Skip to content

Commit c220834

Browse files
injectivesinjectives
committed
Deprecate RevocationStrategy and introduce RevocationCheckingStrategy
The `RevocationStrategy` is an internal type, it has been superseded by `RevocationCheckingStrategy`.
1 parent e855bcc commit c220834

File tree

10 files changed

+130
-53
lines changed

10 files changed

+130
-53
lines changed

‎driver/src/main/java/org/neo4j/driver/Config.java

Lines changed: 29 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -772,7 +772,7 @@ public enum Strategy {
772772
private final Strategy strategy;
773773
private final List<File> certFiles;
774774
private boolean hostnameVerificationEnabled = true;
775-
private RevocationStrategy revocationStrategy = RevocationStrategy.NO_CHECKS;
775+
private RevocationCheckingStrategy revocationCheckingStrategy = RevocationCheckingStrategy.NO_CHECKS;
776776

777777
private TrustStrategy(Strategy strategy) {
778778
this(strategy, Collections.emptyList());
@@ -882,8 +882,33 @@ public static TrustStrategy trustAllCertificates() {
882882
/**
883883
* The revocation strategy used for verifying certificates.
884884
* @return this {@link TrustStrategy}'s revocation strategy
885+
* @deprecated superseded by {@link TrustStrategy#revocationPolicy()}
885886
*/
887+
public RevocationCheckingStrategy revocationPolicy() {
888+
return revocationCheckingStrategy;
889+
}
890+
891+
/**
892+
* The revocation strategy used for verifying certificates.
893+
* @return this {@link TrustStrategy}'s revocation strategy
894+
* @deprecated superseded by {@link TrustStrategy#revocationPolicy()}
895+
*/
896+
@Deprecated
886897
public RevocationStrategy revocationStrategy() {
898+
RevocationStrategy revocationStrategy;
899+
switch (this.revocationCheckingStrategy) {
900+
case VERIFY_IF_PRESENT:
901+
revocationStrategy = RevocationStrategy.VERIFY_IF_PRESENT;
902+
break;
903+
case STRICT:
904+
revocationStrategy = RevocationStrategy.STRICT;
905+
break;
906+
case NO_CHECKS:
907+
revocationStrategy = RevocationStrategy.NO_CHECKS;
908+
break;
909+
default:
910+
throw new IllegalStateException("Failed to map RevocationStrategy to RevocationStrategy.");
911+
}
887912
return revocationStrategy;
888913
}
889914

@@ -893,7 +918,7 @@ public RevocationStrategy revocationStrategy() {
893918
* @return the current trust strategy
894919
*/
895920
public TrustStrategy withoutCertificateRevocationChecks() {
896-
this.revocationStrategy = RevocationStrategy.NO_CHECKS;
921+
this.revocationCheckingStrategy = RevocationCheckingStrategy.NO_CHECKS;
897922
return this;
898923
}
899924

@@ -905,7 +930,7 @@ public TrustStrategy withoutCertificateRevocationChecks() {
905930
* @return the current trust strategy
906931
*/
907932
public TrustStrategy withVerifyIfPresentRevocationChecks() {
908-
this.revocationStrategy = RevocationStrategy.VERIFY_IF_PRESENT;
933+
this.revocationCheckingStrategy = RevocationCheckingStrategy.VERIFY_IF_PRESENT;
909934
return this;
910935
}
911936

@@ -919,7 +944,7 @@ public TrustStrategy withVerifyIfPresentRevocationChecks() {
919944
* @return the current trust strategy
920945
*/
921946
public TrustStrategy withStrictRevocationChecks() {
922-
this.revocationStrategy = RevocationStrategy.STRICT;
947+
this.revocationCheckingStrategy = RevocationCheckingStrategy.STRICT;
923948
return this;
924949
}
925950
}

