Missing peer host and port info in SSLEngine for server SslHandler #5290
Comments
|
@ben1222 can you provide a reproducer for this using the vertx tests so we are covered, that would help |
|
@vietj I tried to create a unit test under public class Http1xTLSTest extends HttpTLSTest {
private static final Logger LOG = LogManager.getLogger(Http1xTLSTest.class);
@Test
public void testTLSServerSSLEnginePeerHost() throws Exception {
testTLS(Cert.NONE, Trust.SERVER_JKS, () -> {
try {
return KeyCertOptions.wrap(new MyKeyManager((X509KeyManager) Cert.SERVER_JKS.get().getKeyManagerFactory(vertx).getKeyManagers()[0]));
} catch (Exception e) {
throw new RuntimeException(e);
}
}, Trust.NONE).pass();
}
private static class MyKeyManager extends X509ExtendedKeyManager {
private final X509KeyManager wrapped;
MyKeyManager(X509KeyManager wrapped) {
this.wrapped = wrapped;
}
@Override
public String chooseEngineClientAlias(String[] keyType, Principal[] issuers, SSLEngine engine) {
throw new UnsupportedOperationException();
}
@Override
public String chooseEngineServerAlias(String keyType, Principal[] issuers, SSLEngine engine) {
LOG.info("In chooseEngineServerAlias, keyType: {}, issuers: {}, peer host: {}, peer port: {}",
keyType, issuers, engine.getPeerHost(), engine.getPeerPort());
if (engine.getPeerHost() == null || engine.getPeerPort() == -1) {
throw new RuntimeException("Missing peer host/port");
}
return wrapped.chooseServerAlias(keyType, issuers, null);
}
@Override
public String chooseClientAlias(String[] keyType, Principal[] issuers, Socket socket) {
throw new UnsupportedOperationException();
}
@Override
public String chooseServerAlias(String keyType, Principal[] issuers, Socket socket) {
throw new UnsupportedOperationException();
}
@Override
public String[] getClientAliases(String s, Principal[] principals) {
throw new UnsupportedOperationException();
}
@Override
public String[] getServerAliases(String s, Principal[] principals) {
return wrapped.getServerAliases(s, principals);
}
@Override
public X509Certificate[] getCertificateChain(String s) {
LOG.info("In getCertificateChain, s: {}", s);
return wrapped.getCertificateChain(s);
}
@Override
public PrivateKey getPrivateKey(String s) {
LOG.info("In getPrivateKey, s: {}", s);
return wrapped.getPrivateKey(s);
}
}
//...
}Currently it will fail with: With the changes in |
|
do you mind contributing a pull request to the 4.x branch and master branch ? |
|
@vietj I can have a try. Do I need to go through some process before sending the pull request? I see the contributing guideline mentioned about signing ECA? |
|
you should sign the Eclipse Agreement indeed everything should be updated and tested in master and 4.x branches |
This was referenced Oct 8, 2024
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Version
4.4.9
Context
We have a customized key manager that extends
X509ExtendedKeyManagerthat want to override thepublic String chooseEngineServerAlias(String keyType, Principal[] issuers, SSLEngine engine)method to choose the server alias partly depending on the peer host address.However, the
engine.getPeerHost()always returnsnull.After read related code, I find that netty
SslContext.newHandlerdo support passing in an advisory peer information of peer host and port.However, in vert.x, when creating
SslHandlerfor server inSslChannelProvider, the peer host and port info is not passed toSslContext.newHandler, result innullforengine.getPeerHost()inX509ExtendedKeyManager.chooseEngineServerAlias.(The
SslChannelProviderdo provide peer host and port info when creating clientSslHandler)I tried to pass the peer host and port info from
HttpServerWorkertoSslChannelProvider.createServerHandlerand find the peer host and port are available in theSSLEngineinX509ExtendedKeyManager.chooseEngineServerAlias:There are a few other places calling
SslChannelProvider.createServerHandlerso although this change works in my use case, a more complete fix may be needed.The text was updated successfully, but these errors were encountered: