Skip to content

Commit 13ea866

Browse files
rayokotarayokota
authored
Fix validation of SSL CA Certificate for DEK Registry client (#2348)
1 parent 843d68f commit 13ea866

File tree

14 files changed

+79
-31
lines changed

14 files changed

+79
-31
lines changed

‎src/Confluent.SchemaRegistry.Encryption/CachedDekRegistryClient.cs

Lines changed: 11 additions & 14 deletions
Original file line numberDiff line numberDiff line change
@@ -18,7 +18,7 @@
1818
using System.Threading.Tasks;
1919
using System.Linq;
2020
using System;
21-
using System.ComponentModel;
21+
using System.Net;
2222
using System.Threading;
2323
using System.Security.Cryptography.X509Certificates;
2424

@@ -31,7 +31,7 @@ public record DekId(string KekName, string Subject, int? Version, DekFormat? Dek
3131
/// <summary>
3232
/// A caching DEK Registry client.
3333
/// </summary>
34-
public class CachedDekRegistryClient : IDekRegistryClient, IDisposable
34+
public class CachedDekRegistryClient : IDekRegistryClient
3535
{
3636
private DekRestService restService;
3737

@@ -71,12 +71,16 @@ public int MaxCachedKeys
7171
/// <param name="authenticationHeaderValueProvider">
7272
/// The authentication header value provider
7373
/// </param>
74+
/// <param name="proxy">
75+
/// The proxy server to use for connections
76+
/// </param>
7477
public CachedDekRegistryClient(IEnumerable<KeyValuePair<string, string>> config,
75-
IAuthenticationHeaderValueProvider authenticationHeaderValueProvider)
78+
IAuthenticationHeaderValueProvider authenticationHeaderValueProvider,
79+
IWebProxy proxy = null)
7680
{
7781
if (config == null)
7882
{
79-
throw new ArgumentNullException("config properties must be specified.");
83+
throw new ArgumentNullException("config");
8084
}
8185
var schemaRegistryUrisMaybe = config.FirstOrDefault(prop =>
8286
prop.Key.ToLower() == SchemaRegistryConfig.PropertyNames.SchemaRegistryUrl);
@@ -236,8 +240,9 @@ public CachedDekRegistryClient(IEnumerable<KeyValuePair<string, string>> config,
236240
$"Configured value for {SchemaRegistryConfig.PropertyNames.EnableSslCertificateVerification} must be a bool.");
237241
}
238242

239-
this.restService = new DekRestService(schemaRegistryUris, timeoutMs, authenticationHeaderValueProvider,
240-
SetSslConfig(config), sslVerify);
243+
var sslCaLocation = config.FirstOrDefault(prop => prop.Key.ToLower() == SchemaRegistryConfig.PropertyNames.SslCaLocation).Value;
244+
var sslCaCertificate = string.IsNullOrEmpty(sslCaLocation) ? null : new X509Certificate2(sslCaLocation);
245+
this.restService = new DekRestService(schemaRegistryUris, timeoutMs, authenticationHeaderValueProvider, SetSslConfig(config), sslVerify, sslCaCertificate, proxy);
241246
}
242247

243248
/// <summary>
@@ -291,14 +296,6 @@ private List<X509Certificate2> SetSslConfig(IEnumerable<KeyValuePair<string, str
291296
certificates.Add(new X509Certificate2(certificateLocation, certificatePassword));
292297
}
293298

294-
var caLocation =
295-
config.FirstOrDefault(prop => prop.Key.ToLower() == SchemaRegistryConfig.PropertyNames.SslCaLocation)
296-
.Value ?? "";
297-
if (!String.IsNullOrEmpty(caLocation))
298-
{
299-
certificates.Add(new X509Certificate2(caLocation));
300-
}
301-
302299
return certificates;
303300
}
304301

‎src/Confluent.SchemaRegistry.Encryption/FieldEncryptionExecutor.cs

Lines changed: 10 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -45,12 +45,20 @@ public FieldEncryptionExecutor(IDekRegistryClient client, IClock clock)
4545
Clock = clock ?? new Clock();
4646
}
4747

