Sign Up
Log In
Log In
or
Sign Up
Places
All Projects
Status Monitor
Collapse sidebar
openSUSE:Backports:SLE-15-SP3:Update
netty
0003-Remove-conscrypt-ALPN.patch
Overview
Repositories
Revisions
Requests
Users
Attributes
Meta
File 0003-Remove-conscrypt-ALPN.patch of Package netty
From 039534e20546221c3466d1ceb663625c59edb0e7 Mon Sep 17 00:00:00 2001 From: Michael Simacek <msimacek@redhat.com> Date: Tue, 11 Jul 2017 13:37:22 +0200 Subject: [PATCH 3/3] Remove conscrypt ALPN --- handler/pom.xml | 6 - .../netty/handler/ssl/ConscryptAlpnSslEngine.java | 176 --------------------- .../ssl/JdkAlpnApplicationProtocolNegotiator.java | 6 +- .../main/java/io/netty/handler/ssl/SslHandler.java | 35 ---- .../ssl/ConscryptJdkSslEngineInteropTest.java | 76 --------- .../io/netty/handler/ssl/Java8SslTestUtils.java | 7 - .../ssl/JdkConscryptSslEngineInteropTest.java | 86 ---------- .../io/netty/handler/ssl/JdkSslEngineTest.java | 2 +- 8 files changed, 2 insertions(+), 392 deletions(-) delete mode 100644 handler/src/main/java/io/netty/handler/ssl/ConscryptAlpnSslEngine.java delete mode 100644 handler/src/test/java/io/netty/handler/ssl/ConscryptJdkSslEngineInteropTest.java delete mode 100644 handler/src/test/java/io/netty/handler/ssl/JdkConscryptSslEngineInteropTest.java diff --git a/handler/pom.xml b/handler/pom.xml index 52e63ca..69af32a 100644 --- a/handler/pom.xml +++ b/handler/pom.xml @@ -60,12 +60,6 @@ <optional>true</optional> </dependency> <dependency> - <groupId>${conscrypt.groupId}</groupId> - <artifactId>${conscrypt.artifactId}</artifactId> - <classifier>${conscrypt.classifier}</classifier> - <optional>true</optional> - </dependency> - <dependency> <groupId>org.mockito</groupId> <artifactId>mockito-core</artifactId> </dependency> diff --git a/handler/src/main/java/io/netty/handler/ssl/ConscryptAlpnSslEngine.java b/handler/src/main/java/io/netty/handler/ssl/ConscryptAlpnSslEngine.java deleted file mode 100644 index 8e7a544..0000000 --- a/handler/src/main/java/io/netty/handler/ssl/ConscryptAlpnSslEngine.java +++ /dev/null @@ -1,176 +0,0 @@ -/* - * Copyright 2017 The Netty Project - * - * The Netty Project licenses this file to you under the Apache License, - * version 2.0 (the "License"); you may not use this file except in compliance - * with the License. You may obtain a copy of the License at: - * - * http://www.apache.org/licenses/LICENSE-2.0 - * - * Unless required by applicable law or agreed to in writing, software - * distributed under the License is distributed on an "AS IS" BASIS, WITHOUT - * WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the - * License for the specific language governing permissions and limitations - * under the License. - */ -package io.netty.handler.ssl; - -import static io.netty.handler.ssl.SslUtils.toSSLHandshakeException; -import static io.netty.util.internal.ObjectUtil.checkNotNull; -import static java.lang.Math.min; - -import io.netty.handler.ssl.JdkApplicationProtocolNegotiator.ProtocolSelectionListener; -import io.netty.handler.ssl.JdkApplicationProtocolNegotiator.ProtocolSelector; -import java.lang.reflect.Method; -import java.nio.ByteBuffer; -import java.util.Collections; -import java.util.LinkedHashSet; -import java.util.List; -import javax.net.ssl.SSLEngine; -import javax.net.ssl.SSLEngineResult; -import javax.net.ssl.SSLException; - -import io.netty.util.internal.PlatformDependent; -import org.conscrypt.Conscrypt; -import org.conscrypt.HandshakeListener; - -/** - * A {@link JdkSslEngine} that uses the Conscrypt provider or SSL with ALPN. - */ -abstract class ConscryptAlpnSslEngine extends JdkSslEngine { - private static final Class<?