Remove synchronized (ReferenceCountedOpenSslContext.class) blocks

Motivation:

We had some useless synchronized (ReferenceCountedOpenSslContext.class) blocks in our code which could slow down concurrent collecting and creating of ReferenceCountedOpenSslContext instances. Beside this we missed a few guards.

Modifications:

Use ReadWriteLock to correctly guard. A ReadWriteLock was choosen as SSL.newSSL(...) will be called from multiple threads all the time so using synchronized would be worse and there would be no way for the JIT to optimize it away

Result:

Faster concurrent creating and collecting of ReferenceCountedOpenSslContext instances and correctly guard in all cases.
This commit is contained in:
Norman Maurer 2017-06-14 20:18:50 +02:00
parent 2af895994d
commit e597756a56
7 changed files with 408 additions and 225 deletions

View File

@ -18,6 +18,8 @@ package io.netty.handler.ssl;
import io.netty.internal.tcnative.SSL; import io.netty.internal.tcnative.SSL;
import io.netty.internal.tcnative.SSLContext; import io.netty.internal.tcnative.SSLContext;
import java.util.concurrent.locks.Lock;
/** /**
* {@link OpenSslSessionContext} implementation which offers extra methods which are only useful for the server-side. * {@link OpenSslSessionContext} implementation which offers extra methods which are only useful for the server-side.
@ -32,12 +34,24 @@ public final class OpenSslServerSessionContext extends OpenSslSessionContext {
if (seconds < 0) { if (seconds < 0) {
throw new IllegalArgumentException(); throw new IllegalArgumentException();
} }
SSLContext.setSessionCacheTimeout(context.ctx, seconds); Lock writerLock = context.ctxLock.writeLock();
writerLock.lock();
try {
SSLContext.setSessionCacheTimeout(context.ctx, seconds);
} finally {
writerLock.unlock();
}
} }
@Override @Override
public int getSessionTimeout() { public int getSessionTimeout() {
return (int) SSLContext.getSessionCacheTimeout(context.ctx); Lock readerLock = context.ctxLock.readLock();
readerLock.lock();
try {
return (int) SSLContext.getSessionCacheTimeout(context.ctx);
} finally {
readerLock.unlock();
}
} }
@Override @Override
@ -45,23 +59,48 @@ public final class OpenSslServerSessionContext extends OpenSslSessionContext {
if (size < 0) { if (size < 0) {
throw new IllegalArgumentException(); throw new IllegalArgumentException();
} }
SSLContext.setSessionCacheSize(context.ctx, size); Lock writerLock = context.ctxLock.writeLock();
writerLock.lock();
try {
SSLContext.setSessionCacheSize(context.ctx, size);
} finally {
writerLock.unlock();
}
} }
@Override @Override
public int getSessionCacheSize() { public int getSessionCacheSize() {
return (int) SSLContext.getSessionCacheSize(context.ctx); Lock readerLock = context.ctxLock.readLock();
readerLock.lock();
try {
return (int) SSLContext.getSessionCacheSize(context.ctx);
} finally {
readerLock.unlock();
}
} }
@Override @Override
public void setSessionCacheEnabled(boolean enabled) { public void setSessionCacheEnabled(boolean enabled) {
long mode = enabled ? SSL.SSL_SESS_CACHE_SERVER : SSL.SSL_SESS_CACHE_OFF; long mode = enabled ? SSL.SSL_SESS_CACHE_SERVER : SSL.SSL_SESS_CACHE_OFF;
SSLContext.setSessionCacheMode(context.ctx, mode);
Lock writerLock = context.ctxLock.writeLock();
writerLock.lock();
try {
SSLContext.setSessionCacheMode(context.ctx, mode);
} finally {
writerLock.unlock();
}
} }
@Override @Override
public boolean isSessionCacheEnabled() { public boolean isSessionCacheEnabled() {
return SSLContext.getSessionCacheMode(context.ctx) == SSL.SSL_SESS_CACHE_SERVER; Lock readerLock = context.ctxLock.readLock();
readerLock.lock();
try {
return SSLContext.getSessionCacheMode(context.ctx) == SSL.SSL_SESS_CACHE_SERVER;
} finally {
readerLock.unlock();
}
} }
/** /**
@ -74,6 +113,12 @@ public final class OpenSslServerSessionContext extends OpenSslSessionContext {
* @return {@code true} if success, {@code false} otherwise. * @return {@code true} if success, {@code false} otherwise.
*/ */
public boolean setSessionIdContext(byte[] sidCtx) { public boolean setSessionIdContext(byte[] sidCtx) {
return SSLContext.setSessionIdContext(context.ctx, sidCtx); Lock writerLock = context.ctxLock.writeLock();
writerLock.lock();
try {
return SSLContext.setSessionIdContext(context.ctx, sidCtx);
} finally {
writerLock.unlock();
}
} }
} }

