| /* |
| * Copyright (c) 2015, 2025, Oracle and/or its affiliates. All rights reserved. |
| * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER. |
| * |
| * This code is free software; you can redistribute it and/or modify it |
| * under the terms of the GNU General Public License version 2 only, as |
| * published by the Free Software Foundation. Oracle designates this |
| * particular file as subject to the "Classpath" exception as provided |
| * by Oracle in the LICENSE file that accompanied this code. |
| * |
| * This code is distributed in the hope that it will be useful, but WITHOUT |
| * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or |
| * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License |
| * version 2 for more details (a copy is included in the LICENSE file that |
| * accompanied this code). |
| * |
| * You should have received a copy of the GNU General Public License version |
| * 2 along with this work; if not, write to the Free Software Foundation, |
| * Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA. |
| * |
| * Please contact Oracle, 500 Oracle Parkway, Redwood Shores, CA 94065 USA |
| * or visit www.oracle.com if you need additional information or have any |
| * questions. |
| */ |
| |
| package jdk.internal.net.http; |
| |
| import java.net.InetSocketAddress; |
| import java.net.http.HttpClient; |
| import java.util.Arrays; |
| import java.util.ArrayDeque; |
| import java.util.List; |
| import java.util.concurrent.CompletableFuture; |
| import javax.net.ssl.SNIHostName; |
| import javax.net.ssl.SNIServerName; |
| import javax.net.ssl.SSLContext; |
| import javax.net.ssl.SSLEngine; |
| import javax.net.ssl.SSLParameters; |
| |
| import jdk.internal.net.http.common.Alpns; |
| import jdk.internal.net.http.common.SSLTube; |
| import jdk.internal.net.http.common.Log; |
| import jdk.internal.net.http.common.Utils; |
| import static jdk.internal.net.http.common.Utils.ServerName; |
| |
| /** |
| * Asynchronous version of SSLConnection. |
| * |
| * There are two concrete implementations of this class: AsyncSSLConnection |
| * and AsyncSSLTunnelConnection. |
| * This abstraction is useful when downgrading from HTTP/2 to HTTP/1.1 over |
| * an SSL connection. See ExchangeImpl::get in the case where an ALPNException |
| * is thrown. |
| * |
| * Note: An AsyncSSLConnection wraps a PlainHttpConnection, while an |
| * AsyncSSLTunnelConnection wraps a PlainTunnelingConnection. |
| * If both these wrapped classes where made to inherit from a |
| * common abstraction then it might be possible to merge |
| * AsyncSSLConnection and AsyncSSLTunnelConnection back into |
| * a single class - and simply use different factory methods to |
| * create different wrappees, but this is left up for further cleanup. |
| * |
| */ |
| abstract class AbstractAsyncSSLConnection extends HttpConnection |
| { |
| protected final SSLEngine engine; |
| protected final SSLParameters sslParameters; |
| private final List<SNIServerName> sniServerNames; |
| |
| // Setting this property disables HTTPS hostname verification. Use with care. |
| private static final boolean disableHostnameVerification |
| = Utils.isHostnameVerificationDisabled(); |
| |
| AbstractAsyncSSLConnection(InetSocketAddress addr, |
| HttpClientImpl client, |
| ServerName serverName, int port, |
| String[] alpn, |
| String label) { |
| super(addr, client, label); |
| this.sniServerNames = formSNIServerNames(serverName, client); |
| SSLContext context = client.theSSLContext(); |
| sslParameters = createSSLParameters(client, this.sniServerNames, alpn); |
| Log.logParams(sslParameters); |
| engine = createEngine(context, serverName.name(), port, sslParameters); |
| } |
| |
| abstract SSLTube getConnectionFlow(); |
| |
| final CompletableFuture<String> getALPN() { |
| return getConnectionFlow().getALPN(); |
| } |
| |
| final SSLEngine getEngine() { return engine; } |
| |
| @Override |
| public final List<SNIServerName> getSNIServerNames() { |
| return this.sniServerNames; |
| } |
| |
