Java 6173

driver-core/src/main/com/mongodb/AutoEncryptionSettings.java

@@ -17,6 +17,7 @@
 package com.mongodb;
 
 import com.mongodb.annotations.NotThreadSafe;
+import com.mongodb.connection.ProxySettings;
 import com.mongodb.lang.Nullable;
 import org.bson.BsonDocument;
 
@@ -69,6 +70,7 @@ public final class AutoEncryptionSettings {
     private final String keyVaultNamespace;
     private final Map<String, Map<String, Object>> kmsProviders;
     private final Map<String, SSLContext> kmsProviderSslContextMap;
+    private final ProxySettings proxySettings;
     private final Map<String, Supplier<Map<String, Object>>> kmsProviderPropertySuppliers;
     private final Map<String, BsonDocument> schemaMap;
     private final Map<String, Object> extraOptions;
@@ -88,6 +90,7 @@ public static final class Builder {
         private String keyVaultNamespace;
         private Map<String, Map<String, Object>> kmsProviders;
         private Map<String, SSLContext> kmsProviderSslContextMap = new HashMap<>();
+        private ProxySettings proxySettings = ProxySettings.builder().build();
         private Map<String, Supplier<Map<String, Object>>> kmsProviderPropertySuppliers = new HashMap<>();
         private Map<String, BsonDocument> schemaMap = Collections.emptyMap();
         private Map<String, Object> extraOptions = Collections.emptyMap();
@@ -162,6 +165,26 @@ public Builder kmsProviderSslContextMap(final Map<String, SSLContext> kmsProvide
             return this;
         }
 
+        /**
+         * Sets the proxy to route Key Management Service (KMS) requests through.
+         *
+         * <p>Both {@link com.mongodb.connection.ProxyProtocol#HTTP HTTP} and
+         * {@link com.mongodb.connection.ProxyProtocol#SOCKS5 SOCKS5} proxies are supported. TLS is always negotiated
+         * end-to-end with the KMS host, so the proxy relays the session without being able to read it.</p>
+         *
+         * <p>Defaults to a {@link ProxySettings} with no host, in which case the driver connects to KMS hosts
+         * directly.</p>
+         *
+         * @param proxySettings the proxy settings, which may not be null.
+         * @return this
+         * @see #getProxySettings()
+         * @since 5.11
+         */
+        public Builder proxySettings(final ProxySettings proxySettings) {
+            this.proxySettings = notNull("proxySettings", proxySettings);
+            return this;
+        }
+
         /**
          * Sets the map from namespace to local schema document
          *
@@ -406,6 +429,16 @@ public Map<String, SSLContext> getKmsProviderSslContextMap() {
         return unmodifiableMap(kmsProviderSslContextMap);
     }
 
+    /**
+     * Gets the proxy that Key Management Service (KMS) requests are routed through.
+     *
+     * @return the proxy settings, never null. {@link ProxySettings#isProxyEnabled()} is false if no proxy is configured.
+     * @since 5.11
+     */
+    public ProxySettings getProxySettings() {
+        return proxySettings;
+    }
+
     /**
      * Gets the map of namespace to local JSON schema.
      * <p>
@@ -529,6 +562,7 @@ private AutoEncryptionSettings(final Builder builder) {
         this.keyVaultNamespace = notNull("keyVaultNamespace", builder.keyVaultNamespace);
         this.kmsProviders = notNull("kmsProviders", builder.kmsProviders);
         this.kmsProviderSslContextMap = notNull("kmsProviderSslContextMap", builder.kmsProviderSslContextMap);
+        this.proxySettings = builder.proxySettings;
         this.kmsProviderPropertySuppliers = notNull("kmsProviderPropertySuppliers", builder.kmsProviderPropertySuppliers);
         this.schemaMap = notNull("schemaMap", builder.schemaMap);
         this.extraOptions = notNull("extraOptions", builder.extraOptions);

driver-core/src/main/com/mongodb/ClientEncryptionSettings.java

@@ -18,6 +18,7 @@
 
 import com.mongodb.annotations.Alpha;
 import com.mongodb.annotations.NotThreadSafe;
+import com.mongodb.connection.ProxySettings;
 import com.mongodb.annotations.Reason;
 import com.mongodb.lang.Nullable;
 
@@ -49,6 +50,7 @@ public final class ClientEncryptionSettings {
     private final Map<String, Map<String, Object>> kmsProviders;
     private final Map<String, Supplier<Map<String, Object>>> kmsProviderPropertySuppliers;
     private final Map<String, SSLContext> kmsProviderSslContextMap;
+    private final ProxySettings proxySettings;
     @Nullable
     private final Long timeoutMS;
     @Nullable
@@ -65,6 +67,7 @@ public static final class Builder {
         private Map<String, Map<String, Object>> kmsProviders;
         private Map<String, Supplier<Map<String, Object>>> kmsProviderPropertySuppliers = new HashMap<>();
         private Map<String, SSLContext> kmsProviderSslContextMap = new HashMap<>();
+        private ProxySettings proxySettings = ProxySettings.builder().build();
         @Nullable
         private Long timeoutMS;
         @Nullable
@@ -136,6 +139,26 @@ public Builder kmsProviderSslContextMap(final Map<String, SSLContext> kmsProvide
             return this;
         }
 
