javax.net.ssl.SNIServerName Java Examples

private static SNIServerName chooseSni(Collection<SNIMatcher> matchers,
        List<SNIServerName> sniNames) {
    if (sniNames != null && !sniNames.isEmpty()) {
        for (SNIMatcher matcher : matchers) {
            int matcherType = matcher.getType();
            for (SNIServerName sniName : sniNames) {
                if (sniName.getType() == matcherType) {
                    if (matcher.matches(sniName)) {
                        return sniName;
                    }

                    // no duplicated entry in the server names list.
                    break;
                }
            }
        }
    }

    return null;
}
 

ServerNameExtension(List<SNIServerName> serverNames)
        throws IOException {
    super(ExtensionType.EXT_SERVER_NAME);

    listLength = 0;
    sniMap = new LinkedHashMap<>();
    for (SNIServerName serverName : serverNames) {
        // check for duplicated server name type
        if (sniMap.put(serverName.getType(), serverName) != null) {
            // unlikely to happen, but in case ...
            throw new RuntimeException(
                "Duplicated server name of type " + serverName.getType());
        }

        listLength += serverName.getEncoded().length + NAME_HEADER_LENGTH;
    }

    // This constructor is used for ClientHello only.  Empty list is
    // not allowed in client mode.
    if (listLength == 0) {
        throw new RuntimeException("The ServerNameList cannot be empty");
    }
}
 

ServerNameExtension(List<SNIServerName> serverNames)
        throws IOException {
    super(ExtensionType.EXT_SERVER_NAME);

    listLength = 0;
    sniMap = new LinkedHashMap<>();
    for (SNIServerName serverName : serverNames) {
        // check for duplicated server name type
        if (sniMap.put(serverName.getType(), serverName) != null) {
            // unlikely to happen, but in case ...
            throw new RuntimeException(
                "Duplicated server name of type " + serverName.getType());
        }

        listLength += serverName.getEncoded().length + NAME_HEADER_LENGTH;
    }

    // This constructor is used for ClientHello only.  Empty list is
    // not allowed in client mode.
    if (listLength == 0) {
        throw new RuntimeException("The ServerNameList cannot be empty");
    }
}
 

ServerNameExtension(List<SNIServerName> serverNames)
        throws IOException {
    super(ExtensionType.EXT_SERVER_NAME);

    listLength = 0;
    sniMap = new LinkedHashMap<>();
    for (SNIServerName serverName : serverNames) {
        // check for duplicated server name type
        if (sniMap.put(serverName.getType(), serverName) != null) {
            // unlikely to happen, but in case ...
            throw new RuntimeException(
                "Duplicated server name of type " + serverName.getType());
        }

        listLength += serverName.getEncoded().length + NAME_HEADER_LENGTH;
    }

    // This constructor is used for ClientHello only.  Empty list is
    // not allowed in client mode.
    if (listLength == 0) {
        throw new RuntimeException("The ServerNameList cannot be empty");
    }
}
 

ServerNameExtension(List<SNIServerName> serverNames)
        throws IOException {
    super(ExtensionType.EXT_SERVER_NAME);

    listLength = 0;
    sniMap = new LinkedHashMap<>();
    for (SNIServerName serverName : serverNames) {
        // check for duplicated server name type
        if (sniMap.put(serverName.getType(), serverName) != null) {
            // unlikely to happen, but in case ...
            throw new RuntimeException(
                "Duplicated server name of type " + serverName.getType());
        }

        listLength += serverName.getEncoded().length + NAME_HEADER_LENGTH;
    }

    // This constructor is used for ClientHello only.  Empty list is
    // not allowed in client mode.
    if (listLength == 0) {
        throw new RuntimeException("The ServerNameList cannot be empty");
    }
}
 

private static SNIServerName chooseSni(Collection<SNIMatcher> matchers,
        List<SNIServerName> sniNames) {
    if (sniNames != null && !sniNames.isEmpty()) {
        for (SNIMatcher matcher : matchers) {
            int matcherType = matcher.getType();
            for (SNIServerName sniName : sniNames) {
                if (sniName.getType() == matcherType) {
                    if (matcher.matches(sniName)) {
                        return sniName;
                    }

                    // no duplicated entry in the server names list.
                    break;
                }
            }
        }
    }

    return null;
}
 

private static List<SNIServerName> exploreTLSRecord(
        ByteBuffer input, byte firstByte, byte secondByte,
        byte thirdByte) throws SSLException {

