Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Configure SSL for unauthenticated client #24595

Merged
merged 2 commits into from
Dec 31, 2024
+34 −33
Merged

Configure SSL for unauthenticated client #24595

Changes from 1 commit
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
21889ef
Configure SSL for unauthenticated client
wendigo Dec 30, 2024
70c7620
Simplify conditions
wendigo Dec 30, 2024
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
68 changes: 35 additions & 33 deletions client/trino-client/src/main/java/io/trino/client/uri/HttpClientFactory.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -54,45 +54,13 @@ public static OkHttpClient.Builder toHttpClientBuilder(TrinoUri uri, String user
OkHttpClient.Builder builder = unauthenticatedClientBuilder(uri, userAgent);
setupCookieJar(builder);

if (!uri.isUseSecureConnection()) {
setupInsecureSsl(builder);
}

if (uri.hasPassword()) {
if (!uri.isUseSecureConnection()) {
throw new RuntimeException("TLS/SSL is required for authentication with username and password");
}
builder.addNetworkInterceptor(basicAuth(uri.getRequiredUser(), uri.getPassword().orElseThrow(() -> new RuntimeException("Password expected"))));
}

if (uri.isUseSecureConnection()) {
ConnectionProperties.SslVerificationMode sslVerificationMode = uri.getSslVerification();
if (sslVerificationMode.equals(FULL) || sslVerificationMode.equals(CA)) {
setupSsl(
builder,
uri.getSslKeyStorePath(),
uri.getSslKeyStorePassword(),
uri.getSslKeyStoreType(),
uri.getSslUseSystemKeyStore(),
uri.getSslTrustStorePath(),
uri.getSslTrustStorePassword(),
uri.getSslTrustStoreType(),
uri.getSslUseSystemTrustStore());
}
if (sslVerificationMode.equals(FULL)) {
uri.getHostnameInCertificate().ifPresent(certHostname ->
setupAlternateHostnameVerification(builder, certHostname));
}

if (sslVerificationMode.equals(CA)) {
builder.hostnameVerifier((hostname, session) -> true);
}

if (sslVerificationMode.equals(NONE)) {
setupInsecureSsl(builder);
}
}

if (uri.getKerberosRemoteServiceName().isPresent()) {
if (!uri.isUseSecureConnection()) {
throw new RuntimeException("TLS/SSL is required for Kerberos authentication");
Expand Down Expand Up @@ -145,7 +113,6 @@ public static OkHttpClient.Builder toHttpClientBuilder(TrinoUri uri, String user
builder.addNetworkInterceptor(authenticator);
}

uri.getDnsResolver().ifPresent(resolverClass -> builder.dns(instantiateDnsResolver(resolverClass, uri.getDnsResolverContext())::lookup));
return builder;
}

Expand All @@ -157,6 +124,41 @@ public static OkHttpClient.Builder unauthenticatedClientBuilder(TrinoUri uri, St
setupHttpProxy(builder, uri.getHttpProxy());
setupTimeouts(builder, toIntExact(uri.getTimeout().toMillis()), TimeUnit.MILLISECONDS);
setupHttpLogging(builder, uri.getHttpLoggingLevel());

if (!uri.isUseSecureConnection()) {
setupInsecureSsl(builder);
}

if (uri.isUseSecureConnection()) {
wendigo marked this conversation as resolved.
Show resolved Hide resolved
wendigo marked this conversation as resolved.
Show resolved Hide resolved
ConnectionProperties.SslVerificationMode sslVerificationMode = uri.getSslVerification();
if (sslVerificationMode.equals(FULL) || sslVerificationMode.equals(CA)) {
setupSsl(
builder,
uri.getSslKeyStorePath(),
uri.getSslKeyStorePassword(),
uri.getSslKeyStoreType(),
uri.getSslUseSystemKeyStore(),
uri.getSslTrustStorePath(),
uri.getSslTrustStorePassword(),
uri.getSslTrustStoreType(),
uri.getSslUseSystemTrustStore());
}
if (sslVerificationMode.equals(FULL)) {
uri.getHostnameInCertificate().ifPresent(certHostname ->
setupAlternateHostnameVerification(builder, certHostname));
}

if (sslVerificationMode.equals(CA)) {
builder.hostnameVerifier((hostname, session) -> true);
}

if (sslVerificationMode.equals(NONE)) {
setupInsecureSsl(builder);
}
}

uri.getDnsResolver().ifPresent(resolverClass -> builder.dns(instantiateDnsResolver(resolverClass, uri.getDnsResolverContext())::lookup));

return builder;
}

Expand Down
Loading