[DE-1010] SSL configuration properties (#611)

Author: rashtao

core/pom.xml

@@ -8,7 +8,7 @@
         <relativePath>../release-parent</relativePath>
         <groupId>com.arangodb</groupId>
         <artifactId>release-parent</artifactId>
-        <version>7.20.0</version>
+        <version>7.21.0-SNAPSHOT</version>
     </parent>
 
     <name>core</name>

core/src/main/java/com/arangodb/ArangoDB.java

@@ -356,6 +356,7 @@ public interface ArangoDB extends ArangoSerdeAccessor {
     /**
      * Reset the server log levels
      * Revert the server's log level settings to the values they had at startup, as determined by the startup options specified on the command-line, a configuration file, and the factory defaults.
+     *
      * @since ArangoDB 3.12
      */
     LogLevelEntity resetLogLevels(LogLevelOptions options);
@@ -484,6 +485,39 @@ public Builder useSsl(final Boolean useSsl) {
             return this;
         }
 
+        /**
+         * Sets the SSL certificate value as Base64 encoded String
+         *
+         * @param sslCertValue the SSL certificate value as Base64 encoded String
+         * @return {@link ArangoDB.Builder}
+         */
+        public Builder sslCertValue(final String sslCertValue) {
+            config.setSslCertValue(sslCertValue);
+            return this;
+        }
+
+        /**
+         * Sets the SSL Trust manager algorithm
+         *
+         * @param sslAlgorithm the name of the SSL Trust manager algorithm
+         * @return {@link ArangoDB.Builder}
+         */
+        public Builder sslAlgorithm(final String sslAlgorithm) {
+            config.setSslAlgorithm(sslAlgorithm);
+            return this;
+        }
+
+        /**
+         * Sets the SSLContext protocol, default: {@code TLS}
+         *
+         * @param sslProtocol the name of the SSLContext protocol
+         * @return {@link ArangoDB.Builder}
+         */
+        public Builder sslProtocol(final String sslProtocol) {
+            config.setSslProtocol(sslProtocol);
+            return this;
+        }
+
         /**
          * Sets the SSL context to be used when {@code true} is passed through {@link #useSsl(Boolean)}.
          *
@@ -716,6 +750,7 @@ public Builder compressionLevel(Integer level) {
 
         /**
          * Configuration specific for {@link com.arangodb.internal.net.ProtocolProvider}.
+         *
          * @return {@link ArangoDB.Builder}
          */
         public Builder protocolConfig(ProtocolConfig protocolConfig) {

core/src/main/java/com/arangodb/config/ArangoConfigProperties.java

@@ -19,6 +19,9 @@ public interface ArangoConfigProperties {
     String KEY_JWT = "jwt";
     String KEY_TIMEOUT = "timeout";
     String KEY_USE_SSL = "useSsl";
+    String KEY_SSL_CERT_VALUE = "sslCertValue";
+    String KEY_SSL_ALGORITHM = "sslAlgorithm";
+    String KEY_SSL_PROTOCOL = "sslProtocol";
     String KEY_VERIFY_HOST = "verifyHost";
     String KEY_CHUNK_SIZE = "chunkSize";
     String KEY_PIPELINING = "pipelining";
@@ -103,6 +106,18 @@ default Optional<Boolean> getUseSsl() {
         return Optional.empty();
     }
 
+    default Optional<String> getSslCertValue() {
+        return Optional.empty();
+    }
+
+    default Optional<String> getSslAlgorithm() {
+        return Optional.empty();
+    }
+
+    default Optional<String> getSslProtocol() {
+        return Optional.empty();
+    }
+
     default Optional<Boolean> getVerifyHost() {
         return Optional.empty();
     }

core/src/main/java/com/arangodb/internal/ArangoDefaults.java

@@ -48,6 +48,7 @@ public final class ArangoDefaults {
     public static final Integer DEFAULT_TIMEOUT = 0;
     public static final Long DEFAULT_CONNECTION_TTL_HTTP = 30_000L;
     public static final Boolean DEFAULT_USE_SSL = false;
+    public static final String DEFAULT_SSL_PROTOCOL = "TLS";
     public static final Boolean DEFAULT_VERIFY_HOST = true;
     public static final Integer DEFAULT_CHUNK_SIZE = 30_000;
     public static final Boolean DEFAULT_PIPELINING = false;

core/src/main/java/com/arangodb/internal/config/ArangoConfig.java

@@ -16,7 +16,12 @@
 import com.fasterxml.jackson.databind.Module;
 
 import javax.net.ssl.SSLContext;
+import javax.net.ssl.TrustManagerFactory;
+import java.io.ByteArrayInputStream;
 import java.lang.reflect.InvocationTargetException;
+import java.security.KeyStore;
+import java.security.cert.Certificate;
+import java.security.cert.CertificateFactory;
 import java.util.*;
 import java.util.concurrent.Executor;
 import java.util.stream.Collectors;
@@ -30,6 +35,9 @@ public class ArangoConfig {
     private String password;
     private String jwt;
     private Boolean useSsl;
+    private Optional<String> sslCertValue;
+    private Optional<String> sslAlgorithm;
+    private String sslProtocol;
     private SSLContext sslContext;
     private Boolean verifyHost;
     private Integer chunkSize;
@@ -69,6 +77,9 @@ public void loadProperties(final ArangoConfigProperties properties) {
         // FIXME: make jwt field Optional
         jwt = properties.getJwt().orElse(null);
         useSsl = properties.getUseSsl().orElse(ArangoDefaults.DEFAULT_USE_SSL);
+        sslCertValue = properties.getSslCertValue();
+        sslAlgorithm = properties.getSslAlgorithm();
+        sslProtocol = properties.getSslProtocol().orElse(ArangoDefaults.DEFAULT_SSL_PROTOCOL);
         verifyHost = properties.getVerifyHost().orElse(ArangoDefaults.DEFAULT_VERIFY_HOST);
         chunkSize = properties.getChunkSize().orElse(ArangoDefaults.DEFAULT_CHUNK_SIZE);
         pipelining = properties.getPipelining().orElse(ArangoDefaults.DEFAULT_PIPELINING);
@@ -151,7 +162,22 @@ public void setUseSsl(Boolean useSsl) {
         this.useSsl = useSsl;
     }
 