View File

@ -25,6 +25,7 @@ import javax.net.ssl.SSLSessionContext;
import java.util.Arrays; import java.util.Arrays;
import java.util.Enumeration; import java.util.Enumeration;
import java.util.NoSuchElementException; import java.util.NoSuchElementException;
import java.util.concurrent.locks.Lock;
/** /**
* OpenSSL specific {@link SSLSessionContext} implementation. * OpenSSL specific {@link SSLSessionContext} implementation.
@ -76,8 +77,14 @@ public abstract class OpenSslSessionContext implements SSLSessionContext {
a += SessionTicketKey.AES_KEY_SIZE; a += SessionTicketKey.AES_KEY_SIZE;
tickets[i] = new SessionTicketKey(name, hmacKey, aesKey); tickets[i] = new SessionTicketKey(name, hmacKey, aesKey);
} }
SSLContext.clearOptions(context.ctx, SSL.SSL_OP_NO_TICKET); Lock writerLock = context.ctxLock.writeLock();
SSLContext.setSessionTicketKeys(context.ctx, tickets); writerLock.lock();
try {
SSLContext.clearOptions(context.ctx, SSL.SSL_OP_NO_TICKET);
SSLContext.setSessionTicketKeys(context.ctx, tickets);
} finally {
writerLock.unlock();
}
} }
/** /**
@ -85,12 +92,18 @@ public abstract class OpenSslSessionContext implements SSLSessionContext {
*/ */
public void setTicketKeys(OpenSslSessionTicketKey... keys) { public void setTicketKeys(OpenSslSessionTicketKey... keys) {
ObjectUtil.checkNotNull(keys, "keys"); ObjectUtil.checkNotNull(keys, "keys");
SSLContext.clearOptions(context.ctx, SSL.SSL_OP_NO_TICKET);
SessionTicketKey[] ticketKeys = new SessionTicketKey[keys.length]; SessionTicketKey[] ticketKeys = new SessionTicketKey[keys.length];
for (int i = 0; i < ticketKeys.length; i++) { for (int i = 0; i < ticketKeys.length; i++) {
ticketKeys[i] = keys[i].key; ticketKeys[i] = keys[i].key;
} }
SSLContext.setSessionTicketKeys(context.ctx, ticketKeys); Lock writerLock = context.ctxLock.writeLock();
writerLock.lock();
try {
SSLContext.clearOptions(context.ctx, SSL.SSL_OP_NO_TICKET);
SSLContext.setSessionTicketKeys(context.ctx, ticketKeys);
} finally {
writerLock.unlock();
}
} }
/** /**

