chore: tls scan refactorings

Author: sureshg

backend/security/src/main/kotlin/dev/suresh/cert/CertScan.kt

@@ -1,33 +1,27 @@
 package dev.suresh.cert
 
 import dev.suresh.tls.SavingTrustManager
+import dev.suresh.tls.newTLSSocket
 import java.net.InetSocketAddress
 import java.security.cert.X509Certificate
 import javax.net.ssl.SNIHostName
-import javax.net.ssl.SSLContext
-import javax.net.ssl.SSLSocket
 import kotlin.time.Duration
-import kotlin.time.Duration.Companion.milliseconds
+import kotlin.time.Duration.Companion.seconds
 
 object CertScan {
 
   fun scan(
       host: String,
       port: Int = 443,
       sni: String? = null,
-      timeout: Duration = 2_000.milliseconds
+      timeout: Duration = 2.seconds
   ): List<X509Certificate> {
     val trustManager = SavingTrustManager()
-    val socket =
-        SSLContext.getInstance("TLS").run {
-          init(null, arrayOf(trustManager), null)
-          socketFactory.createSocket() as SSLSocket
-        }
-
+    val socket = trustManager.newTLSSocket()
     return socket.use { sock ->
       val handshake = runCatching {
         sni?.let {
-          // sock.sslParameters will create a new object
+          // sock.sslParameters will create a new copy
           val sslParams = sock.sslParameters
           sslParams.serverNames = listOf(SNIHostName(sni))
           sock.sslParameters = sslParams

backend/security/src/main/kotlin/dev/suresh/tls/SavingTrustManager.kt

@@ -1,7 +1,7 @@
 package dev.suresh.tls
 
 import java.security.cert.X509Certificate
-import javax.net.ssl.X509TrustManager
+import javax.net.ssl.*
 
 class SavingTrustManager : X509TrustManager {
 
@@ -20,3 +20,11 @@ class SavingTrustManager : X509TrustManager {
 
   override fun getAcceptedIssuers(): Array<X509Certificate> = emptyArray()
 }
+
+fun SavingTrustManager.newTLSSocket(): SSLSocket {
+  val tm = this
+  return SSLContext.getInstance("TLS").run {
+    init(null, arrayOf(tm), null)
+    socketFactory.createSocket() as SSLSocket
+  }
+}

backend/security/src/main/kotlin/dev/suresh/tls/TLSProp.kt

@@ -0,0 +1,51 @@
+package dev.suresh.tls
+
+import java.net.JarURLConnection
+import java.security.Security
+import java.util.jar.Manifest
+import kotlin.reflect.KClass
+
+/**
+ * Enumeration of JSSE (Java Secure Socket Extension) system and security properties used for
+ * configuring TLS/SSL connections.
+ */
+enum class TLSProp(val prop: String, val desc: String, val system: Boolean = true) {
+  Debug("javax.net.debug", "Debugging SSL/TLS Connections."),
+  KeyStore("javax.net.ssl.keyStore", "Default keystore"),
+  KeyStoreType("javax.net.ssl.keyStoreType", "Default keystore type"),
+  KeyStorePassword("javax.net.ssl.keyStorePassword", "Default keystore password"),
+  KeyStoreProvider("javax.net.ssl.keyStoreProvider", "Default keystore provider"),
+  TrustStore("javax.net.ssl.trustStore", "Default truststore"),
+  TrustStoreType("javax.net.ssl.trustStoreType", "Default truststore type"),
+  TrustStorePassword("javax.net.ssl.trustStorePassword", "Default truststore password"),
+  TrustStoreProvider("javax.net.ssl.trustStoreProvider", "Default truststore provider"),
+  ProxyHost("https.proxyHost", "Default HTTPS proxy host"),
+  ProxyPort("https.proxyPort", "Default HTTPS proxy port"),
+  HttpsCipherSuites("https.cipherSuites", "Default cipher suites"),
+  HttpsProtocols("https.protocols", "Default HTTPS handshaking protocols"),
+  TLSProtocols("jdk.tls.client.protocols", "Default Enabled TLS Protocols"),
+  CertPathDisabledAlgos(
+      "jdk.certpath.disabledAlgorithms",
+      "Disabled certificate verification cryptographic algorithms",
+      false),
+  TLSDisabledAlgos("jdk.tls.disabledAlgorithms", "Disabled/Restricted Algorithms", false);
+
+  /** Sets the JSSE system/security property to the given value. */
+  fun set(value: String) {
+    when (system) {
+      true -> System.setProperty(prop, value)
+      else -> Security.setProperty(prop, value)
+    }
+  }
+}
+
+/**
+ * Returns the jar [Manifest] of the class. Returns `null` if the class is not bundled in a jar
+ * (Classes in an unpacked class hierarchy).
+ */
+val <T : Any> KClass<T>.jarManifest: Manifest?
+  get() {
+    val res = java.getResource("${java.simpleName}.class")
+    val conn = res?.openConnection()
+    return if (conn is JarURLConnection) conn.manifest else null
+  }