Skip to content

Commit a1a617c

Browse files
zhicwuzhicwu
committed
Change default sslmode to strict for security reason
1 parent 75ddd37 commit a1a617c

File tree

4 files changed

+15
-14
lines changed

4 files changed

+15
-14
lines changed

‎clickhouse-client/src/main/java/com/clickhouse/client/ClickHouseNode.java

+1-1
Original file line numberDiff line numberDiff line change
@@ -801,7 +801,7 @@ public static ClickHouseNode of(URI uri, ClickHouseNode template) {
801801
}
802802
if (protocol != ClickHouseProtocol.POSTGRESQL && scheme.charAt(scheme.length() - 1) == 's') {
803803
params.put(ClickHouseClientOption.SSL.getKey(), Boolean.TRUE.toString());
804-
params.put(ClickHouseClientOption.SSL_MODE.getKey(), ClickHouseSslMode.NONE.name());
804+
params.put(ClickHouseClientOption.SSL_MODE.getKey(), ClickHouseSslMode.STRICT.name());
805805
}
806806

807807
ClickHouseCredentials credentials = template.credentials;

‎clickhouse-client/src/test/java/com/clickhouse/client/ClickHouseNodeTest.java

+8-8
Original file line numberDiff line numberDiff line change
@@ -169,7 +169,7 @@ public void testInvalidNodes() {
169169
public void testValidNodes() {
170170
Map<String, String> options = new HashMap<>();
171171
options.put(ClickHouseClientOption.SSL.getKey(), "false");
172-
options.put(ClickHouseClientOption.SSL_MODE.getKey(), "NONE");
172+
options.put(ClickHouseClientOption.SSL_MODE.getKey(), ClickHouseSslMode.STRICT.name());
173173
options.put(ClickHouseClientOption.DATABASE.getKey(), "db1");
174174

175175
Set<String> tags = new HashSet<>();
@@ -183,7 +183,7 @@ public void testValidNodes() {
183183
public void testSecureNode() {
184184
Map<String, String> options = new HashMap<>();
185185
options.put(ClickHouseClientOption.SSL.getKey(), "true");
186-
options.put(ClickHouseClientOption.SSL_MODE.getKey(), "NONE");
186+
options.put(ClickHouseClientOption.SSL_MODE.getKey(), ClickHouseSslMode.STRICT.name());
187187
options.put(ClickHouseClientOption.DATABASE.getKey(), "db1");
188188

189189
Assert.assertEquals(ClickHouseNode.of("https://node1:443/db1"),
@@ -218,7 +218,7 @@ public void testSingleWordNode() {
218218
public void testNodeWithProtocol() {
219219
Map<String, String> options = new HashMap<>();
220220
options.put(ClickHouseClientOption.SSL.getKey(), "true");
221-
options.put(ClickHouseClientOption.SSL_MODE.getKey(), "NONE");
221+
options.put(ClickHouseClientOption.SSL_MODE.getKey(), ClickHouseSslMode.STRICT.name());
222222

223223
for (ClickHouseProtocol p : ClickHouseProtocol.values()) {
224224
Assert.assertEquals(ClickHouseNode.of(p.name() + ":///?#"),
@@ -254,7 +254,7 @@ public void testNodeWithHostAndPort() {
254254
public void testNodeWithDatabase() {
255255
Map<String, String> options = new HashMap<>();
256256
options.put(ClickHouseClientOption.SSL.getKey(), "true");
257-
options.put(ClickHouseClientOption.SSL_MODE.getKey(), "NONE");
257+
options.put(ClickHouseClientOption.SSL_MODE.getKey(), ClickHouseSslMode.STRICT.name());
258258

259259
Assert.assertEquals(ClickHouseNode.of("grpcs://node1:19100/"),
260260
new ClickHouseNode("node1", ClickHouseProtocol.GRPC, 19100, null, options, null));
@@ -324,13 +324,13 @@ public void testNodeWithOptions() {
324324
Map<String, String> options = new HashMap<>();
325325
options.put(ClickHouseClientOption.ASYNC.getKey(), "false");
326326
options.put(ClickHouseClientOption.SSL.getKey(), "true");
327-
options.put(ClickHouseClientOption.SSL_MODE.getKey(), "NONE");
327+
options.put(ClickHouseClientOption.SSL_MODE.getKey(), ClickHouseSslMode.STRICT.name());
328328
options.put(ClickHouseClientOption.CONNECTION_TIMEOUT.getKey(), "500");
329329

