Skip to content

Commit 3193e0d

Browse files
madhav-dbmadhav-db
committed
core SSL functionality
1 parent 58e7daa commit 3193e0d

12 files changed

Lines changed: 598 additions & 153 deletions

File tree

‎src/main/java/com/databricks/jdbc/api/impl/volume/DBFSVolumeClient.java‎

Lines changed: 4 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -16,6 +16,7 @@
1616
import com.databricks.jdbc.dbclient.IDatabricksHttpClient;
1717
import com.databricks.jdbc.dbclient.impl.common.ClientConfigurator;
1818
import com.databricks.jdbc.dbclient.impl.http.DatabricksHttpClientFactory;
19+
import com.databricks.jdbc.exception.DatabricksHttpException;
1920
import com.databricks.jdbc.exception.DatabricksSQLException;
2021
import com.databricks.jdbc.exception.DatabricksVolumeOperationException;
2122
import com.databricks.jdbc.log.JdbcLogger;
@@ -58,7 +59,8 @@ public DBFSVolumeClient(WorkspaceClient workspaceClient) {
5859
this.allowedVolumeIngestionPaths = "";
5960
}
6061

61-
public DBFSVolumeClient(IDatabricksConnectionContext connectionContext) {
62+
public DBFSVolumeClient(IDatabricksConnectionContext connectionContext)
63+
throws DatabricksHttpException {
6264
this.connectionContext = connectionContext;
6365
this.workspaceClient = getWorkspaceClientFromConnectionContext(connectionContext);
6466
this.apiClient = workspaceClient.apiClient();
@@ -392,7 +394,7 @@ public boolean deleteObject(String catalog, String schema, String volume, String
392394
}
393395

394396
WorkspaceClient getWorkspaceClientFromConnectionContext(
395-
IDatabricksConnectionContext connectionContext) {
397+
IDatabricksConnectionContext connectionContext) throws DatabricksHttpException {
396398
ClientConfigurator clientConfigurator = new ClientConfigurator(connectionContext);
397399
DatabricksThreadContextHolder.setDatabricksConfig(clientConfigurator.getDatabricksConfig());
398400
return clientConfigurator.getWorkspaceClient();

‎src/main/java/com/databricks/jdbc/api/impl/volume/DatabricksVolumeClientFactory.java‎

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -3,6 +3,7 @@
33
import com.databricks.jdbc.api.IDatabricksVolumeClient;
44
import com.databricks.jdbc.api.internal.IDatabricksConnectionContext;
55
import com.databricks.jdbc.common.util.DatabricksThreadContextHolder;
6+
import com.databricks.jdbc.exception.DatabricksHttpException;
67
import com.databricks.jdbc.log.JdbcLogger;
78
import com.databricks.jdbc.log.JdbcLoggerFactory;
89
import java.sql.Connection;
@@ -33,7 +34,7 @@ public static IDatabricksVolumeClient getVolumeClient(Connection con) {
3334
* @return an instance of {@link IDatabricksVolumeClient}
3435
*/
3536
public static IDatabricksVolumeClient getVolumeClient(
36-
IDatabricksConnectionContext connectionContext) {
37+
IDatabricksConnectionContext connectionContext) throws DatabricksHttpException {
3738
LOGGER.debug(
3839
String.format(
3940
"Entering public static IDatabricksVolumeClient getVolumeClient with IDatabricksConnectionContext connectionContext = {%s}",

‎src/main/java/com/databricks/jdbc/common/util/SocketFactoryUtil.java‎

Lines changed: 37 additions & 34 deletions
Original file line numberDiff line numberDiff line change
@@ -5,75 +5,78 @@
55
import com.databricks.sdk.core.DatabricksException;
66
import java.security.SecureRandom;
77
import java.security.cert.X509Certificate;
8-
import javax.net.ssl.HostnameVerifier;
98
import javax.net.ssl.SSLContext;
109
import javax.net.ssl.TrustManager;
1110
import javax.net.ssl.X509TrustManager;
1211
import org.apache.http.config.Registry;
1312
import org.apache.http.config.RegistryBuilder;
1413
import org.apache.http.conn.socket.ConnectionSocketFactory;
1514
import org.apache.http.conn.socket.PlainConnectionSocketFactory;
15+
import org.apache.http.conn.ssl.NoopHostnameVerifier;
1616
import org.apache.http.conn.ssl.SSLConnectionSocketFactory;
1717

1818
public class SocketFactoryUtil {
19-
2019
private static final JdbcLogger LOGGER = JdbcLoggerFactory.getLogger(SocketFactoryUtil.class);
2120

