1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16 package io.netty.handler.ssl;
17
18 import io.netty.buffer.ByteBuf;
19 import io.netty.buffer.ByteBufAllocator;
20 import io.netty.internal.tcnative.CertificateVerifier;
21 import io.netty.internal.tcnative.SSL;
22 import io.netty.internal.tcnative.SSLContext;
23 import io.netty.util.AbstractReferenceCounted;
24 import io.netty.util.ReferenceCounted;
25 import io.netty.util.ResourceLeakDetector;
26 import io.netty.util.ResourceLeakDetectorFactory;
27 import io.netty.util.ResourceLeakTracker;
28 import io.netty.util.internal.PlatformDependent;
29 import io.netty.util.internal.StringUtil;
30 import io.netty.util.internal.SystemPropertyUtil;
31 import io.netty.util.internal.logging.InternalLogger;
32 import io.netty.util.internal.logging.InternalLoggerFactory;
33
34 import java.security.AccessController;
35 import java.security.PrivateKey;
36 import java.security.PrivilegedAction;
37 import java.security.cert.CertPathValidatorException;
38 import java.security.cert.Certificate;
39 import java.security.cert.CertificateExpiredException;
40 import java.security.cert.CertificateNotYetValidException;
41 import java.security.cert.CertificateRevokedException;
42 import java.security.cert.X509Certificate;
43 import java.util.Arrays;
44 import java.util.Collections;
45 import java.util.List;
46 import java.util.Map;
47 import java.util.concurrent.locks.Lock;
48 import java.util.concurrent.locks.ReadWriteLock;
49 import java.util.concurrent.locks.ReentrantReadWriteLock;
50
51 import javax.net.ssl.KeyManager;
52 import javax.net.ssl.KeyManagerFactory;
53 import javax.net.ssl.SSLEngine;
54 import javax.net.ssl.SSLException;
55 import javax.net.ssl.SSLHandshakeException;
56 import javax.net.ssl.TrustManager;
57 import javax.net.ssl.X509ExtendedTrustManager;
58 import javax.net.ssl.X509KeyManager;
59 import javax.net.ssl.X509TrustManager;
60
61 import static io.netty.handler.ssl.OpenSsl.DEFAULT_CIPHERS;
62 import static io.netty.handler.ssl.OpenSsl.availableJavaCipherSuites;
63 import static io.netty.util.internal.ObjectUtil.checkNotNull;
64 import static io.netty.util.internal.ObjectUtil.checkPositiveOrZero;
65
66
67
68
69
70
71
72
73
74
75 public abstract class ReferenceCountedOpenSslContext extends SslContext implements ReferenceCounted {
76 private static final InternalLogger logger =
77 InternalLoggerFactory.getInstance(ReferenceCountedOpenSslContext.class);
78
79 private static final int DEFAULT_BIO_NON_APPLICATION_BUFFER_SIZE =
80 AccessController.doPrivileged(new PrivilegedAction<Integer>() {
81 @Override
82 public Integer run() {
83 return Math.max(1,
84 SystemPropertyUtil.getInt("io.netty.handler.ssl.openssl.bioNonApplicationBufferSize",
85 2048));
86 }
87 });
88
89 private static final Integer DH_KEY_LENGTH;
90 private static final ResourceLeakDetector<ReferenceCountedOpenSslContext> leakDetector =
91 ResourceLeakDetectorFactory.instance().newResourceLeakDetector(ReferenceCountedOpenSslContext.class);
92
93
94 protected static final int VERIFY_DEPTH = 10;
95
96
97
98
99
100
101 protected long ctx;
102 private final List<String> unmodifiableCiphers;
103 private final long sessionCacheSize;
104 private final long sessionTimeout;
