1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16 package io.netty.handler.ssl;
17
18 import io.netty.buffer.ByteBufAllocator;
19 import io.netty.internal.tcnative.CertificateCallback;
20 import io.netty.internal.tcnative.SSL;
21 import io.netty.internal.tcnative.SSLContext;
22 import io.netty.internal.tcnative.SniHostNameMatcher;
23 import io.netty.util.CharsetUtil;
24 import io.netty.util.internal.PlatformDependent;
25 import io.netty.util.internal.SuppressJava6Requirement;
26 import io.netty.util.internal.logging.InternalLogger;
27 import io.netty.util.internal.logging.InternalLoggerFactory;
28
29 import java.security.KeyStore;
30 import java.security.PrivateKey;
31 import java.security.cert.X509Certificate;
32 import java.util.Map;
33 import javax.net.ssl.KeyManagerFactory;
34 import javax.net.ssl.SSLException;
35 import javax.net.ssl.TrustManagerFactory;
36 import javax.net.ssl.X509ExtendedTrustManager;
37 import javax.net.ssl.X509TrustManager;
38
39 import static io.netty.util.internal.ObjectUtil.checkNotNull;
40
41
42
43
44
45
46
47
48
49 public final class ReferenceCountedOpenSslServerContext extends ReferenceCountedOpenSslContext {
50 private static final InternalLogger logger =
51 InternalLoggerFactory.getInstance(ReferenceCountedOpenSslServerContext.class);
52 private static final byte[] ID = {'n', 'e', 't', 't', 'y'};
53 private final OpenSslServerSessionContext sessionContext;
54
55 ReferenceCountedOpenSslServerContext(
56 X509Certificate[] trustCertCollection, TrustManagerFactory trustManagerFactory,
57 X509Certificate[] keyCertChain, PrivateKey key, String keyPassword, KeyManagerFactory keyManagerFactory,
58 Iterable<String> ciphers, CipherSuiteFilter cipherFilter, ApplicationProtocolConfig apn,
59 long sessionCacheSize, long sessionTimeout, ClientAuth clientAuth, String[] protocols, boolean startTls,
60 boolean enableOcsp, String keyStore, ResumptionController resumptionController,
61 Map.Entry<SslContextOption<?>, Object>... options) throws SSLException {
62 this(trustCertCollection, trustManagerFactory, keyCertChain, key, keyPassword, keyManagerFactory, ciphers,
63 cipherFilter, toNegotiator(apn), sessionCacheSize, sessionTimeout, clientAuth, protocols, startTls,
64 enableOcsp, keyStore, resumptionController, options);
65 }
66
67 ReferenceCountedOpenSslServerContext(
68 X509Certificate[] trustCertCollection, TrustManagerFactory trustManagerFactory,
69 X509Certificate[] keyCertChain, PrivateKey key, String keyPassword, KeyManagerFactory keyManagerFactory,
70 Iterable<String> ciphers, CipherSuiteFilter cipherFilter, OpenSslApplicationProtocolNegotiator apn,
71 long sessionCacheSize, long sessionTimeout, ClientAuth clientAuth, String[] protocols, boolean startTls,
72 boolean enableOcsp, String keyStore, ResumptionController resumptionController,
73 Map.Entry<SslContextOption<?>, Object>... options) throws SSLException {
74 super(ciphers, cipherFilter, apn, SSL.SSL_MODE_SERVER, keyCertChain,
75 clientAuth, protocols, startTls,
76 null,
77 enableOcsp, true, resumptionController, options);
78
79 boolean success = false;
80 try {
81 sessionContext = newSessionContext(this, ctx, engineMap, trustCertCollection, trustManagerFactory,
82 keyCertChain, key, keyPassword, keyManagerFactory, keyStore,
83 sessionCacheSize, sessionTimeout, resumptionController);
84 if (SERVER_ENABLE_SESSION_TICKET) {
85 sessionContext.setTicketKeys();
86 }
87 success = true;
88 } finally {
89 if (!success) {
