Example usage for io.netty.handler.ssl SslContextBuilder sslProvider

List of usage examples for io.netty.handler.ssl SslContextBuilder sslProvider

  1. HOME
  2. Java
  3. io.netty
  4. io.netty.handler.ssl.*
  5. SslContextBuilder
  6. sslProvider

Introduction

In this page you can find the example usage for io.netty.handler.ssl SslContextBuilder sslProvider.

Prototype

public SslContextBuilder sslProvider(SslProvider provider)

Source Link

Document

The SslContext implementation to use.

Usage

From source file:com.liferay.sync.engine.lan.server.file.LanFileServerInitializer.java

License:Open Source License

public void updateDomainNameMapping() {
    DomainNameMappingBuilder<SslContext> domainNameMappingBuilder = null;

    for (SyncAccount syncAccount : SyncAccountService.findAll()) {
        if (!syncAccount.isActive() || !syncAccount.isLanEnabled()) {
            continue;
        }/* ww  w. j ava2  s.  co  m*/

        SslContext sslContext = null;

        try {
            X509Certificate x509Certificate = LanPEMParserUtil
                    .parseX509Certificate(syncAccount.getLanCertificate());

            SslContextBuilder sslContextBuilder = SslContextBuilder
                    .forServer(LanPEMParserUtil.parsePrivateKey(syncAccount.getLanKey()), x509Certificate);

            sslContextBuilder.clientAuth(ClientAuth.REQUIRE);
            sslContextBuilder.sslProvider(SslProvider.JDK);
            sslContextBuilder.trustManager(x509Certificate);

            sslContext = sslContextBuilder.build();
        } catch (Exception e) {
            _logger.error(e.getMessage(), e);

            continue;
        }

        if (domainNameMappingBuilder == null) {
            domainNameMappingBuilder = new DomainNameMappingBuilder<>(sslContext);
        }

        domainNameMappingBuilder.add(LanClientUtil.getSNIHostname(syncAccount.getLanServerUuid()), sslContext);
    }

    if (domainNameMappingBuilder == null) {
        return;
    }

    _domainNameMapping = domainNameMappingBuilder.build();
}

From source file:com.linecorp.armeria.client.http.HttpClientPipelineConfigurator.java

License:Apache License

HttpClientPipelineConfigurator(SessionProtocol sessionProtocol, SessionOptions options) {
    switch (sessionProtocol) {
    case HTTP:/*from   w  w w.  j a v  a  2  s  .  co m*/
    case HTTPS:
        httpPreference = HttpPreference.HTTP2_PREFERRED;
        break;
    case H1:
    case H1C:
        httpPreference = HttpPreference.HTTP1_REQUIRED;
        break;
    case H2:
    case H2C:
        httpPreference = HttpPreference.HTTP2_REQUIRED;
        break;
    default:
        // Should never reach here.
        throw new Error();
    }

    this.options = requireNonNull(options, "options");

    if (sessionProtocol.isTls()) {
        try {
            final SslContextBuilder builder = SslContextBuilder.forClient();

            builder.sslProvider(NativeLibraries.isOpenSslAvailable() ? SslProvider.OPENSSL : SslProvider.JDK);
            options.trustManagerFactory().ifPresent(builder::trustManager);

            if (httpPreference == HttpPreference.HTTP2_REQUIRED
                    || httpPreference == HttpPreference.HTTP2_PREFERRED) {

                builder.ciphers(Http2SecurityUtil.CIPHERS, SupportedCipherSuiteFilter.INSTANCE)
                        .applicationProtocolConfig(
                                new ApplicationProtocolConfig(ApplicationProtocolConfig.Protocol.ALPN,
                                        // NO_ADVERTISE is currently the only mode supported by both OpenSsl and
                                        // JDK providers.
                                        ApplicationProtocolConfig.SelectorFailureBehavior.NO_ADVERTISE,
                                        // ACCEPT is currently the only mode supported by both OpenSsl and JDK
                                        // providers.
                                        ApplicationProtocolConfig.SelectedListenerFailureBehavior.ACCEPT,
                                        ApplicationProtocolNames.HTTP_2));
            }
            sslCtx = builder.build();
        } catch (SSLException e) {
            throw new IllegalStateException("failed to create an SslContext", e);
        }
    } else {
        sslCtx = null;
    }
}

