-
Notifications
You must be signed in to change notification settings - Fork 2.4k
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
* TLS PSK implementation * Breaking apart the PSK creation to an interface * Added license * Store PSK info in handshake info * Addressed review comments * Added license * 1) moving read of byte buff and release to helper method in TLSPSKHandler 2) adding comment in Http2OrHttpHandler and use readBytes instead of readSlice 3) adding SslCloseCompletionEvent on close_notify alert 4) handling null value TLS_HANDSHAKE_USING_EXTERNAL_PSK * adding license header * adding back old SslHandshakeInfo constructor for backward compatibility * Update build.gradle --------- Co-authored-by: deeptiv1991 <[email protected]>
- Loading branch information
1 parent
545e977
commit 9de74b9
Showing
13 changed files
with
806 additions
and
10 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
19 changes: 19 additions & 0 deletions
19
zuul-core/src/main/java/com/netflix/zuul/netty/server/psk/ClientPSKIdentityInfo.java
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,19 @@ | ||
| /* | ||
| * Copyright 2024 Netflix, Inc. | ||
| * | ||
| * Licensed under the Apache License, Version 2.0 (the "License"); | ||
| * you may not use this file except in compliance with the License. | ||
| * You may obtain a copy of the License at | ||
| * | ||
| * http://www.apache.org/licenses/LICENSE-2.0 | ||
| * | ||
| * Unless required by applicable law or agreed to in writing, software | ||
| * distributed under the License is distributed on an "AS IS" BASIS, | ||
| * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. | ||
| * See the License for the specific language governing permissions and | ||
| * limitations under the License. | ||
| */ | ||
| package com.netflix.zuul.netty.server.psk; | ||
|
|
||
| public record ClientPSKIdentityInfo(byte[] clientPSKIdentity) { | ||
| } |
22 changes: 22 additions & 0 deletions
22
zuul-core/src/main/java/com/netflix/zuul/netty/server/psk/ExternalTlsPskProvider.java
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,22 @@ | ||
| /* | ||
| * Copyright 2024 Netflix, Inc. | ||
| * | ||
| * Licensed under the Apache License, Version 2.0 (the "License"); | ||
| * you may not use this file except in compliance with the License. | ||
| * You may obtain a copy of the License at | ||
| * | ||
| * http://www.apache.org/licenses/LICENSE-2.0 | ||
| * | ||
| * Unless required by applicable law or agreed to in writing, software | ||
| * distributed under the License is distributed on an "AS IS" BASIS, | ||
| * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. | ||
| * See the License for the specific language governing permissions and | ||
| * limitations under the License. | ||
| */ | ||
|
|
||
| package com.netflix.zuul.netty.server.psk; | ||
|
|
||
|
|
||
| public interface ExternalTlsPskProvider { | ||
| byte[] provide(byte[] clientPskIdentity, byte[] clientRandom) throws PskCreationFailureException; | ||
| } |
46 changes: 46 additions & 0 deletions
46
zuul-core/src/main/java/com/netflix/zuul/netty/server/psk/PskCreationFailureException.java
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,46 @@ | ||
| /* | ||
| * Copyright 2024 Netflix, Inc. | ||
| * | ||
| * Licensed under the Apache License, Version 2.0 (the "License"); | ||
| * you may not use this file except in compliance with the License. | ||
| * You may obtain a copy of the License at | ||
| * | ||
| * http://www.apache.org/licenses/LICENSE-2.0 | ||
| * | ||
| * Unless required by applicable law or agreed to in writing, software | ||
| * distributed under the License is distributed on an "AS IS" BASIS, | ||
| * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. | ||
| * See the License for the specific language governing permissions and | ||
| * limitations under the License. | ||
| */ | ||
| package com.netflix.zuul.netty.server.psk; | ||
|
|
||
