QuicheQuicSslSession Class — netty Architecture

Source Code

codec-classes-quic/src/main/java/io/netty/handler/codec/quic/QuicheQuicSslEngine.java lines 285–593

    private final class QuicheQuicSslSession implements SSLSession {
        private X509Certificate[] x509PeerCerts;
        private Certificate[] peerCerts;
        private String protocol;
        private String cipher;
        private byte[] id;
        private long creationTime = -1;
        private long timeout = -1;
        private boolean invalid;
        private long lastAccessedTime = -1;

        // lazy init for memory reasons
        private Map<String, Object> values;

        private boolean isEmpty(Object @Nullable [] arr) {
            return arr == null || arr.length == 0;
        }
        private boolean isEmpty(byte @Nullable [] arr) {
            return arr == null || arr.length == 0;
        }

        void handshakeFinished(byte[] id, String cipher, String protocol, byte[] peerCertificate,
                               byte[][] peerCertificateChain, long creationTime, long timeout) {
            synchronized (QuicheQuicSslEngine.this) {
                initPeerCerts(peerCertificateChain, peerCertificate);
                this.id = id;
                this.cipher = cipher;
                this.protocol = protocol;
                this.creationTime = creationTime * 1000L;
                this.timeout = timeout * 1000L;
                lastAccessedTime = System.currentTimeMillis();
            }
        }

        void removeFromCacheIfInvalid() {
            if (!isValid()) {
                // Shouldn't be re-used again
                removeFromCache();
            }
        }

        private void removeFromCache() {
            // Shouldn't be re-used again
            QuicClientSessionCache cache = ctx.getSessionCache();
            if (cache != null) {
                cache.removeSession(getPeerHost(), getPeerPort());
            }
        }

        /**
         * Init peer certificates that can be obtained via {@link #getPeerCertificateChain()}
         * and {@link #getPeerCertificates()}.
         */
        private void initPeerCerts(byte[][] chain, byte[] clientCert) {
            // Return the full chain from the JNI layer.
            if (getUseClientMode()) {
                if (isEmpty(chain)) {
                    peerCerts = EmptyArrays.EMPTY_CERTIFICATES;
                    x509PeerCerts = EmptyArrays.EMPTY_JAVAX_X509_CERTIFICATES;
                } else {
                    peerCerts = new Certificate[chain.length];
                    x509PeerCerts = new X509Certificate[chain.length];
                    initCerts(chain, 0);
                }
            } else {
                // if used on the server side SSL_get_peer_cert_chain(...) will not include the remote peer
                // certificate. We use SSL_get_peer_certificate to get it in this case and add it to our
                // array later.
                //
                // See https://www.openssl.org/docs/ssl/SSL_get_peer_cert_chain.html
                if (isEmpty(clientCert)) {
                    peerCerts = EmptyArrays.EMPTY_CERTIFICATES;
                    x509PeerCerts = EmptyArrays.EMPTY_JAVAX_X509_CERTIFICATES;
                } else {
                    if (isEmpty(chain)) {
                        peerCerts = new Certificate[] {new LazyX509Certificate(clientCert)};
                        x509PeerCerts = new X509Certificate[] {new LazyJavaxX509Certificate(clientCert)};
                    } else {
                        peerCerts = new Certificate[chain.length + 1];
                        x509PeerCerts = new X509Certificate[chain.length + 1];
                        peerCerts[0] = new LazyX509Certificate(clientCert);