SocketSslLargeCertificateTest Class — netty Architecture

Source Code

testsuite/src/main/java/io/netty/testsuite/transport/socket/SocketSslLargeCertificateTest.java lines 65–230

@EnabledIf("supportKeyManagerAndTLS13")
@TestInstance(TestInstance.Lifecycle.PER_CLASS)
@Execution(ExecutionMode.SAME_THREAD)
public class SocketSslLargeCertificateTest {

    private CertificateBuilder base;
    private X509Bundle rootCert;
    private MultiThreadIoEventLoopGroup group;

    @BeforeAll
    public void setUp() throws Exception {
        base = new CertificateBuilder()
                .ecp256()
                .setKeyUsage(true, CertificateBuilder.KeyUsage.digitalSignature,
                        CertificateBuilder.KeyUsage.keyCertSign);
        rootCert = base.copy()
                .subject("cn=root.netty.io")
                .setIsCertificateAuthority(true)
                .buildSelfSigned();
        group = new MultiThreadIoEventLoopGroup(NioIoHandler.newFactory());
    }

    @AfterAll
    public void tearDown() {
        group.shutdownGracefully(100, 1000, TimeUnit.MILLISECONDS);
    }

    public static boolean supportKeyManagerAndTLS13() {
        return OpenSsl.isAvailable() &&
                OpenSsl.supportsKeyManagerFactory() &&
                SslProvider.isTlsv13Supported(SslProvider.OPENSSL);
    }

    public static Stream<Arguments> certExtensionSizes() {
        int defaultMaxHandshakeMessageLength = 16384;
        return IntStream.rangeClosed(defaultMaxHandshakeMessageLength - 768, defaultMaxHandshakeMessageLength)
                .mapToObj(Arguments::of);
    }

    @ParameterizedTest
    @MethodSource("certExtensionSizes")
    void resumptionWithLargeCertificates(int certExtensionSize) throws Exception {
        X509Bundle serverCert = base.copy()
                .subject("cn=localhost")
                .addExtendedKeyUsageServerAuth()
                .buildIssuedBy(rootCert);
        byte[] extension = new byte[certExtensionSize];
        ThreadLocalRandom.current().nextBytes(extension);
        X509Bundle clientCert = base.copy()
                .subject("cn=client")
                .addExtendedKeyUsageClientAuth()
                .addExtensionOctetString("1.2.840.113635.100.6.2.1", false, extension)
                .buildIssuedBy(rootCert);

        TrustManagerFactory tmf = rootCert.toTrustManagerFactory();
        KeyManagerFactory serverKmf = serverCert.toKeyManagerFactory();
        KeyManagerFactory clientKmf = clientCert.toKeyManagerFactory();

        SslContext serverSsl = SslContextBuilder.forServer(serverKmf)
                .sslProvider(SslProvider.OPENSSL)
                .trustManager(tmf)
                .protocols("TLSv1.3")
                .clientAuth(ClientAuth.REQUIRE)
                .option(OpenSslContextOption.MAX_CERTIFICATE_LIST_BYTES, 32768)
                .build();
        SslContext clientSsl = SslContextBuilder.forClient()
                .sslProvider(SslProvider.OPENSSL)
                .keyManager(clientKmf)
                .trustManager(tmf)
                .protocols("TLSv1.3")
                .option(OpenSslContextOption.MAX_CERTIFICATE_LIST_BYTES, 32768)
                .serverName(new SNIHostName("localhost"))
                .endpointIdentificationAlgorithm(null)
                .build();

        final Promise<Void> completion = ImmediateEventExecutor.INSTANCE.newPromise();

        ChannelFuture bindFuture = new ServerBootstrap()
                .group(group)
                .channel(NioServerSocketChannel.class)
                .childHandler(new ChannelInitializer<Channel>() {