neo4j
diff --git a/‎driver/src/main/java/org/neo4j/driver/internal/connector/socket/SSLContextFactory.java
Copy file name to clipboard
+16-15Lines changed: 16 additions & 15 deletions b/‎driver/src/main/java/org/neo4j/driver/internal/connector/socket/SSLContextFactory.java
Copy file name to clipboard
+16-15Lines changed: 16 additions & 15 deletions
diff --git a/‎driver/src/main/java/org/neo4j/driver/internal/connector/socket/SocketClient.java
Copy file name to clipboard
+11-4Lines changed: 11 additions & 4 deletions b/‎driver/src/main/java/org/neo4j/driver/internal/connector/socket/SocketClient.java
Copy file name to clipboard
+11-4Lines changed: 11 additions & 4 deletions
diff --git a/‎driver/src/main/java/org/neo4j/driver/internal/connector/socket/SocketConnector.java
Copy file name to clipboard
+6-3Lines changed: 6 additions & 3 deletions b/‎driver/src/main/java/org/neo4j/driver/internal/connector/socket/SocketConnector.java
Copy file name to clipboard
+6-3Lines changed: 6 additions & 3 deletions
diff --git a/‎driver/src/main/java/org/neo4j/driver/internal/connector/socket/SSLSocketChannel.java renamed to ‎driver/src/main/java/org/neo4j/driver/internal/connector/socket/TLSSocketChannel.java
Copy file name to clipboard
+10-10Lines changed: 10 additions & 10 deletions b/‎driver/src/main/java/org/neo4j/driver/internal/connector/socket/SSLSocketChannel.java renamed to ‎driver/src/main/java/org/neo4j/driver/internal/connector/socket/TLSSocketChannel.java
Copy file name to clipboard
+10-10Lines changed: 10 additions & 10 deletions
@@ -27,35 +27,34 @@
 import javax.net.ssl.TrustManagerFactory;
 
 import org.neo4j.driver.v1.Config;
+import org.neo4j.driver.v1.exceptions.ClientException;
+import org.neo4j.driver.internal.spi.Logger;
 
 import static org.neo4j.driver.internal.util.CertificateTool.loadX509Cert;
 
 class SSLContextFactory
 {
-
     private final String host;
     private final int port;
-    private final Config.TlsAuthenticationConfig authConfig;
+    private final Config.TrustStrategy authConfig;
+    private final Logger logger;
 
-    SSLContextFactory( String host, int port, Config.TlsAuthenticationConfig authConfig )
+    SSLContextFactory( String host, int port, Config.TrustStrategy authConfig, Logger logger )
     {
         this.host = host;
         this.port = port;
         this.authConfig = authConfig;
+        this.logger = logger;
     }
 
     public SSLContext create()
             throws GeneralSecurityException, IOException
     {
         SSLContext sslContext = SSLContext.getInstance( "TLS" );
+        TrustManager[] trustManagers;
 
-        // TODO Do we also want the server to verify the client's cert, a.k.a mutual authentication?
-        // Ref: https://logicoy.com/blogs/ssl-keystore-truststore-and-mutual-authentication/
-        KeyManager[] keyManagers = new KeyManager[0];
-        TrustManager[] trustManagers = null;
-
-        if ( authConfig.isFullAuthEnabled() )
-        {
+        switch ( authConfig.strategy() ) {
+        case TRUST_SIGNED_CERTIFICATES:
             // A certificate file is specified so we will load the certificates in the file
             // Init a in memory TrustedKeyStore
             KeyStore trustedKeyStore = KeyStore.getInstance( "JKS" );
@@ -68,13 +67,15 @@ public SSLContext create()
             TrustManagerFactory trustManagerFactory = TrustManagerFactory.getInstance( "SunX509" );
             trustManagerFactory.init( trustedKeyStore );
             trustManagers = trustManagerFactory.getTrustManagers();
-        }
-        else
-        {
-            trustManagers = new TrustManager[]{new TrustOnFirstUseTrustManager( host, port, authConfig.certFile() )};
+            break;
+        case TRUST_ON_FIRST_USE:
+            trustManagers = new TrustManager[]{new TrustOnFirstUseTrustManager( host, port, authConfig.certFile(), logger )};
+            break;
+        default:
+            throw new ClientException( "Unknown TLS authentication strategy: " + authConfig.strategy().name() );
         }
 
