Skip to content

Commit 9c40e29

Browse files
Aaron3SAaron3S
committed
feat: support pg ssl
1 parent f750494 commit 9c40e29

File tree

9 files changed

+128
-64
lines changed

9 files changed

+128
-64
lines changed

‎backend/framework/src/main/java/org/jumpserver/chen/framework/datasource/base/BaseConnectionManager.java

+1-27
Original file line numberDiff line numberDiff line change
@@ -10,7 +10,6 @@
1010
import org.jumpserver.chen.framework.driver.DriverClassLoader;
1111
import org.jumpserver.chen.framework.driver.DriverManager;
1212
import org.jumpserver.chen.framework.i18n.MessageUtils;
13-
import org.jumpserver.chen.framework.ssl.JKSGenerator;
1413

1514
import java.lang.reflect.InvocationTargetException;
1615
import java.sql.Connection;
@@ -50,32 +49,7 @@ public void ping(String jdbcUrl) throws SQLException {
5049
this.ping(jdbcUrl, props);
5150
}
5251

53-
protected void setSSLProps(Properties props) {
54-
if (this.getConnectInfo().getOptions().get("useSSL") != null
55-
&& (boolean) this.getConnectInfo().getOptions().get("useSSL")) {
56-
props.setProperty("useSSL", "true");
57-
props.setProperty("requireSSL", "true");
58-
var jksGenerator = new JKSGenerator();
59-
if ((boolean) this.getConnectInfo().getOptions().get("verifyServerCertificate")) {
60-
props.setProperty("verifyServerCertificate", "true");
61-
jksGenerator.setCaCert((String) this.getConnectInfo().getOptions().get("caCert"));
62-
63-
var caCertPath = jksGenerator.generateCaJKS();
64-
props.setProperty("trustCertificateKeyStoreUrl", "file:" + caCertPath);
65-
props.setProperty("trustCertificateKeyStorePassword", JKSGenerator.JSK_PASS);
66-
67-
}
68-
if (StringUtils.isNotBlank((String) this.getConnectInfo().getOptions().get("clientCert"))) {
69-
jksGenerator.setClientCert((String) this.getConnectInfo().getOptions().get("clientCert"));
70-
jksGenerator.setClientKey((String) this.getConnectInfo().getOptions().get("clientKey"));
71-
var clientCertPath = jksGenerator.generateClientJKS();
72-
props.setProperty("clientCertificateKeyStoreUrl", "file:" + clientCertPath);
73-
props.setProperty("clientCertificateKeyStorePassword", JKSGenerator.JSK_PASS);
74-
props.setProperty("clientKeyPassword", JKSGenerator.JSK_PASS);
75-
76-
}
77-
}
78-
}
52+
protected void setSSLProps(Properties props) {}
7953

8054

8155
public List<DriverClassLoader> getDriverClassLoaders() {

‎backend/framework/src/main/java/org/jumpserver/chen/framework/ssl/SSLConfig.java

-17
This file was deleted.

‎backend/framework/src/main/java/org/jumpserver/chen/framework/ssl/SSLContext.java

-6
This file was deleted.

‎backend/framework/src/main/java/org/jumpserver/chen/framework/ssl/SSlUtils.java

-12
This file was deleted.

‎backend/framework/src/main/java/org/jumpserver/chen/framework/ssl/JKSGenerator.java ‎backend/modules/src/main/java/org.jumpserver.chen.modules/base/ssl/JKSGenerator.java

+1-1
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,4 @@
1-
package org.jumpserver.chen.framework.ssl;
1+
package org.jumpserver.chen.modules.base.ssl;
22

33
import lombok.Setter;
44
import org.apache.commons.lang3.StringUtils;

‎backend/modules/src/main/java/org.jumpserver.chen.modules/base/ssl/SSLCertManager.java

+76
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,76 @@
1+
package org.jumpserver.chen.modules.base.ssl;
2+
3+
import lombok.Setter;
4+
5+
import java.io.File;
6+
import java.io.FileWriter;
7+
import java.io.IOException;
8+
import java.nio.file.Files;
9+
10+
public class SSLCertManager {
11+
12+
@Setter
13+
private String caCert; // CA 证书
14+
@Setter
15+
private String clientCertKey; // 客户端私钥
16+
@Setter
17+
private String clientCert; // 客户端证书
18+
19+
20+
private File caCertFile;
21+
private File clientCertKeyFile;
22+
private File clientCertFile;
23+
24+
// 获取 CA 证书的路径
25+
private String getCaCertPath() throws IOException {
26+
if (caCertFile == null) {
27+
caCertFile = createTempFile("ca-cert", caCert);
28+
}
29+
return caCertFile.getAbsolutePath();
30+
}
31+
32+
// 获取客户端私钥的路径
33+
private String getClientCertKeyPath() throws IOException {
34+
if (clientCertKeyFile == null) {
35+
clientCertKeyFile = createTempFile("client-cert-key", clientCertKey);
36+
}
37+
return clientCertKeyFile.getAbsolutePath();
38+
}
39+
40+
// 获取客户端证书的路径
41+
private String getClientCertPath() throws IOException {
42+
if (clientCertFile == null) {
43+
clientCertFile = createTempFile("client-cert", clientCert);
44+
}
45+
return clientCertFile.getAbsolutePath();
46+
}
47+
48+
// 销毁资源，如果 autoDestroy 为 true，则删除临时文件
49+
public void Destroy() {
50+
deleteTempFile(caCertFile);
51+
deleteTempFile(clientCertKeyFile);
52+
deleteTempFile(clientCertFile);
53+
}
54+
55+
// 辅助方法：创建临时文件并写入内容
56+
private File createTempFile(String prefix, String content) throws IOException {
57+
File tempFile = File.createTempFile(prefix, ".pem");
58+
try (FileWriter writer = new FileWriter(tempFile)) {
59+
writer.write(content);
60+
}
61+
tempFile.deleteOnExit(); // JVM 退出时自动删除
62+
return tempFile;
63+
}
64+
65+
// 辅助方法：删除临时文件
66+
private void deleteTempFile(File file) {
67+
if (file != null && file.exists()) {
68+
try {
69+
Files.delete(file.toPath());
70+
System.out.println("Deleted file: " + file.getAbsolutePath());
71+
} catch (IOException e) {
72+
System.err.println("Failed to delete file: " + file.getAbsolutePath());
73+
}
74+
}
75+
}
76+
}

