Add startTls parameter to SslContextBuilder
Motivation: There is an incoherence in terms of API when one wants to use startTls: without startTls one can use the SslContextBuilder's method newHandler, but with startTls, the developper is forced to call directly the SslHandler constructor. Modifications: Introduce startTls as a SslContextBuilder parameter as well as a member in SslContext (and thus Jdk and OpenSsl implementations!). Always use this information to call the SslHandler constructor. Use false by default, in particular in deprecated constructors of the SSL implementations. The client Context use false by default Results: Fixes #5170 and more generally homogenise the API so that everything can be done via SslContextBuilder.
This commit is contained in:
parent
b604a22395
commit
8566fd1019
@ -251,7 +251,7 @@ public final class JdkSslClientContext extends JdkSslContext {
|
|||||||
trustCertCollectionFile), trustManagerFactory,
|
trustCertCollectionFile), trustManagerFactory,
|
||||||
toX509CertificatesInternal(keyCertChainFile), toPrivateKeyInternal(keyFile, keyPassword),
|
toX509CertificatesInternal(keyCertChainFile), toPrivateKeyInternal(keyFile, keyPassword),
|
||||||
keyPassword, keyManagerFactory, sessionCacheSize, sessionTimeout), true,
|
keyPassword, keyManagerFactory, sessionCacheSize, sessionTimeout), true,
|
||||||
ciphers, cipherFilter, apn, ClientAuth.NONE);
|
ciphers, cipherFilter, apn, ClientAuth.NONE, false);
|
||||||
}
|
}
|
||||||
|
|
||||||
JdkSslClientContext(X509Certificate[] trustCertCollection, TrustManagerFactory trustManagerFactory,
|
JdkSslClientContext(X509Certificate[] trustCertCollection, TrustManagerFactory trustManagerFactory,
|
||||||
@ -260,7 +260,7 @@ public final class JdkSslClientContext extends JdkSslContext {
|
|||||||
ApplicationProtocolConfig apn, long sessionCacheSize, long sessionTimeout) throws SSLException {
|
ApplicationProtocolConfig apn, long sessionCacheSize, long sessionTimeout) throws SSLException {
|
||||||
super(newSSLContext(trustCertCollection, trustManagerFactory, keyCertChain, key, keyPassword,
|
super(newSSLContext(trustCertCollection, trustManagerFactory, keyCertChain, key, keyPassword,
|
||||||
keyManagerFactory, sessionCacheSize, sessionTimeout), true,
|
keyManagerFactory, sessionCacheSize, sessionTimeout), true,
|
||||||
ciphers, cipherFilter, toNegotiator(apn, false), ClientAuth.NONE);
|
ciphers, cipherFilter, toNegotiator(apn, false), ClientAuth.NONE, false);
|
||||||
}
|
}
|
||||||
|
|
||||||
private static SSLContext newSSLContext(X509Certificate[] trustCertCollection,
|
private static SSLContext newSSLContext(X509Certificate[] trustCertCollection,
|
||||||
|
@ -153,7 +153,7 @@ public class JdkSslContext extends SslContext {
|
|||||||
public JdkSslContext(SSLContext sslContext, boolean isClient,
|
public JdkSslContext(SSLContext sslContext, boolean isClient,
|
||||||
ClientAuth clientAuth) {
|
ClientAuth clientAuth) {
|
||||||
this(sslContext, isClient, null, IdentityCipherSuiteFilter.INSTANCE,
|
this(sslContext, isClient, null, IdentityCipherSuiteFilter.INSTANCE,
|
||||||
JdkDefaultApplicationProtocolNegotiator.INSTANCE, clientAuth);
|
JdkDefaultApplicationProtocolNegotiator.INSTANCE, clientAuth, false);
|
||||||
}
|
}
|
||||||
|
|
||||||
/**
|
/**
|
