Skip to content

Commit 3f66dd2

Browse files
chrisvestchrisvest
authored
Make it possible to notify the TrustManager of resumed sessions (#14358)
1 parent c036b99 commit 3f66dd2

18 files changed

Lines changed: 958 additions & 117 deletions

‎handler/src/main/java/io/netty/handler/ssl/JdkSslClientContext.java‎

Lines changed: 19 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -176,7 +176,7 @@ public JdkSslClientContext(
176176
long sessionCacheSize, long sessionTimeout) throws SSLException {
177177
super(newSSLContext(provider, toX509CertificatesInternal(trustCertCollectionFile),
178178
trustManagerFactory, null, null,
179-
null, null, sessionCacheSize, sessionTimeout, null, KeyStore.getDefaultType()), true,
179+
null, null, sessionCacheSize, sessionTimeout, null, KeyStore.getDefaultType(), null), true,
180180
ciphers, cipherFilter, apn, ClientAuth.NONE, null, false);
181181
}
182182

@@ -260,7 +260,7 @@ public JdkSslClientContext(File trustCertCollectionFile, TrustManagerFactory tru
260260
trustCertCollectionFile), trustManagerFactory,
261261
toX509CertificatesInternal(keyCertChainFile), toPrivateKeyInternal(keyFile, keyPassword),
262262
keyPassword, keyManagerFactory, sessionCacheSize, sessionTimeout,
263-
null, KeyStore.getDefaultType()), true,
263+
null, KeyStore.getDefaultType(), null), true,
264264
ciphers, cipherFilter, apn, ClientAuth.NONE, null, false);
265265
}
266266

@@ -269,21 +269,23 @@ public JdkSslClientContext(File trustCertCollectionFile, TrustManagerFactory tru
269269
X509Certificate[] keyCertChain, PrivateKey key, String keyPassword,
270270
KeyManagerFactory keyManagerFactory, Iterable<String> ciphers, CipherSuiteFilter cipherFilter,
271271
ApplicationProtocolConfig apn, String[] protocols, long sessionCacheSize, long sessionTimeout,
272-
SecureRandom secureRandom, String keyStoreType, String endpointIdentificationAlgorithm)
272+
SecureRandom secureRandom, String keyStoreType, String endpointIdentificationAlgorithm,
273+
ResumptionController resumptionController)
273274
throws SSLException {
274275
super(newSSLContext(sslContextProvider, trustCertCollection, trustManagerFactory,
275276
keyCertChain, key, keyPassword, keyManagerFactory, sessionCacheSize,
276-
sessionTimeout, secureRandom, keyStoreType),
277+
sessionTimeout, secureRandom, keyStoreType, resumptionController),
277278
true, ciphers, cipherFilter, toNegotiator(apn, false), ClientAuth.NONE, protocols, false,
278-
endpointIdentificationAlgorithm);
279+
endpointIdentificationAlgorithm, resumptionController);
279280
}
280281

281282
private static SSLContext newSSLContext(Provider sslContextProvider,
282283
X509Certificate[] trustCertCollection,
283284
TrustManagerFactory trustManagerFactory, X509Certificate[] keyCertChain,
284285
PrivateKey key, String keyPassword, KeyManagerFactory keyManagerFactory,
285286
long sessionCacheSize, long sessionTimeout,
286-
SecureRandom secureRandom, String keyStore) throws SSLException {
287+
SecureRandom secureRandom, String keyStore,
288+
ResumptionController resumptionController) throws SSLException {
287289
try {
288290
if (trustCertCollection != null) {
289291
trustManagerFactory = buildTrustManagerFactory(trustCertCollection, trustManagerFactory, keyStore);
@@ -295,7 +297,8 @@ private static SSLContext newSSLContext(Provider sslContextProvider,
295297
SSLContext ctx = sslContextProvider == null ? SSLContext.getInstance(PROTOCOL)
296298
: SSLContext.getInstance(PROTOCOL, sslContextProvider);
297299
ctx.init(keyManagerFactory == null ? null : keyManagerFactory.getKeyManagers(),
298-
trustManagerFactory == null ? null : trustManagerFactory.getTrustManagers(),
300+
trustManagerFactory == null ? null :
301+
wrapIfNeeded(trustManagerFactory.getTrustManagers(), resumptionController),
299302
secureRandom);
300303