48-
public override void Configure(IEnumerable<KeyValuePair<string, string>> config)
48+
public override void Configure(IEnumerable<KeyValuePair<string, string>> config,
49+
ISchemaRegistryClient client = null)
4950
{
5051
Configs = config;
5152
if (Client == null)
5253
{
53-
Client = new CachedDekRegistryClient(Configs);
54+
if (client != null)
55+
{
56+
Client = new CachedDekRegistryClient(Configs, client.AuthHeaderProvider, client.Proxy);
57+
}
58+
else
59+
{
60+
Client = new CachedDekRegistryClient(Configs);
61+
}
5462
}
5563
}
5664

‎src/Confluent.SchemaRegistry.Encryption/Rest/DekRestService.cs

Lines changed: 3 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -16,6 +16,7 @@
1616

1717
using System;
1818
using System.Collections.Generic;
19+
using System.Net;
1920
using System.Net.Http;
2021
using System.Threading.Tasks;
2122
using System.Security.Cryptography.X509Certificates;
@@ -29,9 +30,9 @@ public class DekRestService : RestService
2930
/// </summary>
3031
public DekRestService(string schemaRegistryUrl, int timeoutMs,
3132
IAuthenticationHeaderValueProvider authenticationHeaderValueProvider, List<X509Certificate2> certificates,
32-
bool enableSslCertificateVerification) :
33+
bool enableSslCertificateVerification, X509Certificate2 sslCaCertificate = null, IWebProxy proxy = null) :
3334
base(schemaRegistryUrl, timeoutMs, authenticationHeaderValueProvider, certificates,
34-
enableSslCertificateVerification)
35+
enableSslCertificateVerification, sslCaCertificate, proxy)
3536
{
3637
}
3738

‎src/Confluent.SchemaRegistry.Rules/CelExecutor.cs

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -34,7 +34,8 @@ public CelExecutor()
3434
{
3535
}
3636

37-
public void Configure(IEnumerable<KeyValuePair<string, string>> config)
37+
public void Configure(IEnumerable<KeyValuePair<string, string>> config,
38+
ISchemaRegistryClient client = null)
3839
{
3940
}
4041

‎src/Confluent.SchemaRegistry.Rules/CelFieldExecutor.cs

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -22,7 +22,8 @@ public CelFieldExecutor()
2222
public override string Type() => RuleType;
2323

2424

25-
public override void Configure(IEnumerable<KeyValuePair<string, string>> config)
25+
public override void Configure(IEnumerable<KeyValuePair<string, string>> config,
26+
ISchemaRegistryClient client = null)
2627
{
2728
}
2829

‎src/Confluent.SchemaRegistry.Rules/JsonataExecutor.cs

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -20,7 +20,8 @@ public JsonataExecutor()
2020
{
2121
}
2222

23-
public void Configure(IEnumerable<KeyValuePair<string, string>> config)
23+
public void Configure(IEnumerable<KeyValuePair<string, string>> config,
24+
ISchemaRegistryClient client = null)
2425
{
2526
}
2627

‎src/Confluent.SchemaRegistry/AsyncSerde.cs

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -59,7 +59,7 @@ protected AsyncSerde(ISchemaRegistryClient schemaRegistryClient, SerdeConfig con
5959

6060
foreach (IRuleExecutor executor in this.ruleRegistry.GetExecutors())
6161
{
62-
executor.Configure(ruleConfigs);
62+
executor.Configure(ruleConfigs, schemaRegistryClient);
6363
}
6464
}
6565

@@ -297,6 +297,7 @@ protected async Task<object> ExecuteMigrations(
297297
/// <param name="source"></param>
298298
/// <param name="target"></param>
299299
/// <param name="message"></param>
300+
/// <param name="fieldTransformer"></param>
300301
/// <returns></returns>
301302
/// <exception cref="RuleConditionException"></exception>
302303
/// <exception cref="ArgumentException"></exception>