||||||
@ -169,11 +169,12 @@ public class JdkSslContext extends SslContext {
|
|||||||
public JdkSslContext(SSLContext sslContext, boolean isClient, Iterable<String> ciphers,
|
public JdkSslContext(SSLContext sslContext, boolean isClient, Iterable<String> ciphers,
|
||||||
CipherSuiteFilter cipherFilter, ApplicationProtocolConfig apn,
|
CipherSuiteFilter cipherFilter, ApplicationProtocolConfig apn,
|
||||||
ClientAuth clientAuth) {
|
ClientAuth clientAuth) {
|
||||||
this(sslContext, isClient, ciphers, cipherFilter, toNegotiator(apn, !isClient), clientAuth);
|
this(sslContext, isClient, ciphers, cipherFilter, toNegotiator(apn, !isClient), clientAuth, false);
|
||||||
}
|
}
|
||||||
|
|
||||||
JdkSslContext(SSLContext sslContext, boolean isClient, Iterable<String> ciphers, CipherSuiteFilter cipherFilter,
|
JdkSslContext(SSLContext sslContext, boolean isClient, Iterable<String> ciphers, CipherSuiteFilter cipherFilter,
|
||||||
JdkApplicationProtocolNegotiator apn, ClientAuth clientAuth) {
|
JdkApplicationProtocolNegotiator apn, ClientAuth clientAuth, boolean startTls) {
|
||||||
|
super(startTls);
|
||||||
this.apn = checkNotNull(apn, "apn");
|
this.apn = checkNotNull(apn, "apn");
|
||||||
this.clientAuth = checkNotNull(clientAuth, "clientAuth");
|
this.clientAuth = checkNotNull(clientAuth, "clientAuth");
|
||||||
cipherSuites = checkNotNull(cipherFilter, "cipherFilter").filterCipherSuites(
|
cipherSuites = checkNotNull(cipherFilter, "cipherFilter").filterCipherSuites(
|
||||||
|
@ -215,17 +215,17 @@ public final class JdkSslServerContext extends JdkSslContext {
|
|||||||
super(newSSLContext(toX509CertificatesInternal(trustCertCollectionFile), trustManagerFactory,
|
super(newSSLContext(toX509CertificatesInternal(trustCertCollectionFile), trustManagerFactory,
|
||||||
toX509CertificatesInternal(keyCertChainFile), toPrivateKeyInternal(keyFile, keyPassword),
|
toX509CertificatesInternal(keyCertChainFile), toPrivateKeyInternal(keyFile, keyPassword),
|
||||||
keyPassword, keyManagerFactory, sessionCacheSize, sessionTimeout), false,
|
keyPassword, keyManagerFactory, sessionCacheSize, sessionTimeout), false,
|
||||||
ciphers, cipherFilter, apn, ClientAuth.NONE);
|
ciphers, cipherFilter, apn, ClientAuth.NONE, false);
|
||||||
}
|
}
|
||||||
|
|
||||||
JdkSslServerContext(X509Certificate[] trustCertCollection, TrustManagerFactory trustManagerFactory,
|
JdkSslServerContext(X509Certificate[] trustCertCollection, TrustManagerFactory trustManagerFactory,
|
||||||
X509Certificate[] keyCertChain, PrivateKey key, String keyPassword,
|
X509Certificate[] keyCertChain, PrivateKey key, String keyPassword,
|
||||||
KeyManagerFactory keyManagerFactory, Iterable<String> ciphers, CipherSuiteFilter cipherFilter,
|
KeyManagerFactory keyManagerFactory, Iterable<String> ciphers, CipherSuiteFilter cipherFilter,
|
||||||
ApplicationProtocolConfig apn, long sessionCacheSize, long sessionTimeout,
|
ApplicationProtocolConfig apn, long sessionCacheSize, long sessionTimeout,
|
||||||
ClientAuth clientAuth) throws SSLException {
|
ClientAuth clientAuth, boolean startTls) throws SSLException {
|
||||||
super(newSSLContext(trustCertCollection, trustManagerFactory, keyCertChain, key,
|
super(newSSLContext(trustCertCollection, trustManagerFactory, keyCertChain, key,