    // Is it a handshake message?
    if (firstByte != 22) {        // 22: handshake record
        throw UndertowMessages.MESSAGES.notHandshakeRecord();
    }

    // Is there enough data for a full record?
    int recordLength = getInt16(input);
    if (recordLength > input.remaining()) {
        throw new BufferUnderflowException();
    }

    // We have already had enough source bytes.
    try {
        return exploreHandshake(input,
            secondByte, thirdByte, recordLength);
    } catch (BufferUnderflowException ignored) {
        throw UndertowMessages.MESSAGES.invalidHandshakeRecord();
    }
}
 

private static List<SNIServerName> exploreHandshake(
        ByteBuffer input, byte recordMajorVersion,
        byte recordMinorVersion, int recordLength) throws SSLException {

    // What is the handshake type?
    byte handshakeType = input.get();
    if (handshakeType != 0x01) {   // 0x01: client_hello message
        throw UndertowMessages.MESSAGES.expectedClientHello();
    }

    // What is the handshake body length?
    int handshakeLength = getInt24(input);

    // Theoretically, a single handshake message might span multiple
    // records, but in practice this does not occur.
    if (handshakeLength > recordLength - 4) { // 4: handshake header size
        throw UndertowMessages.MESSAGES.multiRecordSSLHandshake();
    }

    input = input.duplicate();
    input.limit(handshakeLength + input.position());
    return exploreClientHello(input,
                                recordMajorVersion, recordMinorVersion);
}
 

private static ExtensionInfo exploreExtensions(ByteBuffer input)
        throws SSLException {

    List<SNIServerName> sni = Collections.emptyList();
    List<String> alpn = Collections.emptyList();

    int length = getInt16(input);           // length of extensions
    while (length > 0) {
        int extType = getInt16(input);      // extension type
        int extLen = getInt16(input);       // length of extension data

        if (extType == 0x00) {      // 0x00: type of server name indication
            sni = exploreSNIExt(input, extLen);
        } else if (extType == 0x10) { // 0x10: type of alpn
            alpn = exploreALPN(input, extLen);
        } else {                    // ignore other extensions
            ignoreByteVector(input, extLen);
        }

        length -= extLen + 4;
    }

    return new ExtensionInfo(sni, alpn);
}
 

static List<String> getSniHostNames(SSLParameters sslParameters) {
    List<SNIServerName> names = sslParameters.getServerNames();
    if (names == null || names.isEmpty()) {
        return Collections.emptyList();
    }
    List<String> strings = new ArrayList<String>(names.size());

    for (SNIServerName serverName : names) {
        if (serverName instanceof SNIHostName) {
            strings.add(((SNIHostName) serverName).getAsciiName());
        } else {
            throw new IllegalArgumentException("Only " + SNIHostName.class.getName()
                    + " instances are supported, but found: " + serverName);
        }
    }
    return strings;
}
 

/**
 * Returns client ssl engine.
 *
 * @param context - SSLContext to get SSLEngine from.
 * @param useSNI  - flag used to enable or disable using SNI extension.
 *                Needed for Kerberos.
 */
public static SSLEngine getClientSSLEngine(
        SSLContext context, boolean useSNI) {

    SSLEngine clientEngine = context.createSSLEngine(HOST, 80);
    clientEngine.setUseClientMode(true);
    if (useSNI) {
        SNIHostName serverName = new SNIHostName(SERVER_NAME);
        List<SNIServerName> serverNames = new ArrayList<>();
        serverNames.add(serverName);
        SSLParameters params = clientEngine.getSSLParameters();
        params.setServerNames(serverNames);
        clientEngine.setSSLParameters(params);
    }
    return clientEngine;
}
 

boolean isIdentical(List<SNIServerName> other) {
    if (other.size() == sniMap.size()) {
        for(SNIServerName sniInOther : other) {
            SNIServerName sniName = sniMap.get(sniInOther.getType());
            if (sniName == null || !sniInOther.equals(sniName)) {
                return false;
            }
        }

        return true;
    }

    return false;
}
 

/**
 * Obtains a <code>List</code> containing all {@link SNIServerName}s
 * of the requested Server Name Indication (SNI) extension.
 */
@Override
public List<SNIServerName> getRequestedServerNames() {
    if (requestedServerNames != null && !requestedServerNames.isEmpty()) {
        return Collections.<SNIServerName>unmodifiableList(
                                            requestedServerNames);
    }

