org.apache.tomcat.util.net.SSLSupport Java Examples

/**
 * Look for SSL session ID if required. Only look for SSL Session ID if it
 * is the only tracking method enabled.
 *
 * @param request The Servlet request object
 */
protected void parseSessionSslId(Request request) {
    if (request.getRequestedSessionId() == null &&
            SSL_ONLY.equals(request.getServletContext()
                    .getEffectiveSessionTrackingModes()) &&
                    request.connector.secure) {
        String sessionId = (String) request.getAttribute(SSLSupport.SESSION_ID_KEY);
        if (sessionId != null) {
            request.setRequestedSessionId(sessionId);
            request.setRequestedSessionSSL(true);
        }
    }
}
 

/**
 * Copied from <code>org.apache.catalina.valves.CertificateValve</code>
 */
@Override
public Integer getKeySize()
    throws IOException {
    // Look up the current SSLSession
    SSLSupport.CipherData c_aux[]=ciphers;
    if (session == null)
        return null;

    Integer keySize = null;
    synchronized(keySizeCache) {
        keySize = keySizeCache.get(session);
    }

    if (keySize == null) {
        int size = 0;
        String cipherSuite = session.getCipherSuite();
        for (int i = 0; i < c_aux.length; i++) {
            if (cipherSuite.indexOf(c_aux[i].phrase) >= 0) {
                size = c_aux[i].keySize;
                break;
            }
        }
        keySize = Integer.valueOf(size);
        synchronized(keySizeCache) {
            keySizeCache.put(session, keySize);
        }
    }
    return keySize;
}
 

/**
 * Copied from <code>org.apache.catalina.valves.CertificateValve</code>
 */
@Override
public Integer getKeySize()
    throws IOException {
    // Look up the current SSLSession
    SSLSupport.CipherData c_aux[]=ciphers;
    if (session == null)
        return null;

    Integer keySize = null;
    synchronized(keySizeCache) {
        keySize = keySizeCache.get(session);
    }

    if (keySize == null) {
        int size = 0;
        String cipherSuite = session.getCipherSuite();
        for (int i = 0; i < c_aux.length; i++) {
            if (cipherSuite.indexOf(c_aux[i].phrase) >= 0) {
                size = c_aux[i].keySize;
                break;
            }
        }
        keySize = Integer.valueOf(size);
        synchronized(keySizeCache) {
            keySizeCache.put(session, keySize);
        }
    }
    return keySize;
}
 

@Override
protected final void sslReHandShake() throws IOException {
    if (sslSupport != null) {
        // Consume and buffer the request body, so that it does not
        // interfere with the client's handshake messages
        InputFilter[] inputFilters = inputBuffer.getFilters();
        ((BufferedInputFilter) inputFilters[Constants.BUFFERED_FILTER]).setLimit(
                maxSavePostSize);
        inputBuffer.addActiveFilter(inputFilters[Constants.BUFFERED_FILTER]);

        /*
         * Outside the try/catch because we want I/O errors during
         * renegotiation to be thrown for the caller to handle since they
         * will be fatal to the connection.
         */
        socketWrapper.doClientAuth(sslSupport);
        try {
            /*
             * Errors processing the cert chain do not affect the client
             * connection so they can be logged and swallowed here.
             */
            Object sslO = sslSupport.getPeerCertificateChain();
            if (sslO != null) {
                request.setAttribute(SSLSupport.CERTIFICATE_KEY, sslO);
            }
        } catch (IOException ioe) {
            log.warn(sm.getString("http11processor.socket.ssl"), ioe);
        }
    }
}
 

/**
 * Look for SSL session ID if required. Only look for SSL Session ID if it
 * is the only tracking method enabled.
 */
protected void parseSessionSslId(Request request) {
    if (request.getRequestedSessionId() == null &&
            SSL_ONLY.equals(request.getServletContext()
                    .getEffectiveSessionTrackingModes()) &&
                    request.connector.secure) {
        // TODO Is there a better way to map SSL sessions to our sesison ID?
        // TODO The request.getAttribute() will cause a number of other SSL
        //      attribute to be populated. Is this a performance concern?
        request.setRequestedSessionId(
                request.getAttribute(SSLSupport.SESSION_ID_KEY).toString());
        request.setRequestedSessionSSL(true);
    }
}
 

