Package io.servicetalk.transport.netty.internal

Class NettyPipelineSslUtils

java.lang.Object
io.servicetalk.transport.netty.internal.NettyPipelineSslUtils
public final class NettyPipelineSslUtils extends Object
Utilities for ChannelPipeline and SSL/TLS.

  • Method Details

    • isSslEnabled

      @Deprecated public static boolean isSslEnabled(io.netty.channel.ChannelPipeline pipeline)
      Deprecated.
      not required anymore, will be removed in the future releases, see extractSslSessionAndReport(SslConfig, ChannelPipeline, ConnectionObserver) for an alternative approach
      Determine if the ChannelPipeline is configured for SSL/TLS.
      Parameters:
      pipeline - The pipeline to check.
      Returns:
      true if the pipeline is configured to use SSL/TLS.

    • extractSslSessionAndReport

      @Nullable @Deprecated public static SSLSession extractSslSessionAndReport(@Nullable SslConfig sslConfig, io.netty.channel.ChannelPipeline pipeline, ConnectionObserver connectionObserver)
      Deprecated.
      Use extractSslSession(SslConfig, ChannelPipeline) instead, reporting to ConnectionObserver.SecurityHandshakeObserver is handled automatically for all SslHandlers initialized by SslClientChannelInitializer or SslServerChannelInitializer
      Extracts the SSLSession from the ChannelPipeline if the handshake is already done and reports the result to ConnectionObserver.SecurityHandshakeObserver if available. If it's done but failed, it rethrows the result.
      Parameters:
      sslConfig - SslConfig if SSL/TLS is expected
      pipeline - ChannelPipeline which contains a handler containing the SSLSession
      connectionObserver - ConnectionObserver in case the handshake status should be reported
      Returns:
      The SSLSession or null if none can be found
      Throws:
      IllegalStateException - if SslHandler can not be found in the ChannelPipeline

    • extractSslSession

      @Nullable public static SSLSession extractSslSession(@Nullable SslConfig sslConfig, io.netty.channel.ChannelPipeline pipeline)
      Extracts the SSLSession from the ChannelPipeline if the handshake is already done. If it's done but failed, it rethrows the result.
      Parameters:
      sslConfig - SslConfig if SSL/TLS is expected
      pipeline - ChannelPipeline which contains a handler containing the SSLSession
      Returns:
      The SSLSession or null if none can be found
      Throws:
      IllegalStateException - if SslHandler can not be found in the ChannelPipeline

    • extractSslSessionAndReport

      @Nullable @Deprecated public static SSLSession extractSslSessionAndReport(io.netty.channel.ChannelPipeline pipeline, io.netty.handler.ssl.SslHandshakeCompletionEvent sslEvent, Consumer<Throwable> failureConsumer, boolean shouldReport)
      Deprecated.
      Use extractSslSession(ChannelPipeline, SslHandshakeCompletionEvent, Consumer) instead, reporting to ConnectionObserver.SecurityHandshakeObserver is handled automatically for all SslHandlers initialized by SslClientChannelInitializer or SslServerChannelInitializer.
      Extracts the SSLSession from the ChannelPipeline if the SslHandshakeCompletionEvent is successful and reports the result to ConnectionObserver.SecurityHandshakeObserver if available.
      Parameters:
      pipeline - the ChannelPipeline which contains handler containing the SSLSession.
      sslEvent - the event indicating a SSL/TLS handshake completed.
      failureConsumer - invoked if a failure is encountered.
      shouldReport - true if the handshake status should be reported to ConnectionObserver.SecurityHandshakeObserver.
      Returns:
      The SSLSession or null if none can be found.

    • extractSslSession

      @Nullable public static SSLSession extractSslSession(io.netty.channel.ChannelPipeline pipeline, io.netty.handler.ssl.SslHandshakeCompletionEvent sslEvent, Consumer<Throwable> failureConsumer)
      Extracts the SSLSession from the ChannelPipeline if the SslHandshakeCompletionEvent is successful or propagate the failure to failureConsumer.
      Parameters:
      pipeline - the ChannelPipeline which contains handler containing the SSLSession.
      sslEvent - the event indicating a SSL/TLS handshake completed.
      failureConsumer - invoked if a failure is encountered.
      Returns:
      The SSLSession or null if none can be found.

    • applicationSslHandler

      @Nullable public static io.netty.handler.ssl.SslHandler applicationSslHandler(io.netty.channel.ChannelPipeline pipeline)
      Returns the application-tier SslHandler, or null if none is present.

      With layered TLS (e.g. an outer proxy TLS stage plus an inner origin TLS stage on the same Channel) the origin handler is the one whose SSLSession represents the application-visible session. Callers that operate on the application-level session should use this helper instead of pipeline.get(SslHandler.class), which returns the head-most handler — the wrong one for layered TLS.

      Iterates rather than looking up by APPLICATION_SSL_HANDLER_NAME because not every SslHandler is installed under that name (e.g. handlers installed by third-party Netty code).

      Parameters:
      pipeline - the pipeline to inspect for a SslHandler.
      Returns:
      the application-tier (last-in-pipeline-order) SslHandler, or null if none is present.

    • proxySslHandler

      @Nullable public static io.netty.handler.ssl.SslHandler proxySslHandler(io.netty.channel.ChannelPipeline pipeline)
      Returns the proxy SslHandler installed by installProxyTlsStage(io.netty.channel.Channel, io.netty.handler.ssl.SslContext, io.servicetalk.transport.api.ClientSslConfig), or null if none is present (a plaintext proxy hop or a non-proxy connection).
      Parameters:
      pipeline - the pipeline to inspect for the proxy SslHandler.
      Returns:
      the proxy SslHandler, or null if none is present.

    • installProxyTlsStage

      public static void installProxyTlsStage(io.netty.channel.Channel channel, io.netty.handler.ssl.SslContext sslContext, ClientSslConfig sslConfig)
      Install the outer (proxy) TLS stage of a layered-TLS pipeline. Adds an eager proxy SslHandler named PROXY_SSL_HANDLER_NAME followed by an internal isolator that drops outer-stage SslHandshakeCompletionEvent and SslCloseCompletionEvent from reaching handlers downstream (which expect application-level TLS events). The proxy handshake is reported to the SecurityHandshakeObserver returned by ConnectionObserver.onProxySecurityHandshake(SslConfig), separate from the application-level ConnectionObserver.onSecurityHandshake(SslConfig).
      Parameters:
      channel - the channel whose pipeline to install on
      sslContext - the SslContext for the proxy TLS stage
      sslConfig - the ClientSslConfig for the proxy TLS stage