resultCallback) {
42 | final byte[] result;
43 | try {
44 | result = method.decrypt(ssl, input);
45 | } catch (Throwable cause) {
46 | resultCallback.onError(ssl, cause);
47 | return;
48 | }
49 | resultCallback.onSuccess(ssl, result);
50 | }
51 | }
52 |
--------------------------------------------------------------------------------
/openssl-classes/src/main/java/io/netty/internal/tcnative/AsyncTask.java:
--------------------------------------------------------------------------------
1 | /*
2 | * Copyright 2021 The Netty Project
3 | *
4 | * The Netty Project licenses this file to you under the Apache License,
5 | * version 2.0 (the "License"); you may not use this file except in compliance
6 | * with the License. You may obtain a copy of the License at:
7 | *
8 | * http://www.apache.org/licenses/LICENSE-2.0
9 | *
10 | * Unless required by applicable law or agreed to in writing, software
11 | * distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
12 | * WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the
13 | * License for the specific language governing permissions and limitations
14 | * under the License.
15 | */
16 | package io.netty.internal.tcnative;
17 |
18 | public interface AsyncTask extends Runnable {
19 |
20 | /**
21 | * Run this {@link AsyncTask} in an async fashion. Which means it will be run and completed at some point.
22 | * Once it is done the {@link Runnable} is called
23 | *
24 | * @param completeCallback The {@link Runnable} that is run once the task was run and completed.
25 | */
26 | void runAsync(Runnable completeCallback);
27 | }
28 |
--------------------------------------------------------------------------------
/openssl-classes/src/main/java/io/netty/internal/tcnative/Buffer.java:
--------------------------------------------------------------------------------
1 | /*
2 | * Copyright 2016 The Netty Project
3 | *
4 | * The Netty Project licenses this file to you under the Apache License,
5 | * version 2.0 (the "License"); you may not use this file except in compliance
6 | * with the License. You may obtain a copy of the License at:
7 | *
8 | * http://www.apache.org/licenses/LICENSE-2.0
9 | *
10 | * Unless required by applicable law or agreed to in writing, software
11 | * distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
12 | * WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the
13 | * License for the specific language governing permissions and limitations
14 | * under the License.
15 | */
16 | /*
17 | * Licensed to the Apache Software Foundation (ASF) under one or more
18 | * contributor license agreements. See the NOTICE file distributed with
19 | * this work for additional information regarding copyright ownership.
20 | * The ASF licenses this file to You under the Apache License, Version 2.0
21 | * (the "License"); you may not use this file except in compliance with
22 | * the License. You may obtain a copy of the License at
23 | *
24 | * http://www.apache.org/licenses/LICENSE-2.0
25 | *
26 | * Unless required by applicable law or agreed to in writing, software
27 | * distributed under the License is distributed on an "AS IS" BASIS,
28 | * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
29 | * See the License for the specific language governing permissions and
30 | * limitations under the License.
31 | */
32 |
33 | package io.netty.internal.tcnative;
34 |
35 | import java.nio.ByteBuffer;
36 |
37 | public final class Buffer {
38 |
39 | private Buffer() { }
40 |
41 | /**
42 | * Returns the memory address of the ByteBuffer.
43 | * @param buf Previously allocated ByteBuffer.
44 | * @return the memory address.
45 | */
46 | public static native long address(ByteBuffer buf);
47 |
48 | /**
49 | * Returns the allocated memory size of the ByteBuffer.
50 | * @param buf Previously allocated ByteBuffer.
51 | * @return the allocated memory size
52 | */
53 | public static native long size(ByteBuffer buf);
54 | }
55 |
--------------------------------------------------------------------------------
/openssl-classes/src/main/java/io/netty/internal/tcnative/CertificateCallback.java:
--------------------------------------------------------------------------------
1 | /*
2 | * Copyright 2018 The Netty Project
3 | *
4 | * The Netty Project licenses this file to you under the Apache License,
5 | * version 2.0 (the "License"); you may not use this file except in compliance
6 | * with the License. You may obtain a copy of the License at:
7 | *
8 | * http://www.apache.org/licenses/LICENSE-2.0
9 | *
10 | * Unless required by applicable law or agreed to in writing, software
11 | * distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
12 | * WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the
13 | * License for the specific language governing permissions and limitations
14 | * under the License.
15 | */
16 | package io.netty.internal.tcnative;
17 |
18 | /**
19 | * Is called during handshake and hooked into openssl via {@code SSL_CTX_set_cert_cb}.
20 | *
21 | * IMPORTANT: Implementations of this interface should be static as it is stored as a global reference via JNI. This
22 | * means if you use an inner / anonymous class to implement this and also depend on the finalizer of the
23 | * class to free up the SSLContext the finalizer will never run as the object is never GC, due the hard
24 | * reference to the enclosing class. This will most likely result in a memory leak.
25 | */
26 | public interface CertificateCallback {
27 |
28 | /**
29 | * The types contained in the {@code keyTypeBytes} array.
30 | */
31 | // Extracted from https://github.com/openssl/openssl/blob/master/include/openssl/tls1.h
32 | byte TLS_CT_RSA_SIGN = 1;
33 | byte TLS_CT_DSS_SIGN = 2;
34 | byte TLS_CT_RSA_FIXED_DH = 3;
35 | byte TLS_CT_DSS_FIXED_DH = 4;
36 | byte TLS_CT_ECDSA_SIGN = 64;
37 | byte TLS_CT_RSA_FIXED_ECDH = 65;
38 | byte TLS_CT_ECDSA_FIXED_ECDH = 66;
39 |
40 | /**
41 | * Called during cert selection. If a certificate chain / key should be used
42 | * {@link SSL#setKeyMaterial(long, long, long)} must be called from this callback after
43 | * all preparations / validations were completed.
44 | *
45 | * @param ssl the SSL instance
46 | * @param keyTypeBytes an array of the key types on client-mode or {@code null} on server-mode.
47 | * @param asn1DerEncodedPrincipals the principals or {@code null}.
48 | *
49 | */
50 | void handle(long ssl, byte[] keyTypeBytes, byte[][] asn1DerEncodedPrincipals) throws Exception;
51 | }
52 |
--------------------------------------------------------------------------------
/openssl-classes/src/main/java/io/netty/internal/tcnative/CertificateCallbackTask.java:
--------------------------------------------------------------------------------
1 | /*
2 | * Copyright 2019 The Netty Project
3 | *
4 | * The Netty Project licenses this file to you under the Apache License,
5 | * version 2.0 (the "License"); you may not use this file except in compliance
6 | * with the License. You may obtain a copy of the License at:
7 | *
8 | * http://www.apache.org/licenses/LICENSE-2.0
9 | *
10 | * Unless required by applicable law or agreed to in writing, software
11 | * distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
12 | * WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the
13 | * License for the specific language governing permissions and limitations
14 | * under the License.
15 | */
16 | package io.netty.internal.tcnative;
17 |
18 | /**
19 | * Execute {@link CertificateCallback#handle(long, byte[], byte[][])}.
20 | */
21 | final class CertificateCallbackTask extends SSLTask {
22 | private final byte[] keyTypeBytes;
23 | private final byte[][] asn1DerEncodedPrincipals;
24 | private final CertificateCallback callback;
25 |
26 | CertificateCallbackTask(long ssl, byte[] keyTypeBytes, byte[][] asn1DerEncodedPrincipals,
27 | CertificateCallback callback) {
28 | // It is important that this constructor never throws. Be sure to not change this!
29 | super(ssl);
30 | // It's ok to not clone the arrays as we create these in JNI and not-reuse.
31 | this.keyTypeBytes = keyTypeBytes;
32 | this.asn1DerEncodedPrincipals = asn1DerEncodedPrincipals;
33 | this.callback = callback;
34 | }
35 |
36 | // See https://www.openssl.org/docs/man1.0.2/man3/SSL_set_cert_cb.html.
37 | @Override
38 | protected void runTask(long ssl, TaskCallback taskCallback) {
39 | try {
40 | callback.handle(ssl, keyTypeBytes, asn1DerEncodedPrincipals);
41 | taskCallback.onResult(ssl, 1);
42 | } catch (Exception e) {
43 | // Just catch the exception and return 0 to fail the handshake.
44 | // The problem is that rethrowing here is really "useless" as we will process it as part of an openssl
45 | // c callback which needs to return 0 for an error to abort the handshake.
46 | taskCallback.onResult(ssl, 0);
47 | }
48 | }
49 | }
50 |
--------------------------------------------------------------------------------
/openssl-classes/src/main/java/io/netty/internal/tcnative/CertificateCompressionAlgo.java:
--------------------------------------------------------------------------------
1 | /*
2 | * Copyright 2022 The Netty Project
3 | *
4 | * The Netty Project licenses this file to you under the Apache License,
5 | * version 2.0 (the "License"); you may not use this file except in compliance
6 | * with the License. You may obtain a copy of the License at:
7 | *
8 | * http://www.apache.org/licenses/LICENSE-2.0
9 | *
10 | * Unless required by applicable law or agreed to in writing, software
11 | * distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
12 | * WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the
13 | * License for the specific language governing permissions and limitations
14 | * under the License.
15 | */
16 | package io.netty.internal.tcnative;
17 |
18 | /**
19 | * Provides compression/decompression implementations for TLS Certificate Compression
20 | * (RFC 8879).
21 | */
22 | public interface CertificateCompressionAlgo {
23 | int TLS_EXT_CERT_COMPRESSION_ZLIB = NativeStaticallyReferencedJniMethods.tlsExtCertCompressionZlib();
24 | int TLS_EXT_CERT_COMPRESSION_BROTLI = NativeStaticallyReferencedJniMethods.tlsExtCertCompressionBrotli();
25 | int TLS_EXT_CERT_COMPRESSION_ZSTD = NativeStaticallyReferencedJniMethods.tlsExtCertCompressionZstd();
26 |
27 | /**
28 | * Compress the given input with the specified algorithm and return the compressed bytes.
29 | *
30 | * @param ssl the SSL instance
31 | * @param input the uncompressed form of the certificate
32 | * @return the compressed form of the certificate
33 | * @throws Exception thrown if an error occurs while compressing
34 | */
35 | byte[] compress(long ssl, byte[] input) throws Exception;
36 |
37 | /**
38 | * Decompress the given input with the specified algorithm and return the decompressed bytes.
39 | *
40 | *
42 | * Implementations SHOULD bound the memory usage when decompressing the CompressedCertificate message.
43 | *
44 | * Implementations MUST limit the size of the resulting decompressed chain to the specified {@code uncompressedLen},
45 | * and they MUST abort the connection (throw an exception) if the size of the output of the decompression
46 | * function exceeds that limit.
47 | *
48 | *
49 | * @param ssl the SSL instance
50 | * @param uncompressedLen the expected length of the uncompressed certificate
51 | * @param input the compressed form of the certificate
52 | * @return the decompressed form of the certificate
53 | * @throws Exception thrown if an error occurs while decompressing or output
54 | * size exceeds {@code uncompressedLen}
55 | */
56 | byte[] decompress(long ssl, int uncompressedLen, byte[] input) throws Exception;
57 |
58 | /**
59 | * Return the ID for the compression algorithm provided for by a given implementation.
60 | *
61 | * @return compression algorithm ID as specified by RFC8879
62 | *
63 | * {@link CertificateCompressionAlgo#TLS_EXT_CERT_COMPRESSION_ZLIB}
64 | * {@link CertificateCompressionAlgo#TLS_EXT_CERT_COMPRESSION_BROTLI}
65 | * {@link CertificateCompressionAlgo#TLS_EXT_CERT_COMPRESSION_ZSTD}
66 | *
67 | */
68 | int algorithmId();
69 |
70 | }
71 |
--------------------------------------------------------------------------------
/openssl-classes/src/main/java/io/netty/internal/tcnative/CertificateRequestedCallback.java:
--------------------------------------------------------------------------------
1 | /*
2 | * Copyright 2016 The Netty Project
3 | *
4 | * The Netty Project licenses this file to you under the Apache License,
5 | * version 2.0 (the "License"); you may not use this file except in compliance
6 | * with the License. You may obtain a copy of the License at:
7 | *
8 | * http://www.apache.org/licenses/LICENSE-2.0
9 | *
10 | * Unless required by applicable law or agreed to in writing, software
11 | * distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
12 | * WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the
13 | * License for the specific language governing permissions and limitations
14 | * under the License.
15 | */
16 | package io.netty.internal.tcnative;
17 |
18 | /**
19 | * Is called during handshake and hooked into openssl via {@code SSL_CTX_set_client_cert_cb}.
20 | *
21 | * IMPORTANT: Implementations of this interface should be static as it is stored as a global reference via JNI. This
22 | * means if you use an inner / anonymous class to implement this and also depend on the finalizer of the
23 | * class to free up the SSLContext the finalizer will never run as the object is never GC, due the hard
24 | * reference to the enclosing class. This will most likely result in a memory leak.+
25 | *
26 | * @deprecated use {@link CertificateCallback}
27 | */
28 | @Deprecated
29 | public interface CertificateRequestedCallback {
30 |
31 | /**
32 | * The types contained in the {@code keyTypeBytes} array.
33 | */
34 | // Extracted from https://github.com/openssl/openssl/blob/master/include/openssl/tls1.h
35 | byte TLS_CT_RSA_SIGN = CertificateCallback.TLS_CT_RSA_SIGN;
36 | byte TLS_CT_DSS_SIGN = CertificateCallback.TLS_CT_DSS_SIGN;
37 | byte TLS_CT_RSA_FIXED_DH = CertificateCallback.TLS_CT_RSA_FIXED_DH;
38 | byte TLS_CT_DSS_FIXED_DH = CertificateCallback.TLS_CT_DSS_FIXED_DH;
39 | byte TLS_CT_ECDSA_SIGN = CertificateCallback.TLS_CT_ECDSA_SIGN;
40 | byte TLS_CT_RSA_FIXED_ECDH = CertificateCallback.TLS_CT_RSA_FIXED_ECDH;
41 | byte TLS_CT_ECDSA_FIXED_ECDH = CertificateCallback.TLS_CT_ECDSA_FIXED_ECDH;
42 |
43 | /**
44 | * Called during cert selection. If a certificate chain / key should be used
45 | * {@link SSL#setKeyMaterialClientSide(long, long, long, long, long)} must be called from this callback after
46 | * all preparations / validations were completed.
47 | *
48 | * @param ssl the SSL instance
49 | * @param certOut the pointer to the pointer of the certificate to use.
50 | * @param keyOut the pointer to the pointer of the private key to use.
51 | * @param keyTypeBytes an array of the key types.
52 | * @param asn1DerEncodedPrincipals the principals
53 | *
54 | */
55 | void requested(long ssl, long certOut, long keyOut, byte[] keyTypeBytes, byte[][] asn1DerEncodedPrincipals)
56 | throws Exception;
57 | }
58 |
--------------------------------------------------------------------------------
/openssl-classes/src/main/java/io/netty/internal/tcnative/CertificateVerifierTask.java:
--------------------------------------------------------------------------------
1 | /*
2 | * Copyright 2019 The Netty Project
3 | *
4 | * The Netty Project licenses this file to you under the Apache License,
5 | * version 2.0 (the "License"); you may not use this file except in compliance
6 | * with the License. You may obtain a copy of the License at:
7 | *
8 | * http://www.apache.org/licenses/LICENSE-2.0
9 | *
10 | * Unless required by applicable law or agreed to in writing, software
11 | * distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
12 | * WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the
13 | * License for the specific language governing permissions and limitations
14 | * under the License.
15 | */
16 | package io.netty.internal.tcnative;
17 |
18 |
19 | /**
20 | * Execute {@link CertificateVerifier#verify(long, byte[][], String)}.
21 | */
22 | final class CertificateVerifierTask extends SSLTask {
23 | private final byte[][] x509;
24 | private final String authAlgorithm;
25 | private final CertificateVerifier verifier;
26 |
27 | CertificateVerifierTask(long ssl, byte[][] x509, String authAlgorithm, CertificateVerifier verifier) {
28 | super(ssl);
29 | this.x509 = x509;
30 | this.authAlgorithm = authAlgorithm;
31 | this.verifier = verifier;
32 | }
33 |
34 | @Override
35 | protected void runTask(long ssl, TaskCallback callback) {
36 | int result = verifier.verify(ssl, x509, authAlgorithm);
37 | callback.onResult(ssl, result);
38 | }
39 | }
40 |
--------------------------------------------------------------------------------
/openssl-classes/src/main/java/io/netty/internal/tcnative/KeyLogCallback.java:
--------------------------------------------------------------------------------
1 | /*
2 | * Copyright 2024 The Netty Project
3 | *
4 | * The Netty Project licenses this file to you under the Apache License,
5 | * version 2.0 (the "License"); you may not use this file except in compliance
6 | * with the License. You may obtain a copy of the License at:
7 | *
8 | * http://www.apache.org/licenses/LICENSE-2.0
9 | *
10 | * Unless required by applicable law or agreed to in writing, software
11 | * distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
12 | * WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the
13 | * License for the specific language governing permissions and limitations
14 | * under the License.
