1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16 package io.netty.handler.ssl;
17
18 import io.netty.buffer.ByteBufAllocator;
19 import io.netty.internal.tcnative.CertificateCallback;
20 import io.netty.internal.tcnative.SSL;
21 import io.netty.internal.tcnative.SSLContext;
22 import io.netty.internal.tcnative.SniHostNameMatcher;
23 import io.netty.util.CharsetUtil;
24 import io.netty.util.internal.PlatformDependent;
25 import io.netty.util.internal.SuppressJava6Requirement;
26 import io.netty.util.internal.logging.InternalLogger;
27 import io.netty.util.internal.logging.InternalLoggerFactory;
28
29 import java.security.KeyStore;
30 import java.security.PrivateKey;
31 import java.security.cert.X509Certificate;
32 import java.util.Map;
33 import javax.net.ssl.KeyManagerFactory;
34 import javax.net.ssl.SSLException;
35 import javax.net.ssl.TrustManagerFactory;
36 import javax.net.ssl.X509ExtendedTrustManager;
37 import javax.net.ssl.X509TrustManager;
38
39 import static io.netty.util.internal.ObjectUtil.checkNotNull;
40
41
42
43
44
45
46
47
48
49 public final class ReferenceCountedOpenSslServerContext extends ReferenceCountedOpenSslContext {
50 private static final InternalLogger logger =
51 InternalLoggerFactory.getInstance(ReferenceCountedOpenSslServerContext.class);
52 private static final byte[] ID = {'n', 'e', 't', 't', 'y'};
53 private final OpenSslServerSessionContext sessionContext;
54
55 ReferenceCountedOpenSslServerContext(
56 X509Certificate[] trustCertCollection, TrustManagerFactory trustManagerFactory,
57 X509Certificate[] keyCertChain, PrivateKey key, String keyPassword, KeyManagerFactory keyManagerFactory,
58 Iterable<String> ciphers, CipherSuiteFilter cipherFilter, ApplicationProtocolConfig apn,
59 long sessionCacheSize, long sessionTimeout, ClientAuth clientAuth, String[] protocols, boolean startTls,
60 boolean enableOcsp, String keyStore, Map.Entry<SslContextOption<?>, Object>... options)
61 throws SSLException {
62 this(trustCertCollection, trustManagerFactory, keyCertChain, key, keyPassword, keyManagerFactory, ciphers,
63 cipherFilter, toNegotiator(apn), sessionCacheSize, sessionTimeout, clientAuth, protocols, startTls,
64 enableOcsp, keyStore, options);
65 }
66
67 ReferenceCountedOpenSslServerContext(
68 X509Certificate[] trustCertCollection, TrustManagerFactory trustManagerFactory,
69 X509Certificate[] keyCertChain, PrivateKey key, String keyPassword, KeyManagerFactory keyManagerFactory,
70 Iterable<String> ciphers, CipherSuiteFilter cipherFilter, OpenSslApplicationProtocolNegotiator apn,
71 long sessionCacheSize, long sessionTimeout, ClientAuth clientAuth, String[] protocols, boolean startTls,
72 boolean enableOcsp, String keyStore, Map.Entry<SslContextOption<?>, Object>... options)
73 throws SSLException {
74 super(ciphers, cipherFilter, apn, SSL.SSL_MODE_SERVER, keyCertChain,
75 clientAuth, protocols, startTls,
76 null,
77 enableOcsp, true, options);
78
79 boolean success = false;
80 try {
81 sessionContext = newSessionContext(this, ctx, engineMap, trustCertCollection, trustManagerFactory,
82 keyCertChain, key, keyPassword, keyManagerFactory, keyStore,
83 sessionCacheSize, sessionTimeout);
84 if (SERVER_ENABLE_SESSION_TICKET) {
85 sessionContext.setTicketKeys();
86 }
87 success = true;
88 } finally {
89 if (!success) {
90 release();
91 }
92 }
93 }
94
95 @Override
96 public OpenSslServerSessionContext sessionContext() {
