Package org.postgresql.ssl

Class BaseX509KeyManager

  • All Implemented Interfaces:
    javax.net.ssl.KeyManager, javax.net.ssl.X509KeyManager
    Direct Known Subclasses:
    PEMKeyManager, PKCS12KeyManager
    public abstract class BaseX509KeyManager
extends java.lang.Object
implements javax.net.ssl.X509KeyManager

    • Method Summary

      All Methods Static Methods Instance Methods Concrete Methods 
      Modifier and Type Method Description
      java.lang.String chooseClientAlias​(java.lang.String[] keyType, java.security.Principal[] principals, java.net.Socket socket)  
      java.lang.String chooseServerAlias​(java.lang.String s, java.security.Principal[] principals, java.net.Socket socket)  
      java.lang.String[] getClientAliases​(java.lang.String keyType, java.security.Principal[] principals)  
      java.lang.String[] getServerAliases​(java.lang.String s, java.security.Principal[] principals)  
      private static boolean hasInsecurePosixPermissions​(java.util.Set<java.nio.file.attribute.PosixFilePermission> permissions, boolean isOwnedByRoot)
      Determines whether the given POSIX permissions are insecure for a private key file.
      private static boolean isFileOwnedByRoot​(java.nio.file.Path keyPath)
      Checks whether the file is owned by root (uid 0).
      void throwKeyManagerException()
      getCertificateChain and getPrivateKey cannot throw exceptions, therefore any exception is stored in error and can be raised by this method.
      static void validateKeyFilePermissions​(java.nio.file.Path keyPath)
      Validates that the private key file has secure permissions, matching libpq behavior.
      private static boolean validatePosixPermissions​(java.nio.file.Path keyPath)
      Validates POSIX file permissions of key, matching libpq behavior.
      private static boolean validateWindowsAclPermissions​(java.nio.file.Path keyPath)
      Validates Windows ACL permissions of the key file.

      • Methods inherited from class java.lang.Object

        clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait

      • Methods inherited from interface javax.net.ssl.X509KeyManager

        getCertificateChain, getPrivateKey

    • Constructor Detail

      • BaseX509KeyManager

        public BaseX509KeyManager()

    • Method Detail

      • throwKeyManagerException

        public void throwKeyManagerException()
                              throws PSQLException
        getCertificateChain and getPrivateKey cannot throw exceptions, therefore any exception is stored in error and can be raised by this method.
        Throws:
        PSQLException - if any exception is stored in error and can be raised

      • getClientAliases

        public java.lang.String[] getClientAliases​(java.lang.String keyType,
                                           java.security.Principal[] principals)
        Specified by:
        getClientAliases in interface javax.net.ssl.X509KeyManager

      • chooseClientAlias

        public java.lang.String chooseClientAlias​(java.lang.String[] keyType,
                                          java.security.Principal[] principals,
                                          java.net.Socket socket)
        Specified by:
        chooseClientAlias in interface javax.net.ssl.X509KeyManager

      • getServerAliases

        public java.lang.String[] getServerAliases​(java.lang.String s,
                                           java.security.Principal[] principals)
        Specified by:
        getServerAliases in interface javax.net.ssl.X509KeyManager

      • chooseServerAlias

        public java.lang.String chooseServerAlias​(java.lang.String s,
                                          java.security.Principal[] principals,
                                          java.net.Socket socket)
        Specified by:
        chooseServerAlias in interface javax.net.ssl.X509KeyManager

      • validateKeyFilePermissions

        public static void validateKeyFilePermissions​(java.nio.file.Path keyPath)
                                       throws PSQLException
        Validates that the private key file has secure permissions, matching libpq behavior. On POSIX systems, root-owned files are allowed group-read access (up to 0640), since it's common for root to own certs and grant read access via group membership. Files owned by anyone else must be 0600 or stricter. On Windows, ACLs are checked to ensure only the owner and trusted system accounts have access.
        Parameters:
        keyPath - the path to the private key file
        Throws:
        PSQLException - if the file has insecure permissions

      • validatePosixPermissions

        private static boolean validatePosixPermissions​(java.nio.file.Path keyPath)
                                         throws PSQLException
        Validates POSIX file permissions of key, matching libpq behavior. Root-owned files (uid 0) allow GROUP_READ (up to 0640). Non-root-owned files require 0600 or less (no group or other permissions).
        Parameters:
        keyPath - the path to the private key file
        Returns:
        true if validation succeeded (permissions are secure), false if POSIX is not supported
        Throws:
        PSQLException - if the file has insecure permissions

      • isFileOwnedByRoot

        private static boolean isFileOwnedByRoot​(java.nio.file.Path keyPath)
                                  throws java.io.IOException
        Checks whether the file is owned by root (uid 0). Falls back to false if the unix:uid attribute is not available.
        Throws:
        java.io.IOException

      • hasInsecurePosixPermissions

        private static boolean hasInsecurePosixPermissions​(java.util.Set<java.nio.file.attribute.PosixFilePermission> permissions,
                                                   boolean isOwnedByRoot)
        Determines whether the given POSIX permissions are insecure for a private key file. Matches libpq behavior: root-owned files allow GROUP_READ (0640), while non-root-owned files reject all group and other permissions (0600).

      • validateWindowsAclPermissions

        private static boolean validateWindowsAclPermissions​(java.nio.file.Path keyPath)
                                              throws PSQLException
        Validates Windows ACL permissions of the key file.
        Parameters:
        keyPath - the path to the private key file
        Returns:
        true if validation succeeded (permissions are secure), false if ACL is not supported
        Throws:
        PSQLException - if the file has insecure permissions