330330
for (String uri : new String[] {
331331
"https://node1?!async&ssl&connect_timeout=500",
332-
"http://node1?async=false&ssl=true&sslmode=NONE&connect_timeout=500",
333-
"http://node1?&&&&async=false&ssl&&&&&sslmode=NONE&connect_timeout=500&&&",
332+
"http://node1?async=false&ssl=true&sslmode=STRICT&connect_timeout=500",
333+
"http://node1?&&&&async=false&ssl&&&&&sslmode=STRICT&connect_timeout=500&&&",
334334
}) {
335335
Assert.assertEquals(ClickHouseNode.of(uri),
336336
new ClickHouseNode("node1", ClickHouseProtocol.HTTP,
@@ -379,7 +379,7 @@ public void testQueryWithSlash() throws Exception {
379379
Assert.assertEquals(server.toUri(), new URI("http://localhost:1234?/a/b/c=d"));
380380

381381
Assert.assertEquals(ClickHouseNode.of("https://myserver/db/1/2/3?a%20=%201&b=/root/my.crt").toUri(),
382-
new URI("http://myserver:8443/db/1/2/3?ssl=true&sslmode=NONE&a%20=%201&b=/root/my.crt"));
382+
new URI("http://myserver:8443/db/1/2/3?ssl=true&sslmode=STRICT&a%20=%201&b=/root/my.crt"));
383383
}
384384

385385
@Test(groups = { "integration" })

‎clickhouse-client/src/test/java/com/clickhouse/client/ClickHouseNodesTest.java

+2-1
Original file line numberDiff line numberDiff line change
@@ -13,6 +13,7 @@
1313
import com.clickhouse.client.ClickHouseNode.Status;
1414
import com.clickhouse.client.config.ClickHouseClientOption;
1515
import com.clickhouse.client.config.ClickHouseDefaults;
16+
import com.clickhouse.client.config.ClickHouseSslMode;
1617

1718
import org.testng.Assert;
1819
import org.testng.annotations.Test;
@@ -213,7 +214,7 @@ public void testSingleNodeList() {
213214

214215
Map<String, String> options = new HashMap<>();
215216
options.put(ClickHouseClientOption.SSL.getKey(), "true");
216-
options.put(ClickHouseClientOption.SSL_MODE.getKey(), "NONE");
217+
options.put(ClickHouseClientOption.SSL_MODE.getKey(), ClickHouseSslMode.STRICT.name());
217218
options.put(ClickHouseClientOption.DATABASE.getKey(), "db1");
218219

219220
Assert.assertEquals(ClickHouseNodes.of("https://node1:443/db1").nodes.get(0),

‎clickhouse-jdbc/src/test/java/com/clickhouse/jdbc/internal/ClickHouseJdbcUrlParserTest.java

+4-4
Original file line numberDiff line numberDiff line change
@@ -69,12 +69,12 @@ public void testParseAbbrevation() throws SQLException, URISyntaxException {
6969

7070
info = ClickHouseJdbcUrlParser.parse("jdbc:ch:https://:letmein@[::1]:3218/db1?user=aaa", null);
7171
Assert.assertEquals(info.getServer().toUri(ClickHouseJdbcUrlParser.JDBC_CLICKHOUSE_PREFIX),
72-
new URI("jdbc:clickhouse:http://[::1]:3218/db1?ssl=true&sslmode=NONE"));
72+
new URI("jdbc:clickhouse:http://[::1]:3218/db1?ssl=true&sslmode=STRICT"));
7373
Assert.assertEquals(info.getServer(), ClickHouseNode.builder().host("[::1]")
7474
.port(ClickHouseProtocol.HTTP, 3218)
7575
.database("db1")
7676
.credentials(ClickHouseCredentials.fromUserAndPassword("aaa", "letmein"))
77-
.addOption("ssl", "true").addOption("sslmode", "NONE").build());
77+
.addOption("ssl", "true").addOption("sslmode", "STRICT").build());
7878
Assert.assertEquals(info.getServer().getCredentials().orElse(null),
7979
ClickHouseCredentials.fromUserAndPassword("aaa", "letmein"));
8080
}
@@ -98,13 +98,13 @@ public void testParse() throws SQLException, URISyntaxException {
9898

9999
info = ClickHouseJdbcUrlParser.parse("jdbc:ch:https://:[email protected]:3218/db1", null);
100100
Assert.assertEquals(info.getServer().toUri(ClickHouseJdbcUrlParser.JDBC_CLICKHOUSE_PREFIX),
101-
new URI("jdbc:clickhouse:http://127.0.0.1:3218/db1?ssl=true&sslmode=NONE"));
101+
new URI("jdbc:clickhouse:http://127.0.0.1:3218/db1?ssl=true&sslmode=STRICT"));
102102
Assert.assertEquals(info.getServer(), ClickHouseNode.builder().host("127.0.0.1")
103103
.port(ClickHouseProtocol.HTTP, 3218).database("db1")
104104
.credentials(ClickHouseCredentials
105105
.fromUserAndPassword((String) ClickHouseDefaults.USER
106106
.getEffectiveDefaultValue(), "letmein"))
107-
.addOption("ssl", "true").addOption("sslmode", "NONE")
107+
.addOption("ssl", "true").addOption("sslmode", "STRICT")
108108
.build());
109109
}
110110

0 commit comments

Comments
 (0)