Skip to content

Open up SslCredential API to AWS-LC #953

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
jmcrawford45 wants to merge 1 commit into
base: main
Choose a base branch
from
Open

Open up SslCredential API to AWS-LC #953

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
12 changes: 6 additions & 6 deletions openssl-classes/src/main/java/io/netty/internal/tcnative/SSL.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -973,11 +973,11 @@ public static AsyncTask getAsyncTask(long ssl) {

/**
* Add an SSL_CREDENTIAL to the SSL instance.
*
* <p>This is a BoringSSL-specific feature. See
*
* <p>This is a BoringSSL/AWS-LC-specific feature. See
* <a href="https://commondatastorage.googleapis.com/chromium-boringssl-docs/ssl.h.html#SSL_add1_credential">SSL_add1_credential</a>
* for detailed documentation.</p>
*
*
* @param ssl the SSL instance (SSL *)
* @param cred the SSL_CREDENTIAL instance (SSL_CREDENTIAL *)
* @throws Exception if an error occurred
Expand All @@ -986,11 +986,11 @@ public static AsyncTask getAsyncTask(long ssl) {

/**
* Get the selected credential from an SSL instance.
*
* <p>This is a BoringSSL-specific feature. See
*
* <p>This is a BoringSSL/AWS-LC-specific feature. See
* <a href="https://commondatastorage.googleapis.com/chromium-boringssl-docs/ssl.h.html#SSL_get0_selected_credential">SSL_get0_selected_credential</a>
* for detailed documentation.</p>
*
*
* @param ssl the SSL instance (SSL *)
* @return the selected credential (SSL_CREDENTIAL *) or {@code 0} if none
* @throws Exception if an error occurred
Expand Down
6 changes: 3 additions & 3 deletions openssl-classes/src/main/java/io/netty/internal/tcnative/SSLContext.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -777,11 +777,11 @@ public static boolean setCurvesList(long ctx, String... curves) {

/**
* Add an SSL_CREDENTIAL to the SSL_CTX instance.
*
* <p>This is a BoringSSL-specific feature. See
*
* <p>This is a BoringSSL/AWS-LC-specific feature. See
* <a href="https://commondatastorage.googleapis.com/chromium-boringssl-docs/ssl.h.html#SSL_CTX_add1_credential">SSL_CTX_add1_credential</a>
* for detailed documentation.</p>
*
*
* @param ctx the SSL_CTX instance (SSL_CTX *)
* @param cred the SSL_CREDENTIAL instance (SSL_CREDENTIAL *)
* @throws Exception if an error occurred
Expand Down
88 changes: 44 additions & 44 deletions openssl-classes/src/main/java/io/netty/internal/tcnative/SSLCredential.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -16,16 +16,16 @@
package io.netty.internal.tcnative;

/**
* SSL_CREDENTIAL management for BoringSSL.
*
* SSL_CREDENTIAL management for BoringSSL and AWS-LC.
*
* This class provides methods to create and manage SSL_CREDENTIAL objects,
* which are used to configure credentials for SSL/TLS connections in BoringSSL.
*
* <p>This API is only supported when using BoringSSL. For usage instructions and detailed
* documentation, see the
* which are used to configure credentials for SSL/TLS connections in BoringSSL and AWS-LC.
*
* <p>This API is only supported when using BoringSSL or AWS-LC. For usage instructions and detailed
* documentation, see the
* <a href="https://commondatastorage.googleapis.com/chromium-boringssl-docs/ssl.h.html#SSL_CREDENTIAL_free">BoringSSL SSL_CREDENTIAL documentation</a>.
* </p>
*
*
* <p>SSL_CREDENTIAL objects allow fine-grained control over certificate and private key
* configuration, including support for multiple credentials, delegated credentials,
* and SPAKE2+ authentication.</p>
Expand All @@ -36,47 +36,47 @@ private SSLCredential() { }

