1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16 package io.netty.handler.ssl;
17
18 import io.netty.buffer.ByteBufAllocator;
19 import io.netty.internal.tcnative.CertificateCallback;
20 import io.netty.internal.tcnative.SSL;
21 import io.netty.internal.tcnative.SSLContext;
22 import io.netty.internal.tcnative.SniHostNameMatcher;
23 import io.netty.util.CharsetUtil;
24 import io.netty.util.internal.logging.InternalLogger;
25 import io.netty.util.internal.logging.InternalLoggerFactory;
26
27 import java.security.KeyStore;
28 import java.security.PrivateKey;
29 import java.security.cert.X509Certificate;
30 import java.util.Map;
31 import javax.net.ssl.KeyManagerFactory;
32 import javax.net.ssl.SSLException;
33 import javax.net.ssl.TrustManagerFactory;
34 import javax.net.ssl.X509ExtendedTrustManager;
35 import javax.net.ssl.X509TrustManager;
36
37 import static io.netty.util.internal.ObjectUtil.checkNotNull;
38
39
40
41
42
43
44
45
46
47 public final class ReferenceCountedOpenSslServerContext extends ReferenceCountedOpenSslContext {
48 private static final InternalLogger logger =
49 InternalLoggerFactory.getInstance(ReferenceCountedOpenSslServerContext.class);
50 private static final byte[] ID = {'n', 'e', 't', 't', 'y'};
51 private final OpenSslServerSessionContext sessionContext;
52
53 ReferenceCountedOpenSslServerContext(
54 X509Certificate[] trustCertCollection, TrustManagerFactory trustManagerFactory,
55 X509Certificate[] keyCertChain, PrivateKey key, String keyPassword, KeyManagerFactory keyManagerFactory,
56 Iterable<String> ciphers, CipherSuiteFilter cipherFilter, ApplicationProtocolConfig apn,
57 long sessionCacheSize, long sessionTimeout, ClientAuth clientAuth, String[] protocols, boolean startTls,
58 boolean enableOcsp, String keyStore, Map.Entry<SslContextOption<?>, Object>... options)
59 throws SSLException {
60 this(trustCertCollection, trustManagerFactory, keyCertChain, key, keyPassword, keyManagerFactory, ciphers,
61 cipherFilter, toNegotiator(apn), sessionCacheSize, sessionTimeout, clientAuth, protocols, startTls,
62 enableOcsp, keyStore, options);
63 }
64
65 ReferenceCountedOpenSslServerContext(
66 X509Certificate[] trustCertCollection, TrustManagerFactory trustManagerFactory,
67 X509Certificate[] keyCertChain, PrivateKey key, String keyPassword, KeyManagerFactory keyManagerFactory,
68 Iterable<String> ciphers, CipherSuiteFilter cipherFilter, OpenSslApplicationProtocolNegotiator apn,
69 long sessionCacheSize, long sessionTimeout, ClientAuth clientAuth, String[] protocols, boolean startTls,
70 boolean enableOcsp, String keyStore, Map.Entry<SslContextOption<?>, Object>... options)
71 throws SSLException {
72 super(ciphers, cipherFilter, apn, SSL.SSL_MODE_SERVER, keyCertChain,
73 clientAuth, protocols, startTls,
74 null,
75 enableOcsp, true, options);
76
77 boolean success = false;
78 try {
79 sessionContext = newSessionContext(this, ctx, engineMap, trustCertCollection, trustManagerFactory,
80 keyCertChain, key, keyPassword, keyManagerFactory, keyStore,
81 sessionCacheSize, sessionTimeout);
82 if (SERVER_ENABLE_SESSION_TICKET) {
83 sessionContext.setTicketKeys();
84 }
85 success = true;
86 } finally {
87 if (!success) {
88 release();
89 }
90 }
91 }
92
93 @Override
94 public OpenSslServerSessionContext sessionContext() {