15 | */
16 | package io.netty.internal.tcnative;
17 |
18 | /**
19 | * Callback hooked into SSL_CTX_set_keylog_callback
20 | * This is intended for TLS debugging with tools like Wireshark.
21 | * For instance, a valid {@code SSLKEYLOGFILE} implementation could look like this:
22 | * {@code
23 | * final PrintStream out = new PrintStream("~/tls.sslkeylog_file");
24 | * SSLContext.setKeyLogCallback(ctxPtr, new KeyLogCallback() {
25 | * @Override
26 | * public void handle(long ssl, byte[] line) {
27 | * out.println(new String(line));
28 | * }
29 | * });
30 | * }
31 | *
32 | * Warning: The log output will contain secret key material, and can be used to decrypt
33 | * TLS sessions! The log output should be handled with the same care given to the private keys.
34 | */
35 | public interface KeyLogCallback {
36 | /**
37 | * Called when a new key log line is emitted.
38 | *
39 | * Warning: The log output will contain secret key material, and can be used to decrypt
40 | * TLS sessions! The log output should be handled with the same care given to the private keys.
41 | *
42 | * @param ssl the SSL instance
43 | * @param line an array of the key types on client-mode or {@code null} on server-mode.
44 | *
45 | */
46 | void handle(long ssl, byte[] line);
47 | }
48 |
--------------------------------------------------------------------------------
/openssl-classes/src/main/java/io/netty/internal/tcnative/Library.java:
--------------------------------------------------------------------------------
1 | /*
2 | * Copyright 2016 The Netty Project
3 | *
4 | * The Netty Project licenses this file to you under the Apache License,
5 | * version 2.0 (the "License"); you may not use this file except in compliance
6 | * with the License. You may obtain a copy of the License at:
7 | *
8 | * http://www.apache.org/licenses/LICENSE-2.0
9 | *
10 | * Unless required by applicable law or agreed to in writing, software
11 | * distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
12 | * WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the
13 | * License for the specific language governing permissions and limitations
14 | * under the License.
15 | */
16 | /*
17 | * Licensed to the Apache Software Foundation (ASF) under one or more
18 | * contributor license agreements. See the NOTICE file distributed with
19 | * this work for additional information regarding copyright ownership.
20 | * The ASF licenses this file to You under the Apache License, Version 2.0
21 | * (the "License"); you may not use this file except in compliance with
22 | * the License. You may obtain a copy of the License at
23 | *
24 | * http://www.apache.org/licenses/LICENSE-2.0
25 | *
26 | * Unless required by applicable law or agreed to in writing, software
27 | * distributed under the License is distributed on an "AS IS" BASIS,
28 | * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
29 | * See the License for the specific language governing permissions and
30 | * limitations under the License.
31 | */
32 |
33 | package io.netty.internal.tcnative;
34 |
35 | import java.io.File;
36 |
37 | public final class Library {
38 |
39 | /* Default library names */
40 | private static final String [] NAMES = {
41 | "netty_tcnative",
42 | "libnetty_tcnative"
43 | };
44 |
45 | private static final String PROVIDED = "provided";
46 |
47 | /*
48 | * A handle to the unique Library singleton instance.
49 | */
50 | private static Library _instance = null;
51 |
52 | static {
53 | // Preload all classes that will be used in the OnLoad(...) function of JNI to eliminate the possiblity of a
54 | // class-loader deadlock. This is a workaround for https://github.com/netty/netty/issues/11209.
55 |
56 | // This needs to match all the classes that are loaded via NETTY_JNI_UTIL_LOAD_CLASS or looked up via
57 | // NETTY_JNI_UTIL_FIND_CLASS.
58 | tryLoadClasses(ClassLoader.getSystemClassLoader(),
59 | // error
60 | Exception.class, NullPointerException.class, IllegalArgumentException.class, OutOfMemoryError.class,
61 |
62 | // jnilib
63 | String.class, byte[].class,
64 |
65 | // sslcontext
66 | SSLTask.class, CertificateCallbackTask.class, CertificateCallback.class, SSLPrivateKeyMethodTask.class,
67 | SSLPrivateKeyMethodSignTask.class, SSLPrivateKeyMethodDecryptTask.class
68 | );
69 | }
70 |
71 | /**
72 | * Preload the given classes and so ensure the {@link ClassLoader} has these loaded after this method call.
73 | *
74 | * @param classLoader the {@link ClassLoader}
75 | * @param classes the classes to load.
76 | */
77 | private static void tryLoadClasses(ClassLoader classLoader, Class... classes) {
78 | for (Class clazz: classes) {
79 | tryLoadClass(classLoader, clazz.getName());
80 | }
81 | }
82 |
83 | private static void tryLoadClass(ClassLoader classLoader, String className) {
84 | try {
85 | // Load the class and also ensure we init it which means its linked etc.
86 | Class.forName(className, true, classLoader);
87 | } catch (ClassNotFoundException ignore) {
88 | // Ignore
89 | } catch (SecurityException ignore) {
90 | // Ignore
91 | }
92 | }
93 |
94 | private Library() throws Exception {
95 | boolean loaded = false;
96 | String path = System.getProperty("java.library.path");
97 | String [] paths = path.split(File.pathSeparator);
98 | StringBuilder err = new StringBuilder();
99 | for (int i = 0; i < NAMES.length; i++) {
100 | try {
101 | loadLibrary(NAMES[i]);
102 | loaded = true;
103 | } catch (ThreadDeath t) {
104 | throw t;
105 | } catch (VirtualMachineError t) {
106 | throw t;
107 | } catch (Throwable t) {
108 | String name = System.mapLibraryName(NAMES[i]);
109 | for (int j = 0; j < paths.length; j++) {
110 | File fd = new File(paths[j] , name);
111 | if (fd.exists()) {
112 | // File exists but failed to load
113 | throw new RuntimeException(t);
114 | }
115 | }
116 | if (i > 0) {
117 | err.append(", ");
118 | }
119 | err.append(t.getMessage());
120 | }
121 | if (loaded) {
122 | break;
123 | }
124 | }
125 | if (!loaded) {
126 | throw new UnsatisfiedLinkError(err.toString());
127 | }
128 | }
129 |
130 | private Library(String libraryName) {
131 | if (!PROVIDED.equals(libraryName)) {
132 | loadLibrary(libraryName);
133 | }
134 | }
135 |
136 | private static void loadLibrary(String libraryName) {
137 | System.loadLibrary(calculatePackagePrefix().replace('.', '_') + libraryName);
138 | }
139 |
140 | /**
141 | * The shading prefix added to this class's full name.
142 | *
143 | * @throws UnsatisfiedLinkError if the shader used something other than a prefix
144 | */
145 | private static String calculatePackagePrefix() {
146 | String maybeShaded = Library.class.getName();
147 | // Use ! instead of . to avoid shading utilities from modifying the string
148 | String expected = "io!netty!internal!tcnative!Library".replace('!', '.');
149 | if (!maybeShaded.endsWith(expected)) {
150 | throw new UnsatisfiedLinkError(String.format(
151 | "Could not find prefix added to %s to get %s. When shading, only adding a "
152 | + "package prefix is supported", expected, maybeShaded));
153 | }
154 | return maybeShaded.substring(0, maybeShaded.length() - expected.length());
155 | }
156 |
157 | /* create global TCN's APR pool
158 | * This has to be the first call to TCN library.
159 | */
160 | private static native boolean initialize0();
161 |
162 | private static native boolean aprHasThreads();
163 |
164 | private static native int aprMajorVersion();
165 |
166 | /* APR_VERSION_STRING */
167 | private static native String aprVersionString();
168 |
169 | /**
170 | * Calls {@link #initialize(String, String)} with {@code "provided"} and {@code null}.
171 | *
172 | * @return {@code true} if initialization was successful
173 | * @throws Exception if an error happens during initialization
174 | */
175 | public static boolean initialize() throws Exception {
176 | return initialize(PROVIDED, null);
177 | }
178 |
179 | /**
180 | * Setup native library. This is the first method that must be called!
181 | *
182 | * @param libraryName the name of the library to load
183 | * @param engine Support for external a Crypto Device ("engine"), usually
184 | * @return {@code true} if initialization was successful
185 | * @throws Exception if an error happens during initialization
186 | */
187 | public static boolean initialize(String libraryName, String engine) throws Exception {
188 | if (_instance == null) {
189 | _instance = libraryName == null ? new Library() : new Library(libraryName);
190 |
191 | if (aprMajorVersion() < 1) {
192 | throw new UnsatisfiedLinkError("Unsupported APR Version (" +
193 | aprVersionString() + ")");
194 | }
195 |
196 | if (!aprHasThreads()) {
197 | throw new UnsatisfiedLinkError("Missing APR_HAS_THREADS");
198 | }
199 | }
200 | return initialize0() && SSL.initialize(engine) == 0;
201 | }
202 | }
203 |
--------------------------------------------------------------------------------
/openssl-classes/src/main/java/io/netty/internal/tcnative/NativeStaticallyReferencedJniMethods.java:
--------------------------------------------------------------------------------
1 | /*
2 | * Copyright 2017 The Netty Project
3 | *
4 | * The Netty Project licenses this file to you under the Apache License,
5 | * version 2.0 (the "License"); you may not use this file except in compliance
6 | * with the License. You may obtain a copy of the License at:
7 | *
8 | * http://www.apache.org/licenses/LICENSE-2.0
9 | *
10 | * Unless required by applicable law or agreed to in writing, software
11 | * distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
12 | * WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the
13 | * License for the specific language governing permissions and limitations
14 | * under the License.
15 | */
16 | package io.netty.internal.tcnative;
17 |
18 | /**
19 | * This class is necessary to break the following cyclic dependency:
20 | *
21 | * - JNI_OnLoad
22 | * - JNI Calls FindClass because RegisterNatives (used to register JNI methods) requires a class
23 | * - FindClass loads the class, but static members variables of that class attempt to call a JNI method which has not
24 | * yet been registered.
25 | * - {@link UnsatisfiedLinkError} is thrown because native method has not yet been registered.
26 | *
27 | * Static members which call JNI methods must not be declared in this class!
28 | */
29 | final class NativeStaticallyReferencedJniMethods {
30 | private NativeStaticallyReferencedJniMethods() {
31 | }
32 |
33 | /**
34 | * Options that may impact security and may be set by default as defined in:
35 | * SSL Docs.
36 | */
37 | static native int sslOpCipherServerPreference();
38 | static native int sslOpNoSSLv2();
39 | static native int sslOpNoSSLv3();
40 | static native int sslOpNoTLSv1();
41 | static native int sslOpNoTLSv11();
42 | static native int sslOpNoTLSv12();
43 | static native int sslOpNoTLSv13();
44 | static native int sslOpNoTicket();
45 | static native int sslOpAllowUnsafeLegacyRenegotiation();
46 | static native int sslOpLegacyServerConnect();
47 |
48 | /**
49 | * Options not defined in the OpenSSL docs but may impact security.
50 | */
51 | static native int sslOpNoCompression();
52 |
53 | static native int sslSessCacheOff();
54 | static native int sslSessCacheServer();
55 | static native int sslSessCacheClient();
56 | static native int sslSessCacheNoInternalLookup();
57 | static native int sslSessCacheNoInternalStore();
58 |
59 | static native int sslStConnect();
60 | static native int sslStAccept();
61 |
62 | static native int sslModeEnablePartialWrite();
63 | static native int sslModeAcceptMovingWriteBuffer();
64 | static native int sslModeReleaseBuffers();
65 | static native int sslModeEnableFalseStart();
66 |
67 | static native int sslSendShutdown();
68 | static native int sslReceivedShutdown();
69 | static native int sslErrorNone();
70 | static native int sslErrorSSL();
71 | static native int sslErrorWantRead();
72 | static native int sslErrorWantWrite();
73 | static native int sslErrorWantX509Lookup();
74 | static native int sslErrorSyscall();
75 | static native int sslErrorZeroReturn();
76 | static native int sslErrorWantConnect();
77 | static native int sslErrorWantAccept();
78 |
79 | static native int sslMaxPlaintextLength();
80 | static native int sslMaxEncryptedLength();
81 | static native int sslMaxRecordLength();
82 |
83 | static native int x509CheckFlagAlwaysCheckSubject();
84 | static native int x509CheckFlagDisableWildCards();
85 | static native int x509CheckFlagNoPartialWildCards();
86 | static native int x509CheckFlagMultiLabelWildCards();
87 |
88 | /* x509 certificate verification errors */
89 | static native int x509vOK();
90 | static native int x509vErrUnspecified();
91 | static native int x509vErrUnableToGetIssuerCert();
92 | static native int x509vErrUnableToGetCrl();
93 | static native int x509vErrUnableToDecryptCertSignature();
94 | static native int x509vErrUnableToDecryptCrlSignature();
95 | static native int x509vErrUnableToDecodeIssuerPublicKey();
96 | static native int x509vErrCertSignatureFailure();
97 | static native int x509vErrCrlSignatureFailure();
98 | static native int x509vErrCertNotYetValid();
99 | static native int x509vErrCertHasExpired();
100 | static native int x509vErrCrlNotYetValid();
101 | static native int x509vErrCrlHasExpired();
102 | static native int x509vErrErrorInCertNotBeforeField();
103 | static native int x509vErrErrorInCertNotAfterField();
104 | static native int x509vErrErrorInCrlLastUpdateField();
105 | static native int x509vErrErrorInCrlNextUpdateField();
106 | static native int x509vErrOutOfMem();
107 | static native int x509vErrDepthZeroSelfSignedCert();
108 | static native int x509vErrSelfSignedCertInChain();
109 | static native int x509vErrUnableToGetIssuerCertLocally();
110 | static native int x509vErrUnableToVerifyLeafSignature();
111 | static native int x509vErrCertChainTooLong();
112 | static native int x509vErrCertRevoked();
113 | static native int x509vErrInvalidCa();
114 | static native int x509vErrPathLengthExceeded();
115 | static native int x509vErrInvalidPurpose();
116 | static native int x509vErrCertUntrusted();
117 | static native int x509vErrCertRejected();
118 | static native int x509vErrSubjectIssuerMismatch();
119 | static native int x509vErrAkidSkidMismatch();
120 | static native int x509vErrAkidIssuerSerialMismatch();
121 | static native int x509vErrKeyUsageNoCertSign();
122 | static native int x509vErrUnableToGetCrlIssuer();
123 | static native int x509vErrUnhandledCriticalExtension();
124 | static native int x509vErrKeyUsageNoCrlSign();
125 | static native int x509vErrUnhandledCriticalCrlExtension();
126 | static native int x509vErrInvalidNonCa();
127 | static native int x509vErrProxyPathLengthExceeded();
128 | static native int x509vErrKeyUsageNoDigitalSignature();
129 | static native int x509vErrProxyCertificatesNotAllowed();
130 | static native int x509vErrInvalidExtension();
131 | static native int x509vErrInvalidPolicyExtension();
132 | static native int x509vErrNoExplicitPolicy();
133 | static native int x509vErrDifferntCrlScope();
134 | static native int x509vErrUnsupportedExtensionFeature();
135 | static native int x509vErrUnnestedResource();
136 | static native int x509vErrPermittedViolation();
137 | static native int x509vErrExcludedViolation();
138 | static native int x509vErrSubtreeMinMax();
139 | static native int x509vErrApplicationVerification();
140 | static native int x509vErrUnsupportedConstraintType();
141 | static native int x509vErrUnsupportedConstraintSyntax();
142 | static native int x509vErrUnsupportedNameSyntax();
143 | static native int x509vErrCrlPathValidationError();
144 | static native int x509vErrPathLoop();
145 | static native int x509vErrSuiteBInvalidVersion();
146 | static native int x509vErrSuiteBInvalidAlgorithm();
147 | static native int x509vErrSuiteBInvalidCurve();
148 | static native int x509vErrSuiteBInvalidSignatureAlgorithm();
149 | static native int x509vErrSuiteBLosNotAllowed();
150 | static native int x509vErrSuiteBCannotSignP384WithP256();
151 | static native int x509vErrHostnameMismatch();
152 | static native int x509vErrEmailMismatch();
153 | static native int x509vErrIpAddressMismatch();
154 | static native int x509vErrDaneNoMatch();
155 |
156 | // BoringSSL specific.