View File

@ -18,6 +18,8 @@ package io.netty.handler.ssl;
import io.netty.internal.tcnative.SSLContext; import io.netty.internal.tcnative.SSLContext;
import java.util.concurrent.locks.Lock;
/** /**
* Stats exposed by an OpenSSL session context. * Stats exposed by an OpenSSL session context.
* *
@ -39,49 +41,91 @@ public final class OpenSslSessionStats {
* Returns the current number of sessions in the internal session cache. * Returns the current number of sessions in the internal session cache.
*/ */
public long number() { public long number() {
return SSLContext.sessionNumber(context.ctx); Lock readerLock = context.ctxLock.readLock();
readerLock.lock();
try {
return SSLContext.sessionNumber(context.ctx);
} finally {
readerLock.unlock();
}
} }
/** /**
* Returns the number of started SSL/TLS handshakes in client mode. * Returns the number of started SSL/TLS handshakes in client mode.
*/ */
public long connect() { public long connect() {
return SSLContext.sessionConnect(context.ctx); Lock readerLock = context.ctxLock.readLock();
readerLock.lock();
try {
return SSLContext.sessionConnect(context.ctx);
} finally {
readerLock.unlock();
}
} }
/** /**
* Returns the number of successfully established SSL/TLS sessions in client mode. * Returns the number of successfully established SSL/TLS sessions in client mode.
*/ */
public long connectGood() { public long connectGood() {
return SSLContext.sessionConnectGood(context.ctx); Lock readerLock = context.ctxLock.readLock();
readerLock.lock();
try {
return SSLContext.sessionConnectGood(context.ctx);
} finally {
readerLock.unlock();
}
} }
/** /**
* Returns the number of start renegotiations in client mode. * Returns the number of start renegotiations in client mode.
*/ */
public long connectRenegotiate() { public long connectRenegotiate() {
return SSLContext.sessionConnectRenegotiate(context.ctx); Lock readerLock = context.ctxLock.readLock();
readerLock.lock();
try {
return SSLContext.sessionConnectRenegotiate(context.ctx);
} finally {
readerLock.unlock();
}
} }
/** /**
* Returns the number of started SSL/TLS handshakes in server mode. * Returns the number of started SSL/TLS handshakes in server mode.
*/ */
public long accept() { public long accept() {
return SSLContext.sessionAccept(context.ctx); Lock readerLock = context.ctxLock.readLock();
readerLock.lock();
try {
return SSLContext.sessionAccept(context.ctx);
} finally {
readerLock.unlock();
}
} }
/** /**
* Returns the number of successfully established SSL/TLS sessions in server mode. * Returns the number of successfully established SSL/TLS sessions in server mode.
*/ */
public long acceptGood() { public long acceptGood() {
return SSLContext.sessionAcceptGood(context.ctx); Lock readerLock = context.ctxLock.readLock();
readerLock.lock();
try {
return SSLContext.sessionAcceptGood(context.ctx);
} finally {
readerLock.unlock();
}
} }
/** /**
* Returns the number of start renegotiations in server mode. * Returns the number of start renegotiations in server mode.
*/ */
public long acceptRenegotiate() { public long acceptRenegotiate() {
return SSLContext.sessionAcceptRenegotiate(context.ctx); Lock readerLock = context.ctxLock.readLock();
readerLock.lock();
try {
return SSLContext.sessionAcceptRenegotiate(context.ctx);
} finally {
readerLock.unlock();
}
} }
/** /**
@ -90,14 +134,26 @@ public final class OpenSslSessionStats {
* external cache is counted as a hit. * external cache is counted as a hit.
*/ */
public long hits() { public long hits() {
return SSLContext.sessionHits(context.ctx); Lock readerLock = context.ctxLock.readLock();
readerLock.lock();
try {
return SSLContext.sessionHits(context.ctx);
} finally {
readerLock.unlock();
}
} }
/** /**
* Returns the number of successfully retrieved sessions from the external session cache in server mode. * Returns the number of successfully retrieved sessions from the external session cache in server mode.
*/ */
public long cbHits() { public long cbHits() {
return SSLContext.sessionCbHits(context.ctx); Lock readerLock = context.ctxLock.readLock();
readerLock.lock();
try {
return SSLContext.sessionCbHits(context.ctx);
} finally {
readerLock.unlock();
}
} }
/** /**
@ -105,7 +161,13 @@ public final class OpenSslSessionStats {
* in server mode. * in server mode.
*/ */
public long misses() { public long misses() {
return SSLContext.sessionMisses(context.ctx); Lock readerLock = context.ctxLock.readLock();
readerLock.lock();
try {
return SSLContext.sessionMisses(context.ctx);
} finally {
readerLock.unlock();
}
} }
/** /**
@ -114,28 +176,52 @@ public final class OpenSslSessionStats {
* count. * count.
*/ */
public long timeouts() { public long timeouts() {
return SSLContext.sessionTimeouts(context.ctx); Lock readerLock = context.ctxLock.readLock();
readerLock.lock();
try {
return SSLContext.sessionTimeouts(context.ctx);
} finally {
readerLock.unlock();
}
} }
/** /**
* Returns the number of sessions that were removed because the maximum session cache size was exceeded. * Returns the number of sessions that were removed because the maximum session cache size was exceeded.
*/ */
public long cacheFull() { public long cacheFull() {
return SSLContext.sessionCacheFull(context.ctx); Lock readerLock = context.ctxLock.readLock();
readerLock.lock();
try {
return SSLContext.sessionCacheFull(context.ctx);
} finally {
readerLock.unlock();
}
} }
/** /**
* Returns the number of times a client presented a ticket that did not match any key in the list. * Returns the number of times a client presented a ticket that did not match any key in the list.
*/ */
public long ticketKeyFail() { public long ticketKeyFail() {
return SSLContext.sessionTicketKeyFail(context.ctx); Lock readerLock = context.ctxLock.readLock();
readerLock.lock();
try {
return SSLContext.sessionTicketKeyFail(context.ctx);
} finally {
readerLock.unlock();
}
} }
/** /**
* Returns the number of times a client did not present a ticket and we issued a new one * Returns the number of times a client did not present a ticket and we issued a new one
*/ */
public long ticketKeyNew() { public long ticketKeyNew() {
return SSLContext.sessionTicketKeyNew(context.ctx); Lock readerLock = context.ctxLock.readLock();
readerLock.lock();
try {
return SSLContext.sessionTicketKeyNew(context.ctx);
} finally {
readerLock.unlock();
}
} }
/** /**
@ -143,13 +229,25 @@ public final class OpenSslSessionStats {
* and we upgraded to the primary key. * and we upgraded to the primary key.
*/ */
public long ticketKeyRenew() { public long ticketKeyRenew() {
return SSLContext.sessionTicketKeyRenew(context.ctx); Lock readerLock = context.ctxLock.readLock();
readerLock.lock();
try {
return SSLContext.sessionTicketKeyRenew(context.ctx);
} finally {
readerLock.unlock();
}
} }
/** /**
* Returns the number of times a client presented a ticket derived from the primary key. * Returns the number of times a client presented a ticket derived from the primary key.
*/ */
public long ticketKeyResume() { public long ticketKeyResume() {
return SSLContext.sessionTicketKeyResume(context.ctx); Lock readerLock = context.ctxLock.readLock();
readerLock.lock();
try {
return SSLContext.sessionTicketKeyResume(context.ctx);
} finally {
readerLock.unlock();
}
} }
} }

