Added option to remove identity route

Author: Hakky54

sslcontext-kickstart/src/main/java/nl/altindag/ssl/keymanager/AggregatedX509ExtendedKeyManager.java

@@ -26,11 +26,11 @@
 import java.security.PrivateKey;
 import java.security.cert.X509Certificate;
 import java.util.Collections;
-import java.util.HashMap;
 import java.util.LinkedHashMap;
 import java.util.List;
 import java.util.Map;
 import java.util.Objects;
+import java.util.concurrent.ConcurrentHashMap;
 
 /**
  * Represents an ordered list of {@link X509ExtendedKeyManager} with most-preferred managers first.
@@ -86,7 +86,7 @@ public AggregatedX509ExtendedKeyManager(Map<String, ? extends X509ExtendedKeyMan
     public AggregatedX509ExtendedKeyManager(Map<String, ? extends X509ExtendedKeyManager> keyManagers,
                                             Map<String, List<URI>> preferredAliasToHost) {
         this.keyManagers = Collections.synchronizedMap(new LinkedHashMap<>(keyManagers));
-        this.preferredAliasToHost = new HashMap<>(preferredAliasToHost);
+        this.preferredAliasToHost = new ConcurrentHashMap<>(preferredAliasToHost);
     }
 
     /**

sslcontext-kickstart/src/main/java/nl/altindag/ssl/util/KeyManagerUtils.java

@@ -233,31 +233,41 @@ public static void swapKeyManager(X509KeyManager baseKeyManager, X509KeyManager
     }
 
     public static void addIdentityRoute(X509ExtendedKeyManager keyManager, String alias, String... hosts) {
-        addIdentityRoute(keyManager, alias, hosts, false);
+        computeIdentityRoute(keyManager, alias, hosts, false, false);
     }
 
     public static void overrideIdentityRoute(X509ExtendedKeyManager keyManager, String alias, String... hosts) {
-        addIdentityRoute(keyManager, alias, hosts, true);
+        computeIdentityRoute(keyManager, alias, hosts, true, false);
     }
 
-    private static void addIdentityRoute(X509ExtendedKeyManager keyManager,
-                                         String alias,
-                                         String[] hosts,
-                                         boolean overrideExistingRouteEnabled) {
+    public static void removeIdentityRoute(X509ExtendedKeyManager keyManager, String alias) {
+        computeIdentityRoute(keyManager, alias, null, false, true);
+    }
+
+    private static void computeIdentityRoute(X509ExtendedKeyManager keyManager,
+                                             String alias,
+                                             String[] hosts,
+                                             boolean overrideExistingRouteEnabled,
+                                             boolean removeExistingRouteEnabled) {
 
         requireNotNull(keyManager, GENERIC_EXCEPTION_MESSAGE.apply("KeyManager"));
         requireNotNull(alias, GENERIC_EXCEPTION_MESSAGE.apply("Alias"));
-        requireNotNull(keyManager, GENERIC_EXCEPTION_MESSAGE.apply("Host"));
 
         if (keyManager instanceof DelegatingX509ExtendedKeyManager) {
-            addIdentityRoute(((DelegatingX509ExtendedKeyManager) keyManager).getInnerKeyManager(), alias, hosts, overrideExistingRouteEnabled);
+            computeIdentityRoute(((DelegatingX509ExtendedKeyManager) keyManager).getInnerKeyManager(), alias, hosts, overrideExistingRouteEnabled, removeExistingRouteEnabled);
             return;
         }
 
         if (keyManager instanceof AggregatedX509ExtendedKeyManager) {
             AggregatedX509ExtendedKeyManager aggregatedX509ExtendedKeyManager = (AggregatedX509ExtendedKeyManager) keyManager;
             Map<String, List<URI>> aliasToHosts = aggregatedX509ExtendedKeyManager.getIdentityRoute();
 
+            if (removeExistingRouteEnabled) {
+                aliasToHosts.remove(alias);
+                return;
+            }
+
+            requireNotNull(hosts, GENERIC_EXCEPTION_MESSAGE.apply("Host"));
             List<URI> uris = new ArrayList<>();
             for (String host : hosts) {
                 URI uri = URI.create(host);
@@ -370,9 +380,10 @@ public static void addIdentityMaterial(X509ExtendedKeyManager baseKeyManager, St
             return;
         }
 
-        throw new GenericKeyManagerException(
-                String.format("The provided keyManager should be an instance of [%s]", InflatableX509ExtendedKeyManager.class.getName())
-        );
+        throw new GenericKeyManagerException(String.format(
+                "KeyManager should be an instance of: [%s], but received: [%s]",
+                InflatableX509ExtendedKeyManager.class.getName(),
+                baseKeyManager.getClass().getName()));
     }
 
