apache / apache/arrow-java

[Java] JDBC driver throws exception when loading system trust store on MacOS

Offen
#193 4 Kommentare 0 Reaktionen 0 zugewiesene Personen Auf GitHub ansehen
Type: bug
Vorherrschende Sprache
Java
Sterne
94
Forks
152
Ø Merge
3 T. 16 Std.
Gemergte PRs (30 T.)
11

Beschreibung

### Describe the bug, including details regarding any error messages, version, and platform.

On MacOS attempting to use the system trust store with the JDBC driver results in an exception. The following is a minimal application which triggers the problem:

```java
import java.sql.*;

public class FlightSQLTLSTest {

public static void main(String[] args) {
if (args.length != 1) {
System.err.println("usage: java FlightSQLTLSTest dsn");
System.exit(2);
}

String dsn = args[0];
try {
Connection conn = DriverManager.getConnection(dsn);
DatabaseMetaData md = conn.getMetaData();
ResultSet rs = md.getCatalogs();
while (rs.next()) {
System.out.println(rs.getString(1));
}
rs.close();
conn.close();
} catch (SQLException e) {
e.printStackTrace();
System.exit(1);
}

}

}
```

When the supplied DSN uses TLS with the system certificates `useEncryption=true&useSystemTrustStore=true` then the following execption is thrown on MacOS.

```
java.sql.SQLException: java.lang.IllegalArgumentException: Input stream does not contain valid certificates.
at org.apache.arrow.driver.jdbc.client.ArrowFlightSqlClientHandler$Builder.build(ArrowFlightSqlClientHandler.java:586)
at org.apache.arrow.driver.jdbc.ArrowFlightConnection.createNewClientHandler(ArrowFlightConnection.java:109)
at org.apache.arrow.driver.jdbc.ArrowFlightConnection.createNewConnection(ArrowFlightConnection.java:88)
at org.apache.arrow.driver.jdbc.ArrowFlightJdbcDriver.connect(ArrowFlightJdbcDriver.java:85)
at org.apache.arrow.driver.jdbc.ArrowFlightJdbcDriver.connect(ArrowFlightJdbcDriver.java:49)
at java.sql/java.sql.DriverManager.getConnection(DriverManager.java:683)
at java.sql/java.sql.DriverManager.getConnection(DriverManager.java:253)
at FlightSQLTLSTest.main(FlightSQLTLSTest.java:13)
Caused by: java.lang.IllegalArgumentException: Input stream does not contain valid certificates.
at cfjd.io.netty.handler.ssl.SslContextBuilder.trustManager(SslContextBuilder.java:276)
at cfjd.org.apache.arrow.flight.FlightClient$Builder.build(FlightClient.java:698)
at org.apache.arrow.driver.jdbc.client.ArrowFlightSqlClientHandler$Builder.build(ArrowFlightSqlClientHandler.java:572)
... 7 more
Caused by: java.security.cert.CertificateException: found no certificates in input stream
at cfjd.io.netty.handler.ssl.PemReader.readCertificates(PemReader.java:107)
at cfjd.io.netty.handler.ssl.SslContext.toX509Certificates(SslContext.java:1226)
at cfjd.io.netty.handler.ssl.SslContextBuilder.trustManager(SslContextBuilder.java:274)
... 9 more
```

On linux the program runs as expected, outputting the list of catalogs.

### Version information

MacOS version: 13.3.1 (a) (22E772610a)
flight-sql-jdbc-driver version: 12.0.0

```
$ uname -a
Darwin cromarty.local 22.4.0 Darwin Kernel Version 22.4.0: Mon Mar 6 20:59:28 PST 2023; root:xnu-8796.101.5~3/RELEASE_ARM64_T6000 arm64
$ java -version
openjdk version "20.0.1" 2023-04-18
OpenJDK Runtime Environment Homebrew (build 20.0.1)
OpenJDK 64-Bit Server VM Homebrew (build 20.0.1, mixed mode, sharing)
```

Note: This is using the openjdk provided by homebrew.

### Component(s)

Java

Beitragsleitfaden

Beitragsleitfaden öffnen

Rechercherichtung

Start at ArrowFlightSqlClientHandler.Builder.build around line 586 and follow the system trust store handling used by the JDBC connection path. Reproduce the minimal FlightSQL application with useEncryption=true and useSystemTrustStore=true on MacOS, then compare it with Linux behavior. Done means the connection succeeds and catalogs are listed without the certificate exception.

Vom Indexierungsmodell aus dem Issue-Text verfasst.

Bewertung

Tech-Stack
java
Bereich
database
Issue-Typ
Bug
Schwierigkeit
3/5
Geschätzter Aufwand
1-2 Tage
Aktivitätsstatus
Veraltet
Klarheit
Größtenteils klar
Anfängerfreundlichkeit
35/100

Neue Issues direkt in Ihr Postfach

Eine kurze Übersicht über anfängerfreundliche GitHub-Issues.