1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16 package io.netty.handler.ssl;
17
18 import io.netty.internal.tcnative.CertificateCallback;
19 import io.netty.internal.tcnative.SSL;
20 import io.netty.internal.tcnative.SSLContext;
21 import io.netty.util.internal.EmptyArrays;
22
23 import javax.net.ssl.KeyManagerFactory;
24 import javax.net.ssl.SNIServerName;
25 import javax.net.ssl.SSLException;
26 import javax.net.ssl.TrustManagerFactory;
27 import javax.net.ssl.X509ExtendedTrustManager;
28 import javax.net.ssl.X509TrustManager;
29 import javax.security.auth.x500.X500Principal;
30 import java.security.KeyStore;
31 import java.security.PrivateKey;
32 import java.security.cert.X509Certificate;
33 import java.util.HashSet;
34 import java.util.List;
35 import java.util.Map;
36 import java.util.Set;
37
38
39
40
41
42
43
44
45
46 public final class ReferenceCountedOpenSslClientContext extends ReferenceCountedOpenSslContext {
47
48 private static final String[] SUPPORTED_KEY_TYPES = {
49 OpenSslKeyMaterialManager.KEY_TYPE_RSA,
50 OpenSslKeyMaterialManager.KEY_TYPE_DH_RSA,
51 OpenSslKeyMaterialManager.KEY_TYPE_EC,
52 OpenSslKeyMaterialManager.KEY_TYPE_EC_RSA,
53 OpenSslKeyMaterialManager.KEY_TYPE_EC_EC
54 };
55
56 private final OpenSslSessionContext sessionContext;
57
58 ReferenceCountedOpenSslClientContext(X509Certificate[] trustCertCollection, TrustManagerFactory trustManagerFactory,
59 X509Certificate[] keyCertChain, PrivateKey key, String keyPassword,
60 KeyManagerFactory keyManagerFactory, Iterable<String> ciphers,
61 CipherSuiteFilter cipherFilter, ApplicationProtocolConfig apn,
62 String[] protocols, long sessionCacheSize, long sessionTimeout,
63 boolean enableOcsp, String keyStore, String endpointIdentificationAlgorithm,
64 List<SNIServerName> serverNames, ResumptionController resumptionController,
65 Map.Entry<SslContextOption<?>, Object>... options) throws SSLException {
66 super(ciphers, cipherFilter, toNegotiator(apn), SSL.SSL_MODE_CLIENT, keyCertChain,
67 ClientAuth.NONE, protocols, false, endpointIdentificationAlgorithm, enableOcsp, true,
68 serverNames, resumptionController, options);
69 boolean success = false;
70 try {
71 sessionContext = newSessionContext(this, ctx, engineMap, trustCertCollection, trustManagerFactory,
72 keyCertChain, key, keyPassword, keyManagerFactory, keyStore,
73 sessionCacheSize, sessionTimeout, resumptionController);
74 success = true;
75 } finally {
76 if (!success) {
77 release();
78 }
79 }
80 }
81
82 @Override
83 public OpenSslSessionContext sessionContext() {
84 return sessionContext;
85 }
86
87 static OpenSslSessionContext newSessionContext(ReferenceCountedOpenSslContext thiz, long ctx,
88 OpenSslEngineMap engineMap,
89 X509Certificate[] trustCertCollection,
90 TrustManagerFactory trustManagerFactory,
91 X509Certificate[] keyCertChain, PrivateKey key,
92 String keyPassword, KeyManagerFactory keyManagerFactory,
93 String keyStore, long sessionCacheSize, long sessionTimeout,
94 ResumptionController resumptionController)
95 throws SSLException {
96 if (key == null && keyCertChain != null || key != null && keyCertChain == null) {
97 throw new IllegalArgumentException(
98 "Either both keyCertChain and key needs to be null or none of them");
99 }
100 OpenSslKeyMaterialProvider keyMaterialProvider = null;
101 try {
102 try {
103 if (!OpenSsl.useKeyManagerFactory()) {
104 if (keyManagerFactory != null) {
105 throw new IllegalArgumentException(
106 "KeyManagerFactory not supported");
107 }