95 return sessionContext;
96 }
97
98 static OpenSslServerSessionContext newSessionContext(ReferenceCountedOpenSslContext thiz, long ctx,
99 OpenSslEngineMap engineMap,
100 X509Certificate[] trustCertCollection,
101 TrustManagerFactory trustManagerFactory,
102 X509Certificate[] keyCertChain, PrivateKey key,
103 String keyPassword, KeyManagerFactory keyManagerFactory,
104 String keyStore, long sessionCacheSize, long sessionTimeout)
105 throws SSLException {
106 OpenSslKeyMaterialProvider keyMaterialProvider = null;
107 try {
108 try {
109 SSLContext.setVerify(ctx, SSL.SSL_CVERIFY_NONE, VERIFY_DEPTH);
110 if (!OpenSsl.useKeyManagerFactory()) {
111 if (keyManagerFactory != null) {
112 throw new IllegalArgumentException(
113 "KeyManagerFactory not supported");
114 }
115 checkNotNull(keyCertChain, "keyCertChain");
116
117 setKeyMaterial(ctx, keyCertChain, key, keyPassword);
118 } else {
119
120
121 if (keyManagerFactory == null) {
122 char[] keyPasswordChars = keyStorePassword(keyPassword);
123 KeyStore ks = buildKeyStore(keyCertChain, key, keyPasswordChars, keyStore);
124 if (ks.aliases().hasMoreElements()) {
125 keyManagerFactory = new OpenSslX509KeyManagerFactory();
126 } else {
127 keyManagerFactory = new OpenSslCachingX509KeyManagerFactory(
128 KeyManagerFactory.getInstance(KeyManagerFactory.getDefaultAlgorithm()));
129 }
130 keyManagerFactory.init(ks, keyPasswordChars);
131 }
132 keyMaterialProvider = providerFor(keyManagerFactory, keyPassword);
133
134 SSLContext.setCertificateCallback(ctx, new OpenSslServerCertificateCallback(
135 engineMap, new OpenSslKeyMaterialManager(keyMaterialProvider)));
136 }
137 } catch (Exception e) {
138 throw new SSLException("failed to set certificate and key", e);
139 }
140 try {
141 if (trustCertCollection != null) {
142 trustManagerFactory = buildTrustManagerFactory(trustCertCollection, trustManagerFactory, keyStore);
143 } else if (trustManagerFactory == null) {
144
145 trustManagerFactory = TrustManagerFactory.getInstance(
146 TrustManagerFactory.getDefaultAlgorithm());
147 trustManagerFactory.init((KeyStore) null);
148 }
149
150 final X509TrustManager manager = chooseTrustManager(trustManagerFactory.getTrustManagers());
151
152
153
154
155
156
157
158 setVerifyCallback(ctx, engineMap, manager);
159
160 X509Certificate[] issuers = manager.getAcceptedIssuers();
161 if (issuers != null && issuers.length > 0) {
162 long bio = 0;
163 try {
164 bio = toBIO(ByteBufAllocator.DEFAULT, issuers);
165 if (!SSLContext.setCACertificateBio(ctx, bio)) {
166 throw new SSLException("unable to setup accepted issuers for trustmanager " + manager);
167 }
168 } finally {
169 freeBio(bio);
170 }
171 }
172
173
174
175
176 SSLContext.setSniHostnameMatcher(ctx, new OpenSslSniHostnameMatcher(engineMap));
177 } catch (SSLException e) {
178 throw e;
179 } catch (Exception e) {
180 throw new SSLException("unable to setup trustmanager", e);
181 }
182
183 OpenSslServerSessionContext sessionContext = new OpenSslServerSessionContext(thiz, keyMaterialProvider);
184 sessionContext.setSessionIdContext(ID);
185
186 sessionContext.setSessionCacheEnabled(SERVER_ENABLE_SESSION_CACHE);
187 if (sessionCacheSize > 0) {
188 sessionContext.setSessionCacheSize((int) Math.min(sessionCacheSize, Integer.MAX_VALUE));