+        /**
+         * Sets the proxy to route Key Management Service (KMS) requests through.
+         *
+         * <p>Both {@link com.mongodb.connection.ProxyProtocol#HTTP HTTP} and
+         * {@link com.mongodb.connection.ProxyProtocol#SOCKS5 SOCKS5} proxies are supported. TLS is always negotiated
+         * end-to-end with the KMS host, so the proxy relays the session without being able to read it.</p>
+         *
+         * <p>Defaults to a {@link ProxySettings} with no host, in which case the driver connects to KMS hosts
+         * directly.</p>
+         *
+         * @param proxySettings the proxy settings, which may not be null.
+         * @return this
+         * @see #getProxySettings()
+         * @since 5.11
+         */
+        public Builder proxySettings(final ProxySettings proxySettings) {
+            this.proxySettings = notNull("proxySettings", proxySettings);
+            return this;
+        }
+
         /**
          * The cache expiration time for data encryption keys.
          * <p>Defaults to {@code null} which defers to libmongocrypt's default which is currently 60000 ms. Set to 0 to disable key expiration.</p>
@@ -335,6 +358,16 @@ public Map<String, SSLContext> getKmsProviderSslContextMap() {
         return unmodifiableMap(kmsProviderSslContextMap);
     }
 
+    /**
+     * Gets the proxy that Key Management Service (KMS) requests are routed through.
+     *
+     * @return the proxy settings, never null. {@link ProxySettings#isProxyEnabled()} is false if no proxy is configured.
+     * @since 5.11
+     */
+    public ProxySettings getProxySettings() {
+        return proxySettings;
+    }
+
     /**
      * Returns the cache expiration time for data encryption keys.
      *
@@ -399,6 +432,7 @@ private ClientEncryptionSettings(final Builder builder) {
         this.kmsProviders = notNull("kmsProviders", builder.kmsProviders);
         this.kmsProviderPropertySuppliers = notNull("kmsProviderPropertySuppliers", builder.kmsProviderPropertySuppliers);
         this.kmsProviderSslContextMap = notNull("kmsProviderSslContextMap", builder.kmsProviderSslContextMap);
+        this.proxySettings = builder.proxySettings;
         this.timeoutMS = builder.timeoutMS;
         this.keyExpirationMS = builder.keyExpirationMS;
     }

driver-core/src/main/com/mongodb/connection/ProxyProtocol.java

@@ -0,0 +1,60 @@
+/*
+ * Copyright 2008-present MongoDB, Inc.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package com.mongodb.connection;
+
+import com.mongodb.AutoEncryptionSettings;
+import com.mongodb.ClientEncryptionSettings;
+
+/**
+ * The protocol spoken to a proxy server.
+ *
+ * @see ProxySettings.Builder#protocol(ProxyProtocol)
+ * @since 5.11
+ */
+public enum ProxyProtocol {
+    /**
+     * SOCKS5, as specified by <a href="https://www.rfc-editor.org/rfc/rfc1928">RFC 1928</a>.
+     *
+     * <p>This is the default, and is the only protocol supported for connections to a MongoDB server.</p>
+     */
+    SOCKS5,
+
+    /**
+     * HTTP, using the {@code CONNECT} method to establish a tunnel to the target host.
+     *
+     * <p>This protocol is currently supported only for Key Management Service (KMS) requests made by in-use
+     * encryption, configured via {@link ClientEncryptionSettings.Builder#proxySettings(ProxySettings)} or
+     * {@link AutoEncryptionSettings.Builder#proxySettings(ProxySettings)}. Configuring it for connections to a
+     * MongoDB server is rejected when the client is created.</p>
+     *
+     * <p>A port must be specified explicitly with {@link ProxySettings.Builder#port(int)}, as there is no
+     * standard port for an HTTP proxy.</p>
+     */
+    HTTP,
+
+    /**
+     * HTTP over TLS, using the {@code CONNECT} method to establish a tunnel to the target host.
+     *
+     * <p>The connection to the proxy itself is protected with TLS, configured by
+     * {@link ProxySettings.Builder#sslContext(javax.net.ssl.SSLContext)}. The tunnel then carries a second, independent
+     * TLS session negotiated end-to-end with the target host, so the proxy cannot read it.</p>
+     *
+     * <p>As with {@link #HTTP}, this is supported only for Key Management Service (KMS) requests, and a port must be
+     * specified explicitly.</p>
+     */
+    HTTPS
+}