/**
* Create a new X509 SSL_CREDENTIAL.
*
* <p>This is a BoringSSL-specific feature. See
*
* <p>This is a BoringSSL/AWS-LC-specific feature. See
* <a href="https://commondatastorage.googleapis.com/chromium-boringssl-docs/ssl.h.html#SSL_CREDENTIAL_new_x509">SSL_CREDENTIAL_new_x509</a>
* for detailed documentation.</p>
*
*
* @return the SSL_CREDENTIAL instance (SSL_CREDENTIAL *)
* @throws Exception if an error occurred
*/
public static native long newX509() throws Exception;

/**
* Increment the reference count of an SSL_CREDENTIAL.
*
* <p>This is a BoringSSL-specific feature. See
*
* <p>This is a BoringSSL/AWS-LC-specific feature. See
* <a href="https://commondatastorage.googleapis.com/chromium-boringssl-docs/ssl.h.html#SSL_CREDENTIAL_up_ref">SSL_CREDENTIAL_up_ref</a>
* for detailed documentation.</p>
*
*
* @param cred the SSL_CREDENTIAL instance (SSL_CREDENTIAL *)
* @throws Exception if an error occurred
*/
public static native void upRef(long cred) throws Exception;

/**
* Free an SSL_CREDENTIAL and decrement its reference count.
*
* <p>This is a BoringSSL-specific feature. See
*
* <p>This is a BoringSSL/AWS-LC-specific feature. See
* <a href="https://commondatastorage.googleapis.com/chromium-boringssl-docs/ssl.h.html#SSL_CREDENTIAL_free">SSL_CREDENTIAL_free</a>
* for detailed documentation.</p>
*
*
* @param cred the SSL_CREDENTIAL instance (SSL_CREDENTIAL *)
* @throws Exception if an error occurred
*/
public static native void free(long cred) throws Exception;

/**
* Set the private key for an SSL_CREDENTIAL.
*
* <p>This is a BoringSSL-specific feature. See
*
* <p>This is a BoringSSL/AWS-LC-specific feature. See
* <a href="https://commondatastorage.googleapis.com/chromium-boringssl-docs/ssl.h.html#SSL_CREDENTIAL_set1_private_key">SSL_CREDENTIAL_set1_private_key</a>
* for detailed documentation.</p>
*
*
* @param cred the SSL_CREDENTIAL instance (SSL_CREDENTIAL *)
* @param key the private key (EVP_PKEY *)
* @throws Exception if an error occurred
Expand All @@ -86,7 +86,7 @@ private SSLCredential() { }
/**
* Set the certificate chain for an SSL_CREDENTIAL.
*
* <p>This is a BoringSSL-specific feature. See
* <p>This is a BoringSSL/AWS-LC-specific feature. See
* <a href="https://commondatastorage.googleapis.com/chromium-boringssl-docs/ssl.h.html#SSL_CREDENTIAL_set1_cert_chain">SSL_CREDENTIAL_set1_cert_chain</a>
* for detailed documentation.</p>
*
Expand All @@ -98,11 +98,11 @@ private SSLCredential() { }

/**
* Set the OCSP response for an SSL_CREDENTIAL.
*
* <p>This is a BoringSSL-specific feature. See
*
* <p>This is a BoringSSL/AWS-LC-specific feature. See
* <a href="https://commondatastorage.googleapis.com/chromium-boringssl-docs/ssl.h.html#SSL_CREDENTIAL_set1_ocsp_response">SSL_CREDENTIAL_set1_ocsp_response</a>
* for detailed documentation.</p>
*
*
* @param cred the SSL_CREDENTIAL instance (SSL_CREDENTIAL *)
* @param response the OCSP response bytes
* @throws Exception if an error occurred
Expand All @@ -111,11 +111,11 @@ private SSLCredential() { }

/**
* Set the signing algorithm preferences for an SSL_CREDENTIAL.
*
* <p>This is a BoringSSL-specific feature. See
*
* <p>This is a BoringSSL/AWS-LC-specific feature. See
* <a href="https://commondatastorage.googleapis.com/chromium-boringssl-docs/ssl.h.html#SSL_CREDENTIAL_set1_signing_algorithm_prefs">SSL_CREDENTIAL_set1_signing_algorithm_prefs</a>
* for detailed documentation.</p>
*
*
* @param cred the SSL_CREDENTIAL instance (SSL_CREDENTIAL *)
* @param prefs the signing algorithm preferences
* @throws Exception if an error occurred
Expand All @@ -124,11 +124,11 @@ private SSLCredential() { }