‎backend/modules/src/main/java/org.jumpserver.chen.modules/mysql/MysqlConnectionManager.java

+32
Original file line numberDiff line numberDiff line change
@@ -1,11 +1,14 @@
11
package org.jumpserver.chen.modules.mysql;
22

3+
import org.apache.commons.lang3.StringUtils;
34
import org.jumpserver.chen.framework.datasource.Datasource;
45
import org.jumpserver.chen.framework.datasource.base.BaseConnectionManager;
56
import org.jumpserver.chen.framework.datasource.entity.DBConnectInfo;
67
import org.jumpserver.chen.framework.datasource.sql.SQL;
8+
import org.jumpserver.chen.modules.base.ssl.JKSGenerator;
79

810
import java.sql.SQLException;
11+
import java.util.Properties;
912

1013
public class MysqlConnectionManager extends BaseConnectionManager {
1114

@@ -29,6 +32,35 @@ public void ping() throws SQLException {
2932
this.jdbcUrl = url;
3033
}
3134

35+
36+
protected void setSSLProps(Properties props) {
37+
if (this.getConnectInfo().getOptions().get("useSSL") != null
38+
&& (boolean) this.getConnectInfo().getOptions().get("useSSL")) {
39+
40+
props.setProperty("useSSL", "true");
41+
props.setProperty("requireSSL", "true");
42+
43+
var jksGenerator = new JKSGenerator();
44+
if ((boolean) this.getConnectInfo().getOptions().get("verifyServerCertificate")) {
45+
props.setProperty("verifyServerCertificate", "true");
46+
jksGenerator.setCaCert((String) this.getConnectInfo().getOptions().get("caCert"));
47+
48+
var caCertPath = jksGenerator.generateCaJKS();
49+
props.setProperty("trustCertificateKeyStoreUrl", "file:" + caCertPath);
50+
props.setProperty("trustCertificateKeyStorePassword", JKSGenerator.JSK_PASS);
51+
52+
}
53+
if (StringUtils.isNotBlank((String) this.getConnectInfo().getOptions().get("clientCert"))) {
54+
jksGenerator.setClientCert((String) this.getConnectInfo().getOptions().get("clientCert"));
55+
jksGenerator.setClientKey((String) this.getConnectInfo().getOptions().get("clientKey"));
56+
var clientCertPath = jksGenerator.generateClientJKS();
57+
props.setProperty("clientCertificateKeyStoreUrl", "file:" + clientCertPath);
58+
props.setProperty("clientCertificateKeyStorePassword", JKSGenerator.JSK_PASS);
59+
props.setProperty("clientKeyPassword", JKSGenerator.JSK_PASS);
60+
}
61+
}
62+
}
63+
3264
@Override
3365
public String getVersion() throws SQLException {
3466
var result = this.sqlActuator.execute(SQL.of("select version()"));

‎backend/modules/src/main/java/org.jumpserver.chen.modules/postgresql/PostgresqlConnectionManager.java

+17
Original file line numberDiff line numberDiff line change
@@ -6,6 +6,7 @@
66
import org.jumpserver.chen.framework.datasource.sql.SQL;
77

88
import java.sql.SQLException;
9+
import java.util.Properties;
910

1011
public class PostgresqlConnectionManager extends BaseConnectionManager {
1112

@@ -30,6 +31,22 @@ public void ping() throws SQLException {
3031
this.jdbcUrl = url;
3132
}
3233

34+
protected void setSSLProps(Properties props) {
35+
if (this.getConnectInfo().getOptions().get("useSSL") != null
36+
&& (boolean) this.getConnectInfo().getOptions().get("useSSL")) {
37+
38+
var caCertPath = (String) this.getConnectInfo().getOptions().get("caCert");
39+
var clientCertPath = (String) this.getConnectInfo().getOptions().get("clientCert");
40+
var clientKeyPath = (String) this.getConnectInfo().getOptions().get("clientKey");
41+
42+
props.setProperty("ssl", "true");
43+
props.setProperty("sslmode", "verify-full");
44+
props.setProperty("sslrootcert", caCertPath);
45+
props.setProperty("sslcert", clientCertPath);
46+
props.setProperty("sslkey", clientKeyPath);
47+
}
48+
}
49+
3350
private static final String SQL_GET_VERSION = "SELECT version()";
3451

3552
@Override

‎backend/modules/src/test/java/mysql/TestMysqlDriver.java

+1-1
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
11
package mysql;
22

33
import com.alibaba.druid.pool.DruidDataSource;
4-
import org.jumpserver.chen.framework.ssl.JKSGenerator;
4+
import org.jumpserver.chen.modules.base.ssl.JKSGenerator;
55

66
import java.lang.reflect.InvocationTargetException;
77
import java.net.MalformedURLException;

0 commit comments

Comments
 (0)