105 private final OpenSslApplicationProtocolNegotiator apn;
106 private final int mode;
107
108
109 private final ResourceLeakTracker<ReferenceCountedOpenSslContext> leak;
110 private final AbstractReferenceCounted refCnt = new AbstractReferenceCounted() {
111 @Override
112 public ReferenceCounted touch(Object hint) {
113 if (leak != null) {
114 leak.record(hint);
115 }
116
117 return ReferenceCountedOpenSslContext.this;
118 }
119
120 @Override
121 protected void deallocate() {
122 destroy();
123 if (leak != null) {
124 boolean closed = leak.close(ReferenceCountedOpenSslContext.this);
125 assert closed;
126 }
127 }
128 };
129
130 final Certificate[] keyCertChain;
131 final ClientAuth clientAuth;
132 final String[] protocols;
133 final boolean enableOcsp;
134 final OpenSslEngineMap engineMap = new DefaultOpenSslEngineMap();
135 final ReadWriteLock ctxLock = new ReentrantReadWriteLock();
136
137 private volatile int bioNonApplicationBufferSize = DEFAULT_BIO_NON_APPLICATION_BUFFER_SIZE;
138
139 @SuppressWarnings("deprecation")
140 static final OpenSslApplicationProtocolNegotiator NONE_PROTOCOL_NEGOTIATOR =
141 new OpenSslApplicationProtocolNegotiator() {
142 @Override
143 public ApplicationProtocolConfig.Protocol protocol() {
144 return ApplicationProtocolConfig.Protocol.NONE;
145 }
146
147 @Override
148 public List<String> protocols() {
149 return Collections.emptyList();
150 }
151
152 @Override
153 public ApplicationProtocolConfig.SelectorFailureBehavior selectorFailureBehavior() {
154 return ApplicationProtocolConfig.SelectorFailureBehavior.CHOOSE_MY_LAST_PROTOCOL;
155 }
156
157 @Override
158 public ApplicationProtocolConfig.SelectedListenerFailureBehavior selectedListenerFailureBehavior() {
159 return ApplicationProtocolConfig.SelectedListenerFailureBehavior.ACCEPT;
160 }
161 };
162
163 static {
164 Integer dhLen = null;
165
166 try {
167 String dhKeySize = AccessController.doPrivileged(new PrivilegedAction<String>() {
168 @Override
169 public String run() {
170 return SystemPropertyUtil.get("jdk.tls.ephemeralDHKeySize");
171 }
172 });
173 if (dhKeySize != null) {
174 try {
175 dhLen = Integer.valueOf(dhKeySize);
176 } catch (NumberFormatException e) {
177 logger.debug("ReferenceCountedOpenSslContext supports -Djdk.tls.ephemeralDHKeySize={int}, but got: "
178 + dhKeySize);
179 }
180 }
181 } catch (Throwable ignore) {
182
183 }
184 DH_KEY_LENGTH = dhLen;
185 }
186
187 ReferenceCountedOpenSslContext(Iterable<String> ciphers, CipherSuiteFilter cipherFilter,
188 ApplicationProtocolConfig apnCfg, long sessionCacheSize, long sessionTimeout,
189 int mode, Certificate[] keyCertChain, ClientAuth clientAuth, String[] protocols,
190 boolean startTls, boolean enableOcsp, boolean leakDetection) throws SSLException {
191 this(ciphers, cipherFilter, toNegotiator(apnCfg), sessionCacheSize, sessionTimeout, mode, keyCertChain,
192 clientAuth, protocols, startTls, enableOcsp, leakDetection);
193 }
194
195 ReferenceCountedOpenSslContext(Iterable<String> ciphers, CipherSuiteFilter cipherFilter,
196 OpenSslApplicationProtocolNegotiator apn, long sessionCacheSize,
197 long sessionTimeout, int mode, Certificate[] keyCertChain,
198 ClientAuth clientAuth, String[] protocols, boolean startTls, boolean enableOcsp,
199 boolean leakDetection) throws SSLException {
