Examples of SSLHandler

by.stub.handlers.SslHandler
com.facebook.presto.jdbc.internal.netty.handler.ssl.SslHandler
kipedia.org/wiki/Transport_Layer_Security">SSL · TLS and StartTLS support to a {@link Channel}. Please refer to the "SecureChat" example in the distribution or the web site for the detailed usage.
Beginning the handshake

You must make sure not to write a message while the {@linkplain #handshake() handshake} is in progress unless you arerenegotiating. You will be notified by the {@link ChannelFuture} which isreturned by the {@link #handshake()} method when the handshakeprocess succeeds or fails.
Handshake

If {@link #isIssueHandshake()} is {@code false}(default) you will need to take care of calling {@link #handshake()} by your own. In mostsituations were {@link SslHandler} is used in 'client mode' you want to issue a handshake oncethe connection was established. if {@link #setIssueHandshake(boolean)} is set to {@code true}you don't need to worry about this as the {@link SslHandler} will take care of it.

Renegotiation

If {@link #isEnableRenegotiation() enableRenegotiation} is {@code true}(default) and the initial handshake has been done successfully, you can call {@link #handshake()} to trigger the renegotiation.
If {@link #isEnableRenegotiation() enableRenegotiation} is {@code false}, an attempt to trigger renegotiation will result in the connection closure.
Please note that TLS renegotiation had a security issue before. If your runtime environment did not fix it, please make sure to disable TLS renegotiation by calling {@link #setEnableRenegotiation(boolean)} with{@code false}. For more information, please refer to the following documents:
Closing the session

To close the SSL session, the {@link #close()} method should becalled to send the {@code close_notify} message to the remote peer. Oneexception is when you close the {@link Channel} - {@link SslHandler}intercepts the close request and send the {@code close_notify} messagebefore the channel closure automatically. Once the SSL session is closed, it is not reusable, and consequently you should create a new {@link SslHandler} with a new {@link SSLEngine} as explained in thefollowing section.
Restarting the session

To restart the SSL session, you must remove the existing closed {@link SslHandler} from the {@link ChannelPipeline}, insert a new {@link SslHandler} with a new {@link SSLEngine} into the pipeline,and start the handshake process as described in the first section.
Implementing StartTLS

StartTLS is the communication pattern that secures the wire in the middle of the plaintext connection. Please note that it is different from SSL · TLS, that secures the wire from the beginning of the connection. Typically, StartTLS is composed of three steps:
1. Client sends a StartTLS request to server.
2. Server sends a StartTLS response to client.
3. Client begins SSL handshake.
If you implement a server, you need to:
1. create a new {@link SslHandler} instance with {@code startTls} flag setto {@code true},
2. insert the {@link SslHandler} to the {@link ChannelPipeline}, and
3. write a StartTLS response.
Please note that you must insert {@link SslHandler} before sendingthe StartTLS response. Otherwise the client can send begin SSL handshake before {@link SslHandler} is inserted to the {@link ChannelPipeline}, causing data corruption.
The client-side implementation is much simpler.
1. Write a StartTLS request,
2. wait for the StartTLS response,
3. create a new {@link SslHandler} instance with {@code startTls} flag setto {@code false},
4. insert the {@link SslHandler} to the {@link ChannelPipeline}, and
5. Initiate SSL handshake by calling {@link SslHandler#handshake()}.
Known issues

Because of a known issue with the current implementation of the SslEngine that comes with Java it may be possible that you see blocked IO-Threads while a full GC is done.
So if you are affected you can workaround this problem by adjust the cache settings like shown below:
```
 SslContext context = ...; context.getServerSessionContext().setSessionCacheSize(someSaneSize); context.getServerSessionContext().setSessionTime(someSameTimeout); 
```
What values to use here depends on the nature of your application and should be set based on monitoring and debugging of it. For more details see #832 in our issue tracker. @apiviz.landmark @apiviz.uses com.facebook.presto.jdbc.internal.netty.handler.ssl.SslBufferPool
io.fletty.handler.ssl.SslHandler
io.netty.handler.ssl.SslHandler
kipedia.org/wiki/Transport_Layer_Security">SSL · TLS and StartTLS support to a {@link Channel}. Please refer to the "SecureChat" example in the distribution or the web site for the detailed usage.
Beginning the handshake

