|
| 1 | +/* |
| 2 | +* author: gvenzl |
| 3 | +* created: 19 Mar 2017 |
| 4 | +*/ |
| 5 | + |
| 6 | +package com.oracle; |
| 7 | + |
| 8 | +import java.io.File; |
| 9 | +import java.io.FileInputStream; |
| 10 | +import java.io.IOException; |
| 11 | +import java.math.BigInteger; |
| 12 | +import java.nio.file.Files; |
| 13 | +import java.nio.file.Path; |
| 14 | +import java.security.NoSuchAlgorithmException; |
| 15 | +import java.security.SecureRandom; |
| 16 | +import java.sql.Connection; |
| 17 | +import java.sql.DriverManager; |
| 18 | +import java.sql.SQLException; |
| 19 | +import java.util.Enumeration; |
| 20 | +import java.util.zip.ZipEntry; |
| 21 | +import java.util.zip.ZipFile; |
| 22 | + |
| 23 | +import javax.crypto.Cipher; |
| 24 | + |
| 25 | +import oracle.security.pki.OracleWallet; |
| 26 | +import oracle.security.pki.textui.OraclePKIGenFunc; |
| 27 | + |
| 28 | +public class CloudConnectionManager { |
| 29 | + |
| 30 | +/** |
| 31 | + * Gets a new database connnection |
| 32 | + * @param clientCredentials Path to the client credentials file |
| 33 | + * @param user Username for database connection |
| 34 | + * @param password Password for database connection |
| 35 | + * @param serviceName Service name for database connections |
| 36 | + * @return A new connection to Exadata Express cloud service |
| 37 | + * @throws IOException Any IOException while reading the client credentials file |
| 38 | + * @throws SQLException Any SQLException while opening a connection to the database |
| 39 | + * @throws NoJCEUnlimitedStrengthSetupException If JCE unlimited strength is not setup correctly |
| 40 | + * @throws NoSuchAlgorithmException If transformation is not a valid transformation, i.e. in the form of "algorithm" or "algorithm/mode/padding" |
| 41 | + */ |
| 42 | +public static Connection getConnection(String clientCredentials, String user, String password, String serviceName) |
| 43 | +throws IOException, SQLException, NoJCEUnlimitedStrengthSetupException, NoSuchAlgorithmException { |
| 44 | + |
| 45 | +File fClientCredentials = new File(clientCredentials); |
| 46 | +return getConnection(fClientCredentials, user, password, serviceName); |
| 47 | +} |
| 48 | + |
| 49 | +/** |
| 50 | + * Gets a new database connnection |
| 51 | + * @param fClientCredentials Client credentials file |
| 52 | + * @param user Username for database connection |
| 53 | + * @param password Password for database connection |
| 54 | + * @param serviceName Service name for database connections |
| 55 | + * @return A new connection to Exadata Express cloud service |
| 56 | + * @throws IOException Any IOException while reading the client credentials file |
| 57 | + * @throws SQLException Any SQLException while opening a connection to the database |
| 58 | + * @throws NoJCEUnlimitedStrengthSetupException If JCE unlimited strength is not setup correctly |
| 59 | + * @throws NoSuchAlgorithmException If transformation is not a valid transformation, i.e. in the form of "algorithm" or "algorithm/mode/padding" |
| 60 | + */ |
| 61 | +public static Connection getConnection(File fClientCredentials, String user, String password, String serviceName) |
| 62 | +throws IOException, SQLException, NoJCEUnlimitedStrengthSetupException, NoSuchAlgorithmException { |
| 63 | + |
| 64 | +// Check whether JCE is installed |
| 65 | +checkJCEUnlimitedStrengthSetup(); |
| 66 | + |
| 67 | +String pathToTrustStore = createTrustStore(fClientCredentials); |
| 68 | + |
| 69 | +System.setProperty("oracle.net.tns_admin", pathToTrustStore); |
| 70 | + |
| 71 | +System.setProperty("oracle.net.ssl_server_dn_match", "true"); |
| 72 | +System.setProperty("oracle.net.ssl_version", "1.2"); |
| 73 | + |
| 74 | +// open the CA's wallet |