157 | static native int sslErrorWantCertificateVerify();
158 | static native int sslErrorWantPrivateKeyOperation();
159 | static native int sslSignRsaPkcsSha1();
160 | static native int sslSignRsaPkcsSha256();
161 | static native int sslSignRsaPkcsSha384();
162 | static native int sslSignRsaPkcsSha512();
163 | static native int sslSignEcdsaPkcsSha1();
164 | static native int sslSignEcdsaSecp256r1Sha256();
165 | static native int sslSignEcdsaSecp384r1Sha384();
166 | static native int sslSignEcdsaSecp521r1Sha512();
167 | static native int sslSignRsaPssRsaeSha256();
168 | static native int sslSignRsaPssRsaeSha384();
169 | static native int sslSignRsaPssRsaeSha512();
170 | static native int sslSignEd25519();
171 | static native int sslSignRsaPkcs1Md5Sha1();
172 |
173 | static native int sslRenegotiateNever();
174 | static native int sslRenegotiateOnce();
175 | static native int sslRenegotiateFreely();
176 | static native int sslRenegotiateIgnore();
177 | static native int sslRenegotiateExplicit();
178 | static native int sslCertCompressionDirectionCompress();
179 | static native int sslCertCompressionDirectionDecompress();
180 | static native int sslCertCompressionDirectionBoth();
181 | static native int tlsExtCertCompressionZlib();
182 | static native int tlsExtCertCompressionBrotli();
183 | static native int tlsExtCertCompressionZstd();
184 | }
185 |
--------------------------------------------------------------------------------
/openssl-classes/src/main/java/io/netty/internal/tcnative/ResultCallback.java:
--------------------------------------------------------------------------------
1 | /*
2 | * Copyright 2021 The Netty Project
3 | *
4 | * The Netty Project licenses this file to you under the Apache License,
5 | * version 2.0 (the "License"); you may not use this file except in compliance
6 | * with the License. You may obtain a copy of the License at:
7 | *
8 | * http://www.apache.org/licenses/LICENSE-2.0
9 | *
10 | * Unless required by applicable law or agreed to in writing, software
11 | * distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
12 | * WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the
13 | * License for the specific language governing permissions and limitations
14 | * under the License.
15 | */
16 | package io.netty.internal.tcnative;
17 |
18 | /**
19 | * Callback that is called once an operation completed.
20 | *
21 | * @param The result type.
22 | */
23 | public interface ResultCallback {
24 | /**
25 | * Called when the operation completes with the given result.
26 | *
27 | * @param ssl the SSL instance (SSL *)
28 | * @param result the result.
29 | */
30 | void onSuccess(long ssl, T result);
31 |
32 | /**
33 | * Called when the operation completes with an error.
34 | *
35 | * @param ssl the SSL instance (SSL *)
36 | * @param cause the error.
37 | */
38 | void onError(long ssl, Throwable cause);
39 | }
40 |
--------------------------------------------------------------------------------
/openssl-classes/src/main/java/io/netty/internal/tcnative/SSLPrivateKeyMethod.java:
--------------------------------------------------------------------------------
1 | /*
2 | * Copyright 2019 The Netty Project
3 | *
4 | * The Netty Project licenses this file to you under the Apache License,
5 | * version 2.0 (the "License"); you may not use this file except in compliance
6 | * with the License. You may obtain a copy of the License at:
7 | *
8 | * http://www.apache.org/licenses/LICENSE-2.0
9 | *
10 | * Unless required by applicable law or agreed to in writing, software
11 | * distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
12 | * WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the
13 | * License for the specific language governing permissions and limitations
14 | * under the License.
15 | */
16 | package io.netty.internal.tcnative;
17 |
18 | /**
19 | * Allows to customize private key signing / decrypt (when using RSA).
20 | */
21 | public interface SSLPrivateKeyMethod {
22 | int SSL_SIGN_RSA_PKCS1_SHA1 = NativeStaticallyReferencedJniMethods.sslSignRsaPkcsSha1();
23 | int SSL_SIGN_RSA_PKCS1_SHA256 = NativeStaticallyReferencedJniMethods.sslSignRsaPkcsSha256();
24 | int SSL_SIGN_RSA_PKCS1_SHA384 = NativeStaticallyReferencedJniMethods.sslSignRsaPkcsSha384();
25 | int SSL_SIGN_RSA_PKCS1_SHA512 = NativeStaticallyReferencedJniMethods.sslSignRsaPkcsSha512();
26 | int SSL_SIGN_ECDSA_SHA1 = NativeStaticallyReferencedJniMethods.sslSignEcdsaPkcsSha1();
27 | int SSL_SIGN_ECDSA_SECP256R1_SHA256 = NativeStaticallyReferencedJniMethods.sslSignEcdsaSecp256r1Sha256();
28 | int SSL_SIGN_ECDSA_SECP384R1_SHA384 = NativeStaticallyReferencedJniMethods.sslSignEcdsaSecp384r1Sha384();
29 | int SSL_SIGN_ECDSA_SECP521R1_SHA512 = NativeStaticallyReferencedJniMethods.sslSignEcdsaSecp521r1Sha512();
30 | int SSL_SIGN_RSA_PSS_RSAE_SHA256 = NativeStaticallyReferencedJniMethods.sslSignRsaPssRsaeSha256();
31 | int SSL_SIGN_RSA_PSS_RSAE_SHA384 = NativeStaticallyReferencedJniMethods.sslSignRsaPssRsaeSha384();
32 | int SSL_SIGN_RSA_PSS_RSAE_SHA512 = NativeStaticallyReferencedJniMethods.sslSignRsaPssRsaeSha512();
33 | int SSL_SIGN_ED25519 = NativeStaticallyReferencedJniMethods.sslSignEd25519();
34 | int SSL_SIGN_RSA_PKCS1_MD5_SHA1 = NativeStaticallyReferencedJniMethods.sslSignRsaPkcs1Md5Sha1();
35 |
36 | /**
37 | * Sign the input with given EC key and returns the signed bytes.
38 | *
39 | * @param ssl the SSL instance
40 | * @param signatureAlgorithm the algorithm to use for signing
41 | * @param input the input itself
42 | * @return the sign
43 | * @throws Exception thrown if an error accours while signing.
44 | */
45 | byte[] sign(long ssl, int signatureAlgorithm, byte[] input) throws Exception;
46 |
47 | /**
48 | * Decrypts the input with the given RSA key and returns the decrypted bytes.
49 | *
50 | * @param ssl the SSL instance
51 | * @param input the input which should be decrypted
52 | * @return the decrypted data
53 | * @throws Exception thrown if an error accours while decrypting.
54 | */
55 | byte[] decrypt(long ssl, byte[] input) throws Exception;
56 | }
57 |
--------------------------------------------------------------------------------
/openssl-classes/src/main/java/io/netty/internal/tcnative/SSLPrivateKeyMethodDecryptTask.java:
--------------------------------------------------------------------------------
1 | /*
2 | * Copyright 2019 The Netty Project
3 | *
4 | * The Netty Project licenses this file to you under the Apache License,
5 | * version 2.0 (the "License"); you may not use this file except in compliance
6 | * with the License. You may obtain a copy of the License at:
7 | *
8 | * http://www.apache.org/licenses/LICENSE-2.0
9 | *
10 | * Unless required by applicable law or agreed to in writing, software
11 | * distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
12 | * WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the
13 | * License for the specific language governing permissions and limitations
14 | * under the License.
15 | */
16 | package io.netty.internal.tcnative;
17 |
18 | final class SSLPrivateKeyMethodDecryptTask extends SSLPrivateKeyMethodTask {
19 |
20 | private final byte[] input;
21 |
22 | SSLPrivateKeyMethodDecryptTask(long ssl, byte[] input, AsyncSSLPrivateKeyMethod method) {
23 | super(ssl, method);
24 | // It's OK to not clone the arrays as we create these in JNI and not reuse.
25 | this.input = input;
26 | }
27 |
28 | @Override
29 | protected void runTask(long ssl, AsyncSSLPrivateKeyMethod method,
30 | ResultCallback resultCallback) {
31 | method.decrypt(ssl, input, resultCallback);
32 | }
33 | }
34 |
--------------------------------------------------------------------------------
/openssl-classes/src/main/java/io/netty/internal/tcnative/SSLPrivateKeyMethodSignTask.java:
--------------------------------------------------------------------------------
1 | /*
2 | * Copyright 2019 The Netty Project
3 | *
4 | * The Netty Project licenses this file to you under the Apache License,
5 | * version 2.0 (the "License"); you may not use this file except in compliance
6 | * with the License. You may obtain a copy of the License at:
7 | *
8 | * http://www.apache.org/licenses/LICENSE-2.0
9 | *
10 | * Unless required by applicable law or agreed to in writing, software
11 | * distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
12 | * WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the
13 | * License for the specific language governing permissions and limitations
14 | * under the License.
15 | */
16 | package io.netty.internal.tcnative;
17 |
18 | final class SSLPrivateKeyMethodSignTask extends SSLPrivateKeyMethodTask {
19 | private final int signatureAlgorithm;
20 | private final byte[] digest;
21 |
22 | SSLPrivateKeyMethodSignTask(long ssl, int signatureAlgorithm, byte[] digest, AsyncSSLPrivateKeyMethod method) {
23 | super(ssl, method);
24 | this.signatureAlgorithm = signatureAlgorithm;
25 | // It's OK to not clone the arrays as we create these in JNI and not reuse.
26 | this.digest = digest;
27 | }
28 |
29 | @Override
30 | protected void runTask(long ssl, AsyncSSLPrivateKeyMethod method,
31 | ResultCallback resultCallback) {
32 | method.sign(ssl, signatureAlgorithm, digest, resultCallback);
33 | }
34 | }
35 |
--------------------------------------------------------------------------------
/openssl-classes/src/main/java/io/netty/internal/tcnative/SSLPrivateKeyMethodTask.java:
--------------------------------------------------------------------------------
1 | /*
2 | * Copyright 2019 The Netty Project
3 | *
4 | * The Netty Project licenses this file to you under the Apache License,
5 | * version 2.0 (the "License"); you may not use this file except in compliance
6 | * with the License. You may obtain a copy of the License at:
7 | *
8 | * http://www.apache.org/licenses/LICENSE-2.0
9 | *
10 | * Unless required by applicable law or agreed to in writing, software
11 | * distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
12 | * WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the
13 | * License for the specific language governing permissions and limitations
14 | * under the License.
15 | */
16 | package io.netty.internal.tcnative;
17 |
18 | abstract class SSLPrivateKeyMethodTask extends SSLTask implements AsyncTask {
19 | private static final byte[] EMPTY = new byte[0];
20 | private final AsyncSSLPrivateKeyMethod method;
21 |
22 | // Will be accessed via JNI.
23 | private byte[] resultBytes;
24 |
25 | SSLPrivateKeyMethodTask(long ssl, AsyncSSLPrivateKeyMethod method) {
26 | super(ssl);
27 | this.method = method;
28 | }
29 |
30 |
31 | @Override
32 | public final void runAsync(final Runnable completeCallback) {
33 | run(completeCallback);
34 | }
35 |
36 | @Override
37 | protected final void runTask(final long ssl, final TaskCallback callback) {
38 | runTask(ssl, method, new ResultCallback() {
39 | @Override
40 | public void onSuccess(long ssl, byte[] result) {
41 | resultBytes = result;
42 | callback.onResult(ssl, 1);
43 | }
44 |
45 | @Override
46 | public void onError(long ssl, Throwable cause) {
47 | // Return 0 as this signals back that the operation failed.
48 | resultBytes = EMPTY;
49 | callback.onResult(ssl, 0);
50 | }
51 | });
52 | }
53 |
54 | protected abstract void runTask(long ssl, AsyncSSLPrivateKeyMethod method,
55 | ResultCallback resultCallback);
56 | }
57 |
--------------------------------------------------------------------------------
/openssl-classes/src/main/java/io/netty/internal/tcnative/SSLSession.java:
--------------------------------------------------------------------------------
1 | /*
2 | * Copyright 2020 The Netty Project
3 | *
4 | * The Netty Project licenses this file to you under the Apache License,
5 | * version 2.0 (the "License"); you may not use this file except in compliance
6 | * with the License. You may obtain a copy of the License at:
7 | *
8 | * http://www.apache.org/licenses/LICENSE-2.0
9 | *
10 | * Unless required by applicable law or agreed to in writing, software
11 | * distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
12 | * WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the
13 | * License for the specific language governing permissions and limitations
14 | * under the License.
15 | */
16 | package io.netty.internal.tcnative;
17 |
18 | /**
19 | * Methods to operate on a {@code SSL_SESSION}.
20 | */
21 | public final class SSLSession {
22 |
23 | private SSLSession() { }
24 |
25 | /**
26 | * See SSL_SESSION_get_time.
27 | *
28 | * @param session the SSL_SESSION instance (SSL_SESSION *)
29 | * @return returns the time at which the session was established. The time is given in seconds since the Epoch
30 | */
31 | public static native long getTime(long session);
32 |
33 | /**
34 | * See SSL_SESSION_get_timeout.
35 | *
36 | * @param session the SSL_SESSION instance (SSL_SESSION *)
37 | * @return returns the timeout for the session. The time is given in seconds since the Epoch
38 | */
39 | public static native long getTimeout(long session);
40 |
41 | /**
42 | * See SSL_SESSION_set_timeout.
43 | *
44 | * @param session the SSL_SESSION instance (SSL_SESSION *)
45 | * @param seconds timeout in seconds
46 | * @return returns the timeout for the session before this call. The time is given in seconds since the Epoch
47 | */
48 | public static native long setTimeout(long session, long seconds);
49 |
50 | /**
51 | * See SSL_SESSION_get_id.
52 | *
53 | * @param session the SSL_SESSION instance (SSL_SESSION *)
54 | * @return the session id as byte array representation obtained via SSL_SESSION_get_id.
55 | */
56 | public static native byte[] getSessionId(long session);
57 |
58 | /**
59 | * See SSL_SESSION_up_ref.
60 | *
61 | * @param session the SSL_SESSION instance (SSL_SESSION *)
62 | * @return {@code true} if successful, {@code false} otherwise.
63 | */
64 | public static native boolean upRef(long session);
65 |
66 | /**
67 | * See SSL_SESSION_free.
68 | *
69 | * @param session the SSL_SESSION instance (SSL_SESSION *)
70 | */
71 | public static native void free(long session);
72 |
73 | /**
74 | * Will return {@code true} if the session should only re-used once.
75 | * See SSL_SESSION_should_be_single_use.
76 | * @param session
77 | * @return {@code true} if the session should be re-used once only, {@code false} otherwise.
78 | */
79 | public static native boolean shouldBeSingleUse(long session);
80 | }
81 |
--------------------------------------------------------------------------------
/openssl-classes/src/main/java/io/netty/internal/tcnative/SSLSessionCache.java:
--------------------------------------------------------------------------------
1 | /*
2 | * Copyright 2020 The Netty Project
3 | *
4 | * The Netty Project licenses this file to you under the Apache License,
5 | * version 2.0 (the "License"); you may not use this file except in compliance
6 | * with the License. You may obtain a copy of the License at:
7 | *
8 | * http://www.apache.org/licenses/LICENSE-2.0
9 | *
10 | * Unless required by applicable law or agreed to in writing, software
11 | * distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
12 | * WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the
13 | * License for the specific language governing permissions and limitations
14 | * under the License.
15 | */
16 | package io.netty.internal.tcnative;
17 |
18 | /**
19 | * Allows to implement a custom external {@code SSL_SESSION} cache.
20 | *
21 | * See SSL_CTX_sess_set_get_cb.html
22 | * and {a href="https://www.openssl.org/docs/man1.1.0/man3/SSL_CTX_set_session_cache_mode.html">SSL_CTX_set_session_cache_mode.
23 | */
24 | public interface SSLSessionCache {
25 |
26 | /**
27 | * Returns {@code true} if the cache takes ownership of the {@code SSL_SESSION} and will call {@code SSL_SESSION_free} once it should be destroyed,
28 | * {@code false} otherwise.
29 | *
30 | * See SSL_CTX_sess_set_new_cb.
31 | *
32 | * @param ssl {@code SSL*}
33 | * @param sslSession {@code SSL_SESSION*}
34 | * @return {@code true} if session ownership was transfered, {@code false} if not.
35 | */
36 | boolean sessionCreated(long ssl, long sslSession);
37 |
38 | /**
39 | * Called once a {@code SSL_SESSION} should be retrieved for the given {@code SSL} and with the given session ID.
40 | * See SSL_CTX_sess_set_get_cb.
41 | * If the session is shared you need to call {@link SSLSession#upRef(long)} explicit in this callback and explicit free all {@code SSL_SESSION}s
42 | * once the cache is destroyed via {@link SSLSession#free(long)}.