> ENGINES_CLASS = getEnginesClass(); - - /** - * Indicates whether or not conscrypt is available on the current system. - */ - static boolean isAvailable() { - return ENGINES_CLASS != null && PlatformDependent.javaVersion() >= 8; - } - - static boolean isEngineSupported(SSLEngine engine) { - return isAvailable() && isConscryptEngine(engine, ENGINES_CLASS); - } - - static ConscryptAlpnSslEngine newClientEngine(SSLEngine engine, - JdkApplicationProtocolNegotiator applicationNegotiator) { - return new ClientEngine(engine, applicationNegotiator); - } - - static ConscryptAlpnSslEngine newServerEngine(SSLEngine engine, - JdkApplicationProtocolNegotiator applicationNegotiator) { - return new ServerEngine(engine, applicationNegotiator); - } - - private ConscryptAlpnSslEngine(SSLEngine engine, List<String> protocols) { - super(engine); - - // Set the list of supported ALPN protocols on the engine. - Conscrypt.Engines.setAlpnProtocols(engine, protocols.toArray(new String[protocols.size()])); - } - - /** - * Calculates the maximum size of the encrypted output buffer required to wrap the given plaintext bytes. Assumes - * as a worst case that there is one TLS record per buffer. - * - * @param plaintextBytes the number of plaintext bytes to be wrapped. - * @param numBuffers the number of buffers that the plaintext bytes are spread across. - * @return the maximum size of the encrypted output buffer required for the wrap operation. - */ - final int calculateOutNetBufSize(int plaintextBytes, int numBuffers) { - // Assuming a max of one frame per component in a composite buffer. - long maxOverhead = (long) Conscrypt.Engines.maxSealOverhead(getWrappedEngine()) * numBuffers; - // TODO(nmittler): update this to use MAX_ENCRYPTED_PACKET_LENGTH instead of Integer.MAX_VALUE - return (int) min(Integer.MAX_VALUE, plaintextBytes + maxOverhead); - } - - final SSLEngineResult unwrap(ByteBuffer[] srcs, ByteBuffer[] dests) throws SSLException { - return Conscrypt.Engines.unwrap(getWrappedEngine(), srcs, dests); - } - - private static final class ClientEngine extends ConscryptAlpnSslEngine { - private final ProtocolSelectionListener protocolListener; - - ClientEngine(SSLEngine engine, - JdkApplicationProtocolNegotiator applicationNegotiator) { - super(engine, applicationNegotiator.protocols()); - // Register for completion of the handshake. - Conscrypt.Engines.setHandshakeListener(engine, new HandshakeListener() { - @Override - public void onHandshakeFinished() throws SSLException { - selectProtocol(); - } - }); - - protocolListener = checkNotNull(applicationNegotiator - .protocolListenerFactory().newListener(this, applicationNegotiator.protocols()), - "protocolListener"); - } - - private void selectProtocol() throws SSLException { - String protocol = Conscrypt.Engines.getAlpnSelectedProtocol(getWrappedEngine()); - try { - protocolListener.selected(protocol); - } catch (Throwable e) { - throw toSSLHandshakeException(e); - } - } - } - - private static final class ServerEngine extends ConscryptAlpnSslEngine { - private final ProtocolSelector protocolSelector; - - ServerEngine(SSLEngine engine, JdkApplicationProtocolNegotiator applicationNegotiator) { - super(engine, applicationNegotiator.protocols()); - - // Register for completion of the handshake. - Conscrypt.Engines.setHandshakeListener(engine, new HandshakeListener() { - @Override - public void onHandshakeFinished() throws SSLException { - selectProtocol(); - } - }); - - protocolSelector = checkNotNull(applicationNegotiator.protocolSelectorFactory() - .newSelector(this, - new LinkedHashSet<String>(applicationNegotiator.protocols())), - "protocolSelector"); - } - - private void selectProtocol() throws SSLException { - try { - String protocol = Conscrypt.Engines.getAlpnSelectedProtocol(getWrappedEngine()); - protocolSelector.select(protocol != null ? Collections.singletonList(protocol) - : Collections.<String>emptyList()); - } catch (Throwable e) { - throw toSSLHandshakeException(e); - } - } - } - - private static Class<?