Skip to content

Commit

Permalink
Respect ClientAuth set via OpenSslEngine constructor
Browse files Browse the repository at this point in the history
Motivation:

When ClientAuth is set via SslContextBuilder we pass it into the OpenSslEngine constructor. Due a bug we missed to call the correct native methods and so never enabled ClientAuth in this case.

Modifications:

Correctly call setClientAuth(...) in the constructor if needed.

Result:

client auth also works when configured via the SslContextBuilder and OPENSSL is used.
  • Loading branch information
normanmaurer committed Dec 16, 2015
1 parent 27b330d commit eb577c5
Showing 1 changed file with 5 additions and 2 deletions.
7 changes: 5 additions & 2 deletions handler/src/main/java/io/netty/handler/ssl/OpenSslEngine.java
Expand Up @@ -202,7 +202,7 @@ public OpenSslEngine(long sslCtx, ByteBufAllocator alloc,
boolean clientMode, OpenSslSessionContext sessionContext,
OpenSslApplicationProtocolNegotiator apn, OpenSslEngineMap engineMap,
boolean rejectRemoteInitiatedRenegation, String peerHost, int peerPort,
java.security.cert.Certificate[] localCerts,
Certificate[] localCerts,
ClientAuth clientAuth) {
super(peerHost, peerPort);
OpenSsl.ensureAvailability();
Expand All @@ -212,14 +212,17 @@ public OpenSslEngine(long sslCtx, ByteBufAllocator alloc,

this.alloc = checkNotNull(alloc, "alloc");
this.apn = checkNotNull(apn, "apn");
this.clientAuth = clientMode ? ClientAuth.NONE : checkNotNull(clientAuth, "clientAuth");
ssl = SSL.newSSL(sslCtx, !clientMode);
session = new OpenSslSession(sessionContext);
networkBIO = SSL.makeNetworkBIO(ssl);
this.clientMode = clientMode;
this.engineMap = engineMap;
this.rejectRemoteInitiatedRenegation = rejectRemoteInitiatedRenegation;
this.localCerts = localCerts;

// Set the client auth mode, this needs to be done via setClientAuth(...) method so we actually call the
// needed JNI methods.
setClientAuth(clientMode ? ClientAuth.NONE : checkNotNull(clientAuth, "clientAuth"));
}

@Override
Expand Down

0 comments on commit eb577c5

Please sign in to comment.