301304
SSLSessionContext sessCtx = ctx.getClientSessionContext();
@@ -313,4 +316,13 @@ private static SSLContext newSSLContext(Provider sslContextProvider,
313316
throw new SSLException("failed to initialize the client-side SSL context", e);
314317
}
315318
}
319+
320+
private static TrustManager[] wrapIfNeeded(TrustManager[] tms, ResumptionController resumptionController) {
321+
if (resumptionController != null) {
322+
for (int i = 0; i < tms.length; i++) {
323+
tms[i] = resumptionController.wrapIfNeeded(tms[i]);
324+
}
325+
}
326+
return tms;
327+
}
316328
}

‎handler/src/main/java/io/netty/handler/ssl/JdkSslContext.java‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -261,14 +261,14 @@ public JdkSslContext(SSLContext sslContext,
261261
@SuppressWarnings("deprecation")
262262
JdkSslContext(SSLContext sslContext, boolean isClient, Iterable<String> ciphers, CipherSuiteFilter cipherFilter,
263263
JdkApplicationProtocolNegotiator apn, ClientAuth clientAuth, String[] protocols, boolean startTls) {
264-
this(sslContext, isClient, ciphers, cipherFilter, apn, clientAuth, protocols, startTls, null);
264+
this(sslContext, isClient, ciphers, cipherFilter, apn, clientAuth, protocols, startTls, null, null);
265265
}
266266

267267
@SuppressWarnings("deprecation")
268268
JdkSslContext(SSLContext sslContext, boolean isClient, Iterable<String> ciphers, CipherSuiteFilter cipherFilter,
269269
JdkApplicationProtocolNegotiator apn, ClientAuth clientAuth, String[] protocols, boolean startTls,
270-
String endpointIdentificationAlgorithm) {
271-
super(startTls);
270+
String endpointIdentificationAlgorithm, ResumptionController resumptionController) {
271+
super(startTls, resumptionController);
272272
this.apn = checkNotNull(apn, "apn");
273273
this.clientAuth = checkNotNull(clientAuth, "clientAuth");
274274
this.sslContext = checkNotNull(sslContext, "sslContext");

‎handler/src/main/java/io/netty/handler/ssl/JdkSslServerContext.java‎

Lines changed: 18 additions & 11 deletions
Original file line numberDiff line numberDiff line change
@@ -92,7 +92,7 @@ static void checkIfWrappingTrustManagerIsSupported() throws CertificateException
9292
tm.init((KeyStore) null);
9393
TrustManager[] managers = tm.getTrustManagers();
9494

95-
ctx.init(kmf.getKeyManagers(), wrapTrustManagerIfNeeded(managers), null);
95+
ctx.init(kmf.getKeyManagers(), wrapTrustManagerIfNeeded(managers, null), null);
9696
}
9797

9898
/**
@@ -208,7 +208,7 @@ public JdkSslServerContext(
208208
long sessionCacheSize, long sessionTimeout, String keyStore) throws SSLException {
209209
super(newSSLContext(provider, null, null,
210210
toX509CertificatesInternal(certChainFile), toPrivateKeyInternal(keyFile, keyPassword),
211-
keyPassword, null, sessionCacheSize, sessionTimeout, null, keyStore), false,
211+
keyPassword, null, sessionCacheSize, sessionTimeout, null, keyStore, null), false,
212212
ciphers, cipherFilter, apn, ClientAuth.NONE, null, false);
213213
}
214214

@@ -248,7 +248,7 @@ public JdkSslServerContext(File trustCertCollectionFile, TrustManagerFactory tru
248248
long sessionCacheSize, long sessionTimeout) throws SSLException {
249249
super(newSSLContext(null, toX509CertificatesInternal(trustCertCollectionFile), trustManagerFactory,
250250
toX509CertificatesInternal(keyCertChainFile), toPrivateKeyInternal(keyFile, keyPassword),
251-
keyPassword, keyManagerFactory, sessionCacheSize, sessionTimeout, null, null), false,
251+
keyPassword, keyManagerFactory, sessionCacheSize, sessionTimeout, null, null, null), false,
252252
ciphers, cipherFilter, apn, ClientAuth.NONE, null, false);
253253
}
254254