You must make sure not to write a message while the {@linkplain #handshake() handshake} is in progress unless you arerenegotiating. You will be notified by the {@link ChannelFuture} which isreturned by the {@link #handshake()} method when the handshakeprocess succeeds or fails.
Handshake

If {@link #isIssueHandshake()} is {@code false}(default) you will need to take care of calling {@link #handshake()} by your own. In most situations were {@link SslHandler} is used in 'client mode'you want to issue a handshake once the connection was established. if {@link #setIssueHandshake(boolean)} is set to true you don't need to worry about this as the {@link SslHandler} will take care of it.

Renegotiation

If {@link #isEnableRenegotiation() enableRenegotiation} is {@code true}(default) and the initial handshake has been done successfully, you can call {@link #handshake()} to trigger the renegotiation.
If {@link #isEnableRenegotiation() enableRenegotiation} is {@code false}, an attempt to trigger renegotiation will result in the connection closure.
Please note that TLS renegotiation had a security issue before. If your runtime environment did not fix it, please make sure to disable TLS renegotiation by calling {@link #setEnableRenegotiation(boolean)} with{@code false}. For more information, please refer to the following documents:
Closing the session

To close the SSL session, the {@link #close()} method should becalled to send the {@code close_notify} message to the remote peer. Oneexception is when you close the {@link Channel} - {@link SslHandler}intercepts the close request and send the {@code close_notify} messagebefore the channel closure automatically. Once the SSL session is closed, it is not reusable, and consequently you should create a new {@link SslHandler} with a new {@link SSLEngine} as explained in thefollowing section.
Restarting the session

To restart the SSL session, you must remove the existing closed {@link SslHandler} from the {@link ChannelPipeline}, insert a new {@link SslHandler} with a new {@link SSLEngine} into the pipeline,and start the handshake process as described in the first section.
Implementing StartTLS

StartTLS is the communication pattern that secures the wire in the middle of the plaintext connection. Please note that it is different from SSL · TLS, that secures the wire from the beginning of the connection. Typically, StartTLS is composed of three steps:
1. Client sends a StartTLS request to server.
2. Server sends a StartTLS response to client.
3. Client begins SSL handshake.
If you implement a server, you need to:
1. create a new {@link SslHandler} instance with {@code startTls} flag setto {@code true},
2. insert the {@link SslHandler} to the {@link ChannelPipeline}, and
3. write a StartTLS response.
Please note that you must insert {@link SslHandler} before sendingthe StartTLS response. Otherwise the client can send begin SSL handshake before {@link SslHandler} is inserted to the {@link ChannelPipeline}, causing data corruption.
The client-side implementation is much simpler.
1. Write a StartTLS request,
2. wait for the StartTLS response,
3. create a new {@link SslHandler} instance with {@code startTls} flag setto {@code false},
4. insert the {@link SslHandler} to the {@link ChannelPipeline}, and
5. Initiate SSL handshake by calling {@link SslHandler#handshake()}.
@apiviz.landmark @apiviz.uses io.netty.handler.ssl.SslBufferPool
org.apache.mina.filter.support.SSLHandler
A helper class using the SSLEngine API to decrypt/encrypt data.
Each connection has a SSLEngine that is used through the lifetime of the connection. We allocate byte buffers for use as the outbound and inbound network buffers. These buffers handle all of the intermediary data for the SSL connection. To make things easy, we'll require outNetBuffer be completely flushed before trying to wrap any more data. @author The Apache Directory Project (mina-dev@directory.apache.org) @version $Rev: 561232 $, $Date: 2007-07-31 14:19:37 +0900 (Tue, 31 Jul 2007) $
org.jboss.netty.handler.ssl.SslHandler
kipedia.org/wiki/Transport_Layer_Security">SSL · TLS and StartTLS support to a {@link Channel}. Please refer to the "SecureChat" example in the distribution or the web site for the detailed usage.
Beginning the handshake

