OpenSslKeyMaterialManager Class — netty Architecture

Source Code

handler/src/main/java/io/netty/handler/ssl/OpenSslKeyMaterialManager.java lines 32–170

final class OpenSslKeyMaterialManager {

    // Code in this class is inspired by code of conscrypts:
    // - https://android.googlesource.com/platform/external/
    //   conscrypt/+/master/src/main/java/org/conscrypt/OpenSSLEngineImpl.java
    // - https://android.googlesource.com/platform/external/
    //   conscrypt/+/master/src/main/java/org/conscrypt/SSLParametersImpl.java
    //
    static final String KEY_TYPE_RSA = "RSA";
    static final String KEY_TYPE_DH_RSA = "DH_RSA";
    static final String KEY_TYPE_EC = "EC";
    static final String KEY_TYPE_EC_EC = "EC_EC";
    static final String KEY_TYPE_EC_RSA = "EC_RSA";

    private static final int TYPE_RSA     = 1;      // 00001
    private static final int TYPE_DH_RSA  = 1 << 1; // 00010
    private static final int TYPE_EC      = 1 << 2; // 00100
    private static final int TYPE_EC_EC   = 1 << 3; // 01000
    private static final int TYPE_EC_RSA  = 1 << 4; // 10000

    private final OpenSslKeyMaterialProvider provider;
    private final boolean hasTmpDhKeys;

    OpenSslKeyMaterialManager(OpenSslKeyMaterialProvider provider, boolean hasTmpDhKeys) {
        this.provider = provider;
        this.hasTmpDhKeys = hasTmpDhKeys;
    }

    void setKeyMaterialServerSide(ReferenceCountedOpenSslEngine engine) throws SSLException {
        String[] authMethods = engine.authMethods();
        if (authMethods.length == 0) {
            throw new SSLHandshakeException("Unable to find key material");
        }

        // authMethods may contain duplicates or may result in the same type
        // but call chooseServerAlias(...) may be expensive. So let's ensure
        // we filter out duplicates.

        int seenTypes = 0;
        for (String authMethod : authMethods) {
            int typeBit = resolveKeyTypeBit(authMethod);
            if (typeBit == 0 || (seenTypes & typeBit) != 0) {
                continue;
            }

            seenTypes |= typeBit; // mark as seen

            String keyType = keyTypeString(typeBit);
            String alias = chooseServerAlias(engine, keyType);
            if (alias != null) {
                setKeyMaterial(engine, alias);
                return;
            }
        }

        if (hasTmpDhKeys && authMethods.length == 1 &&
                ("DH_anon".equals(authMethods[0]) || "ECDH_anon".equals(authMethods[0]))) {
            return; // These auth methods don't require certificates.
        }
        throw new SSLHandshakeException("Unable to find key material for auth method(s): "
                + Arrays.toString(authMethods));
    }

    private static int resolveKeyTypeBit(String authMethod) {
        switch (authMethod) {
            case "RSA":
            case "DHE_RSA":
            case "ECDHE_RSA":
                return TYPE_RSA;
            case "DH_RSA":
                return TYPE_DH_RSA;
            case "ECDHE_ECDSA":
                return TYPE_EC;
            case "ECDH_ECDSA":
                return TYPE_EC_EC;
            case "ECDH_RSA":
                return TYPE_EC_RSA;
            default:
                return 0;
        }
    }