/**
 * Populate the TLS related request attributes from the {@link SSLSupport}
 * instance associated with this processor. Protocols that populate TLS
 * attributes from a different source (e.g. AJP) should override this
 * method.
 */
protected void populateSslRequestAttributes() {
    try {
        if (sslSupport != null) {
            Object sslO = sslSupport.getCipherSuite();
            if (sslO != null) {
                request.setAttribute(SSLSupport.CIPHER_SUITE_KEY, sslO);
            }
            sslO = sslSupport.getPeerCertificateChain();
            if (sslO != null) {
                request.setAttribute(SSLSupport.CERTIFICATE_KEY, sslO);
            }
            sslO = sslSupport.getKeySize();
            if (sslO != null) {
                request.setAttribute (SSLSupport.KEY_SIZE_KEY, sslO);
            }
            sslO = sslSupport.getSessionId();
            if (sslO != null) {
                request.setAttribute(SSLSupport.SESSION_ID_KEY, sslO);
            }
            sslO = sslSupport.getProtocol();
            if (sslO != null) {
                request.setAttribute(SSLSupport.PROTOCOL_VERSION_KEY, sslO);
            }
            request.setAttribute(SSLSupport.SESSION_MGR, sslSupport);
        }
    } catch (Exception e) {
        getLog().warn(sm.getString("abstractProcessor.socket.ssl"), e);
    }
}
 

/**
 * Look for SSL session ID if required. Only look for SSL Session ID if it
 * is the only tracking method enabled.
 */
protected void parseSessionSslId(Request request) {
    if (request.getRequestedSessionId() == null &&
            SSL_ONLY.equals(request.getServletContext()
                    .getEffectiveSessionTrackingModes()) &&
                    request.connector.secure) {
        // TODO Is there a better way to map SSL sessions to our sesison ID?
        // TODO The request.getAttribute() will cause a number of other SSL
        //      attribute to be populated. Is this a performance concern?
        request.setRequestedSessionId(
                request.getAttribute(SSLSupport.SESSION_ID_KEY).toString());
        request.setRequestedSessionSSL(true);
    }
}
 

@Override
public void setSslSupport(SSLSupport sslSupport) {
    // Should never reach this code but in case we do...
    throw new IllegalStateException(
            sm.getString("ajpprocessor.ssl.notsupported"));
}
 

/**
 * Set the SSL information for this HTTP connection.
 */
@Override
public void setSslSupport(SSLSupport sslSupport) {
    this.sslSupport = sslSupport;
}
 

@Override
public SSLSupport getSSLSupport(Socket s) {
    return new JSSESupport((SSLSocket) s);
}
 

@Override
public SSLSupport getSSLSupport(SSLSession session) {
    return new JSSESupport(session);
}
 

@Override
public void doClientAuth(SSLSupport sslSupport) throws IOException {
    throw new UnsupportedOperationException();
}
 

@Override
public SSLSupport getSslSupport(String clientCertProvider) {
    throw new UnsupportedOperationException();
}
 

/**
 * Return the specified request attribute if it exists; otherwise, return
 * <code>null</code>.
 *
 * @param name Name of the request attribute to return
 */
@Override
public Object getAttribute(String name) {

    // Special attributes
    SpecialAttributeAdapter adapter = specialAttributes.get(name);
    if (adapter != null) {
        return adapter.get(this, name);
    }

    Object attr=attributes.get(name);

    if(attr!=null) {
        return(attr);
    }

    attr =  coyoteRequest.getAttribute(name);
    if(attr != null) {
        return attr;
    }
    if( isSSLAttribute(name) || name.equals(SSLSupport.PROTOCOL_VERSION_KEY)) {
        coyoteRequest.action(ActionCode.REQ_SSL_ATTRIBUTE,
                             coyoteRequest);
        attr = coyoteRequest.getAttribute(Globals.CERTIFICATES_ATTR);
        if( attr != null) {
            attributes.put(Globals.CERTIFICATES_ATTR, attr);
        }
        attr = coyoteRequest.getAttribute(Globals.CIPHER_SUITE_ATTR);
        if(attr != null) {
            attributes.put(Globals.CIPHER_SUITE_ATTR, attr);
        }
        attr = coyoteRequest.getAttribute(Globals.KEY_SIZE_ATTR);
        if(attr != null) {
            attributes.put(Globals.KEY_SIZE_ATTR, attr);
        }
        attr = coyoteRequest.getAttribute(Globals.SSL_SESSION_ID_ATTR);
        if(attr != null) {
            attributes.put(Globals.SSL_SESSION_ID_ATTR, attr);
            attributes.put(Globals.SSL_SESSION_ID_TOMCAT_ATTR, attr);
        }
        attr = coyoteRequest.getAttribute(Globals.SSL_SESSION_MGR_ATTR);
        if(attr != null) {
            attributes.put(Globals.SSL_SESSION_MGR_ATTR, attr);
        }
        attr = coyoteRequest.getAttribute(SSLSupport.PROTOCOL_VERSION_KEY);
        if(attr != null) {
            attributes.put(SSLSupport.PROTOCOL_VERSION_KEY, attr);
        }
        attr = attributes.get(name);
        sslAttributesParsed = true;
    }
    return attr;
}
 

