This is an automated email from the ASF dual-hosted git repository.
lidavidm pushed a commit to branch main
in repository https://gitbox.apache.org/repos/asf/arrow.git
The following commit(s) were added to refs/heads/main by this push:
new cd5a1bd259 GH-39014: [Java] Add default truststore along with
KeychainStore when on Mac system (#39235)
cd5a1bd259 is described below
commit cd5a1bd259a95eb9342569fb01d41a5924aec30f
Author: Ravjot Brar <[email protected]>
AuthorDate: Fri Dec 22 07:03:32 2023 -0800
GH-39014: [Java] Add default truststore along with KeychainStore when on
Mac system (#39235)
### Rationale for this change
As described in #39014, when using the system TrustStore on Mac, the
certificates returned do not include Root CAs trusted by the system. This
change adds the default KeyStore instance along with the KeyChainStore to
include trusted Root CAs. The reason we add the default KeyStore instance is
because there is no easy way to get the certificates from the System Roots
keychain.
### What changes are included in this PR?
I've updated ClientAuthenticationUtils to get the default KeyStore instance
when the operating system is macOS and have updated the tests to include this
change.
### Are these changes tested?
See changes made in ClientAuthenticationUtilsTest.java.
### Are there any user-facing changes?
No
* Closes: #39014
Authored-by: Ravjot Brar <[email protected]>
Signed-off-by: David Li <[email protected]>
---
.../client/utils/ClientAuthenticationUtils.java | 21 ++++++-----
.../utils/ClientAuthenticationUtilsTest.java | 42 ++++++++++++++++++++--
2 files changed, 51 insertions(+), 12 deletions(-)
diff --git
a/java/flight/flight-sql-jdbc-core/src/main/java/org/apache/arrow/driver/jdbc/client/utils/ClientAuthenticationUtils.java
b/java/flight/flight-sql-jdbc-core/src/main/java/org/apache/arrow/driver/jdbc/client/utils/ClientAuthenticationUtils.java
index d50dc385a6..ffb0048181 100644
---
a/java/flight/flight-sql-jdbc-core/src/main/java/org/apache/arrow/driver/jdbc/client/utils/ClientAuthenticationUtils.java
+++
b/java/flight/flight-sql-jdbc-core/src/main/java/org/apache/arrow/driver/jdbc/client/utils/ClientAuthenticationUtils.java
@@ -115,6 +115,16 @@ public final class ClientAuthenticationUtils {
return keyStore;
}
+ @VisibleForTesting
+ static KeyStore getDefaultKeyStoreInstance(String password)
+ throws KeyStoreException, CertificateException,
NoSuchAlgorithmException, IOException {
+ try (InputStream fileInputStream = getKeystoreInputStream()) {
+ KeyStore keyStore = KeyStore.getInstance(KeyStore.getDefaultType());
+ keyStore.load(fileInputStream, password == null ? null :
password.toCharArray());
+ return keyStore;
+ }
+ }
+
static String getOperatingSystem() {
return System.getProperty("os.name");
}
@@ -156,16 +166,9 @@ public final class ClientAuthenticationUtils {
keyStoreList.add(getKeyStoreInstance("Windows-MY"));
} else if (isMac()) {
keyStoreList.add(getKeyStoreInstance("KeychainStore"));
+ keyStoreList.add(getDefaultKeyStoreInstance(password));
} else {
- try (InputStream fileInputStream = getKeystoreInputStream()) {
- KeyStore keyStore = KeyStore.getInstance(KeyStore.getDefaultType());
- if (password == null) {
- keyStore.load(fileInputStream, null);
- } else {
- keyStore.load(fileInputStream, password.toCharArray());
- }
- keyStoreList.add(keyStore);
- }
+ keyStoreList.add(getDefaultKeyStoreInstance(password));