43 | *
44 | * @param sslCtx {code SSL_CTX*}
45 | * @param sessionId the session id
46 | * @return the {@link SSL_SESSION} or {@code -1} if none was found in the cache.
47 | */
48 | long getSession(long sslCtx, byte[] sessionId);
49 | }
50 |
--------------------------------------------------------------------------------
/openssl-classes/src/main/java/io/netty/internal/tcnative/SSLTask.java:
--------------------------------------------------------------------------------
1 | /*
2 | * Copyright 2019 The Netty Project
3 | *
4 | * The Netty Project licenses this file to you under the Apache License,
5 | * version 2.0 (the "License"); you may not use this file except in compliance
6 | * with the License. You may obtain a copy of the License at:
7 | *
8 | * http://www.apache.org/licenses/LICENSE-2.0
9 | *
10 | * Unless required by applicable law or agreed to in writing, software
11 | * distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
12 | * WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the
13 | * License for the specific language governing permissions and limitations
14 | * under the License.
15 | */
16 | package io.netty.internal.tcnative;
17 |
18 | /**
19 | * A SSL related task that will be returned by {@link SSL#getTask(long)}.
20 | */
21 | abstract class SSLTask implements Runnable {
22 | private static final Runnable NOOP = new Runnable() {
23 | @Override
24 | public void run() {
25 | // NOOP
26 | }
27 | };
28 | private final long ssl;
29 |
30 | // These fields are accessed via JNI.
31 | private int returnValue;
32 | private boolean complete;
33 | protected boolean didRun;
34 |
35 | protected SSLTask(long ssl) {
36 | // It is important that this constructor never throws. Be sure to not change this!
37 | this.ssl = ssl;
38 | }
39 |
40 | @Override
41 | public final void run() {
42 | run(NOOP);
43 | }
44 |
45 | protected final void run(final Runnable completeCallback) {
46 | if (!didRun) {
47 | didRun = true;
48 | runTask(ssl, new TaskCallback() {
49 | @Override
50 | public void onResult(long ssl, int result) {
51 | returnValue = result;
52 | complete = true;
53 | completeCallback.run();
54 | }
55 | });
56 | } else {
57 | completeCallback.run();
58 | }
59 | }
60 |
61 | /**
62 | * Run the task and return the return value that should be passed back to OpenSSL.
63 | */
64 | protected abstract void runTask(long ssl, TaskCallback callback);
65 |
66 | interface TaskCallback {
67 | void onResult(long ssl, int result);
68 | }
69 | }
70 |
--------------------------------------------------------------------------------
/openssl-classes/src/main/java/io/netty/internal/tcnative/SessionTicketKey.java:
--------------------------------------------------------------------------------
1 | /*
2 | * Copyright 2016 The Netty Project
3 | *
4 | * The Netty Project licenses this file to you under the Apache License,
5 | * version 2.0 (the "License"); you may not use this file except in compliance
6 | * with the License. You may obtain a copy of the License at:
7 | *
8 | * http://www.apache.org/licenses/LICENSE-2.0
9 | *
10 | * Unless required by applicable law or agreed to in writing, software
11 | * distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
12 | * WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the
13 | * License for the specific language governing permissions and limitations
14 | * under the License.
15 | */
16 |
17 | package io.netty.internal.tcnative;
18 |
19 | /**
20 | * Session Ticket Key
21 | */
22 | public final class SessionTicketKey {
23 | /**
24 | * Size of session ticket key name
25 | */
26 | public static final int NAME_SIZE = 16;
27 | /**
28 | * Size of session ticket key HMAC key
29 | */
30 | public static final int HMAC_KEY_SIZE = 16;
31 | /**
32 | * Size of session ticket key AES key
33 | */
34 | public static final int AES_KEY_SIZE = 16;
35 | /**
36 | * Size of session ticket key
37 | */
38 | public static final int TICKET_KEY_SIZE = NAME_SIZE + HMAC_KEY_SIZE + AES_KEY_SIZE;
39 |
40 | // package private so we can access these in SSLContext without calling clone() on the byte[].
41 | final byte[] name;
42 | final byte[] hmacKey;
43 | final byte[] aesKey;
44 |
45 | /**
46 | * Construct SessionTicketKey.
47 | * @param name the name of the session ticket key
48 | * @param hmacKey the HMAC key of the session ticket key
49 | * @param aesKey the AES key of the session ticket key
50 | */
51 | public SessionTicketKey(byte[] name, byte[] hmacKey, byte[] aesKey) {
52 | if (name == null || name.length != NAME_SIZE) {
53 | throw new IllegalArgumentException("Length of name should be " + NAME_SIZE);
54 | }
55 | if (hmacKey == null || hmacKey.length != HMAC_KEY_SIZE) {
56 | throw new IllegalArgumentException("Length of hmacKey should be " + HMAC_KEY_SIZE);
57 | }
58 | if (aesKey == null || aesKey.length != AES_KEY_SIZE) {
59 | throw new IllegalArgumentException("Length of aesKey should be " + AES_KEY_SIZE);
60 | }
61 | this.name = name;
62 | this.hmacKey = hmacKey;
63 | this.aesKey = aesKey;
64 | }
65 |
66 | /**
67 | * Get name.
68 | *
69 | * @return the name of the session ticket key
70 | */
71 | public byte[] getName() {
72 | return name.clone();
73 | }
74 |
75 | /**
76 | * Get HMAC key.
77 | * @return the HMAC key of the session ticket key
78 | */
79 | public byte[] getHmacKey() {
80 | return hmacKey.clone();
81 | }
82 |
83 | /**
84 | * Get AES Key.
85 | * @return the AES key of the session ticket key
86 | */
87 | public byte[] getAesKey() {
88 | return aesKey.clone();
89 | }
90 | }
91 |
--------------------------------------------------------------------------------
/openssl-classes/src/main/java/io/netty/internal/tcnative/SniHostNameMatcher.java:
--------------------------------------------------------------------------------
1 | /*
2 | * Copyright 2017 The Netty Project
3 | *
4 | * The Netty Project licenses this file to you under the Apache License,
5 | * version 2.0 (the "License"); you may not use this file except in compliance
6 | * with the License. You may obtain a copy of the License at:
7 | *
8 | * http://www.apache.org/licenses/LICENSE-2.0
9 | *
10 | * Unless required by applicable law or agreed to in writing, software
11 | * distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
12 | * WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the
13 | * License for the specific language governing permissions and limitations
14 | * under the License.
15 | */
16 | package io.netty.internal.tcnative;
17 |
18 | public interface SniHostNameMatcher {
19 |
20 | /**
21 | * Returns {@code true} if the hostname was matched and so SNI should be allowed.
22 | * @param ssl the SSL instance
23 | * @param hostname the hostname to match.
24 | * @return {@code true} if the hostname was matched
25 | */
26 | boolean match(long ssl, String hostname);
27 | }
28 |
--------------------------------------------------------------------------------
/openssl-classes/src/main/java/module-info.yml:
--------------------------------------------------------------------------------
1 | exports:
2 | - package: io.netty.internal.tcnative
3 |
--------------------------------------------------------------------------------
/openssl-dynamic/src/main/c/bb.c:
--------------------------------------------------------------------------------
1 | /*
2 | * Copyright 2016 The Netty Project
3 | *
4 | * The Netty Project licenses this file to you under the Apache License,
5 | * version 2.0 (the "License"); you may not use this file except in compliance
6 | * with the License. You may obtain a copy of the License at:
7 | *
8 | * http://www.apache.org/licenses/LICENSE-2.0
9 | *
10 | * Unless required by applicable law or agreed to in writing, software
11 | * distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
12 | * WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the
13 | * License for the specific language governing permissions and limitations
14 | * under the License.
15 | */
16 | /* Licensed to the Apache Software Foundation (ASF) under one or more
17 | * contributor license agreements. See the NOTICE file distributed with
18 | * this work for additional information regarding copyright ownership.
19 | * The ASF licenses this file to You under the Apache License, Version 2.0
20 | * (the "License"); you may not use this file except in compliance with
21 | * the License. You may obtain a copy of the License at
22 | *
23 | * http://www.apache.org/licenses/LICENSE-2.0
24 | *
25 | * Unless required by applicable law or agreed to in writing, software
26 | * distributed under the License is distributed on an "AS IS" BASIS,
27 | * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
28 | * See the License for the specific language governing permissions and
29 | * limitations under the License.
30 | */
31 |
32 | #include "tcn.h"
33 | #include "bb.h"
34 |
35 | #define BUFFER_CLASSNAME "io/netty/internal/tcnative/Buffer"
36 |
37 | TCN_IMPLEMENT_CALL(jlong, Buffer, address)(TCN_STDARGS, jobject bb)
38 | {
39 | return P2J((*e)->GetDirectBufferAddress(e, bb));
40 | }
41 |
42 | TCN_IMPLEMENT_CALL(jlong, Buffer, size)(TCN_STDARGS, jobject bb)
43 | {
44 | return (*e)->GetDirectBufferCapacity(e, bb);
45 | }
46 |
47 | // JNI Method Registration Table Begin
48 | static const JNINativeMethod method_table[] = {
49 | { TCN_METHOD_TABLE_ENTRY(address, (Ljava/nio/ByteBuffer;)J, Buffer) },
50 | { TCN_METHOD_TABLE_ENTRY(size, (Ljava/nio/ByteBuffer;)J, Buffer) }
51 | };
52 |
53 | static const jint method_table_size = sizeof(method_table) / sizeof(method_table[0]);
54 | // JNI Method Registration Table End
55 |
56 | // IMPORTANT: If you add any NETTY_JNI_UTIL_LOAD_CLASS or NETTY_JNI_UTIL_FIND_CLASS calls you also need to update
57 | // Library to reflect that.
58 | jint netty_internal_tcnative_Buffer_JNI_OnLoad(JNIEnv* env, const char* packagePrefix) {
59 | if (netty_jni_util_register_natives(env, packagePrefix, BUFFER_CLASSNAME, method_table, method_table_size) != 0) {
60 | return JNI_ERR;
61 | }
62 | return NETTY_JNI_UTIL_JNI_VERSION;
63 | }
64 |
65 | void netty_internal_tcnative_Buffer_JNI_OnUnLoad(JNIEnv* env, const char* packagePrefix) {
66 | netty_jni_util_unregister_natives(env, packagePrefix, BUFFER_CLASSNAME);
67 | }
68 |
--------------------------------------------------------------------------------
/openssl-dynamic/src/main/c/bb.h:
--------------------------------------------------------------------------------
1 | /*
2 | * Copyright 2017 The Netty Project
3 | *
4 | * The Netty Project licenses this file to you under the Apache License,
5 | * version 2.0 (the "License"); you may not use this file except in compliance
6 | * with the License. You may obtain a copy of the License at:
7 | *
8 | * http://www.apache.org/licenses/LICENSE-2.0
9 | *
10 | * Unless required by applicable law or agreed to in writing, software
11 | * distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
12 | * WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the
13 | * License for the specific language governing permissions and limitations
14 | * under the License.
15 | */
16 | #ifndef NETTY_TCNATIVE_BB_H_
17 | #define NETTY_TCNATIVE_BB_H_
18 |
19 | // JNI initialization hooks. Users of this file are responsible for calling these in the JNI_OnLoad and JNI_OnUnload methods.
20 | jint netty_internal_tcnative_Buffer_JNI_OnLoad(JNIEnv* env, const char* packagePrefix);
21 | void netty_internal_tcnative_Buffer_JNI_OnUnLoad(JNIEnv* env, const char* packagePrefix);
22 | #endif /* NETTY_TCNATIVE_BB_H_ */
23 |
--------------------------------------------------------------------------------
/openssl-dynamic/src/main/c/cert_compress.c:
--------------------------------------------------------------------------------
1 | /*
2 | * Copyright 2022 The Netty Project
3 | *
4 | * The Netty Project licenses this file to you under the Apache License,
5 | * version 2.0 (the "License"); you may not use this file except in compliance
6 | * with the License. You may obtain a copy of the License at:
7 | *
8 | * http://www.apache.org/licenses/LICENSE-2.0
9 | *
10 | * Unless required by applicable law or agreed to in writing, software
11 | * distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
12 | * WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the
13 | * License for the specific language governing permissions and limitations
14 | * under the License.
15 | */
16 |
17 | #include "tcn.h"
18 | #include "ssl_private.h"
19 | #ifdef OPENSSL_IS_BORINGSSL
20 | #include "cert_compress.h"
21 |
22 | static int compress(jobject compression_algorithm, jmethodID compress_method, SSL* ssl, CBB* out,
23 | const uint8_t* in, size_t in_len) {
24 |
25 | JNIEnv *e = NULL;
26 | jbyteArray inputArray = NULL;
27 |
28 | if (compression_algorithm == NULL || compress_method == NULL) {
29 | return 0;
30 | }
31 | if (tcn_get_java_env(&e) != JNI_OK) {
32 | return 0;
33 | }
34 | if ((inputArray = (*e)->NewByteArray(e, in_len)) == NULL) {
35 | return 0;
36 | }
37 |
38 | (*e)->SetByteArrayRegion(e, inputArray, 0, in_len, (jbyte*) in);
39 |
40 | jbyteArray resultArray = (*e)->CallObjectMethod(e, compression_algorithm, compress_method,
41 | P2J(ssl), inputArray);
42 |
43 | if ((*e)->ExceptionCheck(e) != JNI_FALSE) {
44 | (*e)->ExceptionClear(e);
45 | return 0; // Exception while calling into Java
46 | }
47 | if (resultArray == NULL) {
48 | return 0; // Received NULL array from call to Java
49 | }
50 |
51 | int resultLen = (*e)->GetArrayLength(e, resultArray);
52 | uint8_t* outData = NULL;
53 | if (!CBB_reserve(out, &outData, resultLen)) {
54 | return 0; // Unable to reserve space for compressed data
55 | }
56 | jbyte* resultData = (*e)->GetByteArrayElements(e, resultArray, NULL);
57 | if (resultData == NULL) {
58 | return 0;
59 | }
60 | memcpy(outData, resultData, resultLen);
61 | (*e)->ReleaseByteArrayElements(e, resultArray, resultData, JNI_ABORT);
62 | if (!CBB_did_write(out, resultLen)) {
63 | return 0; // Unable to advance bytes written to CBB
64 | }
65 | return 1; // Success
66 | }
67 |
68 | static int decompress(jobject compression_algorithm, jmethodID decompress_method, SSL* ssl, CRYPTO_BUFFER** out,
69 | size_t uncompressed_len, const uint8_t* in, size_t in_len) {
70 |
71 | JNIEnv* e = NULL;
72 | jbyteArray inputArray = NULL;
73 |
74 | if (compression_algorithm == NULL || decompress_method == NULL) {
75 | return 0;
76 | }
77 | if (tcn_get_java_env(&e) != JNI_OK) {
78 | return 0;
79 | }
80 | if ((inputArray = (*e)->NewByteArray(e, in_len)) == NULL) {
81 | return 0;
82 | }
83 |
84 | (*e)->SetByteArrayRegion(e, inputArray, 0, in_len, (jbyte*) in);
85 |
86 | // BoringSSL checks that `uncompressed_len <= ssl->max_cert_list` before calling `ssl_cert_decompression_func_t`
87 | // `max_cert_list` contains the max cert size, avoiding excessive allocations.