‎driver/src/main/java/org/neo4j/driver/RevocationCheckingStrategy.java

Lines changed: 35 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,35 @@
1+
/*
2+
* Copyright (c) "Neo4j"
3+
* Neo4j Sweden AB [http://neo4j.com]
4+
*
5+
* This file is part of Neo4j.
6+
*
7+
* Licensed under the Apache License, Version 2.0 (the "License");
8+
* you may not use this file except in compliance with the License.
9+
* You may obtain a copy of the License at
10+
*
11+
* http://www.apache.org/licenses/LICENSE-2.0
12+
*
13+
* Unless required by applicable law or agreed to in writing, software
14+
* distributed under the License is distributed on an "AS IS" BASIS,
15+
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
16+
* See the License for the specific language governing permissions and
17+
* limitations under the License.
18+
*/
19+
package org.neo4j.driver;
20+
21+
/**
22+
* Defines policy for revocation checks.
23+
*/
24+
public enum RevocationCheckingStrategy {
25+
/** Don't do any OCSP revocation checks, regardless whether there are stapled revocation statuses or not. */
26+
NO_CHECKS,
27+
/** Verify OCSP revocation checks when the revocation status is stapled to the certificate, continue if not. */
28+
VERIFY_IF_PRESENT,
29+
/** Require stapled revocation status and verify OCSP revocation checks, fail if no revocation status is stapled to the certificate. */
30+
STRICT;
31+
32+
public static boolean requiresRevocationChecking(RevocationCheckingStrategy revocationCheckingStrategy) {
33+
return revocationCheckingStrategy.equals(STRICT) || revocationCheckingStrategy.equals(VERIFY_IF_PRESENT);
34+
}
35+
}

‎driver/src/main/java/org/neo4j/driver/internal/RevocationStrategy.java

Lines changed: 8 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -18,6 +18,14 @@
1818
*/
1919
package org.neo4j.driver.internal;
2020

21+
import org.neo4j.driver.RevocationCheckingStrategy;
22+
23+
/**
24+
* Defines strategy for revocation checks.
25+
*
26+
* @deprecated superseded by {@link RevocationCheckingStrategy}
27+
*/
28+
@Deprecated
2129
public enum RevocationStrategy {
2230
/** Don't do any OCSP revocation checks, regardless whether there are stapled revocation statuses or not. */
2331
NO_CHECKS,

‎driver/src/main/java/org/neo4j/driver/internal/SecuritySettings.java

Lines changed: 9 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -26,6 +26,7 @@
2626
import java.io.Serializable;
2727
import java.security.GeneralSecurityException;
2828
import org.neo4j.driver.Config;
29+
import org.neo4j.driver.RevocationCheckingStrategy;
2930
import org.neo4j.driver.exceptions.ClientException;
3031
import org.neo4j.driver.internal.security.SecurityPlan;
3132
import org.neo4j.driver.internal.security.SecurityPlanImpl;
@@ -56,6 +57,7 @@ private boolean isCustomized() {
5657
return !(DEFAULT.encrypted() == this.encrypted() && DEFAULT.hasEqualTrustStrategy(this));
5758
}
5859

60+
@SuppressWarnings("deprecation")
5961
private boolean hasEqualTrustStrategy(SecuritySettings other) {
6062
Config.TrustStrategy t1 = this.trustStrategy;
6163
Config.TrustStrategy t2 = other.trustStrategy;
@@ -66,6 +68,7 @@ private boolean hasEqualTrustStrategy(SecuritySettings other) {
6668
return t1.isHostnameVerificationEnabled() == t2.isHostnameVerificationEnabled()
6769
&& t1.strategy() == t2.strategy()
6870
&& t1.certFiles().equals(t2.certFiles())
71+
&& t1.revocationPolicy() == t2.revocationPolicy()
6972
&& t1.revocationStrategy() == t2.revocationStrategy();
7073
}
7174

@@ -92,9 +95,9 @@ private void assertSecuritySettingsNotUserConfigured(String uriScheme) {
9295