|
||||||
keyPassword, keyManagerFactory, sessionCacheSize, sessionTimeout), false,
|
keyPassword, keyManagerFactory, sessionCacheSize, sessionTimeout), false,
|
||||||
ciphers, cipherFilter, toNegotiator(apn, true), clientAuth);
|
ciphers, cipherFilter, toNegotiator(apn, true), clientAuth, startTls);
|
||||||
}
|
}
|
||||||
|
|
||||||
private static SSLContext newSSLContext(X509Certificate[] trustCertCollection,
|
private static SSLContext newSSLContext(X509Certificate[] trustCertCollection,
|
||||||
|
@ -185,7 +185,7 @@ public final class OpenSslClientContext extends OpenSslContext {
|
|||||||
long sessionCacheSize, long sessionTimeout)
|
long sessionCacheSize, long sessionTimeout)
|
||||||
throws SSLException {
|
throws SSLException {
|
||||||
super(ciphers, cipherFilter, apn, sessionCacheSize, sessionTimeout, SSL.SSL_MODE_CLIENT, keyCertChain,
|
super(ciphers, cipherFilter, apn, sessionCacheSize, sessionTimeout, SSL.SSL_MODE_CLIENT, keyCertChain,
|
||||||
ClientAuth.NONE);
|
ClientAuth.NONE, false);
|
||||||
boolean success = false;
|
boolean success = false;
|
||||||
try {
|
try {
|
||||||
sessionContext = newSessionContext(this, ctx, engineMap, trustCertCollection, trustManagerFactory,
|
sessionContext = newSessionContext(this, ctx, engineMap, trustCertCollection, trustManagerFactory,
|
||||||
|
@ -29,17 +29,18 @@ import javax.net.ssl.SSLException;
|
|||||||
public abstract class OpenSslContext extends ReferenceCountedOpenSslContext {
|
public abstract class OpenSslContext extends ReferenceCountedOpenSslContext {
|
||||||
OpenSslContext(Iterable<String> ciphers, CipherSuiteFilter cipherFilter, ApplicationProtocolConfig apnCfg,
|
OpenSslContext(Iterable<String> ciphers, CipherSuiteFilter cipherFilter, ApplicationProtocolConfig apnCfg,
|
||||||
long sessionCacheSize, long sessionTimeout, int mode, Certificate[] keyCertChain,
|
long sessionCacheSize, long sessionTimeout, int mode, Certificate[] keyCertChain,
|
||||||
ClientAuth clientAuth)
|
ClientAuth clientAuth, boolean startTls)
|
||||||
throws SSLException {
|
throws SSLException {
|
||||||
super(ciphers, cipherFilter, apnCfg, sessionCacheSize, sessionTimeout, mode, keyCertChain,
|
super(ciphers, cipherFilter, apnCfg, sessionCacheSize, sessionTimeout, mode, keyCertChain,
|
||||||
clientAuth, false);
|
clientAuth, startTls, false);
|
||||||
}
|
}
|
||||||
|
|
||||||
OpenSslContext(Iterable<String> ciphers, CipherSuiteFilter cipherFilter,
|
OpenSslContext(Iterable<String> ciphers, CipherSuiteFilter cipherFilter,
|
||||||
OpenSslApplicationProtocolNegotiator apn, long sessionCacheSize,
|
OpenSslApplicationProtocolNegotiator apn, long sessionCacheSize,
|
||||||
long sessionTimeout, int mode, Certificate[] keyCertChain,
|
long sessionTimeout, int mode, Certificate[] keyCertChain,
|
||||||
ClientAuth clientAuth) throws SSLException {
|
ClientAuth clientAuth, boolean startTls) throws SSLException {
|
||||||
super(ciphers, cipherFilter, apn, sessionCacheSize, sessionTimeout, mode, keyCertChain, clientAuth, false);
|
super(ciphers, cipherFilter, apn, sessionCacheSize, sessionTimeout, mode, keyCertChain, clientAuth, startTls,
|
||||||
|
false);
|
||||||
}
|
}
|
||||||
|
|
||||||
@Override
|
@Override
|
||||||
|
@ -323,16 +323,16 @@ public final class OpenSslServerContext extends OpenSslContext {