/**
* Set the certificate properties for an SSL_CREDENTIAL.
*
* <p>This is a BoringSSL-specific feature. See
*
* <p>This is a BoringSSL/AWS-LC-specific feature. See
* <a href="https://commondatastorage.googleapis.com/chromium-boringssl-docs/ssl.h.html#SSL_CREDENTIAL_set1_certificate_properties">SSL_CREDENTIAL_set1_certificate_properties</a>
* for detailed documentation.</p>
*
*
* @param cred the SSL_CREDENTIAL instance (SSL_CREDENTIAL *)
* @param properties the certificate properties
* @throws Exception if an error occurred
Expand All @@ -137,11 +137,11 @@ private SSLCredential() { }

/**
* Set the signed certificate timestamp list for an SSL_CREDENTIAL.
*
* <p>This is a BoringSSL-specific feature. See
*
* <p>This is a BoringSSL/AWS-LC-specific feature. See
* <a href="https://commondatastorage.googleapis.com/chromium-boringssl-docs/ssl.h.html#SSL_CREDENTIAL_set1_signed_cert_timestamp_list">SSL_CREDENTIAL_set1_signed_cert_timestamp_list</a>
* for detailed documentation.</p>
*
*
* @param cred the SSL_CREDENTIAL instance (SSL_CREDENTIAL *)
* @param sctList the signed certificate timestamp list
* @throws Exception if an error occurred
Expand All @@ -150,11 +150,11 @@ private SSLCredential() { }

/**
* Set whether the issuer must match for an SSL_CREDENTIAL.
*
* <p>This is a BoringSSL-specific feature. See
*
* <p>This is a BoringSSL/AWS-LC-specific feature. See
* <a href="https://commondatastorage.googleapis.com/chromium-boringssl-docs/ssl.h.html#SSL_CREDENTIAL_set_must_match_issuer">SSL_CREDENTIAL_set_must_match_issuer</a>
* for detailed documentation.</p>
*
*
* @param cred the SSL_CREDENTIAL instance (SSL_CREDENTIAL *)
* @param mustMatch {@code true} if issuer must match, {@code false} otherwise
* @throws Exception if an error occurred
Expand All @@ -163,11 +163,11 @@ private SSLCredential() { }

/**
* Set the trust anchor ID for an SSL_CREDENTIAL.
*
* <p>This is a BoringSSL-specific feature for trust anchor configuration. See
*
* <p>This is a BoringSSL/AWS-LC-specific feature for trust anchor configuration. See
* <a href="https://commondatastorage.googleapis.com/chromium-boringssl-docs/ssl.h.html#SSL_CREDENTIAL_set1_trust_anchor_id">SSL_CREDENTIAL_set1_trust_anchor_id</a>
* for detailed documentation.</p>
*
*
* @param cred the SSL_CREDENTIAL instance (SSL_CREDENTIAL *)
* @param id the trust anchor ID
* @throws Exception if an error occurred
Expand All @@ -176,23 +176,23 @@ private SSLCredential() { }

/**
* Create a new delegated SSL_CREDENTIAL.
*
* <p>This is a BoringSSL-specific feature for delegated credential support. See
*
* <p>This is a BoringSSL/AWS-LC-specific feature for delegated credential support. See
* <a href="https://commondatastorage.googleapis.com/chromium-boringssl-docs/ssl.h.html#SSL_CREDENTIAL_new_delegated">SSL_CREDENTIAL_new_delegated</a>
* for detailed documentation.</p>
*
*
* @return the delegated SSL_CREDENTIAL instance (SSL_CREDENTIAL *)
* @throws Exception if an error occurred
*/
public static native long newDelegated() throws Exception;