9396
private SecurityPlan createSecurityPlanFromScheme(String scheme) throws GeneralSecurityException, IOException {
9497
if (isHighTrustScheme(scheme)) {
95-
return SecurityPlanImpl.forSystemCASignedCertificates(true, RevocationStrategy.NO_CHECKS);
98+
return SecurityPlanImpl.forSystemCASignedCertificates(true, RevocationCheckingStrategy.NO_CHECKS);
9699
} else {
97-
return SecurityPlanImpl.forAllCertificates(false, RevocationStrategy.NO_CHECKS);
100+
return SecurityPlanImpl.forAllCertificates(false, RevocationCheckingStrategy.NO_CHECKS);
98101
}
99102
}
100103

@@ -106,16 +109,16 @@ private static SecurityPlan createSecurityPlanImpl(boolean encrypted, Config.Tru
106109
throws GeneralSecurityException, IOException {
107110
if (encrypted) {
108111
boolean hostnameVerificationEnabled = trustStrategy.isHostnameVerificationEnabled();
109-
RevocationStrategy revocationStrategy = trustStrategy.revocationStrategy();
112+
RevocationCheckingStrategy revocationCheckingStrategy = trustStrategy.revocationPolicy();
110113
switch (trustStrategy.strategy()) {
111114
case TRUST_CUSTOM_CA_SIGNED_CERTIFICATES:
112115
return SecurityPlanImpl.forCustomCASignedCertificates(
113-
trustStrategy.certFiles(), hostnameVerificationEnabled, revocationStrategy);
116+
trustStrategy.certFiles(), hostnameVerificationEnabled, revocationCheckingStrategy);
114117
case TRUST_SYSTEM_CA_SIGNED_CERTIFICATES:
115118
return SecurityPlanImpl.forSystemCASignedCertificates(
116-
hostnameVerificationEnabled, revocationStrategy);
119+
hostnameVerificationEnabled, revocationCheckingStrategy);
117120
case TRUST_ALL_CERTIFICATES:
118-
return SecurityPlanImpl.forAllCertificates(hostnameVerificationEnabled, revocationStrategy);
121+
return SecurityPlanImpl.forAllCertificates(hostnameVerificationEnabled, revocationCheckingStrategy);
119122
default:
120123
throw new ClientException("Unknown TLS authentication strategy: "
121124
+ trustStrategy.strategy().name());

‎driver/src/main/java/org/neo4j/driver/internal/security/SecurityPlan.java

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -19,7 +19,7 @@
1919
package org.neo4j.driver.internal.security;
2020

2121
import javax.net.ssl.SSLContext;
22-
import org.neo4j.driver.internal.RevocationStrategy;
22+
import org.neo4j.driver.RevocationCheckingStrategy;
2323

2424
/**
2525
* A SecurityPlan consists of encryption and trust details.
@@ -31,5 +31,5 @@ public interface SecurityPlan {
3131

3232
boolean requiresHostnameVerification();
3333

34-
RevocationStrategy revocationStrategy();
34+
RevocationCheckingStrategy revocationPolicy();
3535
}

‎driver/src/main/java/org/neo4j/driver/internal/security/SecurityPlanImpl.java

Lines changed: 25 additions & 22 deletions
Original file line numberDiff line numberDiff line change
@@ -18,8 +18,8 @@
1818
*/
1919
package org.neo4j.driver.internal.security;
2020

21-
import static org.neo4j.driver.internal.RevocationStrategy.VERIFY_IF_PRESENT;
22-
import static org.neo4j.driver.internal.RevocationStrategy.requiresRevocationChecking;
21+
import static org.neo4j.driver.RevocationCheckingStrategy.VERIFY_IF_PRESENT;
22+
import static org.neo4j.driver.RevocationCheckingStrategy.requiresRevocationChecking;
2323
import static org.neo4j.driver.internal.util.CertificateTool.loadX509Cert;
2424