@Override
public void setSslSupport(SSLSupport sslSupport) {
    // NOOP for APR
}
 

@Override
public final void setSslSupport(SSLSupport sslSupport) {
    // NOOP
}
 

@Override
public final void setSslSupport(SSLSupport sslSupport) {
    // NOOP
}
 

@Override
public void setSslSupport(SSLSupport sslSupport) {
    // NOOP for APR
}
 

/**
 * Set the SSL information for this HTTP connection.
 */
@Override
public void setSslSupport(SSLSupport sslSupport) {
    this.sslSupport = sslSupport;
}
 

/**
 * Set the SSL information for this HTTP connection.
 */
@Override
public void setSslSupport(SSLSupport sslSupport) {
    this.sslSupport = sslSupport;
}
 

@Override
public SSLSupport getSSLSupport(Socket s) {
    return new JSSESupport((SSLSocket) s);
}
 

@Override
public SSLSupport getSSLSupport(SSLSession session) {
    return new JSSESupport(session);
}
 

@Override
public void setSslSupport(SSLSupport sslSupport) {
    // NO-OP. WebSocket has no requirement to access the TLS information
    // associated with the underlying connection.
}
 

/**
 * @return the specified request attribute if it exists; otherwise, return
 * <code>null</code>.
 *
 * @param name Name of the request attribute to return
 */
@Override
public Object getAttribute(String name) {
    // Special attributes
    SpecialAttributeAdapter adapter = specialAttributes.get(name);
    if (adapter != null) {
        return adapter.get(this, name);
    }

    Object attr = attributes.get(name);

    if (attr != null) {
        return attr;
    }

    attr = coyoteRequest.getAttribute(name);
    if (attr != null) {
        return attr;
    }
    if (TLSUtil.isTLSRequestAttribute(name)) {
        coyoteRequest.action(ActionCode.REQ_SSL_ATTRIBUTE, coyoteRequest);
        attr = coyoteRequest.getAttribute(Globals.CERTIFICATES_ATTR);
        if (attr != null) {
            attributes.put(Globals.CERTIFICATES_ATTR, attr);
        }
        attr = coyoteRequest.getAttribute(Globals.CIPHER_SUITE_ATTR);
        if (attr != null) {
            attributes.put(Globals.CIPHER_SUITE_ATTR, attr);
        }
        attr = coyoteRequest.getAttribute(Globals.KEY_SIZE_ATTR);
        if (attr != null) {
            attributes.put(Globals.KEY_SIZE_ATTR, attr);
        }
        attr = coyoteRequest.getAttribute(Globals.SSL_SESSION_ID_ATTR);
        if (attr != null) {
            attributes.put(Globals.SSL_SESSION_ID_ATTR, attr);
        }
        attr = coyoteRequest.getAttribute(Globals.SSL_SESSION_MGR_ATTR);
        if (attr != null) {
            attributes.put(Globals.SSL_SESSION_MGR_ATTR, attr);
        }
        attr = coyoteRequest.getAttribute(SSLSupport.PROTOCOL_VERSION_KEY);
        if (attr != null) {
            attributes.put(SSLSupport.PROTOCOL_VERSION_KEY, attr);
        }
        attr = attributes.get(name);
        sslAttributesParsed = true;
    }
    return attr;
}
 

@Override
public void setSslSupport(SSLSupport sslSupport) {
    this.sslSupport = sslSupport;
}
 

@Override
public final void setSslSupport(SSLSupport sslSupport) {
    internalHttpUpgradeHandler.setSslSupport(sslSupport);
}
 

@Override
public final void setSslSupport(SSLSupport sslSupport) {
    // NO-OP
}
 

@Override
public final void setSslSupport(SSLSupport sslSupport) {
    this.sslSupport = sslSupport;
}
 

/**
 * Set the SSL information for this HTTP connection.
 */
@Override
public void setSslSupport(SSLSupport sslSupport) {
    this.sslSupport = sslSupport;
}
 

@Override
public SSLSupport getSSLSupport(SSLSession session) {
    return new JSSESupport(session);
}