Merge branch '06/10/26/certs_as_string' into 06/10/26/ssl_modes

Author: chernser

.github/workflows/analysis.yml

@@ -1,4 +1,4 @@
-name: Analysis
+name: Coverage
 
 on:
   push:
@@ -94,13 +94,13 @@ jobs:
           find . -type f -name "simplelogger.*" -exec rm -fv '{}' \;
           mvn -q --no-transfer-progress --batch-mode -DclickhouseVersion=$PREFERRED_LTS_VERSION \
             -DskipTests install
-      - name: Analyze
+      - name: Generate coverage report
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} # Needed to get PR information, if any
           SONAR_TOKEN: ${{ secrets.SONAR_TOKEN }}
         run: |
           mvn -fn --no-transfer-progress --batch-mode -DclickhouseVersion=$PREFERRED_LTS_VERSION \
-            -Panalysis verify org.sonarsource.scanner.maven:sonar-maven-plugin:sonar -Dsonar.projectKey=ClickHouse_clickhouse-java
+            -Pcoverage verify org.sonarsource.scanner.maven:sonar-maven-plugin:sonar -Dsonar.projectKey=ClickHouse_clickhouse-java
         continue-on-error: true
       - name: Generate and post coverage report
         env:

.gitignore

@@ -60,3 +60,8 @@ performance/jmh-simple-results.json
 *.csv
 *.sql
 *.json
+
+*.crt 
+*.key
+*.srl
+*.csr

CONTRIBUTING.md

@@ -1,28 +1,20 @@
 package com.clickhouse.client.config;
 
-import java.io.ByteArrayOutputStream;
+import com.clickhouse.data.ClickHouseUtils;
+import org.testng.Assert;
+import org.testng.annotations.Test;
+
 import java.io.FileNotFoundException;
 import java.io.InputStream;
 import java.nio.charset.StandardCharsets;
 import java.security.KeyStore;
 import java.security.PrivateKey;
 
-import com.clickhouse.data.ClickHouseUtils;
-
-import org.testng.Assert;
-import org.testng.annotations.Test;
-
 public class ClickHouseDefaultSslContextProviderTest {
     static String readTestResource(String name) throws Exception {
-        ByteArrayOutputStream out = new ByteArrayOutputStream();
         try (InputStream in = ClickHouseUtils.getFileInputStream(name)) {
-            byte[] buffer = new byte[2048];
-            int read;
-            while ((read = in.read(buffer)) != -1) {
-                out.write(buffer, 0, read);
-            }
+            return new String(in.readAllBytes(), StandardCharsets.US_ASCII);
         }
-        return new String(out.toByteArray(), StandardCharsets.US_ASCII);
     }
 
     @Test(groups = { "unit" })

clickhouse-client/src/test/java/com/clickhouse/client/config/ClickHouseDefaultSslContextProviderTest.java

@@ -141,9 +141,12 @@ openssl req -newkey rsa:2048 -nodes \
 openssl x509 -req -in server.csr -CA ca.crt -CAkey ca.key -CAcreateserial \
   -days 365 -out server.crt \
   -extfile <(printf "subjectAltName=DNS:localhost,IP:127.0.0.1")
+  
+# Only for demo purpose we make key readable by all. On production should be readable only by owner, not even by group.
+chmod a+r server.key
 ```
 
-2. Create a `config.d` overlay enabling the HTTPS interface, e.g. `zzz_ssl.xml`:
+2. Create a `config.d` overlay enabling the HTTPS interface, e.g. `my_ssl.xml`:
 
