Package org.postgresql.ssl

Class Pk8OrPemKeyManager

java.lang.Object

org.postgresql.ssl.Pk8OrPemKeyManager

All Implemented Interfaces:

KeyManager, X509KeyManager

public class Pk8OrPemKeyManager
extends Object
implements X509KeyManager

A key manager that selects PEM when its header is found within the first 64 KiB of the key file, and PK8/DER otherwise. This preserves libpq's preference for PEM before DER, while using a bounded marker scan rather than parsing the key during format detection.

The delegate is resolved lazily on the first call to any X509KeyManager method, so this works regardless of which method the TLS engine calls first.

Field Summary

Fields

Modifier and Type	Field	Description
private X509KeyManager	delegate
private final String	keyFilePath
private static final int	MAX_PEM_SCAN_BYTES
private final PEMKeyManager	pem
private static final byte[]	PEM_HEADER
private static final int	PEM_SCAN_CHUNK_BYTES
private PSQLException	permissionError
private final LazyKeyManager	pk8

Constructor Summary

Constructors

Constructor	Description
Pk8OrPemKeyManager(String keyFilePath, PEMKeyManager pem, LazyKeyManager pk8)

Method Summary

Modifier and Type	Method	Description
String	chooseClientAlias(String[] keyType, Principal[] issuers, Socket socket)
String	chooseServerAlias(String keyType, Principal[] issuers, Socket socket)
private X509KeyManager	delegate()	Resolves which key manager to use by probing the key file format, or null if the key file has insecure permissions.
X509Certificate[]	getCertificateChain(String alias)
String[]	getClientAliases(String keyType, Principal[] issuers)
PrivateKey	getPrivateKey(String alias)
String[]	getServerAliases(String keyType, Principal[] issuers)
private boolean	looksLikePem()	Returns true if the key file is a PKCS#8 PEM file, detected by the BEGIN PRIVATE KEY marker within the first MAX_PEM_SCAN_BYTES bytes.
void	throwKeyManagerException()	Propagates any exception from the resolved delegate key manager, including an insecure-permission error detected while probing the key file.

Methods inherited from class java.lang.Object

clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait

Field Details

PEM_HEADER

private static final byte[] PEM_HEADER

MAX_PEM_SCAN_BYTES

private static final int MAX_PEM_SCAN_BYTES

See Also:

• Constant Field Values

PEM_SCAN_CHUNK_BYTES

private static final int PEM_SCAN_CHUNK_BYTES

See Also:

• Constant Field Values

keyFilePath

private final String keyFilePath

pem

private final PEMKeyManager pem

pk8

private final LazyKeyManager pk8

delegate

private X509KeyManager delegate

permissionError

private PSQLException permissionError

Constructor Details

Pk8OrPemKeyManager

public Pk8OrPemKeyManager(String keyFilePath,
 PEMKeyManager pem,
 LazyKeyManager pk8)

Method Details

delegate

private X509KeyManager delegate()

Resolves which key manager to use by probing the key file format, or null if the key file has insecure permissions.

looksLikePem

private boolean looksLikePem()

Returns true if the key file is a PKCS#8 PEM file, detected by the BEGIN PRIVATE KEY marker within the first MAX_PEM_SCAN_BYTES bytes. Binary (DER) or unreadable content is not PEM.

The marker is matched with a streaming scan, so it is found even when it straddles a read boundary, while memory stays bounded to one chunk. The marker's first byte ('B') does not recur in it, so a mismatch can only start a fresh match and no KMP-style backtracking is needed.

getClientAliases

public String[] getClientAliases(String keyType,
 Principal[] issuers)

Specified by:

getClientAliases in interface X509KeyManager

chooseClientAlias

public String chooseClientAlias(String[] keyType,
 Principal[] issuers,
 Socket socket)

Specified by:

chooseClientAlias in interface X509KeyManager

getServerAliases

public String[] getServerAliases(String keyType,
 Principal[] issuers)

Specified by:

getServerAliases in interface X509KeyManager

chooseServerAlias

public String chooseServerAlias(String keyType,
 Principal[] issuers,
 Socket socket)

Specified by:

chooseServerAlias in interface X509KeyManager

getCertificateChain

public X509Certificate[] getCertificateChain(String alias)

Specified by:

getCertificateChain in interface X509KeyManager

getPrivateKey

public PrivateKey getPrivateKey(String alias)

Specified by:

getPrivateKey in interface X509KeyManager

throwKeyManagerException

public void throwKeyManagerException()
                              throws PSQLException

Propagates any exception from the resolved delegate key manager, including an insecure-permission error detected while probing the key file.

Throws:

PSQLException - if the delegate key manager has a stored exception