200 super(startTls);
201
202 OpenSsl.ensureAvailability();
203
204 if (enableOcsp && !OpenSsl.isOcspSupported()) {
205 throw new IllegalStateException("OCSP is not supported.");
206 }
207
208 if (mode != SSL.SSL_MODE_SERVER && mode != SSL.SSL_MODE_CLIENT) {
209 throw new IllegalArgumentException("mode most be either SSL.SSL_MODE_SERVER or SSL.SSL_MODE_CLIENT");
210 }
211 leak = leakDetection ? leakDetector.track(this) : null;
212 this.mode = mode;
213 this.clientAuth = isServer() ? checkNotNull(clientAuth, "clientAuth") : ClientAuth.NONE;
214 this.protocols = protocols;
215 this.enableOcsp = enableOcsp;
216
217 this.keyCertChain = keyCertChain == null ? null : keyCertChain.clone();
218
219 unmodifiableCiphers = Arrays.asList(checkNotNull(cipherFilter, "cipherFilter").filterCipherSuites(
220 ciphers, DEFAULT_CIPHERS, availableJavaCipherSuites()));
221
222 this.apn = checkNotNull(apn, "apn");
223
224
225 boolean success = false;
226 try {
227 try {
228 ctx = SSLContext.make(SSL.SSL_PROTOCOL_ALL, mode);
229 } catch (Exception e) {
230 throw new SSLException("failed to create an SSL_CTX", e);
231 }
232
233 SSLContext.setOptions(ctx, SSLContext.getOptions(ctx) |
234 SSL.SSL_OP_NO_SSLv2 |
235 SSL.SSL_OP_NO_SSLv3 |
236 SSL.SSL_OP_CIPHER_SERVER_PREFERENCE |
237
238
239 SSL.SSL_OP_NO_COMPRESSION |
240
241
242
243
244
245 SSL.SSL_OP_NO_TICKET);
246
247
248
249
250 SSLContext.setMode(ctx, SSLContext.getMode(ctx) | SSL.SSL_MODE_ACCEPT_MOVING_WRITE_BUFFER);
251
252 if (DH_KEY_LENGTH != null) {
253 SSLContext.setTmpDHLength(ctx, DH_KEY_LENGTH);
254 }
255
256
257 try {
258 SSLContext.setCipherSuite(ctx, CipherSuiteConverter.toOpenSsl(unmodifiableCiphers));
259 } catch (SSLException e) {
260 throw e;
261 } catch (Exception e) {
262 throw new SSLException("failed to set cipher suite: " + unmodifiableCiphers, e);
263 }
264
265 List<String> nextProtoList = apn.protocols();
266
267 if (!nextProtoList.isEmpty()) {
268 String[] appProtocols = nextProtoList.toArray(new String[0]);
269 int selectorBehavior = opensslSelectorFailureBehavior(apn.selectorFailureBehavior());
270
271 switch (apn.protocol()) {
272 case NPN:
273 SSLContext.setNpnProtos(ctx, appProtocols, selectorBehavior);
274 break;
275 case ALPN:
276 SSLContext.setAlpnProtos(ctx, appProtocols, selectorBehavior);
277 break;
278 case NPN_AND_ALPN:
279 SSLContext.setNpnProtos(ctx, appProtocols, selectorBehavior);
280 SSLContext.setAlpnProtos(ctx, appProtocols, selectorBehavior);
281 break;
282 default:
283 throw new Error();
284 }
285 }
286
287
288 if (sessionCacheSize <= 0) {
289
290 sessionCacheSize = SSLContext.setSessionCacheSize(ctx, 20480);
291 }
292 this.sessionCacheSize = sessionCacheSize;
293 SSLContext.setSessionCacheSize(ctx, sessionCacheSize);
294
295
296 if (sessionTimeout <= 0) {
297
298 sessionTimeout = SSLContext.setSessionCacheTimeout(ctx, 300);
299 }
300 this.sessionTimeout = sessionTimeout;
301 SSLContext.setSessionCacheTimeout(ctx, sessionTimeout);
302
303 if (enableOcsp) {
304 SSLContext.enableOcsp(ctx, isClient());
305 }
306 success = true;
307 } finally {
308 if (!success) {
309 release();
310 }
311 }
312 }
313
314 private static int opensslSelectorFailureBehavior(ApplicationProtocolConfig.SelectorFailureBehavior behavior) {
315 switch (behavior) {