 ```xml
 <clickhouse>
@@ -167,11 +170,22 @@ openssl x509 -req -in server.csr -CA ca.crt -CAkey ca.key -CAcreateserial \
 docker run -d --name clickhouse-ssl -p 8443:8443 \
   -v "$PWD/server.crt:/etc/clickhouse-server/certs/server.crt:ro" \
   -v "$PWD/server.key:/etc/clickhouse-server/certs/server.key:ro" \
-  -v "$PWD/zzz_ssl.xml:/etc/clickhouse-server/config.d/zzz_ssl.xml:ro" \
+  -v "$PWD/my_ssl.xml:/etc/clickhouse-server/config.d/my_ssl.xml:ro" \
+  -e CLICKHOUSE_PASSWORD="secret" \
   clickhouse/clickhouse-server:latest
 ```
 
 4. Run the example in standalone mode with `-DchHost=localhost -DchRootCert="$PWD/ca.crt"`.
 
+```shell
+mvn exec:java -Dexec.mainClass="com.clickhouse.examples.client_v2.SSLExamples" \
+  -DchHost="localhost" \
+  -DchPort="8443" \
+  -DchUser="default" \
+  -DchPassword="secret" \
+  -DchDatabase="default" \
+  -DchRootCert="$PWD/ca.crt"
+```
+
 The full description of the server-side TLS configuration is in the official documentation:
 [Configuring SSL-TLS](https://clickhouse.com/docs/en/guides/sre/configuring-ssl).

examples/client-v2/README.md

@@ -90,10 +90,7 @@ public static void main(String[] args) {
                     SecureServerSupport.USER, SecureServerSupport.PASSWORD, server.getCaCertPath());
         } catch (Exception e) {
             log.error("Failed to run the SSL example against a local Docker server", e);
-            Runtime.getRuntime().exit(-1);
         }
-        // Explicit exit: testcontainers keeps non-daemon threads alive after the scenario is done.
-        Runtime.getRuntime().exit(0);
     }
 
     /**

examples/client-v2/src/main/java/com/clickhouse/examples/client_v2/SSLExamples.java

@@ -82,7 +82,7 @@ private SecureServerSupport(GenericContainer<?> container, Path certDir, Path co
     public static SecureServerSupport start(String image) throws Exception {
         Path certDir = Files.createTempDirectory("ch-ssl-example-certs-");
         Path confDir = Files.createTempDirectory("ch-ssl-example-config-");
-        Path sslConfig = confDir.resolve("zzz_ssl.xml");
+        Path sslConfig = confDir.resolve("custom_ca_ssl.xml");
 
         log.info("Generating an ephemeral private CA and a server certificate in {}", certDir);
         generatePrivateCaAndServerCertificate(certDir);
@@ -100,7 +100,7 @@ public static SecureServerSupport start(String image) throws Exception {
                 .withFileSystemBind(certDir.toAbsolutePath().toString(),
                         "/etc/clickhouse-server/certs", BindMode.READ_ONLY)
                 .withFileSystemBind(sslConfig.toAbsolutePath().toString(),
-                        "/etc/clickhouse-server/config.d/zzz_ssl.xml", BindMode.READ_ONLY)
+                        "/etc/clickhouse-server/config.d/custom_ca_ssl.xml", BindMode.READ_ONLY)
                 .waitingFor(Wait.forHttp("/ping")
                         .forPort(HTTP_PORT)
                         .forStatusCode(200)

examples/client-v2/src/main/java/com/clickhouse/examples/client_v2/SecureServerSupport.java

@@ -86,9 +86,12 @@ openssl req -newkey rsa:2048 -nodes \
 openssl x509 -req -in server.csr -CA ca.crt -CAkey ca.key -CAcreateserial \
   -days 365 -out server.crt \
   -extfile <(printf "subjectAltName=DNS:localhost,IP:127.0.0.1")
+  
+# Only for demo purpose we make key readable by all. On production should be readable only by owner, not even by group.^M
+chmod a+r server.key
 ```
 
-2. Create a `config.d` overlay enabling the HTTPS interface, e.g. `zzz_ssl.xml`:
+2. Create a `config.d` overlay enabling the HTTPS interface, e.g. `my_ssl.xml`:
 
 ```xml
 <clickhouse>
@@ -112,12 +115,22 @@ openssl x509 -req -in server.csr -CA ca.crt -CAkey ca.key -CAcreateserial \
 docker run -d --name clickhouse-ssl -p 8443:8443 \
   -v "$PWD/server.crt:/etc/clickhouse-server/certs/server.crt:ro" \
   -v "$PWD/server.key:/etc/clickhouse-server/certs/server.key:ro" \
-  -v "$PWD/zzz_ssl.xml:/etc/clickhouse-server/config.d/zzz_ssl.xml:ro" \
+  -v "$PWD/my_ssl.xml:/etc/clickhouse-server/config.d/my_ssl.xml:ro" \
+  -e CLICKHOUSE_PASSWORD="secret" \
   clickhouse/clickhouse-server:latest
 ```
 
 4. Run the example in standalone mode with
 `-DchUrl="jdbc:clickhouse://localhost:8443/default" -DchRootCert="$PWD/ca.crt"`.
 
+```shell
+mvn exec:java -Dexec.mainClass="com.clickhouse.examples.jdbc.SSLExamples" \
+  -DchUrl="jdbc:clickhouse:https://localhost:8443/default" \
+  -DchUser="default" \
+  -DchPassword="secret" \
+  -DchRootCert="$PWD/ca.crt"
+```
+
+
 The full description of the server-side TLS configuration is in the official documentation:
 [Configuring SSL-TLS](https://clickhouse.com/docs/en/guides/sre/configuring-ssl).

examples/jdbc/README.md

@@ -626,7 +626,7 @@
 
     <profiles>
         <profile>
-            <id>analysis</id>
+            <id>coverage</id>
             <build>
                 <plugins>
                     <plugin>