@@ -290,7 +290,7 @@ public JdkSslServerContext(File trustCertCollectionFile, TrustManagerFactory tru
290290
super(newSSLContext(null, toX509CertificatesInternal(trustCertCollectionFile), trustManagerFactory,
291291
toX509CertificatesInternal(keyCertChainFile), toPrivateKeyInternal(keyFile, keyPassword),
292292
keyPassword, keyManagerFactory, sessionCacheSize, sessionTimeout,
293-
null, KeyStore.getDefaultType()), false,
293+
null, KeyStore.getDefaultType(), null), false,
294294
ciphers, cipherFilter, apn, ClientAuth.NONE, null, false);
295295
}
296296

@@ -300,17 +300,20 @@ public JdkSslServerContext(File trustCertCollectionFile, TrustManagerFactory tru
300300
KeyManagerFactory keyManagerFactory, Iterable<String> ciphers, CipherSuiteFilter cipherFilter,
301301
ApplicationProtocolConfig apn, long sessionCacheSize, long sessionTimeout,
302302
ClientAuth clientAuth, String[] protocols, boolean startTls,
303-
SecureRandom secureRandom, String keyStore) throws SSLException {
303+
SecureRandom secureRandom, String keyStore, ResumptionController resumptionController)
304+
throws SSLException {
304305
super(newSSLContext(provider, trustCertCollection, trustManagerFactory, keyCertChain, key,
305-
keyPassword, keyManagerFactory, sessionCacheSize, sessionTimeout, secureRandom, keyStore), false,
306-
ciphers, cipherFilter, toNegotiator(apn, true), clientAuth, protocols, startTls);
306+
keyPassword, keyManagerFactory, sessionCacheSize, sessionTimeout, secureRandom, keyStore,
307+
resumptionController),
308+
false, ciphers, cipherFilter, toNegotiator(apn, true), clientAuth, protocols, startTls, null,
309+
resumptionController);
307310
}
308311

309312
private static SSLContext newSSLContext(Provider sslContextProvider, X509Certificate[] trustCertCollection,
310313
TrustManagerFactory trustManagerFactory, X509Certificate[] keyCertChain,
311314
PrivateKey key, String keyPassword, KeyManagerFactory keyManagerFactory,
312-
long sessionCacheSize, long sessionTimeout,
313-
SecureRandom secureRandom, String keyStore)
315+
long sessionCacheSize, long sessionTimeout, SecureRandom secureRandom,
316+
String keyStore, ResumptionController resumptionController)
314317
throws SSLException {
315318
if (key == null && keyManagerFactory == null) {
316319
throw new NullPointerException("key, keyManagerFactory");
@@ -335,7 +338,7 @@ private static SSLContext newSSLContext(Provider sslContextProvider, X509Certifi
335338
SSLContext ctx = sslContextProvider == null ? SSLContext.getInstance(PROTOCOL)
336339
: SSLContext.getInstance(PROTOCOL, sslContextProvider);
337340
ctx.init(keyManagerFactory.getKeyManagers(),
338-
wrapTrustManagerIfNeeded(trustManagerFactory.getTrustManagers()),
341+
wrapTrustManagerIfNeeded(trustManagerFactory.getTrustManagers(), resumptionController),
339342
secureRandom);
340343

341344
SSLSessionContext sessCtx = ctx.getServerSessionContext();
@@ -355,10 +358,14 @@ private static SSLContext newSSLContext(Provider sslContextProvider, X509Certifi
355358
}
356359

357360
@SuppressJava6Requirement(reason = "Guarded by java version check")
358-
private static TrustManager[] wrapTrustManagerIfNeeded(TrustManager[] trustManagers) {
361+
private static TrustManager[] wrapTrustManagerIfNeeded(
362+
TrustManager[] trustManagers, ResumptionController resumptionController) {
359363
if (WRAP_TRUST_MANAGER && PlatformDependent.javaVersion() >= 7) {
360364
for (int i = 0; i < trustManagers.length; i++) {
361365
TrustManager tm = trustManagers[i];
366+
if (resumptionController != null) {
367+
tm = resumptionController.wrapIfNeeded(tm);
368+
}
362369
if (tm instanceof X509ExtendedTrustManager) {
363370
// Wrap the TrustManager to provide a better exception message for users to debug hostname
364371
// validation failures.