|
|||||||
this(toX509CertificatesInternal(trustCertCollectionFile), trustManagerFactory,
|
this(toX509CertificatesInternal(trustCertCollectionFile), trustManagerFactory,
|
||||||
toX509CertificatesInternal(keyCertChainFile), toPrivateKeyInternal(keyFile, keyPassword),
|
toX509CertificatesInternal(keyCertChainFile), toPrivateKeyInternal(keyFile, keyPassword),
|
||||||
keyPassword, keyManagerFactory, ciphers, cipherFilter,
|
keyPassword, keyManagerFactory, ciphers, cipherFilter,
|
||||||
apn, sessionCacheSize, sessionTimeout, ClientAuth.NONE);
|
apn, sessionCacheSize, sessionTimeout, ClientAuth.NONE, false);
|
||||||
}
|
}
|
||||||
|
|
||||||
OpenSslServerContext(
|
OpenSslServerContext(
|
||||||
X509Certificate[] trustCertCollection, TrustManagerFactory trustManagerFactory,
|
X509Certificate[] trustCertCollection, TrustManagerFactory trustManagerFactory,
|
||||||
X509Certificate[] keyCertChain, PrivateKey key, String keyPassword, KeyManagerFactory keyManagerFactory,
|
X509Certificate[] keyCertChain, PrivateKey key, String keyPassword, KeyManagerFactory keyManagerFactory,
|
||||||
Iterable<String> ciphers, CipherSuiteFilter cipherFilter, ApplicationProtocolConfig apn,
|
Iterable<String> ciphers, CipherSuiteFilter cipherFilter, ApplicationProtocolConfig apn,
|
||||||
long sessionCacheSize, long sessionTimeout, ClientAuth clientAuth) throws SSLException {
|
long sessionCacheSize, long sessionTimeout, ClientAuth clientAuth, boolean startTls) throws SSLException {
|
||||||
this(trustCertCollection, trustManagerFactory, keyCertChain, key, keyPassword, keyManagerFactory, ciphers,
|
this(trustCertCollection, trustManagerFactory, keyCertChain, key, keyPassword, keyManagerFactory, ciphers,
|
||||||
cipherFilter, toNegotiator(apn), sessionCacheSize, sessionTimeout, clientAuth);
|
cipherFilter, toNegotiator(apn), sessionCacheSize, sessionTimeout, clientAuth, startTls);
|
||||||
}
|
}
|
||||||
|
|
||||||
@SuppressWarnings("deprecation")
|
@SuppressWarnings("deprecation")
|
||||||
@ -340,9 +340,9 @@ public final class OpenSslServerContext extends OpenSslContext {
|
|||||||
X509Certificate[] trustCertCollection, TrustManagerFactory trustManagerFactory,
|
X509Certificate[] trustCertCollection, TrustManagerFactory trustManagerFactory,
|
||||||
X509Certificate[] keyCertChain, PrivateKey key, String keyPassword, KeyManagerFactory keyManagerFactory,
|
X509Certificate[] keyCertChain, PrivateKey key, String keyPassword, KeyManagerFactory keyManagerFactory,
|
||||||
Iterable<String> ciphers, CipherSuiteFilter cipherFilter, OpenSslApplicationProtocolNegotiator apn,
|
Iterable<String> ciphers, CipherSuiteFilter cipherFilter, OpenSslApplicationProtocolNegotiator apn,
|
||||||
long sessionCacheSize, long sessionTimeout, ClientAuth clientAuth) throws SSLException {
|
long sessionCacheSize, long sessionTimeout, ClientAuth clientAuth, boolean startTls) throws SSLException {
|
||||||
super(ciphers, cipherFilter, apn, sessionCacheSize, sessionTimeout, SSL.SSL_MODE_SERVER, keyCertChain,
|
super(ciphers, cipherFilter, apn, sessionCacheSize, sessionTimeout, SSL.SSL_MODE_SERVER, keyCertChain,
|
||||||
clientAuth);
|
clientAuth, startTls);
|
||||||
// Create a new SSL_CTX and configure it.
|
// Create a new SSL_CTX and configure it.
