feat: Configure java connector to check CN instance name. Fixes #1995 #1996
Conversation
hessjcg
force-pushed
the
gh-1995-check-cn
branch
4 times, most recently
from
3e90ff4 to
13b73d3
Compare
|
I added a test for a CN mismatch. |
|
@jackwotherspoon We need to manually test this with a domain-scoped instance. Can you do that? |
@hessjcg sure, for manually testing should I just run the integration tests? Will that suffice? |
|
@jackwotherspoon: Yes, it will be sufficient to run the integration tests at the domain-scoped instance. |
| @@ -62,6 +62,8 @@ public class CloudSqlCoreTestingBase { | |||
|
|
|||
| ListenableFuture<KeyPair> clientKeyPair; | |||
|
|
|||
| public CloudSqlCoreTestingBase() {} | |||
There was a problem hiding this comment.
FWIW In my opinion, this base class deserves to be split up into small composable units. As is, it's an awkward tool.
There was a problem hiding this comment.
+1. Maybe in a different PR.
| FakeSslServer sslServer = new FakeSslServer(); | ||
| ConnectionConfig config = | ||
| new ConnectionConfig.Builder() | ||
| .withCloudSqlInstance("myProject:myRegion:otherInstance") |
There was a problem hiding this comment.
nit: let's make this blatantly wrong, e.g., "wrongwrongwrong" or something similar that catches the eye.
This code will make that the connector checks that the server certificate's subject CN field matches the instance name
before allowing the TLS handshake to proceed.
This introduces new classes that are always installed as trust managers on all TLS connections to ensure that the TLS logic correctly checks that the server certificate's CN field matches the instance.
InstanceCheckingTrustManager- Delegates to default TLS trust manager, then checks the CN field.InstanceCheckingTrustManagerFactoryandInstanceCheckingTrustManagerFactorySpi- Installsour custom trust manager into connector TLS sockets.
The
ConscryptWorkaroundTrustManagerFactoryandConscryptWorkaroundTrustManagerFactorySpiclasses are no longer necessary. Logic to detect Conscrypt and use the workaroundConscryptWorkaroundTrustManagermoves intoInstanceCheckingTrustManagerFactorySpi.