View File

@ -90,65 +90,63 @@ public final class ReferenceCountedOpenSslClientContext extends ReferenceCounted
throw new IllegalArgumentException( throw new IllegalArgumentException(
"Either both keyCertChain and key needs to be null or none of them"); "Either both keyCertChain and key needs to be null or none of them");
} }
synchronized (ReferenceCountedOpenSslContext.class) { try {
try { if (!OpenSsl.useKeyManagerFactory()) {
if (!OpenSsl.useKeyManagerFactory()) { if (keyManagerFactory != null) {
if (keyManagerFactory != null) { throw new IllegalArgumentException(
throw new IllegalArgumentException( "KeyManagerFactory not supported");
"KeyManagerFactory not supported"); }
} if (keyCertChain != null/* && key != null*/) {
if (keyCertChain != null/* && key != null*/) { setKeyMaterial(ctx, keyCertChain, key, keyPassword);
setKeyMaterial(ctx, keyCertChain, key, keyPassword); }
} } else {
} else { // javadocs state that keyManagerFactory has precedent over keyCertChain
// javadocs state that keyManagerFactory has precedent over keyCertChain if (keyManagerFactory == null && keyCertChain != null) {
if (keyManagerFactory == null && keyCertChain != null) { keyManagerFactory = buildKeyManagerFactory(
keyManagerFactory = buildKeyManagerFactory( keyCertChain, key, keyPassword, keyManagerFactory);
keyCertChain, key, keyPassword, keyManagerFactory); }
}
if (keyManagerFactory != null) {
if (keyManagerFactory != null) { X509KeyManager keyManager = chooseX509KeyManager(keyManagerFactory.getKeyManagers());
X509KeyManager keyManager = chooseX509KeyManager(keyManagerFactory.getKeyManagers()); OpenSslKeyMaterialManager materialManager = useExtendedKeyManager(keyManager) ?
OpenSslKeyMaterialManager materialManager = useExtendedKeyManager(keyManager) ? new OpenSslExtendedKeyMaterialManager(
new OpenSslExtendedKeyMaterialManager( (X509ExtendedKeyManager) keyManager, keyPassword) :
(X509ExtendedKeyManager) keyManager, keyPassword) : new OpenSslKeyMaterialManager(keyManager, keyPassword);
new OpenSslKeyMaterialManager(keyManager, keyPassword); SSLContext.setCertRequestedCallback(ctx, new OpenSslCertificateRequestedCallback(
SSLContext.setCertRequestedCallback(ctx, new OpenSslCertificateRequestedCallback( engineMap, materialManager));
engineMap, materialManager));
}
} }
} catch (Exception e) {
throw new SSLException("failed to set certificate and key", e);
} }
} catch (Exception e) {
throw new SSLException("failed to set certificate and key", e);
}
SSLContext.setVerify(ctx, SSL.SSL_CVERIFY_NONE, VERIFY_DEPTH); SSLContext.setVerify(ctx, SSL.SSL_CVERIFY_NONE, VERIFY_DEPTH);
try { try {
if (trustCertCollection != null) { if (trustCertCollection != null) {
trustManagerFactory = buildTrustManagerFactory(trustCertCollection, trustManagerFactory); trustManagerFactory = buildTrustManagerFactory(trustCertCollection, trustManagerFactory);
} else if (trustManagerFactory == null) { } else if (trustManagerFactory == null) {
trustManagerFactory = TrustManagerFactory.getInstance( trustManagerFactory = TrustManagerFactory.getInstance(
TrustManagerFactory.getDefaultAlgorithm()); TrustManagerFactory.getDefaultAlgorithm());
trustManagerFactory.init((KeyStore) null); trustManagerFactory.init((KeyStore) null);
}
final X509TrustManager manager = chooseTrustManager(trustManagerFactory.getTrustManagers());
// IMPORTANT: The callbacks set for verification must be static to prevent memory leak as
// otherwise the context can never be collected. This is because the JNI code holds
// a global reference to the callbacks.
//
// See https://github.com/netty/netty/issues/5372
// Use this to prevent an error when running on java < 7
if (useExtendedTrustManager(manager)) {
SSLContext.setCertVerifyCallback(ctx,
new ExtendedTrustManagerVerifyCallback(engineMap, (X509ExtendedTrustManager) manager));
} else {
SSLContext.setCertVerifyCallback(ctx, new TrustManagerVerifyCallback(engineMap, manager));
}
} catch (Exception e) {
throw new SSLException("unable to setup trustmanager", e);
} }
final X509TrustManager manager = chooseTrustManager(trustManagerFactory.getTrustManagers());
// IMPORTANT: The callbacks set for verification must be static to prevent memory leak as
// otherwise the context can never be collected. This is because the JNI code holds
// a global reference to the callbacks.
//
// See https://github.com/netty/netty/issues/5372
// Use this to prevent an error when running on java < 7
if (useExtendedTrustManager(manager)) {
SSLContext.setCertVerifyCallback(ctx,
new ExtendedTrustManagerVerifyCallback(engineMap, (X509ExtendedTrustManager) manager));
} else {
SSLContext.setCertVerifyCallback(ctx, new TrustManagerVerifyCallback(engineMap, manager));
}
} catch (Exception e) {
throw new SSLException("unable to setup trustmanager", e);
} }
return new OpenSslClientSessionContext(thiz); return new OpenSslClientSessionContext(thiz);
} }

