Changeset: 2fee4b71baac for monetdb-java
URL: https://dev.monetdb.org/hg/monetdb-java/rev/2fee4b71baac
Modified Files:
src/main/java/org/monetdb/mcl/net/SecureSocket.java
tests/TLSTester.java
Branch: monetdbs
Log Message:
Set ALPN protocol if the runtime supports it
(Use introspection because Java 8 can't do it)
diffs (134 lines):
diff --git a/src/main/java/org/monetdb/mcl/net/SecureSocket.java
b/src/main/java/org/monetdb/mcl/net/SecureSocket.java
--- a/src/main/java/org/monetdb/mcl/net/SecureSocket.java
+++ b/src/main/java/org/monetdb/mcl/net/SecureSocket.java
@@ -3,17 +3,18 @@ package org.monetdb.mcl.net;
import javax.net.ssl.*;
import java.io.FileInputStream;
import java.io.IOException;
+import java.lang.reflect.InvocationTargetException;
+import java.lang.reflect.Method;
import java.net.Socket;
import java.security.*;
import java.security.cert.CertificateException;
import java.security.cert.CertificateFactory;
import java.security.cert.X509Certificate;
import java.util.Collections;
-import java.util.List;
public class SecureSocket {
private static final String[] ENABLED_PROTOCOLS = {"TLSv1.3"};
- final String[] APPLICATION_PROTOCOLS = {"mapi/9"};
+ private static final String[] APPLICATION_PROTOCOLS = {"mapi/9"};
public static Socket wrap(Target.Validated validated, Socket inner) throws
IOException {
Target.Verify verify = validated.connectVerify();
@@ -43,17 +44,26 @@ public class SecureSocket {
private static SSLSocket wrapSocket(Socket inner, Target.Validated
validated, SSLSocketFactory socketFactory, boolean checkName) throws
IOException {
SSLSocket sock = (SSLSocket) socketFactory.createSocket(inner,
validated.connectTcp(), validated.connectPort(), true);
+ sock.setUseClientMode(true);
+ SSLParameters parameters = sock.getSSLParameters();
- sock.setUseClientMode(true);
- sock.setEnabledProtocols(ENABLED_PROTOCOLS);
+ parameters.setProtocols(ENABLED_PROTOCOLS);
+
+ parameters.setServerNames(Collections.singletonList(new
SNIHostName(validated.connectTcp())));
if (checkName) {
- SSLParameters parameters = sock.getSSLParameters();
- SNIServerName serverName = new SNIHostName(validated.connectTcp());
- parameters.setServerNames(Collections.singletonList(serverName));
parameters.setEndpointIdentificationAlgorithm("HTTPS");
- sock.setSSLParameters(parameters);
}
+
+ // Unfortunately, SSLParameters.setApplicationProtocols is only
available
+ // since language level 9 and currently we're on 8.
+ // Still call it if it happens to be available.
+ try {
+ Method setApplicationProtocols =
SSLParameters.class.getMethod("setApplicationProtocols", String[].class);
+ setApplicationProtocols.invoke(parameters, (Object)
APPLICATION_PROTOCOLS);
+ } catch (IllegalAccessException | InvocationTargetException |
NoSuchMethodException ignored) {}
+
+ sock.setSSLParameters(parameters);
sock.startHandshake();
return sock;
}
diff --git a/tests/TLSTester.java b/tests/TLSTester.java
--- a/tests/TLSTester.java
+++ b/tests/TLSTester.java
@@ -9,7 +9,9 @@ import java.sql.Connection;
import java.sql.DriverManager;
import java.sql.SQLException;
import java.util.HashMap;
+import java.util.HashSet;
import java.util.Properties;
+import java.util.stream.Collectors;
public class TLSTester {
int verbose = 0;
@@ -19,6 +21,7 @@ public class TLSTester {
boolean enableTrusted = false;
File tempDir = null;
final HashMap<String, File> fileCache = new HashMap<>();
+ private HashSet<String> preparedButNotRun = new HashSet<>();
public TLSTester(String[] args) {
for (int i = 0; i < args.length; i++) {
@@ -133,9 +136,15 @@ public class TLSTester {
test_fail_tls_to_plain();
test_fail_plain_to_tls();
test_connect_server_name();
-// test_connect_alpn_mapi9();
+ test_connect_alpn_mapi9();
test_connect_trusted();
test_refuse_trusted_wrong_host();
+
+ // did we forget to call expectSucceed and expectFailure somewhere?
+ if (!preparedButNotRun.isEmpty()) {
+ String names = String.join(", ", preparedButNotRun);
+ throw new RuntimeException("Not all tests called
expectSuccess/expectFailure: " + names);
+ }
}
private void test_connect_plain() throws IOException, SQLException {
@@ -202,24 +211,27 @@ public class TLSTester {
}
private void test_connect_alpn_mapi9() throws IOException, SQLException {
- attempt("connect_alpn_mapi9", "");
+ attempt("connect_alpn_mapi9", "alpn_mapi9")
+ .withFile(Parameter.CERT, "/ca1.crt")
+ .expectSuccess();
}
private void test_connect_trusted() throws IOException, SQLException {
- attempt("connect_trusted", "alpn_mapi9")
+ attempt("connect_trusted", null)
.with(Parameter.HOST, "monetdb.ergates.nl")
.with(Parameter.PORT, 50000)
.expectSuccess();
}
private void test_refuse_trusted_wrong_host() throws IOException,
SQLException {
- attempt("connect_trusted", null)
+ attempt("test_refuse_trusted_wrong_host", null)
.with(Parameter.HOST, "monetdbxyz.ergates.nl")
.with(Parameter.PORT, 50000)
.expectFailure("No subject alternative DNS name");
}
private Attempt attempt(String testName, String portName) throws
IOException {
+ preparedButNotRun.add(testName);
return new Attempt(testName, portName);
}
@@ -268,6 +280,7 @@ public class TLSTester {
}
public void expectSuccess() throws SQLException {
+ preparedButNotRun.remove(testName);
if (disabled)
return;
try {
_______________________________________________
checkin-list mailing list -- [email protected]
To unsubscribe send an email to [email protected]
