Skip to content
Draft
Show file tree
Hide file tree
Changes from all commits
Commits
File filter

Filter by extension

Filter by extension


Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
51 changes: 50 additions & 1 deletion driver/src/main/java/org/neo4j/driver/Config.java
Original file line number Diff line number Diff line change
Expand Up @@ -30,7 +30,7 @@
import org.neo4j.driver.exceptions.ServiceUnavailableException;
import org.neo4j.driver.exceptions.SessionExpiredException;
import org.neo4j.driver.exceptions.TransientException;
import org.neo4j.driver.internal.ConnectionSettings;
import org.neo4j.driver.internal.RevocationStrategy;
import org.neo4j.driver.internal.SecuritySettings;
import org.neo4j.driver.internal.async.pool.PoolSettings;
import org.neo4j.driver.internal.cluster.RoutingSettings;
Expand Down Expand Up @@ -802,6 +802,7 @@ public enum Strategy
private final Strategy strategy;
private final File certFile;
private boolean hostnameVerificationEnabled = true;
private RevocationStrategy revocationStrategy = RevocationStrategy.NO_CHECKS;

private TrustStrategy( Strategy strategy )
{
Expand Down Expand Up @@ -901,5 +902,53 @@ public static TrustStrategy trustAllCertificates()
{
return new TrustStrategy( Strategy.TRUST_ALL_CERTIFICATES );
}

/**
* The revocation strategy used for verifying certificates.
* @return this {@link TrustStrategy}'s revocation strategy
*/
public RevocationStrategy revocationStrategy()
{
return revocationStrategy;
}

/**
* Configures the {@link TrustStrategy} to not carry out OCSP revocation checks on certificates. This is the
* option that is configured by default.
* @return the current trust strategy
*/
public TrustStrategy withoutCertificateRevocationChecks()
{
this.revocationStrategy = RevocationStrategy.NO_CHECKS;
return this;
}

/**
* Configures the {@link TrustStrategy} to carry out OCSP revocation checks when the revocation status is
* stapled to the certificate. If no stapled response is found, then certificate verification continues
* (and does not fail verification). This setting also requires the server to be configured to enable
* OCSP stapling.
* @return the current trust strategy
*/
public TrustStrategy withVerifyIfPresentRevocationChecks()
{
this.revocationStrategy = RevocationStrategy.VERIFY_IF_PRESENT;
return this;
}

/**
* Configures the {@link TrustStrategy} to carry out strict OCSP revocation checks for revocation status that
* are stapled to the certificate. If no stapled response is found, then the driver will fail certificate verification
* and not connect to the server. This setting also requires the server to be configured to enable OCSP stapling.
*
* Note: enabling this setting will prevent the driver connecting to the server when the server is unable to reach
* the certificate's configured OCSP responder URL.
* @return the current trust strategy
*/
public TrustStrategy withStrictRevocationChecks()
{
this.revocationStrategy = RevocationStrategy.STRICT;
return this;
}
}
}
Original file line number Diff line number Diff line change
Expand Up @@ -202,7 +202,6 @@ public Builder withTimeout( Duration timeout )
public Builder withMetadata( Map<String,Object> metadata )
{
requireNonNull( metadata, "Transaction metadata should not be null" );

this.metadata = Extract.mapOfValues( metadata );
return this;
}
Expand Down
Original file line number Diff line number Diff line change
Expand Up @@ -16,23 +16,20 @@
* See the License for the specific language governing permissions and
* limitations under the License.
*/
package org.neo4j.driver.internal.messaging.v2;

import org.neo4j.driver.internal.messaging.BoltProtocol;
import org.neo4j.driver.internal.messaging.MessageFormat;
import org.neo4j.driver.internal.messaging.v1.BoltProtocolV1Test;
package org.neo4j.driver.internal;

class BoltProtocolV2Test extends BoltProtocolV1Test
public enum RevocationStrategy
{
@Override
protected BoltProtocol createProtocol()
{
return BoltProtocolV2.INSTANCE;
}
/** Don't do any OCSP revocation checks, regardless whether there are stapled revocation statuses or not. */
NO_CHECKS,
/** Verify OCSP revocation checks when the revocation status is stapled to the certificate, continue if not. */
VERIFY_IF_PRESENT,
/** Require stapled revocation status and verify OCSP revocation checks, fail if no revocation status is stapled to the certificate. */
STRICT;