97 return sessionContext;
98 }
99
100 static OpenSslServerSessionContext newSessionContext(ReferenceCountedOpenSslContext thiz, long ctx,
101 OpenSslEngineMap engineMap,
102 X509Certificate[] trustCertCollection,
103 TrustManagerFactory trustManagerFactory,
104 X509Certificate[] keyCertChain, PrivateKey key,
105 String keyPassword, KeyManagerFactory keyManagerFactory,
106 String keyStore, long sessionCacheSize, long sessionTimeout)
107 throws SSLException {
108 OpenSslKeyMaterialProvider keyMaterialProvider = null;
109 try {
110 try {
111 SSLContext.setVerify(ctx, SSL.SSL_CVERIFY_NONE, VERIFY_DEPTH);
112 if (!OpenSsl.useKeyManagerFactory()) {
113 if (keyManagerFactory != null) {
114 throw new IllegalArgumentException(
115 "KeyManagerFactory not supported");
116 }
117 checkNotNull(keyCertChain, "keyCertChain");
118
119 setKeyMaterial(ctx, keyCertChain, key, keyPassword);
120 } else {
121
122
123 if (keyManagerFactory == null) {
124 char[] keyPasswordChars = keyStorePassword(keyPassword);
125 KeyStore ks = buildKeyStore(keyCertChain, key, keyPasswordChars, keyStore);
126 if (ks.aliases().hasMoreElements()) {
127 keyManagerFactory = new OpenSslX509KeyManagerFactory();
128 } else {
129 keyManagerFactory = new OpenSslCachingX509KeyManagerFactory(
130 KeyManagerFactory.getInstance(KeyManagerFactory.getDefaultAlgorithm()));
131 }
132 keyManagerFactory.init(ks, keyPasswordChars);
133 }
134 keyMaterialProvider = providerFor(keyManagerFactory, keyPassword);
135
136 SSLContext.setCertificateCallback(ctx, new OpenSslServerCertificateCallback(
137 engineMap, new OpenSslKeyMaterialManager(keyMaterialProvider)));
138 }
139 } catch (Exception e) {
140 throw new SSLException("failed to set certificate and key", e);
141 }
142 try {
143 if (trustCertCollection != null) {
144 trustManagerFactory = buildTrustManagerFactory(trustCertCollection, trustManagerFactory, keyStore);
145 } else if (trustManagerFactory == null) {
146
147 trustManagerFactory = TrustManagerFactory.getInstance(
148 TrustManagerFactory.getDefaultAlgorithm());
149 trustManagerFactory.init((KeyStore) null);
150 }
151
152 final X509TrustManager manager = chooseTrustManager(trustManagerFactory.getTrustManagers());
153
154
155
156
157
158
159
160 setVerifyCallback(ctx, engineMap, manager);
161
162 X509Certificate[] issuers = manager.getAcceptedIssuers();
163 if (issuers != null && issuers.length > 0) {
164 long bio = 0;
165 try {
166 bio = toBIO(ByteBufAllocator.DEFAULT, issuers);
167 if (!SSLContext.setCACertificateBio(ctx, bio)) {
168 throw new SSLException("unable to setup accepted issuers for trustmanager " + manager);
169 }
170 } finally {
171 freeBio(bio);
172 }
173 }
174
175 if (PlatformDependent.javaVersion() >= 8) {
176
177
178
179
180 SSLContext.setSniHostnameMatcher(ctx, new OpenSslSniHostnameMatcher(engineMap));
181 }
182 } catch (SSLException e) {
183 throw e;
184 } catch (Exception e) {
185 throw new SSLException("unable to setup trustmanager", e);
186 }
187
188 OpenSslServerSessionContext sessionContext = new OpenSslServerSessionContext(thiz, keyMaterialProvider);
189 sessionContext.setSessionIdContext(ID);
190
191 sessionContext.setSessionCacheEnabled(SERVER_ENABLE_SESSION_CACHE);
192 if (sessionCacheSize > 0) {
193 sessionContext.setSessionCacheSize((int) Math.min(sessionCacheSize, Integer.MAX_VALUE));
194 }
195 if (sessionTimeout > 0) {