View File

@ -46,6 +46,9 @@ import java.util.Collections;
import java.util.List; import java.util.List;
import java.util.Map; import java.util.Map;
import java.util.concurrent.locks.Lock;
import java.util.concurrent.locks.ReadWriteLock;
import java.util.concurrent.locks.ReentrantReadWriteLock;
import javax.net.ssl.KeyManager; import javax.net.ssl.KeyManager;
import javax.net.ssl.SSLEngine; import javax.net.ssl.SSLEngine;
import javax.net.ssl.SSLException; import javax.net.ssl.SSLException;
@ -106,11 +109,11 @@ public abstract class ReferenceCountedOpenSslContext extends SslContext implemen
protected static final int VERIFY_DEPTH = 10; protected static final int VERIFY_DEPTH = 10;
/** /**
* The OpenSSL SSL_CTX object * The OpenSSL SSL_CTX object.
*
* <strong>{@link #ctxLock} must be hold while using ctx!</strong>
*/ */
protected volatile long ctx; protected long ctx;
@SuppressWarnings({ "unused", "FieldMayBeFinal" })
private volatile int aprPoolDestroyed;
private final List<String> unmodifiableCiphers; private final List<String> unmodifiableCiphers;
private final long sessionCacheSize; private final long sessionCacheSize;
private final long sessionTimeout; private final long sessionTimeout;
@ -144,6 +147,8 @@ public abstract class ReferenceCountedOpenSslContext extends SslContext implemen
final String[] protocols; final String[] protocols;
final boolean enableOcsp; final boolean enableOcsp;
final OpenSslEngineMap engineMap = new DefaultOpenSslEngineMap(); final OpenSslEngineMap engineMap = new DefaultOpenSslEngineMap();
final ReadWriteLock ctxLock = new ReentrantReadWriteLock();
private volatile boolean rejectRemoteInitiatedRenegotiation; private volatile boolean rejectRemoteInitiatedRenegotiation;
private volatile int bioNonApplicationBufferSize = DEFAULT_BIO_NON_APPLICATION_BUFFER_SIZE; private volatile int bioNonApplicationBufferSize = DEFAULT_BIO_NON_APPLICATION_BUFFER_SIZE;
@ -273,92 +278,90 @@ public abstract class ReferenceCountedOpenSslContext extends SslContext implemen
// Create a new SSL_CTX and configure it. // Create a new SSL_CTX and configure it.
boolean success = false; boolean success = false;
try { try {
synchronized (ReferenceCountedOpenSslContext.class) { try {
try { ctx = SSLContext.make(SSL.SSL_PROTOCOL_ALL, mode);
ctx = SSLContext.make(SSL.SSL_PROTOCOL_ALL, mode); } catch (Exception e) {
} catch (Exception e) { throw new SSLException("failed to create an SSL_CTX", e);
throw new SSLException("failed to create an SSL_CTX", e); }
}
SSLContext.setOptions(ctx, SSLContext.getOptions(ctx) | SSLContext.setOptions(ctx, SSLContext.getOptions(ctx) |
SSL.SSL_OP_NO_SSLv2 | SSL.SSL_OP_NO_SSLv2 |
SSL.SSL_OP_NO_SSLv3 | SSL.SSL_OP_NO_SSLv3 |
SSL.SSL_OP_CIPHER_SERVER_PREFERENCE | SSL.SSL_OP_CIPHER_SERVER_PREFERENCE |
// We do not support compression at the moment so we should explicitly disable it. // We do not support compression at the moment so we should explicitly disable it.
SSL.SSL_OP_NO_COMPRESSION | SSL.SSL_OP_NO_COMPRESSION |
// Disable ticket support by default to be more inline with SSLEngineImpl of the JDK. // Disable ticket support by default to be more inline with SSLEngineImpl of the JDK.
// This also let SSLSession.getId() work the same way for the JDK implementation and the OpenSSLEngine. // This also let SSLSession.getId() work the same way for the JDK implementation and the
// If tickets are supported SSLSession.getId() will only return an ID on the server-side if it could // OpenSSLEngine. If tickets are supported SSLSession.getId() will only return an ID on the
// make use of tickets. // server-side if it could make use of tickets.
SSL.SSL_OP_NO_TICKET); SSL.SSL_OP_NO_TICKET);
// We need to enable SSL_MODE_ACCEPT_MOVING_WRITE_BUFFER as the memory address may change between // We need to enable SSL_MODE_ACCEPT_MOVING_WRITE_BUFFER as the memory address may change between
// calling OpenSSLEngine.wrap(...). // calling OpenSSLEngine.wrap(...).
// See https://github.com/netty/netty-tcnative/issues/100 // See https://github.com/netty/netty-tcnative/issues/100
SSLContext.setMode(ctx, SSLContext.getMode(ctx) | SSL.SSL_MODE_ACCEPT_MOVING_WRITE_BUFFER); SSLContext.setMode(ctx, SSLContext.getMode(ctx) | SSL.SSL_MODE_ACCEPT_MOVING_WRITE_BUFFER);
if (DH_KEY_LENGTH != null) { if (DH_KEY_LENGTH != null) {
SSLContext.setTmpDHLength(ctx, DH_KEY_LENGTH); SSLContext.setTmpDHLength(ctx, DH_KEY_LENGTH);
} }
/* List the ciphers that are permitted to negotiate. */ /* List the ciphers that are permitted to negotiate. */
try { try {
SSLContext.setCipherSuite(ctx, CipherSuiteConverter.toOpenSsl(unmodifiableCiphers)); SSLContext.setCipherSuite(ctx, CipherSuiteConverter.toOpenSsl(unmodifiableCiphers));
} catch (SSLException e) { } catch (SSLException e) {
throw e; throw e;
} catch (Exception e) { } catch (Exception e) {
throw new SSLException("failed to set cipher suite: " + unmodifiableCiphers, e); throw new SSLException("failed to set cipher suite: " + unmodifiableCiphers, e);
} }
List<String> nextProtoList = apn.protocols(); List<String> nextProtoList = apn.protocols();
/* Set next protocols for next protocol negotiation extension, if specified */ /* Set next protocols for next protocol negotiation extension, if specified */
if (!nextProtoList.isEmpty()) { if (!nextProtoList.isEmpty()) {
String[] appProtocols = nextProtoList.toArray(new String[nextProtoList.size()]); String[] appProtocols = nextProtoList.toArray(new String[nextProtoList.size()]);
