Package io.netty.handler.ssl.ocsp

Class OcspServerCertificateValidator

  • All Implemented Interfaces:
    io.netty.channel.ChannelHandler, io.netty.channel.ChannelInboundHandler, io.netty.channel.ChannelOutboundHandler
    public class OcspServerCertificateValidator
extends io.netty.handler.codec.ByteToMessageDecoder
implements io.netty.channel.ChannelOutboundHandler
    OcspServerCertificateValidator validates incoming server's certificate using OCSP. Once TLS handshake is completed, SslHandshakeCompletionEvent.SUCCESS is fired, validator will perform certificate validation using OCSP over HTTP/1.1 with the server's certificate issuer OCSP responder.

    • Nested Class Summary

      • Nested classes/interfaces inherited from class io.netty.handler.codec.ByteToMessageDecoder

        io.netty.handler.codec.ByteToMessageDecoder.Cumulator

      • Nested classes/interfaces inherited from interface io.netty.channel.ChannelHandler

        io.netty.channel.ChannelHandler.Sharable

    • Field Summary

      Fields 
      Modifier and Type Field Description
      static io.netty.util.AttributeKey<Boolean> OCSP_PIPELINE_ATTRIBUTE
      An attribute used to mark all channels created by the OcspServerCertificateValidator.

      • Fields inherited from class io.netty.handler.codec.ByteToMessageDecoder

        COMPOSITE_CUMULATOR, MERGE_CUMULATOR

    • Method Summary

      All Methods Static Methods Instance Methods Concrete Methods 
      Modifier and Type Method Description
      void bind​(io.netty.channel.ChannelHandlerContext ctx, SocketAddress localAddress, io.netty.channel.ChannelPromise promise)  
      void close​(io.netty.channel.ChannelHandlerContext ctx, io.netty.channel.ChannelPromise promise)  
      void connect​(io.netty.channel.ChannelHandlerContext ctx, SocketAddress remoteAddress, SocketAddress localAddress, io.netty.channel.ChannelPromise promise)  
      protected static io.netty.resolver.dns.DnsNameResolver createDefaultResolver​(IoTransport ioTransport)  
      protected void decode​(io.netty.channel.ChannelHandlerContext ctx, io.netty.buffer.ByteBuf in, List<Object> out)  
      void deregister​(io.netty.channel.ChannelHandlerContext ctx, io.netty.channel.ChannelPromise promise)  
      void disconnect​(io.netty.channel.ChannelHandlerContext ctx, io.netty.channel.ChannelPromise promise)  
      void exceptionCaught​(io.netty.channel.ChannelHandlerContext ctx, Throwable cause)  
      void flush​(io.netty.channel.ChannelHandlerContext ctx)  
      void read​(io.netty.channel.ChannelHandlerContext ctx)  
      void userEventTriggered​(io.netty.channel.ChannelHandlerContext ctx, Object evt)  
      void write​(io.netty.channel.ChannelHandlerContext ctx, Object msg, io.netty.channel.ChannelPromise promise)  

      • Methods inherited from class io.netty.handler.codec.ByteToMessageDecoder

        actualReadableBytes, callDecode, channelInactive, channelRead, channelReadComplete, decodeLast, discardSomeReadBytes, handlerRemoved, handlerRemoved0, internalBuffer, isSingleDecode, setCumulator, setDiscardAfterReads, setSingleDecode

      • Methods inherited from class io.netty.channel.ChannelInboundHandlerAdapter

        channelActive, channelRegistered, channelUnregistered, channelWritabilityChanged

      • Methods inherited from class io.netty.channel.ChannelHandlerAdapter

        ensureNotSharable, handlerAdded, isSharable

      • Methods inherited from interface io.netty.channel.ChannelHandler

        handlerAdded, handlerRemoved

    • Field Detail

      • OCSP_PIPELINE_ATTRIBUTE

        public static final io.netty.util.AttributeKey<Boolean> OCSP_PIPELINE_ATTRIBUTE
        An attribute used to mark all channels created by the OcspServerCertificateValidator.

    • Constructor Detail

      • OcspServerCertificateValidator

        public OcspServerCertificateValidator()
        Create a new OcspServerCertificateValidator instance without nonce validation on OCSP response, using default IoTransport.DEFAULT instance, default DnsNameResolver implementation and with closeAndThrowIfNotValid set to true

      • OcspServerCertificateValidator

        public OcspServerCertificateValidator​(boolean validateNonce)
        Create a new OcspServerCertificateValidator instance with default IoTransport.DEFAULT instance and default DnsNameResolver implementation and closeAndThrowIfNotValid set to true.
        Parameters:
        validateNonce - Set to true if we should force nonce validation on OCSP response else set to false