> getEnginesClass() { - try { - // Always use bootstrap class loader. - Class<?> engineClass = Class.forName("org.conscrypt.Conscrypt$Engines", true, - ConscryptAlpnSslEngine.class.getClassLoader()); - // Ensure that it also has the isConscrypt method. - getIsConscryptMethod(engineClass); - return engineClass; - } catch (Throwable ignore) { - // Conscrypt was not loaded. - return null; - } - } - - private static boolean isConscryptEngine(SSLEngine engine, Class<?> enginesClass) { - try { - Method method = getIsConscryptMethod(enginesClass); - return (Boolean) method.invoke(null, engine); - } catch (Throwable ignore) { - return false; - } - } - - private static Method getIsConscryptMethod(Class<?> enginesClass) throws NoSuchMethodException { - return enginesClass.getMethod("isConscrypt", SSLEngine.class); - } -} diff --git a/handler/src/main/java/io/netty/handler/ssl/JdkAlpnApplicationProtocolNegotiator.java b/handler/src/main/java/io/netty/handler/ssl/JdkAlpnApplicationProtocolNegotiator.java index f82c7da..9c4ab9e 100644 --- a/handler/src/main/java/io/netty/handler/ssl/JdkAlpnApplicationProtocolNegotiator.java +++ b/handler/src/main/java/io/netty/handler/ssl/JdkAlpnApplicationProtocolNegotiator.java @@ -21,7 +21,7 @@ import javax.net.ssl.SSLEngine; * The {@link JdkApplicationProtocolNegotiator} to use if you need ALPN and are using {@link SslProvider#JDK}. */ public final class JdkAlpnApplicationProtocolNegotiator extends JdkBaseApplicationProtocolNegotiator { - private static final boolean AVAILABLE = ConscryptAlpnSslEngine.isAvailable() || JettyAlpnSslEngine.isAvailable(); + private static final boolean AVAILABLE = JettyAlpnSslEngine.isAvailable(); private static final SslEngineWrapperFactory ALPN_WRAPPER = AVAILABLE ? new AlpnWrapper() : new FailureWrapper(); /** @@ -121,10 +121,6 @@ public final class JdkAlpnApplicationProtocolNegotiator extends JdkBaseApplicati @Override public SSLEngine wrapSslEngine(SSLEngine engine, JdkApplicationProtocolNegotiator applicationNegotiator, boolean isServer) { - if (ConscryptAlpnSslEngine.isEngineSupported(engine)) { - return isServer ? ConscryptAlpnSslEngine.newServerEngine(engine, applicationNegotiator) - : ConscryptAlpnSslEngine.newClientEngine(engine, applicationNegotiator); - } if (JettyAlpnSslEngine.isAvailable()) { return isServer ? JettyAlpnSslEngine.newServerEngine(engine, applicationNegotiator) : JettyAlpnSslEngine.newClientEngine(engine, applicationNegotiator); diff --git a/handler/src/main/java/io/netty/handler/ssl/SslHandler.java b/handler/src/main/java/io/netty/handler/ssl/SslHandler.java index 05c451a..8693011 100644 --- a/handler/src/main/java/io/netty/handler/ssl/SslHandler.java +++ b/handler/src/main/java/io/netty/handler/ssl/SslHandler.java @@ -187,38 +187,6 @@ public class SslHandler extends ByteToMessageDecoder implements ChannelOutboundH new ClosedChannelException(), SslHandler.class, "channelInactive(...)"); private enum SslEngineType { - CONSCRYPT(true, COMPOSITE_CUMULATOR) { - @Override - SSLEngineResult unwrap(SslHandler handler, ByteBuf in, int readerIndex, int len, ByteBuf out) - throws SSLException { - int nioBufferCount = in.nioBufferCount(); - int writerIndex = out.writerIndex(); - final SSLEngineResult result; - if (nioBufferCount > 1) { - /* - * Use a special unwrap method without additional memory copies. - */ - try { - handler.singleBuffer[0] = toByteBuffer(out, writerIndex, out.writableBytes()); - result = ((ConscryptAlpnSslEngine) handler.engine).unwrap( - in.nioBuffers(readerIndex, len), - handler.singleBuffer); - } finally { - handler.singleBuffer[0] = null; - } - } else { - result = handler.engine.unwrap(toByteBuffer(in, readerIndex, len), - toByteBuffer(out, writerIndex, out.writableBytes())); - } - out.writerIndex(writerIndex + result.bytesProduced()); - return result; - } - - @Override - int