Use SSL.setKeyMaterial(...) to test if the KeyManagerFactory is supported (#8985)
Motivation: We use SSL.setKeyMaterial(...) in our implementation when using the KeyManagerFactory so we should also use it to detect if we can support KeyManagerFactory. Modifications: Use SSL.setKeyMaterial(...) as replacement for SSL.setCertificateBio(...) Result: Use the same method call to detect if KeyManagerFactory can be supported as we use in the real implementation.
This commit is contained in:
Norman Maurer
parent
b299cf6c7d
commit
07244a194f
@ -18,6 +18,7 @@ package io.netty.handler.ssl;
|
||||
|
||||
import io.netty.buffer.ByteBuf;
|
||||
import io.netty.buffer.ByteBufAllocator;
|
||||
import io.netty.buffer.UnpooledByteBufAllocator;
|
||||
import io.netty.internal.tcnative.Buffer;
|
||||
import io.netty.internal.tcnative.Library;
|
||||
import io.netty.internal.tcnative.SSL;
|
||||
@ -34,7 +35,6 @@ import java.io.ByteArrayInputStream;
|
||||
import java.security.AccessController;
|
||||
import java.security.PrivilegedAction;
|
||||
import java.security.cert.CertificateException;
|
||||
import java.security.cert.CertificateFactory;
|
||||
import java.security.cert.X509Certificate;
|
||||
import java.util.ArrayList;
|
||||
import java.util.Collections;
|
||||
@ -65,6 +65,72 @@ public final class OpenSsl {
|
||||
private static final boolean IS_BORINGSSL;
|
||||
static final Set<String> SUPPORTED_PROTOCOLS_SET;
|
||||
|
||||
// Bytes of self-signed certificate for netty.io and the matching private-key
|
||||
private static byte[] CERT_BYTES = {
|
||||
48, -126, 1, -93, 48, -126, 1, 12, -96, 3, 2, 1, 2, 2, 8, 31, 127, -24, 79, 67,
|
||||
-72, -128, 124, 48, 13, 6, 9, 42, -122, 72, -122, -9, 13, 1, 1, 11, 5, 0, 48,
|
||||
19, 49, 17, 48, 15, 6, 3, 85, 4, 3, 19, 8, 110, 101, 116, 116, 121, 46, 105,
|
||||
111, 48, 32, 23, 13, 49, 56, 48, 51, 50, 55, 49, 50, 52, 49, 50, 49, 90, 24,
|
||||
15, 57, 57, 57, 57, 49, 50, 51, 49, 50, 51, 53, 57, 53, 57, 90, 48, 19, 49, 17,
|
||||
48, 15, 6, 3, 85, 4, 3, 19, 8, 110, 101, 116, 116, 121, 46, 105, 111, 48, -127,
|
||||
-97, 48, 13, 6, 9, 42, -122, 72, -122, -9, 13, 1, 1, 1, 5, 0, 3, -127, -115, 0,
|
||||
48, -127, -119, 2, -127, -127, 0, -105, 81, 76, -56, -118, -35, 54, -61, -39,
|
||||
69, 77, -56, 36, -126, 15, -35, -97, 126, -59, 2, -110, -39, -122, -116, -62,
|
||||
-83, -43, -102, 98, 46, -33, 6, 33, 74, -68, -121, -64, -9, -3, 45, 102, -121,
|
||||
50, -86, 93, 125, -82, -110, -2, -22, -114, 18, -93, 51, -86, 63, -63, 46, 96,
|
||||
-37, 16, 105, -11, 96, -97, -77, 98, -2, 117, -66, -118, 31, -62, -94, 109, -61,
|
||||
-82, 31, -103, 29, -53, -6, 47, 13, -78, -30, -128, 95, -76, 18, 5, -43, -80,
|
||||
51, 22, 39, 11, -93, 101, -66, -105, -68, -110, -80, 89, -105, -116, 10, -42,
|
||||
16, 51, 4, 113, -23, 69, -111, 85, -61, -59, -33, -83, 5, 114, -112, 34, 34,
|
||||
-107, 79, 2, 3, 1, 0, 1, 48, 13, 6, 9, 42, -122, 72, -122, -9, 13, 1, 1, 11, 5,
|
||||