108 if (keyCertChain != null) {
109 setKeyMaterial(ctx, keyCertChain, key, keyPassword);
110 }
111 } else {
112
113 if (keyManagerFactory == null && keyCertChain != null) {
114 char[] keyPasswordChars = keyStorePassword(keyPassword);
115 KeyStore ks = buildKeyStore(keyCertChain, key, keyPasswordChars, keyStore);
116 if (ks.aliases().hasMoreElements()) {
117 keyManagerFactory = new OpenSslX509KeyManagerFactory();
118 } else {
119 keyManagerFactory = new OpenSslCachingX509KeyManagerFactory(
120 KeyManagerFactory.getInstance(KeyManagerFactory.getDefaultAlgorithm()));
121 }
122 keyManagerFactory.init(ks, keyPasswordChars);
123 keyMaterialProvider = providerFor(keyManagerFactory, keyPassword);
124 } else if (keyManagerFactory != null) {
125 keyMaterialProvider = providerFor(keyManagerFactory, keyPassword);
126 }
127
128 if (keyMaterialProvider != null) {
129 OpenSslKeyMaterialManager materialManager =
130 new OpenSslKeyMaterialManager(keyMaterialProvider, thiz.hasTmpDhKeys);
131 SSLContext.setCertificateCallback(ctx, new OpenSslClientCertificateCallback(
132 engineMap, materialManager));
133 }
134 }
135 } catch (Exception e) {
136 throw new SSLException("failed to set certificate and key", e);
137 }
138
139
140
141
142
143
144
145 SSLContext.setVerify(ctx, SSL.SSL_CVERIFY_OPTIONAL, VERIFY_DEPTH);
146
147 try {
148 if (trustCertCollection != null) {
149 trustManagerFactory = buildTrustManagerFactory(trustCertCollection, trustManagerFactory, keyStore);
150 } else if (trustManagerFactory == null) {
151 trustManagerFactory = TrustManagerFactory.getInstance(
152 TrustManagerFactory.getDefaultAlgorithm());
153 trustManagerFactory.init((KeyStore) null);
154 }
155 final X509TrustManager manager = chooseTrustManager(
156 trustManagerFactory.getTrustManagers(), resumptionController);
157
158
159
160
161
162
163
164 setVerifyCallback(ctx, engineMap, manager);
165 } catch (Exception e) {
166 if (keyMaterialProvider != null) {
167 keyMaterialProvider.destroy();
168 }
169 throw new SSLException("unable to setup trustmanager", e);
170 }
171 OpenSslClientSessionContext context = new OpenSslClientSessionContext(thiz, keyMaterialProvider);
172 context.setSessionCacheEnabled(CLIENT_ENABLE_SESSION_CACHE);
173 if (sessionCacheSize > 0) {
174 context.setSessionCacheSize((int) Math.min(sessionCacheSize, Integer.MAX_VALUE));
175 }
176 if (sessionTimeout > 0) {
177 context.setSessionTimeout((int) Math.min(sessionTimeout, Integer.MAX_VALUE));
178 }
179
180 if (CLIENT_ENABLE_SESSION_TICKET) {
181 context.setTicketKeys();
182 }
183
184 keyMaterialProvider = null;
185 return context;
186 } finally {
187 if (keyMaterialProvider != null) {
188 keyMaterialProvider.destroy();
189 }
190 }
191 }
192
193 private static void setVerifyCallback(long ctx, OpenSslEngineMap engineMap, X509TrustManager manager) {
194
195 if (useExtendedTrustManager(manager)) {
196 SSLContext.setCertVerifyCallback(ctx,
197 new ExtendedTrustManagerVerifyCallback(engineMap, (X509ExtendedTrustManager) manager));
198 } else {
199 SSLContext.setCertVerifyCallback(ctx, new TrustManagerVerifyCallback(engineMap, manager));
200 }
201 }
202
203 static final class OpenSslClientSessionContext extends OpenSslSessionContext {
204 OpenSslClientSessionContext(ReferenceCountedOpenSslContext context, OpenSslKeyMaterialProvider provider) {
205 super(context, provider, SSL.SSL_SESS_CACHE_CLIENT, new OpenSslClientSessionCache(context.engineMap));
206 }
207 }
208
209 private static final class TrustManagerVerifyCallback extends AbstractCertificateVerifier {
