Class ReferenceCountedOpenSslContext

java.lang.Object
io.netty.handler.ssl.SslContext
io.netty.handler.ssl.ReferenceCountedOpenSslContext
All Implemented Interfaces:
ReferenceCounted
Direct Known Subclasses:
OpenSslContext, ReferenceCountedOpenSslClientContext, ReferenceCountedOpenSslServerContext
public abstract class ReferenceCountedOpenSslContext extends SslContext implements ReferenceCounted
An implementation of SslContext which works with libraries that support the OpenSsl C library API.

Instances of this class must be released or else native memory will leak!

Instances of this class must not be released before any ReferenceCountedOpenSslEngine which depends upon the instance of this class is released. Otherwise if any method of ReferenceCountedOpenSslEngine is called which uses this class's JNI resources the JVM may crash.

  • Field Details

    • DEFAULT_CERTIFICATE_COMPRESSION_CONFIG

      private static final OpenSslCertificateCompressionConfig DEFAULT_CERTIFICATE_COMPRESSION_CONFIG

    • logger

      private static final InternalLogger logger

    • DEFAULT_USE_JDK_PROVIDERS

      private static final boolean DEFAULT_USE_JDK_PROVIDERS

    • DEFAULT_BIO_NON_APPLICATION_BUFFER_SIZE

      private static final int DEFAULT_BIO_NON_APPLICATION_BUFFER_SIZE

    • MIN_MAX_CERTIFICATE_LIST_BYTES

      private static final int MIN_MAX_CERTIFICATE_LIST_BYTES
      See Also:

    • USE_TASKS

      static final boolean USE_TASKS

    • DH_KEY_LENGTH

      private static final java.lang.Integer DH_KEY_LENGTH

    • leakDetector

      private static final ResourceLeakDetector<ReferenceCountedOpenSslContext> leakDetector

    • VERIFY_DEPTH

      protected static final int VERIFY_DEPTH
      See Also:

    • CLIENT_ENABLE_SESSION_TICKET

      static final boolean CLIENT_ENABLE_SESSION_TICKET

    • CLIENT_ENABLE_SESSION_TICKET_TLSV13

      static final boolean CLIENT_ENABLE_SESSION_TICKET_TLSV13

    • SERVER_ENABLE_SESSION_TICKET

      static final boolean SERVER_ENABLE_SESSION_TICKET

    • SERVER_ENABLE_SESSION_TICKET_TLSV13

      static final boolean SERVER_ENABLE_SESSION_TICKET_TLSV13

    • SERVER_ENABLE_SESSION_CACHE

      static final boolean SERVER_ENABLE_SESSION_CACHE

    • CLIENT_ENABLE_SESSION_CACHE

      static final boolean CLIENT_ENABLE_SESSION_CACHE

    • ctx

      protected long ctx
      The OpenSSL SSL_CTX object. ctxLock must be hold while using ctx!