0, 3, -127, -127, 0, 8, -18, -42, -73, 54, 95, 39, -58, -98, 62, -26, 50, -3,
|
||||
71, -125, -128, -19, -87, -46, -85, 72, 17, 46, 75, -104, 125, -51, 27, 123,
|
||||
84, 34, 100, -112, 122, -28, 29, -33, 127, -20, -54, 30, -77, 109, -81, -3,
|
||||
-73, -113, 17, 28, 98, 127, 77, 53, -76, -49, -119, 98, 113, 71, -107, -33,
|
||||
-57, 37, -55, -60, 89, 65, 83, -96, -54, -22, 122, 10, -11, 11, -67, -58, -57,
|
||||
85, -119, 46, -26, -41, 15, -77, 19, 4, -32, -64, -12, 49, 104, -101, 42, 88,
|
||||
75, 27, 41, 122, 126, 70, -99, -91, -33, -36, -57, -63, -7, 94, -71, -15, -108,
|
||||
59, -32, 50, 47, -35, 71, 104, 47, 97, 43, 93, -128, -65, 11, 29, -88
|
||||
};
|
||||
private static byte[] KEY_BYTES = {
|
||||
48, -126, 2, 120, 2, 1, 0, 48, 13, 6, 9, 42, -122, 72, -122, -9, 13, 1, 1, 1, 5,
|
||||
0, 4, -126, 2, 98, 48, -126, 2, 94, 2, 1, 0, 2, -127, -127, 0, -105, 81, 76, -56,
|
||||
-118, -35, 54, -61, -39, 69, 77, -56, 36, -126, 15, -35, -97, 126, -59, 2, -110,
|
||||
-39, -122, -116, -62, -83, -43, -102, 98, 46, -33, 6, 33, 74, -68, -121, -64, -9,
|
||||
-3, 45, 102, -121, 50, -86, 93, 125, -82, -110, -2, -22, -114, 18, -93, 51, -86,
|
||||
63, -63, 46, 96, -37, 16, 105, -11, 96, -97, -77, 98, -2, 117, -66, -118, 31, -62,
|
||||
-94, 109, -61, -82, 31, -103, 29, -53, -6, 47, 13, -78, -30, -128, 95, -76, 18, 5,
|
||||
-43, -80, 51, 22, 39, 11, -93, 101, -66, -105, -68, -110, -80, 89, -105, -116, 10,
|
||||
-42, 16, 51, 4, 113, -23, 69, -111, 85, -61, -59, -33, -83, 5, 114, -112, 34, 34,
|
||||
-107, 79, 2, 3, 1, 0, 1, 2, -127, -128, 68, 52, 93, 11, -73, -85, -26, 87, 120, -61,
|
||||
-120, 63, -62, 84, -19, -103, -45, -98, 108, 102, -80, -110, 99, -41, 102, -104,
|
||||
-68, 67, 14, 38, 90, 88, -123, 1, 14, -31, -111, -43, 53, -59, 21, 5, -77, -116,
|
||||
-98, -1, 91, -124, -34, 106, 19, 7, -53, -112, 42, 24, -6, -106, 81, 9, -20, -24,
|
||||
21, -75, 119, -49, 70, 70, -106, -6, -56, -6, 28, 104, 33, -104, 27, 65, -75, -12,
|
||||
-93, 75, 87, 82, -64, -70, -127, 60, 91, -60, -76, 13, -115, 19, -77, -16, -3, 119,
|
||||
-88, 111, 96, 78, -103, -30, -87, -118, 106, -7, 97, -21, 20, -31, -43, 28, -18,
|
||||
-2, 117, 63, 111, -71, 84, -77, -42, 78, 20, -28, -54, -63, 2, 65, 0, -23, 7, -72,
|
||||
-18, -122, 34, 90, 107, -103, 119, 105, 46, -10, -109, -7, 3, 21, 16, 91, 110, -13,
|
||||
120, 95, 122, -77, -60, 18, -52, 103, -1, -90, 39, -3, 99, -10, 18, -14, 47, -104,
|
||||
-87, -110, 7, -48, -23, -37, 104, -125, 97, 88, -1, -86, -90, -11, -79, -20, 41,
|
||||
-128, 15, -35, -104, 60, 25, 121, -41, 2, 65, 0, -90, 59, -92, -31, -117, 35, -79,
|
||||
16, -76, 57, 90, 15, -6, 84, 47, -113, -42, 19, -56, 121, 123, -121, -91, 91, -37,
|
||||
-71, 78, -40, 12, 82, -25, -125, -58, 115, -123, 97, 10, -99, -59, 38, -48, -103,
|
||||
-128, -125, 36, 108, 18, -86, -85, -17, -40, 8, -14, -108, -24, -20, 63, -59, -81,
|
||||
5, 11, 35, 1, 73, 2, 65, 0, -30, 11, -8, -85, -128, 120, 80, -121, -15, -35, -80,
|