int selectorBehavior = opensslSelectorFailureBehavior(apn.selectorFailureBehavior()); int selectorBehavior = opensslSelectorFailureBehavior(apn.selectorFailureBehavior());
switch (apn.protocol()) { switch (apn.protocol()) {
case NPN: case NPN:
SSLContext.setNpnProtos(ctx, appProtocols, selectorBehavior); SSLContext.setNpnProtos(ctx, appProtocols, selectorBehavior);
break; break;
case ALPN: case ALPN:
SSLContext.setAlpnProtos(ctx, appProtocols, selectorBehavior); SSLContext.setAlpnProtos(ctx, appProtocols, selectorBehavior);
break; break;
case NPN_AND_ALPN: case NPN_AND_ALPN:
SSLContext.setNpnProtos(ctx, appProtocols, selectorBehavior); SSLContext.setNpnProtos(ctx, appProtocols, selectorBehavior);
SSLContext.setAlpnProtos(ctx, appProtocols, selectorBehavior); SSLContext.setAlpnProtos(ctx, appProtocols, selectorBehavior);
break; break;
default: default:
throw new Error(); throw new Error();
}
} }
}
/* Set session cache size, if specified */ /* Set session cache size, if specified */
if (sessionCacheSize > 0) { if (sessionCacheSize > 0) {
this.sessionCacheSize = sessionCacheSize; this.sessionCacheSize = sessionCacheSize;
SSLContext.setSessionCacheSize(ctx, sessionCacheSize); SSLContext.setSessionCacheSize(ctx, sessionCacheSize);
} else { } else {
// Get the default session cache size using SSLContext.setSessionCacheSize() // Get the default session cache size using SSLContext.setSessionCacheSize()
this.sessionCacheSize = sessionCacheSize = SSLContext.setSessionCacheSize(ctx, 20480); this.sessionCacheSize = sessionCacheSize = SSLContext.setSessionCacheSize(ctx, 20480);
// Revert the session cache size to the default value. // Revert the session cache size to the default value.
SSLContext.setSessionCacheSize(ctx, sessionCacheSize); SSLContext.setSessionCacheSize(ctx, sessionCacheSize);
} }
/* Set session timeout, if specified */ /* Set session timeout, if specified */
if (sessionTimeout > 0) { if (sessionTimeout > 0) {
this.sessionTimeout = sessionTimeout; this.sessionTimeout = sessionTimeout;
SSLContext.setSessionCacheTimeout(ctx, sessionTimeout); SSLContext.setSessionCacheTimeout(ctx, sessionTimeout);
} else { } else {
// Get the default session timeout using SSLContext.setSessionCacheTimeout() // Get the default session timeout using SSLContext.setSessionCacheTimeout()
this.sessionTimeout = sessionTimeout = SSLContext.setSessionCacheTimeout(ctx, 300); this.sessionTimeout = sessionTimeout = SSLContext.setSessionCacheTimeout(ctx, 300);
// Revert the session timeout to the default value. // Revert the session timeout to the default value.
SSLContext.setSessionCacheTimeout(ctx, sessionTimeout); SSLContext.setSessionCacheTimeout(ctx, sessionTimeout);
} }
if (enableOcsp) { if (enableOcsp) {
SSLContext.enableOcsp(ctx, isClient()); SSLContext.enableOcsp(ctx, isClient());
}
} }
success = true; success = true;
} finally { } finally {
@ -428,11 +431,17 @@ public abstract class ReferenceCountedOpenSslContext extends SslContext implemen
* Be aware that it is freed as soon as the {@link #finalize()} method is called. * Be aware that it is freed as soon as the {@link #finalize()} method is called.
* At this point {@code 0} will be returned. * At this point {@code 0} will be returned.
* *
* @deprecated use {@link #sslCtxPointer()} * @deprecated this method is considered unsafe as the returned pointer may be released later. Dont use it!
*/ */
@Deprecated @Deprecated
public final long context() { public final long context() {
return ctx; Lock readerLock = ctxLock.readLock();
readerLock.lock();
try {
return ctx;
} finally {
readerLock.unlock();
}
} }
/** /**
@ -491,18 +500,29 @@ public abstract class ReferenceCountedOpenSslContext extends SslContext implemen
/** /**
* Returns the pointer to the {@code SSL_CTX} object for this {@link ReferenceCountedOpenSslContext}. * Returns the pointer to the {@code SSL_CTX} object for this {@link ReferenceCountedOpenSslContext}.
* Be aware that it is freed as soon as the {@link #release()} method is called. * Be aware that it is freed as soon as the {@link #release()} method is called.
* At this point {@code 0} will be returned. * At this point {@code 0} will be returned.
*
* @deprecated this method is considered unsafe as the returned pointer may be released later. Dont use it!
*/ */
@Deprecated
public final long sslCtxPointer() { public final long sslCtxPointer() {
return ctx; Lock readerLock = ctxLock.readLock();
readerLock.lock();
try {
return ctx;
} finally {
readerLock.unlock();
}
} }
// IMPORTANT: This method must only be called from either the constructor or the finalizer as a user MUST never // IMPORTANT: This method must only be called from either the constructor or the finalizer as a user MUST never
// get access to an OpenSslSessionContext after this method was called to prevent the user from // get access to an OpenSslSessionContext after this method was called to prevent the user from
// producing a segfault. // producing a segfault.
final void destroy() { private void destroy() {
synchronized (ReferenceCountedOpenSslContext.class) { Lock writerLock = ctxLock.writeLock();
writerLock.lock();
try {
if (ctx != 0) { if (ctx != 0) {
if (enableOcsp) { if (enableOcsp) {
SSLContext.disableOcsp(ctx); SSLContext.disableOcsp(ctx);
@ -511,6 +531,8 @@ public abstract class ReferenceCountedOpenSslContext extends SslContext implemen
SSLContext.free(ctx); SSLContext.free(ctx);
ctx = 0; ctx = 0;
} }
} finally {
writerLock.unlock();
} }
} }

