io.netty.handler.ssl.ocsp

Class OcspServerCertificateValidator

java.lang.Object

io.netty.channel.ChannelHandlerAdapter

io.netty.channel.ChannelInboundHandlerAdapter

io.netty.handler.codec.ByteToMessageDecoder

io.netty.handler.ssl.ocsp.OcspServerCertificateValidator

All Implemented Interfaces:

ChannelHandler, ChannelInboundHandler, ChannelOutboundHandler

public class OcspServerCertificateValidator
extends ByteToMessageDecoder
implements ChannelOutboundHandler

OcspServerCertificateValidator validates incoming server's certificate using OCSP. Once TLS handshake is completed, SslHandshakeCompletionEvent.SUCCESS is fired, validator will perform certificate validation using OCSP over HTTP/1.1 with the server's certificate issuer OCSP responder.

Nested Class Summary

Nested classes/interfaces inherited from class io.netty.handler.codec.ByteToMessageDecoder

ByteToMessageDecoder.Cumulator

Nested classes/interfaces inherited from interface io.netty.channel.ChannelHandler

ChannelHandler.Sharable

Field Summary

Fields

Modifier and Type	Field and Description
static AttributeKey<Boolean>	OCSP_PIPELINE_ATTRIBUTE An attribute used to mark all channels created by the OcspServerCertificateValidator.

Fields inherited from class io.netty.handler.codec.ByteToMessageDecoder

COMPOSITE_CUMULATOR, MERGE_CUMULATOR

Constructor Summary

Constructors

Constructor and Description
OcspServerCertificateValidator() Create a new OcspServerCertificateValidator instance without nonce validation on OCSP response, using default IoTransport.DEFAULT instance, default DnsNameResolver implementation and with closeAndThrowIfNotValid set to true
OcspServerCertificateValidator(boolean validateNonce) Create a new OcspServerCertificateValidator instance with default IoTransport.DEFAULT instance and default DnsNameResolver implementation and closeAndThrowIfNotValid set to true.
OcspServerCertificateValidator(boolean closeAndThrowIfNotValid, boolean validateNonce, IoTransport ioTransport, DnsNameResolver dnsNameResolver) Create a new IoTransport instance
OcspServerCertificateValidator(boolean validateNonce, IoTransport ioTransport) Create a new OcspServerCertificateValidator instance
OcspServerCertificateValidator(boolean validateNonce, IoTransport ioTransport, DnsNameResolver dnsNameResolver) Create a new IoTransport instance with closeAndThrowIfNotValid set to true

Method Summary

Modifier and Type	Method and Description
void	bind(ChannelHandlerContext ctx, SocketAddress localAddress, ChannelPromise promise) Called once a bind operation is made.
void	close(ChannelHandlerContext ctx, ChannelPromise promise) Called once a close operation is made.
void	connect(ChannelHandlerContext ctx, SocketAddress remoteAddress, SocketAddress localAddress, ChannelPromise promise) Called once a connect operation is made.
protected static DnsNameResolver	createDefaultResolver(IoTransport ioTransport)
protected void	decode(ChannelHandlerContext ctx, ByteBuf in, List<Object> out) Decode the from one ByteBuf to an other.
void	deregister(ChannelHandlerContext ctx, ChannelPromise promise) Called once a deregister operation is made from the current registered EventLoop.
void	disconnect(ChannelHandlerContext ctx, ChannelPromise promise) Called once a disconnect operation is made.
void	exceptionCaught(ChannelHandlerContext ctx, Throwable cause) Calls ChannelHandlerContext.fireExceptionCaught(Throwable) to forward to the next ChannelHandler in the ChannelPipeline.
void	flush(ChannelHandlerContext ctx) Called once a flush operation is made.
void	read(ChannelHandlerContext ctx) Intercepts ChannelHandlerContext.read().
void	userEventTriggered(ChannelHandlerContext ctx, Object evt) Calls ChannelHandlerContext.fireUserEventTriggered(Object) to forward to the next ChannelInboundHandler in the ChannelPipeline.
void	write(ChannelHandlerContext ctx, Object msg, ChannelPromise promise) Called once a write operation is made.