@Override
protected Class<? extends MessageFormat> expectedMessageFormatType()
public static boolean requiresRevocationChecking( RevocationStrategy revocationStrategy )
{
return MessageFormatV2.class;
return revocationStrategy.equals( STRICT ) || revocationStrategy.equals( VERIFY_IF_PRESENT );
}
}
Original file line number Diff line number Diff line change
Expand Up @@ -92,11 +92,11 @@ private SecurityPlan createSecurityPlanFromScheme( String scheme ) throws Genera
{
if ( isHighTrustScheme(scheme) )
{
return SecurityPlanImpl.forSystemCASignedCertificates( true );
return SecurityPlanImpl.forSystemCASignedCertificates( true, RevocationStrategy.NO_CHECKS );
}
else
{
return SecurityPlanImpl.forAllCertificates( false );
return SecurityPlanImpl.forAllCertificates( false, RevocationStrategy.NO_CHECKS );
}
}

Expand All @@ -110,14 +110,15 @@ private static SecurityPlan createSecurityPlanImpl( boolean encrypted, Config.Tr
if ( encrypted )
{
boolean hostnameVerificationEnabled = trustStrategy.isHostnameVerificationEnabled();
RevocationStrategy revocationStrategy = trustStrategy.revocationStrategy();
switch ( trustStrategy.strategy() )
{
case TRUST_CUSTOM_CA_SIGNED_CERTIFICATES:
return SecurityPlanImpl.forCustomCASignedCertificates( trustStrategy.certFile(), hostnameVerificationEnabled );
return SecurityPlanImpl.forCustomCASignedCertificates( trustStrategy.certFile(), hostnameVerificationEnabled, revocationStrategy );
case TRUST_SYSTEM_CA_SIGNED_CERTIFICATES:
return SecurityPlanImpl.forSystemCASignedCertificates( hostnameVerificationEnabled );
return SecurityPlanImpl.forSystemCASignedCertificates( hostnameVerificationEnabled, revocationStrategy );
case TRUST_ALL_CERTIFICATES:
return SecurityPlanImpl.forAllCertificates( hostnameVerificationEnabled );
return SecurityPlanImpl.forAllCertificates( hostnameVerificationEnabled, revocationStrategy );
default:
throw new ClientException(
"Unknown TLS authentication strategy: " + trustStrategy.strategy().name() );
Expand Down
Original file line number Diff line number Diff line change
Expand Up @@ -21,11 +21,10 @@
import io.netty.buffer.ByteBuf;

import org.neo4j.driver.internal.messaging.BoltProtocolVersion;
import org.neo4j.driver.internal.messaging.v1.BoltProtocolV1;
import org.neo4j.driver.internal.messaging.v2.BoltProtocolV2;
import org.neo4j.driver.internal.messaging.v3.BoltProtocolV3;
import org.neo4j.driver.internal.messaging.v4.BoltProtocolV4;
import org.neo4j.driver.internal.messaging.v41.BoltProtocolV41;
import org.neo4j.driver.internal.messaging.v42.BoltProtocolV42;

import static io.netty.buffer.Unpooled.copyInt;
import static io.netty.buffer.Unpooled.unreleasableBuffer;
Expand All @@ -42,10 +41,10 @@ public final class BoltProtocolUtil

private static final ByteBuf HANDSHAKE_BUF = unreleasableBuffer( copyInt(
BOLT_MAGIC_PREAMBLE,
BoltProtocolV42.VERSION.toInt(),
BoltProtocolV41.VERSION.toInt(),
BoltProtocolV4.VERSION.toInt(),
BoltProtocolV3.VERSION.toInt(),
0 ) ).asReadOnly();
BoltProtocolV3.VERSION.toInt() ) ).asReadOnly();

private static final String HANDSHAKE_STRING = createHandshakeString();

Expand Down
Original file line number Diff line number Diff line change
Expand Up @@ -24,19 +24,11 @@
import org.neo4j.driver.internal.handlers.pulln.AutoPullResponseHandler;
import org.neo4j.driver.internal.handlers.pulln.BasicPullResponseHandler;
import org.neo4j.driver.internal.handlers.pulln.PullResponseHandler;
import org.neo4j.driver.internal.messaging.v1.BoltProtocolV1;
import org.neo4j.driver.internal.messaging.v3.BoltProtocolV3;
import org.neo4j.driver.internal.spi.Connection;

public class PullHandlers
{
public static PullAllResponseHandler newBoltV1PullAllHandler(Query query, RunResponseHandler runHandler,
Connection connection, UnmanagedTransaction tx )
{
PullResponseCompletionListener completionListener = createPullResponseCompletionListener( connection, BookmarkHolder.NO_OP, tx );