    return Collections.<SNIServerName>emptyList();
}
 

boolean isIdentical(List<SNIServerName> other) {
    if (other.size() == sniMap.size()) {
        for(SNIServerName sniInOther : other) {
            SNIServerName sniName = sniMap.get(sniInOther.getType());
            if (sniName == null || !sniInOther.equals(sniName)) {
                return false;
            }
        }

        return true;
    }

    return false;
}
 

public SSLEngineResult unwrap(final ByteBuffer src, final ByteBuffer[] dsts, final int offset, final int length) throws SSLException {
    SSLEngine next;
    final int mark = src.position();
    try {
        if (src.remaining() < SNISSLExplorer.RECORD_HEADER_SIZE) {
            packetBufferSize = SNISSLExplorer.RECORD_HEADER_SIZE;
            return UNDERFLOW_UNWRAP;
        }
        final int requiredSize = SNISSLExplorer.getRequiredSize(src);
        if (src.remaining() < requiredSize) {
            packetBufferSize = requiredSize;
            return UNDERFLOW_UNWRAP;
        }
        List<SNIServerName> names = SNISSLExplorer.explore(src);
        SSLContext sslContext = selector.getContext(names);
        if (sslContext == null) {
            // no SSL context is available
            throw UndertowMessages.MESSAGES.noContextForSslConnection();
        }
        next = engineFunction.apply(sslContext);
        next.setUseClientMode(false);
        final int flagsVal = flags.get();
        if ((flagsVal & FL_WANT_C_AUTH) != 0) {
            next.setWantClientAuth(true);
        } else if ((flagsVal & FL_NEED_C_AUTH) != 0) {
            next.setNeedClientAuth(true);
        }
        if ((flagsVal & FL_SESSION_CRE) != 0) {
            next.setEnableSessionCreation(true);
        }
        next = selectionCallback.apply(next);
        currentRef.set(next);
    } finally {
        src.position(mark);
    }
    return next.unwrap(src, dsts, offset, length);
}
 

List<SNIServerName> getServerNames() {
    if (sniMap != null && !sniMap.isEmpty()) {
        return Collections.<SNIServerName>unmodifiableList(
                                    new ArrayList<>(sniMap.values()));
    }

    return Collections.<SNIServerName>emptyList();
}
 

@Override
void send(HandshakeOutStream s) throws IOException {
    s.putInt16(type.id);
    if (listLength == 0) {
        s.putInt16(listLength);     // in ServerHello, empty extension_data
    } else {
        s.putInt16(listLength + 2); // length of extension_data
        s.putInt16(listLength);     // length of ServerNameList

        for (SNIServerName sniName : sniMap.values()) {
            s.putInt8(sniName.getType());         // server name type
            s.putBytes16(sniName.getEncoded());   // server name value
        }
    }
}
 

boolean isMatched(Collection<SNIMatcher> matchers) {
    if (sniMap != null && !sniMap.isEmpty()) {
        for (SNIMatcher matcher : matchers) {
            SNIServerName sniName = sniMap.get(matcher.getType());
            if (sniName != null && (!matcher.matches(sniName))) {
                return false;
            }
        }
    }

    return true;
}
 

/**
 * Obtains a <code>List</code> containing all {@link SNIServerName}s
 * of the requested Server Name Indication (SNI) extension.
 */
@Override
public List<SNIServerName> getRequestedServerNames() {
    if (requestedServerNames != null && !requestedServerNames.isEmpty()) {
        return Collections.<SNIServerName>unmodifiableList(
                                            requestedServerNames);
    }

    return Collections.<SNIServerName>emptyList();
}
 

List<SNIServerName> getServerNames() {
    if (sniMap != null && !sniMap.isEmpty()) {
        return Collections.<SNIServerName>unmodifiableList(
                                    new ArrayList<>(sniMap.values()));
    }

    return Collections.<SNIServerName>emptyList();
}
 

List<SNIServerName> getServerNames() {
    if (sniMap != null && !sniMap.isEmpty()) {
        return Collections.<SNIServerName>unmodifiableList(
                                    new ArrayList<>(sniMap.values()));
    }

    return Collections.<SNIServerName>emptyList();
}
 

private static Map<Integer, SNIServerName> exploreClientHello(ByteBuffer input)
    throws SSLProtocolException {
  ignore(input, 2); // ignore version
  ignore(input, 32); // ignore random; 32: the length of Random
  ignoreByteVector8(input); // ignore session id
  ignoreByteVector16(input); // ignore cipher_suites
  ignoreByteVector8(input); // ignore compression methods
  if (input.remaining() > 0) return exploreExtensions(input);
  else return new HashMap<>();
}
 