2525
import java.io.File;
@@ -41,36 +41,39 @@
4141
import javax.net.ssl.TrustManager;
4242
import javax.net.ssl.TrustManagerFactory;
4343
import javax.net.ssl.X509TrustManager;
44-
import org.neo4j.driver.internal.RevocationStrategy;
44+
import org.neo4j.driver.RevocationCheckingStrategy;
4545

4646
/**
4747
* A SecurityPlan consists of encryption and trust details.
4848
*/
4949
public class SecurityPlanImpl implements SecurityPlan {
5050
public static SecurityPlan forAllCertificates(
51-
boolean requiresHostnameVerification, RevocationStrategy revocationStrategy)
51+
boolean requiresHostnameVerification, RevocationCheckingStrategy revocationCheckingStrategy)
5252
throws GeneralSecurityException {
5353
SSLContext sslContext = SSLContext.getInstance("TLS");
5454
sslContext.init(new KeyManager[0], new TrustManager[] {new TrustAllTrustManager()}, null);
5555

56-
return new SecurityPlanImpl(true, sslContext, requiresHostnameVerification, revocationStrategy);
56+
return new SecurityPlanImpl(true, sslContext, requiresHostnameVerification, revocationCheckingStrategy);
5757
}
5858

5959
public static SecurityPlan forCustomCASignedCertificates(
60-
List<File> certFiles, boolean requiresHostnameVerification, RevocationStrategy revocationStrategy)
60+
List<File> certFiles,
61+
boolean requiresHostnameVerification,
62+
RevocationCheckingStrategy revocationCheckingStrategy)
6163
throws GeneralSecurityException, IOException {
62-
SSLContext sslContext = configureSSLContext(certFiles, revocationStrategy);
63-
return new SecurityPlanImpl(true, sslContext, requiresHostnameVerification, revocationStrategy);
64+
SSLContext sslContext = configureSSLContext(certFiles, revocationCheckingStrategy);
65+
return new SecurityPlanImpl(true, sslContext, requiresHostnameVerification, revocationCheckingStrategy);
6466
}
6567

6668
public static SecurityPlan forSystemCASignedCertificates(
67-
boolean requiresHostnameVerification, RevocationStrategy revocationStrategy)
69+
boolean requiresHostnameVerification, RevocationCheckingStrategy revocationCheckingStrategy)
6870
throws GeneralSecurityException, IOException {
69-
SSLContext sslContext = configureSSLContext(Collections.emptyList(), revocationStrategy);
70-
return new SecurityPlanImpl(true, sslContext, requiresHostnameVerification, revocationStrategy);
71+
SSLContext sslContext = configureSSLContext(Collections.emptyList(), revocationCheckingStrategy);
72+
return new SecurityPlanImpl(true, sslContext, requiresHostnameVerification, revocationCheckingStrategy);
7173
}
7274

73-
private static SSLContext configureSSLContext(List<File> customCertFiles, RevocationStrategy revocationStrategy)
75+
private static SSLContext configureSSLContext(
76+
List<File> customCertFiles, RevocationCheckingStrategy revocationCheckingStrategy)
7477
throws GeneralSecurityException, IOException {
7578
KeyStore trustedKeyStore = KeyStore.getInstance(KeyStore.getDefaultType());
7679
trustedKeyStore.load(null, null);
@@ -83,7 +86,7 @@ private static SSLContext configureSSLContext(List<File> customCertFiles, Revoca
8386
}
8487

8588
PKIXBuilderParameters pkixBuilderParameters =
86-
configurePKIXBuilderParameters(trustedKeyStore, revocationStrategy);
89+
configurePKIXBuilderParameters(trustedKeyStore, revocationCheckingStrategy);
8790

8891
SSLContext sslContext = SSLContext.getInstance("TLS");
8992
TrustManagerFactory trustManagerFactory =
@@ -101,11 +104,11 @@ private static SSLContext configureSSLContext(List<File> customCertFiles, Revoca
101104
}
102105