2221
/**
23-
* <b>NOTE: </b> Only for testing purposes and should never be used in production.
24-
*
25-
* <p>Builds a registry of connection socket factories that trusts all SSL certificates.
22+
* Builds a registry of connection socket factories that trusts all SSL certificates. This should
23+
* only be used in testing environments or when explicitly configured to allow self-signed
24+
* certificates.
2625
*
2726
* @return A registry of connection socket factories.
2827
*/
2928
public static Registry<ConnectionSocketFactory> getTrustAllSocketFactoryRegistry() {
3029
LOGGER.warn(
31-
"This driver is configured to trust all SSL certificates. This is insecure and should be never used in production.");
32-
LOGGER.debug("Entering the getTrustAllSocketFactoryRegistry method");
33-
30+
"This driver is configured to trust all SSL certificates. This is insecure and should never be used in production.");
3431
try {
3532
// Create a TrustManager that trusts all certificates
36-
TrustManager[] trustAllCerts =
37-
new TrustManager[] {
38-
new X509TrustManager() {
39-
@Override
40-
public X509Certificate[] getAcceptedIssuers() {
41-
return null; // Accept all issuers
42-
}
43-
44-
@Override
45-
public void checkClientTrusted(X509Certificate[] certs, String authType) {
46-
// No-op: Trust all client certificates
47-
}
48-
49-
@Override
50-
public void checkServerTrusted(X509Certificate[] certs, String authType) {
51-
// No-op: Trust all server certificates
52-
}
53-
}
54-
};
33+
TrustManager[] trustAllCerts = getTrustManagerThatTrustsAllCertificates();
5534

5635
// Initialize the SSLContext with trust-all settings
5736
SSLContext sslContext = SSLContext.getInstance("TLS");
5837
sslContext.init(null, trustAllCerts, new SecureRandom());
5938

60-
// Disable hostname verification
61-
HostnameVerifier allHostsValid = (hostname, session) -> true;
62-
63-
// Configure SSLConnectionSocketFactory with the trust-all SSLContext
39+
// Use the NoopHostnameVerifier to disable hostname verification
6440
SSLConnectionSocketFactory sslSocketFactory =
65-
new SSLConnectionSocketFactory(sslContext, allHostsValid);
41+
new SSLConnectionSocketFactory(sslContext, NoopHostnameVerifier.INSTANCE);
6642

6743
// Build and return the registry
6844
return RegistryBuilder.<ConnectionSocketFactory>create()
6945
.register("https", sslSocketFactory)
7046
.register("http", new PlainConnectionSocketFactory())
7147
.build();
72-
7348
} catch (Exception e) {
7449
String errorMessage = "Error while setting up trust-all SSL context.";
75-
LOGGER.error(errorMessage, e);
50+
LOGGER.error(e, errorMessage);
7651
throw new DatabricksException(errorMessage, e);
7752
}
7853
}
54+
55+
/**
56+
* Creates a TrustManager array that accepts all certificates without validation. This should only
57+
* be used in testing environments or when explicitly configured to allow self-signed
58+
* certificates.
59+
*
60+
* @return An array containing a single TrustManager that trusts all certificates.
61+
*/
62+
public static TrustManager[] getTrustManagerThatTrustsAllCertificates() {
63+
return new TrustManager[] {
64+
new X509TrustManager() {
65+
@Override
66+
public X509Certificate[] getAcceptedIssuers() {
67+
return new X509Certificate[0]; // Empty array instead of null for better compatibility
68+
}
69+
70+
@Override
71+
public void checkClientTrusted(X509Certificate[] certs, String authType) {
72+
// No-op: Trust all client certificates
73+
}
74+
75+
@Override
76+
public void checkServerTrusted(X509Certificate[] certs, String authType) {
77+
// No-op: Trust all server certificates
78+
}
79+
}
80+
};
81+
}
7982
}

‎src/main/java/com/databricks/jdbc/dbclient/impl/common/ClientConfigurator.java‎

Lines changed: 5 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -10,6 +10,7 @@
1010
import com.databricks.jdbc.common.AuthMech;
1111
import com.databricks.jdbc.common.DatabricksJdbcConstants;
1212
import com.databricks.jdbc.common.util.DriverUtil;
13+
import com.databricks.jdbc.exception.DatabricksHttpException;
1314
import com.databricks.jdbc.exception.DatabricksParsingException;
1415
import com.databricks.jdbc.log.JdbcLogger;
1516
import com.databricks.jdbc.log.JdbcLoggerFactory;
@@ -39,7 +40,8 @@ public class ClientConfigurator {
3940
private final IDatabricksConnectionContext connectionContext;
4041
private DatabricksConfig databricksConfig;
4142

42-
public ClientConfigurator(IDatabricksConnectionContext connectionContext) {
43+
public ClientConfigurator(IDatabricksConnectionContext connectionContext)
44+
throws DatabricksHttpException {
4345
this.connectionContext = connectionContext;
4446
this.databricksConfig = new DatabricksConfig();
4547
CommonsHttpClient.Builder httpClientBuilder = new CommonsHttpClient.Builder();
@@ -57,7 +59,8 @@ public ClientConfigurator(IDatabricksConnectionContext connectionContext) {
5759
*
5860
* @param httpClientBuilder The builder to which the SSL configuration should be added.
5961
*/
60-
void setupConnectionManager(CommonsHttpClient.Builder httpClientBuilder) {
62+
void setupConnectionManager(CommonsHttpClient.Builder httpClientBuilder)
63+
throws DatabricksHttpException {
6164
PoolingHttpClientConnectionManager connManager =
6265
ConfiguratorUtils.getBaseConnectionManager(connectionContext);
6366
// Default value is 100 which is consistent with the value in the SDK

0 commit comments

Comments
 (0)