Methods inherited from class io.netty.handler.codec.ByteToMessageDecoder

actualReadableBytes, callDecode, channelInactive, channelRead, channelReadComplete, decodeLast, discardSomeReadBytes, handlerRemoved, handlerRemoved0, internalBuffer, isSingleDecode, setCumulator, setDiscardAfterReads, setSingleDecode

Methods inherited from class io.netty.channel.ChannelInboundHandlerAdapter

channelActive, channelRegistered, channelUnregistered, channelWritabilityChanged

Methods inherited from class io.netty.channel.ChannelHandlerAdapter

ensureNotSharable, handlerAdded, isSharable

Methods inherited from class java.lang.Object

clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait

Methods inherited from interface io.netty.channel.ChannelHandler

handlerAdded, handlerRemoved

Field Detail

OCSP_PIPELINE_ATTRIBUTE

public static final AttributeKey<Boolean> OCSP_PIPELINE_ATTRIBUTE

An attribute used to mark all channels created by the OcspServerCertificateValidator.

Constructor Detail

OcspServerCertificateValidator

public OcspServerCertificateValidator()

Create a new OcspServerCertificateValidator instance without nonce validation on OCSP response, using default IoTransport.DEFAULT instance, default DnsNameResolver implementation and with closeAndThrowIfNotValid set to true

OcspServerCertificateValidator

public OcspServerCertificateValidator(boolean validateNonce)

Create a new OcspServerCertificateValidator instance with default IoTransport.DEFAULT instance and default DnsNameResolver implementation and closeAndThrowIfNotValid set to true.

Parameters:

validateNonce - Set to true if we should force nonce validation on OCSP response else set to false

OcspServerCertificateValidator

public OcspServerCertificateValidator(boolean validateNonce,
                                      IoTransport ioTransport)

Create a new OcspServerCertificateValidator instance

Parameters:

validateNonce - Set to true if we should force nonce validation on OCSP response else set to false

ioTransport - IoTransport to use

OcspServerCertificateValidator

public OcspServerCertificateValidator(boolean validateNonce,
                                      IoTransport ioTransport,
                                      DnsNameResolver dnsNameResolver)

Create a new IoTransport instance with closeAndThrowIfNotValid set to true

Parameters:

validateNonce - Set to true if we should force nonce validation on OCSP response else set to false

ioTransport - IoTransport to use

dnsNameResolver - DnsNameResolver implementation to use

OcspServerCertificateValidator

public OcspServerCertificateValidator(boolean closeAndThrowIfNotValid,
                                      boolean validateNonce,
                                      IoTransport ioTransport,
                                      DnsNameResolver dnsNameResolver)

Create a new IoTransport instance

Parameters:

closeAndThrowIfNotValid - If set to true then we will close the channel and throw an exception when certificate is not OcspResponse.Status.VALID. If set to false then we will simply pass the OcspValidationEvent to the next handler in pipeline and let it decide what to do.

validateNonce - Set to true if we should force nonce validation on OCSP response else set to false

ioTransport - IoTransport to use

dnsNameResolver - DnsNameResolver implementation to use

Method Detail

createDefaultResolver

protected static DnsNameResolver createDefaultResolver(IoTransport ioTransport)

decode

protected void decode(ChannelHandlerContext ctx,
                      ByteBuf in,
                      List<Object> out)

Description copied from class: ByteToMessageDecoder

Decode the from one ByteBuf to an other. This method will be called till either the input ByteBuf has nothing to read when return from this method or till nothing was read from the input ByteBuf.

Specified by:

decode in class ByteToMessageDecoder

Parameters:

ctx - the ChannelHandlerContext which this ByteToMessageDecoder belongs to

in - the ByteBuf from which to read data

out - the List to which decoded messages should be added

userEventTriggered

public void userEventTriggered(ChannelHandlerContext ctx,
                               Object evt)
                        throws Exception

Description copied from class: ChannelInboundHandlerAdapter

Calls ChannelHandlerContext.fireUserEventTriggered(Object) to forward to the next ChannelInboundHandler in the ChannelPipeline. Sub-classes may override this method to change behavior.

