QuicheQuicSslContext Class — netty Architecture

Source Code

codec-classes-quic/src/main/java/io/netty/handler/codec/quic/QuicheQuicSslContext.java lines 62–640

final class QuicheQuicSslContext extends QuicSslContext {

    private static final InternalLogger LOGGER = InternalLoggerFactory.getInstance(QuicheQuicSslContext.class);

    // Use default that is supported in java 11 and earlier and also in OpenSSL / BoringSSL.
    // See https://github.com/netty/netty-tcnative/issues/567
    // See https://www.java.com/en/configure_crypto.html for ordering
    private static final String[] DEFAULT_NAMED_GROUPS = { "x25519", "secp256r1", "secp384r1", "secp521r1" };
    private static final String[] NAMED_GROUPS;

    static {
        String[] namedGroups = DEFAULT_NAMED_GROUPS;
        Set<String> defaultConvertedNamedGroups = new LinkedHashSet<>(namedGroups.length);
        for (int i = 0; i < namedGroups.length; i++) {
            defaultConvertedNamedGroups.add(GroupsConverter.toBoringSSL(namedGroups[i]));
        }

        // Call Quic.isAvailable() first to ensure native lib is loaded.
        // See https://github.com/netty/netty-incubator-codec-quic/issues/759
        if (Quic.isAvailable()) {
            final long sslCtx = BoringSSL.SSLContext_new();
            try {
                // Let's filter out any group that is not supported from the default.
                Iterator<String> defaultGroupsIter = defaultConvertedNamedGroups.iterator();
                while (defaultGroupsIter.hasNext()) {
                    if (BoringSSL.SSLContext_set1_groups_list(sslCtx, defaultGroupsIter.next()) == 0) {
                        // Not supported, let's remove it. This could for example be the case if we use
                        // fips and the configure group is not supported when using FIPS.
                        // See https://github.com/netty/netty-tcnative/issues/883
                        defaultGroupsIter.remove();
                    }
                }

                String groups = SystemPropertyUtil.get("jdk.tls.namedGroups", null);
                if (groups != null) {
                    String[] nGroups = groups.split(",");
                    Set<String> supportedNamedGroups = new LinkedHashSet<>(nGroups.length);
                    Set<String> supportedConvertedNamedGroups = new LinkedHashSet<>(nGroups.length);

                    Set<String> unsupportedNamedGroups = new LinkedHashSet<>();
                    for (String namedGroup : nGroups) {
                        String converted = GroupsConverter.toBoringSSL(namedGroup);
                        // Will return 0 on failure.
                        if (BoringSSL.SSLContext_set1_groups_list(sslCtx, converted) == 0) {
                            unsupportedNamedGroups.add(namedGroup);
                        } else {
                            supportedConvertedNamedGroups.add(converted);
                            supportedNamedGroups.add(namedGroup);
                        }
                    }

                    if (supportedNamedGroups.isEmpty()) {
                        namedGroups = defaultConvertedNamedGroups.toArray(EmptyArrays.EMPTY_STRINGS);
                        LOGGER.info("All configured namedGroups are not supported: {}. Use default: {}.",
                                Arrays.toString(unsupportedNamedGroups.toArray(EmptyArrays.EMPTY_STRINGS)),
                                Arrays.toString(DEFAULT_NAMED_GROUPS));
                    } else {
                        String[] groupArray = supportedNamedGroups.toArray(EmptyArrays.EMPTY_STRINGS);
                        if (unsupportedNamedGroups.isEmpty()) {
                            LOGGER.info("Using configured namedGroups -D 'jdk.tls.namedGroup': {} ",
                                    Arrays.toString(groupArray));
                        } else {
                            LOGGER.info("Using supported configured namedGroups: {}. Unsupported namedGroups: {}. ",
                                    Arrays.toString(groupArray),
                                    Arrays.toString(unsupportedNamedGroups.toArray(EmptyArrays.EMPTY_STRINGS)));
                        }
                        namedGroups = supportedConvertedNamedGroups.toArray(EmptyArrays.EMPTY_STRINGS);
                    }
                } else {
                    namedGroups = defaultConvertedNamedGroups.toArray(EmptyArrays.EMPTY_STRINGS);
                }
            } finally {
                BoringSSL.SSLContext_free(sslCtx);
            }
        }
        NAMED_GROUPS = namedGroups;
    }

    final ClientAuth clientAuth;
    private final boolean server;
    @SuppressWarnings("deprecation")