Class DefaultTlsSocketPlugin

java.lang.Object

org.mariadb.jdbc.plugin.tls.main.DefaultTlsSocketPlugin

All Implemented Interfaces:

TlsSocketPlugin

public class DefaultTlsSocketPlugin
extends Object
implements TlsSocketPlugin

Default TLS socket plugin

Nested Class Summary

Nested Classes

Modifier and Type	Class	Description
private static final class	DefaultTlsSocketPlugin.CachedTrust

Field Summary

Fields

Modifier and Type	Field	Description
private static final ConcurrentHashMap<String, KeyManager[]>	KEY_CACHE
private static final Logger	logger
private static final int	MAX_CACHE_SIZE
private static final ConcurrentHashMap<String, DefaultTlsSocketPlugin.CachedTrust>	TRUST_CACHE

Constructor Summary

Constructors

Constructor	Description
DefaultTlsSocketPlugin()

Method Summary

Modifier and Type	Method	Description
private static void	appendFile(StringBuilder sb, String value)
private static void	appendValue(StringBuilder sb, String value)
(package private) KeyManager[]	buildKeyManager(Configuration conf, ExceptionFactory exceptionFactory)
private DefaultTlsSocketPlugin.CachedTrust	buildTrust(Configuration conf, ExceptionFactory exceptionFactory, HostAddress hostAddress)
(package private) TrustManager[]	buildTrustManager(Configuration conf, ExceptionFactory exceptionFactory, HostAddress hostAddress)
private static boolean	cacheDisabled(Configuration conf)	Non-mapped option disableSslContextCache to disable the trust/key-manager cache and rebuild the managers on every connection.
private static String	freshnessToken(String value)	Freshness token for a store reference.
private static InputStream	getInputStreamFromPath(String path)
KeyManager[]	getKeyManager(Configuration conf, ExceptionFactory exceptionFactory)
TrustManager[]	getTrustManager(Configuration conf, ExceptionFactory exceptionFactory, HostAddress hostAddress)
private static String	keyCacheKey(Configuration conf)
private static KeyManager	loadClientCerts(String keyStoreUrl, String keyStorePassword, String keyPassword, String storeType, ExceptionFactory exceptionFactory)
private static InputStream	loadFromUrl(String keyStoreUrl)
private static String	sha256(String input)
private static File	toFile(String value)
private static String	trustCacheKey(Configuration conf, HostAddress hostAddress)	Cache key for the trust managers.
String	type()	plugin type.
void	verify(String host, SSLSession session, long serverThreadId)	Host name verifier implementation.
private static TrustManager[]	wrapTrust(DefaultTlsSocketPlugin.CachedTrust cachedTrust)	Wraps the cached base trust manager for a single connection: paths that defer identity validation to authentication get a fresh MariaDbX509DeferredIdentityTrustManager (so the captured fingerprint is per-connection state); other paths use the stateless base directly.

Methods inherited from class Object

clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait

Methods inherited from interface TlsSocketPlugin

createSocket, getSocketFactory

Field Details

logger

private static final Logger logger

TRUST_CACHE

private static final ConcurrentHashMap<String, DefaultTlsSocketPlugin.CachedTrust> TRUST_CACHE

KEY_CACHE

private static final ConcurrentHashMap<String, KeyManager[]> KEY_CACHE

MAX_CACHE_SIZE

private static final int MAX_CACHE_SIZE

See Also:

• Constant Field Values

Constructor Details

DefaultTlsSocketPlugin

public DefaultTlsSocketPlugin()

Method Details

cacheDisabled

private static boolean cacheDisabled(Configuration conf)

Non-mapped option disableSslContextCache to disable the trust/key-manager cache and rebuild the managers on every connection.

loadClientCerts

private static KeyManager loadClientCerts(String keyStoreUrl,
 String keyStorePassword,
 String keyPassword,
 String storeType,
 ExceptionFactory exceptionFactory)
                                   throws SQLException

Throws:

SQLException

loadFromUrl

private static InputStream loadFromUrl(String keyStoreUrl)
                                throws FileNotFoundException

Throws:

FileNotFoundException

getInputStreamFromPath

private static InputStream getInputStreamFromPath(String path)
                                           throws IOException

Throws:

IOException

type

public String type()

Description copied from interface: TlsSocketPlugin

plugin type.

Specified by:

type in interface TlsSocketPlugin

Returns:

plugin type

getTrustManager

public TrustManager[] getTrustManager(Configuration conf,
 ExceptionFactory exceptionFactory,
 HostAddress hostAddress)
                               throws SQLException

Specified by:

getTrustManager in interface TlsSocketPlugin

Throws:

SQLException

buildTrustManager

TrustManager[] buildTrustManager(Configuration conf,
 ExceptionFactory exceptionFactory,
 HostAddress hostAddress)
                          throws SQLException

Throws:

SQLException

wrapTrust

private static TrustManager[] wrapTrust(DefaultTlsSocketPlugin.CachedTrust cachedTrust)

Wraps the cached base trust manager for a single connection: paths that defer identity validation to authentication get a fresh MariaDbX509DeferredIdentityTrustManager (so the captured fingerprint is per-connection state); other paths use the stateless base directly.

buildTrust

private DefaultTlsSocketPlugin.CachedTrust buildTrust(Configuration conf,
 ExceptionFactory exceptionFactory,
 HostAddress hostAddress)
                                               throws SQLException

Throws:

SQLException

getKeyManager

public KeyManager[] getKeyManager(Configuration conf,
 ExceptionFactory exceptionFactory)
                           throws SQLException

Specified by:

getKeyManager in interface TlsSocketPlugin

Throws:

SQLException

buildKeyManager

KeyManager[] buildKeyManager(Configuration conf,
 ExceptionFactory exceptionFactory)
                      throws SQLException

Throws:

SQLException

trustCacheKey

private static String trustCacheKey(Configuration conf,
 HostAddress hostAddress)

Cache key for the trust managers. The options read by buildTrustManager(Configuration, ExceptionFactory, HostAddress). A store referenced by a file path contributes a freshness token (last-modified + length) so replacing it on disk forces a rebuild. The system trust store used by the fallback path is identified by the javax.net.ssl.trustStore property (+ token). The key is hashed so that store passwords are not retained as plain text in a long-lived map.

keyCacheKey

private static String keyCacheKey(Configuration conf)

appendValue

private static void appendValue(StringBuilder sb,
 String value)

appendFile

private static void appendFile(StringBuilder sb,
 String value)

freshnessToken

private static String freshnessToken(String value)

Freshness token for a store reference. For a local file it is last-modified + length, so an on-disk replacement invalidates the cache. Inline PEM is its own token (content addressed). Remote/classpath references cannot be checked cheaply and are tracked by their string only.

toFile

private static File toFile(String value)

sha256

private static String sha256(String input)

verify

public void verify(String host,
 SSLSession session,
 long serverThreadId)
            throws SSLException

Description copied from interface: TlsSocketPlugin

Host name verifier implementation.

Specified by:

verify in interface TlsSocketPlugin

Parameters:

host - hostname

session - ssl session

serverThreadId - current server threadId

Throws:

SSLException - if verification fail