| private static boolean contains(String[] rr, String target) { |
| for (String s : rr) |
| if (target.equalsIgnoreCase(s)) |
| return true; |
| return false; |
| } |
| |
| /** |
| * Returns the {@link SSLParameters} to be used by the {@link SSLEngine} for this connection. |
| * <p> |
| * The returned {@code SSLParameters} will have its {@link SNIServerName}s set to the given |
| * {@code sniServerNames}. If {@code alpn} is non-null then the returned {@code SSLParameters} |
| * will have its {@linkplain SSLParameters#getApplicationProtocols() application layer protocols} |
| * set to this value. All other parameters in the returned {@code SSLParameters} will be |
| * copied over from {@link HttpClient#sslParameters()} of the given {@code client}. |
| * |
| * @param client the HttpClient |
| * @param sniServerNames the SNIServerName(s) |
| * @param alpn the application layer protocols |
| * @return the SSLParameters to be set on the SSLEngine used by this connection. |
| */ |
| private static SSLParameters createSSLParameters(HttpClientImpl client, |
| List<SNIServerName> sniServerNames, |
| String[] alpn) { |
| SSLParameters sslp = client.sslParameters(); |
| SSLParameters sslParameters = Utils.copySSLParameters(sslp); |
| // filter out unwanted protocols, if h2 only |
| if (alpn != null && alpn.length != 0 && !contains(alpn, Alpns.HTTP_1_1)) { |
| ArrayDeque<String> l = new ArrayDeque<>(); |
| for (String proto : sslParameters.getProtocols()) { |
| if (!proto.startsWith("SSL") && !proto.endsWith("v1.1") && !proto.endsWith("v1")) { |
| l.add(proto); |
| } |
| } |
| String[] a1 = l.toArray(new String[0]); |
| sslParameters.setProtocols(a1); |
| } |
| |
| if (!disableHostnameVerification) |
| sslParameters.setEndpointIdentificationAlgorithm("HTTPS"); |
| if (alpn != null) { |
| Log.logSSL("AbstractAsyncSSLConnection: Setting application protocols: {0}", |
| Arrays.toString(alpn)); |
| sslParameters.setApplicationProtocols(alpn); |
| } else { |
| Log.logSSL("AbstractAsyncSSLConnection: no applications set!"); |
| } |
| sslParameters.setServerNames(sniServerNames); |
| return sslParameters; |
| } |
| |
| /** |
| * Returns a list of {@link SNIServerName}s that are expected to be used to |
| * configure the {@link SSLEngine} used by this connection. |
| * <p> |
| * The given {@code serverName} is given preference, and if it is not null and |
| * is not an IP address literal, then the returned list will contain only one |
| * {@code SNIServerName} formed out of the {@code serverName}. If {@code serverName} |
| * is null or is an IP address literal then the {@code SNIServerName}(s) |
| * configured through {@link HttpClient#sslParameters()} will be returned. If none have |
| * been configured, then an empty list is returned. |
| * |
| * @param serverName the {@link ServerName}, typically computed based on the request URI |
| * @param client the {@code HttpClient} |
| * @return a list of {@code SNIServerName}s to be used by the {@code SSLEngine} |
| * of this connection. |
| */ |
| private static List<SNIServerName> formSNIServerNames(final ServerName serverName, |
| final HttpClientImpl client) { |
| if (serverName != null && !serverName.isLiteral()) { |
| final String name = serverName.name(); |
| if (name != null && !name.isEmpty()) { |
| return List.of(new SNIHostName(name)); |
| } |
| } |
| // fallback on any SNIServerName(s) configured through HttpClient.sslParameters() |
| final SSLParameters clientSSLParams = client.sslParameters(); |
| final List<SNIServerName> clientConfigured = clientSSLParams.getServerNames(); |
| return clientConfigured != null ? clientConfigured : List.of(); |
| } |
| |
| private static SSLEngine createEngine(SSLContext context, String peerHost, int port, |
| SSLParameters sslParameters) { |
| SSLEngine engine = context.createSSLEngine(peerHost, port); |
| engine.setUseClientMode(true); |
| |
| engine.setSSLParameters(sslParameters); |
| return engine; |
| } |
| |
| @Override |
| final boolean isSecure() { |
| return true; |
| } |
| |
| } |
