ZOOKEEPER-4942: Add option to preserve JVM TLS certification revocation properties #2271
There are no files selected for viewing
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,40 @@ | ||
| package org.apache.zookeeper.common; | ||
|
|
||
| /** | ||
| * Represent True / False / System (unset/default) values. | ||
| * | ||
| */ | ||
| public enum TriState { | ||
| True, | ||
| False, | ||
| System; | ||
|
|
||
| /** | ||
| * @param value the string representation | ||
| * @return TriState.true if value equals "true" ignoring case, TriState.System | ||
| * if value equals "system", Tristate.False otherwise | ||
| */ | ||
| public static TriState parse(String value) { | ||
| if (value == null) { | ||
| return TriState.False; | ||
| } else if (value.equalsIgnoreCase("true")) { | ||
| return TriState.True; | ||
| } else if (value.equalsIgnoreCase("system")) { | ||
| return TriState.System; | ||
| } else { | ||
| return TriState.False; | ||
| } | ||
| } | ||
|
|
||
| public boolean isTrue() { | ||
| return this == TriState.True; | ||
| } | ||
|
|
||
| public boolean isFalse() { | ||
| return this == TriState.False; | ||
| } | ||
|
|
||
| public boolean isSystem() { | ||
| return this == TriState.System; | ||
| } | ||
| } |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
|
|
@@ -392,8 +392,8 @@ public SSLContextAndOptions createSSLContextAndOptionsFromConfig(ZKConfig config | |
| String trustStorePasswordProp = getPasswordFromConfigPropertyOrFile(config, sslTruststorePasswdProperty, sslTruststorePasswdPathProperty); | ||
| String trustStoreTypeProp = config.getProperty(sslTruststoreTypeProperty); | ||
|
|
||
| TriState sslCrlEnabled = config.getTriState(this.sslCrlEnabledProperty); | ||
| TriState sslOcspEnabled = config.getTriState(this.sslOcspEnabledProperty); | ||
| boolean sslServerHostnameVerificationEnabled = isServerHostnameVerificationEnabled(config); | ||
| boolean sslClientHostnameVerificationEnabled = isClientHostnameVerificationEnabled(config); | ||
| boolean fipsMode = getFipsMode(config); | ||
|
|
@@ -537,8 +537,8 @@ public static X509TrustManager createTrustManager( | |
| String trustStoreLocation, | ||
| String trustStorePassword, | ||
| String trustStoreTypeProp, | ||
| TriState crlEnabled, | ||
| TriState ocspEnabled, | ||
| final boolean serverHostnameVerificationEnabled, | ||
| final boolean clientHostnameVerificationEnabled, | ||
| final boolean fipsMode) throws TrustManagerException { | ||
|
|
@@ -548,17 +548,19 @@ public static X509TrustManager createTrustManager( | |
| try { | ||
| KeyStore ts = loadTrustStore(trustStoreLocation, trustStorePassword, trustStoreTypeProp); | ||
| PKIXBuilderParameters pbParams = new PKIXBuilderParameters(ts, new X509CertSelector()); | ||
| // Leave CRL/OCSP JVM global properties alone both are set to "system" (represented as null) | ||
| if (!crlEnabled.isSystem() || !ocspEnabled.isSystem()) { | ||
| if (crlEnabled.isTrue() || ocspEnabled.isTrue()) { | ||
| pbParams.setRevocationEnabled(true); | ||
| System.setProperty("com.sun.net.ssl.checkRevocation", "true"); | ||
| System.setProperty("com.sun.security.enableCRLDP", "true"); | ||
| if (ocspEnabled.isTrue()) { | ||
| Security.setProperty("ocsp.enable", "true"); | ||
| } | ||
| } else { | ||
| pbParams.setRevocationEnabled(false); | ||
| } | ||
|
Comment on lines
+552
to
+562
There was a problem hiding this comment. One question here: There was a problem hiding this comment. Doc:
There was a problem hiding this comment. I found the same docs, @anmolnar . The code agrees that this defaults to the value of "com.sun.net.ssl.checkRevocation". I think that's fine, the goal here is to use the JDK default settings. (Also note that I have slightly changed the logic in the current #2277 PR). |
||
| } | ||
| // Revocation checking is only supported with the PKIX algorithm | ||
| TrustManagerFactory tmf = TrustManagerFactory.getInstance("PKIX"); | ||
| tmf.init(new CertPathTrustManagerParameters(pbParams)); | ||
|
|
||
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Oops, something went wrong.
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
License header is missing.