}
return getCertificatesInputStream(keyStoreList);
diff --git
a/java/flight/flight-sql-jdbc-core/src/test/java/org/apache/arrow/driver/jdbc/client/utils/ClientAuthenticationUtilsTest.java
b/java/flight/flight-sql-jdbc-core/src/test/java/org/apache/arrow/driver/jdbc/client/utils/ClientAuthenticationUtilsTest.java
index 27bba64587..b7977462e9 100644
---
a/java/flight/flight-sql-jdbc-core/src/test/java/org/apache/arrow/driver/jdbc/client/utils/ClientAuthenticationUtilsTest.java
+++
b/java/flight/flight-sql-jdbc-core/src/test/java/org/apache/arrow/driver/jdbc/client/utils/ClientAuthenticationUtilsTest.java
@@ -77,6 +77,33 @@ public class ClientAuthenticationUtilsTest {
}
}
+ @Test
+ public void testGetDefaultKeyStoreInstancePassword() throws IOException,
+ KeyStoreException, CertificateException, NoSuchAlgorithmException {
+ try (MockedStatic<KeyStore> keyStoreMockedStatic =
Mockito.mockStatic(KeyStore.class)) {
+
+ keyStoreMockedStatic
+ .when(() ->
ClientAuthenticationUtils.getDefaultKeyStoreInstance("changeit"))
+ .thenReturn(keyStoreMock);
+ KeyStore receiveKeyStore =
ClientAuthenticationUtils.getDefaultKeyStoreInstance("changeit");
+ Assert.assertEquals(receiveKeyStore, keyStoreMock);
+ }
+ }
+
+ @Test
+ public void testGetDefaultKeyStoreInstanceNoPassword() throws IOException,
+ KeyStoreException, CertificateException, NoSuchAlgorithmException {
+ try (MockedStatic<KeyStore> keyStoreMockedStatic =
Mockito.mockStatic(KeyStore.class)) {
+
+ keyStoreMockedStatic
+ .when(() ->
ClientAuthenticationUtils.getDefaultKeyStoreInstance(null))
+ .thenReturn(keyStoreMock);
+ KeyStore receiveKeyStore =
ClientAuthenticationUtils.getDefaultKeyStoreInstance(null);
+ Assert.assertEquals(receiveKeyStore, keyStoreMock);
+ }
+ }
+
+
@Test
public void testGetCertificateInputStreamFromMacSystem() throws IOException,
KeyStoreException, CertificateException, NoSuchAlgorithmException {
@@ -90,11 +117,18 @@ public class ClientAuthenticationUtilsTest {
keyStoreMockedStatic.when(() -> ClientAuthenticationUtils
.getKeyStoreInstance("KeychainStore"))
.thenReturn(keyStoreMock);
+ keyStoreMockedStatic.when(() -> ClientAuthenticationUtils
+ .getDefaultKeyStoreInstance("changeit"))
+ .thenReturn(keyStoreMock);
+ clientAuthenticationUtilsMockedStatic
+ .when(ClientAuthenticationUtils::getKeystoreInputStream)
+ .thenCallRealMethod();
+ keyStoreMockedStatic.when(KeyStore::getDefaultType).thenCallRealMethod();
keyStoreMockedStatic.when(() -> ClientAuthenticationUtils
.getCertificatesInputStream(Mockito.any()))
.thenReturn(mock);
- InputStream inputStream =
ClientAuthenticationUtils.getCertificateInputStreamFromSystem("test");
+ InputStream inputStream =
ClientAuthenticationUtils.getCertificateInputStreamFromSystem("changeit");
Assert.assertEquals(inputStream, mock);
}
}
@@ -136,9 +170,11 @@ public class ClientAuthenticationUtilsTest {
setOperatingSystemMock(clientAuthenticationUtilsMockedStatic, false,
false);
keyStoreMockedStatic.when(() -> ClientAuthenticationUtils
- .getCertificatesInputStream(Mockito.any()))
+ .getCertificatesInputStream(Mockito.any()))
.thenReturn(mock);
-
+ keyStoreMockedStatic.when(() -> ClientAuthenticationUtils
+ .getDefaultKeyStoreInstance(Mockito.any()))
+ .thenReturn(keyStoreMock);
clientAuthenticationUtilsMockedStatic
.when(ClientAuthenticationUtils::getKeystoreInputStream)
.thenCallRealMethod();