    • unmodifiableCiphers

      private final java.util.List<java.lang.String> unmodifiableCiphers

    • apn

      private final OpenSslApplicationProtocolNegotiator apn

    • mode

      private final int mode

    • leak

      private final ResourceLeakTracker<ReferenceCountedOpenSslContext> leak

    • refCnt

      private final AbstractReferenceCounted refCnt

    • keyCertChain

      final java.security.cert.Certificate[] keyCertChain

    • clientAuth

      final ClientAuth clientAuth

    • protocols

      final java.lang.String[] protocols

    • endpointIdentificationAlgorithm

      final java.lang.String endpointIdentificationAlgorithm

    • serverNames

      final java.util.List<javax.net.ssl.SNIServerName> serverNames

    • hasTLSv13Cipher

      final boolean hasTLSv13Cipher

    • hasTmpDhKeys

      final boolean hasTmpDhKeys

    • groups

      final java.lang.String[] groups

    • enableOcsp

      final boolean enableOcsp

    • engines

      final OpenSslEngineMap engines

    • ctxLock

      final java.util.concurrent.locks.ReadWriteLock ctxLock

    • credentials

      final java.util.List<OpenSslCredential> credentials

    • bioNonApplicationBufferSize

      private volatile int bioNonApplicationBufferSize

    • NONE_PROTOCOL_NEGOTIATOR

      static final OpenSslApplicationProtocolNegotiator NONE_PROTOCOL_NEGOTIATOR

    • tlsFalseStart

      final boolean tlsFalseStart

  • Constructor Details

    • ReferenceCountedOpenSslContext

      ReferenceCountedOpenSslContext(java.lang.Iterable<java.lang.String> ciphers, CipherSuiteFilter cipherFilter, OpenSslApplicationProtocolNegotiator apn, int mode, java.security.cert.Certificate[] keyCertChain, ClientAuth clientAuth, java.lang.String[] protocols, boolean startTls, java.lang.String endpointIdentificationAlgorithm, boolean enableOcsp, boolean leakDetection, java.util.List<javax.net.ssl.SNIServerName> serverNames, ResumptionController resumptionController, java.util.Map.Entry<SslContextOption<?>, java.lang.Object>[] ctxOptions, java.util.List<OpenSslCredential> credentials) throws javax.net.ssl.SSLException
      Throws:
      javax.net.ssl.SSLException

  • Method Details

    • isCertificateCompressionDisabled

      private static boolean isCertificateCompressionDisabled(int mode)

    • opensslSelectorFailureBehavior

      private static int opensslSelectorFailureBehavior(ApplicationProtocolConfig.SelectorFailureBehavior behavior)

    • maxCertificateListBytes

      static int maxCertificateListBytes(int maxCertificateListBytes)

    • addCredential

      private void addCredential(OpenSslCredential credential) throws javax.net.ssl.SSLException
      Throws:
      javax.net.ssl.SSLException

    • cipherSuites

      public final java.util.List<java.lang.String> cipherSuites()
      Description copied from class: SslContext
      Returns the list of enabled cipher suites, in the order of preference.
      Specified by:
      cipherSuites in class SslContext

    • applicationProtocolNegotiator

      public ApplicationProtocolNegotiator applicationProtocolNegotiator()
      Description copied from class: SslContext
      Returns the object responsible for negotiating application layer protocols for the TLS NPN/ALPN extensions.
      Specified by:
      applicationProtocolNegotiator in class SslContext

    • isClient

      public final boolean isClient()
      Description copied from class: SslContext
      Returns the true if and only if this context is for client-side.
      Specified by:
      isClient in class SslContext

    • newEngine

      public final javax.net.ssl.SSLEngine newEngine(ByteBufAllocator alloc, java.lang.String peerHost, int peerPort)
      Description copied from class: SslContext
      Creates a new SSLEngine using advisory peer information.

      If SslProvider.OPENSSL_REFCNT is used then the object must be released. One way to do this is to wrap in a SslHandler and insert it into a pipeline. See SslContext.newHandler(ByteBufAllocator, String, int).

      Specified by:
      newEngine in class SslContext
      Parameters:
      peerHost - the non-authoritative name of the host
      peerPort - the non-authoritative port
      Returns:
      a new SSLEngine

    • newHandler

      protected final SslHandler newHandler(ByteBufAllocator alloc, boolean startTls)
      Description copied from class: SslContext
      Create a new SslHandler.
      Overrides:
      newHandler in class SslContext
      See Also:

    • newHandler

      protected final SslHandler newHandler(ByteBufAllocator alloc, java.lang.String peerHost, int peerPort, boolean startTls)
      Description copied from class: SslContext
      Create a new SslHandler.
      Overrides:
      newHandler in class SslContext
      See Also:

    • newHandler

      protected SslHandler newHandler(ByteBufAllocator alloc, boolean startTls, java.util.concurrent.Executor executor)
      Description copied from class: SslContext
      Create a new SslHandler.
      Overrides:
      newHandler in class SslContext
      See Also:

    • newHandler

      protected SslHandler newHandler(ByteBufAllocator alloc, java.lang.String peerHost, int peerPort, boolean startTls, java.util.concurrent.Executor executor)
      Overrides:
      newHandler in class SslContext

    • newEngine0

      javax.net.ssl.SSLEngine newEngine0(ByteBufAllocator alloc, java.lang.String peerHost, int peerPort, boolean jdkCompatibilityMode)

    • newEngine

      public final javax.net.ssl.SSLEngine newEngine(ByteBufAllocator alloc)
      Returns a new server-side SSLEngine with the current configuration.
      Specified by:
      newEngine in class SslContext
      Returns:
      a new SSLEngine

    • context

      @Deprecated public final long context()
      Deprecated.
      this method is considered unsafe as the returned pointer may be released later. Dont use it!
      Returns the pointer to the SSL_CTX object for this ReferenceCountedOpenSslContext. Be aware that it is freed as soon as the Object.finalize() method is called. At this point 0 will be returned.

