View Javadoc
1   /*
2    * Copyright 2017 The Netty Project
3    *
4    * The Netty Project licenses this file to you under the Apache License,
5    * version 2.0 (the "License"); you may not use this file except in compliance
6    * with the License. You may obtain a copy of the License at:
7    *
8    *   http://www.apache.org/licenses/LICENSE-2.0
9    *
10   * Unless required by applicable law or agreed to in writing, software
11   * distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
12   * WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the
13   * License for the specific language governing permissions and limitations
14   * under the License.
15   */
16  package io.netty.handler.ssl.ocsp;
17  
18  import io.netty.channel.ChannelHandlerContext;
19  import io.netty.channel.ChannelInboundHandlerAdapter;
20  import io.netty.handler.ssl.ReferenceCountedOpenSslContext;
21  import io.netty.handler.ssl.ReferenceCountedOpenSslEngine;
22  import io.netty.handler.ssl.SslHandshakeCompletionEvent;
23  import io.netty.util.internal.ObjectUtil;
24  import io.netty.util.internal.UnstableApi;
25  
26  import javax.net.ssl.SSLHandshakeException;
27  
28  /**
29   * A handler for SSL clients to handle and act upon stapled OCSP responses.
30   *
31   * @see ReferenceCountedOpenSslContext#enableOcsp()
32   * @see ReferenceCountedOpenSslEngine#getOcspResponse()
33   */
34  @UnstableApi
35  public abstract class OcspClientHandler extends ChannelInboundHandlerAdapter {
36  
37      private final ReferenceCountedOpenSslEngine engine;
38  
39      protected OcspClientHandler(ReferenceCountedOpenSslEngine engine) {
40          this.engine = ObjectUtil.checkNotNull(engine, "engine");
41      }
42  
43      /**
44       * @see ReferenceCountedOpenSslEngine#getOcspResponse()
45       */
46      protected abstract boolean verify(ChannelHandlerContext ctx, ReferenceCountedOpenSslEngine engine) throws Exception;
47  
48      @Override
49      public void userEventTriggered(ChannelHandlerContext ctx, Object evt) throws Exception {
50          if (evt instanceof SslHandshakeCompletionEvent) {
51              ctx.pipeline().remove(this);
52  
53              SslHandshakeCompletionEvent event = (SslHandshakeCompletionEvent) evt;
54              if (event.isSuccess() && !verify(ctx, engine)) {
55                  throw new SSLHandshakeException("Bad OCSP response");
56              }
57          }
58  
59          ctx.fireUserEventTriggered(evt);
60      }
61  }