316 case NO_ADVERTISE:
317 return SSL.SSL_SELECTOR_FAILURE_NO_ADVERTISE;
318 case CHOOSE_MY_LAST_PROTOCOL:
319 return SSL.SSL_SELECTOR_FAILURE_CHOOSE_MY_LAST_PROTOCOL;
320 default:
321 throw new Error();
322 }
323 }
324
325 @Override
326 public final List<String> cipherSuites() {
327 return unmodifiableCiphers;
328 }
329
330 @Override
331 public final long sessionCacheSize() {
332 return sessionCacheSize;
333 }
334
335 @Override
336 public final long sessionTimeout() {
337 return sessionTimeout;
338 }
339
340 @Override
341 public ApplicationProtocolNegotiator applicationProtocolNegotiator() {
342 return apn;
343 }
344
345 @Override
346 public final boolean isClient() {
347 return mode == SSL.SSL_MODE_CLIENT;
348 }
349
350 @Override
351 public final SSLEngine newEngine(ByteBufAllocator alloc, String peerHost, int peerPort) {
352 return newEngine0(alloc, peerHost, peerPort, true);
353 }
354
355 @Override
356 protected final SslHandler newHandler(ByteBufAllocator alloc, boolean startTls) {
357 return new SslHandler(newEngine0(alloc, null, -1, false), startTls);
358 }
359
360 @Override
361 protected final SslHandler newHandler(ByteBufAllocator alloc, String peerHost, int peerPort, boolean startTls) {
362 return new SslHandler(newEngine0(alloc, peerHost, peerPort, false), startTls);
363 }
364
365 SSLEngine newEngine0(ByteBufAllocator alloc, String peerHost, int peerPort, boolean jdkCompatibilityMode) {
366 return new ReferenceCountedOpenSslEngine(this, alloc, peerHost, peerPort, jdkCompatibilityMode, true);
367 }
368
369 abstract OpenSslKeyMaterialManager keyMaterialManager();
370
371
372
373
374 @Override
375 public final SSLEngine newEngine(ByteBufAllocator alloc) {
376 return newEngine(alloc, null, -1);
377 }
378
379
380
381
382
383
384
385
386 @Deprecated
387 public final long context() {
388 Lock readerLock = ctxLock.readLock();
389 readerLock.lock();
390 try {
391 return ctx;
392 } finally {
393 readerLock.unlock();
394 }
395 }
396
397
398
399
400
401
402 @Deprecated
403 public final OpenSslSessionStats stats() {
404 return sessionContext().stats();
405 }
406
407
408
409
410
411
412 @Deprecated
413 public void setRejectRemoteInitiatedRenegotiation(boolean rejectRemoteInitiatedRenegotiation) {
414 if (!rejectRemoteInitiatedRenegotiation) {
415 throw new UnsupportedOperationException("Renegotiation is not supported");
416 }
417 }
418
419
420
421
422
423 @Deprecated
424 public boolean getRejectRemoteInitiatedRenegotiation() {
425 return true;
426 }
427
428
429
430
431
432 public void setBioNonApplicationBufferSize(int bioNonApplicationBufferSize) {
433 this.bioNonApplicationBufferSize =
434 checkPositiveOrZero(bioNonApplicationBufferSize, "bioNonApplicationBufferSize");
435 }
436
437
438
439
440 public int getBioNonApplicationBufferSize() {
441 return bioNonApplicationBufferSize;
442 }
443
444
445
446
447
448
449 @Deprecated
450 public final void setTicketKeys(byte[] keys) {
451 sessionContext().setTicketKeys(keys);
452 }
453
454 @Override
455 public abstract OpenSslSessionContext sessionContext();
456
457
458
459
460
461
462
463
464 @Deprecated
465 public final long sslCtxPointer() {
466 Lock readerLock = ctxLock.readLock();
467 readerLock.lock();
468 try {
469 return ctx;
470 } finally {