||||
-83, -70, -55, 125, -109, 44, -38, -86, 39, 45, -116, 69, -22, 75, -7, 86, 86, -20,
|
||||
71, 68, -111, -92, 46, 84, 100, -70, -125, -53, 46, 42, -106, -28, 100, 5, -49, 19,
|
||||
42, -38, 95, 95, -42, 7, -99, -23, 61, -76, -103, 47, 86, -34, 109, -60, 15, 2, 65,
|
||||
0, -126, -72, -22, -101, 87, 0, -75, 80, 110, 121, -97, 98, 107, 55, -30, -61, 24,
|
||||
-43, 43, -44, -92, -104, -14, 39, 127, 109, -123, 28, 14, -20, -17, 20, -56, 109,
|
||||
-75, -40, -81, 49, -116, -123, 78, -117, 55, -19, 105, 41, -9, -81, -15, 79, -58,
|
||||
50, -101, 25, 16, -26, 31, -20, 68, 11, 18, 75, -17, -55, 2, 65, 0, -126, -11, 56,
|
||||
-83, -60, 1, -125, 109, 74, 74, -1, -17, 54, 111, -111, 100, 125, 21, 77, 34, 119,
|
||||
-33, 23, -13, 66, 74, -78, 80, -67, 57, -42, 65, 65, 58, 96, 0, 72, -122, 3, -78,
|
||||
119, 68, -76, 5, 50, 37, 51, 10, -54, 54, -102, 90, -6, 127, -93, 97, 53, 24, 57,
|
||||
77, 81, 53, -13, -127
|
||||
};
|
||||
|
||||
static {
|
||||
Throwable cause = null;
|
||||
|
||||
@ -142,6 +208,9 @@ public final class OpenSsl {
|
||||
try {
|
||||
final long sslCtx = SSLContext.make(SSL.SSL_PROTOCOL_ALL, SSL.SSL_MODE_SERVER);
|
||||
long certBio = 0;
|
||||
long keyBio = 0;
|
||||
long cert = 0;
|
||||
long key = 0;
|
||||
try {
|
||||
try {
|
||||
StringBuilder tlsv13Ciphers = new StringBuilder();
|
||||
@ -194,10 +263,18 @@ public final class OpenSsl {
|
||||
} catch (Throwable ignore) {
|
||||
logger.debug("Hostname Verification not supported.");
|
||||
}
|
||||
|
||||
PemEncoded privateKey = PemPrivateKey.toPEM(UnpooledByteBufAllocator.DEFAULT, true, KEY_BYTES);
|
||||
try {
|
||||
X509Certificate certificate = selfSignedCertificate();
|
||||
certBio = ReferenceCountedOpenSslContext.toBIO(ByteBufAllocator.DEFAULT, certificate);
|
||||
SSL.setCertificateChainBio(ssl, certBio, false);
|
||||
cert = SSL.parseX509Chain(certBio);
|
||||
|
||||
keyBio = ReferenceCountedOpenSslContext.toBIO(
|
||||
UnpooledByteBufAllocator.DEFAULT, privateKey.retain());
|
||||
key = SSL.parsePrivateKey(keyBio, null);
|
||||
|
||||
SSL.setKeyMaterial(ssl, cert, key);
|
||||
supportsKeyManagerFactory = true;
|
||||
try {
|
||||
useKeyManagerFactory = AccessController.doPrivileged((PrivilegedAction<Boolean>) () ->
|
||||
@ -208,12 +285,23 @@ public final class OpenSsl {
|
||||
}
|
||||
} catch (Throwable ignore) {
|
||||
logger.debug("KeyManagerFactory not supported.");
|
||||
} finally {
|
||||
privateKey.release();
|
||||
}
|
||||
} finally {
|
||||
SSL.freeSSL(ssl);
|
||||
if (certBio != 0) {
|
||||
SSL.freeBIO(certBio);
|
||||
}
|
||||
if (keyBio != 0) {
|
||||
SSL.freeBIO(keyBio);
|
||||
}
|
||||
if (cert != 0) {
|
||||
SSL.freeX509Chain(cert);
|
||||
}
|
||||
if (key != 0) {
|
||||
SSL.freePrivateKey(key);
|
||||
}
|
||||
}
|
||||
} finally {
|
||||
SSLContext.free(sslCtx);
|
||||
@ -306,39 +394,7 @@ public final class OpenSsl {
|
||||
* Returns a self-signed {@link X509Certificate} for {@code netty.io}.