calculateWrapBufferCapacity(SslHandler handler, int pendingBytes, int numComponents) { - return ((ConscryptAlpnSslEngine) handler.engine).calculateOutNetBufSize(pendingBytes, numComponents); - } - }, JDK(false, MERGE_CUMULATOR) { @Override SSLEngineResult unwrap(SslHandler handler, ByteBuf in, int readerIndex, int len, ByteBuf out) @@ -237,9 +205,6 @@ public class SslHandler extends ByteToMessageDecoder implements ChannelOutboundH }; static SslEngineType forEngine(SSLEngine engine) { - if (engine instanceof ConscryptAlpnSslEngine) { - return CONSCRYPT; - } return JDK; } diff --git a/handler/src/test/java/io/netty/handler/ssl/ConscryptJdkSslEngineInteropTest.java b/handler/src/test/java/io/netty/handler/ssl/ConscryptJdkSslEngineInteropTest.java deleted file mode 100644 index e217136..0000000 --- a/handler/src/test/java/io/netty/handler/ssl/ConscryptJdkSslEngineInteropTest.java +++ /dev/null @@ -1,76 +0,0 @@ -/* - * Copyright 2016 The Netty Project - * - * The Netty Project licenses this file to you under the Apache License, - * version 2.0 (the "License"); you may not use this file except in compliance - * with the License. You may obtain a copy of the License at: - * - * http://www.apache.org/licenses/LICENSE-2.0 - * - * Unless required by applicable law or agreed to in writing, software - * distributed under the License is distributed on an "AS IS" BASIS, WITHOUT - * WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the - * License for the specific language governing permissions and limitations - * under the License. - */ -package io.netty.handler.ssl; - -import java.security.Provider; -import org.junit.BeforeClass; -import org.junit.Ignore; - -import org.junit.runner.RunWith; -import org.junit.runners.Parameterized; - -import java.util.ArrayList; -import java.util.Collection; -import java.util.List; - -import static org.junit.Assume.assumeTrue; - -@RunWith(Parameterized.class) -public class ConscryptJdkSslEngineInteropTest extends SSLEngineTest { - - @Parameterized.Parameters(name = "{index}: bufferType = {0}") - public static Collection<Object> data() { - List<Object> params = new ArrayList<Object>(); - for (BufferType type: BufferType.values()) { - params.add(type); - } - return params; - } - - public ConscryptJdkSslEngineInteropTest(BufferType type) { - super(type); - } - - @BeforeClass - public static void checkConscrypt() { - assumeTrue(ConscryptAlpnSslEngine.isAvailable()); - } - - @Override - protected SslProvider sslClientProvider() { - return SslProvider.JDK; - } - - @Override - protected SslProvider sslServerProvider() { - return SslProvider.JDK; - } - - @Override - protected Provider clientSslContextProvider() { - return Java8SslTestUtils.conscryptProvider(); - } - - @Ignore /* Does the JDK support a "max certificate chain length"? */ - @Override - public void testMutualAuthValidClientCertChainTooLongFailOptionalClientAuth() throws Exception { - } - - @Ignore /* Does the JDK support a "max certificate chain length"? */ - @Override - public void testMutualAuthValidClientCertChainTooLongFailRequireClientAuth() throws Exception { - } -} diff --git a/handler/src/test/java/io/netty/handler/ssl/Java8SslTestUtils.java b/handler/src/test/java/io/netty/handler/ssl/Java8SslTestUtils.java index cc2e6c6..f9cf771 100644 --- a/handler/src/test/java/io/netty/handler/ssl/Java8SslTestUtils.java +++ b/handler/src/test/java/io/netty/handler/ssl/Java8SslTestUtils.java @@ -16,12 +16,9 @@ package io.netty.handler.ssl; -import org.conscrypt.OpenSSLProvider; - import javax.net.ssl.SNIMatcher; import javax.net.ssl.SNIServerName; import javax.net.ssl.SSLParameters; -import java.security.Provider; import java.util.Collections; final class Java8SslTestUtils { @@ -37,8 +34,4 @@ final class Java8SslTestUtils { }; parameters.setSNIMatchers(Collections.singleton(matcher)); } - - static