Skip to content

Enable JVM default TLS protocols #31

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
adorham wants to merge 1 commit into
base: master
Choose a base branch
from
Open

Enable JVM default TLS protocols #31

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
4 changes: 2 additions & 2 deletions README.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -74,13 +74,13 @@ DDC is a Maven project (binaries are deployed in Maven Central) so you can impor
<dependency>
<artifactId>ddc-core</artifactId>
<groupId>com.imperva.ddc</groupId>
<version>7.4.0.0.0.0</version>
<version>7.5.0.0.0.0</version>
</dependency>
<!--To work with ddc service wrapper add the following dependency-->
<dependency>
<artifactId>ddc-service</artifactId>
<groupId>com.imperva.ddc</groupId>
<version>7.4.0.0.0.0</version>
<version>7.5.0.0.0.0</version>
</dependency>

~~~
Expand Down
2 changes: 1 addition & 1 deletion source/ddc-core/pom.xml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -6,7 +6,7 @@
<parent>
<groupId>com.imperva.ddc</groupId>
<artifactId>domain-directory-controller</artifactId>
<version>7.4.0.0.0.0</version>
<version>7.5.0.0.0.0</version>
</parent>

<artifactId>ddc-core</artifactId>
Expand Down
26 changes: 26 additions & 0 deletions source/ddc-core/src/main/java/com/imperva/ddc/core/Driver.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -18,9 +18,13 @@
import org.apache.directory.ldap.client.api.exception.InvalidConnectionException;
import org.slf4j.Logger;
import org.slf4j.LoggerFactory;
import javax.net.ssl.SSLContext;
import javax.net.ssl.SSLEngine;
import javax.net.ssl.TrustManager;
import javax.net.ssl.X509TrustManager;
import java.security.GeneralSecurityException;
import java.util.ArrayList;
import java.util.Arrays;
import java.util.List;
import java.util.Map;

Expand All @@ -30,6 +34,8 @@
*/
class Driver extends DriverBase {
private static final Logger LOGGER = LoggerFactory.getLogger(Driver.class.getName());
private static final String[] FALLBACK_TLS_PROTOCOLS = new String[]{"TLSv1.2", "TLSv1.3"};
private static final String[] JVM_TLS_PROTOCOLS = resolveJvmTlsProtocols();

@Override
LdapConnectionResult connect(Endpoint endpoint) {
Expand Down Expand Up @@ -210,6 +216,7 @@ LdapNetworkConnection ldapNetworkConnectionGetInstance(String host, Integer port
ldapConnectionConfig.setUseSsl(isSecuredConnection);
ldapConnectionConfig.setLdapHost(host);
ldapConnectionConfig.setLdapPort(port);
ldapConnectionConfig.setEnabledProtocols(JVM_TLS_PROTOCOLS.clone());
Boolean ignoreChainException = isIgnoreSSLValidations == null ? Boolean.parseBoolean(DDCProperties.getInstance().getProperty("ignore.ssl.cert.chain.exception")) : isIgnoreSSLValidations;
if (isSecuredConnection && ignoreChainException) {
TrustManager[] trustAllCerts = new TrustManager[]{
Expand All @@ -231,4 +238,23 @@ public void checkServerTrusted(
}
return new LdapNetworkConnection(ldapConnectionConfig);
}

/**
* Resolves the TLS protocols enabled by the JVM for client connections.
* This honors the runtime's TLS configuration and allows supported protocol
* versions, including TLS 1.3, to be used without maintaining a fixed list.
* Falls back to TLS 1.2 and TLS 1.3 if the JVM defaults cannot be resolved.
*/
private static String[] resolveJvmTlsProtocols() {
try {
SSLContext sslContext = SSLContext.getInstance("TLS");
sslContext.init(null, null, null);
SSLEngine sslEngine = sslContext.createSSLEngine();
sslEngine.setUseClientMode(true);
return sslEngine.getEnabledProtocols();
} catch (GeneralSecurityException | RuntimeException e) {
LOGGER.warn("Could not read the JVM default TLS protocols, falling back to {}", Arrays.toString(FALLBACK_TLS_PROTOCOLS), e);
return FALLBACK_TLS_PROTOCOLS.clone();
}
}
}
4 changes: 2 additions & 2 deletions source/ddc-service/pom.xml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -5,7 +5,7 @@
<parent>
<groupId>com.imperva.ddc</groupId>
<artifactId>domain-directory-controller</artifactId>
<version>7.4.0.0.0.0</version>
<version>7.5.0.0.0.0</version>
</parent>

<artifactId>ddc-service</artifactId>
Expand All @@ -14,7 +14,7 @@
<dependency>
<groupId>com.imperva.ddc</groupId>
<artifactId>ddc-core</artifactId>
<version>7.4.0.0.0.0</version>
<version>7.5.0.0.0.0</version>
</dependency>
</dependencies>

Expand Down
2 changes: 1 addition & 1 deletion source/pom.xml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -6,7 +6,7 @@
<packaging>pom</packaging>
<groupId>com.imperva.ddc</groupId>
<artifactId>domain-directory-controller</artifactId>
<version>7.4.0.0.0.0</version>
<version>7.5.0.0.0.0</version>
<name>Domain Directory Controller</name>
<description>
DDC is an Active Directory Java SDK designed to simplify AD interaction for small, medium and large projects.
Expand Down
2 changes: 1 addition & 1 deletion startingkit/ddckit/pom.xml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -54,7 +54,7 @@
<dependency>
<groupId>com.imperva.ddc</groupId>
<artifactId>ddc-service</artifactId>
<version>7.4.0.0.0.0</version>
<version>7.5.0.0.0.0</version>
</dependency>
</dependencies>

Expand Down