|
||||
*/
|
||||
static X509Certificate selfSignedCertificate() throws CertificateException {
|
||||
// Bytes of self-signed certificate for netty.io
|
||||
byte[] certBytes = {
|
||||
48, -126, 1, -92, 48, -126, 1, 13, -96, 3, 2, 1, 2, 2, 9, 0, -9, 61,
|
||||
44, 121, -118, -4, -45, -120, 48, 13, 6, 9, 42, -122, 72, -122,
|
||||
-9, 13, 1, 1, 5, 5, 0, 48, 19, 49, 17, 48, 15, 6, 3, 85, 4, 3, 19,
|
||||
8, 110, 101, 116, 116, 121, 46, 105, 111, 48, 32, 23, 13, 49, 55,
|
||||
49, 48, 50, 48, 49, 56, 49, 54, 51, 54, 90, 24, 15, 57, 57, 57, 57,
|
||||
49, 50, 51, 49, 50, 51, 53, 57, 53, 57, 90, 48, 19, 49, 17, 48, 15,
|
||||
6, 3, 85, 4, 3, 19, 8, 110, 101, 116, 116, 121, 46, 105, 111, 48, -127,
|
||||
-97, 48, 13, 6, 9, 42, -122, 72, -122, -9, 13, 1, 1, 1, 5, 0, 3, -127,
|
||||
-115, 0, 48, -127, -119, 2, -127, -127, 0, -116, 37, 122, -53, 28, 46,
|
||||
13, -90, -14, -33, 111, -108, -41, 59, 90, 124, 113, -112, -66, -17,
|
||||
-102, 44, 13, 7, -33, -28, 24, -79, -126, -76, 40, 111, -126, -103,
|
||||
-102, 34, 11, 45, 16, -38, 63, 24, 80, 24, 76, 88, -93, 96, 11, 38,
|
||||
-19, -64, -11, 87, -49, -52, -65, 24, 36, -22, 53, 8, -42, 14, -121,
|
||||
114, 6, 17, -82, 10, 92, -91, -127, 81, -12, -75, 105, -10, -106, 91,
|
||||
-38, 111, 50, 57, -97, -125, 109, 42, -87, -1, -19, 80, 78, 49, -97, -4,
|
||||
23, -2, -103, 122, -107, -43, 4, -31, -21, 90, 39, -9, -106, 34, -101,
|
||||
-116, 31, -94, -84, 80, -6, -78, -33, 87, -90, 31, 103, 100, 56, -103,
|
||||
-5, 11, 2, 3, 1, 0, 1, 48, 13, 6, 9, 42, -122, 72, -122, -9, 13, 1, 1,
|
||||
5, 5, 0, 3, -127, -127, 0, 112, 45, -73, 5, 64, 49, 59, 101, 51, 73,
|
||||
-96, 62, 23, -84, 90, -41, -58, 83, -20, -72, 38, 123, -108, -45, 28,
|
||||
96, -122, -18, 30, 42, 86, 87, -87, -28, 107, 110, 11, -59, 91, 100,
|
||||
101, -18, 26, -103, -78, -80, -3, 38, 113, 83, -48, -108, 109, 41, -15,
|
||||
6, 112, 105, 7, -46, -11, -3, -51, 40, -66, -73, -83, -46, -94, -121,
|
||||
-88, 51, -106, -77, 109, 53, -7, 123, 91, 75, -105, -22, 64, 121, -72,
|
||||
-59, -21, -44, 84, 12, 9, 120, 21, -26, 13, 49, -81, -58, -47, 117,
|
||||
-44, -18, -17, 124, 49, -48, 19, 16, -41, 71, -52, -107, 99, -19, -29,
|
||||
105, -93, -71, -38, -97, -128, -2, 118, 119, 49, -126, 109, 119 };
|
||||
|
||||
CertificateFactory cf = CertificateFactory.getInstance("X.509");
|
||||
return (X509Certificate) cf.generateCertificate(
|
||||
new ByteArrayInputStream(certBytes));
|
||||
return (X509Certificate) SslContext.X509_CERT_FACTORY.generateCertificate(new ByteArrayInputStream(CERT_BYTES));
|
||||
}
|
||||
|
||||
private static boolean doesSupportOcsp() {
|
||||
|
||||
@ -66,6 +66,10 @@ public final class PemPrivateKey extends AbstractReferenceCounted implements Pri
|
||||
throw new IllegalArgumentException(key.getClass().getName() + " does not support encoding");
|
||||
}
|
||||
|
||||
return toPEM(allocator, useDirect, bytes);
|
||||
}
|
||||
|
||||
static PemEncoded toPEM(ByteBufAllocator allocator, boolean useDirect, byte[] bytes) {
|
||||
ByteBuf encoded = Unpooled.wrappedBuffer(bytes);
|
||||
try {
|
||||
ByteBuf base64 = SslUtils.toBase64(allocator, encoded);
|
||||
|
||||
Loading…
Reference in New Issue
Block a user