|
||||||
boolean success = false;
|
boolean success = false;
|
||||||
try {
|
try {
|
||||||
|
@ -57,7 +57,7 @@ public final class ReferenceCountedOpenSslClientContext extends ReferenceCounted
|
|||||||
long sessionCacheSize, long sessionTimeout)
|
long sessionCacheSize, long sessionTimeout)
|
||||||
throws SSLException {
|
throws SSLException {
|
||||||
super(ciphers, cipherFilter, apn, sessionCacheSize, sessionTimeout, SSL.SSL_MODE_CLIENT, keyCertChain,
|
super(ciphers, cipherFilter, apn, sessionCacheSize, sessionTimeout, SSL.SSL_MODE_CLIENT, keyCertChain,
|
||||||
ClientAuth.NONE, true);
|
ClientAuth.NONE, false, true);
|
||||||
boolean success = false;
|
boolean success = false;
|
||||||
try {
|
try {
|
||||||
sessionContext = newSessionContext(this, ctx, engineMap, trustCertCollection, trustManagerFactory,
|
sessionContext = newSessionContext(this, ctx, engineMap, trustCertCollection, trustManagerFactory,
|
||||||
|
@ -198,16 +198,18 @@ public abstract class ReferenceCountedOpenSslContext extends SslContext implemen
|
|||||||
|
|
||||||
ReferenceCountedOpenSslContext(Iterable<String> ciphers, CipherSuiteFilter cipherFilter,
|
ReferenceCountedOpenSslContext(Iterable<String> ciphers, CipherSuiteFilter cipherFilter,
|
||||||
ApplicationProtocolConfig apnCfg, long sessionCacheSize, long sessionTimeout,
|
ApplicationProtocolConfig apnCfg, long sessionCacheSize, long sessionTimeout,
|
||||||
int mode, Certificate[] keyCertChain, ClientAuth clientAuth, boolean leakDetection)
|
int mode, Certificate[] keyCertChain, ClientAuth clientAuth, boolean startTls,
|
||||||
throws SSLException {
|
boolean leakDetection) throws SSLException {
|
||||||
this(ciphers, cipherFilter, toNegotiator(apnCfg), sessionCacheSize, sessionTimeout, mode, keyCertChain,
|
this(ciphers, cipherFilter, toNegotiator(apnCfg), sessionCacheSize, sessionTimeout, mode, keyCertChain,
|
||||||
clientAuth, leakDetection);
|
clientAuth, startTls, leakDetection);
|
||||||
}
|
}
|
||||||
|
|
||||||
ReferenceCountedOpenSslContext(Iterable<String> ciphers, CipherSuiteFilter cipherFilter,
|
ReferenceCountedOpenSslContext(Iterable<String> ciphers, CipherSuiteFilter cipherFilter,
|
||||||
OpenSslApplicationProtocolNegotiator apn, long sessionCacheSize,
|
OpenSslApplicationProtocolNegotiator apn, long sessionCacheSize,
|
||||||
long sessionTimeout, int mode, Certificate[] keyCertChain,
|
long sessionTimeout, int mode, Certificate[] keyCertChain,
|
||||||
ClientAuth clientAuth, boolean leakDetection) throws SSLException {
|
ClientAuth clientAuth, boolean startTls, boolean leakDetection) throws SSLException {
|
||||||
|
super(startTls);
|
||||||
|
|
||||||
OpenSsl.ensureAvailability();
|
OpenSsl.ensureAvailability();
|
||||||
|
|
||||||
if (mode != SSL.SSL_MODE_SERVER && mode != SSL.SSL_MODE_CLIENT) {
|
if (mode != SSL.SSL_MODE_SERVER && mode != SSL.SSL_MODE_CLIENT) {
|
||||||
|
@ -49,18 +49,18 @@ public final class ReferenceCountedOpenSslServerContext extends ReferenceCounted
|
|||||||
X509Certificate[] trustCertCollection, TrustManagerFactory trustManagerFactory,
|
X509Certificate[] trustCertCollection, TrustManagerFactory trustManagerFactory,
|
||||||
X509Certificate[] keyCertChain, PrivateKey key, String keyPassword, KeyManagerFactory keyManagerFactory,
|
X509Certificate[] keyCertChain, PrivateKey key, String keyPassword, KeyManagerFactory keyManagerFactory,
|
||||||
Iterable<String> ciphers, CipherSuiteFilter cipherFilter, ApplicationProtocolConfig apn,
|
Iterable<String> ciphers, CipherSuiteFilter cipherFilter, ApplicationProtocolConfig apn,
|
||||||
long sessionCacheSize, long sessionTimeout, ClientAuth clientAuth) throws SSLException {
|
long sessionCacheSize, long sessionTimeout, ClientAuth clientAuth, boolean startTls) throws SSLException {