103106
private static PKIXBuilderParameters configurePKIXBuilderParameters(
104-
KeyStore trustedKeyStore, RevocationStrategy revocationStrategy)
107+
KeyStore trustedKeyStore, RevocationCheckingStrategy revocationCheckingStrategy)
105108
throws InvalidAlgorithmParameterException, KeyStoreException {
106109
PKIXBuilderParameters pkixBuilderParameters = null;
107110

108-
if (requiresRevocationChecking(revocationStrategy)) {
111+
if (requiresRevocationChecking(revocationCheckingStrategy)) {
109112
// Configure certificate revocation checking (X509CertSelector() selects all certificates)
110113
pkixBuilderParameters = new PKIXBuilderParameters(trustedKeyStore, new X509CertSelector());
111114

@@ -115,7 +118,7 @@ private static PKIXBuilderParameters configurePKIXBuilderParameters(
115118
// enables status_request extension in client hello
116119
System.setProperty("jdk.tls.client.enableStatusRequestExtension", "true");
117120

118-
if (revocationStrategy.equals(VERIFY_IF_PRESENT)) {
121+
if (revocationCheckingStrategy.equals(VERIFY_IF_PRESENT)) {
119122
// enables soft-fail behaviour if no stapled response found.
120123
Security.setProperty("ocsp.enable", "true");
121124
}
@@ -146,23 +149,23 @@ private static void loadSystemCertificates(KeyStore trustedKeyStore) throws Gene
146149
}
147150

148151
public static SecurityPlan insecure() {
149-
return new SecurityPlanImpl(false, null, false, RevocationStrategy.NO_CHECKS);
152+
return new SecurityPlanImpl(false, null, false, RevocationCheckingStrategy.NO_CHECKS);
150153
}
151154

152155
private final boolean requiresEncryption;
153156
private final SSLContext sslContext;
154157
private final boolean requiresHostnameVerification;
155-
private final RevocationStrategy revocationStrategy;
158+
private final RevocationCheckingStrategy revocationCheckingStrategy;
156159

157160
private SecurityPlanImpl(
158161
boolean requiresEncryption,
159162
SSLContext sslContext,
160163
boolean requiresHostnameVerification,
161-
RevocationStrategy revocationStrategy) {
164+
RevocationCheckingStrategy revocationCheckingStrategy) {
162165
this.requiresEncryption = requiresEncryption;
163166
this.sslContext = sslContext;
164167
this.requiresHostnameVerification = requiresHostnameVerification;
165-
this.revocationStrategy = revocationStrategy;
168+
this.revocationCheckingStrategy = revocationCheckingStrategy;
166169
}
167170

168171
@Override
@@ -181,8 +184,8 @@ public boolean requiresHostnameVerification() {
181184
}
182185

183186
@Override
184-
public RevocationStrategy revocationStrategy() {
185-
return revocationStrategy;
187+
public RevocationCheckingStrategy revocationPolicy() {
188+
return revocationCheckingStrategy;
186189
}
187190

188191
private static class TrustAllTrustManager implements X509TrustManager {

‎driver/src/test/java/org/neo4j/driver/ConfigTest.java

Lines changed: 10 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -26,9 +26,6 @@
2626
import static org.junit.jupiter.api.Assertions.assertThrows;
2727
import static org.junit.jupiter.api.Assertions.assertTrue;
2828
import static org.mockito.Mockito.mock;
29-
import static org.neo4j.driver.internal.RevocationStrategy.NO_CHECKS;
30-
import static org.neo4j.driver.internal.RevocationStrategy.STRICT;
31-
import static org.neo4j.driver.internal.RevocationStrategy.VERIFY_IF_PRESENT;
3229
import static org.neo4j.driver.internal.handlers.pulln.FetchSizeUtil.DEFAULT_FETCH_SIZE;
3330