90 release();
91 }
92 }
93 }
94
95 @Override
96 public OpenSslServerSessionContext sessionContext() {
97 return sessionContext;
98 }
99
100 static OpenSslServerSessionContext newSessionContext(ReferenceCountedOpenSslContext thiz, long ctx,
101 OpenSslEngineMap engineMap,
102 X509Certificate[] trustCertCollection,
103 TrustManagerFactory trustManagerFactory,
104 X509Certificate[] keyCertChain, PrivateKey key,
105 String keyPassword, KeyManagerFactory keyManagerFactory,
106 String keyStore, long sessionCacheSize, long sessionTimeout,
107 ResumptionController resumptionController)
108 throws SSLException {
109 OpenSslKeyMaterialProvider keyMaterialProvider = null;
110 try {
111 try {
112 SSLContext.setVerify(ctx, SSL.SSL_CVERIFY_NONE, VERIFY_DEPTH);
113 if (!OpenSsl.useKeyManagerFactory()) {
114 if (keyManagerFactory != null) {
115 throw new IllegalArgumentException(
116 "KeyManagerFactory not supported");
117 }
118 checkNotNull(keyCertChain, "keyCertChain");
119
120 setKeyMaterial(ctx, keyCertChain, key, keyPassword);
121 } else {
122
123
124 if (keyManagerFactory == null) {
125 char[] keyPasswordChars = keyStorePassword(keyPassword);
126 KeyStore ks = buildKeyStore(keyCertChain, key, keyPasswordChars, keyStore);
127 if (ks.aliases().hasMoreElements()) {
128 keyManagerFactory = new OpenSslX509KeyManagerFactory();
129 } else {
130 keyManagerFactory = new OpenSslCachingX509KeyManagerFactory(
131 KeyManagerFactory.getInstance(KeyManagerFactory.getDefaultAlgorithm()));
132 }
133 keyManagerFactory.init(ks, keyPasswordChars);
134 }
135 keyMaterialProvider = providerFor(keyManagerFactory, keyPassword);
136
137 SSLContext.setCertificateCallback(ctx, new OpenSslServerCertificateCallback(
138 engineMap, new OpenSslKeyMaterialManager(keyMaterialProvider)));
139 }
140 } catch (Exception e) {
141 throw new SSLException("failed to set certificate and key", e);
142 }
143 try {
144 if (trustCertCollection != null) {
145 trustManagerFactory = buildTrustManagerFactory(trustCertCollection, trustManagerFactory, keyStore);
146 } else if (trustManagerFactory == null) {
147
148 trustManagerFactory = TrustManagerFactory.getInstance(
149 TrustManagerFactory.getDefaultAlgorithm());
150 trustManagerFactory.init((KeyStore) null);
151 }
152
153 final X509TrustManager manager = chooseTrustManager(
154 trustManagerFactory.getTrustManagers(), resumptionController);
155
156
157
158
159
160
161
162 setVerifyCallback(ctx, engineMap, manager);
163
164 X509Certificate[] issuers = manager.getAcceptedIssuers();
165 if (issuers != null && issuers.length > 0) {
166 long bio = 0;
167 try {
168 bio = toBIO(ByteBufAllocator.DEFAULT, issuers);
169 if (!SSLContext.setCACertificateBio(ctx, bio)) {
170 throw new SSLException("unable to setup accepted issuers for trustmanager " + manager);
171 }
172 } finally {
173 freeBio(bio);
174 }
175 }
176
177 if (PlatformDependent.javaVersion() >= 8) {
178
179
180
181
182 SSLContext.setSniHostnameMatcher(ctx, new OpenSslSniHostnameMatcher(engineMap));
183 }
184 } catch (SSLException e) {
185 throw e;
186 } catch (Exception e) {
187 throw new SSLException("unable to setup trustmanager", e);
188 }
189
190 OpenSslServerSessionContext sessionContext = new OpenSslServerSessionContext(thiz, keyMaterialProvider);
191 sessionContext.setSessionIdContext(ID);
192
193 sessionContext.setSessionCacheEnabled(SERVER_ENABLE_SESSION_CACHE);
194 if (sessionCacheSize > 0) {
195 sessionContext.setSessionCacheSize((int) Math.min(sessionCacheSize, Integer.MAX_VALUE));