|
||||||
this(trustCertCollection, trustManagerFactory, keyCertChain, key, keyPassword, keyManagerFactory, ciphers,
|
this(trustCertCollection, trustManagerFactory, keyCertChain, key, keyPassword, keyManagerFactory, ciphers,
|
||||||
cipherFilter, toNegotiator(apn), sessionCacheSize, sessionTimeout, clientAuth);
|
cipherFilter, toNegotiator(apn), sessionCacheSize, sessionTimeout, clientAuth, startTls);
|
||||||
}
|
}
|
||||||
|
|
||||||
private ReferenceCountedOpenSslServerContext(
|
private ReferenceCountedOpenSslServerContext(
|
||||||
X509Certificate[] trustCertCollection, TrustManagerFactory trustManagerFactory,
|
X509Certificate[] trustCertCollection, TrustManagerFactory trustManagerFactory,
|
||||||
X509Certificate[] keyCertChain, PrivateKey key, String keyPassword, KeyManagerFactory keyManagerFactory,
|
X509Certificate[] keyCertChain, PrivateKey key, String keyPassword, KeyManagerFactory keyManagerFactory,
|
||||||
Iterable<String> ciphers, CipherSuiteFilter cipherFilter, OpenSslApplicationProtocolNegotiator apn,
|
Iterable<String> ciphers, CipherSuiteFilter cipherFilter, OpenSslApplicationProtocolNegotiator apn,
|
||||||
long sessionCacheSize, long sessionTimeout, ClientAuth clientAuth) throws SSLException {
|
long sessionCacheSize, long sessionTimeout, ClientAuth clientAuth, boolean startTls) throws SSLException {
|
||||||
super(ciphers, cipherFilter, apn, sessionCacheSize, sessionTimeout, SSL.SSL_MODE_SERVER, keyCertChain,
|
super(ciphers, cipherFilter, apn, sessionCacheSize, sessionTimeout, SSL.SSL_MODE_SERVER, keyCertChain,
|
||||||
clientAuth, true);
|
clientAuth, startTls, true);
|
||||||
// Create a new SSL_CTX and configure it.
|
// Create a new SSL_CTX and configure it.
|
||||||
boolean success = false;
|
boolean success = false;
|
||||||
try {
|
try {
|
||||||
|
@ -340,16 +340,18 @@ public class SniHandler extends ByteToMessageDecoder implements ChannelOutboundH
|
|||||||
* It's also possible for the hostname argument to be {@code null}.
|
* It's also possible for the hostname argument to be {@code null}.
|
||||||
*/
|
*/
|
||||||
protected void replaceHandler(ChannelHandlerContext ctx, String hostname, SslContext sslContext) throws Exception {
|
protected void replaceHandler(ChannelHandlerContext ctx, String hostname, SslContext sslContext) throws Exception {
|
||||||
SSLEngine sslEngine = null;
|
SslHandler sslHandler = null;
|
||||||
try {
|
try {
|
||||||
sslEngine = sslContext.newEngine(ctx.alloc());
|
sslHandler = sslContext.newHandler(ctx.alloc());
|
||||||
ctx.pipeline().replace(this, SslHandler.class.getName(), SslContext.newHandler(sslEngine));
|
ctx.pipeline().replace(this, SslHandler.class.getName(), sslHandler);
|
||||||
sslEngine = null;
|
sslHandler = null;
|
||||||
} finally {
|
} finally {
|
||||||
// Since the SslHandler was not inserted into the pipeline the ownership of the SSLEngine was not
|
// Since the SslHandler was not inserted into the pipeline the ownership of the SSLEngine was not
|
||||||
// transferred to the SslHandler.
|
// transferred to the SslHandler.
|
||||||
// See https://github.com/netty/netty/issues/5678
|
// See https://github.com/netty/netty/issues/5678
|
||||||
ReferenceCountUtil.safeRelease(sslEngine);
|
if (sslHandler != null) {
|
||||||
|
ReferenceCountUtil.safeRelease(sslHandler.engine());
|
||||||
|
}
|
||||||
}
|
}
|
||||||
}
|
}
|
||||||
|
|
||||||
|
@ -93,6 +93,8 @@ public abstract class SslContext {
|
|||||||
}
|
}
|
||||||
}
|
}
|
||||||
|
|
||||||
|
private final boolean startTls;
|
||||||
|
|
||||||
/**
|
/**
|
||||||
* Returns the default server-side implementation provider currently in use.
|
* Returns the default server-side implementation provider currently in use.
