This is an automated email from the ASF dual-hosted git repository.
hanicz pushed a commit to branch master
in repository https://gitbox.apache.org/repos/asf/knox.git
The following commit(s) were added to refs/heads/master by this push:
new 810abcd04 KNOX-3329: New database truststore type config (#1246)
810abcd04 is described below
commit 810abcd046ddb04b5f936b3708df6c9e63ff4a37
Author: hanicz <[email protected]>
AuthorDate: Tue Jun 2 15:19:26 2026 +0200
KNOX-3329: New database truststore type config (#1246)
---
.../gateway/config/impl/GatewayConfigImpl.java | 6 ++++++
.../gateway/database/MysqlDataSourceFactory.java | 2 +-
.../gateway/database/OracleDataSourceFactory.java | 2 +-
.../gateway/database/DataSourceProviderTest.java | 23 +++++++++++++++++++++-
.../org/apache/knox/gateway/GatewayTestConfig.java | 11 +++++++++++
.../apache/knox/gateway/config/GatewayConfig.java | 2 ++
6 files changed, 43 insertions(+), 3 deletions(-)
diff --git
a/gateway-server/src/main/java/org/apache/knox/gateway/config/impl/GatewayConfigImpl.java
b/gateway-server/src/main/java/org/apache/knox/gateway/config/impl/GatewayConfigImpl.java
index 79c67f5a2..68dfbd6b2 100644
---
a/gateway-server/src/main/java/org/apache/knox/gateway/config/impl/GatewayConfigImpl.java
+++
b/gateway-server/src/main/java/org/apache/knox/gateway/config/impl/GatewayConfigImpl.java
@@ -353,6 +353,7 @@ public class GatewayConfigImpl extends Configuration
implements GatewayConfig {
private static final String GATEWAY_DATABASE_SSL_ENABLED =
GATEWAY_CONFIG_FILE_PREFIX + ".database.ssl.enabled";
private static final String GATEWAY_DATABASE_VERIFY_SERVER_CERT =
GATEWAY_CONFIG_FILE_PREFIX + ".database.ssl.verify.server.cert";
private static final String GATEWAY_DATABASE_TRUSTSTORE_FILE =
GATEWAY_CONFIG_FILE_PREFIX + ".database.ssl.truststore.file";
+ private static final String GATEWAY_DATABASE_SSL_TRUSTSTORE_TYPE =
GATEWAY_CONFIG_FILE_PREFIX + ".database.ssl.truststore.type";
// Concurrent session properties
private static final String GATEWAY_SESSION_VERIFICATION_PREFIX =
GATEWAY_CONFIG_FILE_PREFIX + ".session.verification";
@@ -1541,6 +1542,11 @@ public class GatewayConfigImpl extends Configuration
implements GatewayConfig {
return get(GATEWAY_DATABASE_TRUSTSTORE_FILE);
}
+ @Override
+ public String getDatabaseSslTruststoreType() {
+ return get(GATEWAY_DATABASE_SSL_TRUSTSTORE_TYPE, "JKS");
+ }
+
@Override
public int getJettyMaxFormContentSize() {
return getInt(JETTY_MAX_FORM_CONTENT_SIZE,
ContextHandler.DEFAULT_MAX_FORM_CONTENT_SIZE);
diff --git
a/gateway-server/src/main/java/org/apache/knox/gateway/database/MysqlDataSourceFactory.java
b/gateway-server/src/main/java/org/apache/knox/gateway/database/MysqlDataSourceFactory.java
index 55c003f3c..a42b9afed 100644
---
a/gateway-server/src/main/java/org/apache/knox/gateway/database/MysqlDataSourceFactory.java
+++
b/gateway-server/src/main/java/org/apache/knox/gateway/database/MysqlDataSourceFactory.java
@@ -49,7 +49,7 @@ public class MysqlDataSourceFactory extends
AbstractDataSourceFactory {
if (gatewayConfig.verifyDatabaseSslServerCertificate()) {
dataSource.setSslMode(PropertyDefinitions.SslMode.VERIFY_CA.name());
dataSource.setVerifyServerCertificate(true);
- dataSource.setTrustCertificateKeyStoreType("JKS");
+
dataSource.setTrustCertificateKeyStoreType(gatewayConfig.getDatabaseSslTruststoreType());
