userEventTriggered() — netty Function Reference

Source Code

handler-ssl-ocsp/src/main/java/io/netty/handler/ssl/ocsp/OcspServerCertificateValidator.java lines 130–191

    @Override
    public void userEventTriggered(final ChannelHandlerContext ctx, final Object evt) throws Exception {
        ctx.fireUserEventTriggered(evt);

        if (evt instanceof SslHandshakeCompletionEvent) {
            SslHandshakeCompletionEvent sslHandshakeCompletionEvent = (SslHandshakeCompletionEvent) evt;

            // If TLS handshake was successful then only we will perform OCSP certificate validation.
            // If not, then just forward the event to next handler in pipeline and remove ourselves from pipeline.
            if (sslHandshakeCompletionEvent.isSuccess()) {
                Certificate[] certificates = ctx.pipeline().get(SslHandler.class)
                        .engine()
                        .getSession()
                        .getPeerCertificates();

                assert certificates.length >= 2 : "There must an end-entity certificate and issuer certificate";

                Promise<BasicOCSPResp> ocspRespPromise = OcspClient.query((X509Certificate) certificates[0],
                        (X509Certificate) certificates[1], validateNonce, ioTransport, dnsNameResolver);

                ocspRespPromise.addListener((GenericFutureListener<Future<BasicOCSPResp>>) future -> {
                    // If Future is success then we have successfully received OCSP response
                    // from OCSP responder. We will validate it now and process.
                    if (future.isSuccess()) {
                        SingleResp response = future.getNow().getResponses()[0];

                        Date current = new Date();
                        if (!(current.after(response.getThisUpdate()) &&
                                current.before(response.getNextUpdate()))) {
                            ctx.fireExceptionCaught(new IllegalStateException("OCSP Response is out-of-date"));
                        }

                        OcspResponse.Status status;
                        if (response.getCertStatus() == null) {
                            // 'null' means certificate is valid
                            status = OcspResponse.Status.VALID;
                        } else if (response.getCertStatus() instanceof RevokedStatus) {
                            status = OcspResponse.Status.REVOKED;
                        } else {
                            status = OcspResponse.Status.UNKNOWN;
                        }

                        ctx.fireUserEventTriggered(new OcspValidationEvent(
                                new OcspResponse(status, response.getThisUpdate(), response.getNextUpdate())));

                        // If Certificate is not VALID and 'closeAndThrowIfNotValid' is set
                        // to 'true' then close the channel and throw an exception.
                        if (status != OcspResponse.Status.VALID && closeAndThrowIfNotValid) {
                            ctx.channel().close();
                            // Certificate is not valid. Throw
                            ctx.fireExceptionCaught(new OCSPException(
                                    "Certificate not valid. Status: " + status));
                        }
                    } else {
                        ctx.fireExceptionCaught(future.cause());
                    }
                });
            }
            // Lets remove ourselves from the pipeline because we are done processing validation.
            ctx.pipeline().remove(this);
        }
    }