+    public void setSslCertValue(String sslCertValue) {
+        this.sslCertValue = Optional.ofNullable(sslCertValue);
+    }
+
+    public void setSslAlgorithm(String sslAlgorithm) {
+        this.sslAlgorithm = Optional.ofNullable(sslAlgorithm);
+    }
+
+    public void setSslProtocol(String sslProtocol) {
+        this.sslProtocol = sslProtocol;
+    }
+
     public SSLContext getSslContext() {
+        if (sslContext == null) {
+            sslContext = createSslContext();
+        }
         return sslContext;
     }
 
@@ -342,4 +368,26 @@ public ProtocolConfig getProtocolConfig() {
     public void setProtocolConfig(ProtocolConfig protocolConfig) {
         this.protocolConfig = protocolConfig;
     }
+
+    private SSLContext createSslContext() {
+        try {
+            if (sslCertValue.isPresent()) {
+                ByteArrayInputStream is = new ByteArrayInputStream(Base64.getDecoder().decode(sslCertValue.get()));
+                Certificate cert = CertificateFactory.getInstance("X.509").generateCertificate(is);
+                KeyStore ks = KeyStore.getInstance(KeyStore.getDefaultType());
+                ks.load(null);
+                ks.setCertificateEntry("arangodb", cert);
+                TrustManagerFactory tmf = TrustManagerFactory.getInstance(sslAlgorithm.orElseGet(TrustManagerFactory::getDefaultAlgorithm));
+                tmf.init(ks);
+                SSLContext sc = SSLContext.getInstance(sslProtocol);
+                sc.init(null, tmf.getTrustManagers(), null);
+                return sc;
+            } else {
+                return SSLContext.getDefault();
+            }
+        } catch (Exception e) {
+            throw new RuntimeException(e);
+        }
+    }
+
 }

core/src/main/java/com/arangodb/internal/config/ArangoConfigPropertiesImpl.java

@@ -109,6 +109,21 @@ public Optional<Boolean> getUseSsl() {
         return Optional.ofNullable(getProperty(KEY_USE_SSL)).map(Boolean::valueOf);
     }
 
+    @Override
+    public Optional<String> getSslCertValue() {
+        return Optional.ofNullable(getProperty(KEY_SSL_CERT_VALUE));
+    }
+
+    @Override
+    public Optional<String> getSslAlgorithm() {
+        return Optional.ofNullable(getProperty(KEY_SSL_ALGORITHM));
+    }
+
+    @Override
+    public Optional<String> getSslProtocol() {
+        return Optional.ofNullable(getProperty(KEY_SSL_PROTOCOL));
+    }
+
     @Override
     public Optional<Boolean> getVerifyHost() {
         return Optional.ofNullable(getProperty(KEY_VERIFY_HOST)).map(Boolean::valueOf);

driver/pom.xml

@@ -8,7 +8,7 @@
         <relativePath>../release-parent</relativePath>
         <groupId>com.arangodb</groupId>
         <artifactId>release-parent</artifactId>
-        <version>7.20.0</version>
+        <version>7.21.0-SNAPSHOT</version>
     </parent>
 
     <name>arangodb-java-driver</name>

http-protocol/pom.xml

@@ -8,7 +8,7 @@
         <relativePath>../release-parent</relativePath>
         <groupId>com.arangodb</groupId>
         <artifactId>release-parent</artifactId>
-        <version>7.20.0</version>
+        <version>7.21.0-SNAPSHOT</version>
     </parent>
 
     <name>http-protocol</name>

http-protocol/src/main/java/com/arangodb/http/HttpConnection.java

@@ -55,7 +55,6 @@
 import org.slf4j.LoggerFactory;
 
 import javax.net.ssl.SSLContext;
-import java.security.NoSuchAlgorithmException;
 import java.util.Collections;
 import java.util.Iterator;
 import java.util.Map.Entry;
@@ -169,17 +168,7 @@ private static String getUserAgent() {
         }
 
         if (Boolean.TRUE.equals(config.getUseSsl())) {
-            SSLContext ctx;
-            if (config.getSslContext() != null) {
-                ctx = config.getSslContext();
-            } else {
-                try {
-                    ctx = SSLContext.getDefault();
-                } catch (NoSuchAlgorithmException e) {
-                    throw ArangoDBException.of(e);
-                }
-            }
-
+            SSLContext ctx = config.getSslContext();
             webClientOptions
                     .setSsl(true)
                     .setUseAlpn(true)

jackson-serde-json/pom.xml

@@ -8,7 +8,7 @@
         <relativePath>../release-parent</relativePath>
         <groupId>com.arangodb</groupId>
         <artifactId>release-parent</artifactId>
-        <version>7.20.0</version>
+        <version>7.21.0-SNAPSHOT</version>
     </parent>
 
     <name>jackson-serde-json</name>