dataSource.setTrustCertificateKeyStoreUrl("file:" +
gatewayConfig.getDatabaseSslTruststoreFileName());
dataSource.setTrustCertificateKeyStorePassword(getDatabaseAlias(aliasService,
DATABASE_TRUSTSTORE_PASSWORD_ALIAS_NAME));
} else {
diff --git
a/gateway-server/src/main/java/org/apache/knox/gateway/database/OracleDataSourceFactory.java
b/gateway-server/src/main/java/org/apache/knox/gateway/database/OracleDataSourceFactory.java
index 73a089502..2a20ce009 100644
---
a/gateway-server/src/main/java/org/apache/knox/gateway/database/OracleDataSourceFactory.java
+++
b/gateway-server/src/main/java/org/apache/knox/gateway/database/OracleDataSourceFactory.java
@@ -62,7 +62,7 @@ public class OracleDataSourceFactory extends
AbstractDataSourceFactory {
oracleDataSource.setNetworkProtocol("tcps");
if (gatewayConfig.verifyDatabaseSslServerCertificate()) {
oracleDataSource.setConnectionProperty("javax.net.ssl.trustStore",
gatewayConfig.getDatabaseSslTruststoreFileName());
-
oracleDataSource.setConnectionProperty("javax.net.ssl.trustStoreType", "JKS");
+
oracleDataSource.setConnectionProperty("javax.net.ssl.trustStoreType",
gatewayConfig.getDatabaseSslTruststoreType());
final String truststorePassword =
getDatabaseAlias(aliasService, DATABASE_TRUSTSTORE_PASSWORD_ALIAS_NAME);
if (truststorePassword != null) {
oracleDataSource.setConnectionProperty("javax.net.ssl.trustStorePassword",
truststorePassword);
diff --git
a/gateway-server/src/test/java/org/apache/knox/gateway/database/DataSourceProviderTest.java
b/gateway-server/src/test/java/org/apache/knox/gateway/database/DataSourceProviderTest.java
index 59c7a423f..5d333b850 100644
---
a/gateway-server/src/test/java/org/apache/knox/gateway/database/DataSourceProviderTest.java
+++
b/gateway-server/src/test/java/org/apache/knox/gateway/database/DataSourceProviderTest.java
@@ -184,6 +184,26 @@ public class DataSourceProviderTest {
EasyMock.verify(gatewayConfig);
}
+ @Test
+ public void mysqlDataSourceShouldHaveProperSslConnectionProperties() throws
Exception {
+ GatewayConfig gatewayConfig = EasyMock.createNiceMock(GatewayConfig.class);
+ AliasService aliasService = EasyMock.createNiceMock(AliasService.class);
+
EasyMock.expect(gatewayConfig.getDatabaseType()).andReturn(DatabaseType.MYSQL.type()).anyTimes();
+
EasyMock.expect(gatewayConfig.getDatabaseHost()).andReturn("localhost").anyTimes();
+
EasyMock.expect(gatewayConfig.getDatabasePort()).andReturn(3306).anyTimes();
+
EasyMock.expect(gatewayConfig.getDatabaseName()).andReturn("sampleDatabase");
+
EasyMock.expect(gatewayConfig.isDatabaseSslEnabled()).andReturn(true).anyTimes();
+
EasyMock.expect(gatewayConfig.verifyDatabaseSslServerCertificate()).andReturn(true).anyTimes();
+
EasyMock.expect(gatewayConfig.getDatabaseSslTruststoreFileName()).andReturn("/path/to/truststore").anyTimes();
+
EasyMock.expect(gatewayConfig.getDatabaseSslTruststoreType()).andReturn("BCFKS").anyTimes();
+
+ EasyMock.replay(gatewayConfig, aliasService);
+ MysqlDataSource dataSource = (MysqlDataSource)
DataSourceProvider.getDataSource(gatewayConfig, aliasService);
+ assertTrue(dataSource.getUseSSL());
+ assertEquals("BCFKS", dataSource.getTrustCertificateKeyStoreType());
+ assertEquals("file:/path/to/truststore",
dataSource.getTrustCertificateKeyStoreUrl());
+ }
+
@Test