From source file:com.linecorp.armeria.client.HttpClientPipelineConfigurator.java

License:Apache License

HttpClientPipelineConfigurator(HttpClientFactory clientFactory, SessionProtocol sessionProtocol) {
    this.clientFactory = clientFactory;

    if (sessionProtocol == HTTP || sessionProtocol == HTTPS) {
        httpPreference = HttpPreference.HTTP2_PREFERRED;
    } else if (sessionProtocol == H1 || sessionProtocol == H1C) {
        httpPreference = HttpPreference.HTTP1_REQUIRED;
    } else if (sessionProtocol == H2 || sessionProtocol == H2C) {
        httpPreference = HttpPreference.HTTP2_REQUIRED;
    } else {/*w w  w  .ja  v a  2 s .c o  m*/
        // Should never reach here.
        throw new Error();
    }

    if (sessionProtocol.isTls()) {
        try {
            final SslContextBuilder builder = SslContextBuilder.forClient();

            builder.sslProvider(Flags.useOpenSsl() ? SslProvider.OPENSSL : SslProvider.JDK);
            clientFactory.sslContextCustomizer().accept(builder);

            if (httpPreference == HttpPreference.HTTP2_REQUIRED
                    || httpPreference == HttpPreference.HTTP2_PREFERRED) {

                builder.ciphers(Http2SecurityUtil.CIPHERS, SupportedCipherSuiteFilter.INSTANCE)
                        .applicationProtocolConfig(
                                new ApplicationProtocolConfig(ApplicationProtocolConfig.Protocol.ALPN,
                                        // NO_ADVERTISE is currently the only mode supported by both OpenSsl and
                                        // JDK providers.
                                        ApplicationProtocolConfig.SelectorFailureBehavior.NO_ADVERTISE,
                                        // ACCEPT is currently the only mode supported by both OpenSsl and JDK
                                        // providers.
                                        ApplicationProtocolConfig.SelectedListenerFailureBehavior.ACCEPT,
                                        ApplicationProtocolNames.HTTP_2));
            }
            sslCtx = builder.build();
        } catch (SSLException e) {
            throw new IllegalStateException("failed to create an SslContext", e);
        }
    } else {
        sslCtx = null;
    }
}

From source file:com.linecorp.armeria.client.HttpConfigurator.java

License:Apache License

HttpConfigurator(SessionProtocol sessionProtocol, RemoteInvokerOptions options) {
    switch (sessionProtocol) {
    case HTTP://  w  w w  .j  a va 2s . c  om
    case HTTPS:
        httpPreference = HttpPreference.HTTP2_PREFERRED;
        break;
    case H1:
    case H1C:
        httpPreference = HttpPreference.HTTP1_REQUIRED;
        break;
    case H2:
    case H2C:
        httpPreference = HttpPreference.HTTP2_REQUIRED;
        break;
    default:
        // Should never reach here.
        throw new Error();
    }

    this.options = requireNonNull(options, "options");

    if (sessionProtocol.isTls()) {
        try {
            final SslContextBuilder builder = SslContextBuilder.forClient();

            builder.sslProvider(NativeLibraries.isOpenSslAvailable() ? SslProvider.OPENSSL : SslProvider.JDK);
            options.trustManagerFactory().ifPresent(builder::trustManager);

            if (httpPreference == HttpPreference.HTTP2_REQUIRED
                    || httpPreference == HttpPreference.HTTP2_PREFERRED) {

                builder.ciphers(Http2SecurityUtil.CIPHERS, SupportedCipherSuiteFilter.INSTANCE)
                        .applicationProtocolConfig(
                                new ApplicationProtocolConfig(ApplicationProtocolConfig.Protocol.ALPN,
                                        // NO_ADVERTISE is currently the only mode supported by both OpenSsl and
                                        // JDK providers.
                                        ApplicationProtocolConfig.SelectorFailureBehavior.NO_ADVERTISE,
                                        // ACCEPT is currently the only mode supported by both OpenSsl and JDK
                                        // providers.
                                        ApplicationProtocolConfig.SelectedListenerFailureBehavior.ACCEPT,
                                        ApplicationProtocolNames.HTTP_2));
            }
            sslCtx = builder.build();
        } catch (SSLException e) {
            throw new IllegalStateException("failed to create a SslContext", e);
        }
    } else {
        sslCtx = null;
    }
}

