IGNITE-29209 Return fresh SSL bundles with certificate metadata

modules/clients/src/test/java/org/apache/ignite/jdbc/thin/JdbcThinConnectionSSLTest.java

@@ -655,9 +655,7 @@ public void testUnsupportedSslProtocol() throws Exception {
         }
     }
 
-    /**
-     * @throws Exception If failed.
-     */
+    /** An unsupported key-manager algorithm is reported together with the affected key store. */
     @Test
     public void testInvalidKeyAlgorithm() throws Exception {
         setSslCtxFactoryToCli = true;
@@ -666,7 +664,7 @@ public void testInvalidKeyAlgorithm() throws Exception {
         startGrids(1);
 
         try {
-            GridTestUtils.assertThrows(log, new Callable<Object>() {
+            Throwable err = GridTestUtils.assertThrows(log, new Callable<Object>() {
                 @Override public Object call() throws Exception {
                     Connection c = DriverManager.getConnection("jdbc:ignite:thin://127.0.0.1/?sslMode=require" +
                         "&sslKeyAlgorithm=INVALID" +
@@ -678,6 +676,8 @@ public void testInvalidKeyAlgorithm() throws Exception {
                     return null;
                 }
             }, SQLException.class, "Unsupported key algorithm: INVALID");
+
+            assertTrue(err.getMessage().contains("keyStoreFile=" + CLI_KEY_STORE_PATH));
         }
         finally {
             stopAllGrids();

modules/commons/src/main/java/org/apache/ignite/ssl/AbstractSslContextFactory.java

@@ -19,7 +19,6 @@
 
 import java.security.KeyManagementException;
 import java.security.NoSuchAlgorithmException;
-import java.util.concurrent.atomic.AtomicReference;
 import javax.cache.configuration.Factory;
 import javax.net.ssl.KeyManager;
 import javax.net.ssl.SSLContext;
@@ -30,9 +29,8 @@
 import org.apache.ignite.internal.util.typedef.internal.A;
 
 /**
- * Represents abstract implementation of SSL Context Factory that caches the result of the first successful
- * attempt to create an {@link SSLContext} and always returns it as a result of further invocations of the
- * {@link AbstractSslContextFactory#create()}} method.
+ * Builds a fresh SSL context and its certificate metadata on each call. The component using the context is responsible for
+ * retaining it between connections.
  */
 public abstract class AbstractSslContextFactory implements Factory<SSLContext> {
     /** */
@@ -50,9 +48,6 @@ public abstract class AbstractSslContextFactory implements Factory<SSLContext> {
     /** Enabled protocols. */
     protected String[] protocols;
 
-    /** Cached instance of an {@link SSLContext}. */
-    protected final AtomicReference<SSLContext> sslCtx = new AtomicReference<>();
-
     /**
      * Gets protocol for secure transport.
      *
@@ -110,16 +105,31 @@ public void setProtocols(String... protocols) {
     }
 
     /**
-     * Creates SSL context based on factory settings.
+     * Checks the factory parameters, loads its key material once, and builds a fresh context with the certificate chains from
+     * that material. The factory does not retain the result.
      *
-     * @return Initialized SSL context.
-     * @throws SSLException If SSL context could not be created.
+     * @return Fresh context and the certificate metadata available to this factory.
+     * @throws IgniteException If the context could not be created.
      */
-    private SSLContext createSslContext() throws SSLException {
-        checkParameters();
+    public SslBundle createSslBundle() {
+        try {
+            checkParameters();
 
-        KeyManager[] keyMgrs = createKeyManagers();
+            KeyMaterial material = loadKeyMaterial();
 
+            return new SslBundle(createSslContext(material.keyManagers()), material.certificateChains());
+        }
+        catch (SSLException e) {
+            throw new IgniteException(e.getMessage() + " [factory=" + this + ']', e);
+        }
+    }
+
+    /**
+     * @param keyMgrs Key managers for the loaded material.
+     * @return Initialized context.
+     * @throws SSLException If trust managers or the context cannot be created.
+     */
+    private SSLContext createSslContext(KeyManager[] keyMgrs) throws SSLException {
         TrustManager[] trustMgrs = createTrustManagers();
 
         try {
@@ -167,33 +177,27 @@ protected void checkNullParameter(Object param, String name) throws SSLException
     protected abstract void checkParameters() throws SSLException;
 
