feat(bigquery-jdbc): respect standard JVM trustStore properties by default

[keshavdandeva]

b/515129164

Problem

In enterprise corporate networks (e.g. Zscaler), outbound HTTPS traffic is intercepted by transparent proxies doing SSL MITM (man-in-the-middle) decryption. The proxy signs its re-encrypted connections with dynamically generated root CA certificates.

The BigQuery JDBC driver failed to establish TLS connections under these environments because the underlying client library ignored JVM trust stores (the standard Java cacerts file or custom system properties set via -Djavax.net.ssl.trustStore).
This happened because when direct connections had empty SSL/proxy settings, the driver returned null for HttpTransportOptions. This fallback triggered classpath SPI overrides or legacy defaults which invoked GoogleNetHttpTransport.newTrustedTransport(). That convenience constructor hardcodes trust exclusively to a bundled google.p12 keystore, completely overriding JVM system properties.

Solution

Simplified the driver's transport instantiation to align with the core Google Cloud Java SDK's network defaults:

1. Direct Connections: Modified getHttpTransportOptions(...) to unconditionally return a transport factory configured with a single NetHttpTransport instance (new NetHttpTransport.Builder().build()). This allows JSSE to handle TLS certificate validation using standard JVM system properties and cacerts natively. Bypassing the SPI loader prevents classpath hijacking.
2. Explicit Proxy Connections: Configured the Apache HTTP client builder inside getHttpTransportFactory(...) to unconditionally call httpClientBuilder.useSystemProperties(). This ensures that even when a proxy is set in the JDBC URL, Apache HttpClient still honors system-level properties like -Djavax.net.ssl.trustStore.

Integration Testing: SSL/TLS Validation (ITLocalSslValidationTest)

Added ITLocalSslValidationTest.java to validate the loading and enforcement of custom SSL truststore configurations end-to-end.

• Local Mock HTTPS Server: Starts a lightweight local HTTPS server on a random port presenting a self-signed certificate. It mocks necessary BigQuery backend endpoints (/queries and /jobs) to satisfy basic driver query execution.
• Process Isolation: Runs each connection check in a separate, isolated JVM subprocess via ProcessBuilder. This is required to bypass JSSE's JVM-wide caching of the -Djavax.net.ssl.trustStore property.
• Test Coverage:
  • Negative Case: Verifies that connection attempts without a truststore fail with the expected PKIX path building failed handshake error (exit code 1).
  • Positive Case: Verifies that connection attempts using our custom truststore (localhost-truststore.jks) succeed and complete query executions successfully (exit code 0).
• CI Integration: Added to ITPresubmitTests to run automatically on every pull request. Since it uses local mocks, it requires no GCP credentials and executes in under 2 seconds.

[gemini-code-assist]

Code Review

This pull request updates BigQueryJdbcProxyUtility to configure a default NetHttpTransport with a MergedTrustManager (trusting both the JVM's default trust store and Google's bundled certificate store) when no proxy or custom SSL settings are provided. The review feedback focuses on critical performance and robustness improvements: caching the merged SSLContext using a thread-safe lazy initialization holder pattern to avoid high CPU and latency overhead from re-creating it, handling potential null returns from getAcceptedIssuers() to prevent NullPointerException, and preserving debugging context by suppressing the initial CertificateException when falling back to Google's trust manager.

[keshavdandeva]

/gemini review

[gemini-code-assist]

Code Review

This pull request updates BigQueryJdbcProxyUtility to return default HttpTransportOptions with a default NetHttpTransport instead of null when no proxy or SSL settings are configured, and updates the corresponding tests. The reviewer pointed out that the default transport factory implementation recreates a new NetHttpTransport on every call, which can cause socket leaks and prevent connection reuse, and also lacks MergedTrustManager integration. It is recommended to instantiate the transport once and reuse it.

[keshavdandeva]

/gemini review

[gemini-code-assist]

Code Review

This pull request modifies BigQueryJdbcProxyUtility to return default HttpTransportOptions configured with a NetHttpTransport when no proxy or SSL settings are specified, rather than returning null. Additionally, it ensures that httpClientBuilder.useSystemProperties() is always called in getHttpTransportFactory. Corresponding unit tests have been updated to reflect these changes. There are no review comments, and I have no additional feedback to provide.

[logachev]

lgtm, but before approving I'd want us to have an environment where we could validate it

[logachev]

Why using final here?

[keshavdandeva]

Removed. It was originally added because the variable is captured by a lambda, but since it is effectively final, the final keyword is redundant.

[keshavdandeva]

/gemini review

[gemini-code-assist]

Code Review

This pull request updates BigQueryJdbcProxyUtility to return default HTTP transport options instead of null when no proxy or timeout configurations are set, and introduces a new integration test ITLocalSslValidationTest to validate local SSL connections. The review feedback recommends resolving the truststore path dynamically from the classpath rather than using a hardcoded relative path, ensuring the tests run reliably regardless of the working directory.

[keshavdandeva]

/gemini review

[gemini-code-assist]

Code Review

This pull request updates BigQueryJdbcProxyUtility to return default HttpTransportOptions with a NetHttpTransport instead of null when no proxy or SSL settings are configured, and ensures useSystemProperties() is always invoked. It also introduces a new integration test, ITLocalSslValidationTest, to verify SSL behavior. The review feedback highlights two important improvements in the new integration test: first, resolving potential encoding and response truncation issues in the mock server by using UTF-8 byte arrays for HTTP responses; second, implementing a timeout for the subprocess execution to prevent tests from hanging indefinitely in CI.