210 private final X509TrustManager manager;
211
212 TrustManagerVerifyCallback(OpenSslEngineMap engineMap, X509TrustManager manager) {
213 super(engineMap);
214 this.manager = manager;
215 }
216
217 @Override
218 void verify(ReferenceCountedOpenSslEngine engine, X509Certificate[] peerCerts, String auth)
219 throws Exception {
220 manager.checkServerTrusted(peerCerts, auth);
221 }
222 }
223
224 private static final class ExtendedTrustManagerVerifyCallback extends AbstractCertificateVerifier {
225 private final X509ExtendedTrustManager manager;
226
227 ExtendedTrustManagerVerifyCallback(OpenSslEngineMap engineMap, X509ExtendedTrustManager manager) {
228 super(engineMap);
229 this.manager = manager;
230 }
231
232 @Override
233 void verify(ReferenceCountedOpenSslEngine engine, X509Certificate[] peerCerts, String auth)
234 throws Exception {
235 manager.checkServerTrusted(peerCerts, auth, engine);
236 }
237 }
238
239 private static final class OpenSslClientCertificateCallback implements CertificateCallback {
240 private final OpenSslEngineMap engineMap;
241 private final OpenSslKeyMaterialManager keyManagerHolder;
242
243 OpenSslClientCertificateCallback(OpenSslEngineMap engineMap, OpenSslKeyMaterialManager keyManagerHolder) {
244 this.engineMap = engineMap;
245 this.keyManagerHolder = keyManagerHolder;
246 }
247
248 @Override
249 public void handle(long ssl, byte[] keyTypeBytes, byte[][] asn1DerEncodedPrincipals) throws Exception {
250 final ReferenceCountedOpenSslEngine engine = engineMap.get(ssl);
251
252 if (engine == null) {
253 return;
254 }
255 try {
256 final String[] keyTypes = supportedClientKeyTypes(keyTypeBytes);
257 final X500Principal[] issuers;
258 if (asn1DerEncodedPrincipals == null) {
259 issuers = null;
260 } else {
261 issuers = new X500Principal[asn1DerEncodedPrincipals.length];
262 for (int i = 0; i < asn1DerEncodedPrincipals.length; i++) {
263 issuers[i] = new X500Principal(asn1DerEncodedPrincipals[i]);
264 }
265 }
266 keyManagerHolder.setKeyMaterialClientSide(engine, keyTypes, issuers);
267 } catch (Throwable cause) {
268 engine.initHandshakeException(cause);
269 if (cause instanceof Exception) {
270 throw (Exception) cause;
271 }
272 throw new SSLException(cause);
273 }
274 }
275
276
277
278
279
280
281
282
283
284 private static String[] supportedClientKeyTypes(byte[] clientCertificateTypes) {
285 if (clientCertificateTypes == null) {
286
287 return SUPPORTED_KEY_TYPES.clone();
288 }
289 Set<String> result = new HashSet<>(clientCertificateTypes.length);
290 for (byte keyTypeCode : clientCertificateTypes) {
291 String keyType = clientKeyType(keyTypeCode);
292 if (keyType == null) {
293
294 continue;
295 }
296 result.add(keyType);
297 }
298 return result.toArray(EmptyArrays.EMPTY_STRINGS);
299 }
300
301 private static String clientKeyType(byte clientCertificateType) {
302
303 switch (clientCertificateType) {
304 case CertificateCallback.TLS_CT_RSA_SIGN:
305 return OpenSslKeyMaterialManager.KEY_TYPE_RSA;
306 case CertificateCallback.TLS_CT_RSA_FIXED_DH:
307 return OpenSslKeyMaterialManager.KEY_TYPE_DH_RSA;
308 case CertificateCallback.TLS_CT_ECDSA_SIGN:
309 return OpenSslKeyMaterialManager.KEY_TYPE_EC;
310 case CertificateCallback.TLS_CT_RSA_FIXED_ECDH:
311 return OpenSslKeyMaterialManager.KEY_TYPE_EC_RSA;
312 case CertificateCallback.TLS_CT_ECDSA_FIXED_ECDH:
313 return OpenSslKeyMaterialManager.KEY_TYPE_EC_EC;
314 default:
315 return null;
316 }
317 }
318 }
319 }