|
||||||
*
|
*
|
||||||
@ -382,7 +384,7 @@ public abstract class SslContext {
|
|||||||
toX509Certificates(keyCertChainFile),
|
toX509Certificates(keyCertChainFile),
|
||||||
toPrivateKey(keyFile, keyPassword),
|
toPrivateKey(keyFile, keyPassword),
|
||||||
keyPassword, keyManagerFactory, ciphers, cipherFilter, apn,
|
keyPassword, keyManagerFactory, ciphers, cipherFilter, apn,
|
||||||
sessionCacheSize, sessionTimeout, ClientAuth.NONE);
|
sessionCacheSize, sessionTimeout, ClientAuth.NONE, false);
|
||||||
} catch (Exception e) {
|
} catch (Exception e) {
|
||||||
if (e instanceof SSLException) {
|
if (e instanceof SSLException) {
|
||||||
throw (SSLException) e;
|
throw (SSLException) e;
|
||||||
@ -396,7 +398,7 @@ public abstract class SslContext {
|
|||||||
X509Certificate[] trustCertCollection, TrustManagerFactory trustManagerFactory,
|
X509Certificate[] trustCertCollection, TrustManagerFactory trustManagerFactory,
|
||||||
X509Certificate[] keyCertChain, PrivateKey key, String keyPassword, KeyManagerFactory keyManagerFactory,
|
X509Certificate[] keyCertChain, PrivateKey key, String keyPassword, KeyManagerFactory keyManagerFactory,
|
||||||
Iterable<String> ciphers, CipherSuiteFilter cipherFilter, ApplicationProtocolConfig apn,
|
Iterable<String> ciphers, CipherSuiteFilter cipherFilter, ApplicationProtocolConfig apn,
|
||||||
long sessionCacheSize, long sessionTimeout, ClientAuth clientAuth) throws SSLException {
|
long sessionCacheSize, long sessionTimeout, ClientAuth clientAuth, boolean startTls) throws SSLException {
|
||||||
|
|
||||||
if (provider == null) {
|
if (provider == null) {
|
||||||
provider = defaultServerProvider();
|
provider = defaultServerProvider();
|
||||||
@ -407,17 +409,17 @@ public abstract class SslContext {
|
|||||||
return new JdkSslServerContext(
|
return new JdkSslServerContext(
|
||||||
trustCertCollection, trustManagerFactory, keyCertChain, key, keyPassword,
|
trustCertCollection, trustManagerFactory, keyCertChain, key, keyPassword,
|
||||||
keyManagerFactory, ciphers, cipherFilter, apn, sessionCacheSize, sessionTimeout,
|
keyManagerFactory, ciphers, cipherFilter, apn, sessionCacheSize, sessionTimeout,
|
||||||
clientAuth);
|
clientAuth, startTls);
|
||||||
case OPENSSL:
|
case OPENSSL:
|
||||||
return new OpenSslServerContext(
|
return new OpenSslServerContext(
|
||||||
trustCertCollection, trustManagerFactory, keyCertChain, key, keyPassword,
|
trustCertCollection, trustManagerFactory, keyCertChain, key, keyPassword,
|
||||||
keyManagerFactory, ciphers, cipherFilter, apn, sessionCacheSize, sessionTimeout,
|
keyManagerFactory, ciphers, cipherFilter, apn, sessionCacheSize, sessionTimeout,
|
||||||
clientAuth);
|
clientAuth, startTls);
|
||||||
case OPENSSL_REFCNT:
|
case OPENSSL_REFCNT:
|
||||||
return new ReferenceCountedOpenSslServerContext(
|
return new ReferenceCountedOpenSslServerContext(
|
||||||
trustCertCollection, trustManagerFactory, keyCertChain, key, keyPassword,
|
trustCertCollection, trustManagerFactory, keyCertChain, key, keyPassword,
|
||||||
keyManagerFactory, ciphers, cipherFilter, apn, sessionCacheSize, sessionTimeout,
|
keyManagerFactory, ciphers, cipherFilter, apn, sessionCacheSize, sessionTimeout,
|
||||||
clientAuth);
|
clientAuth, startTls);
|
||||||
default:
|
default:
|
||||||
throw new Error(provider.toString());
|
throw new Error(provider.toString());
|
||||||
}
|
}
|
||||||
@ -774,10 +776,19 @@ public abstract class SslContext {
|
|||||||
return apn;
|
return apn;
|
||||||
}
|
}
|
||||||
|
|
||||||
|
/**
|
||||||
|
* Creates a new instance (startTls set to <code>false</code>).
|
||||||
|
*/
|
||||||
|
protected SslContext() {
|
||||||
|
this(false);
|
||||||
|
}
|
||||||
|
|
||||||
/**
|
/**
|
||||||
* Creates a new instance.
|
* Creates a new instance.
|
||||||
*/
|
*/
|
||||||
protected SslContext() { }
|
protected SslContext(boolean startTls) {
|
||||||
|
this.startTls = startTls;
|
||||||
|
}
|
||||||
|
|
||||||
/**
|
/**
|
||||||
* Returns {@code true} if and only if this context is for server-side.