From source file:com.linecorp.armeria.server.AbstractVirtualHostBuilder.java

License:Apache License

/**
 * Configures SSL or TLS of this {@link VirtualHost} with the specified {@code keyCertChainFile},
 * {@code keyFile} and {@code keyPassword}.
 *//*from   ww  w  .  j  a va 2  s  .c o  m*/
public B tls(File keyCertChainFile, File keyFile, @Nullable String keyPassword) throws SSLException {
    if (!keyCertChainFile.exists()) {
        throw new SSLException("non-existent certificate chain file: " + keyCertChainFile);
    }
    if (!keyCertChainFile.canRead()) {
        throw new SSLException("cannot read certificate chain file: " + keyCertChainFile);
    }
    if (!keyFile.exists()) {
        throw new SSLException("non-existent key file: " + keyFile);
    }
    if (!keyFile.canRead()) {
        throw new SSLException("cannot read key file: " + keyFile);
    }

    final SslContext sslCtx;

    try {
        sslCtx = BouncyCastleKeyFactoryProvider.call(() -> {
            final SslContextBuilder builder = SslContextBuilder.forServer(keyCertChainFile, keyFile,
                    keyPassword);

            builder.sslProvider(Flags.useOpenSsl() ? SslProvider.OPENSSL : SslProvider.JDK);
            builder.ciphers(Http2SecurityUtil.CIPHERS, SupportedCipherSuiteFilter.INSTANCE);
            builder.applicationProtocolConfig(HTTPS_ALPN_CFG);

            return builder.build();
        });
    } catch (RuntimeException | SSLException e) {
        throw e;
    } catch (Exception e) {
        throw new SSLException("failed to configure TLS: " + e, e);
    }

    tls(sslCtx);
    return self();
}

From source file:com.linecorp.armeria.server.VirtualHostBuilder.java

License:Apache License

/**
 * Sets the {@link SslContext} of this {@link VirtualHost} from the specified {@link SessionProtocol},
 * {@code keyCertChainFile}, {@code keyFile} and {@code keyPassword}.
 *///from  w ww.  j  a  va  2 s.  co  m
public VirtualHostBuilder sslContext(SessionProtocol protocol, File keyCertChainFile, File keyFile,
        String keyPassword) throws SSLException {

    if (requireNonNull(protocol, "protocol") != SessionProtocol.HTTPS) {
        throw new IllegalArgumentException("unsupported protocol: " + protocol);
    }

    final SslContextBuilder builder = SslContextBuilder.forServer(keyCertChainFile, keyFile, keyPassword);

    builder.sslProvider(NativeLibraries.isOpenSslAvailable() ? SslProvider.OPENSSL : SslProvider.JDK);
    builder.ciphers(Http2SecurityUtil.CIPHERS, SupportedCipherSuiteFilter.INSTANCE);
    builder.applicationProtocolConfig(HTTPS_ALPN_CFG);

    sslContext(builder.build());

    return this;
}

From source file:com.relayrides.pushy.apns.MockApnsServerBuilder.java

License:Open Source License

/**
 * Constructs a new {@link MockApnsServer} with the previously-set configuration.
 *
 * @return a new MockApnsServer instance with the previously-set configuration
 *
 * @throws SSLException if an SSL context could not be created for the new server for any reason
 *
 * @since 0.8/*  w  w w. ja  v a  2s.  c o m*/
 */
public MockApnsServer build() throws SSLException {
    final SslContext sslContext;
    {
        final SslProvider sslProvider;

        if (this.preferredSslProvider != null) {
            sslProvider = this.preferredSslProvider;
        } else {
            if (OpenSsl.isAvailable()) {
                if (OpenSsl.isAlpnSupported()) {
                    log.info("Native SSL provider is available and supports ALPN; will use native provider.");
                    sslProvider = SslProvider.OPENSSL;
                } else {
                    log.info(
                            "Native SSL provider is available, but does not support ALPN; will use JDK SSL provider.");
                    sslProvider = SslProvider.JDK;
                }
            } else {
                log.info("Native SSL provider not available; will use JDK SSL provider.");
                sslProvider = SslProvider.JDK;
            }
        }

        final SslContextBuilder sslContextBuilder;

        if (this.certificateChain != null && this.privateKey != null) {
            sslContextBuilder = SslContextBuilder.forServer(this.privateKey, this.privateKeyPassword,
                    this.certificateChain);
        } else if (this.certificateChainPemFile != null && this.privateKeyPkcs8File != null) {
            sslContextBuilder = SslContextBuilder.forServer(this.certificateChainPemFile,
                    this.privateKeyPkcs8File, this.privateKeyPassword);
        } else if (this.certificateChainInputStream != null && this.privateKeyPkcs8InputStream != null) {
            sslContextBuilder = SslContextBuilder.forServer(this.certificateChainInputStream,
                    this.privateKeyPkcs8InputStream, this.privateKeyPassword);
        } else {
            throw new IllegalStateException("Must specify server credentials before building a mock server.");
        }