    • stats

      @Deprecated public final OpenSslSessionStats stats()
      Deprecated.
      use
      invalid @link 
      {@link #sessionContext#stats()
      }
      Returns the stats of this context.

    • setRejectRemoteInitiatedRenegotiation

      @Deprecated public void setRejectRemoteInitiatedRenegotiation(boolean rejectRemoteInitiatedRenegotiation)
      Deprecated.
      Specify if remote initiated renegotiation is supported or not. If not supported and the remote side tries to initiate a renegotiation a SSLHandshakeException will be thrown during decoding.

    • getRejectRemoteInitiatedRenegotiation

      @Deprecated public boolean getRejectRemoteInitiatedRenegotiation()
      Deprecated.
      Returns:
      true because renegotiation is not supported.

    • setBioNonApplicationBufferSize

      public void setBioNonApplicationBufferSize(int bioNonApplicationBufferSize)
      Set the size of the buffer used by the BIO for non-application based writes (e.g. handshake, renegotiation, etc...).

    • getBioNonApplicationBufferSize

      public int getBioNonApplicationBufferSize()
      Returns the size of the buffer used by the BIO for non-application based writes

    • setTicketKeys

      @Deprecated public final void setTicketKeys(byte[] keys)
      Deprecated.
      use OpenSslSessionContext.setTicketKeys(byte[])
      Sets the SSL session ticket keys of this context.

    • sessionContext

      public abstract OpenSslSessionContext sessionContext()
      Description copied from class: SslContext
      Returns the SSLSessionContext object held by this context.
      Specified by:
      sessionContext in class SslContext

    • sslCtxPointer

      @Deprecated public final long sslCtxPointer()
      Deprecated.
      this method is considered unsafe as the returned pointer may be released later. Dont use it!
      Returns the pointer to the SSL_CTX object for this ReferenceCountedOpenSslContext. Be aware that it is freed as soon as the release() method is called. At this point 0 will be returned.

    • setPrivateKeyMethod

      @Deprecated @UnstableApi public final void setPrivateKeyMethod(OpenSslPrivateKeyMethod method)
      Deprecated.
      use SslContextBuilder.option(SslContextOption, Object) with OpenSslContextOption.PRIVATE_KEY_METHOD.
      Set the OpenSslPrivateKeyMethod to use. This allows to offload private-key operations if needed. This method is currently only supported when BoringSSL is used.
      Parameters:
      method - method to use.

    • setUseTasks

      @Deprecated public final void setUseTasks(boolean useTasks)
      Deprecated.
      use SslContextBuilder.option(SslContextOption, Object) with OpenSslContextOption.USE_TASKS.

    • destroy

      private void destroy()

    • certificates

      protected static java.security.cert.X509Certificate[] certificates(byte[][] chain)

    • chooseTrustManager

      @Deprecated protected static javax.net.ssl.X509TrustManager chooseTrustManager(javax.net.ssl.TrustManager[] managers)
      Deprecated.
      This method is kept for API backwards compatibility.

    • chooseTrustManager

      static javax.net.ssl.X509TrustManager chooseTrustManager(javax.net.ssl.TrustManager[] managers, ResumptionController resumptionController)

    • chooseX509KeyManager

      protected static javax.net.ssl.X509KeyManager chooseX509KeyManager(javax.net.ssl.KeyManager[] kms)

    • toNegotiator

      static OpenSslApplicationProtocolNegotiator toNegotiator(ApplicationProtocolConfig config)
      Translate a ApplicationProtocolConfig object to a OpenSslApplicationProtocolNegotiator object.
      Parameters:
      config - The configuration which defines the translation
      Returns:
      The results of the translation

    • useExtendedTrustManager

      static boolean useExtendedTrustManager(javax.net.ssl.X509TrustManager trustManager)

    • refCnt

      public final int refCnt()
      Description copied from interface: ReferenceCounted
      Returns the reference count of this object. If 0, it means this object has been deallocated.
      Specified by:
      refCnt in interface ReferenceCounted

    • retain

      public final ReferenceCounted retain()
      Description copied from interface: ReferenceCounted
      Increases the reference count by 1.
      Specified by:
      retain in interface ReferenceCounted