471 readerLock.unlock();
472 }
473 }
474
475
476
477
478 private void destroy() {
479 Lock writerLock = ctxLock.writeLock();
480 writerLock.lock();
481 try {
482 if (ctx != 0) {
483 if (enableOcsp) {
484 SSLContext.disableOcsp(ctx);
485 }
486
487 SSLContext.free(ctx);
488 ctx = 0;
489
490 OpenSslSessionContext context = sessionContext();
491 if (context != null) {
492 context.destroy();
493 }
494 }
495 } finally {
496 writerLock.unlock();
497 }
498 }
499
500 protected static X509Certificate[] certificates(byte[][] chain) {
501 X509Certificate[] peerCerts = new X509Certificate[chain.length];
502 for (int i = 0; i < peerCerts.length; i++) {
503 peerCerts[i] = new OpenSslX509Certificate(chain[i]);
504 }
505 return peerCerts;
506 }
507
508 protected static X509TrustManager chooseTrustManager(TrustManager[] managers) {
509 for (TrustManager m : managers) {
510 if (m instanceof X509TrustManager) {
511 return (X509TrustManager) m;
512 }
513 }
514 throw new IllegalStateException("no X509TrustManager found");
515 }
516
517 protected static X509KeyManager chooseX509KeyManager(KeyManager[] kms) {
518 for (KeyManager km : kms) {
519 if (km instanceof X509KeyManager) {
520 return (X509KeyManager) km;
521 }
522 }
523 throw new IllegalStateException("no X509KeyManager found");
524 }
525
526
527
528
529
530
531
532
533 @SuppressWarnings("deprecation")
534 static OpenSslApplicationProtocolNegotiator toNegotiator(ApplicationProtocolConfig config) {
535 if (config == null) {
536 return NONE_PROTOCOL_NEGOTIATOR;
537 }
538
539 switch (config.protocol()) {
540 case NONE:
541 return NONE_PROTOCOL_NEGOTIATOR;
542 case ALPN:
543 case NPN:
544 case NPN_AND_ALPN:
545 switch (config.selectedListenerFailureBehavior()) {
546 case CHOOSE_MY_LAST_PROTOCOL:
547 case ACCEPT:
548 switch (config.selectorFailureBehavior()) {
549 case CHOOSE_MY_LAST_PROTOCOL:
550 case NO_ADVERTISE:
551 return new OpenSslDefaultApplicationProtocolNegotiator(
552 config);
553 default:
554 throw new UnsupportedOperationException(
555 new StringBuilder("OpenSSL provider does not support ")
556 .append(config.selectorFailureBehavior())
557 .append(" behavior").toString());
558 }
559 default:
560 throw new UnsupportedOperationException(
561 new StringBuilder("OpenSSL provider does not support ")
562 .append(config.selectedListenerFailureBehavior())
563 .append(" behavior").toString());
564 }
565 default:
566 throw new Error();
567 }
568 }
569
570 static boolean useExtendedTrustManager(X509TrustManager trustManager) {
571 return PlatformDependent.javaVersion() >= 7 && trustManager instanceof X509ExtendedTrustManager;
572 }
573
574 @Override
575 public final int refCnt() {
576 return refCnt.refCnt();
577 }
578
579 @Override
580 public final ReferenceCounted retain() {
581 refCnt.retain();
582 return this;
583 }
584
585 @Override
586 public final ReferenceCounted retain(int increment) {
587 refCnt.retain(increment);
588 return this;
589 }
590
591 @Override
592 public final ReferenceCounted touch() {
593 refCnt.touch();
594 return this;
595 }
596
597 @Override
598 public final ReferenceCounted touch(Object hint) {
599 refCnt.touch(hint);
600 return this;
601 }
602
603 @Override
604 public final boolean release() {
605 return refCnt.release();
606 }
607
608 @Override