‎handler/src/main/java/io/netty/handler/ssl/OpenSslClientContext.java‎

Lines changed: 6 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -178,24 +178,25 @@ public OpenSslClientContext(File trustCertCollectionFile, TrustManagerFactory tr
178178
this(toX509CertificatesInternal(trustCertCollectionFile), trustManagerFactory,
179179
toX509CertificatesInternal(keyCertChainFile), toPrivateKeyInternal(keyFile, keyPassword),
180180
keyPassword, keyManagerFactory, ciphers, cipherFilter, apn, null, sessionCacheSize,
181-
sessionTimeout, false, KeyStore.getDefaultType(), null);
181+
sessionTimeout, false, KeyStore.getDefaultType(), null, null);
182182
}
183183

184184
OpenSslClientContext(X509Certificate[] trustCertCollection, TrustManagerFactory trustManagerFactory,
185185
X509Certificate[] keyCertChain, PrivateKey key, String keyPassword,
186186
KeyManagerFactory keyManagerFactory, Iterable<String> ciphers,
187187
CipherSuiteFilter cipherFilter, ApplicationProtocolConfig apn, String[] protocols,
188188
long sessionCacheSize, long sessionTimeout, boolean enableOcsp, String keyStore,
189-
String endpointIdentificationAlgorithm, Map.Entry<SslContextOption<?>, Object>... options)
189+
String endpointIdentificationAlgorithm, ResumptionController resumptionController,
190+
Map.Entry<SslContextOption<?>, Object>... options)
190191
throws SSLException {
191-
super(ciphers, cipherFilter, apn, SSL.SSL_MODE_CLIENT, keyCertChain,
192-
ClientAuth.NONE, protocols, false, endpointIdentificationAlgorithm, enableOcsp, options);
192+
super(ciphers, cipherFilter, apn, SSL.SSL_MODE_CLIENT, keyCertChain, ClientAuth.NONE, protocols, false,
193+
endpointIdentificationAlgorithm, enableOcsp, resumptionController, options);
193194
boolean success = false;
194195
try {
195196
OpenSslKeyMaterialProvider.validateKeyMaterialSupported(keyCertChain, key, keyPassword);
196197
sessionContext = newSessionContext(this, ctx, engineMap, trustCertCollection, trustManagerFactory,
197198
keyCertChain, key, keyPassword, keyManagerFactory, keyStore,
198-
sessionCacheSize, sessionTimeout);
199+
sessionCacheSize, sessionTimeout, resumptionController);
199200
success = true;
200201
} finally {
201202
if (!success) {

‎handler/src/main/java/io/netty/handler/ssl/OpenSslContext.java‎

Lines changed: 6 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -31,19 +31,22 @@ public abstract class OpenSslContext extends ReferenceCountedOpenSslContext {
3131
OpenSslContext(Iterable<String> ciphers, CipherSuiteFilter cipherFilter, ApplicationProtocolConfig apnCfg,
3232
int mode, Certificate[] keyCertChain,
3333
ClientAuth clientAuth, String[] protocols, boolean startTls, String endpointIdentificationAlgorithm,
34-
boolean enableOcsp, Map.Entry<SslContextOption<?>, Object>... options)
34+
boolean enableOcsp, ResumptionController resumptionController,
35+
Map.Entry<SslContextOption<?>, Object>... options)
3536
throws SSLException {
3637
super(ciphers, cipherFilter, toNegotiator(apnCfg), mode, keyCertChain,
37-
clientAuth, protocols, startTls, endpointIdentificationAlgorithm, enableOcsp, false, options);
38+
clientAuth, protocols, startTls, endpointIdentificationAlgorithm, enableOcsp, false,
39+
resumptionController, options);
3840
}
3941