View File

@ -43,6 +43,8 @@ import java.util.HashMap;
import java.util.List; import java.util.List;
import java.util.Map; import java.util.Map;
import java.util.concurrent.atomic.AtomicIntegerFieldUpdater; import java.util.concurrent.atomic.AtomicIntegerFieldUpdater;
import java.util.concurrent.locks.Lock;
import javax.net.ssl.SSLEngine; import javax.net.ssl.SSLEngine;
import javax.net.ssl.SSLEngineResult; import javax.net.ssl.SSLEngineResult;
import javax.net.ssl.SSLException; import javax.net.ssl.SSLException;
@ -234,7 +236,14 @@ public class ReferenceCountedOpenSslEngine extends SSLEngine implements Referenc
localCerts = context.keyCertChain; localCerts = context.keyCertChain;
keyMaterialManager = context.keyMaterialManager(); keyMaterialManager = context.keyMaterialManager();
enableOcsp = context.enableOcsp; enableOcsp = context.enableOcsp;
ssl = SSL.newSSL(context.ctx, !context.isClient());
Lock readerLock = context.ctxLock.readLock();
readerLock.lock();
try {
ssl = SSL.newSSL(context.ctx, !context.isClient());
} finally {
readerLock.unlock();
}
try { try {
networkBIO = SSL.bioNewByteBuffer(ssl, context.getBioNonApplicationBufferSize()); networkBIO = SSL.bioNewByteBuffer(ssl, context.getBioNonApplicationBufferSize());