-        sslContext.init( keyManagers, trustManagers, null );
+        sslContext.init( new KeyManager[0], trustManagers, null );
         return sslContext;
     }
 }
@@ -220,15 +220,22 @@ public static ByteChannel create( String host, int port, Config config, Logger l
             soChannel.setOption( StandardSocketOptions.SO_KEEPALIVE, true );
             soChannel.connect( new InetSocketAddress( host, port ) );
 
-            ByteChannel channel = null;
+            ByteChannel channel;
 
-            if( config.isTlsEnabled() )
+            switch ( config.encryptionLevel() )
             {
-                channel = new SSLSocketChannel( host, port, soChannel, logger, config.tlsAuthConfig() );
+            case REQUIRED:
+            {
+                channel = new TLSSocketChannel( host, port, soChannel, logger, config.trustStrategy() );
+                break;
             }
-            else
+            case NONE:
             {
                 channel = new AllOrNothingChannel( soChannel );
+                break;
+            }
+            default:
+                throw new ClientException( "Unknown TLS Level: " + config.encryptionLevel() );
             }
 
             if( logger.isTraceEnabled() )
 
@@ -30,16 +30,19 @@
 
 public class SocketConnector implements Connector
 {
+    public static final String SCHEME = "bolt";
+    public static final int DEFAULT_PORT = 7687;
+
     @Override
     public boolean supports( String scheme )
     {
-        return scheme.equals( Config.SCHEME );
+        return scheme.equals( SCHEME );
     }
 
     @Override
     public Connection connect( URI sessionURI, Config config ) throws ClientException
     {
-        int port = sessionURI.getPort() == -1 ? Config.DEFAULT_PORT : sessionURI.getPort();
+        int port = sessionURI.getPort() == -1 ? DEFAULT_PORT : sessionURI.getPort();
         SocketConnection conn = new SocketConnection( sessionURI.getHost(), port, config );
         conn.init( "bolt-java-driver/" + Version.driverVersion() );
         return conn;
@@ -48,6 +51,6 @@ public Connection connect( URI sessionURI, Config config ) throws ClientExceptio
     @Override
     public Collection<String> supportedSchemes()
     {
-        return Collections.singletonList( Config.SCHEME );
+        return Collections.singletonList( SCHEME );
     }
 }
@@ -32,14 +32,14 @@
 
 import org.neo4j.driver.internal.spi.Logger;
 import org.neo4j.driver.internal.util.BytePrinter;
-import org.neo4j.driver.v1.Config.TlsAuthenticationConfig;
+import org.neo4j.driver.v1.Config.TrustStrategy;
 import org.neo4j.driver.v1.exceptions.ClientException;
 
 import static javax.net.ssl.SSLEngineResult.HandshakeStatus.FINISHED;
 import static javax.net.ssl.SSLEngineResult.HandshakeStatus.NOT_HANDSHAKING;
 
 /**
- * A blocking SSL socket channel.
+ * A blocking TLS socket channel.
  *
  * When debugging, we could enable JSSE system debugging by setting system property:
  * {@code -Djavax.net.debug=all} to value more information about handshake messages and other operations underway.
@@ -49,7 +49,7 @@
  * https://docs.oracle.com/javase/1.5.0/docs/guide/security/jsse/JSSERefGuide.html#SSLENG
  * https://docs.oracle.com/javase/7/docs/api/javax/net/ssl/SSLEngine.html
  */
-public class SSLSocketChannel implements ByteChannel
+public class TLSSocketChannel implements ByteChannel
 {
     private final SocketChannel channel;      // The real channel the data is sent to and read from
     private final Logger logger;
@@ -64,25 +64,25 @@ public class SSLSocketChannel implements ByteChannel
     private ByteBuffer plainIn;
     private ByteBuffer plainOut;
 
-    public SSLSocketChannel( String host, int port, SocketChannel channel, Logger logger,
-            TlsAuthenticationConfig authConfig )
+    public TLSSocketChannel( String host, int port, SocketChannel channel, Logger logger,
+                             TrustStrategy trustStrategy )
             throws GeneralSecurityException, IOException
     {
         logger.debug( "TLS connection enabled" );
         this.logger = logger;
         this.channel = channel;
         this.channel.configureBlocking( true );
 
-        sslContext =  new SSLContextFactory( host, port, authConfig ).create();
+        sslContext =  new SSLContextFactory( host, port, trustStrategy, logger ).create();
         createSSLEngine( host, port );
         createBuffers();
-        runSSLHandShake();
+        runHandshake();
         logger.debug( "TLS connection established" );
     }
 
