Add SslOptions #3980

sazzad16 · 2024-09-30T11:21:35Z

Similar to SslOptions in Lettuce library.

inspired by SslVerifyMode in Lettuce

atakavci

having a trust manager like this smells off. May be its because i am lack of context. What is the rationale ?

src/main/java/redis/clients/jedis/DefaultJedisClientConfig.java

src/main/java/redis/clients/jedis/SslOptions.java

src/main/java/redis/clients/jedis/DefaultJedisSocketFactory.java

tishun · 2024-10-01T13:53:36Z

src/main/java/redis/clients/jedis/SslHostnameVerifyMode.java

@@ -0,0 +1,8 @@
+package redis.clients.jedis;
+
+public enum SslHostnameVerifyMode {


This is the equivalent of the SslVerifyMode in Lettuce, correct?

It's not an equivalent of the SslVerifyMode in Lettuce, but it should be.

This is exactly SslVerifyMode in Lettuce except the NONE option.
All the remaining options are specific to hostname verification.
So I named this as such.

Just to make sure I get this right:

SslVerifyMode.CA == SslHostnameVerifyMode.DISABLE SslVerifyMode.FULL == SslHostnameVerifyMode.HTTPS

I am a bit confused by the naming. HTTPS is HTTP + SSL, we do not use the HTTP protocol.
Also if we only have two modes perhaps we can just have a Boolean value, and not an enum?
Do we plan to have more? What would they be?

@tishun In Lettuce,

SslVerifyMode.FULL ==> setEndpointIdentificationAlgorithm("HTTPS") SslVerifyMode.CA ==> setEndpointIdentificationAlgorithm("")

So I opted for those names.
REVERTED, to reduce confusion atm.

I understand. The setEndpointIdentificationAlgorithm uses standard names from the Java specification, but I think they are generic and in this case could be misleading if used as part of the API of the driver. A friendly name could describe better (I do not insist on the same naming as in Lettuce, although similar names could make it easier for a app developers to switch between them).

We could always leave a note in the public JavaDoc that this specific enum value would result in using the HTTPS Endpoint Identification Algorithm (for verbosity).

tishun · 2024-10-01T13:54:56Z

having a trust manager like this smells off. May be its because i am lack of context. What is the rationale ?

I have the same question. The motivation of the change is important in this case.

uglide · 2024-10-02T08:06:30Z

@tishun @atakavci This is an attempt to create a TLS config similar to what we have in Lettuce, as a more developer-friendly option compared to the current approach with SSLSocketFactory, etc.

sazzad16 · 2024-10-02T15:23:45Z

having a trust manager like this smells off. May be its because i am lack of context. What is the rationale ?

I have the same question. The motivation of the change is important in this case.

@tishun

Lettuce has similar support.
Users want insecurity.

tishun

I may not be getting the whole idea, so please excuse me if my comments are not making sense.

My current assumption is that we only want to be able to enable and disable hostname verification, as part of the SSL verification process.

tishun · 2024-10-09T16:54:55Z

src/main/java/redis/clients/jedis/DefaultJedisClientConfig.java

@@ -28,6 +30,7 @@ public final class DefaultJedisClientConfig implements JedisClientConfig {

  private final boolean readOnlyForRedisClusterReplicas;

+  // TODO: how many constructors should we have? 1) all params, 2) builder 3) another config


I would go with the builder pattern. It is perfect for such cases as it allows to have defaults and in the same time tweak only the options you want. It could also easily evolve into having profiles (a thing I wanted to discuss in the team) e.g. StandaloneProfile / ClusterProfile / EnterpriseProfile - each having specific configuration options suitable for the specific use case scenario

tishun · 2024-10-09T17:01:46Z

src/main/java/redis/clients/jedis/SslHostnameVerifyMode.java

@@ -0,0 +1,8 @@
+package redis.clients.jedis;
+
+public enum SslHostnameVerifyMode {


Just to make sure I get this right:

SslVerifyMode.CA == SslHostnameVerifyMode.DISABLE SslVerifyMode.FULL == SslHostnameVerifyMode.HTTPS

I am a bit confused by the naming. HTTPS is HTTP + SSL, we do not use the HTTP protocol.
Also if we only have two modes perhaps we can just have a Boolean value, and not an enum?
Do we plan to have more? What would they be?