        sslContextBuilder.sslProvider(sslProvider)
                .ciphers(Http2SecurityUtil.CIPHERS, SupportedCipherSuiteFilter.INSTANCE)
                .clientAuth(ClientAuth.OPTIONAL).applicationProtocolConfig(
                        new ApplicationProtocolConfig(Protocol.ALPN, SelectorFailureBehavior.NO_ADVERTISE,
                                SelectedListenerFailureBehavior.ACCEPT, ApplicationProtocolNames.HTTP_2));

        sslContext = sslContextBuilder.build();
    }

    final MockApnsServer server = new MockApnsServer(sslContext, this.eventLoopGroup);
    server.setEmulateInternalErrors(this.emulateInternalErrors);

    return server;
}

From source file:com.turo.pushy.apns.MockApnsServerBuilder.java

License:Open Source License

/**
 * Constructs a new {@link MockApnsServer} with the previously-set configuration.
 *
 * @return a new MockApnsServer instance with the previously-set configuration
 *
 * @throws SSLException if an SSL context could not be created for the new server for any reason
 *
 * @since 0.8/*from  w w w. ja  va  2s  .co m*/
 */
public MockApnsServer build() throws SSLException {
    final SslContext sslContext;
    {
        final SslProvider sslProvider = SslUtil.getSslProvider();

        final SslContextBuilder sslContextBuilder;

        if (this.certificateChain != null && this.privateKey != null) {
            sslContextBuilder = SslContextBuilder.forServer(this.privateKey, this.privateKeyPassword,
                    this.certificateChain);
        } else if (this.certificateChainPemFile != null && this.privateKeyPkcs8File != null) {
            sslContextBuilder = SslContextBuilder.forServer(this.certificateChainPemFile,
                    this.privateKeyPkcs8File, this.privateKeyPassword);
        } else if (this.certificateChainInputStream != null && this.privateKeyPkcs8InputStream != null) {
            sslContextBuilder = SslContextBuilder.forServer(this.certificateChainInputStream,
                    this.privateKeyPkcs8InputStream, this.privateKeyPassword);
        } else {
            throw new IllegalStateException("Must specify server credentials before building a mock server.");
        }

        sslContextBuilder.sslProvider(sslProvider)
                .ciphers(Http2SecurityUtil.CIPHERS, SupportedCipherSuiteFilter.INSTANCE)
                .clientAuth(ClientAuth.OPTIONAL).applicationProtocolConfig(
                        new ApplicationProtocolConfig(Protocol.ALPN, SelectorFailureBehavior.NO_ADVERTISE,
                                SelectedListenerFailureBehavior.ACCEPT, ApplicationProtocolNames.HTTP_2));

        if (this.trustedClientCertificatePemFile != null) {
            sslContextBuilder.trustManager(this.trustedClientCertificatePemFile);
        } else if (this.trustedClientCertificateInputStream != null) {
            sslContextBuilder.trustManager(this.trustedClientCertificateInputStream);
        } else if (this.trustedClientCertificates != null) {
            sslContextBuilder.trustManager(this.trustedClientCertificates);
        }

        sslContext = sslContextBuilder.build();
    }

    final MockApnsServer server = new MockApnsServer(sslContext, this.eventLoopGroup);
    server.setEmulateInternalErrors(this.emulateInternalErrors);
    server.setEmulateExpiredFirstToken(this.emulateExpiredFirstToken);

    return server;
}

From source file:com.turo.pushy.apns.server.BaseHttp2ServerBuilder.java

License:Open Source License

/**
 * Constructs a new server with the previously-set configuration.
 *
 * @return a new server instance with the previously-set configuration
 *
 * @throws SSLException if an SSL context could not be created for the new server for any reason
 *
 * @since 0.8/*from   w w w  .  j a  va 2  s  . c  o m*/
 */
public T build() throws SSLException {
    final SslContext sslContext;
    {
        final SslProvider sslProvider;

        if (OpenSsl.isAvailable()) {
            log.info("Native SSL provider is available; will use native provider.");
            sslProvider = SslProvider.OPENSSL;
        } else {
            log.info("Native SSL provider not available; will use JDK SSL provider.");
            sslProvider = SslProvider.JDK;
        }

        final SslContextBuilder sslContextBuilder;