4042
OpenSslContext(Iterable<String> ciphers, CipherSuiteFilter cipherFilter, OpenSslApplicationProtocolNegotiator apn,
4143
int mode, Certificate[] keyCertChain,
4244
ClientAuth clientAuth, String[] protocols, boolean startTls, boolean enableOcsp,
45+
ResumptionController resumptionController,
4346
Map.Entry<SslContextOption<?>, Object>... options)
4447
throws SSLException {
4548
super(ciphers, cipherFilter, apn, mode, keyCertChain,
46-
clientAuth, protocols, startTls, null, enableOcsp, false, options);
49+
clientAuth, protocols, startTls, null, enableOcsp, false, resumptionController, options);
4750
}
4851

4952
@Override

‎handler/src/main/java/io/netty/handler/ssl/OpenSslServerContext.java‎

Lines changed: 9 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -323,19 +323,21 @@ public OpenSslServerContext(
323323
this(toX509CertificatesInternal(trustCertCollectionFile), trustManagerFactory,
324324
toX509CertificatesInternal(keyCertChainFile), toPrivateKeyInternal(keyFile, keyPassword),
325325
keyPassword, keyManagerFactory, ciphers, cipherFilter,
326-
apn, sessionCacheSize, sessionTimeout, ClientAuth.NONE, null, false, false, KeyStore.getDefaultType());
326+
apn, sessionCacheSize, sessionTimeout, ClientAuth.NONE, null, false, false, KeyStore.getDefaultType(),
327+
null);
327328
}
328329

329330
OpenSslServerContext(
330331
X509Certificate[] trustCertCollection, TrustManagerFactory trustManagerFactory,
331332
X509Certificate[] keyCertChain, PrivateKey key, String keyPassword, KeyManagerFactory keyManagerFactory,
332333
Iterable<String> ciphers, CipherSuiteFilter cipherFilter, ApplicationProtocolConfig apn,
333334
long sessionCacheSize, long sessionTimeout, ClientAuth clientAuth, String[] protocols, boolean startTls,
334-
boolean enableOcsp, String keyStore, Map.Entry<SslContextOption<?>, Object>... options)
335+
boolean enableOcsp, String keyStore, ResumptionController resumptionController,
336+
Map.Entry<SslContextOption<?>, Object>... options)
335337
throws SSLException {
336338
this(trustCertCollection, trustManagerFactory, keyCertChain, key, keyPassword, keyManagerFactory, ciphers,
337339
cipherFilter, toNegotiator(apn), sessionCacheSize, sessionTimeout, clientAuth, protocols, startTls,
338-
enableOcsp, keyStore, options);
340+
enableOcsp, keyStore, resumptionController, options);
339341
}
340342

341343
@SuppressWarnings("deprecation")
@@ -344,18 +346,19 @@ private OpenSslServerContext(
344346
X509Certificate[] keyCertChain, PrivateKey key, String keyPassword, KeyManagerFactory keyManagerFactory,
345347
Iterable<String> ciphers, CipherSuiteFilter cipherFilter, OpenSslApplicationProtocolNegotiator apn,
346348
long sessionCacheSize, long sessionTimeout, ClientAuth clientAuth, String[] protocols, boolean startTls,
347-
boolean enableOcsp, String keyStore, Map.Entry<SslContextOption<?>, Object>... options)
349+
boolean enableOcsp, String keyStore, ResumptionController resumptionController,
350+
Map.Entry<SslContextOption<?>, Object>... options)
348351
throws SSLException {
349352
super(ciphers, cipherFilter, apn, SSL.SSL_MODE_SERVER, keyCertChain,
350-
clientAuth, protocols, startTls, enableOcsp, options);
353+
clientAuth, protocols, startTls, enableOcsp, resumptionController, options);
351354

352355
// Create a new SSL_CTX and configure it.
353356
boolean success = false;
354357
try {
355358
OpenSslKeyMaterialProvider.validateKeyMaterialSupported(keyCertChain, key, keyPassword);
356359
sessionContext = newSessionContext(this, ctx, engineMap, trustCertCollection, trustManagerFactory,
357360
keyCertChain, key, keyPassword, keyManagerFactory, keyStore,
358-
sessionCacheSize, sessionTimeout);
361+
sessionCacheSize, sessionTimeout, resumptionController);
359362
success = true;
360363
} finally {
361364
if (!success) {

0 commit comments

Comments
 (0)