ReferenceCountedOpenSslContext() — netty Function Reference

Source Code

handler/src/main/java/io/netty/handler/ssl/ReferenceCountedOpenSslContext.java lines 223–488

    ReferenceCountedOpenSslContext(Iterable<String> ciphers, CipherSuiteFilter cipherFilter,
                                   OpenSslApplicationProtocolNegotiator apn, int mode, Certificate[] keyCertChain,
                                   ClientAuth clientAuth, String[] protocols, boolean startTls,
                                   String endpointIdentificationAlgorithm, boolean enableOcsp,
                                   boolean leakDetection, List<SNIServerName> serverNames,
                                   ResumptionController resumptionController,
                                   Map.Entry<SslContextOption<?>, Object>... ctxOptions)
            throws SSLException {
        super(startTls, resumptionController);

        OpenSsl.ensureAvailability();

        if (enableOcsp && !OpenSsl.isOcspSupported()) {
            throw new IllegalStateException("OCSP is not supported.");
        }

        if (mode != SSL.SSL_MODE_SERVER && mode != SSL.SSL_MODE_CLIENT) {
            throw new IllegalArgumentException("mode most be either SSL.SSL_MODE_SERVER or SSL.SSL_MODE_CLIENT");
        }

        boolean tlsFalseStart = false;
        boolean useTasks = USE_TASKS;
        OpenSslPrivateKeyMethod privateKeyMethod = null;
        OpenSslAsyncPrivateKeyMethod asyncPrivateKeyMethod = null;
        OpenSslCertificateCompressionConfig certCompressionConfig = null;
        Integer maxCertificateList = null;
        Integer tmpDhKeyLength = null;
        String[] groups = OpenSsl.NAMED_GROUPS;
        if (ctxOptions != null) {
            for (Map.Entry<SslContextOption<?>, Object> ctxOpt : ctxOptions) {
                SslContextOption<?> option = ctxOpt.getKey();

                if (option == OpenSslContextOption.TLS_FALSE_START) {
                    tlsFalseStart = (Boolean) ctxOpt.getValue();
                } else if (option == OpenSslContextOption.USE_TASKS) {
                    useTasks = (Boolean) ctxOpt.getValue();
                } else if (option == OpenSslContextOption.PRIVATE_KEY_METHOD) {
                    privateKeyMethod = (OpenSslPrivateKeyMethod) ctxOpt.getValue();
                } else if (option == OpenSslContextOption.ASYNC_PRIVATE_KEY_METHOD) {
                    asyncPrivateKeyMethod = (OpenSslAsyncPrivateKeyMethod) ctxOpt.getValue();
                } else if (option == OpenSslContextOption.CERTIFICATE_COMPRESSION_ALGORITHMS) {
                    certCompressionConfig = (OpenSslCertificateCompressionConfig) ctxOpt.getValue();
                } else if (option == OpenSslContextOption.MAX_CERTIFICATE_LIST_BYTES) {
                    maxCertificateList = (Integer) ctxOpt.getValue();
                } else if (option == OpenSslContextOption.TMP_DH_KEYLENGTH) {
                    tmpDhKeyLength = (Integer) ctxOpt.getValue();
                } else if (option == OpenSslContextOption.GROUPS) {
                    String[] groupsArray = (String[]) ctxOpt.getValue();
                    Set<String> groupsSet = new LinkedHashSet<String>(groupsArray.length);
                    for (String group : groupsArray) {
                        groupsSet.add(GroupsConverter.toOpenSsl(group));
                    }
                    groups = groupsSet.toArray(EmptyArrays.EMPTY_STRINGS);
                } else if (option == OpenSslContextOption.USE_JDK_PROVIDER_SIGNATURES) {
                    // Alternative key fallback policy - handled during key material setup
                    logger.debug("Alternative key fallback policy set to: " + ctxOpt.getValue());
                } else {
                    logger.debug("Skipping unsupported " + SslContextOption.class.getSimpleName()
                            + ": " + ctxOpt.getKey());
                }
            }
        }
        if (privateKeyMethod != null && asyncPrivateKeyMethod != null) {
            throw new IllegalArgumentException("You can either only use "
                    + OpenSslAsyncPrivateKeyMethod.class.getSimpleName() + " or "
                    + OpenSslPrivateKeyMethod.class.getSimpleName());
        }

        this.tlsFalseStart = tlsFalseStart;

        leak = leakDetection ? leakDetector.track(this) : null;
        this.mode = mode;
        this.clientAuth = isServer() ? checkNotNull(clientAuth, "clientAuth") : ClientAuth.NONE;
        this.protocols = protocols == null ? OpenSsl.defaultProtocols(mode == SSL.SSL_MODE_CLIENT) : protocols;
        this.endpointIdentificationAlgorithm = endpointIdentificationAlgorithm;
        this.serverNames = serverNames;
        this.enableOcsp = enableOcsp;

        this.keyCertChain = keyCertChain == null ? null : keyCertChain.clone();

        String[] suites = checkNotNull(cipherFilter, "cipherFilter").filterCipherSuites(