|
* Returns {@code true} if and only if this context is for server-side.
|
||||||
@ -852,7 +863,7 @@ public abstract class SslContext {
|
|||||||
* @return a new {@link SslHandler}
|
* @return a new {@link SslHandler}
|
||||||
*/
|
*/
|
||||||
public final SslHandler newHandler(ByteBufAllocator alloc) {
|
public final SslHandler newHandler(ByteBufAllocator alloc) {
|
||||||
return newHandler(newEngine(alloc));
|
return new SslHandler(newEngine(alloc), startTls);
|
||||||
}
|
}
|
||||||
|
|
||||||
/**
|
/**
|
||||||
@ -866,11 +877,7 @@ public abstract class SslContext {
|
|||||||
* @return a new {@link SslHandler}
|
* @return a new {@link SslHandler}
|
||||||
*/
|
*/
|
||||||
public final SslHandler newHandler(ByteBufAllocator alloc, String peerHost, int peerPort) {
|
public final SslHandler newHandler(ByteBufAllocator alloc, String peerHost, int peerPort) {
|
||||||
return newHandler(newEngine(alloc, peerHost, peerPort));
|
return new SslHandler(newEngine(alloc, peerHost, peerPort), startTls);
|
||||||
}
|
|
||||||
|
|
||||||
static SslHandler newHandler(SSLEngine engine) {
|
|
||||||
return new SslHandler(engine);
|
|
||||||
}
|
}
|
||||||
|
|
||||||
/**
|
/**
|
||||||
|
@ -137,6 +137,7 @@ public final class SslContextBuilder {
|
|||||||
private long sessionCacheSize;
|
private long sessionCacheSize;
|
||||||
private long sessionTimeout;
|
private long sessionTimeout;
|
||||||
private ClientAuth clientAuth = ClientAuth.NONE;
|
private ClientAuth clientAuth = ClientAuth.NONE;
|
||||||
|
private boolean startTls;
|
||||||
|
|
||||||
private SslContextBuilder(boolean forServer) {
|
private SslContextBuilder(boolean forServer) {
|
||||||
this.forServer = forServer;
|
this.forServer = forServer;
|
||||||
@ -383,6 +384,14 @@ public final class SslContextBuilder {
|
|||||||
return this;
|
return this;
|
||||||
}
|
}
|
||||||
|
|
||||||
|
/**
|
||||||
|
* {@code true} if the first write request shouldn't be encrypted.
|
||||||
|
*/
|
||||||
|
public SslContextBuilder startTls(boolean startTls) {
|
||||||
|
this.startTls = startTls;
|
||||||
|
return this;
|
||||||
|
}
|
||||||
|
|
||||||
/**
|
/**
|
||||||
* Create new {@code SslContext} instance with configured settings.
|
* Create new {@code SslContext} instance with configured settings.
|
||||||
* <p>If {@link #sslProvider(SslProvider)} is set to {@link SslProvider#OPENSSL_REFCNT} then the caller is
|
* <p>If {@link #sslProvider(SslProvider)} is set to {@link SslProvider#OPENSSL_REFCNT} then the caller is
|
||||||
@ -392,7 +401,7 @@ public final class SslContextBuilder {
|
|||||||
if (forServer) {
|
if (forServer) {
|
||||||
return SslContext.newServerContextInternal(provider, trustCertCollection,
|
return SslContext.newServerContextInternal(provider, trustCertCollection,
|
||||||
trustManagerFactory, keyCertChain, key, keyPassword, keyManagerFactory,
|
trustManagerFactory, keyCertChain, key, keyPassword, keyManagerFactory,
|
||||||
ciphers, cipherFilter, apn, sessionCacheSize, sessionTimeout, clientAuth);
|
ciphers, cipherFilter, apn, sessionCacheSize, sessionTimeout, clientAuth, startTls);
|
||||||
} else {
|
} else {
|
||||||
return SslContext.newClientContextInternal(provider, trustCertCollection,
|
return SslContext.newClientContextInternal(provider, trustCertCollection,
|
||||||
trustManagerFactory, keyCertChain, key, keyPassword, keyManagerFactory,
|
trustManagerFactory, keyCertChain, key, keyPassword, keyManagerFactory,
|
||||||
|
Loading…
Reference in New Issue
Block a user