88 | jbyteArray resultArray = (*e)->CallObjectMethod(e, compression_algorithm, decompress_method,
89 | P2J(ssl), uncompressed_len, inputArray);
90 |
91 | if ((*e)->ExceptionCheck(e) != JNI_FALSE) {
92 | (*e)->ExceptionClear(e);
93 | return 0; // Exception while calling into Java
94 | }
95 | if (resultArray == NULL) {
96 | return 0; // Received NULL array from call to Java
97 | }
98 |
99 | int resultLen = (*e)->GetArrayLength(e, resultArray);
100 | if (uncompressed_len != resultLen) {
101 | return 0; // Unexpected uncompressed length
102 | }
103 | uint8_t* outData;
104 | if (!((*out) = CRYPTO_BUFFER_alloc(&outData, uncompressed_len))) {
105 | return 0; // Unable to allocate certificate decompression buffer
106 | }
107 | jbyte* resultData = (*e)->GetByteArrayElements(e, resultArray, NULL);
108 | if (resultData == NULL) {
109 | return 0;
110 | }
111 | memcpy(outData, resultData, uncompressed_len);
112 | (*e)->ReleaseByteArrayElements(e, resultArray, resultData, JNI_ABORT);
113 | return 1; // Success
114 |
115 | }
116 |
117 | int zlib_compress_java(SSL* ssl, CBB* out, const uint8_t* in, size_t in_len)
118 | {
119 | tcn_ssl_ctxt_t* c = NULL;
120 | TCN_GET_SSL_CTX(ssl, c);
121 | TCN_ASSERT(c != NULL);
122 | return compress(c->ssl_cert_compression_zlib_algorithm, c->ssl_cert_compression_zlib_compress_method,
123 | ssl, out, in, in_len);
124 | }
125 |
126 | int zlib_decompress_java(SSL* ssl, CRYPTO_BUFFER** out, size_t uncompressed_len, const uint8_t* in, size_t in_len)
127 | {
128 | tcn_ssl_ctxt_t* c = NULL;
129 | TCN_GET_SSL_CTX(ssl, c);
130 | TCN_ASSERT(c != NULL);
131 | return decompress(c->ssl_cert_compression_zlib_algorithm, c->ssl_cert_compression_zlib_decompress_method,
132 | ssl, out, uncompressed_len, in, in_len);
133 | }
134 |
135 | int brotli_compress_java(SSL* ssl, CBB* out, const uint8_t* in, size_t in_len)
136 | {
137 | tcn_ssl_ctxt_t* c = NULL;
138 | TCN_GET_SSL_CTX(ssl, c);
139 | TCN_ASSERT(c != NULL);
140 | return compress(c->ssl_cert_compression_brotli_algorithm, c->ssl_cert_compression_brotli_compress_method,
141 | ssl, out, in, in_len);
142 | }
143 |
144 | int brotli_decompress_java(SSL* ssl, CRYPTO_BUFFER** out, size_t uncompressed_len, const uint8_t* in, size_t in_len)
145 | {
146 | tcn_ssl_ctxt_t* c = NULL;
147 | TCN_GET_SSL_CTX(ssl, c);
148 | TCN_ASSERT(c != NULL);
149 | return decompress(c->ssl_cert_compression_brotli_algorithm, c->ssl_cert_compression_brotli_decompress_method,
150 | ssl, out, uncompressed_len, in, in_len);
151 | }
152 |
153 | int zstd_compress_java(SSL* ssl, CBB* out, const uint8_t* in, size_t in_len)
154 | {
155 | tcn_ssl_ctxt_t* c = NULL;
156 | TCN_GET_SSL_CTX(ssl, c);
157 | TCN_ASSERT(c != NULL);
158 | return compress(c->ssl_cert_compression_zstd_algorithm, c->ssl_cert_compression_zstd_compress_method,
159 | ssl, out, in, in_len);
160 | }
161 |
162 | int zstd_decompress_java(SSL* ssl, CRYPTO_BUFFER** out, size_t uncompressed_len, const uint8_t* in, size_t in_len)
163 | {
164 | tcn_ssl_ctxt_t* c = NULL;
165 | TCN_GET_SSL_CTX(ssl, c);
166 | TCN_ASSERT(c != NULL);
167 | return decompress(c->ssl_cert_compression_zstd_algorithm, c->ssl_cert_compression_zstd_decompress_method,
168 | ssl, out, uncompressed_len, in, in_len);
169 | }
170 |
171 | #endif // OPENSSL_IS_BORINGSSL
--------------------------------------------------------------------------------
/openssl-dynamic/src/main/c/cert_compress.h:
--------------------------------------------------------------------------------
1 | /*
2 | * Copyright 2022 The Netty Project
3 | *
4 | * The Netty Project licenses this file to you under the Apache License,
5 | * version 2.0 (the "License"); you may not use this file except in compliance
6 | * with the License. You may obtain a copy of the License at:
7 | *
8 | * http://www.apache.org/licenses/LICENSE-2.0
9 | *
10 | * Unless required by applicable law or agreed to in writing, software
11 | * distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
12 | * WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the
13 | * License for the specific language governing permissions and limitations
14 | * under the License.
15 | */
16 |
17 | #ifndef NETTY_TCNATIVE_CERT_COMPRESS_H_
18 | #define NETTY_TCNATIVE_CERT_COMPRESS_H_
19 |
20 | #ifdef OPENSSL_IS_BORINGSSL
21 |
22 | int zlib_decompress_java(SSL* ssl, CRYPTO_BUFFER** out, size_t uncompressed_len, const uint8_t* in, size_t in_len);
23 | int zlib_compress_java(SSL* ssl, CBB* out, const uint8_t* in, size_t in_len);
24 |
25 | int brotli_decompress_java(SSL* ssl, CRYPTO_BUFFER** out, size_t uncompressed_len, const uint8_t* in, size_t in_len);
26 | int brotli_compress_java(SSL* ssl, CBB* out, const uint8_t* in, size_t in_len);
27 |
28 | int zstd_decompress_java(SSL* ssl, CRYPTO_BUFFER** out, size_t uncompressed_len, const uint8_t* in, size_t in_len);
29 | int zstd_compress_java(SSL* ssl, CBB* out, const uint8_t* in, size_t in_len);
30 |
31 | #endif // OPENSSL_IS_BORINGSSL
32 |
33 | #endif /* NETTY_TCNATIVE_CERT_COMPRESS_H_ */
--------------------------------------------------------------------------------
/openssl-dynamic/src/main/c/error.c:
--------------------------------------------------------------------------------
1 | /*
2 | * Copyright 2016 The Netty Project
3 | *
4 | * The Netty Project licenses this file to you under the Apache License,
5 | * version 2.0 (the "License"); you may not use this file except in compliance
6 | * with the License. You may obtain a copy of the License at:
7 | *
8 | * http://www.apache.org/licenses/LICENSE-2.0
9 | *
10 | * Unless required by applicable law or agreed to in writing, software
11 | * distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
12 | * WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the
13 | * License for the specific language governing permissions and limitations
14 | * under the License.
15 | */
16 | /* Licensed to the Apache Software Foundation (ASF) under one or more
17 | * contributor license agreements. See the NOTICE file distributed with
18 | * this work for additional information regarding copyright ownership.
19 | * The ASF licenses this file to You under the Apache License, Version 2.0
20 | * (the "License"); you may not use this file except in compliance with
21 | * the License. You may obtain a copy of the License at
22 | *
23 | * http://www.apache.org/licenses/LICENSE-2.0
24 | *
25 | * Unless required by applicable law or agreed to in writing, software
26 | * distributed under the License is distributed on an "AS IS" BASIS,
27 | * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
28 | * See the License for the specific language governing permissions and
29 | * limitations under the License.
30 | */
31 |
32 | #include "tcn.h"
33 | #include "apr_strings.h"
34 |
35 | static jclass exceptionClass;
36 | static jclass nullPointerExceptionClass;
37 | static jclass illegalArgumentExceptionClass;
38 | static jclass oomeClass;
39 |
40 |
41 | /*
42 | * Convenience function to help throw an java.lang.Exception.
43 | */
44 | void tcn_ThrowException(JNIEnv *env, const char *msg)
45 | {
46 | (*env)->ThrowNew(env, exceptionClass, msg);
47 | }
48 |
49 | void tcn_ThrowNullPointerException(JNIEnv *env, const char *msg)
50 | {
51 | (*env)->ThrowNew(env, nullPointerExceptionClass, msg);
52 | }
53 |
54 | void tcn_ThrowIllegalArgumentException(JNIEnv *env, const char *msg)
55 | {
56 | (*env)->ThrowNew(env, illegalArgumentExceptionClass, msg);
57 | }
58 |
59 | void tcn_Throw(JNIEnv *env, const char *fmt, ...)
60 | {
61 | char msg[TCN_BUFFER_SZ] = {'\0'};
62 | va_list ap;
63 |
64 | va_start(ap, fmt);
65 | apr_vsnprintf(msg, TCN_BUFFER_SZ, fmt, ap);
66 | tcn_ThrowException(env, msg);
67 | va_end(ap);
68 | }
69 |
70 | void tcn_ThrowAPRException(JNIEnv *e, apr_status_t err)
71 | {
72 | char serr[512] = {0};
73 |
74 | apr_strerror(err, serr, 512);
75 | tcn_ThrowException(e, serr);
76 | }
77 |
78 | void tcn_throwOutOfMemoryError(JNIEnv* env, const char *msg)
79 | {
80 | (*env)->ThrowNew(env, oomeClass, msg);
81 | }
82 |
83 | // IMPORTANT: If you add any NETTY_JNI_UTIL_LOAD_CLASS or NETTY_JNI_UTIL_FIND_CLASS calls you also need to update
84 | // Library to reflect that.
85 | jint netty_internal_tcnative_Error_JNI_OnLoad(JNIEnv* env, const char* packagePrefix) {
86 | NETTY_JNI_UTIL_LOAD_CLASS(env, exceptionClass, "java/lang/Exception", error);
87 | NETTY_JNI_UTIL_LOAD_CLASS(env, nullPointerExceptionClass, "java/lang/NullPointerException", error);
88 | NETTY_JNI_UTIL_LOAD_CLASS(env, illegalArgumentExceptionClass, "java/lang/IllegalArgumentException", error);
89 | NETTY_JNI_UTIL_LOAD_CLASS(env, oomeClass, "java/lang/OutOfMemoryError", error);
90 | return NETTY_JNI_UTIL_JNI_VERSION;
91 | error:
92 | return JNI_ERR;
93 | }
94 |
95 | void netty_internal_tcnative_Error_JNI_OnUnLoad(JNIEnv* env, const char* packagePrefix) {
96 | NETTY_JNI_UTIL_UNLOAD_CLASS(env, exceptionClass);
97 | NETTY_JNI_UTIL_UNLOAD_CLASS(env, nullPointerExceptionClass);
98 | NETTY_JNI_UTIL_UNLOAD_CLASS(env, illegalArgumentExceptionClass);
99 | NETTY_JNI_UTIL_UNLOAD_CLASS(env, oomeClass);
100 | }
101 |
--------------------------------------------------------------------------------
/openssl-dynamic/src/main/c/error.h:
--------------------------------------------------------------------------------
1 | /*
2 | * Copyright 2017 The Netty Project
3 | *
4 | * The Netty Project licenses this file to you under the Apache License,
5 | * version 2.0 (the "License"); you may not use this file except in compliance
6 | * with the License. You may obtain a copy of the License at:
7 | *
8 | * http://www.apache.org/licenses/LICENSE-2.0
9 | *
10 | * Unless required by applicable law or agreed to in writing, software
11 | * distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
12 | * WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the
13 | * License for the specific language governing permissions and limitations
14 | * under the License.
15 | */
16 | #ifndef NETTY_TCNATIVE_ERROR_H_
17 | #define NETTY_TCNATIVE_ERROR_H_
18 |
19 | // JNI initialization hooks. Users of this file are responsible for calling these in the JNI_OnLoad and JNI_OnUnload methods.
20 | jint netty_internal_tcnative_Error_JNI_OnLoad(JNIEnv* env, const char* packagePrefix);
21 | void netty_internal_tcnative_Error_JNI_OnUnLoad(JNIEnv* env, const char* packagePrefix);
22 | #endif /* NETTY_TCNATIVE_ERROR_H_ */
23 |
--------------------------------------------------------------------------------
/openssl-dynamic/src/main/c/jnilib.c:
--------------------------------------------------------------------------------
1 | /*
2 | * Copyright 2016 The Netty Project
3 | *
4 | * The Netty Project licenses this file to you under the Apache License,
5 | * version 2.0 (the "License"); you may not use this file except in compliance
6 | * with the License. You may obtain a copy of the License at:
7 | *
8 | * http://www.apache.org/licenses/LICENSE-2.0
9 | *
10 | * Unless required by applicable law or agreed to in writing, software
11 | * distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
12 | * WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the
13 | * License for the specific language governing permissions and limitations
14 | * under the License.
15 | */
16 | /* Licensed to the Apache Software Foundation (ASF) under one or more
17 | * contributor license agreements. See the NOTICE file distributed with
18 | * this work for additional information regarding copyright ownership.
19 | * The ASF licenses this file to You under the Apache License, Version 2.0
20 | * (the "License"); you may not use this file except in compliance with
21 | * the License. You may obtain a copy of the License at
22 | *
23 | * http://www.apache.org/licenses/LICENSE-2.0
24 | *
25 | * Unless required by applicable law or agreed to in writing, software
26 | * distributed under the License is distributed on an "AS IS" BASIS,
27 | * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
28 | * See the License for the specific language governing permissions and
29 | * limitations under the License.
30 | */
31 |
32 | #define LIBRARY_CLASSNAME "io/netty/internal/tcnative/Library"
33 |
34 | #ifdef _WIN32
35 | #define MAX_DLL_PATH_LEN 2048
36 | #endif
37 |
38 | #ifdef TCN_BUILD_STATIC
39 | #define NETTY_JNI_UTIL_BUILD_STATIC
40 | #endif
41 |
42 | #include "tcn.h"
43 | #include "apr_version.h"
44 | #include "apr_atomic.h"
45 | #include "apr_strings.h"
46 | #include "bb.h"
47 | #include "native_constants.h"
48 | #include "ssl.h"
49 | #include "sslcontext.h"
50 | #include "sslsession.h"
51 | #include "error.h"
52 |
53 | apr_pool_t *tcn_global_pool = NULL;
54 | static JavaVM *tcn_global_vm = NULL;
55 |
56 | static jclass jString_class;
57 | static jmethodID jString_init;
58 | static jmethodID jString_getBytes;
59 | static jclass byteArrayClass;
60 | static char const* staticPackagePrefix = NULL;
61 |
62 | jstring tcn_new_stringn(JNIEnv *env, const char *str, size_t l)
63 | {
64 | jstring result = NULL;
65 | jbyteArray bytes = 0;
66 |
67 | if (!str) {
68 | return NULL;
69 | }
70 | if ((*env)->EnsureLocalCapacity(env, 2) < 0) {
71 | return NULL; /* out of memory error */
72 | }
73 | bytes = (*env)->NewByteArray(env, l);
74 | if (bytes != NULL) {
75 | (*env)->SetByteArrayRegion(env, bytes, 0, l, (jbyte *)str);
76 | result = (*env)->NewObject(env, jString_class, jString_init, bytes);
77 | NETTY_JNI_UTIL_DELETE_LOCAL(env, bytes);
78 | return result;
79 | } /* else fall through */
80 | return NULL;
81 | }
82 |
83 | jstring tcn_new_string(JNIEnv *env, const char *str)
84 | {
85 | if (!str) {
86 | return NULL;
87 | }
88 | return (*env)->NewStringUTF(env, str);
89 | }
90 |
91 | TCN_IMPLEMENT_CALL(jboolean, Library, initialize0)(TCN_STDARGS)
92 | {
93 |
94 | if (!tcn_global_pool) {
95 | apr_initialize();
96 | if (apr_pool_create(&tcn_global_pool, NULL) != APR_SUCCESS) {
97 | return JNI_FALSE;
98 | }
99 | apr_atomic_init(tcn_global_pool);
100 | }
101 | return JNI_TRUE;
102 | }
103 |
104 | TCN_IMPLEMENT_CALL(jint, Library, aprMajorVersion)(TCN_STDARGS)
105 | {
106 | apr_version_t apv;
107 |
108 | apr_version(&apv);
109 | return apv.major;
110 | }
111 |
112 | TCN_IMPLEMENT_CALL(jstring, Library, aprVersionString)(TCN_STDARGS)
113 | {
114 | return AJP_TO_JSTRING(apr_version_string());
115 | }
116 |
117 | TCN_IMPLEMENT_CALL(jboolean, Library, aprHasThreads)(TCN_STDARGS)
118 | {
119 | #if APR_HAS_THREADS
120 | return JNI_TRUE;
121 | #else
122 | return JNI_FALSE;
123 | #endif
124 | }
125 |
126 | jclass tcn_get_string_class()
127 | {
128 | return jString_class;
129 | }
130 |
131 | jclass tcn_get_byte_array_class()
132 | {
133 | return byteArrayClass;
134 | }
135 |
136 | jint tcn_get_java_env(JNIEnv **env)
137 | {
138 | return (*tcn_global_vm)->GetEnv(tcn_global_vm, (void **)env, NETTY_JNI_UTIL_JNI_VERSION);
139 | }
140 |
141 | // JNI Method Registration Table Begin
142 | static const JNINativeMethod method_table[] = {
143 | { TCN_METHOD_TABLE_ENTRY(initialize0, ()Z, Library) },
144 | { TCN_METHOD_TABLE_ENTRY(aprMajorVersion, ()I, Library) },
145 | { TCN_METHOD_TABLE_ENTRY(aprVersionString, ()Ljava/lang/String;, Library) },
146 | { TCN_METHOD_TABLE_ENTRY(aprHasThreads, ()Z, Library) },
147 | };
148 |
149 | static const jint method_table_size = sizeof(method_table) / sizeof(method_table[0]);
150 | // JNI Method Registration Table End
151 |
152 | // IMPORTANT: If you add any NETTY_JNI_UTIL_LOAD_CLASS or NETTY_JNI_UTIL_FIND_CLASS calls you also need to update
153 | // Library to reflect that.