196 sessionContext.setSessionTimeout((int) Math.min(sessionTimeout, Integer.MAX_VALUE));
197 }
198
199 keyMaterialProvider = null;
200
201 return sessionContext;
202 } finally {
203 if (keyMaterialProvider != null) {
204 keyMaterialProvider.destroy();
205 }
206 }
207 }
208
209 @SuppressJava6Requirement(reason = "Guarded by java version check")
210 private static void setVerifyCallback(long ctx, OpenSslEngineMap engineMap, X509TrustManager manager) {
211
212 if (useExtendedTrustManager(manager)) {
213 SSLContext.setCertVerifyCallback(ctx, new ExtendedTrustManagerVerifyCallback(
214 engineMap, (X509ExtendedTrustManager) manager));
215 } else {
216 SSLContext.setCertVerifyCallback(ctx, new TrustManagerVerifyCallback(engineMap, manager));
217 }
218 }
219
220 private static final class OpenSslServerCertificateCallback implements CertificateCallback {
221 private final OpenSslEngineMap engineMap;
222 private final OpenSslKeyMaterialManager keyManagerHolder;
223
224 OpenSslServerCertificateCallback(OpenSslEngineMap engineMap, OpenSslKeyMaterialManager keyManagerHolder) {
225 this.engineMap = engineMap;
226 this.keyManagerHolder = keyManagerHolder;
227 }
228
229 @Override
230 public void handle(long ssl, byte[] keyTypeBytes, byte[][] asn1DerEncodedPrincipals) throws Exception {
231 final ReferenceCountedOpenSslEngine engine = engineMap.get(ssl);
232 if (engine == null) {
233
234 return;
235 }
236 try {
237
238
239 keyManagerHolder.setKeyMaterialServerSide(engine);
240 } catch (Throwable cause) {
241 engine.initHandshakeException(cause);
242
243 if (cause instanceof Exception) {
244 throw (Exception) cause;
245 }
246 throw new SSLException(cause);
247 }
248 }
249 }
250
251 private static final class TrustManagerVerifyCallback extends AbstractCertificateVerifier {
252 private final X509TrustManager manager;
253
254 TrustManagerVerifyCallback(OpenSslEngineMap engineMap, X509TrustManager manager) {
255 super(engineMap);
256 this.manager = manager;
257 }
258
259 @Override
260 void verify(ReferenceCountedOpenSslEngine engine, X509Certificate[] peerCerts, String auth)
261 throws Exception {
262 manager.checkClientTrusted(peerCerts, auth);
263 }
264 }
265
266 @SuppressJava6Requirement(reason = "Usage guarded by java version check")
267 private static final class ExtendedTrustManagerVerifyCallback extends AbstractCertificateVerifier {
268 private final X509ExtendedTrustManager manager;
269
270 ExtendedTrustManagerVerifyCallback(OpenSslEngineMap engineMap, X509ExtendedTrustManager manager) {
271 super(engineMap);
272 this.manager = manager;
273 }
274
275 @Override
276 void verify(ReferenceCountedOpenSslEngine engine, X509Certificate[] peerCerts, String auth)
277 throws Exception {
278 manager.checkClientTrusted(peerCerts, auth, engine);
279 }
280 }
281
282 private static final class OpenSslSniHostnameMatcher implements SniHostNameMatcher {
283 private final OpenSslEngineMap engineMap;
284
285 OpenSslSniHostnameMatcher(OpenSslEngineMap engineMap) {
286 this.engineMap = engineMap;
287 }
288
289 @Override
290 public boolean match(long ssl, String hostname) {
291 ReferenceCountedOpenSslEngine engine = engineMap.get(ssl);
292 if (engine != null) {
293
294 return engine.checkSniHostnameMatch(hostname.getBytes(CharsetUtil.UTF_8));
295 }
296 logger.warn("No ReferenceCountedOpenSslEngine found for SSL pointer: {}", ssl);
297 return false;
298 }
299 }
300 }