object

org.mariadb.jdbc.plugin.tls.main.DefaultTlsSocketPlugin

All Implemented Interfaces:

TlsSocketPlugin

public class DefaultTlsSocketPlugin
extends java.lang.Object
implements TlsSocketPlugin

Default TLS socket plugin

Nested Class Summary

Nested Classes

Modifier and Type	Class	Description
private static class	DefaultTlsSocketPlugin.CachedTrust

Field Summary

Fields

Modifier and Type	Field	Description
private static java.util.concurrent.ConcurrentHashMap<java.lang.String,javax.net.ssl.KeyManager[]>	KEY_CACHE
private static Logger	logger
private static int	MAX_CACHE_SIZE
private static java.util.concurrent.ConcurrentHashMap<java.lang.String,DefaultTlsSocketPlugin.CachedTrust>	TRUST_CACHE

Constructor Summary

Constructors

Constructor	Description
DefaultTlsSocketPlugin()

Method Summary

Modifier and Type	Method	Description
private static void	appendFile(java.lang.StringBuilder sb, java.lang.String value)
private static void	appendValue(java.lang.StringBuilder sb, java.lang.String value)
(package private) javax.net.ssl.KeyManager[]	buildKeyManager(Configuration conf, ExceptionFactory exceptionFactory)
private DefaultTlsSocketPlugin.CachedTrust	buildTrust(Configuration conf, ExceptionFactory exceptionFactory, HostAddress hostAddress)
(package private) javax.net.ssl.TrustManager[]	buildTrustManager(Configuration conf, ExceptionFactory exceptionFactory, HostAddress hostAddress)
private static boolean	cacheDisabled(Configuration conf)	Non-mapped option disableSslContextCache to disable the trust/key-manager cache and rebuild the managers on every connection.
private static java.lang.String	freshnessToken(java.lang.String value)	Freshness token for a store reference.
private static java.io.InputStream	getInputStreamFromPath(java.lang.String path)
javax.net.ssl.KeyManager[]	getKeyManager(Configuration conf, ExceptionFactory exceptionFactory)
javax.net.ssl.TrustManager[]	getTrustManager(Configuration conf, ExceptionFactory exceptionFactory, HostAddress hostAddress)
private static java.lang.String	keyCacheKey(Configuration conf)
private static javax.net.ssl.KeyManager	loadClientCerts(java.lang.String keyStoreUrl, java.lang.String keyStorePassword, java.lang.String keyPassword, java.lang.String storeType, ExceptionFactory exceptionFactory)
private static java.io.InputStream	loadFromUrl(java.lang.String keyStoreUrl)
private static java.lang.String	sha256(java.lang.String input)
private static java.io.File	toFile(java.lang.String value)
private static java.lang.String	trustCacheKey(Configuration conf, HostAddress hostAddress)	Cache key for the trust managers.
java.lang.String	type()	plugin type.
void	verify(java.lang.String host, javax.net.ssl.SSLSession session, long serverThreadId)	Host name verifier implementation.
private static javax.net.ssl.TrustManager[]	wrapTrust(DefaultTlsSocketPlugin.CachedTrust cachedTrust)	Wraps the cached base trust manager for a single connection: paths that defer identity validation to authentication get a fresh MariaDbX509DeferredIdentityTrustManager (so the captured fingerprint is per-connection state); other paths use the stateless base directly.

Methods inherited from class java.lang.Object

clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait

Methods inherited from interface org.mariadb.jdbc.plugin.TlsSocketPlugin

createSocket, getSocketFactory

Field Detail

logger

private static final Logger logger

TRUST_CACHE

private static final java.util.concurrent.ConcurrentHashMap<java.lang.String,DefaultTlsSocketPlugin.CachedTrust> TRUST_CACHE

KEY_CACHE

private static final java.util.concurrent.ConcurrentHashMap<java.lang.String,javax.net.ssl.KeyManager[]> KEY_CACHE

MAX_CACHE_SIZE

private static final int MAX_CACHE_SIZE

See Also:

Constant Field Values

Constructor Detail

DefaultTlsSocketPlugin

public DefaultTlsSocketPlugin()

Method Detail

cacheDisabled

private static boolean cacheDisabled(Configuration conf)

Non-mapped option disableSslContextCache to disable the trust/key-manager cache and rebuild the managers on every connection.