154 | static jint netty_internal_tcnative_Library_JNI_OnLoad(JNIEnv* env, char const* packagePrefix) {
155 | int errorOnLoadCalled = 0;
156 | int bufferOnLoadCalled = 0;
157 | int jniMethodsOnLoadCalled = 0;
158 | int sessionOnLoadCalled = 0;
159 | int sslOnLoadCalled = 0;
160 | int contextOnLoadCalled = 0;
161 |
162 | if (netty_jni_util_register_natives(env, packagePrefix, LIBRARY_CLASSNAME, method_table, method_table_size) != 0) {
163 | goto error;
164 | }
165 |
166 | // Load all c modules that we depend upon
167 | if (netty_internal_tcnative_Error_JNI_OnLoad(env, packagePrefix) == JNI_ERR) {
168 | goto error;
169 | }
170 | errorOnLoadCalled = 1;
171 |
172 | if (netty_internal_tcnative_Buffer_JNI_OnLoad(env, packagePrefix) == JNI_ERR) {
173 | goto error;
174 | }
175 | bufferOnLoadCalled = 1;
176 |
177 | if (netty_internal_tcnative_NativeStaticallyReferencedJniMethods_JNI_OnLoad(env, packagePrefix) == JNI_ERR) {
178 | goto error;
179 | }
180 | jniMethodsOnLoadCalled = 1;
181 |
182 | if (netty_internal_tcnative_SSL_JNI_OnLoad(env, packagePrefix) == JNI_ERR) {
183 | goto error;
184 | }
185 | sslOnLoadCalled = 1;
186 |
187 | if (netty_internal_tcnative_SSLContext_JNI_OnLoad(env, packagePrefix) == JNI_ERR) {
188 | goto error;
189 | }
190 | contextOnLoadCalled = 1;
191 |
192 | if (netty_internal_tcnative_SSLSession_JNI_OnLoad(env, packagePrefix) == JNI_ERR) {
193 | goto error;
194 | }
195 | sessionOnLoadCalled = 1;
196 |
197 | apr_version_t apv;
198 | int apvn;
199 |
200 | /* Before doing anything else check if we have a valid
201 | * APR version.
202 | */
203 | apr_version(&apv);
204 | apvn = apv.major * 1000 + apv.minor * 100 + apv.patch;
205 | if (apvn < 1201) {
206 | tcn_Throw(env, "Unsupported APR version (%s)",
207 | apr_version_string());
208 | goto error;
209 | }
210 |
211 |
212 | /* Initialize global java.lang.String class */
213 | NETTY_JNI_UTIL_LOAD_CLASS(env, jString_class, "java/lang/String", error);
214 |
215 | NETTY_JNI_UTIL_GET_METHOD(env, jString_class, jString_init,
216 | "", "([B)V", error);
217 | NETTY_JNI_UTIL_GET_METHOD(env, jString_class, jString_getBytes,
218 | "getBytes", "()[B", error);
219 |
220 | NETTY_JNI_UTIL_LOAD_CLASS(env, byteArrayClass, "[B", error);
221 | staticPackagePrefix = packagePrefix;
222 | return NETTY_JNI_UTIL_JNI_VERSION;
223 | error:
224 | if (tcn_global_pool != NULL) {
225 | NETTY_JNI_UTIL_UNLOAD_CLASS(env, jString_class);
226 | apr_terminate();
227 | tcn_global_pool = NULL;
228 | }
229 |
230 | NETTY_JNI_UTIL_UNLOAD_CLASS(env, byteArrayClass);
231 |
232 | netty_jni_util_unregister_natives(env, packagePrefix, LIBRARY_CLASSNAME);
233 |
234 | // Call unload methods if needed to ensure we correctly release any resources.
235 | if (errorOnLoadCalled == 1) {
236 | netty_internal_tcnative_Error_JNI_OnUnLoad(env, packagePrefix);
237 | }
238 | if (bufferOnLoadCalled == 1) {
239 | netty_internal_tcnative_Buffer_JNI_OnUnLoad(env, packagePrefix);
240 | }
241 | if (jniMethodsOnLoadCalled == 1) {
242 | netty_internal_tcnative_NativeStaticallyReferencedJniMethods_JNI_OnUnLoad(env, packagePrefix);
243 | }
244 | if (sslOnLoadCalled == 1) {
245 | netty_internal_tcnative_SSL_JNI_OnUnLoad(env, packagePrefix);
246 | }
247 | if (contextOnLoadCalled == 1) {
248 | netty_internal_tcnative_SSLContext_JNI_OnUnLoad(env, packagePrefix);
249 | }
250 | if (sessionOnLoadCalled == 1) {
251 | netty_internal_tcnative_SSLSession_JNI_OnUnLoad(env, packagePrefix);
252 | }
253 | return JNI_ERR;
254 | }
255 |
256 | static void netty_internal_tcnative_Library_JNI_OnUnload(JNIEnv* env) {
257 | if (tcn_global_pool != NULL) {
258 | NETTY_JNI_UTIL_UNLOAD_CLASS(env, jString_class);
259 | apr_terminate();
260 | tcn_global_pool = NULL;
261 | }
262 |
263 | NETTY_JNI_UTIL_UNLOAD_CLASS(env, byteArrayClass);
264 | netty_internal_tcnative_Error_JNI_OnUnLoad(env, staticPackagePrefix);
265 | netty_internal_tcnative_Buffer_JNI_OnUnLoad(env, staticPackagePrefix);
266 | netty_internal_tcnative_NativeStaticallyReferencedJniMethods_JNI_OnUnLoad(env, staticPackagePrefix);
267 | netty_internal_tcnative_SSL_JNI_OnUnLoad(env, staticPackagePrefix);
268 | netty_internal_tcnative_SSLContext_JNI_OnUnLoad(env, staticPackagePrefix);
269 | netty_internal_tcnative_SSLSession_JNI_OnUnLoad(env, staticPackagePrefix);
270 | free((void *) staticPackagePrefix);
271 | staticPackagePrefix = NULL;
272 | }
273 |
274 | // As we build with -fvisibility=hidden we need to ensure we mark the entry load and unload functions used by the
275 | // JVM as visible.
276 | //
277 | // It's important to note that we will only export functions that are prefixed with JNI_ so if we ever need to export
278 | // more we need to ensure we add the prefix. This is enforced by the TCN_CHECK_STATIC function in tcnative.m4.
279 |
280 | // Invoked by the JVM when statically linked
281 | JNIEXPORT jint JNI_OnLoad_netty_tcnative(JavaVM* vm, void* reserved) {
282 | tcn_global_vm = vm;
283 | jint ret = netty_jni_util_JNI_OnLoad(vm, reserved, "netty_tcnative", netty_internal_tcnative_Library_JNI_OnLoad);
284 | if (ret == JNI_ERR) {
285 | tcn_global_vm = NULL;
286 | }
287 | return ret;
288 | }
289 |
290 | // Invoked by the JVM when statically linked
291 | JNIEXPORT void JNI_OnUnload_netty_tcnative(JavaVM* vm, void* reserved) {
292 | netty_jni_util_JNI_OnUnload(vm, reserved, netty_internal_tcnative_Library_JNI_OnUnload);
293 | tcn_global_vm = NULL;
294 | }
295 |
296 | #ifndef TCN_BUILD_STATIC
297 | JNIEXPORT jint JNI_OnLoad(JavaVM* vm, void* reserved) {
298 | tcn_global_vm = vm;
299 | jint ret = netty_jni_util_JNI_OnLoad(vm, reserved, "netty_tcnative", netty_internal_tcnative_Library_JNI_OnLoad);
300 | if (ret == JNI_ERR) {
301 | tcn_global_vm = NULL;
302 | }
303 | return ret;
304 | }
305 |
306 | JNIEXPORT void JNI_OnUnload(JavaVM* vm, void* reserved) {
307 | netty_jni_util_JNI_OnUnload(vm, reserved, netty_internal_tcnative_Library_JNI_OnUnload);
308 | tcn_global_vm = NULL;
309 | }
310 | #endif /* TCN_BUILD_STATIC */
311 |
--------------------------------------------------------------------------------
/openssl-dynamic/src/main/c/native_constants.h:
--------------------------------------------------------------------------------
1 | /*
2 | * Copyright 2017 The Netty Project
3 | *
4 | * The Netty Project licenses this file to you under the Apache License,
5 | * version 2.0 (the "License"); you may not use this file except in compliance
6 | * with the License. You may obtain a copy of the License at:
7 | *
8 | * http://www.apache.org/licenses/LICENSE-2.0
9 | *
10 | * Unless required by applicable law or agreed to in writing, software
11 | * distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
12 | * WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the
13 | * License for the specific language governing permissions and limitations
14 | * under the License.
15 | */
16 | #ifndef NETTY_TCNATIVE_NATIVE_CONSTANTS_H_
17 | #define NETTY_TCNATIVE_NATIVE_CONSTANTS_H_
18 |
19 | // JNI initialization hooks. Users of this file are responsible for calling these in the JNI_OnLoad and JNI_OnUnload methods.
20 | jint netty_internal_tcnative_NativeStaticallyReferencedJniMethods_JNI_OnLoad(JNIEnv* env, const char* packagePrefix);
21 | void netty_internal_tcnative_NativeStaticallyReferencedJniMethods_JNI_OnUnLoad(JNIEnv* env, const char* packagePrefix);
22 | #endif /* NETTY_TCNATIVE_NATIVE_CONSTANTS_H_ */
23 |
--------------------------------------------------------------------------------
/openssl-dynamic/src/main/c/ssl.h:
--------------------------------------------------------------------------------
1 | /*
2 | * Copyright 2017 The Netty Project
3 | *
4 | * The Netty Project licenses this file to you under the Apache License,
5 | * version 2.0 (the "License"); you may not use this file except in compliance
6 | * with the License. You may obtain a copy of the License at:
7 | *
8 | * http://www.apache.org/licenses/LICENSE-2.0
9 | *
10 | * Unless required by applicable law or agreed to in writing, software
11 | * distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
12 | * WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the
13 | * License for the specific language governing permissions and limitations
14 | * under the License.
15 | */
16 | #ifndef NETTY_TCNATIVE_SSL_H_
17 | #define NETTY_TCNATIVE_SSL_H_
18 |
19 | // JNI initialization hooks. Users of this file are responsible for calling these in the JNI_OnLoad and JNI_OnUnload methods.
20 | jint netty_internal_tcnative_SSL_JNI_OnLoad(JNIEnv* env, const char* packagePrefix);
21 | void netty_internal_tcnative_SSL_JNI_OnUnLoad(JNIEnv* env, const char* packagePrefix);
22 | #endif /* NETTY_TCNATIVE_SSL_H_ */
23 |
--------------------------------------------------------------------------------
/openssl-dynamic/src/main/c/sslcontext.h:
--------------------------------------------------------------------------------
1 | /*
2 | * Copyright 2017 The Netty Project
3 | *
4 | * The Netty Project licenses this file to you under the Apache License,
5 | * version 2.0 (the "License"); you may not use this file except in compliance
6 | * with the License. You may obtain a copy of the License at:
7 | *
8 | * http://www.apache.org/licenses/LICENSE-2.0
9 | *
10 | * Unless required by applicable law or agreed to in writing, software
11 | * distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
12 | * WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the
13 | * License for the specific language governing permissions and limitations
14 | * under the License.
15 | */
16 | #ifndef NETTY_TCNATIVE_SSLCONTEXT_H_
17 | #define NETTY_TCNATIVE_SSLCONTEXT_H_
18 |
19 | // JNI initialization hooks. Users of this file are responsible for calling these in the JNI_OnLoad and JNI_OnUnload methods.
20 | jint netty_internal_tcnative_SSLContext_JNI_OnLoad(JNIEnv* env, const char* packagePrefix);
21 | void netty_internal_tcnative_SSLContext_JNI_OnUnLoad(JNIEnv* env, const char* packagePrefix);
22 | #endif /* NETTY_TCNATIVE_SSLCONTEXT_H_ */
23 |
--------------------------------------------------------------------------------
/openssl-dynamic/src/main/c/sslsession.c:
--------------------------------------------------------------------------------
1 | /*
2 | * Copyright 2020 The Netty Project
3 | *
4 | * The Netty Project licenses this file to you under the Apache License,
5 | * version 2.0 (the "License"); you may not use this file except in compliance
6 | * with the License. You may obtain a copy of the License at:
7 | *
8 | * http://www.apache.org/licenses/LICENSE-2.0
9 | *
10 | * Unless required by applicable law or agreed to in writing, software
11 | * distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
12 | * WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the
13 | * License for the specific language governing permissions and limitations
14 | * under the License.
15 | */
16 | #include "tcn.h"
17 | #include "ssl_private.h"
18 | #include "sslsession.h"
19 |
20 | #define SSLSESSION_CLASSNAME "io/netty/internal/tcnative/SSLSession"
21 |
22 |
23 | TCN_IMPLEMENT_CALL(jlong, SSLSession, getTime)(TCN_STDARGS, jlong session)
24 | {
25 | SSL_SESSION *session_ = J2P(session, SSL_SESSION *);
26 |
27 | TCN_CHECK_NULL(session_, session, 0);
28 |
29 | return SSL_SESSION_get_time(session_);
30 | }
31 |
32 | TCN_IMPLEMENT_CALL(jlong, SSLSession, getTimeout)(TCN_STDARGS, jlong session)
33 | {
34 | SSL_SESSION *session_ = J2P(session, SSL_SESSION *);
35 |
36 | TCN_CHECK_NULL(session_, session, 0);
37 |
38 | return SSL_SESSION_get_timeout(session_);
39 | }
40 |
41 | TCN_IMPLEMENT_CALL(jlong, SSLSession, setTimeout)(TCN_STDARGS, jlong session, jlong seconds)
42 | {
43 | SSL_SESSION *session_ = J2P(session, SSL_SESSION *);
44 |
45 | TCN_CHECK_NULL(session_, session, 0);
46 |
47 | return SSL_SESSION_set_timeout(session_, seconds);
48 | }
49 |
50 | TCN_IMPLEMENT_CALL(jbyteArray, SSLSession, getSessionId)(TCN_STDARGS, jlong session)
51 | {
52 | unsigned int len;
53 | const unsigned char *session_id = NULL;
54 | jbyteArray bArray = NULL;
55 | SSL_SESSION *session_ = J2P(session, SSL_SESSION *);
56 |
57 | TCN_CHECK_NULL(session_, session, NULL);
58 |
59 | session_id = SSL_SESSION_get_id(session_, &len);
60 | if (len == 0 || session_id == NULL) {
61 | return NULL;
62 | }
63 |
64 | if ((bArray = (*e)->NewByteArray(e, len)) == NULL) {
65 | return NULL;
66 | }
67 | (*e)->SetByteArrayRegion(e, bArray, 0, len, (jbyte*) session_id);
68 | return bArray;
69 | }
70 |
71 | TCN_IMPLEMENT_CALL(jboolean, SSLSession, upRef)(TCN_STDARGS, jlong session) {
72 | SSL_SESSION *session_ = J2P(session, SSL_SESSION *);
73 |
74 | TCN_CHECK_NULL(session_, session, JNI_FALSE);
75 |
76 | // Only supported with GCC
77 | #if !defined(OPENSSL_IS_BORINGSSL) && (defined(__GNUC__) || defined(__GNUG__))
78 | if (!SSL_SESSION_up_ref) {
79 | return JNI_FALSE;
80 | }
81 | #endif
82 |
83 | // We can only support it when either use openssl version >= 1.1.0 or GCC as this way we can use weak linking
84 | #if OPENSSL_VERSION_NUMBER >= 0x10100000L || defined(__GNUC__) || defined(__GNUG__)
85 | return SSL_SESSION_up_ref(session_) == 1 ? JNI_TRUE : JNI_FALSE;
86 | #else
87 | return JNI_FALSE;
88 | #endif // OPENSSL_VERSION_NUMBER >= 0x10100000L || defined(__GNUC__) || defined(__GNUG__)
89 | }
90 |
91 | TCN_IMPLEMENT_CALL(void, SSLSession, free)(TCN_STDARGS, jlong session) {
92 | SSL_SESSION *session_ = J2P(session, SSL_SESSION *);
93 |
94 | TCN_CHECK_NULL(session_, session, /* void */);
95 |
96 | SSL_SESSION_free(session_);
97 | }
98 |
99 | TCN_IMPLEMENT_CALL(jboolean, SSLSession, shouldBeSingleUse)(TCN_STDARGS, jlong session) {
100 | // Only supported by BoringSSL atm
101 | #ifdef OPENSSL_IS_BORINGSSL
102 | SSL_SESSION *session_ = J2P(session, SSL_SESSION *);
103 | TCN_CHECK_NULL(session_, session, JNI_FALSE);
104 | return SSL_SESSION_should_be_single_use(session_) == 0 ? JNI_FALSE : JNI_TRUE;
105 | #else
106 | return JNI_FALSE;
107 | #endif // OPENSSL_IS_BORINGSSL
108 | }
109 |
110 | // JNI Method Registration Table Begin
111 | static const JNINativeMethod method_table[] = {
112 | { TCN_METHOD_TABLE_ENTRY(getTime, (J)J, SSLSession) },
113 | { TCN_METHOD_TABLE_ENTRY(getTimeout, (J)J, SSLSession) },
114 | { TCN_METHOD_TABLE_ENTRY(setTimeout, (JJ)J, SSLSession) },
115 | { TCN_METHOD_TABLE_ENTRY(getSessionId, (J)[B, SSLSession) },
116 | { TCN_METHOD_TABLE_ENTRY(free, (J)V, SSLSession) },
117 | { TCN_METHOD_TABLE_ENTRY(upRef, (J)Z, SSLSession) },
118 | { TCN_METHOD_TABLE_ENTRY(shouldBeSingleUse, (J)Z, SSLSession) }
119 | };
120 |
121 | static const jint method_table_size = sizeof(method_table) / sizeof(method_table[0]);
122 |
123 | // JNI Method Registration Table End
124 |
125 | // IMPORTANT: If you add any NETTY_JNI_UTIL_LOAD_CLASS or NETTY_JNI_UTIL_FIND_CLASS calls you also need to update
126 | // Library to reflect that.