     /**
-     * @return Created Key Managers.
-     * @throws SSLException If Key Managers could not be created.
+     * Loads the key store and the settings used to read its keys. Called once per context, after the parameters are checked.
+     * For a context without private keys, return material over an empty store initialized with {@code KeyStore.load(null, null)}.
+     *
+     * @return Loaded key material, never {@code null}.
+     * @throws SSLException If the key material cannot be loaded.
      */
-    protected abstract KeyManager[] createKeyManagers() throws SSLException;
+    protected abstract KeyMaterial loadKeyMaterial() throws SSLException;
 
     /**
      * @return Created Trust Managers.
      * @throws SSLException If Trust Managers could not be created.
      */
     protected abstract TrustManager[] createTrustManagers() throws SSLException;
 
-    /** {@inheritDoc} */
-    @Override public SSLContext create() {
-        SSLContext ctx = sslCtx.get();
-
-        if (ctx == null) {
-            try {
-                ctx = createSslContext();
-
-                if (!sslCtx.compareAndSet(null, ctx))
-                    ctx = sslCtx.get();
-            }
-            catch (SSLException e) {
-                throw new IgniteException(e);
-            }
-        }
-
-        return ctx;
+    /**
+     * Builds a fresh context through {@link #createSslBundle()}. Override that method to customize both entry points.
+     *
+     * @return Fresh initialized context.
+     * @throws IgniteException If the context could not be created.
+     */
+    @Override public final SSLContext create() {
+        return createSslBundle().context();
     }
 }

modules/commons/src/main/java/org/apache/ignite/ssl/KeyMaterial.java

@@ -0,0 +1,135 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one or more
+ * contributor license agreements.  See the NOTICE file distributed with
+ * this work for additional information regarding copyright ownership.
+ * The ASF licenses this file to You under the Apache License, Version 2.0
+ * (the "License"); you may not use this file except in compliance with
+ * the License.  You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package org.apache.ignite.ssl;
+
+import java.security.GeneralSecurityException;
+import java.security.KeyStore;
+import java.security.KeyStoreException;
+import java.security.NoSuchAlgorithmException;
+import java.security.cert.Certificate;
+import java.security.cert.X509Certificate;
+import java.util.ArrayList;
+import java.util.Collections;
+import java.util.Enumeration;
+import java.util.List;
+import java.util.Map;
+import java.util.TreeMap;
+import javax.net.ssl.KeyManager;
+import javax.net.ssl.KeyManagerFactory;
+import javax.net.ssl.SSLException;
+import org.apache.ignite.internal.util.typedef.internal.A;
+import org.jetbrains.annotations.Nullable;
+
+/**
+ * A loaded key store and the settings needed to create its key managers. Both managers and certificate metadata are read from
+ * this store without loading it again. Do not modify the store while any context created from it is in use: key managers
+ * such as PKIX read it during handshakes. Load replacement material into a separate store.
+ */
+public final class KeyMaterial {
+    /** */
+    private final KeyStore store;
+
+    /** */
+    private final char[] keyPwd;
+
+    /** */
+    private final String algorithm;
+
+    /**
+     * @param store Loaded key store, never {@code null}. For a context without private keys, initialize an empty store with
+     *      {@code KeyStore.load(null, null)}.
+     * @param keyPwd Password for its private keys, or {@code null} if the store requires no password.
+     * @param algorithm Key manager algorithm.
+     */
+    public KeyMaterial(KeyStore store, @Nullable char[] keyPwd, String algorithm) {
+        A.notNull(store, "store", algorithm, "algorithm");
+
+        this.store = store;
+        this.keyPwd = keyPwd == null ? null : keyPwd.clone();
+        this.algorithm = algorithm;
+    }
+
+    /**
+     * @return Key managers initialized from the loaded store.
+     * @throws SSLException If the algorithm is unavailable or the keys cannot be read.
+     */
+    public KeyManager[] keyManagers() throws SSLException {
+        try {
+            KeyManagerFactory factory = KeyManagerFactory.getInstance(algorithm);
+
+            factory.init(store, keyPwd);
+
+            return factory.getKeyManagers();
+        }
+        catch (NoSuchAlgorithmException e) {
+            throw new SSLException("Unsupported key algorithm: " + algorithm, e);
+        }
+        catch (GeneralSecurityException e) {
+            throw new SSLException("Failed to initialize Key Manager (security exception occurred)", e);
+        }
+    }
+
+    /**
+     * @return Immutable, nonempty X.509 chains of key entries, ordered by alias and with each key's own certificate first.
+     *      Entries without a chain or with a non-X.509 certificate are omitted. An empty map means no such chains were found.
+     *      Reading the chains does not recover the keys.
+     * @throws SSLException If the loaded store cannot be read.
+     */
+    public Map<String, List<X509Certificate>> certificateChains() throws SSLException {
+        try {
+            Map<String, List<X509Certificate>> chains = new TreeMap<>();
+
+            for (Enumeration<String> aliases = store.aliases(); aliases.hasMoreElements(); ) {
+                String alias = aliases.nextElement();
+
+                if (!store.isKeyEntry(alias))
+                    continue;
+
+                List<X509Certificate> chain = certificateChain(store.getCertificateChain(alias));
+
+                if (!chain.isEmpty())
+                    chains.put(alias, chain);
+            }
+
+            return Collections.unmodifiableMap(chains);
+        }
+        catch (KeyStoreException e) {
+            throw new SSLException("Failed to read certificate chains from key store", e);
+        }
+    }
+
+    /**
+     * @param certs Chain from the store, if present.
+     * @return Immutable X.509 chain, or an empty list if it is absent or contains another certificate type.
+     */
+    private static List<X509Certificate> certificateChain(@Nullable Certificate[] certs) {
+        if (certs == null)
+            return Collections.emptyList();
+
+        List<X509Certificate> chain = new ArrayList<>(certs.length);
+
+        for (Certificate cert : certs) {
+            if (!(cert instanceof X509Certificate))
+                return Collections.emptyList();
+
+            chain.add((X509Certificate)cert);
+        }
+
+        return Collections.unmodifiableList(chain);
+    }
+}