return new LegacyPullAllResponseHandler(query, runHandler, connection, BoltProtocolV1.METADATA_EXTRACTOR, completionListener );
}

public static PullAllResponseHandler newBoltV3PullAllHandler(Query query, RunResponseHandler runHandler, Connection connection,
BookmarkHolder bookmarkHolder, UnmanagedTransaction tx )
Expand Down
Original file line number Diff line number Diff line change
Expand Up @@ -21,7 +21,6 @@
import io.netty.channel.Channel;
import io.netty.channel.ChannelPromise;

import java.util.Map;
import java.util.concurrent.CompletionStage;

import org.neo4j.driver.AuthToken;
Expand All @@ -30,18 +29,16 @@
import org.neo4j.driver.Session;
import org.neo4j.driver.Transaction;
import org.neo4j.driver.TransactionConfig;
import org.neo4j.driver.Value;
import org.neo4j.driver.exceptions.ClientException;
import org.neo4j.driver.internal.BookmarkHolder;
import org.neo4j.driver.internal.InternalBookmark;
import org.neo4j.driver.internal.async.UnmanagedTransaction;
import org.neo4j.driver.internal.cluster.RoutingContext;
import org.neo4j.driver.internal.cursor.ResultCursorFactory;
import org.neo4j.driver.internal.messaging.v1.BoltProtocolV1;
import org.neo4j.driver.internal.messaging.v2.BoltProtocolV2;
import org.neo4j.driver.internal.messaging.v3.BoltProtocolV3;
import org.neo4j.driver.internal.messaging.v4.BoltProtocolV4;
import org.neo4j.driver.internal.messaging.v41.BoltProtocolV41;
import org.neo4j.driver.internal.messaging.v42.BoltProtocolV42;
import org.neo4j.driver.internal.spi.Connection;

import static org.neo4j.driver.internal.async.connection.ChannelAttributes.protocolVersion;
Expand Down Expand Up @@ -155,25 +152,22 @@ static BoltProtocol forChannel( Channel channel )
*/
static BoltProtocol forVersion( BoltProtocolVersion version )
{
if ( BoltProtocolV1.VERSION.equals( version ) )
{
return BoltProtocolV1.INSTANCE;
}
else if ( BoltProtocolV2.VERSION.equals( version ) )
{
return BoltProtocolV2.INSTANCE;
}
else if ( BoltProtocolV3.VERSION.equals( version ) )
if ( BoltProtocolV3.VERSION.equals( version ) )
{
return BoltProtocolV3.INSTANCE;
}
else if ( BoltProtocolV4.VERSION.equals( version ) )
{
return BoltProtocolV4.INSTANCE;
} else if ( BoltProtocolV41.VERSION.equals( version ) )
}
else if ( BoltProtocolV41.VERSION.equals( version ) )
{
return BoltProtocolV41.INSTANCE;
}
else if ( BoltProtocolV42.VERSION.equals( version ) )
{
return BoltProtocolV42.INSTANCE;
}
throw new ClientException( "Unknown protocol version: " + version );
}
}
Original file line number Diff line number Diff line change
Expand Up @@ -16,11 +16,12 @@
* See the License for the specific language governing permissions and
* limitations under the License.
*/
package org.neo4j.driver.internal.messaging.v1;
package org.neo4j.driver.internal.messaging.common;

import java.io.IOException;
import java.util.Map;

import org.neo4j.driver.Value;
import org.neo4j.driver.internal.messaging.MessageFormat;
import org.neo4j.driver.internal.messaging.ResponseMessageHandler;
import org.neo4j.driver.internal.messaging.ValueUnpacker;
Expand All @@ -29,18 +30,17 @@
import org.neo4j.driver.internal.messaging.response.RecordMessage;
import org.neo4j.driver.internal.messaging.response.SuccessMessage;
import org.neo4j.driver.internal.packstream.PackInput;
import org.neo4j.driver.Value;

public class MessageReaderV1 implements MessageFormat.Reader
public class CommonMessageReader implements MessageFormat.Reader
{
private final ValueUnpacker unpacker;

public MessageReaderV1( PackInput input )
public CommonMessageReader( PackInput input )
{
this( new ValueUnpackerV1( input ) );
this( new CommonValueUnpacker( input ) );
}

protected MessageReaderV1( ValueUnpacker unpacker )
protected CommonMessageReader( ValueUnpacker unpacker )
{
this.unpacker = unpacker;
}
Expand Down
Loading