127 | jint netty_internal_tcnative_SSLSession_JNI_OnLoad(JNIEnv* env, const char* packagePrefix) {
128 | if (netty_jni_util_register_natives(env,
129 | packagePrefix,
130 | SSLSESSION_CLASSNAME,
131 | method_table, method_table_size) != 0) {
132 | return JNI_ERR;
133 | }
134 | return NETTY_JNI_UTIL_JNI_VERSION;
135 | }
136 |
137 | void netty_internal_tcnative_SSLSession_JNI_OnUnLoad(JNIEnv* env, const char* packagePrefix) {
138 | netty_jni_util_unregister_natives(env,packagePrefix, SSLSESSION_CLASSNAME);
139 | }
140 |
--------------------------------------------------------------------------------
/openssl-dynamic/src/main/c/sslsession.h:
--------------------------------------------------------------------------------
1 | /*
2 | * Copyright 2020 The Netty Project
3 | *
4 | * The Netty Project licenses this file to you under the Apache License,
5 | * version 2.0 (the "License"); you may not use this file except in compliance
6 | * with the License. You may obtain a copy of the License at:
7 | *
8 | * http://www.apache.org/licenses/LICENSE-2.0
9 | *
10 | * Unless required by applicable law or agreed to in writing, software
11 | * distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
12 | * WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the
13 | * License for the specific language governing permissions and limitations
14 | * under the License.
15 | */
16 | #ifndef NETTY_TCNATIVE_SSLSESSION_H_
17 | #define NETTY_TCNATIVE_SSLSESSION_H_
18 |
19 | // JNI initialization hooks. Users of this file are responsible for calling these in the JNI_OnLoad and JNI_OnUnload methods.
20 | jint netty_internal_tcnative_SSLSession_JNI_OnLoad(JNIEnv* env, const char* packagePrefix);
21 | void netty_internal_tcnative_SSLSession_JNI_OnUnLoad(JNIEnv* env, const char* packagePrefix);
22 | #endif /* NETTY_TCNATIVE_SSLSESSION_H_ */
23 |
--------------------------------------------------------------------------------
/openssl-dynamic/src/main/c/tcn.h:
--------------------------------------------------------------------------------
1 | /*
2 | * Copyright 2016 The Netty Project
3 | *
4 | * The Netty Project licenses this file to you under the Apache License,
5 | * version 2.0 (the "License"); you may not use this file except in compliance
6 | * with the License. You may obtain a copy of the License at:
7 | *
8 | * http://www.apache.org/licenses/LICENSE-2.0
9 | *
10 | * Unless required by applicable law or agreed to in writing, software
11 | * distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
12 | * WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the
13 | * License for the specific language governing permissions and limitations
14 | * under the License.
15 | */
16 | /* Licensed to the Apache Software Foundation (ASF) under one or more
17 | * contributor license agreements. See the NOTICE file distributed with
18 | * this work for additional information regarding copyright ownership.
19 | * The ASF licenses this file to You under the Apache License, Version 2.0
20 | * (the "License"); you may not use this file except in compliance with
21 | * the License. You may obtain a copy of the License at
22 | *
23 | * http://www.apache.org/licenses/LICENSE-2.0
24 | *
25 | * Unless required by applicable law or agreed to in writing, software
26 | * distributed under the License is distributed on an "AS IS" BASIS,
27 | * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
28 | * See the License for the specific language governing permissions and
29 | * limitations under the License.
30 | */
31 |
32 | #ifndef TCN_H
33 | #define TCN_H
34 |
35 | // Start includes
36 | #include
37 | #include "netty_jni_util.h"
38 |
39 | #include "apr.h"
40 | #include "apr_pools.h"
41 |
42 | #ifndef APR_HAS_THREADS
43 | #error "Missing APR_HAS_THREADS support from APR."
44 | #endif
45 |
46 | #include
47 | #include
48 | #if defined(_WIN32) && !defined(__CYGWIN__)
49 | #include
50 | #else
51 | #include
52 | #endif
53 |
54 | #if defined(_DEBUG) || defined(DEBUG)
55 | #include
56 | #define TCN_ASSERT(x) assert((x))
57 | #else
58 | #define TCN_ASSERT(x) (void)0
59 | #endif
60 | // End includes
61 |
62 | #ifdef _WIN32
63 | #define LLT(X) (X)
64 | #else
65 | #define LLT(X) ((long)(X))
66 | #endif
67 | #define P2J(P) ((jlong)LLT(P))
68 | #define J2P(P, T) ((T)LLT((jlong)P))
69 | /* On stack buffer size */
70 | #define TCN_BUFFER_SZ 8192
71 | #define TCN_STDARGS JNIEnv *e, jobject o
72 |
73 | #define STR(V) #V
74 |
75 | #define TCN_FUNCTION_NAME(CL, FN) \
76 | netty_internal_tcnative_##CL##_##FN
77 |
78 | #define TCN_IMPLEMENT_CALL(RT, CL, FN) \
79 | static RT TCN_FUNCTION_NAME(CL, FN)
80 |
81 | #define TCN_METHOD_TABLE_ENTRY(ME, SI, CL) \
82 | STR(ME), STR(SI), (void *) TCN_FUNCTION_NAME(CL, ME)
83 |
84 | /* Private helper functions */
85 | void tcn_Throw(JNIEnv *, const char *, ...);
86 | void tcn_ThrowException(JNIEnv *, const char *);
87 | void tcn_ThrowNullPointerException(JNIEnv *, const char *);
88 | void tcn_ThrowIllegalArgumentException(JNIEnv *, const char *);
89 | void tcn_ThrowAPRException(JNIEnv *, apr_status_t);
90 | void tcn_throwOutOfMemoryError(JNIEnv *, const char *);
91 |
92 | jstring tcn_new_string(JNIEnv *, const char *);
93 | jstring tcn_new_stringn(JNIEnv *, const char *, size_t);
94 |
95 | #define J2S(V) c##V
96 | #define J2L(V) p##V
97 |
98 | #define TCN_ALLOC_CSTRING(V) \
99 | const char *c##V = V ? (const char *)((*e)->GetStringUTFChars(e, V, JNI_FALSE)) : NULL
100 |
101 | #define TCN_FREE_CSTRING(V) \
102 | if (c##V) (*e)->ReleaseStringUTFChars(e, V, c##V)
103 |
104 | #define AJP_TO_JSTRING(V) (*e)->NewStringUTF((e), (V))
105 |
106 | #define TCN_CHECK_NULL(V, M, R) \
107 | NETTY_JNI_UTIL_BEGIN_MACRO \
108 | if (V == NULL) { \
109 | tcn_ThrowNullPointerException(e, #M); \
110 | return R; \
111 | } \
112 | NETTY_JNI_UTIL_END_MACRO
113 |
114 | #define TCN_CHECK_POSITIVE_OR_ZERO(V, M, R) \
115 | NETTY_JNI_UTIL_BEGIN_MACRO \
116 | if (V < 0) { \
117 | tcn_ThrowIllegalArgumentException(e, #M); \
118 | return R; \
119 | } \
120 | NETTY_JNI_UTIL_END_MACRO
121 |
122 | #define TCN_CHECK_POSITIVE(V, M, R) \
123 | NETTY_JNI_UTIL_BEGIN_MACRO \
124 | if (V <= 0) { \
125 | tcn_ThrowIllegalArgumentException(e, #M); \
126 | return R; \
127 | } \
128 | NETTY_JNI_UTIL_END_MACRO
129 |
130 | #define TCN_FREE_JSTRING(V) \
131 | NETTY_JNI_UTIL_BEGIN_MACRO \
132 | if (c##V) \
133 | free(c##V); \
134 | NETTY_JNI_UTIL_END_MACRO
135 |
136 | #define TCN_THROW_IF_ERR(x, r) \
137 | NETTY_JNI_UTIL_BEGIN_MACRO \
138 | apr_status_t R = (x); \
139 | if (R != APR_SUCCESS) { \
140 | tcn_ThrowAPRException(e, R); \
141 | (r) = 0; \
142 | goto cleanup; \
143 | } \
144 | NETTY_JNI_UTIL_END_MACRO
145 |
146 | #define TCN_MIN(a, b) ((a) < (b) ? (a) : (b))
147 |
148 | #define TCN_REASSIGN(V1, V2) \
149 | NETTY_JNI_UTIL_BEGIN_MACRO \
150 | free(V1); \
151 | V1 = V2; \
152 | V2 = NULL; \
153 | NETTY_JNI_UTIL_END_MACRO
154 |
155 |
156 | /* Return global String class
157 | */
158 | jclass tcn_get_string_class(void);
159 |
160 | jclass tcn_get_byte_array_class();
161 |
162 | /* Get current thread JNIEnv
163 | */
164 | jint tcn_get_java_env(JNIEnv **);
165 |
166 | #endif /* TCN_H */
167 |
--------------------------------------------------------------------------------
/openssl-dynamic/src/main/native-package/configure.ac:
--------------------------------------------------------------------------------
1 | # ---------------------------------------------------------------------------
2 | # Licensed to the Apache Software Foundation (ASF) under one or more
3 | # contributor license agreements. See the NOTICE file distributed with
4 | # this work for additional information regarding copyright ownership.
5 | # The ASF licenses this file to You under the Apache License, Version 2.0
6 | # (the "License"); you may not use this file except in compliance with
7 | # the License. You may obtain a copy of the License at
8 | #
9 | # http://www.apache.org/licenses/LICENSE-2.0
10 | #
11 | # Unless required by applicable law or agreed to in writing, software
12 | # distributed under the License is distributed on an "AS IS" BASIS,
13 | # WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
14 | # See the License for the specific language governing permissions and
15 | # limitations under the License.
16 | # ---------------------------------------------------------------------------
17 |
18 | ## --------------------------------
19 | ## Initialization macros.
20 | ## --------------------------------
21 | AC_PREREQ([2.61])
22 | AC_INIT([@PROJECT_NAME@], [@VERSION@])
23 | AC_CONFIG_AUX_DIR([autotools])
24 | AC_CONFIG_MACRO_DIR([m4])
25 | AC_CONFIG_SRCDIR([src/error.c])
26 | #AC_CONFIG_SRCDIR([@FIRST_SOURCE_FILE@])
27 | AC_CONFIG_HEADERS([src/config.h])
28 | AC_CANONICAL_HOST
29 | AC_CANONICAL_SYSTEM
30 |
31 | ${CFLAGS="-O3 -Werror -fno-omit-frame-pointer -fvisibility=hidden -Wunused -Wno-unused-value -Wno-deprecated-declarations"}
32 | ${CXXFLAGS="-O3 -Werror -fno-omit-frame-pointer -fvisibility=hidden -Wunused -Wno-unused-value"}
33 |
34 | ## -----------------------------------------------
35 | ## Application Checks
36 | ## -----------------------------------------------
37 | AC_PROG_CC
38 | AC_PROG_INSTALL
39 | # Make AM_PROG_AR work before automake 1.12
40 | m4_ifdef([AM_PROG_AR], [AM_PROG_AR])
41 | AC_PROG_LIBTOOL([disable-static])
42 |
43 | ## -----------------------------------------------
44 | ## API Checks
45 | ## -----------------------------------------------
46 | WITH_JNI_JDK
47 |
48 | CUSTOM_M4_SETUP
49 |
50 | WITH_OSX_UNIVERSAL
51 |
52 | CFLAGS="$CFLAGS $JNI_EXTRA_CFLAGS"
53 | AC_SUBST(CFLAGS)
54 | CXXFLAGS="$CXXFLAGS $JNI_EXTRA_CFLAGS"
55 | AC_SUBST(CXXFLAGS)
56 | LDFLAGS="$LDFLAGS $JNI_EXTRA_LDFLAGS -release @VERSION@"
57 | AC_SUBST(LDFLAGS)
58 |
59 | ## -----------------------------------------------------
60 | ## Generate the files
61 | ## -----------------------------------------------------
62 | AM_INIT_AUTOMAKE([subdir-objects no-dependencies -Wall foreign])
63 | AC_CONFIG_FILES([Makefile])
64 | AC_OUTPUT
65 |
66 | echo "
67 | ($PACKAGE_NAME) version $PACKAGE_VERSION
68 | Prefix.........: $prefix
69 | C Compiler.....: $CC $CFLAGS
70 | Linker.........: $LD $LDFLAGS $LIBS
71 | "
72 |
--------------------------------------------------------------------------------
/openssl-dynamic/src/main/native-package/m4/custom.m4:
--------------------------------------------------------------------------------
1 | dnl ---------------------------------------------------------------------------
2 | dnl Copyright 2014 The Netty Project
3 | dnl
4 | dnl Licensed under the Apache License, Version 2.0 (the "License");
5 | dnl you may not use this file except in compliance with the License.
6 | dnl You may obtain a copy of the License at
7 | dnl
8 | dnl http://www.apache.org/licenses/LICENSE-2.0
9 | dnl
10 | dnl Unless required by applicable law or agreed to in writing, software
11 | dnl distributed under the License is distributed on an "AS IS" BASIS,
12 | dnl WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
13 | dnl See the License for the specific language governing permissions and
14 | dnl limitations under the License.
15 | dnl ---------------------------------------------------------------------------
16 |
17 | AC_DEFUN([CUSTOM_M4_SETUP],
18 | [
19 | dnl These macros were copied from tomcat-native/jni/native/build/
20 | sinclude(m4/apr_common.m4)
21 | sinclude(m4/find_apr.m4)
22 |
23 | dnl This macro was copied from tomcat-native/jni/native/build with slight modifications
24 | dnl - Fix autoconf warnings
25 | dnl - Make TCN_FIND_APR try the system's APR installation
26 | sinclude(m4/tcnative.m4)
27 |
28 | dnl Make sure Apache Portable Runtime is available in the system.
29 | APR_PARSE_ARGUMENTS
30 | TCN_FIND_APR
31 |
32 | dnl Enable OpenSSL OCSP verification support.
33 | AC_ARG_ENABLE(ocsp,
34 | [AS_HELP_STRING([--enable-ocsp],[Turn on OpenSSL OCSP verification support])],
35 | [
36 | case "${enableval}" in
37 | yes)
38 | APR_ADDTO(CFLAGS, [-DHAVE_OPENSSL_OCSP])
39 | AC_MSG_RESULT([Enabling OCSP verification support...])
40 | ;;
41 | esac
42 | ])
43 |
44 | dnl Check if the libs we link against are static
45 | TCN_CHECK_STATIC
46 |
47 | dnl Make sure OpenSSL is available in the system and set extra flags if we compile against a static version.
48 | if $use_openssl ; then
49 | TCN_CHECK_SSL_TOOLKIT
50 | fi
51 |
52 | dnl Update the compiler/linker flags to add APR and OpenSSL to the build path.
