Package com.datastax.oss.driver.api.core.ssl

Class ProgrammaticSslEngineFactory

java.lang.Object

com.datastax.oss.driver.api.core.ssl.ProgrammaticSslEngineFactory

All Implemented Interfaces:

SslEngineFactory, AutoCloseable

public class ProgrammaticSslEngineFactory
extends Object
implements SslEngineFactory

An SSL engine factory that allows you to configure the driver programmatically, by passing your own SSLContext.

Note that this class will create SSL engines with advisory peer information (SSLContext.createSSLEngine(String, int)) whenever possible.

If those defaults do not work for you, it should be pretty straightforward to write your own implementation by extending or duplicating this class.

See Also:

SessionBuilder.withSslEngineFactory(SslEngineFactory), SessionBuilder.withSslContext(SSLContext)

Field Summary

Fields

Modifier and Type	Field	Description
protected boolean	allowDnsReverseLookupSan
protected String[]	cipherSuites
protected boolean	requireHostnameValidation
protected SSLContext	sslContext

Constructor Summary

Constructors

Constructor	Description
ProgrammaticSslEngineFactory(SSLContext sslContext)	Creates an instance with the given SSLContext, default cipher suites and no host name validation.
ProgrammaticSslEngineFactory(SSLContext sslContext, String[] cipherSuites)	Creates an instance with the given SSLContext and cipher suites, and no host name validation.
ProgrammaticSslEngineFactory(SSLContext sslContext, String[] cipherSuites, boolean requireHostnameValidation)	Creates an instance with the given SSLContext, cipher suites and host name validation.
ProgrammaticSslEngineFactory(SSLContext sslContext, String[] cipherSuites, boolean requireHostnameValidation, boolean allowDnsReverseLookupSan)	Creates an instance with the given SSLContext, cipher suites and host name validation.

Method Summary

Modifier and Type	Method	Description
void	close()
boolean	isHostnameValidationRequired()	Whether newSslEngine(com.datastax.oss.driver.api.core.metadata.EndPoint) configures the engine to validate the server certificate against the node's host name, as passed to the constructor.
SSLEngine	newSslEngine(EndPoint remoteEndpoint)	Creates a new SSL engine each time a connection is established.

Methods inherited from class java.lang.Object

clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait

Field Detail

sslContext

protected final SSLContext sslContext

cipherSuites

protected final String[] cipherSuites

requireHostnameValidation

protected final boolean requireHostnameValidation

allowDnsReverseLookupSan

protected final boolean allowDnsReverseLookupSan

Constructor Detail

ProgrammaticSslEngineFactory

public ProgrammaticSslEngineFactory(@NonNull
                                    SSLContext sslContext)

Creates an instance with the given SSLContext, default cipher suites and no host name validation.

Parameters:

sslContext - the SSLContext to use.

ProgrammaticSslEngineFactory

public ProgrammaticSslEngineFactory(@NonNull
                                    SSLContext sslContext,
                                    @Nullable
                                    String[] cipherSuites)

Creates an instance with the given SSLContext and cipher suites, and no host name validation.

Parameters:

sslContext - the SSLContext to use.

cipherSuites - the cipher suites to use, or null to use the default ones.

ProgrammaticSslEngineFactory

public ProgrammaticSslEngineFactory(@NonNull
                                    SSLContext sslContext,
                                    @Nullable
                                    String[] cipherSuites,
                                    boolean requireHostnameValidation)

Creates an instance with the given SSLContext, cipher suites and host name validation.

Parameters:

sslContext - the SSLContext to use.

cipherSuites - the cipher suites to use, or null to use the default ones.

requireHostnameValidation - whether to enable host name validation. If enabled, host name validation will be done using HTTPS algorithm.

ProgrammaticSslEngineFactory

public ProgrammaticSslEngineFactory(@NonNull
                                    SSLContext sslContext,
                                    @Nullable
                                    String[] cipherSuites,
                                    boolean requireHostnameValidation,
                                    boolean allowDnsReverseLookupSan)

Creates an instance with the given SSLContext, cipher suites and host name validation.

Parameters:

sslContext - the SSLContext to use.

cipherSuites - the cipher suites to use, or null to use the default ones.

requireHostnameValidation - whether to enable host name validation. If enabled, host name validation will be done using HTTPS algorithm.

allowDnsReverseLookupSan - whether to allow raw server IPs to be DNS reverse-resolved to choose the appropriate Subject Alternative Name.

Method Detail

newSslEngine

@NonNull
public SSLEngine newSslEngine(@NonNull
                              EndPoint remoteEndpoint)

Description copied from interface: SslEngineFactory

Creates a new SSL engine each time a connection is established.

The driver's standard JDK SSL handler factory invokes this method on dedicated preparation workers before opening the connection, so blocking work such as reverse DNS does not occupy network I/O threads. Implementations must support concurrent invocations.

Specified by:

newSslEngine in interface SslEngineFactory

Parameters:

remoteEndpoint - the remote endpoint we are connecting to (the address of the Cassandra node).

isHostnameValidationRequired

public boolean isHostnameValidationRequired()

Whether newSslEngine(com.datastax.oss.driver.api.core.metadata.EndPoint) configures the engine to validate the server certificate against the node's host name, as passed to the constructor.

A diagnostic accessor, read by the driver-configuration report sent to the server at connection time. Deliberately not on SslEngineFactory: an arbitrary factory can neither be assumed to validate host names nor be assumed not to, and a default answer on the interface would misdescribe a security control for every implementation that never considered the question. The report names the factories it recognizes and says nothing about the rest.

close

public void close()

Specified by:

close in interface AutoCloseable