/**
* Set the delegated credential for an SSL_CREDENTIAL.
*
* <p>This is a BoringSSL-specific feature for delegated credential configuration. See
*
* <p>This is a BoringSSL/AWS-LC-specific feature for delegated credential configuration. See
* <a href="https://commondatastorage.googleapis.com/chromium-boringssl-docs/ssl.h.html#SSL_CREDENTIAL_set1_delegated_credential">SSL_CREDENTIAL_set1_delegated_credential</a>
* for detailed documentation.</p>
*
*
* @param cred the SSL_CREDENTIAL instance (SSL_CREDENTIAL *)
* @param delegatedCred the delegated credential bytes
* @throws Exception if an error occurred
Expand Down
4 changes: 2 additions & 2 deletions openssl-dynamic/src/main/c/ssl.c
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -2674,7 +2674,7 @@ TCN_IMPLEMENT_CALL(void, SSL, addCredential)(TCN_STDARGS, jlong ssl, jlong cred)
SSL *ssl_ = J2P(ssl, SSL *);
TCN_CHECK_NULL(ssl_, ssl, /* void */);

#ifdef OPENSSL_IS_BORINGSSL
#if defined(OPENSSL_IS_BORINGSSL) || defined(OPENSSL_IS_AWSLC)
SSL_CREDENTIAL* credential = (SSL_CREDENTIAL*)(intptr_t)cred;
TCN_CHECK_NULL(credential, credential, /* void */);

Expand All @@ -2690,7 +2690,7 @@ TCN_IMPLEMENT_CALL(jlong, SSL, getSelectedCredential)(TCN_STDARGS, jlong ssl) {
SSL *ssl_ = J2P(ssl, SSL *);
TCN_CHECK_NULL(ssl_, ssl, 0);

#ifdef OPENSSL_IS_BORINGSSL
#if defined(OPENSSL_IS_BORINGSSL) || defined(OPENSSL_IS_AWSLC)
const SSL_CREDENTIAL* credential = SSL_get0_selected_credential(ssl_);
if (credential == NULL) {
return 0;
Expand Down
4 changes: 2 additions & 2 deletions openssl-dynamic/src/main/c/ssl_private.h
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -519,7 +519,7 @@ enum ssl_verify_result_t tcn_SSL_cert_custom_verify(SSL* ssl, uint8_t *out_alert
#endif // defined(OPENSSL_IS_BORINGSSL) || defined(OPENSSL_IS_AWSLC)

// SSL_CREDENTIAL API runtime detection for FIPS compatibility
#ifdef OPENSSL_IS_BORINGSSL
#if defined(OPENSSL_IS_BORINGSSL) || defined(OPENSSL_IS_AWSLC)
// Use weak symbols to detect if SSL_CREDENTIAL API is available at runtime
// FIPS BoringSSL builds (fips-20230428 and earlier) don't have these symbols
__attribute__((weak)) extern SSL_CREDENTIAL* SSL_CREDENTIAL_new_x509(void);
Expand Down Expand Up @@ -554,6 +554,6 @@ __attribute__((unused)) static inline int check_credential_api(JNIEnv* e) {
tcn_ThrowUnsupportedOperationException(e, "SSL_CREDENTIAL API not available.");
return 0;
}
#endif // OPENSSL_IS_BORINGSSL
#endif // defined(OPENSSL_IS_BORINGSSL) || defined(OPENSSL_IS_AWSLC)

#endif /* SSL_PRIVATE_H */
2 changes: 1 addition & 1 deletion openssl-dynamic/src/main/c/sslcontext.c
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -2949,7 +2949,7 @@ TCN_IMPLEMENT_CALL(void, SSLContext, addCredential)(TCN_STDARGS, jlong ctx, jlon
tcn_ssl_ctxt_t *c = J2P(ctx, tcn_ssl_ctxt_t *);
TCN_CHECK_NULL(c, ctx, /* void */);

#ifdef OPENSSL_IS_BORINGSSL
#if defined(OPENSSL_IS_BORINGSSL) || defined(OPENSSL_IS_AWSLC)
SSL_CREDENTIAL* credential = (SSL_CREDENTIAL*)(intptr_t)cred;
TCN_CHECK_NULL(credential, credential, /* void */);

Expand Down
Loading
Loading