A user should make sure not to write a message while the {@linkplain #handshake(Channel) handshake} is in progress unless it is arenegotiation. You will be notified by the {@link ChannelFuture} which isreturned by the {@link #handshake(Channel)} method when the handshakeprocess succeeds or fails.
Renegotiation

Once the initial handshake is done successfully. You can always call {@link #handshake(Channel)} again to renegotiate the SSL session parameters.
Closing the session

To close the SSL session, the {@link #close(Channel)} method should becalled to send the {@code close_notify} message to the remote peer. Oneexception is when you close the {@link Channel} - {@link SslHandler}intercepts the close request and send the {@code close_notify} messagebefore the channel closure automatically. Once the SSL session is closed, it is not reusable, and consequently you should create a new {@link SslHandler} with a new {@link SSLEngine} as explained in thefollowing section.
Restarting the session

To restart the SSL session, you must remove the existing closed {@link SslHandler} from the {@link ChannelPipeline}, insert a new {@link SslHandler} with a new {@link SSLEngine} into the pipeline,and start the handshake process as described in the first section. @author The Netty Project (netty-dev@lists.jboss.org) @author Trustin Lee (tlee@redhat.com) @version $Rev: 981 $, $Date: 2009-03-04 23:11:54 +0900 (Wed, 04 Mar 2009) $ @apiviz.landmark @apiviz.uses org.jboss.netty.handler.ssl.SslBufferPool

Examples of io.netty.handler.ssl.SslHandler

            engine.setNeedClientAuth(consumer.getConfiguration().isNeedClientAuth());
            if (consumer.getConfiguration().getSslContextParameters() == null) {
                // just set the enabledProtocols if the SslContextParameter doesn't set
                engine.setEnabledProtocols(consumer.getConfiguration().getEnabledProtocols().split(","));
            }
            return new SslHandler(engine);
        }


        return null;
    }

View Full Code Here

Examples of io.netty.handler.ssl.SslHandler

               else
               {
                  engine.setEnabledProtocols(originalProtocols);
               }


               SslHandler handler = new SslHandler(engine);


               pipeline.addLast(handler);
            }


            if (httpEnabled)

View Full Code Here

Examples of io.netty.handler.ssl.SslHandler

      future.awaitUninterruptibly();


      if (future.isSuccess())
      {
         final Channel ch = future.channel();
         SslHandler sslHandler = ch.pipeline().get(SslHandler.class);
         if (sslHandler != null)
         {
            Future<Channel> handshakeFuture = sslHandler.handshakeFuture();
            if (handshakeFuture.awaitUninterruptibly(30000))
            {
               if (handshakeFuture.isSuccess())
               {
                  ChannelPipeline channelPipeline = ch.pipeline();

View Full Code Here

Examples of io.netty.handler.ssl.SslHandler


    private void enableSsl(ChannelHandlerContext ctx) {
        ChannelPipeline pipeline = ctx.pipeline();
        SSLEngine engine = SSLFactory.getInstance().sslContext().createSSLEngine();
        engine.setUseClientMode(false);
        pipeline.addLast("ssl", new SslHandler(engine));


        // re-unify
        pipeline.addLast("sslUnification", new ProxyUnificationHandler(false, socksEnabled, port));
        pipeline.remove(this);
    }

View Full Code Here

Examples of io.netty.handler.ssl.SslHandler

                ChannelPipeline pipeline = ch.pipeline();


                // add HTTPS support
                SSLEngine engine = SSLFactory.getInstance().sslContext().createSSLEngine();
                engine.setUseClientMode(false);
                pipeline.addLast(SslHandler.class.getSimpleName(), new SslHandler(engine));


                // add HTTP decoder and encoder
                pipeline.addLast(HttpServerCodec.class.getSimpleName(), new HttpServerCodec());
                pipeline.addLast(HttpObjectAggregator.class.getSimpleName(), new HttpObjectAggregator(Integer.MAX_VALUE));

