JdkDelegatingPrivateKeyMethod Class — netty Architecture

Source Code

handler/src/main/java/io/netty/handler/ssl/JdkDelegatingPrivateKeyMethod.java lines 43–275

final class JdkDelegatingPrivateKeyMethod implements SSLPrivateKeyMethod {

    private static final InternalLogger logger =
            InternalLoggerFactory.getInstance(JdkDelegatingPrivateKeyMethod.class);

    private static final IntObjectMap<String> SSL_TO_JDK_SIGNATURE_ALGORITHM;
    private static final ConcurrentMap<CacheKey, String> PROVIDER_CACHE = new ConcurrentHashMap<>();

    static {
        IntObjectMap<String> algorithmMap = new IntObjectHashMap<>();

        // RSA PKCS#1 signatures
        algorithmMap.put(OpenSslAsyncPrivateKeyMethod.SSL_SIGN_RSA_PKCS1_SHA1, "SHA1withRSA");
        algorithmMap.put(OpenSslAsyncPrivateKeyMethod.SSL_SIGN_RSA_PKCS1_SHA256, "SHA256withRSA");
        algorithmMap.put(OpenSslAsyncPrivateKeyMethod.SSL_SIGN_RSA_PKCS1_SHA384, "SHA384withRSA");
        algorithmMap.put(OpenSslAsyncPrivateKeyMethod.SSL_SIGN_RSA_PKCS1_SHA512, "SHA512withRSA");
        algorithmMap.put(OpenSslAsyncPrivateKeyMethod.SSL_SIGN_RSA_PKCS1_MD5_SHA1, "MD5andSHA1withRSA");

        // ECDSA signatures
        algorithmMap.put(OpenSslAsyncPrivateKeyMethod.SSL_SIGN_ECDSA_SHA1, "SHA1withECDSA");
        algorithmMap.put(OpenSslAsyncPrivateKeyMethod.SSL_SIGN_ECDSA_SECP256R1_SHA256, "SHA256withECDSA");
        algorithmMap.put(OpenSslAsyncPrivateKeyMethod.SSL_SIGN_ECDSA_SECP384R1_SHA384, "SHA384withECDSA");
        algorithmMap.put(OpenSslAsyncPrivateKeyMethod.SSL_SIGN_ECDSA_SECP521R1_SHA512, "SHA512withECDSA");

        // RSA-PSS signatures
        algorithmMap.put(OpenSslAsyncPrivateKeyMethod.SSL_SIGN_RSA_PSS_RSAE_SHA256, "RSASSA-PSS");
        algorithmMap.put(OpenSslAsyncPrivateKeyMethod.SSL_SIGN_RSA_PSS_RSAE_SHA384, "RSASSA-PSS");
        algorithmMap.put(OpenSslAsyncPrivateKeyMethod.SSL_SIGN_RSA_PSS_RSAE_SHA512, "RSASSA-PSS");

        // EdDSA signatures
        algorithmMap.put(OpenSslAsyncPrivateKeyMethod.SSL_SIGN_ED25519, "EdDSA");

        SSL_TO_JDK_SIGNATURE_ALGORITHM = IntCollections.unmodifiableMap(algorithmMap);
    }

    private final PrivateKey privateKey;
    private final String privateKeyTypeName;

    /**
     * Creates a new JDK delegating async private key method.
     *
     * @param privateKey the private key to use for cryptographic operations
     */
    JdkDelegatingPrivateKeyMethod(PrivateKey privateKey) {
        this.privateKey = ObjectUtil.checkNotNull(privateKey, "privateKey");
        this.privateKeyTypeName = privateKey.getClass().getName();
    }

    @Override
    public byte[] sign(long ssl, int signatureAlgorithm, byte[] input) throws Exception {
        Signature signature = createSignature(signatureAlgorithm);
        signature.update(input);
        byte[] result = signature.sign();

        if (logger.isDebugEnabled()) {
            logger.debug("Signing operation completed successfully, result length: {}", result.length);
        }
        return result;
    }

    @Override
    public byte[] decrypt(long ssl, byte[] input) {
        // Modern handshake techniques don't use the private key to decrypt, only to sign in order to verify
        // identity. As such, we don't currently support decrypting using the private key.
        throw new UnsupportedOperationException("Direct decryption is not supported");
    }

    private Signature createSignature(int opensslAlgorithm)
            throws NoSuchAlgorithmException {
        String jdkAlgorithm = SSL_TO_JDK_SIGNATURE_ALGORITHM.get(opensslAlgorithm);
        if (jdkAlgorithm == null) {
            String errorMsg = "Unsupported signature algorithm: " + opensslAlgorithm;
            throw new NoSuchAlgorithmException(errorMsg);
        }

        CacheKey cacheKey = new CacheKey(jdkAlgorithm, privateKeyTypeName);

        // Try cached provider first
        String cachedProviderName = PROVIDER_CACHE.get(cacheKey);
        if (cachedProviderName != null) {
            try {