io.netty.handler.ssl.ocsp

Class OcspServerCertificateValidator

java.lang.Object

io.netty.channel.ChannelHandlerAdapter

io.netty.channel.ChannelInboundHandlerAdapter

io.netty.handler.codec.ByteToMessageDecoder

io.netty.handler.ssl.ocsp.OcspServerCertificateValidator

All Implemented Interfaces:

io.netty.channel.ChannelHandler, io.netty.channel.ChannelInboundHandler, io.netty.channel.ChannelOutboundHandler

public class OcspServerCertificateValidator
extends io.netty.handler.codec.ByteToMessageDecoder
implements io.netty.channel.ChannelOutboundHandler

OcspServerCertificateValidator validates incoming server's certificate using OCSP. Once TLS handshake is completed, SslHandshakeCompletionEvent.SUCCESS is fired, validator will perform certificate validation using OCSP over HTTP/1.1 with the server's certificate issuer OCSP responder.

Nested Class Summary

Nested classes/interfaces inherited from class io.netty.handler.codec.ByteToMessageDecoder

io.netty.handler.codec.ByteToMessageDecoder.Cumulator

Nested classes/interfaces inherited from interface io.netty.channel.ChannelHandler

io.netty.channel.ChannelHandler.Sharable

Field Summary

Fields

Modifier and Type	Field and Description
static io.netty.util.AttributeKey<Boolean>	OCSP_PIPELINE_ATTRIBUTE An attribute used to mark all channels created by the OcspServerCertificateValidator.

Fields inherited from class io.netty.handler.codec.ByteToMessageDecoder

COMPOSITE_CUMULATOR, MERGE_CUMULATOR

Constructor Summary

Constructors

Constructor and Description
OcspServerCertificateValidator() Create a new OcspServerCertificateValidator instance without nonce validation on OCSP response, using default IoTransport.DEFAULT instance, default DnsNameResolver implementation and with closeAndThrowIfNotValid set to true
OcspServerCertificateValidator(boolean validateNonce) Create a new OcspServerCertificateValidator instance with default IoTransport.DEFAULT instance and default DnsNameResolver implementation and closeAndThrowIfNotValid set to true.
OcspServerCertificateValidator(boolean closeAndThrowIfNotValid, boolean validateNonce, IoTransport ioTransport, io.netty.resolver.dns.DnsNameResolver dnsNameResolver) Create a new IoTransport instance
OcspServerCertificateValidator(boolean validateNonce, IoTransport ioTransport) Create a new OcspServerCertificateValidator instance
OcspServerCertificateValidator(boolean validateNonce, IoTransport ioTransport, io.netty.resolver.dns.DnsNameResolver dnsNameResolver) Create a new IoTransport instance with closeAndThrowIfNotValid set to true

Method Summary

Modifier and Type	Method and Description
void	bind(io.netty.channel.ChannelHandlerContext ctx, SocketAddress localAddress, io.netty.channel.ChannelPromise promise)
void	close(io.netty.channel.ChannelHandlerContext ctx, io.netty.channel.ChannelPromise promise)
void	connect(io.netty.channel.ChannelHandlerContext ctx, SocketAddress remoteAddress, SocketAddress localAddress, io.netty.channel.ChannelPromise promise)
protected static io.netty.resolver.dns.DnsNameResolver	createDefaultResolver(IoTransport ioTransport)
protected void	decode(io.netty.channel.ChannelHandlerContext ctx, io.netty.buffer.ByteBuf in, List<Object> out)
void	deregister(io.netty.channel.ChannelHandlerContext ctx, io.netty.channel.ChannelPromise promise)
void	disconnect(io.netty.channel.ChannelHandlerContext ctx, io.netty.channel.ChannelPromise promise)
void	exceptionCaught(io.netty.channel.ChannelHandlerContext ctx, Throwable cause)
void	flush(io.netty.channel.ChannelHandlerContext ctx)
void	read(io.netty.channel.ChannelHandlerContext ctx)
void	userEventTriggered(io.netty.channel.ChannelHandlerContext ctx, Object evt)
void	write(io.netty.channel.ChannelHandlerContext ctx, Object msg, io.netty.channel.ChannelPromise promise)

Methods inherited from class io.netty.handler.codec.ByteToMessageDecoder

actualReadableBytes, callDecode, channelInactive, channelRead, channelReadComplete, decodeLast, discardSomeReadBytes, handlerRemoved, handlerRemoved0, internalBuffer, isSingleDecode, setCumulator, setDiscardAfterReads, setSingleDecode

Methods inherited from class io.netty.channel.ChannelInboundHandlerAdapter

channelActive, channelRegistered, channelUnregistered, channelWritabilityChanged

Methods inherited from class io.netty.channel.ChannelHandlerAdapter

ensureNotSharable, handlerAdded, isSharable

Methods inherited from class java.lang.Object

clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait

Methods inherited from interface io.netty.channel.ChannelHandler

handlerAdded, handlerRemoved

Field Detail

OCSP_PIPELINE_ATTRIBUTE

public static final io.netty.util.AttributeKey<Boolean> OCSP_PIPELINE_ATTRIBUTE

An attribute used to mark all channels created by the OcspServerCertificateValidator.