3431
import java.io.File;
@@ -44,6 +41,7 @@
4441
import org.junit.jupiter.params.provider.ValueSource;
4542
import org.junit.platform.commons.support.HierarchyTraversalMode;
4643
import org.junit.platform.commons.support.ReflectionSupport;
44+
import org.neo4j.driver.internal.RevocationStrategy;
4745
import org.neo4j.driver.internal.logging.ConsoleLogging;
4846
import org.neo4j.driver.internal.logging.DevNullLogging;
4947
import org.neo4j.driver.internal.logging.JULogging;
@@ -279,19 +277,24 @@ void shouldEnableAndDisableHostnameVerificationOnTrustStrategy() {
279277
assertFalse(trustStrategy.isHostnameVerificationEnabled());
280278
}
281279

280+
@SuppressWarnings("deprecation")
282281
@Test
283282
void shouldEnableAndDisableCertificateRevocationChecksOnTestStrategy() {
284283
Config.TrustStrategy trustStrategy = Config.TrustStrategy.trustSystemCertificates();
285-
assertEquals(NO_CHECKS, trustStrategy.revocationStrategy());
284+
assertEquals(RevocationCheckingStrategy.NO_CHECKS, trustStrategy.revocationPolicy());
285+
assertEquals(RevocationStrategy.NO_CHECKS, trustStrategy.revocationStrategy());
286286

287287
assertSame(trustStrategy, trustStrategy.withoutCertificateRevocationChecks());
288-
assertEquals(NO_CHECKS, trustStrategy.revocationStrategy());
288+
assertEquals(RevocationCheckingStrategy.NO_CHECKS, trustStrategy.revocationPolicy());
289+
assertEquals(RevocationStrategy.NO_CHECKS, trustStrategy.revocationStrategy());
289290

290291
assertSame(trustStrategy, trustStrategy.withStrictRevocationChecks());
291-
assertEquals(STRICT, trustStrategy.revocationStrategy());
292+
assertEquals(RevocationCheckingStrategy.STRICT, trustStrategy.revocationPolicy());
293+
assertEquals(RevocationStrategy.STRICT, trustStrategy.revocationStrategy());
292294

293295
assertSame(trustStrategy, trustStrategy.withVerifyIfPresentRevocationChecks());
294-
assertEquals(VERIFY_IF_PRESENT, trustStrategy.revocationStrategy());
296+
assertEquals(RevocationCheckingStrategy.VERIFY_IF_PRESENT, trustStrategy.revocationPolicy());
297+
assertEquals(RevocationStrategy.VERIFY_IF_PRESENT, trustStrategy.revocationStrategy());
295298
}
296299

297300
@Test

‎driver/src/test/java/org/neo4j/driver/integration/ChannelConnectorImplIT.java

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -49,12 +49,12 @@
4949
import org.junit.jupiter.api.extension.RegisterExtension;
5050
import org.neo4j.driver.AuthToken;
5151
import org.neo4j.driver.AuthTokens;
52+
import org.neo4j.driver.RevocationCheckingStrategy;
5253
import org.neo4j.driver.exceptions.AuthenticationException;
5354
import org.neo4j.driver.exceptions.ServiceUnavailableException;
5455
import org.neo4j.driver.internal.BoltServerAddress;
5556
import org.neo4j.driver.internal.ConnectionSettings;
5657
import org.neo4j.driver.internal.DefaultDomainNameResolver;
57-
import org.neo4j.driver.internal.RevocationStrategy;
5858
import org.neo4j.driver.internal.async.connection.BootstrapFactory;
5959
import org.neo4j.driver.internal.async.connection.ChannelConnector;
6060
import org.neo4j.driver.internal.async.connection.ChannelConnectorImpl;
@@ -222,6 +222,6 @@ private ChannelConnectorImpl newConnector(
222222
}
223223

224224
private static SecurityPlan trustAllCertificates() throws GeneralSecurityException {
225-
return SecurityPlanImpl.forAllCertificates(false, RevocationStrategy.NO_CHECKS);
225+
return SecurityPlanImpl.forAllCertificates(false, RevocationCheckingStrategy.NO_CHECKS);
226226
}
227227
}

0 commit comments

Comments
 (0)