‎src/Confluent.SchemaRegistry/CachedSchemaRegistryClient.cs

Lines changed: 18 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -42,7 +42,7 @@ namespace Confluent.SchemaRegistry
4242
/// - <see cref="CachedSchemaRegistryClient.GetSchemaBySubjectAndIdAsync(string, int, string)" />
4343
/// - <see cref="CachedSchemaRegistryClient.RegisterSchemaAsync(string, Schema, bool)" />
4444
/// - <see cref="CachedSchemaRegistryClient.RegisterSchemaAsync(string, string, bool)" />
45-
/// - <see cref="CachedSchemaRegistryClient.GetRegisteredSchemaAsync(string, int)" />
45+
/// - <see cref="CachedSchemaRegistryClient.GetRegisteredSchemaAsync(string, int, bool)" />
4646
///
4747
/// The following method calls do NOT cache results:
4848
/// - <see cref="CachedSchemaRegistryClient.LookupSchemaAsync(string, Schema, bool, bool)" />
@@ -54,11 +54,13 @@ namespace Confluent.SchemaRegistry
5454
/// - <see cref="CachedSchemaRegistryClient.GetCompatibilityAsync(string)" />
5555
/// - <see cref="CachedSchemaRegistryClient.UpdateCompatibilityAsync(Compatibility, string)" />
5656
/// </summary>
57-
public class CachedSchemaRegistryClient : ISchemaRegistryClient, IDisposable
57+
public class CachedSchemaRegistryClient : ISchemaRegistryClient
5858
{
5959
private readonly List<SchemaReference> EmptyReferencesList = new List<SchemaReference>();
6060

6161
private IEnumerable<KeyValuePair<string, string>> config;
62+
private IAuthenticationHeaderValueProvider authHeaderProvider;
63+
private IWebProxy proxy;
6264

6365
private IRestService restService;
6466
private int identityMapCapacity;
@@ -117,6 +119,16 @@ public IEnumerable<KeyValuePair<string, string>> Config
117119
=> config;
118120

119121

122+
/// <inheritdoc />
123+
public IAuthenticationHeaderValueProvider AuthHeaderProvider
124+
=> authHeaderProvider;
125+
126+
127+
/// <inheritdoc />
128+
public IWebProxy Proxy
129+
=> proxy;
130+
131+
120132
/// <inheritdoc />
121133
public int MaxCachedSchemas
122134
=> identityMapCapacity;
@@ -176,10 +188,12 @@ public CachedSchemaRegistryClient(IEnumerable<KeyValuePair<string, string>> conf
176188
{
177189
if (config == null)
178190
{
179-
throw new ArgumentNullException("config properties must be specified.");
191+
throw new ArgumentNullException("config");
180192
}
181193

182194
this.config = config;
195+
this.authHeaderProvider = authenticationHeaderValueProvider;
196+
this.proxy = proxy;
183197

184198
keySubjectNameStrategy = GetKeySubjectNameStrategy(config);
185199
valueSubjectNameStrategy = GetValueSubjectNameStrategy(config);
@@ -663,6 +677,7 @@ public async Task<RegisteredSchema> GetLatestSchemaAsync(string subject)
663677
return schema;
664678
}
665679

680+
/// <inheritdoc/>
666681
public async Task<RegisteredSchema> GetLatestWithMetadataAsync(string subject,
667682
IDictionary<string, string> metadata, bool ignoreDeletedSchemas)
668683
{

‎src/Confluent.SchemaRegistry/ErrorAction.cs

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -27,7 +27,8 @@ public class ErrorAction : IRuleAction
2727
{
2828
public static readonly string ActionType = "ERROR";
2929

30-
public void Configure(IEnumerable<KeyValuePair<string, string>> config)
30+
public void Configure(IEnumerable<KeyValuePair<string, string>> config,
31+
ISchemaRegistryClient client = null)
3132
{
3233
}
3334

‎src/Confluent.SchemaRegistry/FieldRuleExecutor.cs

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -21,7 +21,8 @@ namespace Confluent.SchemaRegistry
2121
{
2222
public abstract class FieldRuleExecutor : IRuleExecutor
2323
{
24-
public abstract void Configure(IEnumerable<KeyValuePair<string, string>> config);
24+
public abstract void Configure(IEnumerable<KeyValuePair<string, string>> config,
25+
ISchemaRegistryClient client = null);
2526

2627
public abstract string Type();
2728

0 commit comments

Comments
 (0)