tishun · 2024-10-09T17:04:46Z

src/main/java/redis/clients/jedis/SslOptions.java

+        public Builder keystore(File keystore, char[] keystorePassword) {
+
+            Objects.requireNonNull(keystore, "Keystore must not be null");
+//            LettuceAssert.isTrue(keystore.exists(), () -> String.format("Keystore file %s does not exist", truststore));


I assume we still want to add these checks, correct?

src/main/java/redis/clients/jedis/SslOptions.java

to avoid confusion at this moment.

does this reduce confusion?

ggivo · 2024-10-12T22:49:05Z

src/main/java/redis/clients/jedis/util/InsecureTrustManagerFactory.java

I believe all we need from this class is

TrustManager[] trustAllCerts = new TrustManager[]{ new X509TrustManager() { @Override public void checkClientTrusted(X509Certificate[] chain, String s) { if (logger.isDebugEnabled()) { logger.debug("Accepting a client certificate: " + chain[0].getSubjectDN()); } } @Override public void checkServerTrusted(X509Certificate[] chain, String s) { if (logger.isDebugEnabled()) { logger.debug("Accepting a server certificate: " + chain[0].getSubjectDN()); } } @Override public X509Certificate[] getAcceptedIssuers() { return EMPTY_X509_CERTIFICATES; } };

@ggivo The X509TrustManager is wrapped to make it X509ExtendedTrustManager.

Sure we can simplify current PR but just wanted to point out that it's not as simple as you've mentioned.

sazzad16 added 6 commits September 29, 2024 18:52

Add SslOptions from Lettuce library

23ef9c3

Add InsecureTrustManagerFactory from Netty library

375e1ca

Separate SSL socket creation in DefaultJedisSocketFactory

ed26f37

Add SslOptions in JedisClientConfig

382fd81

Add SslHostnameVerifyMode

363d493

inspired by SslVerifyMode in Lettuce

Allow system default key and trust managers and insecure trust manager

261bf30

sazzad16 added enhancement experimental labels Sep 30, 2024

fix jdoc

2ca615e

atakavci reviewed Oct 1, 2024

View reviewed changes

Address review comments

8da45c3

tishun reviewed Oct 1, 2024

View reviewed changes

tishun reviewed Oct 9, 2024

View reviewed changes

sazzad16 added 3 commits October 10, 2024 15:57

Revert back to verification mode names in Lettuce,

e9444d9

to avoid confusion at this moment.

Rename insecureTrust to noTruststoreVerification;

ae97c00

does this reduce confusion?

Merge branch 'master' into ssl-options

04fd034

ggivo reviewed Oct 12, 2024

View reviewed changes

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Add SslOptions #3980

Add SslOptions #3980

sazzad16 commented Sep 30, 2024

atakavci left a comment

tishun Oct 1, 2024

uglide Oct 2, 2024

sazzad16 Oct 2, 2024

tishun Oct 9, 2024

sazzad16 Oct 10, 2024

tishun Oct 14, 2024

tishun commented Oct 1, 2024

uglide commented Oct 2, 2024

sazzad16 commented Oct 2, 2024

tishun left a comment

tishun Oct 9, 2024

tishun Oct 9, 2024

tishun Oct 9, 2024

ggivo Oct 12, 2024

sazzad16 Oct 14, 2024 •

edited

Loading

		@@ -0,0 +1,8 @@
		package redis.clients.jedis;

		public enum SslHostnameVerifyMode {

		@@ -28,6 +30,7 @@ public final class DefaultJedisClientConfig implements JedisClientConfig {

		private final boolean readOnlyForRedisClusterReplicas;

		// TODO: how many constructors should we have? 1) all params, 2) builder 3) another config

Add SslOptions #3980

Are you sure you want to change the base?

Add SslOptions #3980

Conversation

sazzad16 commented Sep 30, 2024

atakavci left a comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

tishun commented Oct 1, 2024

uglide commented Oct 2, 2024

sazzad16 commented Oct 2, 2024

tishun left a comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

sazzad16 Oct 14, 2024 • edited Loading

Choose a reason for hiding this comment

sazzad16 Oct 14, 2024 •

edited

Loading