(knox) branch master updated: KNOX-3326: Add TCPS support for Oracle DB (#1237)

[hanicz]

This is an automated email from the ASF dual-hosted git repository.

hanicz pushed a commit to branch master
in repository https://gitbox.apache.org/repos/asf/knox.git


The following commit(s) were added to refs/heads/master by this push:
     new 488e94a36 KNOX-3326: Add TCPS support for Oracle DB (#1237)
488e94a36 is described below

commit 488e94a361ce84e90666bee1a3741be545f74f1a
Author: hanicz <han...@users.noreply.github.com>
AuthorDate: Wed May 20 16:53:24 2026 +0200

    KNOX-3326: Add TCPS support for Oracle DB (#1237)
---
 .../knox/gateway/database/OracleDataSourceFactory.java  | 17 +++++++++++++++++
 .../knox/gateway/database/DataSourceProviderTest.java   | 17 +++++++++++++++++
 2 files changed, 34 insertions(+)

diff --git 
a/gateway-server/src/main/java/org/apache/knox/gateway/database/OracleDataSourceFactory.java
 
b/gateway-server/src/main/java/org/apache/knox/gateway/database/OracleDataSourceFactory.java
index f9f86764f..73a089502 100644
--- 
a/gateway-server/src/main/java/org/apache/knox/gateway/database/OracleDataSourceFactory.java
+++ 
b/gateway-server/src/main/java/org/apache/knox/gateway/database/OracleDataSourceFactory.java
@@ -51,6 +51,23 @@ public class OracleDataSourceFactory extends 
AbstractDataSourceFactory {
             oracleDataSource.setUser(dbUser);
             oracleDataSource.setPassword(dbPassword);
         }
+
+        configureSsl(gatewayConfig, aliasService, oracleDataSource);
+
         return oracleDataSource;
     }
+
+    private void configureSsl(GatewayConfig gatewayConfig, AliasService 
aliasService, oracle.jdbc.pool.OracleDataSource oracleDataSource) throws 
AliasServiceException, SQLException {
+        if (gatewayConfig.isDatabaseSslEnabled()) {
+            oracleDataSource.setNetworkProtocol("tcps");
+            if (gatewayConfig.verifyDatabaseSslServerCertificate()) {
+                
oracleDataSource.setConnectionProperty("javax.net.ssl.trustStore", 
gatewayConfig.getDatabaseSslTruststoreFileName());
+                
oracleDataSource.setConnectionProperty("javax.net.ssl.trustStoreType", "JKS");
+                final String truststorePassword = 
getDatabaseAlias(aliasService, DATABASE_TRUSTSTORE_PASSWORD_ALIAS_NAME);
+                if (truststorePassword != null) {
+                    
oracleDataSource.setConnectionProperty("javax.net.ssl.trustStorePassword", 
truststorePassword);
+                }
+            }
+        }
+    }
 }
diff --git 
a/gateway-server/src/test/java/org/apache/knox/gateway/database/DataSourceProviderTest.java
 
b/gateway-server/src/test/java/org/apache/knox/gateway/database/DataSourceProviderTest.java
index 2eead1652..59c7a423f 100644
--- 
a/gateway-server/src/test/java/org/apache/knox/gateway/database/DataSourceProviderTest.java
+++ 
b/gateway-server/src/test/java/org/apache/knox/gateway/database/DataSourceProviderTest.java
@@ -275,6 +275,22 @@ public class DataSourceProviderTest {
     EasyMock.verify(gatewayConfig);
   }
 
+  @Test
+  public void oracleDataSourceShouldHaveProperSslConnectionProperties() throws 
Exception {
+    final GatewayConfig gatewayConfig = 
EasyMock.createNiceMock(GatewayConfig.class);
+    final AliasService aliasService = 
EasyMock.createNiceMock(AliasService.class);
+    setBasicOracleExpectations(gatewayConfig, aliasService);
+    
EasyMock.expect(gatewayConfig.isDatabaseSslEnabled()).andReturn(true).anyTimes();
+    
EasyMock.expect(gatewayConfig.verifyDatabaseSslServerCertificate()).andReturn(true).anyTimes();
+    
EasyMock.expect(gatewayConfig.getDatabaseSslTruststoreFileName()).andReturn("/path/to/truststore").anyTimes();
+    EasyMock.replay(gatewayConfig, aliasService);
+    final OracleDataSource dataSource = (OracleDataSource) 
DataSourceProvider.getDataSource(gatewayConfig, aliasService);
+    assertEquals("tcps", dataSource.getNetworkProtocol());
+    assertEquals("/path/to/truststore", 
dataSource.getConnectionProperty("javax.net.ssl.trustStore"));
+    assertEquals("JKS", 
dataSource.getConnectionProperty("javax.net.ssl.trustStoreType"));
+    //Can't validate the truststore password because oracle datasource doesn't 
return it.
+  }
+
   private void setBasicOracleExpectations(GatewayConfig gatewayConfig, 
AliasService aliasService) throws AliasServiceException {
     
EasyMock.expect(gatewayConfig.getDatabaseType()).andReturn(DatabaseType.ORACLE.type()).anyTimes();
     
EasyMock.expect(gatewayConfig.getDatabaseHost()).andReturn("localhost").anyTimes();
@@ -282,5 +298,6 @@ public class DataSourceProviderTest {
     
EasyMock.expect(gatewayConfig.getDatabaseName()).andReturn("sampleDatabase");
     
EasyMock.expect(aliasService.getPasswordFromAliasForGateway(AbstractDataSourceFactory.DATABASE_USER_ALIAS_NAME)).andReturn("user".toCharArray()).anyTimes();
     
EasyMock.expect(aliasService.getPasswordFromAliasForGateway(AbstractDataSourceFactory.DATABASE_PASSWORD_ALIAS_NAME)).andReturn("password".toCharArray()).anyTimes();
+    
EasyMock.expect(aliasService.getPasswordFromAliasForGateway(AbstractDataSourceFactory.DATABASE_TRUSTSTORE_PASSWORD_ALIAS_NAME)).andReturn("ts_password".toCharArray()).anyTimes();
   }
 }