196 }
197 if (sessionTimeout > 0) {
198 sessionContext.setSessionTimeout((int) Math.min(sessionTimeout, Integer.MAX_VALUE));
199 }
200
201 keyMaterialProvider = null;
202
203 return sessionContext;
204 } finally {
205 if (keyMaterialProvider != null) {
206 keyMaterialProvider.destroy();
207 }
208 }
209 }
210
211 @SuppressJava6Requirement(reason = "Guarded by java version check")
212 private static void setVerifyCallback(long ctx, OpenSslEngineMap engineMap, X509TrustManager manager) {
213
214 if (useExtendedTrustManager(manager)) {
215 SSLContext.setCertVerifyCallback(ctx, new ExtendedTrustManagerVerifyCallback(
216 engineMap, (X509ExtendedTrustManager) manager));
217 } else {
218 SSLContext.setCertVerifyCallback(ctx, new TrustManagerVerifyCallback(engineMap, manager));
219 }
220 }
221
222 private static final class OpenSslServerCertificateCallback implements CertificateCallback {
223 private final OpenSslEngineMap engineMap;
224 private final OpenSslKeyMaterialManager keyManagerHolder;
225
226 OpenSslServerCertificateCallback(OpenSslEngineMap engineMap, OpenSslKeyMaterialManager keyManagerHolder) {
227 this.engineMap = engineMap;
228 this.keyManagerHolder = keyManagerHolder;
229 }
230
231 @Override
232 public void handle(long ssl, byte[] keyTypeBytes, byte[][] asn1DerEncodedPrincipals) throws Exception {
233 final ReferenceCountedOpenSslEngine engine = engineMap.get(ssl);
234 if (engine == null) {
235
236 return;
237 }
238 try {
239
240
241 keyManagerHolder.setKeyMaterialServerSide(engine);
242 } catch (Throwable cause) {
243 engine.initHandshakeException(cause);
244
245 if (cause instanceof Exception) {
246 throw (Exception) cause;
247 }
248 throw new SSLException(cause);
249 }
250 }
251 }
252
253 private static final class TrustManagerVerifyCallback extends AbstractCertificateVerifier {
254 private final X509TrustManager manager;
255
256 TrustManagerVerifyCallback(OpenSslEngineMap engineMap, X509TrustManager manager) {
257 super(engineMap);
258 this.manager = manager;
259 }
260
261 @Override
262 void verify(ReferenceCountedOpenSslEngine engine, X509Certificate[] peerCerts, String auth)
263 throws Exception {
264 manager.checkClientTrusted(peerCerts, auth);
265 }
266 }
267
268 @SuppressJava6Requirement(reason = "Usage guarded by java version check")
269 private static final class ExtendedTrustManagerVerifyCallback extends AbstractCertificateVerifier {
270 private final X509ExtendedTrustManager manager;
271
272 ExtendedTrustManagerVerifyCallback(OpenSslEngineMap engineMap, X509ExtendedTrustManager manager) {
273 super(engineMap);
274 this.manager = manager;
275 }
276
277 @Override
278 void verify(ReferenceCountedOpenSslEngine engine, X509Certificate[] peerCerts, String auth)
279 throws Exception {
280 manager.checkClientTrusted(peerCerts, auth, engine);
281 }
282 }
283
284 private static final class OpenSslSniHostnameMatcher implements SniHostNameMatcher {
285 private final OpenSslEngineMap engineMap;
286
287 OpenSslSniHostnameMatcher(OpenSslEngineMap engineMap) {
288 this.engineMap = engineMap;
289 }
290
291 @Override
292 public boolean match(long ssl, String hostname) {
293 ReferenceCountedOpenSslEngine engine = engineMap.get(ssl);
294 if (engine != null) {
295
296 return engine.checkSniHostnameMatch(hostname.getBytes(CharsetUtil.UTF_8));
297 }
298 logger.warn("No ReferenceCountedOpenSslEngine found for SSL pointer: {}", ssl);
299 return false;
300 }
301 }
302 }