      • OcspServerCertificateValidator

        public OcspServerCertificateValidator​(boolean validateNonce,
                                      IoTransport ioTransport)
        Create a new OcspServerCertificateValidator instance
        Parameters:
        validateNonce - Set to true if we should force nonce validation on OCSP response else set to false
        ioTransport - IoTransport to use

      • OcspServerCertificateValidator

        public OcspServerCertificateValidator​(boolean validateNonce,
                                      IoTransport ioTransport,
                                      io.netty.resolver.dns.DnsNameResolver dnsNameResolver)
        Create a new IoTransport instance with closeAndThrowIfNotValid set to true
        Parameters:
        validateNonce - Set to true if we should force nonce validation on OCSP response else set to false
        ioTransport - IoTransport to use
        dnsNameResolver - DnsNameResolver implementation to use

      • OcspServerCertificateValidator

        public OcspServerCertificateValidator​(boolean closeAndThrowIfNotValid,
                                      boolean validateNonce,
                                      IoTransport ioTransport,
                                      io.netty.resolver.dns.DnsNameResolver dnsNameResolver)
        Create a new IoTransport instance
        Parameters:
        closeAndThrowIfNotValid - If set to true then we will close the channel and throw an exception when certificate is not OcspResponse.Status.VALID. If set to false then we will simply pass the OcspValidationEvent to the next handler in pipeline and let it decide what to do.
        validateNonce - Set to true if we should force nonce validation on OCSP response else set to false
        ioTransport - IoTransport to use
        dnsNameResolver - DnsNameResolver implementation to use

    • Method Detail

      • createDefaultResolver

        protected static io.netty.resolver.dns.DnsNameResolver createDefaultResolver​(IoTransport ioTransport)

      • decode

        protected void decode​(io.netty.channel.ChannelHandlerContext ctx,
                      io.netty.buffer.ByteBuf in,
                      List<Object> out)
        Specified by:
        decode in class io.netty.handler.codec.ByteToMessageDecoder

      • userEventTriggered

        public void userEventTriggered​(io.netty.channel.ChannelHandlerContext ctx,
                               Object evt)
                        throws Exception
        Specified by:
        userEventTriggered in interface io.netty.channel.ChannelInboundHandler
        Overrides:
        userEventTriggered in class io.netty.handler.codec.ByteToMessageDecoder
        Throws:
        Exception

      • exceptionCaught

        public void exceptionCaught​(io.netty.channel.ChannelHandlerContext ctx,
                            Throwable cause)
        Specified by:
        exceptionCaught in interface io.netty.channel.ChannelHandler
        Specified by:
        exceptionCaught in interface io.netty.channel.ChannelInboundHandler
        Overrides:
        exceptionCaught in class io.netty.channel.ChannelInboundHandlerAdapter

      • bind

        public void bind​(io.netty.channel.ChannelHandlerContext ctx,
                 SocketAddress localAddress,
                 io.netty.channel.ChannelPromise promise)
          throws Exception
        Specified by:
        bind in interface io.netty.channel.ChannelOutboundHandler
        Throws:
        Exception

      • connect

        public void connect​(io.netty.channel.ChannelHandlerContext ctx,
                    SocketAddress remoteAddress,
                    SocketAddress localAddress,
                    io.netty.channel.ChannelPromise promise)
             throws Exception
        Specified by:
        connect in interface io.netty.channel.ChannelOutboundHandler
        Throws:
        Exception

      • disconnect

        public void disconnect​(io.netty.channel.ChannelHandlerContext ctx,
                       io.netty.channel.ChannelPromise promise)
                throws Exception
        Specified by:
        disconnect in interface io.netty.channel.ChannelOutboundHandler
        Throws:
        Exception

      • close

        public void close​(io.netty.channel.ChannelHandlerContext ctx,
                  io.netty.channel.ChannelPromise promise)
           throws Exception
        Specified by:
        close in interface io.netty.channel.ChannelOutboundHandler
        Throws:
        Exception

      • deregister

        public void deregister​(io.netty.channel.ChannelHandlerContext ctx,
                       io.netty.channel.ChannelPromise promise)
                throws Exception
        Specified by:
        deregister in interface io.netty.channel.ChannelOutboundHandler
        Throws:
        Exception

      • read

        public void read​(io.netty.channel.ChannelHandlerContext ctx)
          throws Exception
        Specified by:
        read in interface io.netty.channel.ChannelOutboundHandler
        Throws:
        Exception

      • write

        public void write​(io.netty.channel.ChannelHandlerContext ctx,
                  Object msg,
                  io.netty.channel.ChannelPromise promise)
           throws Exception
        Specified by:
        write in interface io.netty.channel.ChannelOutboundHandler
        Throws:
        Exception

      • flush

        public void flush​(io.netty.channel.ChannelHandlerContext ctx)
           throws Exception
        Specified by:
        flush in interface io.netty.channel.ChannelOutboundHandler
        Throws:
        Exception