     /**

sslcontext-kickstart/src/test/java/nl/altindag/ssl/util/KeyManagerUtilsShould.java

@@ -357,7 +357,8 @@ void addClientIdentityRoutesToInflatableKeyManager() {
         KeyStore identityOne = KeyStoreUtils.loadKeyStore(KEYSTORE_LOCATION + IDENTITY_FILE_NAME, IDENTITY_PASSWORD);
         KeyStore identityTwo = KeyStoreUtils.loadKeyStore(KEYSTORE_LOCATION + IDENTITY_TWO_FILE_NAME, IDENTITY_PASSWORD);
 
-        X509ExtendedKeyManager inflatableKeyManager = KeyManagerUtils.keyManagerBuilder().withInflatableKeyManager(true)
+        X509ExtendedKeyManager inflatableKeyManager = KeyManagerUtils.keyManagerBuilder()
+                .withInflatableKeyManager(true)
                 .withIdentity(identityOne, IDENTITY_PASSWORD, KeyManagerFactory.getDefaultAlgorithm())
                 .withIdentity(identityTwo, IDENTITY_PASSWORD, KeyManagerFactory.getDefaultAlgorithm())
                 .build();
@@ -417,6 +418,29 @@ void addClientIdentities() {
                 .containsValue(Arrays.asList("https://localhost:8443/", "https://localhost:8453/"));
     }
 
+    @Test
+    void removeClientIdentityRoutes() {
+        KeyStore identityOne = KeyStoreUtils.loadKeyStore(KEYSTORE_LOCATION + IDENTITY_FILE_NAME, IDENTITY_PASSWORD);
+        KeyStore identityTwo = KeyStoreUtils.loadKeyStore(KEYSTORE_LOCATION + IDENTITY_TWO_FILE_NAME, IDENTITY_PASSWORD);
+
+        X509ExtendedKeyManager inflatableKeyManager = KeyManagerUtils.keyManagerBuilder()
+                .withInflatableKeyManager(true)
+                .withIdentity(identityOne, IDENTITY_PASSWORD, KeyManagerFactory.getDefaultAlgorithm())
+                .withIdentity(identityTwo, IDENTITY_PASSWORD, KeyManagerFactory.getDefaultAlgorithm())
+                .build();
+
+        KeyManagerUtils.addIdentityRoute(inflatableKeyManager, "client","https://localhost:8443/");
+        KeyManagerUtils.addIdentityRoute(inflatableKeyManager, "client","https://localhost:8453/");
+        Map<String, List<String>> identityRoute = KeyManagerUtils.getIdentityRoute(inflatableKeyManager);
+
+        assertThat(identityRoute)
+                .containsKey("client")
+                .containsValue(Arrays.asList("https://localhost:8443/", "https://localhost:8453/"));
+
+        KeyManagerUtils.removeIdentityRoute(inflatableKeyManager, "client");
+        assertThat(KeyManagerUtils.getIdentityRoute(inflatableKeyManager)).isEmpty();
+    }
+
     @Test
     void addClientIdentityRoutesWhenTryingToOverrideANonExistingRoute() {
         KeyStore identityOne = KeyStoreUtils.loadKeyStore(KEYSTORE_LOCATION + IDENTITY_FILE_NAME, IDENTITY_PASSWORD);
@@ -593,7 +617,7 @@ void throwsExceptionWhenAddingIdentityMaterialToNonInflatableKeyManager() {
 
         assertThatThrownBy(() -> KeyManagerUtils.addIdentityMaterial(keyManager, "key-manager-one", identityTwo, IDENTITY_PASSWORD))
                 .isInstanceOf(GenericKeyManagerException.class)
-                .hasMessage("The provided keyManager should be an instance of [nl.altindag.ssl.keymanager.InflatableX509ExtendedKeyManager]");
+                .hasMessage("KeyManager should be an instance of: [nl.altindag.ssl.keymanager.InflatableX509ExtendedKeyManager], but received: [sun.security.ssl.SunX509KeyManagerImpl]");
     }
 
     @Test
@@ -607,7 +631,7 @@ void throwsExceptionWhenAddingIdentityMaterialToNonInflatableKeyManagerWrappedIn
 
         assertThatThrownBy(() -> KeyManagerUtils.addIdentityMaterial(keyManager, "key-manager-one", identityTwo, IDENTITY_PASSWORD))
                 .isInstanceOf(GenericKeyManagerException.class)
-                .hasMessage("The provided keyManager should be an instance of [nl.altindag.ssl.keymanager.InflatableX509ExtendedKeyManager]");
+                .hasMessage("KeyManager should be an instance of: [nl.altindag.ssl.keymanager.InflatableX509ExtendedKeyManager], but received: [nl.altindag.ssl.keymanager.AggregatedX509ExtendedKeyManager]");
     }
 
     @Test