This is an automated email from the ASF dual-hosted git repository. smolnar82 pushed a commit to branch knox_idf in repository https://gitbox.apache.org/repos/asf/knox.git
commit f6472b2fd141645d5f62e604976ecd96dc0f44f4 Author: hanicz <[email protected]> AuthorDate: Tue Jun 2 15:19:26 2026 +0200 KNOX-3329: New database truststore type config (#1246) --- .../gateway/config/impl/GatewayConfigImpl.java | 6 ++++++ .../gateway/database/MysqlDataSourceFactory.java | 2 +- .../gateway/database/OracleDataSourceFactory.java | 2 +- .../gateway/database/DataSourceProviderTest.java | 23 +++++++++++++++++++++- .../org/apache/knox/gateway/GatewayTestConfig.java | 11 +++++++++++ .../apache/knox/gateway/config/GatewayConfig.java | 2 ++ 6 files changed, 43 insertions(+), 3 deletions(-) diff --git a/gateway-server/src/main/java/org/apache/knox/gateway/config/impl/GatewayConfigImpl.java b/gateway-server/src/main/java/org/apache/knox/gateway/config/impl/GatewayConfigImpl.java index 79c67f5a2..68dfbd6b2 100644 --- a/gateway-server/src/main/java/org/apache/knox/gateway/config/impl/GatewayConfigImpl.java +++ b/gateway-server/src/main/java/org/apache/knox/gateway/config/impl/GatewayConfigImpl.java @@ -353,6 +353,7 @@ public class GatewayConfigImpl extends Configuration implements GatewayConfig { private static final String GATEWAY_DATABASE_SSL_ENABLED = GATEWAY_CONFIG_FILE_PREFIX + ".database.ssl.enabled"; private static final String GATEWAY_DATABASE_VERIFY_SERVER_CERT = GATEWAY_CONFIG_FILE_PREFIX + ".database.ssl.verify.server.cert"; private static final String GATEWAY_DATABASE_TRUSTSTORE_FILE = GATEWAY_CONFIG_FILE_PREFIX + ".database.ssl.truststore.file"; + private static final String GATEWAY_DATABASE_SSL_TRUSTSTORE_TYPE = GATEWAY_CONFIG_FILE_PREFIX + ".database.ssl.truststore.type"; // Concurrent session properties private static final String GATEWAY_SESSION_VERIFICATION_PREFIX = GATEWAY_CONFIG_FILE_PREFIX + ".session.verification"; @@ -1541,6 +1542,11 @@ public class GatewayConfigImpl extends Configuration implements GatewayConfig { return get(GATEWAY_DATABASE_TRUSTSTORE_FILE); } + @Override + public String getDatabaseSslTruststoreType() { + return get(GATEWAY_DATABASE_SSL_TRUSTSTORE_TYPE, "JKS"); + } + @Override public int getJettyMaxFormContentSize() { return getInt(JETTY_MAX_FORM_CONTENT_SIZE, ContextHandler.DEFAULT_MAX_FORM_CONTENT_SIZE); diff --git a/gateway-server/src/main/java/org/apache/knox/gateway/database/MysqlDataSourceFactory.java b/gateway-server/src/main/java/org/apache/knox/gateway/database/MysqlDataSourceFactory.java index 55c003f3c..a42b9afed 100644 --- a/gateway-server/src/main/java/org/apache/knox/gateway/database/MysqlDataSourceFactory.java +++ b/gateway-server/src/main/java/org/apache/knox/gateway/database/MysqlDataSourceFactory.java @@ -49,7 +49,7 @@ public class MysqlDataSourceFactory extends AbstractDataSourceFactory { if (gatewayConfig.verifyDatabaseSslServerCertificate()) { dataSource.setSslMode(PropertyDefinitions.SslMode.VERIFY_CA.name()); dataSource.setVerifyServerCertificate(true); - dataSource.setTrustCertificateKeyStoreType("JKS"); + dataSource.setTrustCertificateKeyStoreType(gatewayConfig.getDatabaseSslTruststoreType()); dataSource.setTrustCertificateKeyStoreUrl("file:" + gatewayConfig.getDatabaseSslTruststoreFileName()); dataSource.setTrustCertificateKeyStorePassword(getDatabaseAlias(aliasService, DATABASE_TRUSTSTORE_PASSWORD_ALIAS_NAME)); } else { diff --git a/gateway-server/src/main/java/org/apache/knox/gateway/database/OracleDataSourceFactory.java b/gateway-server/src/main/java/org/apache/knox/gateway/database/OracleDataSourceFactory.java index 73a089502..2a20ce009 100644 --- a/gateway-server/src/main/java/org/apache/knox/gateway/database/OracleDataSourceFactory.java +++ b/gateway-server/src/main/java/org/apache/knox/gateway/database/OracleDataSourceFactory.java @@ -62,7 +62,7 @@ public class OracleDataSourceFactory extends AbstractDataSourceFactory { oracleDataSource.setNetworkProtocol("tcps"); if (gatewayConfig.verifyDatabaseSslServerCertificate()) { oracleDataSource.setConnectionProperty("javax.net.ssl.trustStore", gatewayConfig.getDatabaseSslTruststoreFileName()); - oracleDataSource.setConnectionProperty("javax.net.ssl.trustStoreType", "JKS"); + oracleDataSource.setConnectionProperty("javax.net.ssl.trustStoreType", gatewayConfig.getDatabaseSslTruststoreType()); final String truststorePassword = getDatabaseAlias(aliasService, DATABASE_TRUSTSTORE_PASSWORD_ALIAS_NAME); if (truststorePassword != null) { oracleDataSource.setConnectionProperty("javax.net.ssl.trustStorePassword", truststorePassword); diff --git a/gateway-server/src/test/java/org/apache/knox/gateway/database/DataSourceProviderTest.java b/gateway-server/src/test/java/org/apache/knox/gateway/database/DataSourceProviderTest.java index 59c7a423f..5d333b850 100644 --- a/gateway-server/src/test/java/org/apache/knox/gateway/database/DataSourceProviderTest.java +++ b/gateway-server/src/test/java/org/apache/knox/gateway/database/DataSourceProviderTest.java @@ -184,6 +184,26 @@ public class DataSourceProviderTest { EasyMock.verify(gatewayConfig); } + @Test + public void mysqlDataSourceShouldHaveProperSslConnectionProperties() throws Exception { + GatewayConfig gatewayConfig = EasyMock.createNiceMock(GatewayConfig.class); + AliasService aliasService = EasyMock.createNiceMock(AliasService.class); + EasyMock.expect(gatewayConfig.getDatabaseType()).andReturn(DatabaseType.MYSQL.type()).anyTimes(); + EasyMock.expect(gatewayConfig.getDatabaseHost()).andReturn("localhost").anyTimes(); + EasyMock.expect(gatewayConfig.getDatabasePort()).andReturn(3306).anyTimes(); + EasyMock.expect(gatewayConfig.getDatabaseName()).andReturn("sampleDatabase"); + EasyMock.expect(gatewayConfig.isDatabaseSslEnabled()).andReturn(true).anyTimes(); + EasyMock.expect(gatewayConfig.verifyDatabaseSslServerCertificate()).andReturn(true).anyTimes(); + EasyMock.expect(gatewayConfig.getDatabaseSslTruststoreFileName()).andReturn("/path/to/truststore").anyTimes(); + EasyMock.expect(gatewayConfig.getDatabaseSslTruststoreType()).andReturn("BCFKS").anyTimes(); + + EasyMock.replay(gatewayConfig, aliasService); + MysqlDataSource dataSource = (MysqlDataSource) DataSourceProvider.getDataSource(gatewayConfig, aliasService); + assertTrue(dataSource.getUseSSL()); + assertEquals("BCFKS", dataSource.getTrustCertificateKeyStoreType()); + assertEquals("file:/path/to/truststore", dataSource.getTrustCertificateKeyStoreUrl()); + } + @Test public void testGetMySqlDatasourceFromJdbcConnectionUrl() throws Exception { String connectionUrl = "jdbc:mysql://mysql_host:1234/testDb?user=user&password=secret&ssl=true&sslmode=verify-ca&sslrootcert=/var/lib/knox/gateway/conf/postgresql/root.crt"; @@ -283,11 +303,12 @@ public class DataSourceProviderTest { EasyMock.expect(gatewayConfig.isDatabaseSslEnabled()).andReturn(true).anyTimes(); EasyMock.expect(gatewayConfig.verifyDatabaseSslServerCertificate()).andReturn(true).anyTimes(); EasyMock.expect(gatewayConfig.getDatabaseSslTruststoreFileName()).andReturn("/path/to/truststore").anyTimes(); + EasyMock.expect(gatewayConfig.getDatabaseSslTruststoreType()).andReturn("BCFKS").anyTimes(); EasyMock.replay(gatewayConfig, aliasService); final OracleDataSource dataSource = (OracleDataSource) DataSourceProvider.getDataSource(gatewayConfig, aliasService); assertEquals("tcps", dataSource.getNetworkProtocol()); assertEquals("/path/to/truststore", dataSource.getConnectionProperty("javax.net.ssl.trustStore")); - assertEquals("JKS", dataSource.getConnectionProperty("javax.net.ssl.trustStoreType")); + assertEquals("BCFKS", dataSource.getConnectionProperty("javax.net.ssl.trustStoreType")); //Can't validate the truststore password because oracle datasource doesn't return it. } diff --git a/gateway-spi-common/src/main/java/org/apache/knox/gateway/GatewayTestConfig.java b/gateway-spi-common/src/main/java/org/apache/knox/gateway/GatewayTestConfig.java index 8a55d3736..ec22c1dc9 100644 --- a/gateway-spi-common/src/main/java/org/apache/knox/gateway/GatewayTestConfig.java +++ b/gateway-spi-common/src/main/java/org/apache/knox/gateway/GatewayTestConfig.java @@ -76,6 +76,8 @@ public class GatewayTestConfig extends Configuration implements GatewayConfig { private boolean sslEnabled; private String truststoreType = "jks"; private String keystoreType = "jks"; + private String databaseSslTruststoreType = "JKS"; + private boolean isTopologyPortMappingEnabled = true; private ConcurrentMap<String, Integer> topologyPortMapping = new ConcurrentHashMap<>(); private int backupVersionLimit = -1; @@ -364,6 +366,11 @@ public class GatewayTestConfig extends Configuration implements GatewayConfig { return truststoreType; } + @Override + public String getDatabaseSslTruststoreType() { + return databaseSslTruststoreType; + } + @Override public String getTruststorePasswordAlias() { return null; @@ -373,6 +380,10 @@ public class GatewayTestConfig extends Configuration implements GatewayConfig { this.truststoreType = truststoreType; } + public void setDatabaseSslTruststoreType(String databaseSslTruststoreType) { + this.databaseSslTruststoreType = databaseSslTruststoreType; + } + @Override public String getKeystoreType() { return keystoreType; diff --git a/gateway-spi/src/main/java/org/apache/knox/gateway/config/GatewayConfig.java b/gateway-spi/src/main/java/org/apache/knox/gateway/config/GatewayConfig.java index a3c62e011..cc174f62a 100644 --- a/gateway-spi/src/main/java/org/apache/knox/gateway/config/GatewayConfig.java +++ b/gateway-spi/src/main/java/org/apache/knox/gateway/config/GatewayConfig.java @@ -233,6 +233,8 @@ public interface GatewayConfig { String getTruststoreType(); + String getDatabaseSslTruststoreType(); + /** * Returns the configured value for the alias name to use when to looking up the Gateway's * truststore password.