modules/commons/src/main/java/org/apache/ignite/ssl/SslBundle.java

@@ -0,0 +1,79 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one or more
+ * contributor license agreements.  See the NOTICE file distributed with
+ * this work for additional information regarding copyright ownership.
+ * The ASF licenses this file to You under the Apache License, Version 2.0
+ * (the "License"); you may not use this file except in compliance with
+ * the License.  You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package org.apache.ignite.ssl;
+
+import java.security.cert.X509Certificate;
+import java.util.Collections;
+import java.util.List;
+import java.util.Map;
+import java.util.TreeMap;
+import javax.net.ssl.SSLContext;
+import org.apache.ignite.internal.util.typedef.internal.A;
+import org.jetbrains.annotations.Nullable;
+
+/**
+ * An initialized SSL context and a snapshot of the certificate chains loaded with it. The chains describe its key material,
+ * not the certificate selected for a particular connection. Do not reinitialize the context after creating the bundle.
+ */
+public final class SslBundle {
+    /** */
+    private final SSLContext ctx;
+
+    /** */
+    private final Map<String, List<X509Certificate>> chains;
+
+    /**
+     * @param ctx Initialized SSL context.
+     * @param chains Nonempty X.509 chains of key entries, by alias, own certificate first. {@code null} means certificate
+     *      metadata is unavailable; an empty map means there are no chains. Trusted certificate entries and secret keys
+     *      must not be included.
+     * @throws IllegalArgumentException If a chain is empty.
+     */
+    public SslBundle(SSLContext ctx, @Nullable Map<String, List<X509Certificate>> chains) {
+        A.notNull(ctx, "ctx");
+
+        this.ctx = ctx;
+
+        if (chains == null)
+            this.chains = null;
+        else {
+            Map<String, List<X509Certificate>> copy = new TreeMap<>();
+
+            chains.forEach((alias, chain) -> {
+                A.ensure(!chain.isEmpty(), "Certificate chain must not be empty [alias=" + alias + ']');
+
+                copy.put(alias, List.copyOf(chain));
+            });
+
+            this.chains = Collections.unmodifiableMap(copy);
+        }
+    }
+
+    /** @return Initialized context. */
+    public SSLContext context() {
+        return ctx;
+    }
+
+    /**
+     * @return Immutable, nonempty chains ordered by alias, or {@code null} if certificate metadata is unavailable.
+     *      An empty map means there are no chains.
+     */
+    public @Nullable Map<String, List<X509Certificate>> certificateChains() {
+        return chains;
+    }
+}