     /** Used in internal tests only */
-    SSLSocketChannel( SocketChannel channel, Logger logger, SSLEngine sslEngine,
-            ByteBuffer plainIn, ByteBuffer cipherIn, ByteBuffer plainOut, ByteBuffer cipherOut )
+    TLSSocketChannel( SocketChannel channel, Logger logger, SSLEngine sslEngine,
+                      ByteBuffer plainIn, ByteBuffer cipherIn, ByteBuffer plainOut, ByteBuffer cipherOut )
             throws GeneralSecurityException, IOException
     {
         logger.debug( "Testing TLS buffers" );
@@ -109,7 +109,7 @@ public SSLSocketChannel( String host, int port, SocketChannel channel, Logger lo
      *
      * @throws IOException
      */
-    private void runSSLHandShake() throws IOException
+    private void runHandshake() throws IOException
     {
         sslEngine.beginHandshake();
         HandshakeStatus handshakeStatus = sslEngine.getHandshakeStatus();
Original file line number	Diff line number	Diff line change
`@@ -220,15 +220,22 @@ public static ByteChannel create( String host, int port, Config config, Logger l`
`220`	`220`	`soChannel.setOption( StandardSocketOptions.SO_KEEPALIVE, true );`
`221`	`221`	`soChannel.connect( new InetSocketAddress( host, port ) );`
`222`	`222`
`223`		`- ByteChannel channel = null;`
	`223`	`+ ByteChannel channel;`
`224`	`224`
`225`		`- if( config.isTlsEnabled() )`
	`225`	`+ switch ( config.encryptionLevel() )`
`226`	`226`	`{`
`227`		`- channel = new SSLSocketChannel( host, port, soChannel, logger, config.tlsAuthConfig() );`
	`227`	`+ case REQUIRED:`
	`228`	`+ {`
	`229`	`+ channel = new TLSSocketChannel( host, port, soChannel, logger, config.trustStrategy() );`
	`230`	`+ break;`
`228`	`231`	`}`
`229`		`- else`
	`232`	`+ case NONE:`
`230`	`233`	`{`
`231`	`234`	`channel = new AllOrNothingChannel( soChannel );`
	`235`	`+ break;`
	`236`	`+ }`
	`237`	`+ default:`
	`238`	`+ throw new ClientException( "Unknown TLS Level: " + config.encryptionLevel() );`
`232`	`239`	`}`
`233`	`240`
`234`	`241`	`if( logger.isTraceEnabled() )`
Original file line number	Diff line number	Diff line change
`@@ -30,16 +30,19 @@`
`30`	`30`
`31`	`31`	`public class SocketConnector implements Connector`
`32`	`32`	`{`
	`33`	`+ public static final String SCHEME = "bolt";`
	`34`	`+ public static final int DEFAULT_PORT = 7687;`
	`35`	`+`
`33`	`36`	`@Override`
`34`	`37`	`public boolean supports( String scheme )`
`35`	`38`	`{`
`36`		`- return scheme.equals( Config.SCHEME );`
	`39`	`+ return scheme.equals( SCHEME );`
`37`	`40`	`}`
`38`	`41`
`39`	`42`	`@Override`
`40`	`43`	`public Connection connect( URI sessionURI, Config config ) throws ClientException`
`41`	`44`	`{`
`42`		`- int port = sessionURI.getPort() == -1 ? Config.DEFAULT_PORT : sessionURI.getPort();`
	`45`	`+ int port = sessionURI.getPort() == -1 ? DEFAULT_PORT : sessionURI.getPort();`
`43`	`46`	`SocketConnection conn = new SocketConnection( sessionURI.getHost(), port, config );`
`44`	`47`	`conn.init( "bolt-java-driver/" + Version.driverVersion() );`
`45`	`48`	`return conn;`
`@@ -48,6 +51,6 @@ public Connection connect( URI sessionURI, Config config ) throws ClientExceptio`
`48`	`51`	`@Override`
`49`	`52`	`public Collection<String> supportedSchemes()`
`50`	`53`	`{`
`51`		`- return Collections.singletonList( Config.SCHEME );`
	`54`	`+ return Collections.singletonList( SCHEME );`
`52`	`55`	`}`
`53`	`56`	`}`