Specified by:

userEventTriggered in interface ChannelInboundHandler

Overrides:

userEventTriggered in class ByteToMessageDecoder

Throws:

Exception

exceptionCaught

public void exceptionCaught(ChannelHandlerContext ctx,
                            Throwable cause)

Description copied from class: ChannelInboundHandlerAdapter

Calls ChannelHandlerContext.fireExceptionCaught(Throwable) to forward to the next ChannelHandler in the ChannelPipeline. Sub-classes may override this method to change behavior.

Specified by:

exceptionCaught in interface ChannelHandler

Specified by:

exceptionCaught in interface ChannelInboundHandler

Overrides:

exceptionCaught in class ChannelInboundHandlerAdapter

bind

public void bind(ChannelHandlerContext ctx,
                 SocketAddress localAddress,
                 ChannelPromise promise)
          throws Exception

Description copied from interface: ChannelOutboundHandler

Called once a bind operation is made.

Specified by:

bind in interface ChannelOutboundHandler

Parameters:

ctx - the ChannelHandlerContext for which the bind operation is made

localAddress - the SocketAddress to which it should bound

promise - the ChannelPromise to notify once the operation completes

Throws:

Exception - thrown if an error occurs

connect

public void connect(ChannelHandlerContext ctx,
                    SocketAddress remoteAddress,
                    SocketAddress localAddress,
                    ChannelPromise promise)
             throws Exception

Description copied from interface: ChannelOutboundHandler

Called once a connect operation is made.

Specified by:

connect in interface ChannelOutboundHandler

Parameters:

ctx - the ChannelHandlerContext for which the connect operation is made

remoteAddress - the SocketAddress to which it should connect

localAddress - the SocketAddress which is used as source on connect

promise - the ChannelPromise to notify once the operation completes

Throws:

Exception - thrown if an error occurs

disconnect

public void disconnect(ChannelHandlerContext ctx,
                       ChannelPromise promise)
                throws Exception

Description copied from interface: ChannelOutboundHandler

Called once a disconnect operation is made.

Specified by:

disconnect in interface ChannelOutboundHandler

Parameters:

ctx - the ChannelHandlerContext for which the disconnect operation is made

promise - the ChannelPromise to notify once the operation completes

Throws:

Exception - thrown if an error occurs

close

public void close(ChannelHandlerContext ctx,
                  ChannelPromise promise)
           throws Exception

Description copied from interface: ChannelOutboundHandler

Called once a close operation is made.

Specified by:

close in interface ChannelOutboundHandler

Parameters:

ctx - the ChannelHandlerContext for which the close operation is made

promise - the ChannelPromise to notify once the operation completes

Throws:

Exception - thrown if an error occurs

deregister

public void deregister(ChannelHandlerContext ctx,
                       ChannelPromise promise)
                throws Exception

Description copied from interface: ChannelOutboundHandler

Called once a deregister operation is made from the current registered EventLoop.

Specified by:

deregister in interface ChannelOutboundHandler

Parameters:

ctx - the ChannelHandlerContext for which the close operation is made

promise - the ChannelPromise to notify once the operation completes

Throws:

Exception - thrown if an error occurs

read

public void read(ChannelHandlerContext ctx)
          throws Exception

Description copied from interface: ChannelOutboundHandler

Intercepts ChannelHandlerContext.read().

Specified by:

read in interface ChannelOutboundHandler

Throws:

Exception

write

public void write(ChannelHandlerContext ctx,
                  Object msg,
                  ChannelPromise promise)
           throws Exception

Description copied from interface: ChannelOutboundHandler

Called once a write operation is made. The write operation will write the messages through the ChannelPipeline. Those are then ready to be flushed to the actual Channel once Channel.flush() is called

Specified by:

write in interface ChannelOutboundHandler

Parameters:

ctx - the ChannelHandlerContext for which the write operation is made

msg - the message to write

promise - the ChannelPromise to notify once the operation completes

Throws:

Exception - thrown if an error occurs

flush

public void flush(ChannelHandlerContext ctx)
           throws Exception

Description copied from interface: ChannelOutboundHandler

Called once a flush operation is made. The flush operation will try to flush out all previous written messages that are pending.

Specified by:

flush in interface ChannelOutboundHandler

Parameters:

ctx - the ChannelHandlerContext for which the flush operation is made

Throws:

Exception - thrown if an error occurs