public void testGetMySqlDatasourceFromJdbcConnectionUrl() throws Exception {
String connectionUrl =
"jdbc:mysql://mysql_host:1234/testDb?user=user&password=secret&ssl=true&sslmode=verify-ca&sslrootcert=/var/lib/knox/gateway/conf/postgresql/root.crt";
@@ -283,11 +303,12 @@ public class DataSourceProviderTest {
EasyMock.expect(gatewayConfig.isDatabaseSslEnabled()).andReturn(true).anyTimes();
EasyMock.expect(gatewayConfig.verifyDatabaseSslServerCertificate()).andReturn(true).anyTimes();
EasyMock.expect(gatewayConfig.getDatabaseSslTruststoreFileName()).andReturn("/path/to/truststore").anyTimes();
+
EasyMock.expect(gatewayConfig.getDatabaseSslTruststoreType()).andReturn("BCFKS").anyTimes();
EasyMock.replay(gatewayConfig, aliasService);
final OracleDataSource dataSource = (OracleDataSource)
DataSourceProvider.getDataSource(gatewayConfig, aliasService);
assertEquals("tcps", dataSource.getNetworkProtocol());
assertEquals("/path/to/truststore",
dataSource.getConnectionProperty("javax.net.ssl.trustStore"));
- assertEquals("JKS",
dataSource.getConnectionProperty("javax.net.ssl.trustStoreType"));
+ assertEquals("BCFKS",
dataSource.getConnectionProperty("javax.net.ssl.trustStoreType"));
//Can't validate the truststore password because oracle datasource doesn't
return it.
}
diff --git
a/gateway-spi-common/src/main/java/org/apache/knox/gateway/GatewayTestConfig.java
b/gateway-spi-common/src/main/java/org/apache/knox/gateway/GatewayTestConfig.java
index 8a55d3736..ec22c1dc9 100644
---
a/gateway-spi-common/src/main/java/org/apache/knox/gateway/GatewayTestConfig.java
+++
b/gateway-spi-common/src/main/java/org/apache/knox/gateway/GatewayTestConfig.java
@@ -76,6 +76,8 @@ public class GatewayTestConfig extends Configuration
implements GatewayConfig {
private boolean sslEnabled;
private String truststoreType = "jks";
private String keystoreType = "jks";
+ private String databaseSslTruststoreType = "JKS";
+
private boolean isTopologyPortMappingEnabled = true;
private ConcurrentMap<String, Integer> topologyPortMapping = new
ConcurrentHashMap<>();
private int backupVersionLimit = -1;
@@ -364,6 +366,11 @@ public class GatewayTestConfig extends Configuration
implements GatewayConfig {
return truststoreType;
}
+ @Override
+ public String getDatabaseSslTruststoreType() {
+ return databaseSslTruststoreType;
+ }
+
@Override
public String getTruststorePasswordAlias() {
return null;
@@ -373,6 +380,10 @@ public class GatewayTestConfig extends Configuration
implements GatewayConfig {
this.truststoreType = truststoreType;
}
+ public void setDatabaseSslTruststoreType(String databaseSslTruststoreType) {
+ this.databaseSslTruststoreType = databaseSslTruststoreType;
+ }
+
@Override
public String getKeystoreType() {
return keystoreType;
diff --git
a/gateway-spi/src/main/java/org/apache/knox/gateway/config/GatewayConfig.java
b/gateway-spi/src/main/java/org/apache/knox/gateway/config/GatewayConfig.java
index a3c62e011..cc174f62a 100644
---
a/gateway-spi/src/main/java/org/apache/knox/gateway/config/GatewayConfig.java
+++
b/gateway-spi/src/main/java/org/apache/knox/gateway/config/GatewayConfig.java
@@ -233,6 +233,8 @@ public interface GatewayConfig {
String getTruststoreType();
+ String getDatabaseSslTruststoreType();
+
/**
* Returns the configured value for the alias name to use when to looking up
the Gateway's
* truststore password.