loadClientCerts

private static javax.net.ssl.KeyManager loadClientCerts(java.lang.String keyStoreUrl,
                                                        java.lang.String keyStorePassword,
                                                        java.lang.String keyPassword,
                                                        java.lang.String storeType,
                                                        ExceptionFactory exceptionFactory)
                                                 throws java.sql.SQLException

Throws:

java.sql.SQLException

loadFromUrl

private static java.io.InputStream loadFromUrl(java.lang.String keyStoreUrl)
                                        throws java.io.FileNotFoundException

Throws:

java.io.FileNotFoundException

getInputStreamFromPath

private static java.io.InputStream getInputStreamFromPath(java.lang.String path)
                                                   throws java.io.IOException

Throws:

java.io.IOException

type

public java.lang.String type()

Description copied from interface: TlsSocketPlugin

plugin type.

Specified by:

type in interface TlsSocketPlugin

Returns:

plugin type

getTrustManager

public javax.net.ssl.TrustManager[] getTrustManager(Configuration conf,
                                                    ExceptionFactory exceptionFactory,
                                                    HostAddress hostAddress)
                                             throws java.sql.SQLException

Specified by:

getTrustManager in interface TlsSocketPlugin

Throws:

java.sql.SQLException

buildTrustManager

javax.net.ssl.TrustManager[] buildTrustManager(Configuration conf,
                                               ExceptionFactory exceptionFactory,
                                               HostAddress hostAddress)
                                        throws java.sql.SQLException

Throws:

java.sql.SQLException

wrapTrust

private static javax.net.ssl.TrustManager[] wrapTrust(DefaultTlsSocketPlugin.CachedTrust cachedTrust)

Wraps the cached base trust manager for a single connection: paths that defer identity validation to authentication get a fresh MariaDbX509DeferredIdentityTrustManager (so the captured fingerprint is per-connection state); other paths use the stateless base directly.

buildTrust

private DefaultTlsSocketPlugin.CachedTrust buildTrust(Configuration conf,
                                                      ExceptionFactory exceptionFactory,
                                                      HostAddress hostAddress)
                                               throws java.sql.SQLException

Throws:

java.sql.SQLException

getKeyManager

public javax.net.ssl.KeyManager[] getKeyManager(Configuration conf,
                                                ExceptionFactory exceptionFactory)
                                         throws java.sql.SQLException

Specified by:

getKeyManager in interface TlsSocketPlugin

Throws:

java.sql.SQLException

buildKeyManager

javax.net.ssl.KeyManager[] buildKeyManager(Configuration conf,
                                           ExceptionFactory exceptionFactory)
                                    throws java.sql.SQLException

Throws:

java.sql.SQLException

trustCacheKey

private static java.lang.String trustCacheKey(Configuration conf,
                                              HostAddress hostAddress)

Cache key for the trust managers. The options read by buildTrustManager(org.mariadb.jdbc.Configuration, org.mariadb.jdbc.export.ExceptionFactory, org.mariadb.jdbc.HostAddress). A store referenced by a file path contributes a freshness token (last-modified + length) so replacing it on disk forces a rebuild. The system trust store used by the fallback path is identified by the javax.net.ssl.trustStore property (+ token). The key is hashed so that store passwords are not retained as plain text in a long-lived map.

keyCacheKey

private static java.lang.String keyCacheKey(Configuration conf)

appendValue

private static void appendValue(java.lang.StringBuilder sb,
                                java.lang.String value)

appendFile

private static void appendFile(java.lang.StringBuilder sb,
                               java.lang.String value)

freshnessToken

private static java.lang.String freshnessToken(java.lang.String value)

Freshness token for a store reference. For a local file it is last-modified + length, so an on-disk replacement invalidates the cache. Inline PEM is its own token (content addressed). Remote/classpath references cannot be checked cheaply and are tracked by their string only.

toFile

private static java.io.File toFile(java.lang.String value)

sha256

private static java.lang.String sha256(java.lang.String input)

verify

public void verify(java.lang.String host,
                   javax.net.ssl.SSLSession session,
                   long serverThreadId)
            throws javax.net.ssl.SSLException

Description copied from interface: TlsSocketPlugin

Host name verifier implementation.

Specified by:

verify in interface TlsSocketPlugin

Parameters:

host - hostname

session - ssl session

serverThreadId - current server threadId

Throws:

javax.net.ssl.SSLException - if verification fail