        if (this.certificateChain != null && this.privateKey != null) {
            sslContextBuilder = SslContextBuilder.forServer(this.privateKey, this.privateKeyPassword,
                    this.certificateChain);
        } else if (this.certificateChainPemFile != null && this.privateKeyPkcs8File != null) {
            sslContextBuilder = SslContextBuilder.forServer(this.certificateChainPemFile,
                    this.privateKeyPkcs8File, this.privateKeyPassword);
        } else if (this.certificateChainInputStream != null && this.privateKeyPkcs8InputStream != null) {
            sslContextBuilder = SslContextBuilder.forServer(this.certificateChainInputStream,
                    this.privateKeyPkcs8InputStream, this.privateKeyPassword);
        } else {
            throw new IllegalStateException("Must specify server credentials before building a mock server.");
        }

        sslContextBuilder.sslProvider(sslProvider)
                .ciphers(Http2SecurityUtil.CIPHERS, SupportedCipherSuiteFilter.INSTANCE)
                .clientAuth(ClientAuth.OPTIONAL);

        if (this.trustedClientCertificatePemFile != null) {
            sslContextBuilder.trustManager(this.trustedClientCertificatePemFile);
        } else if (this.trustedClientCertificateInputStream != null) {
            sslContextBuilder.trustManager(this.trustedClientCertificateInputStream);
        } else if (this.trustedClientCertificates != null) {
            sslContextBuilder.trustManager(this.trustedClientCertificates);
        }

        if (this.useAlpn) {
            sslContextBuilder.applicationProtocolConfig(
                    new ApplicationProtocolConfig(ApplicationProtocolConfig.Protocol.ALPN,
                            ApplicationProtocolConfig.SelectorFailureBehavior.NO_ADVERTISE,
                            ApplicationProtocolConfig.SelectedListenerFailureBehavior.ACCEPT,
                            ApplicationProtocolNames.HTTP_2));
        }

        sslContext = sslContextBuilder.build();
    }

    final T server = this.constructServer(sslContext);

    if (sslContext instanceof ReferenceCounted) {
        ((ReferenceCounted) sslContext).release();
    }

    return server;
}

From source file:io.gatling.http.client.impl.DefaultHttpClient.java

License:Apache License

public DefaultHttpClient(HttpClientConfig config) {
    this.config = config;
    try {/*  w  w w .  j a  v  a2  s  .c  om*/
        SslContextBuilder sslContextBuilder = SslContextBuilder.forClient();

        if (config.getSslSessionCacheSize() > 0) {
            sslContextBuilder.sessionCacheSize(config.getSslSessionCacheSize());
        }

        if (config.getSslSessionTimeout() > 0) {
            sslContextBuilder.sessionTimeout(config.getSslSessionTimeout());
        }

        if (isNonEmpty(config.getEnabledSslProtocols())) {
            sslContextBuilder.protocols(config.getEnabledSslProtocols());
        }

        if (isNonEmpty(config.getEnabledSslCipherSuites())) {
            sslContextBuilder.ciphers(Arrays.asList(config.getEnabledSslCipherSuites()));
        } else if (!config.isFilterInsecureCipherSuites()) {
            sslContextBuilder.ciphers(null, IdentityCipherSuiteFilter.INSTANCE_DEFAULTING_TO_SUPPORTED_CIPHERS);
        }

        sslContextBuilder.sslProvider(config.isUseOpenSsl() ? SslProvider.OPENSSL : SslProvider.JDK)
                .keyManager(config.getKeyManagerFactory()).trustManager(config.getTrustManagerFactory());

        this.sslContext = sslContextBuilder.build();

        this.alpnSslContext = sslContextBuilder.applicationProtocolConfig(
                new ApplicationProtocolConfig(ApplicationProtocolConfig.Protocol.ALPN,
                        // NO_ADVERTISE is currently the only mode supported by both OpenSsl and JDK providers.
                        ApplicationProtocolConfig.SelectorFailureBehavior.NO_ADVERTISE,
                        // ACCEPT is currently the only mode supported by both OpenSsl and JDK providers.
                        ApplicationProtocolConfig.SelectedListenerFailureBehavior.ACCEPT,
                        ApplicationProtocolNames.HTTP_2, ApplicationProtocolNames.HTTP_1_1))
                .build();

    } catch (SSLException e) {
        throw new IllegalArgumentException("Impossible to create SslContext", e);
    }

    DefaultThreadFactory threadFactory = new DefaultThreadFactory(config.getThreadPoolName());
    eventLoopGroup = config.isUseNativeTransport() ? new EpollEventLoopGroup(0, threadFactory)
            : new NioEventLoopGroup(0, threadFactory);
    eventLoopPicker = new AffinityEventLoopPicker(eventLoopGroup);
    channelGroup = new DefaultChannelGroup(eventLoopGroup.next());
}