@Override
void send(HandshakeOutStream s) throws IOException {
    s.putInt16(type.id);
    if (listLength == 0) {
        s.putInt16(listLength);     // in ServerHello, empty extension_data
    } else {
        s.putInt16(listLength + 2); // length of extension_data
        s.putInt16(listLength);     // length of ServerNameList

        for (SNIServerName sniName : sniMap.values()) {
            s.putInt8(sniName.getType());         // server name type
            s.putBytes16(sniName.getEncoded());   // server name value
        }
    }
}
 

boolean isMatched(Collection<SNIMatcher> matchers) {
    if (sniMap != null && !sniMap.isEmpty()) {
        for (SNIMatcher matcher : matchers) {
            SNIServerName sniName = sniMap.get(matcher.getType());
            if (sniName != null && (!matcher.matches(sniName))) {
                return false;
            }
        }
    }

    return true;
}
 

static SSLClient init(String host, int port, String cipherSuiteFilter,
        String sniHostName) throws NoSuchAlgorithmException, IOException {
    SSLContext sslContext = SSLContext.getDefault();
    SSLSocketFactory ssf = (SSLSocketFactory) sslContext.getSocketFactory();
    SSLSocket socket = (SSLSocket) ssf.createSocket(host, port);
    SSLParameters params = new SSLParameters();

    if (cipherSuiteFilter != null) {
        String[] cipherSuites = UnboundSSLUtils.filterStringArray(
                ssf.getSupportedCipherSuites(), cipherSuiteFilter);
        System.out.println("Client: enabled cipher suites: "
                + Arrays.toString(cipherSuites));
        params.setCipherSuites(cipherSuites);
    }

    if (sniHostName != null) {
        System.out.println("Client: set SNI hostname: " + sniHostName);
        SNIHostName serverName = new SNIHostName(sniHostName);
        List<SNIServerName> serverNames = new ArrayList<>();
        serverNames.add(serverName);
        params.setServerNames(serverNames);
    }

    socket.setSSLParameters(params);

    return new SSLClient(socket);
}
 

@Override
public String toString() {
    StringBuffer buffer = new StringBuffer();
    for (SNIServerName sniName : sniMap.values()) {
        buffer.append("[" + sniName + "]");
    }

    return "Extension " + type + ", server_name: " + buffer;
}
 

/**
 * Obtains a <code>List</code> containing all {@link SNIServerName}s
 * of the requested Server Name Indication (SNI) extension.
 */
@Override
public List<SNIServerName> getRequestedServerNames() {
    if (requestedServerNames != null && !requestedServerNames.isEmpty()) {
        return Collections.<SNIServerName>unmodifiableList(
                                            requestedServerNames);
    }

    return Collections.<SNIServerName>emptyList();
}
 

boolean isIdentical(List<SNIServerName> other) {
    if (other.size() == sniMap.size()) {
        for(SNIServerName sniInOther : other) {
            SNIServerName sniName = sniMap.get(sniInOther.getType());
            if (sniName == null || !sniInOther.equals(sniName)) {
                return false;
            }
        }

        return true;
    }

    return false;
}
 

@Override
public String toString() {
    StringBuffer buffer = new StringBuffer();
    for (SNIServerName sniName : sniMap.values()) {
        buffer.append("[" + sniName + "]");
    }

    return "Extension " + type + ", server_name: " + buffer;
}
 

static SSLClient init(String host, int port, String cipherSuiteFilter,
        String sniHostName) throws NoSuchAlgorithmException, IOException {
    SSLContext sslContext = SSLContext.getDefault();
    SSLSocketFactory ssf = (SSLSocketFactory) sslContext.getSocketFactory();
    SSLSocket socket = (SSLSocket) ssf.createSocket(host, port);
    SSLParameters params = new SSLParameters();

    if (cipherSuiteFilter != null) {
        String[] cipherSuites = UnboundSSLUtils.filterStringArray(
                ssf.getSupportedCipherSuites(), cipherSuiteFilter);
        System.out.println("Client: enabled cipher suites: "
                + Arrays.toString(cipherSuites));
        params.setCipherSuites(cipherSuites);
    }

    if (sniHostName != null) {
        System.out.println("Client: set SNI hostname: " + sniHostName);
        SNIHostName serverName = new SNIHostName(sniHostName);
        List<SNIServerName> serverNames = new ArrayList<>();
        serverNames.add(serverName);
        params.setServerNames(serverNames);
    }

    socket.setSSLParameters(params);

    return new SSLClient(socket);
}