53 | CFLAGS="$CFLAGS $TCN_OPENSSL_INC $APR_INCLUDES -D_LARGEFILE64_SOURCE"
54 | CXXFLAGS="$CXXFLAGS $TCN_OPENSSL_INC $APR_INCLUDES"
55 | LDFLAGS="$LDFLAGS $TCN_OPENSSL_LIBS $APR_LIBS"
56 | AC_SUBST(CFLAGS)
57 | AC_SUBST(CXXFLAGS)
58 | AC_SUBST(LDFLAGS)
59 | ])
60 |
61 |
--------------------------------------------------------------------------------
/openssl-dynamic/src/main/native-package/m4/find_apr.m4:
--------------------------------------------------------------------------------
1 | dnl -------------------------------------------------------- -*- autoconf -*-
2 | dnl Licensed to the Apache Software Foundation (ASF) under one or more
3 | dnl contributor license agreements. See the NOTICE file distributed with
4 | dnl this work for additional information regarding copyright ownership.
5 | dnl The ASF licenses this file to You under the Apache License, Version 2.0
6 | dnl (the "License"); you may not use this file except in compliance with
7 | dnl the License. You may obtain a copy of the License at
8 | dnl
9 | dnl http://www.apache.org/licenses/LICENSE-2.0
10 | dnl
11 | dnl Unless required by applicable law or agreed to in writing, software
12 | dnl distributed under the License is distributed on an "AS IS" BASIS,
13 | dnl WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
14 | dnl See the License for the specific language governing permissions and
15 | dnl limitations under the License.
16 |
17 | dnl
18 | dnl find_apr.m4 : locate the APR include files and libraries
19 | dnl
20 | dnl This macro file can be used by applications to find and use the APR
21 | dnl library. It provides a standardized mechanism for using APR. It supports
22 | dnl embedding APR into the application source, or locating an installed
23 | dnl copy of APR.
24 | dnl
25 | dnl APR_FIND_APR(srcdir, builddir, implicit-install-check, acceptable-majors,
26 | dnl detailed-check)
27 | dnl
28 | dnl where srcdir is the location of the bundled APR source directory, or
29 | dnl empty if source is not bundled.
30 | dnl
31 | dnl where builddir is the location where the bundled APR will will be built,
32 | dnl or empty if the build will occur in the srcdir.
33 | dnl
34 | dnl where implicit-install-check set to 1 indicates if there is no
35 | dnl --with-apr option specified, we will look for installed copies.
36 | dnl
37 | dnl where acceptable-majors is a space separated list of acceptable major
38 | dnl version numbers. Often only a single major version will be acceptable.
39 | dnl If multiple versions are specified, and --with-apr=PREFIX or the
40 | dnl implicit installed search are used, then the first (leftmost) version
41 | dnl in the list that is found will be used. Currently defaults to [0 1].
42 | dnl
43 | dnl where detailed-check is an M4 macro which sets the apr_acceptable to
44 | dnl either "yes" or "no". The macro will be invoked for each installed
45 | dnl copy of APR found, with the apr_config variable set appropriately.
46 | dnl Only installed copies of APR which are considered acceptable by
47 | dnl this macro will be considered found. If no installed copies are
48 | dnl considered acceptable by this macro, apr_found will be set to either
49 | dnl either "no" or "reconfig".
50 | dnl
51 | dnl Sets the following variables on exit:
52 | dnl
53 | dnl apr_found : "yes", "no", "reconfig"
54 | dnl
55 | dnl apr_config : If the apr-config tool exists, this refers to it. If
56 | dnl apr_found is "reconfig", then the bundled directory
57 | dnl should be reconfigured *before* using apr_config.
58 | dnl
59 | dnl Note: this macro file assumes that apr-config has been installed; it
60 | dnl is normally considered a required part of an APR installation.
61 | dnl
62 | dnl If a bundled source directory is available and needs to be (re)configured,
63 | dnl then apr_found is set to "reconfig". The caller should reconfigure the
64 | dnl (passed-in) source directory, placing the result in the build directory,
65 | dnl as appropriate.
66 | dnl
67 | dnl If apr_found is "yes" or "reconfig", then the caller should use the
68 | dnl value of apr_config to fetch any necessary build/link information.
69 | dnl
70 |
71 | AC_DEFUN([APR_FIND_APR], [
72 | apr_found="no"
73 |
74 | if test "$target_os" = "os2-emx"; then
75 | # Scripts don't pass test -x on OS/2
76 | TEST_X="test -f"
77 | else
78 | TEST_X="test -x"
79 | fi
80 |
81 | ifelse([$4], [], [
82 | ifdef(AC_WARNING,AC_WARNING([$0: missing argument 4 (acceptable-majors): Defaulting to APR 0.x then APR 1.x]))
83 | acceptable_majors="0 1"],
84 | [acceptable_majors="$4"])
85 |
86 | apr_temp_acceptable_apr_config=""
87 | for apr_temp_major in $acceptable_majors
88 | do
89 | case $apr_temp_major in
90 | 0)
91 | apr_temp_acceptable_apr_config="$apr_temp_acceptable_apr_config apr-config"
92 | ;;
93 | *)
94 | apr_temp_acceptable_apr_config="$apr_temp_acceptable_apr_config apr-$apr_temp_major-config"
95 | ;;
96 | esac
97 | done
98 |
99 | AC_MSG_CHECKING(for APR)
100 | AC_ARG_WITH(apr,
101 | [ --with-apr=PATH prefix for installed APR or the full path to
102 | apr-config],
103 | [
104 | if test "$withval" = "no" || test "$withval" = "yes"; then
105 | AC_MSG_ERROR([--with-apr requires a directory or file to be provided])
106 | fi
107 |
108 | for apr_temp_apr_config_file in $apr_temp_acceptable_apr_config
109 | do
110 | for lookdir in "$withval/bin" "$withval"
111 | do
112 | if $TEST_X "$lookdir/$apr_temp_apr_config_file"; then
113 | apr_config="$lookdir/$apr_temp_apr_config_file"
114 | ifelse([$5], [], [], [
115 | apr_acceptable="yes"
116 | $5
117 | if test "$apr_acceptable" != "yes"; then
118 | AC_MSG_WARN([Found APR in $apr_config, but we think it is considered unacceptable])
119 | continue
120 | fi])
121 | apr_found="yes"
122 | break 2
123 | fi
124 | done
125 | done
126 |
127 | if test "$apr_found" != "yes" && $TEST_X "$withval" && $withval --help > /dev/null 2>&1 ; then
128 | apr_config="$withval"
129 | ifelse([$5], [], [apr_found="yes"], [
130 | apr_acceptable="yes"
131 | $5
132 | if test "$apr_acceptable" = "yes"; then
133 | apr_found="yes"
134 | fi])
135 | fi
136 |
137 | dnl if --with-apr is used, it is a fatal error for its argument
138 | dnl to be invalid
139 | if test "$apr_found" != "yes"; then
140 | AC_MSG_ERROR([the --with-apr parameter is incorrect. It must specify an install prefix, a build directory, or an apr-config file.])
141 | fi
142 | ],[
143 | dnl If we allow installed copies, check those before using bundled copy.
144 | if test -n "$3" && test "$3" = "1"; then
145 | for apr_temp_apr_config_file in $apr_temp_acceptable_apr_config
146 | do
147 | if $apr_temp_apr_config_file --help > /dev/null 2>&1 ; then
148 | apr_config="$apr_temp_apr_config_file"
149 | ifelse([$5], [], [], [
150 | apr_acceptable="yes"
151 | $5
152 | if test "$apr_acceptable" != "yes"; then
153 | AC_MSG_WARN([skipped APR at $apr_config, version not acceptable])
154 | continue
155 | fi])
156 | apr_found="yes"
157 | break
158 | else
159 | dnl look in some standard places
160 | for lookdir in /usr /usr/local /usr/local/apr /opt/apr; do
161 | if $TEST_X "$lookdir/bin/$apr_temp_apr_config_file"; then
162 | apr_config="$lookdir/bin/$apr_temp_apr_config_file"
163 | ifelse([$5], [], [], [
164 | apr_acceptable="yes"
165 | $5
166 | if test "$apr_acceptable" != "yes"; then
167 | AC_MSG_WARN([skipped APR at $apr_config, version not acceptable])
168 | continue
169 | fi])
170 | apr_found="yes"
171 | break 2
172 | fi
173 | done
174 | fi
175 | done
176 | fi
177 | dnl if we have not found anything yet and have bundled source, use that
178 | if test "$apr_found" = "no" && test -d "$1"; then
179 | apr_temp_abs_srcdir="`cd \"$1\" && pwd`"
180 | apr_found="reconfig"
181 | apr_bundled_major="`sed -n '/#define.*APR_MAJOR_VERSION/s/^[^0-9]*\([0-9]*\).*$/\1/p' \"$1/include/apr_version.h\"`"
182 | case $apr_bundled_major in
183 | "")
184 | AC_MSG_ERROR([failed to find major version of bundled APR])
185 | ;;
186 | 0)
187 | apr_temp_apr_config_file="apr-config"
188 | ;;
189 | *)
190 | apr_temp_apr_config_file="apr-$apr_bundled_major-config"
191 | ;;
192 | esac
193 | if test -n "$2"; then
194 | apr_config="$2/$apr_temp_apr_config_file"
195 | else
196 | apr_config="$1/$apr_temp_apr_config_file"
197 | fi
198 | fi
199 | ])
200 |
201 | AC_MSG_RESULT($apr_found)
202 | ])
203 |
--------------------------------------------------------------------------------
/openssl-dynamic/src/test/java/io/netty/internal/tcnative/AbstractNativeTest.java:
--------------------------------------------------------------------------------
1 | /*
2 | * Copyright 2017 The Netty Project
3 | *
4 | * The Netty Project licenses this file to you under the Apache License,
5 | * version 2.0 (the "License"); you may not use this file except in compliance
6 | * with the License. You may obtain a copy of the License at:
7 | *
8 | * http://www.apache.org/licenses/LICENSE-2.0
9 | *
10 | * Unless required by applicable law or agreed to in writing, software
11 | * distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
12 | * WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the
13 | * License for the specific language governing permissions and limitations
14 | * under the License.
15 | */
16 | package io.netty.internal.tcnative;
17 |
18 |
19 | import org.junit.jupiter.api.BeforeAll;
20 |
21 | import java.io.File;
22 |
23 | /**
24 | * All unit-tests MUST extend this base class, otherwise the native library may not be correctly
25 | * loaded.
26 | */
27 | public abstract class AbstractNativeTest {
28 |
29 | @BeforeAll
30 | public static void loadNativeLib() throws Exception {
31 | String testClassesRoot = AbstractNativeTest.class.getProtectionDomain().getCodeSource().getLocation().getFile();
32 | File[] directories = new File(testClassesRoot + File.separator + "META-INF" + File.separator + "native")
33 | .listFiles();
34 | if (directories == null || directories.length != 1) {
35 | throw new IllegalStateException("Could not find platform specific native directory");
36 | }
37 | String libName = System.mapLibraryName("netty_tcnative")
38 | // Fix the filename (this is needed for macOS).
39 | .replace(".dylib", ".jnilib");
40 | String libPath = directories[0].getAbsoluteFile() + File.separator + libName;
41 | System.load(libPath);
42 | Library.initialize();
43 | }
44 | }
45 |
--------------------------------------------------------------------------------
/openssl-dynamic/src/test/java/io/netty/internal/tcnative/CertificateVerifierTest.java:
--------------------------------------------------------------------------------
1 | /*
2 | * Copyright 2017 The Netty Project
3 | *
4 | * The Netty Project licenses this file to you under the Apache License,
5 | * version 2.0 (the "License"); you may not use this file except in compliance
6 | * with the License. You may obtain a copy of the License at:
7 | *
8 | * http://www.apache.org/licenses/LICENSE-2.0
9 | *
10 | * Unless required by applicable law or agreed to in writing, software
11 | * distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
12 | * WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the
13 | * License for the specific language governing permissions and limitations
14 | * under the License.
15 | */
16 | package io.netty.internal.tcnative;
17 |
18 |
19 | import org.junit.jupiter.api.Test;
20 |
21 | import java.lang.reflect.Field;
22 |
23 | import static org.junit.jupiter.api.Assertions.assertFalse;
24 | import static org.junit.jupiter.api.Assertions.assertTrue;
25 |
26 | public class CertificateVerifierTest extends AbstractNativeTest {
27 |
28 | @Test
29 | public void testValidErrorCode() throws Exception {
30 | Field[] fields = CertificateVerifier.class.getFields();
31 | for (Field field : fields) {
32 | if (field.isAccessible()) {
33 | int errorCode = field.getInt(null);
34 | assertTrue(CertificateVerifier.isValid(errorCode), "errorCode '" + errorCode + "' must be valid");
35 | }
36 | }
37 | }
38 |
39 | @Test
40 | public void testNonValidErrorCode() {
41 | assertFalse(CertificateVerifier.isValid(Integer.MIN_VALUE));
42 | }
43 | }
44 |
--------------------------------------------------------------------------------
/patches/apr_crypt.patch:
--------------------------------------------------------------------------------
1 | --- configure.in.old 2023-01-09 14:22:19
2 | +++ configure.in 2023-01-09 14:22:43
3 | @@ -729,7 +729,6 @@
4 | AC_SEARCH_LIBS(gethostbyname, nsl)
5 | AC_SEARCH_LIBS(gethostname, nsl)
6 | AC_SEARCH_LIBS(socket, socket)
7 | - AC_SEARCH_LIBS(crypt, crypt ufc)
8 | AC_CHECK_LIB(truerand, main)
9 | AC_SEARCH_LIBS(modf, m)
10 | ;;
11 |
--------------------------------------------------------------------------------
/scripts/finish_release.sh:
--------------------------------------------------------------------------------
1 | #!/bin/bash
2 | set -e
3 |
4 | if [ "$#" -ne 2 ]; then
5 | echo "Expected staging profile id and tag, login into oss.sonatype.org to retrieve it"
6 | exit 1
7 | fi
8 |
9 | OS=$(uname)
10 | ARCH=$(uname -p)
11 |
12 | if [ "$OS" != "Darwin" ]; then
13 | echo "Needs to be executed on macOS"
14 | exit 1
15 | fi
16 |
17 | BRANCH=$(git branch --show-current)
18 |
19 | if git tag | grep -q "$2" ; then
20 | echo "Tag $2 already exists"
21 | exit 1
22 | fi
23 |
24 | CROSS_COMPILE_PROFILE="mac-m1-cross-compile"
25 | if [ "$ARCH" == "arm" ]; then
26 | CROSS_COMPILE_PROFILE="mac-intel-cross-compile"
27 | fi
28 |
29 |
30 | git fetch
31 | git checkout "$2"
32 |
33 | export JAVA_HOME="$JAVA8_HOME"
34 |
35 | ./mvnw -Psonatype-oss-release -am -pl openssl-dynamic,boringssl-static clean package gpg:sign org.sonatype.plugins:nexus-staging-maven-plugin:deploy -DstagingRepositoryId="$1" -DnexusUrl=https://oss.sonatype.org -DserverId=sonatype-nexus-staging -DskipTests=true
36 | ./mvnw -Psonatype-oss-release,"$CROSS_COMPILE_PROFILE" -am -pl boringssl-static clean package gpg:sign org.sonatype.plugins:nexus-staging-maven-plugin:deploy -DstagingRepositoryId="$1" -DnexusUrl=https://oss.sonatype.org -DserverId=sonatype-nexus-staging -DskipTests=true
37 | ./mvnw -Psonatype-oss-release,uber-staging -pl boringssl-static clean package gpg:sign org.sonatype.plugins:nexus-staging-maven-plugin:deploy -DstagingRepositoryId="$1" -DnexusUrl=https://oss.sonatype.org -DserverId=sonatype-nexus-staging -DskipTests=true
38 | ./mvnw org.sonatype.plugins:nexus-staging-maven-plugin:rc-close org.sonatype.plugins:nexus-staging-maven-plugin:rc-release -DstagingRepositoryId="$1" -DnexusUrl=https://oss.sonatype.org -DserverId=sonatype-nexus-staging -DskipTests=true -DstagingProgressTimeoutMinutes=10
39 |
40 | git checkout "$BRANCH"
41 |
--------------------------------------------------------------------------------
/scripts/list_staged_release.sh:
--------------------------------------------------------------------------------
1 | #!/bin/bash
2 | set -e
3 |
4 | RC_LIST=$(mvn org.sonatype.plugins:nexus-staging-maven-plugin:rc-list -DserverId=sonatype-nexus-staging -DnexusUrl=https://oss.sonatype.org | grep -A 2 "\[INFO\] ID State Description")
5 | STAGED=$(echo "$RC_LIST" | grep 'OPEN' | cut -f 2 -d ' ')
6 | echo "$STAGED"
7 |
--------------------------------------------------------------------------------