Constructor Detail

OcspServerCertificateValidator

public OcspServerCertificateValidator()

Create a new OcspServerCertificateValidator instance without nonce validation on OCSP response, using default IoTransport.DEFAULT instance, default DnsNameResolver implementation and with closeAndThrowIfNotValid set to true

OcspServerCertificateValidator

public OcspServerCertificateValidator(boolean validateNonce)

Create a new OcspServerCertificateValidator instance with default IoTransport.DEFAULT instance and default DnsNameResolver implementation and closeAndThrowIfNotValid set to true.

Parameters:

validateNonce - Set to true if we should force nonce validation on OCSP response else set to false

OcspServerCertificateValidator

public OcspServerCertificateValidator(boolean validateNonce,
                                      IoTransport ioTransport)

Create a new OcspServerCertificateValidator instance

Parameters:

validateNonce - Set to true if we should force nonce validation on OCSP response else set to false

ioTransport - IoTransport to use

OcspServerCertificateValidator

public OcspServerCertificateValidator(boolean validateNonce,
                                      IoTransport ioTransport,
                                      io.netty.resolver.dns.DnsNameResolver dnsNameResolver)

Create a new IoTransport instance with closeAndThrowIfNotValid set to true

Parameters:

validateNonce - Set to true if we should force nonce validation on OCSP response else set to false

ioTransport - IoTransport to use

dnsNameResolver - DnsNameResolver implementation to use

OcspServerCertificateValidator

public OcspServerCertificateValidator(boolean closeAndThrowIfNotValid,
                                      boolean validateNonce,
                                      IoTransport ioTransport,
                                      io.netty.resolver.dns.DnsNameResolver dnsNameResolver)

Create a new IoTransport instance

Parameters:

closeAndThrowIfNotValid - If set to true then we will close the channel and throw an exception when certificate is not OcspResponse.Status.VALID. If set to false then we will simply pass the OcspValidationEvent to the next handler in pipeline and let it decide what to do.

validateNonce - Set to true if we should force nonce validation on OCSP response else set to false

ioTransport - IoTransport to use

dnsNameResolver - DnsNameResolver implementation to use

Method Detail

createDefaultResolver

protected static io.netty.resolver.dns.DnsNameResolver createDefaultResolver(IoTransport ioTransport)

decode

protected void decode(io.netty.channel.ChannelHandlerContext ctx,
                      io.netty.buffer.ByteBuf in,
                      List<Object> out)

Specified by:

decode in class io.netty.handler.codec.ByteToMessageDecoder

userEventTriggered

public void userEventTriggered(io.netty.channel.ChannelHandlerContext ctx,
                               Object evt)
                        throws Exception

Specified by:

userEventTriggered in interface io.netty.channel.ChannelInboundHandler

Overrides:

userEventTriggered in class io.netty.handler.codec.ByteToMessageDecoder

Throws:

Exception

exceptionCaught

public void exceptionCaught(io.netty.channel.ChannelHandlerContext ctx,
                            Throwable cause)

Specified by:

exceptionCaught in interface io.netty.channel.ChannelHandler

Specified by:

exceptionCaught in interface io.netty.channel.ChannelInboundHandler

Overrides:

exceptionCaught in class io.netty.channel.ChannelInboundHandlerAdapter

bind

public void bind(io.netty.channel.ChannelHandlerContext ctx,
                 SocketAddress localAddress,
                 io.netty.channel.ChannelPromise promise)
          throws Exception

Specified by:

bind in interface io.netty.channel.ChannelOutboundHandler

Throws:

Exception

connect

public void connect(io.netty.channel.ChannelHandlerContext ctx,
                    SocketAddress remoteAddress,
                    SocketAddress localAddress,
                    io.netty.channel.ChannelPromise promise)
             throws Exception

Specified by:

connect in interface io.netty.channel.ChannelOutboundHandler

Throws:

Exception

disconnect

public void disconnect(io.netty.channel.ChannelHandlerContext ctx,
                       io.netty.channel.ChannelPromise promise)
                throws Exception

Specified by:

disconnect in interface io.netty.channel.ChannelOutboundHandler

Throws:

Exception

close

public void close(io.netty.channel.ChannelHandlerContext ctx,
                  io.netty.channel.ChannelPromise promise)
           throws Exception

Specified by:

close in interface io.netty.channel.ChannelOutboundHandler

Throws:

Exception

deregister

public void deregister(io.netty.channel.ChannelHandlerContext ctx,
                       io.netty.channel.ChannelPromise promise)
                throws Exception

Specified by:

deregister in interface io.netty.channel.ChannelOutboundHandler

Throws:

Exception

read

public void read(io.netty.channel.ChannelHandlerContext ctx)
          throws Exception

Specified by:

read in interface io.netty.channel.ChannelOutboundHandler

Throws:

Exception

write

public void write(io.netty.channel.ChannelHandlerContext ctx,
                  Object msg,
                  io.netty.channel.ChannelPromise promise)
           throws Exception

Specified by:

write in interface io.netty.channel.ChannelOutboundHandler

Throws:

Exception

flush

public void flush(io.netty.channel.ChannelHandlerContext ctx)
           throws Exception

Specified by:

flush in interface io.netty.channel.ChannelOutboundHandler

Throws:

Exception