View File

@ -106,75 +106,69 @@ public final class ReferenceCountedOpenSslServerContext extends ReferenceCounted
String keyPassword, KeyManagerFactory keyManagerFactory) String keyPassword, KeyManagerFactory keyManagerFactory)
throws SSLException { throws SSLException {
ServerContext result = new ServerContext(); ServerContext result = new ServerContext();
synchronized (ReferenceCountedOpenSslContext.class) { try {
try { SSLContext.setVerify(ctx, SSL.SSL_CVERIFY_NONE, VERIFY_DEPTH);
SSLContext.setVerify(ctx, SSL.SSL_CVERIFY_NONE, VERIFY_DEPTH); if (!OpenSsl.useKeyManagerFactory()) {
if (!OpenSsl.useKeyManagerFactory()) { if (keyManagerFactory != null) {
if (keyManagerFactory != null) { throw new IllegalArgumentException(
throw new IllegalArgumentException( "KeyManagerFactory not supported");
"KeyManagerFactory not supported");
}
checkNotNull(keyCertChain, "keyCertChain");
setKeyMaterial(ctx, keyCertChain, key, keyPassword);
} else {
// javadocs state that keyManagerFactory has precedent over keyCertChain, and we must have a
// keyManagerFactory for the server so build one if it is not specified.
if (keyManagerFactory == null) {
keyManagerFactory = buildKeyManagerFactory(
keyCertChain, key, keyPassword, keyManagerFactory);
}
X509KeyManager keyManager = chooseX509KeyManager(keyManagerFactory.getKeyManagers());
result.keyMaterialManager = useExtendedKeyManager(keyManager) ?
new OpenSslExtendedKeyMaterialManager(
(X509ExtendedKeyManager) keyManager, keyPassword) :
new OpenSslKeyMaterialManager(keyManager, keyPassword);
} }
} catch (Exception e) { checkNotNull(keyCertChain, "keyCertChain");
throw new SSLException("failed to set certificate and key", e);
setKeyMaterial(ctx, keyCertChain, key, keyPassword);
} else {
// javadocs state that keyManagerFactory has precedent over keyCertChain, and we must have a
// keyManagerFactory for the server so build one if it is not specified.
if (keyManagerFactory == null) {
keyManagerFactory = buildKeyManagerFactory(
keyCertChain, key, keyPassword, keyManagerFactory);
}
X509KeyManager keyManager = chooseX509KeyManager(keyManagerFactory.getKeyManagers());
result.keyMaterialManager = useExtendedKeyManager(keyManager) ?
new OpenSslExtendedKeyMaterialManager(
(X509ExtendedKeyManager) keyManager, keyPassword) :
new OpenSslKeyMaterialManager(keyManager, keyPassword);
}
} catch (Exception e) {
throw new SSLException("failed to set certificate and key", e);
}
try {
if (trustCertCollection != null) {
trustManagerFactory = buildTrustManagerFactory(trustCertCollection, trustManagerFactory);
} else if (trustManagerFactory == null) {
// Mimic the way SSLContext.getInstance(KeyManager[], null, null) works
trustManagerFactory = TrustManagerFactory.getInstance(
TrustManagerFactory.getDefaultAlgorithm());
trustManagerFactory.init((KeyStore) null);
} }
try {
if (trustCertCollection != null) {
trustManagerFactory = buildTrustManagerFactory(trustCertCollection, trustManagerFactory);
} else if (trustManagerFactory == null) {
// Mimic the way SSLContext.getInstance(KeyManager[], null, null) works
trustManagerFactory = TrustManagerFactory.getInstance(
TrustManagerFactory.getDefaultAlgorithm());
trustManagerFactory.init((KeyStore) null);
}
final X509TrustManager manager = chooseTrustManager(trustManagerFactory.getTrustManagers()); final X509TrustManager manager = chooseTrustManager(trustManagerFactory.getTrustManagers());
// IMPORTANT: The callbacks set for verification must be static to prevent memory leak as // IMPORTANT: The callbacks set for verification must be static to prevent memory leak as
// otherwise the context can never be collected. This is because the JNI code holds // otherwise the context can never be collected. This is because the JNI code holds
// a global reference to the callbacks. // a global reference to the callbacks.
// //
// See https://github.com/netty/netty/issues/5372 // See https://github.com/netty/netty/issues/5372
// Use this to prevent an error when running on java < 7 // Use this to prevent an error when running on java < 7
if (useExtendedTrustManager(manager)) { if (useExtendedTrustManager(manager)) {
SSLContext.setCertVerifyCallback(ctx, SSLContext.setCertVerifyCallback(ctx,
new ExtendedTrustManagerVerifyCallback(engineMap, (X509ExtendedTrustManager) manager)); new ExtendedTrustManagerVerifyCallback(engineMap, (X509ExtendedTrustManager) manager));
} else { } else {
SSLContext.setCertVerifyCallback(ctx, new TrustManagerVerifyCallback(engineMap, manager)); SSLContext.setCertVerifyCallback(ctx, new TrustManagerVerifyCallback(engineMap, manager));
} }
X509Certificate[] issuers = manager.getAcceptedIssuers(); X509Certificate[] issuers = manager.getAcceptedIssuers();
if (issuers != null && issuers.length > 0) { if (issuers != null && issuers.length > 0) {
long bio = 0; long bio = 0;
try { try {
bio = toBIO(issuers); bio = toBIO(issuers);
if (!SSLContext.setCACertificateBio(ctx, bio)) { if (!SSLContext.setCACertificateBio(ctx, bio)) {
throw new SSLException("unable to setup accepted issuers for trustmanager " + manager); throw new SSLException("unable to setup accepted issuers for trustmanager " + manager);
}
} finally {
freeBio(bio);
} }
} finally {
freeBio(bio);
} }
} catch (SSLException e) {
throw e;
} catch (Exception e) {
throw new SSLException("unable to setup trustmanager", e);
} }
if (PlatformDependent.javaVersion() >= 8) { if (PlatformDependent.javaVersion() >= 8) {
@ -184,6 +178,10 @@ public final class ReferenceCountedOpenSslServerContext extends ReferenceCounted
// a global reference to the matcher. // a global reference to the matcher.
SSLContext.setSniHostnameMatcher(ctx, new OpenSslSniHostnameMatcher(engineMap)); SSLContext.setSniHostnameMatcher(ctx, new OpenSslSniHostnameMatcher(engineMap));
} }
} catch (SSLException e) {
throw e;
} catch (Exception e) {
throw new SSLException("unable to setup trustmanager", e);
} }
result.sessionContext = new OpenSslServerSessionContext(thiz); result.sessionContext = new OpenSslServerSessionContext(thiz);