ReferenceCountedOpenSslClientContext Class — netty Architecture

Source Code

handler/src/main/java/io/netty/handler/ssl/ReferenceCountedOpenSslClientContext.java lines 46–328

public final class ReferenceCountedOpenSslClientContext extends ReferenceCountedOpenSslContext {

    private static final String[] SUPPORTED_KEY_TYPES = {
            OpenSslKeyMaterialManager.KEY_TYPE_RSA,
            OpenSslKeyMaterialManager.KEY_TYPE_DH_RSA,
            OpenSslKeyMaterialManager.KEY_TYPE_EC,
            OpenSslKeyMaterialManager.KEY_TYPE_EC_RSA,
            OpenSslKeyMaterialManager.KEY_TYPE_EC_EC
    };

    private final OpenSslSessionContext sessionContext;

    ReferenceCountedOpenSslClientContext(X509Certificate[] trustCertCollection, TrustManagerFactory trustManagerFactory,
                                         X509Certificate[] keyCertChain, PrivateKey key, String keyPassword,
                                         KeyManagerFactory keyManagerFactory, Iterable<String> ciphers,
                                         CipherSuiteFilter cipherFilter, ApplicationProtocolConfig apn,
                                         String[] protocols, long sessionCacheSize, long sessionTimeout,
                                         boolean enableOcsp, String keyStore, String endpointIdentificationAlgorithm,
                                         List<SNIServerName> serverNames, ResumptionController resumptionController,
                                         Map.Entry<SslContextOption<?>, Object>... options) throws SSLException {
        super(ciphers, cipherFilter, toNegotiator(apn), SSL.SSL_MODE_CLIENT, keyCertChain,
              ClientAuth.NONE, protocols, false, endpointIdentificationAlgorithm, enableOcsp, true,
                serverNames, resumptionController, options);
        boolean success = false;
        try {
            sessionContext = newSessionContext(this, ctx, engines, trustCertCollection, trustManagerFactory,
                                               keyCertChain, key, keyPassword, keyManagerFactory, keyStore,
                                               sessionCacheSize, sessionTimeout, resumptionController,
                                               isJdkSignatureFallbackEnabled(options));
            success = true;
        } finally {
            if (!success) {
                release();
            }
        }
    }

    @Override
    public OpenSslSessionContext sessionContext() {
        return sessionContext;
    }

    static OpenSslSessionContext newSessionContext(ReferenceCountedOpenSslContext thiz, long ctx,
                                                   Map<Long, ReferenceCountedOpenSslEngine> engines,
                                                   X509Certificate[] trustCertCollection,
                                                   TrustManagerFactory trustManagerFactory,
                                                   X509Certificate[] keyCertChain, PrivateKey key,
                                                   String keyPassword, KeyManagerFactory keyManagerFactory,
                                                   String keyStore, long sessionCacheSize, long sessionTimeout,
                                                   ResumptionController resumptionController,
                                                   boolean fallbackToJdkProviders)
            throws SSLException {
        if (key == null && keyCertChain != null || key != null && keyCertChain == null) {
            throw new IllegalArgumentException(
                    "Either both keyCertChain and key needs to be null or none of them");
        }
        OpenSslKeyMaterialProvider keyMaterialProvider = null;
        try {
            try {
                // Check if we have an alternative key that requires special handling
                // Only detect alternative keys when we have an actual key object that can't be accessed directly
                if (keyManagerFactory == null && key != null && key.getEncoded() == null) {
                    if (!fallbackToJdkProviders) {
                        throw new SSLException("Private key requiring alternative signature provider detected " +
                                "(such as hardware security key, smart card, or remote signing service) but " +
                                "alternative key fallback is disabled.");
                    }
                    keyMaterialProvider = setupSecurityProviderSignatureSource(thiz, ctx, keyCertChain, key,
                            materialManager -> new OpenSslClientCertificateCallback(
                                    engines, materialManager));
                } else if (!OpenSsl.useKeyManagerFactory()) {
                    if (keyManagerFactory != null) {
                        throw new IllegalArgumentException(
                                "KeyManagerFactory not supported");
                    }
                    if (keyCertChain != null/* && key != null*/) {
                        setKeyMaterial(ctx, keyCertChain, key, keyPassword);
                    }
                } else {
                    // javadocs state that keyManagerFactory has precedent over keyCertChain
                    if (keyManagerFactory == null && keyCertChain != null) {