    • retain

      public final ReferenceCounted retain(int increment)
      Description copied from interface: ReferenceCounted
      Increases the reference count by the specified increment.
      Specified by:
      retain in interface ReferenceCounted

    • touch

      public final ReferenceCounted touch()
      Description copied from interface: ReferenceCounted
      Records the current access location of this object for debugging purposes. If this object is determined to be leaked, the information recorded by this operation will be provided to you via ResourceLeakDetector. This method is a shortcut to touch(null).
      Specified by:
      touch in interface ReferenceCounted

    • touch

      public final ReferenceCounted touch(java.lang.Object hint)
      Description copied from interface: ReferenceCounted
      Records the current access location of this object with an additional arbitrary information for debugging purposes. If this object is determined to be leaked, the information recorded by this operation will be provided to you via ResourceLeakDetector.
      Specified by:
      touch in interface ReferenceCounted

    • release

      public final boolean release()
      Description copied from interface: ReferenceCounted
      Decreases the reference count by 1 and deallocates this object if the reference count reaches at 0.
      Specified by:
      release in interface ReferenceCounted
      Returns:
      true if and only if the reference count became 0 and this object has been deallocated

    • release

      public final boolean release(int decrement)
      Description copied from interface: ReferenceCounted
      Decreases the reference count by the specified decrement and deallocates this object if the reference count reaches at 0.
      Specified by:
      release in interface ReferenceCounted
      Returns:
      true if and only if the reference count became 0 and this object has been deallocated

    • setKeyMaterial

      static void setKeyMaterial(long ctx, java.security.cert.X509Certificate[] keyCertChain, java.security.PrivateKey key, java.lang.String keyPassword) throws javax.net.ssl.SSLException
      Throws:
      javax.net.ssl.SSLException

    • isJdkSignatureFallbackEnabled

      @SafeVarargs static boolean isJdkSignatureFallbackEnabled(java.util.Map.Entry<SslContextOption<?>, java.lang.Object>... ctxOptions)
      Check if JDK signature fallback is enabled in the given context options.

    • freeBio

      static void freeBio(long bio)

    • toBIO

      static long toBIO(ByteBufAllocator allocator, java.security.PrivateKey key) throws java.lang.Exception
      Return the pointer to a in-memory BIO or 0 if the key is null. The BIO contains the content of the key.
      Throws:
      java.lang.Exception

    • toBIO

      static long toBIO(ByteBufAllocator allocator, java.security.cert.X509Certificate... certChain) throws java.lang.Exception
      Return the pointer to a in-memory BIO or 0 if the certChain is null. The BIO contains the content of the certChain.
      Throws:
      java.lang.Exception

    • toBIO

      static long toBIO(ByteBufAllocator allocator, PemEncoded pem) throws java.lang.Exception
      Throws:
      java.lang.Exception

    • newBIO

      private static long newBIO(ByteBuf buffer) throws java.lang.Exception
      Throws:
      java.lang.Exception

    • providerFor

      static OpenSslKeyMaterialProvider providerFor(javax.net.ssl.KeyManagerFactory factory, java.lang.String password)
      Returns the OpenSslKeyMaterialProvider that should be used for OpenSSL. Depending on the given KeyManagerFactory this may cache the OpenSslKeyMaterial for better performance if it can ensure that the same material is always returned for the same alias.

    • certChainToKeyManagerFactory

      static javax.net.ssl.KeyManagerFactory certChainToKeyManagerFactory(java.security.cert.X509Certificate[] keyCertChain, java.security.PrivateKey key, java.lang.String keyPassword, java.lang.String keyStore) throws java.lang.Exception
      Throws:
      java.lang.Exception

    • setupSecurityProviderSignatureSource

      static OpenSslKeyMaterialProvider setupSecurityProviderSignatureSource(ReferenceCountedOpenSslContext thiz, long ctx, java.security.cert.X509Certificate[] keyCertChain, java.security.PrivateKey key, java.util.function.Function<OpenSslKeyMaterialManager, io.netty.internal.tcnative.CertificateCallback> toCallback) throws java.lang.Exception
      Throws:
      java.lang.Exception

    • retrieveEngine

      private static ReferenceCountedOpenSslEngine retrieveEngine(OpenSslEngineMap engines, long ssl) throws javax.net.ssl.SSLException
      Throws:
      javax.net.ssl.SSLException

    • verifyResult

      private static byte[] verifyResult(byte[] result) throws java.security.SignatureException
      Throws:
      java.security.SignatureException