609 public final boolean release(int decrement) {
610 return refCnt.release(decrement);
611 }
612
613 abstract static class AbstractCertificateVerifier extends CertificateVerifier {
614 private final OpenSslEngineMap engineMap;
615
616 AbstractCertificateVerifier(OpenSslEngineMap engineMap) {
617 this.engineMap = engineMap;
618 }
619
620 @Override
621 public final int verify(long ssl, byte[][] chain, String auth) {
622 X509Certificate[] peerCerts = certificates(chain);
623 final ReferenceCountedOpenSslEngine engine = engineMap.get(ssl);
624 try {
625 verify(engine, peerCerts, auth);
626 return CertificateVerifier.X509_V_OK;
627 } catch (Throwable cause) {
628 logger.debug("verification of certificate failed", cause);
629 SSLHandshakeException e = new SSLHandshakeException("General OpenSslEngine problem");
630 e.initCause(cause);
631 engine.handshakeException = e;
632
633
634 if (cause instanceof OpenSslCertificateException) {
635
636
637 return ((OpenSslCertificateException) cause).errorCode();
638 }
639 if (cause instanceof CertificateExpiredException) {
640 return CertificateVerifier.X509_V_ERR_CERT_HAS_EXPIRED;
641 }
642 if (cause instanceof CertificateNotYetValidException) {
643 return CertificateVerifier.X509_V_ERR_CERT_NOT_YET_VALID;
644 }
645 if (PlatformDependent.javaVersion() >= 7) {
646 if (cause instanceof CertificateRevokedException) {
647 return CertificateVerifier.X509_V_ERR_CERT_REVOKED;
648 }
649
650
651
652
653 Throwable wrapped = cause.getCause();
654 while (wrapped != null) {
655 if (wrapped instanceof CertPathValidatorException) {
656 CertPathValidatorException ex = (CertPathValidatorException) wrapped;
657 CertPathValidatorException.Reason reason = ex.getReason();
658 if (reason == CertPathValidatorException.BasicReason.EXPIRED) {
659 return CertificateVerifier.X509_V_ERR_CERT_HAS_EXPIRED;
660 }
661 if (reason == CertPathValidatorException.BasicReason.NOT_YET_VALID) {
662 return CertificateVerifier.X509_V_ERR_CERT_NOT_YET_VALID;
663 }
664 if (reason == CertPathValidatorException.BasicReason.REVOKED) {
665 return CertificateVerifier.X509_V_ERR_CERT_REVOKED;
666 }
667 }
668 wrapped = wrapped.getCause();
669 }
670 }
671
672
673 return CertificateVerifier.X509_V_ERR_UNSPECIFIED;
674 }
675 }
676
677 abstract void verify(ReferenceCountedOpenSslEngine engine, X509Certificate[] peerCerts,
678 String auth) throws Exception;
679 }
680
681 private static final class DefaultOpenSslEngineMap implements OpenSslEngineMap {
682 private final Map<Long, ReferenceCountedOpenSslEngine> engines = PlatformDependent.newConcurrentHashMap();
683
684 @Override
685 public ReferenceCountedOpenSslEngine remove(long ssl) {
686 return engines.remove(ssl);
687 }
688
689 @Override
690 public void add(ReferenceCountedOpenSslEngine engine) {
691 engines.put(engine.sslPointer(), engine);
692 }
693
694 @Override
695 public ReferenceCountedOpenSslEngine get(long ssl) {
696 return engines.get(ssl);
697 }
698 }
699
700 static void setKeyMaterial(long ctx, X509Certificate[] keyCertChain, PrivateKey key, String keyPassword)
701 throws SSLException {
702
703 long keyBio = 0;
704 long keyCertChainBio = 0;
705 long keyCertChainBio2 = 0;
706 PemEncoded encoded = null;
707 try {
708
709 encoded = PemX509Certificate.toPEM(ByteBufAllocator.DEFAULT, true, keyCertChain);