| 75 | +OracleWallet caWallet = new OracleWallet(); |
| 76 | +caWallet.open(pathToTrustStore, null); |
| 77 | + |
| 78 | +String passwd = generateRandomSecurePassword(); |
| 79 | +char[] keyAndTrustStorePasswd = OraclePKIGenFunc.getCreatePassword(passwd, false); |
| 80 | + |
| 81 | +// certs |
| 82 | +OracleWallet jksK = caWallet.migratePKCS12toJKS(keyAndTrustStorePasswd, OracleWallet.MIGRATE_KEY_ENTIRES_ONLY); |
| 83 | + |
| 84 | +// migrate (trusted) cert entries from p12 to different jks store |
| 85 | +OracleWallet jksT = caWallet.migratePKCS12toJKS(keyAndTrustStorePasswd, |
| 86 | +OracleWallet.MIGRATE_TRUSTED_ENTRIES_ONLY); |
| 87 | +String trustPath = pathToTrustStore + "/sqlclTrustStore.jks"; |
| 88 | +String keyPath = pathToTrustStore + "/sqlclKeyStore.jks"; |
| 89 | +jksT.saveAs(trustPath); |
| 90 | +jksK.saveAs(keyPath); |
| 91 | + |
| 92 | +System.setProperty("javax.net.ssl.trustStore", trustPath); |
| 93 | +System.setProperty("javax.net.ssl.trustStorePassword", passwd.toString()); |
| 94 | +System.setProperty("javax.net.ssl.keyStore", keyPath); |
| 95 | +System.setProperty("javax.net.ssl.keyStorePassword", passwd.toString()); |
| 96 | + |
| 97 | +Connection conn = DriverManager.getConnection("jdbc:oracle:thin:@" + serviceName, user, password); |
| 98 | +return conn; |
| 99 | +} |
| 100 | + |
| 101 | +/** |
| 102 | + * Creates Trust Store. |
| 103 | + * @param fClientCredentials Client credentials files |
| 104 | + * @return Path to trust store |
| 105 | + * @throws IOException |
| 106 | + */ |
| 107 | +private static String createTrustStore(File fClientCredentials) throws IOException { |
| 108 | +Path tmp = Files.createTempDirectory("oracle_cloud_config"); |
| 109 | +// clean up on exit |
| 110 | +tmp.toFile().deleteOnExit(); |
| 111 | + |
| 112 | +// Create new temporary zip file |
| 113 | +Path pzip = tmp.resolve("temp.zip"); |
| 114 | +Files.copy(new FileInputStream(fClientCredentials), pzip); |
| 115 | + |
| 116 | +// Extract all files from the zip file |
| 117 | +ZipFile zf = new ZipFile(pzip.toFile()); |
| 118 | +Enumeration<? extends ZipEntry> entities = zf.entries(); |
| 119 | +while (entities.hasMoreElements()) { |
| 120 | +ZipEntry entry = entities.nextElement(); |
| 121 | +String name = entry.getName(); |
| 122 | +Path p = tmp.resolve(name); |
| 123 | +Files.copy(zf.getInputStream(entry), p); |
| 124 | +} |
| 125 | +zf.close(); |
| 126 | + |
| 127 | +return tmp.toFile().getAbsolutePath(); |
| 128 | +} |
| 129 | + |
| 130 | +/** |
| 131 | + * Checks whether JCE Unlimited Strength is setup. |
| 132 | + * @throws NoSuchAlgorithmException If transformation is not a valid transformation, i.e. in the form of "algorithm" or "algorithm/mode/padding" |
| 133 | + * @throws NoJCEUnlimitedStrengthSetupException If JCE unlimited strength is not setup correctly |
| 134 | + */ |
| 135 | +private static void checkJCEUnlimitedStrengthSetup() |
| 136 | +throws NoSuchAlgorithmException, NoJCEUnlimitedStrengthSetupException |
| 137 | +{ |
| 138 | +// Check whether Java Cryptography Extension (JCE) Unlimited Strength Jurisdiction Policy Files 8 are in place |
| 139 | +// This will generate a huge int if installed correctly |
| 140 | +int maxKeySize = Cipher.getMaxAllowedKeyLength("AES"); |
| 141 | + |
| 142 | +// Throw exception if JCE is not in place |
| 143 | +if (maxKeySize <= 128) { |
| 144 | +throw new NoJCEUnlimitedStrengthSetupException(); |
| 145 | +} |
| 146 | +} |
| 147 | + |
| 148 | +/** |
| 149 | + * Generates new random password |
| 150 | + * @return A new random password |
| 151 | + */ |
| 152 | +private static String generateRandomSecurePassword() { |
| 153 | +return new BigInteger(130, new SecureRandom()).toString(32); |
| 154 | +} |
| 155 | +} |
0 commit comments