189 }
190 if (sessionTimeout > 0) {
191 sessionContext.setSessionTimeout((int) Math.min(sessionTimeout, Integer.MAX_VALUE));
192 }
193
194 keyMaterialProvider = null;
195
196 return sessionContext;
197 } finally {
198 if (keyMaterialProvider != null) {
199 keyMaterialProvider.destroy();
200 }
201 }
202 }
203
204 private static void setVerifyCallback(long ctx, OpenSslEngineMap engineMap, X509TrustManager manager) {
205
206 if (useExtendedTrustManager(manager)) {
207 SSLContext.setCertVerifyCallback(ctx, new ExtendedTrustManagerVerifyCallback(
208 engineMap, (X509ExtendedTrustManager) manager));
209 } else {
210 SSLContext.setCertVerifyCallback(ctx, new TrustManagerVerifyCallback(engineMap, manager));
211 }
212 }
213
214 private static final class OpenSslServerCertificateCallback implements CertificateCallback {
215 private final OpenSslEngineMap engineMap;
216 private final OpenSslKeyMaterialManager keyManagerHolder;
217
218 OpenSslServerCertificateCallback(OpenSslEngineMap engineMap, OpenSslKeyMaterialManager keyManagerHolder) {
219 this.engineMap = engineMap;
220 this.keyManagerHolder = keyManagerHolder;
221 }
222
223 @Override
224 public void handle(long ssl, byte[] keyTypeBytes, byte[][] asn1DerEncodedPrincipals) throws Exception {
225 final ReferenceCountedOpenSslEngine engine = engineMap.get(ssl);
226 if (engine == null) {
227
228 return;
229 }
230 try {
231
232
233 keyManagerHolder.setKeyMaterialServerSide(engine);
234 } catch (Throwable cause) {
235 engine.initHandshakeException(cause);
236
237 if (cause instanceof Exception) {
238 throw (Exception) cause;
239 }
240 throw new SSLException(cause);
241 }
242 }
243 }
244
245 private static final class TrustManagerVerifyCallback extends AbstractCertificateVerifier {
246 private final X509TrustManager manager;
247
248 TrustManagerVerifyCallback(OpenSslEngineMap engineMap, X509TrustManager manager) {
249 super(engineMap);
250 this.manager = manager;
251 }
252
253 @Override
254 void verify(ReferenceCountedOpenSslEngine engine, X509Certificate[] peerCerts, String auth)
255 throws Exception {
256 manager.checkClientTrusted(peerCerts, auth);
257 }
258 }
259
260 private static final class ExtendedTrustManagerVerifyCallback extends AbstractCertificateVerifier {
261 private final X509ExtendedTrustManager manager;
262
263 ExtendedTrustManagerVerifyCallback(OpenSslEngineMap engineMap, X509ExtendedTrustManager manager) {
264 super(engineMap);
265 this.manager = manager;
266 }
267
268 @Override
269 void verify(ReferenceCountedOpenSslEngine engine, X509Certificate[] peerCerts, String auth)
270 throws Exception {
271 manager.checkClientTrusted(peerCerts, auth, engine);
272 }
273 }
274
275 private static final class OpenSslSniHostnameMatcher implements SniHostNameMatcher {
276 private final OpenSslEngineMap engineMap;
277
278 OpenSslSniHostnameMatcher(OpenSslEngineMap engineMap) {
279 this.engineMap = engineMap;
280 }
281
282 @Override
283 public boolean match(long ssl, String hostname) {
284 ReferenceCountedOpenSslEngine engine = engineMap.get(ssl);
285 if (engine != null) {
286
287 return engine.checkSniHostnameMatch(hostname.getBytes(CharsetUtil.UTF_8));
288 }
289 logger.warn("No ReferenceCountedOpenSslEngine found for SSL pointer: {}", ssl);
290 return false;
291 }
292 }
293 }