org.postgresql.ssl.MakeSSL Maven / Gradle / Ivy

Go to download
Show more of this group Show more artifacts with this name
Show all versions of mogdb-jdbc Show documentation
Java JDBC driver for MogDB
There is a newer version: 5.0.0.9.pg
/*
 * Copyright (c) 2004, PostgreSQL Global Development Group
 * See the LICENSE file in the project root for more information.
 */

package io.mogdb.ssl;

import io.mogdb.PGProperty;
import io.mogdb.core.PGStream;
import io.mogdb.core.SocketFactoryFactory;
import io.mogdb.jdbc.SslMode;
import io.mogdb.util.GT;
import io.mogdb.util.ObjectFactory;
import io.mogdb.util.PSQLException;
import io.mogdb.util.PSQLState;
import io.mogdb.log.Logger;
import io.mogdb.log.Log;

import java.io.IOException;
import java.util.Properties;
import javax.net.ssl.HostnameVerifier;
import javax.net.ssl.SSLSocket;
import javax.net.ssl.SSLSocketFactory;

public class MakeSSL extends ObjectFactory {

  private static Log LOGGER = Logger.getLogger(MakeSSL.class.getName());

  public static void convert(PGStream stream, Properties info)
      throws PSQLException, IOException {
    LOGGER.debug("converting regular socket connection to ssl");

    SSLSocketFactory factory = SocketFactoryFactory.getSslSocketFactory(info);
    SSLSocket newConnection;
    try {
      newConnection = (SSLSocket) factory.createSocket(stream.getSocket(),
          stream.getHostSpec().getHost(), stream.getHostSpec().getPort(), true);
      // We must invoke manually, otherwise the exceptions are hidden
      newConnection.setUseClientMode(true);

      //set supported Cipher suites before SSL handshake
      String[] suppoertedCiphersSuites = getSupportedCiphersSuites(info);
      if (suppoertedCiphersSuites != null) {
          newConnection.setEnabledCipherSuites(suppoertedCiphersSuites);
      }

      newConnection.startHandshake();
    } catch (IOException ex) {
      throw new PSQLException(GT.tr("SSL error: {0}", ex.getMessage()),
          PSQLState.CONNECTION_FAILURE, ex);
    }
    if (factory instanceof LibPQFactory) { // throw any KeyManager exception
      ((LibPQFactory) factory).throwKeyManagerException();
    }

    SslMode sslMode = SslMode.of(info);
    if (sslMode.verifyPeerName()) {
      verifyPeerName(stream, info, newConnection);
    }

    stream.changeSocket(newConnection);
  }

  private static String[] getSupportedCiphersSuites(Properties info) {
	  String supportedSSLCipherSuites = PGProperty.TLS_CIPHERS_SUPPERTED.get(info);
	  return supportedSSLCipherSuites.split(",");
  }

  private static void verifyPeerName(PGStream stream, Properties info, SSLSocket newConnection)
      throws PSQLException {
    HostnameVerifier hvn;
    String sslhostnameverifier = PGProperty.SSL_HOSTNAME_VERIFIER.get(info);
    if (sslhostnameverifier == null) {
      hvn = PGjdbcHostnameVerifier.INSTANCE;
      sslhostnameverifier = "PgjdbcHostnameVerifier";
    } else {
      try {
        hvn = instantiate(HostnameVerifier.class, sslhostnameverifier, info, false, null);
      } catch (Exception e) {
        throw new PSQLException(
            GT.tr("The HostnameVerifier class provided {0} could not be instantiated.",
                sslhostnameverifier),
            PSQLState.CONNECTION_FAILURE, e);
      }
    }

    if (hvn.verify(stream.getHostSpec().getHost(), newConnection.getSession())) {
      return;
    }

    throw new PSQLException(
        GT.tr("The hostname {0} could not be verified by hostnameverifier {1}.",
            stream.getHostSpec().getHost(), sslhostnameverifier),
        PSQLState.CONNECTION_FAILURE);
  }

}