710 keyCertChainBio = toBIO(ByteBufAllocator.DEFAULT, encoded.retain());
711 keyCertChainBio2 = toBIO(ByteBufAllocator.DEFAULT, encoded.retain());
712
713 if (key != null) {
714 keyBio = toBIO(ByteBufAllocator.DEFAULT, key);
715 }
716
717 SSLContext.setCertificateBio(
718 ctx, keyCertChainBio, keyBio,
719 keyPassword == null ? StringUtil.EMPTY_STRING : keyPassword);
720
721 SSLContext.setCertificateChainBio(ctx, keyCertChainBio2, true);
722 } catch (SSLException e) {
723 throw e;
724 } catch (Exception e) {
725 throw new SSLException("failed to set certificate and key", e);
726 } finally {
727 freeBio(keyBio);
728 freeBio(keyCertChainBio);
729 freeBio(keyCertChainBio2);
730 if (encoded != null) {
731 encoded.release();
732 }
733 }
734 }
735
736 static void freeBio(long bio) {
737 if (bio != 0) {
738 SSL.freeBIO(bio);
739 }
740 }
741
742
743
744
745
746 static long toBIO(ByteBufAllocator allocator, PrivateKey key) throws Exception {
747 if (key == null) {
748 return 0;
749 }
750
751 PemEncoded pem = PemPrivateKey.toPEM(allocator, true, key);
752 try {
753 return toBIO(allocator, pem.retain());
754 } finally {
755 pem.release();
756 }
757 }
758
759
760
761
762
763 static long toBIO(ByteBufAllocator allocator, X509Certificate... certChain) throws Exception {
764 if (certChain == null) {
765 return 0;
766 }
767
768 if (certChain.length == 0) {
769 throw new IllegalArgumentException("certChain can't be empty");
770 }
771
772 PemEncoded pem = PemX509Certificate.toPEM(allocator, true, certChain);
773 try {
774 return toBIO(allocator, pem.retain());
775 } finally {
776 pem.release();
777 }
778 }
779
780 static long toBIO(ByteBufAllocator allocator, PemEncoded pem) throws Exception {
781 try {
782
783
784 ByteBuf content = pem.content();
785
786 if (content.isDirect()) {
787 return newBIO(content.retainedSlice());
788 }
789
790 ByteBuf buffer = allocator.directBuffer(content.readableBytes());
791 try {
792 buffer.writeBytes(content, content.readerIndex(), content.readableBytes());
793 return newBIO(buffer.retainedSlice());
794 } finally {
795 try {
796
797
798 if (pem.isSensitive()) {
799 SslUtils.zeroout(buffer);
800 }
801 } finally {
802 buffer.release();
803 }
804 }
805 } finally {
806 pem.release();
807 }
808 }
809
810 private static long newBIO(ByteBuf buffer) throws Exception {
811 try {
812 long bio = SSL.newMemBIO();
813 int readable = buffer.readableBytes();
814 if (SSL.bioWrite(bio, OpenSsl.memoryAddress(buffer) + buffer.readerIndex(), readable) != readable) {
815 SSL.freeBIO(bio);
816 throw new IllegalStateException("Could not write data to memory BIO");
817 }
818 return bio;
819 } finally {
820 buffer.release();
821 }
822 }
823
824
825
826
827
828
829 static OpenSslKeyMaterialProvider providerFor(KeyManagerFactory factory, String password) {
830 if (factory instanceof OpenSslX509KeyManagerFactory) {
831 return ((OpenSslX509KeyManagerFactory) factory).newProvider();
832 }
833
834 X509KeyManager keyManager = chooseX509KeyManager(factory.getKeyManagers());
835 if (factory instanceof OpenSslCachingX509KeyManagerFactory) {
836
837 return new OpenSslCachingKeyMaterialProvider(keyManager, password);
838 }
839
840 return new OpenSslKeyMaterialProvider(keyManager, password);
841 }
842 }