Provider conscryptProvider() { - return new OpenSSLProvider(); - } } diff --git a/handler/src/test/java/io/netty/handler/ssl/JdkConscryptSslEngineInteropTest.java b/handler/src/test/java/io/netty/handler/ssl/JdkConscryptSslEngineInteropTest.java deleted file mode 100644 index 0625f7a..0000000 --- a/handler/src/test/java/io/netty/handler/ssl/JdkConscryptSslEngineInteropTest.java +++ /dev/null @@ -1,86 +0,0 @@ -/* - * Copyright 2017 The Netty Project - * - * The Netty Project licenses this file to you under the Apache License, - * version 2.0 (the "License"); you may not use this file except in compliance - * with the License. You may obtain a copy of the License at: - * - * http://www.apache.org/licenses/LICENSE-2.0 - * - * Unless required by applicable law or agreed to in writing, software - * distributed under the License is distributed on an "AS IS" BASIS, WITHOUT - * WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the - * License for the specific language governing permissions and limitations - * under the License. - */ -package io.netty.handler.ssl; - -import java.security.Provider; -import org.junit.BeforeClass; -import org.junit.Ignore; -import org.junit.Test; -import org.junit.runner.RunWith; -import org.junit.runners.Parameterized; - -import java.util.ArrayList; -import java.util.Collection; -import java.util.List; - -import static org.junit.Assume.assumeTrue; - -@RunWith(Parameterized.class) -public class JdkConscryptSslEngineInteropTest extends SSLEngineTest { - - @Parameterized.Parameters(name = "{index}: bufferType = {0}") - public static Collection<Object> data() { - List<Object> params = new ArrayList<Object>(); - for (BufferType type: BufferType.values()) { - params.add(type); - } - return params; - } - - public JdkConscryptSslEngineInteropTest(BufferType type) { - super(type); - } - - @BeforeClass - public static void checkConscrypt() { - assumeTrue(ConscryptAlpnSslEngine.isAvailable()); - } - - @Override - protected SslProvider sslClientProvider() { - return SslProvider.JDK; - } - - @Override - protected SslProvider sslServerProvider() { - return SslProvider.JDK; - } - - @Override - protected Provider serverSslContextProvider() { - return Java8SslTestUtils.conscryptProvider(); - } - - @Override - @Test - @Ignore("TODO: Make this work with Conscrypt") - public void testMutualAuthValidClientCertChainTooLongFailOptionalClientAuth() throws Exception { - super.testMutualAuthValidClientCertChainTooLongFailOptionalClientAuth(); - } - - @Override - @Test - @Ignore("TODO: Make this work with Conscrypt") - public void testMutualAuthValidClientCertChainTooLongFailRequireClientAuth() throws Exception { - super.testMutualAuthValidClientCertChainTooLongFailRequireClientAuth(); - } - - @Override - protected boolean mySetupMutualAuthServerIsValidClientException(Throwable cause) { - // TODO(scott): work around for a JDK issue. The exception should be SSLHandshakeException. - return super.mySetupMutualAuthServerIsValidClientException(cause) || causedBySSLException(cause); - } -} diff --git a/handler/src/test/java/io/netty/handler/ssl/JdkSslEngineTest.java b/handler/src/test/java/io/netty/handler/ssl/JdkSslEngineTest.java index 4489b16..e32fa0d 100644 --- a/handler/src/test/java/io/netty/handler/ssl/JdkSslEngineTest.java +++ b/handler/src/test/java/io/netty/handler/ssl/JdkSslEngineTest.java @@ -81,7 +81,7 @@ public class JdkSslEngineTest extends SSLEngineTest { @Override boolean isAvailable() { - return ConscryptAlpnSslEngine.isAvailable(); + return false; } @Override -- 2.9.4
Locations
Projects
Search
Status Monitor
Help
OpenBuildService.org
Documentation
API Documentation
Code of Conduct
Contact
Support
@OBShq
Terms
openSUSE Build Service is sponsored by
The Open Build Service is an
openSUSE project
.
Sign Up
Log In
Places
Places
All Projects
Status Monitor