| public class PskCreationFailureException extends Exception { | ||
|
|
||
| public enum TlsAlertMessage { | ||
| /** | ||
| * The server does not recognize the (client) PSK identity | ||
| */ | ||
| unknown_psk_identity, | ||
| /** | ||
| * The (client) PSK identity existed but the key was incorrect | ||
| */ | ||
| decrypt_error, | ||
| } | ||
|
|
||
| private final TlsAlertMessage tlsAlertMessage; | ||
|
|
||
| public PskCreationFailureException(TlsAlertMessage tlsAlertMessage, String message) { | ||
| super(message); | ||
| this.tlsAlertMessage = tlsAlertMessage; | ||
| } | ||
|
|
||
| public PskCreationFailureException(TlsAlertMessage tlsAlertMessage, String message, Throwable cause) { | ||
| super(message, cause); | ||
| this.tlsAlertMessage = tlsAlertMessage; | ||
| } | ||
|
|
||
| public TlsAlertMessage getTlsAlertMessage() { | ||
| return tlsAlertMessage; | ||
| } | ||
| } |
67 changes: 67 additions & 0 deletions
67
zuul-core/src/main/java/com/netflix/zuul/netty/server/psk/TlsPskDecoder.java
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,67 @@ | ||
| /* | ||
| * Copyright 2024 Netflix, Inc. | ||
| * | ||
| * Licensed under the Apache License, Version 2.0 (the "License"); | ||
| * you may not use this file except in compliance with the License. | ||
| * You may obtain a copy of the License at | ||
| * | ||
| * http://www.apache.org/licenses/LICENSE-2.0 | ||
| * | ||
| * Unless required by applicable law or agreed to in writing, software | ||
| * distributed under the License is distributed on an "AS IS" BASIS, | ||
| * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. | ||
| * See the License for the specific language governing permissions and | ||
| * limitations under the License. | ||
| */ | ||
|
|
||
| package com.netflix.zuul.netty.server.psk; | ||
|
|
||
| import io.netty.buffer.ByteBuf; | ||
| import io.netty.buffer.Unpooled; | ||
| import io.netty.channel.ChannelFutureListener; | ||
| import io.netty.channel.ChannelHandlerContext; | ||
| import io.netty.handler.codec.ByteToMessageDecoder; | ||
| import io.netty.handler.ssl.SslHandshakeCompletionEvent; | ||
| import org.bouncycastle.tls.TlsFatalAlert; | ||
|
|
||
| import java.util.List; | ||
|
|
||
| public class TlsPskDecoder extends ByteToMessageDecoder { | ||
|
|
||
| private final TlsPskServerProtocol tlsPskServerProtocol; | ||
|
|
||
| public TlsPskDecoder(TlsPskServerProtocol tlsPskServerProtocol) { | ||
| this.tlsPskServerProtocol = tlsPskServerProtocol; | ||
| } | ||
|
|
||
| @Override | ||
| protected void decode(ChannelHandlerContext ctx, ByteBuf in, List<Object> out) throws Exception { | ||
| final byte[] bytesRead = in.hasArray() ? in.array() : TlsPskUtils.readDirect(in); | ||
| try { | ||
| tlsPskServerProtocol.offerInput(bytesRead); | ||
| } catch (TlsFatalAlert tlsFatalAlert) { | ||
| writeOutputIfAvailable(ctx); | ||
| ctx.fireUserEventTriggered(new SslHandshakeCompletionEvent(tlsFatalAlert)); | ||
| ctx.close(); | ||
| return; | ||
| } | ||
| writeOutputIfAvailable(ctx); | ||
| final int appDataAvailable = tlsPskServerProtocol.getAvailableInputBytes(); | ||
| if (appDataAvailable > 0) { | ||
| byte[] appData = new byte[appDataAvailable]; | ||
| tlsPskServerProtocol.readInput(appData, 0, appDataAvailable); | ||
| out.add(Unpooled.wrappedBuffer(appData)); | ||
| } | ||
| } | ||
|
|
||
| private void writeOutputIfAvailable(ChannelHandlerContext ctx) { | ||
| final int availableOutputBytes = tlsPskServerProtocol.getAvailableOutputBytes(); | ||
| // output is available immediately (handshake not complete), pipe that back to the client right away | ||
| if (availableOutputBytes != 0) { | ||
| byte[] outputBytes = new byte[availableOutputBytes]; | ||
| tlsPskServerProtocol.readOutput(outputBytes, 0, availableOutputBytes); | ||
| ctx.writeAndFlush(Unpooled.wrappedBuffer(outputBytes)) | ||
| .addListener(ChannelFutureListener.FIRE_EXCEPTION_ON_FAILURE); | ||
| } | ||
| } | ||
| } |
Oops, something went wrong.