SNOW-2177175 Fix for default trust manager not extending X509ExtendedTrustManager (#2266)

Author: sfc-gh-pfus

ci/container/build_component.sh

@@ -12,5 +12,5 @@ mvn clean install --batch-mode --show-version
 
 cd FIPS
 rm -f lib/*.jar
-mvn clean install --batch-mode --show-version
+mvn clean install -Dsurefire.argLine="-Djavax.net.debug=ssl:handshake" -Dfailsafe.argLine="-Djavax.net.debug=ssl:handshake" --batch-mode --show-version
 $THIS_DIR/upload_artifact.sh

src/main/java/net/snowflake/client/core/HttpUtil.java

@@ -106,6 +106,13 @@ public class HttpUtil {
 
   private static boolean socksProxyDisabled = false;
 
+  @SnowflakeJdbcInternalApi
+  public static void reset() {
+    httpClient.clear();
+    httpClientWithoutDecompression.clear();
+    httpClientRoutePlanner.clear();
+  }
+
   @SnowflakeJdbcInternalApi
   public static Duration getConnectionTimeout() {
     return connectionTimeout != null

src/main/java/net/snowflake/client/core/SFTrustManager.java

@@ -267,8 +267,12 @@ public class SFTrustManager extends X509ExtendedTrustManager {
     this.proxySettingsKey = key;
     this.trustManager = getTrustManager(TrustManagerFactory.getDefaultAlgorithm());
 
-    this.exTrustManager =
-        (X509ExtendedTrustManager) getTrustManager(TrustManagerFactory.getDefaultAlgorithm());
+    if (trustManager instanceof X509ExtendedTrustManager) {
+      this.exTrustManager = (X509ExtendedTrustManager) trustManager;
+    } else {
+      logger.debug("Standard X509TrustManager is used instead of X509ExtendedTrustManager.");
+      this.exTrustManager = null;
+    }
 
     checkNewOCSPEndpointAvailability();
 
@@ -725,31 +729,43 @@ public void checkServerTrusted(X509Certificate[] chain, String authType)
   @Override
   public void checkClientTrusted(X509Certificate[] chain, String authType, java.net.Socket socket)
       throws CertificateException {
-    // default behavior
-    this.exTrustManager.checkClientTrusted(chain, authType, socket);
+    if (exTrustManager != null) {
+      exTrustManager.checkClientTrusted(chain, authType, socket);
+    } else {
+      trustManager.checkClientTrusted(chain, authType);
+    }
   }
 
   @Override
   public void checkClientTrusted(X509Certificate[] chain, String authType, SSLEngine sslEngine)
       throws CertificateException {
-    // default behavior
-    exTrustManager.checkClientTrusted(chain, authType, sslEngine);
+    if (exTrustManager != null) {
+      exTrustManager.checkClientTrusted(chain, authType, sslEngine);
+    } else {
+      trustManager.checkClientTrusted(chain, authType);
+    }
   }
 
   @Override
   public void checkServerTrusted(X509Certificate[] chain, String authType, java.net.Socket socket)
       throws CertificateException {
-    // default behavior
-    exTrustManager.checkServerTrusted(chain, authType, socket);
+    if (exTrustManager != null) {
+      exTrustManager.checkServerTrusted(chain, authType, socket);
+    } else {
+      trustManager.checkServerTrusted(chain, authType);
+    }
     String host = socket.getInetAddress().getHostName();
     this.validateRevocationStatus(chain, host);
   }
 
   @Override
   public void checkServerTrusted(X509Certificate[] chain, String authType, SSLEngine sslEngine)
       throws CertificateException {
-    // default behavior
-    exTrustManager.checkServerTrusted(chain, authType, sslEngine);
+    if (exTrustManager != null) {
+      exTrustManager.checkServerTrusted(chain, authType, sslEngine);
+    } else {
+      trustManager.checkServerTrusted(chain, authType);
+    }
     this.validateRevocationStatus(chain, sslEngine.getPeerHost());
   }
 

src/test/java/net/snowflake/client/core/SFTrustManagerIT.java

@@ -12,17 +12,29 @@
 import java.io.IOException;
 import java.io.InputStream;
 import java.net.URL;
+import java.security.InvalidAlgorithmParameterException;
+import java.security.KeyStore;
+import java.security.KeyStoreException;
+import java.security.Provider;
+import java.security.Security;
 import java.security.cert.Certificate;
+import java.security.cert.CertificateException;
 import java.security.cert.CertificateFactory;
 import java.security.cert.X509Certificate;
+import java.sql.Connection;
+import java.sql.Statement;
 import java.time.Duration;
 import java.util.ArrayList;
 import java.util.Arrays;
 import java.util.List;
 import java.util.Properties;
 import java.util.concurrent.TimeUnit;
 import java.util.stream.Stream;
+import javax.net.ssl.ManagerFactoryParameters;
 import javax.net.ssl.SSLHandshakeException;
+import javax.net.ssl.TrustManager;
+import javax.net.ssl.TrustManagerFactorySpi;
+import javax.net.ssl.X509TrustManager;
 import net.snowflake.client.SystemPropertyOverrider;
 import net.snowflake.client.category.TestTags;
 import net.snowflake.client.jdbc.BaseJDBCTest;
@@ -36,6 +48,7 @@
 import org.junit.jupiter.api.AfterEach;
 import org.junit.jupiter.api.BeforeEach;
 import org.junit.jupiter.api.Tag;
+import org.junit.jupiter.api.Test;
 import org.junit.jupiter.api.extension.ExtensionContext;
 import org.junit.jupiter.api.io.TempDir;
 import org.junit.jupiter.params.ParameterizedTest;
@@ -316,9 +329,60 @@ void testOCSPCacheServerUrlWithProxy(String sfHost, String ocspHost) {
     }
   }
 
+  @Test
+  void shouldNotFailWhenSimpleTrustManagerIsUsed() throws Exception {
+    Security.insertProviderAt(new TestSecurityProvider(), 1);
+    HttpUtil.reset();
+    try (Connection connection = getConnection()) {
+      Statement statement = connection.createStatement();
+      statement.execute("SELECT 1");
+    } finally {
+      Security.removeProvider(TestSecurityProvider.class.getSimpleName());
+      HttpUtil.reset();
+    }
+  }
+
   @BeforeEach
   @AfterEach
   void cleanup() {
     SF_OCSP_RESPONSE_CACHE_SERVER_URL_VALUE = null;
   }
 }
+
+// Standard JCA implementation for registering custom TrustManagerFactory
+class TestTrustManagerSpi extends TrustManagerFactorySpi {
+
+  @Override
+  protected void engineInit(KeyStore ks) throws KeyStoreException {}
+
+  @Override
+  protected void engineInit(ManagerFactoryParameters spec)
+      throws InvalidAlgorithmParameterException {}
+
+  @Override
+  protected TrustManager[] engineGetTrustManagers() {
+    return new TrustManager[] {
+      new X509TrustManager() {
+        @Override
+        public void checkClientTrusted(X509Certificate[] chain, String authType)
+            throws CertificateException {}
+
+        @Override
+        public void checkServerTrusted(X509Certificate[] chain, String authType)
+            throws CertificateException {}
+
+        @Override
+        public X509Certificate[] getAcceptedIssuers() {
+          return new X509Certificate[0];
+        }
+      }
+    };
+  }
+}
+
+class TestSecurityProvider extends Provider {
+  public TestSecurityProvider() {
+    super(TestSecurityProvider.class.getSimpleName(), 1.0, "Test security provider");
+    put("TrustManagerFactory.PKIX", TestTrustManagerSpi.class.getName());
+  }
+}