ReferenceCountedOpenSslServerContext Class — netty Architecture

Source Code

handler/src/main/java/io/netty/handler/ssl/ReferenceCountedOpenSslServerContext.java lines 47–311

public final class ReferenceCountedOpenSslServerContext extends ReferenceCountedOpenSslContext {
    private static final InternalLogger logger =
            InternalLoggerFactory.getInstance(ReferenceCountedOpenSslServerContext.class);
    private static final byte[] ID = {'n', 'e', 't', 't', 'y'};
    private final OpenSslServerSessionContext sessionContext;

    ReferenceCountedOpenSslServerContext(
            X509Certificate[] trustCertCollection, TrustManagerFactory trustManagerFactory,
            X509Certificate[] keyCertChain, PrivateKey key, String keyPassword, KeyManagerFactory keyManagerFactory,
            Iterable<String> ciphers, CipherSuiteFilter cipherFilter, ApplicationProtocolConfig apn,
            long sessionCacheSize, long sessionTimeout, ClientAuth clientAuth, String[] protocols, boolean startTls,
            boolean enableOcsp, String keyStore, ResumptionController resumptionController,
            Map.Entry<SslContextOption<?>, Object>... options) throws SSLException {
        this(trustCertCollection, trustManagerFactory, keyCertChain, key, keyPassword, keyManagerFactory, ciphers,
                cipherFilter, toNegotiator(apn), sessionCacheSize, sessionTimeout, clientAuth, protocols, startTls,
                enableOcsp, keyStore, resumptionController, options);
    }

    ReferenceCountedOpenSslServerContext(
            X509Certificate[] trustCertCollection, TrustManagerFactory trustManagerFactory,
            X509Certificate[] keyCertChain, PrivateKey key, String keyPassword, KeyManagerFactory keyManagerFactory,
            Iterable<String> ciphers, CipherSuiteFilter cipherFilter, OpenSslApplicationProtocolNegotiator apn,
            long sessionCacheSize, long sessionTimeout, ClientAuth clientAuth, String[] protocols, boolean startTls,
            boolean enableOcsp, String keyStore, ResumptionController resumptionController,
            Map.Entry<SslContextOption<?>, Object>... options) throws SSLException {
        super(ciphers, cipherFilter, apn, SSL.SSL_MODE_SERVER, keyCertChain,
                clientAuth, protocols, startTls,
                null, // No endpoint validation for servers.
                enableOcsp, true, null, resumptionController, options);
        // Create a new SSL_CTX and configure it.
        boolean success = false;
        try {
            sessionContext = newSessionContext(this, ctx, engines, trustCertCollection, trustManagerFactory,
                    keyCertChain, key, keyPassword, keyManagerFactory, keyStore,
                    sessionCacheSize, sessionTimeout, resumptionController, isJdkSignatureFallbackEnabled(options));
            if (SERVER_ENABLE_SESSION_TICKET) {
                sessionContext.setTicketKeys();
            }
            success = true;
        } finally {
            if (!success) {
                release();
            }
        }
    }

    @Override
    public OpenSslServerSessionContext sessionContext() {
        return sessionContext;
    }

    static OpenSslServerSessionContext newSessionContext(ReferenceCountedOpenSslContext thiz, long ctx,
                                                         Map<Long, ReferenceCountedOpenSslEngine>  engines,
                                                         X509Certificate[] trustCertCollection,
                                                         TrustManagerFactory trustManagerFactory,
                                                         X509Certificate[] keyCertChain, PrivateKey key,
                                                         String keyPassword, KeyManagerFactory keyManagerFactory,
                                                         String keyStore, long sessionCacheSize, long sessionTimeout,
                                                         ResumptionController resumptionController,
                                                         boolean fallbackToJdkSignatureProviders)
            throws SSLException {
        OpenSslKeyMaterialProvider keyMaterialProvider = null;
        try {
            try {
                SSLContext.setVerify(ctx, SSL.SSL_CVERIFY_NONE, VERIFY_DEPTH);

                // Check if we have an alternative key that requires special handling
                // Only detect alternative keys when we have an actual key object that can't be accessed directly
                if (keyManagerFactory == null && key != null && key.getEncoded() == null) {
                    if (!fallbackToJdkSignatureProviders) {
                        // Alternative key without fallback enabled
                        throw new SSLException("Private key requiring alternative signature provider detected " +
                                "(such as hardware security key, smart card, or remote signing service) but " +
                                "alternative key fallback is disabled.");
                    }
                    keyMaterialProvider = setupSecurityProviderSignatureSource(thiz, ctx, keyCertChain, key,
                            manager -> new OpenSslServerCertificateCallback(engines, manager));
                } else if (!OpenSsl.useKeyManagerFactory()) {
                    if (keyManagerFactory != null) {
                        throw new IllegalArgumentException(
                                "KeyManagerFactory not supported with external keys");