View Full Code Here

Examples of io.netty.handler.ssl.SslHandler

                ChannelPipeline pipeline = ch.pipeline();


                // add HTTPS client -> proxy support
                SSLEngine engine = SSLFactory.getInstance().sslContext().createSSLEngine();
                engine.setUseClientMode(false);
                pipeline.addLast("ssl inbound", new SslHandler(engine));


                // add handler
                InetSocketAddress remoteSocketAddress = new InetSocketAddress(directRemoteHost, directRemotePort);
                pipeline.addLast(new DirectProxyUpstreamHandler(remoteSocketAddress, true, 1048576, new RequestInterceptor(remoteSocketAddress), "                -->"));

View Full Code Here

Examples of io.netty.handler.ssl.SslHandler


                        // add HTTPS proxy -> server support
                        if (secure) {
                            SSLEngine engine = SSLFactory.getInstance().sslContext().createSSLEngine();
                            engine.setUseClientMode(true);
                            pipeline.addLast("proxy -> server ssl", new SslHandler(engine));
                        }


                        // add handler
                        pipeline.addLast(new ProxyRelayHandler(inboundChannel, bufferedCapacity, new ResponseInterceptor(), logger));
                    }

View Full Code Here

Examples of io.netty.handler.ssl.SslHandler


                                // add HTTPS support
                                if (secure) {
                                    SSLEngine engine = SSLFactory.getInstance().sslContext().createSSLEngine();
                                    engine.setUseClientMode(false);
                                    pipeline.addLast("ssl", new SslHandler(engine));
                                }


                                // pipeline.addLast("logger", new LoggingHandler("BOOK_HANDLER"));
                                pipeline.addLast("http_codec", new HttpServerCodec());
                                pipeline.addLast("simple_test_handler", new BookHandler());

View Full Code Here

Examples of io.netty.handler.ssl.SslHandler

                                    ChannelPipeline pipeline = ch.pipeline();


                                    pipeline.addLast("raw logger", new LoggingHandler("RAW TEST_SERVER_SSL"));
                                    SSLEngine engine = SSLFactory.getInstance().sslContext().createSSLEngine();
                                    engine.setUseClientMode(false);
                                    pipeline.addLast("ssl", new SslHandler(engine));
                                    pipeline.addLast("logger", new LoggingHandler("TEST_SERVER_SSL"));
                                    pipeline.addLast("codec", new HttpServerCodec());
                                    pipeline.addLast("chunk-aggregator", new HttpObjectAggregator(10 * 1024 * 1024));
                                    pipeline.addLast("handler", new TestServerHandler());
                                }

View Full Code Here

Examples of io.netty.handler.ssl.SslHandler


        // add HTTPS support
        if (secure) {
            SSLEngine engine = SSLFactory.getInstance().sslContext().createSSLEngine();
            engine.setUseClientMode(false);
            pipeline.addLast("ssl", new SslHandler(engine));
        }


        // add logging
        if (logger.isDebugEnabled()) {
            pipeline.addLast("logger", new LoggingHandler());

View Full Code Here

0 1 2 3 4 5

TOP

All source code are property of their respective owners. Java is a trademark of Sun Microsystems, Inc and owned by ORACLE Inc. Contact coftware#gmail.com.

Examples of SSLHandler

Beginning the handshake

Handshake

Renegotiation

Closing the session

Restarting the session

Implementing StartTLS

Known issues

Beginning the handshake

Handshake

Renegotiation

Closing the session

Restarting the session

Implementing StartTLS

Beginning the handshake

Renegotiation

Closing the session

Restarting the session

Examples of io.netty.handler.ssl.SslHandler

Examples of io.netty.handler.ssl.SslHandler

Examples of io.netty.handler.ssl.SslHandler

Examples of io.netty.handler.ssl.SslHandler

Examples of io.netty.handler.ssl.SslHandler

Examples of io.netty.handler.ssl.SslHandler

Examples of io.netty.handler.ssl.SslHandler

Examples of io.netty.handler.ssl.SslHandler

Examples of io.netty.handler.ssl.SslHandler

Examples of io.netty.handler.ssl.SslHandler