OpenSslSession: Add support to defensively check for peer certs #14641

daschl · 2025-01-07T10:45:36Z

Motivation

In a use-case where an application wants to check if a peer certificate has been provided without throwing an exception if none are found (as is currently the behavior when calling SSLSession#getPeerCertificates) there is currently no API available to do that.

The use-case which prompted this addition is to defensively check if a mTLS connection has been established with access to the SSLSession.

Modifications

This changeset introduces a new API to the OpenSslSession which allows to check if peer certs are available (hasPeerCertificates) and returns true if this is the case.

Result

It is now possible to check if mTLS is enabled (through checking if peer certs are presented) without throwing an exception if not.

Motivation ---------- In a use-case where an application wants to check if a peer certificate has been provided without throwing an exception if none are found (as is currently the behavior when calling SSLSession#getPeerCertificates) there is currently no API available to do that. The use-case which prompted this addition is to defensively check if a mTLS connection has been established with access to the SSLSession. Modifications ------------- This changeset introduces a new API to the OpenSslSession which allows to check if peer certs are available (hasPeerCertificates) and returns true if this is the case. Result ------ It is now possible to check if mTLS is enabled (through checking if peer certs are presented) without throwing an exception if not.

handler/src/test/java/io/netty/handler/ssl/OpenSslEngineTest.java

normanmaurer · 2025-01-10T10:24:16Z

@daschl I am not against this change but I wonder how this will be useful for anyone except for netty itself ? The OpenSslSession interface is package-private and so this can't be called from anyone else

normanmaurer · 2025-01-10T14:18:47Z

@daschl @chrisvest @idelpivnitskiy PTAL again...

handler/src/test/java/io/netty/handler/ssl/OpenSslEngineTest.java

daschl

one minor comment, otherwise LGTM

handler/src/test/java/io/netty/handler/ssl/OpenSslEngineTest.java

Motivation ---------- In a use-case where an application wants to check if a peer certificate has been provided without throwing an exception if none are found (as is currently the behavior when calling SSLSession#getPeerCertificates) there is currently no API available to do that. The use-case which prompted this addition is to defensively check if a mTLS connection has been established with access to the SSLSession. Modifications ------------- This changeset introduces a new API to the OpenSslSession which allows to check if peer certs are available (hasPeerCertificates) and returns true if this is the case. Result ------ It is now possible to check if mTLS is enabled (through checking if peer certs are presented) without throwing an exception if not. --------- Co-authored-by: Norman Maurer <[email protected]>

…) (#14653) Motivation ---------- In a use-case where an application wants to check if a peer certificate has been provided without throwing an exception if none are found (as is currently the behavior when calling SSLSession#getPeerCertificates) there is currently no API available to do that. The use-case which prompted this addition is to defensively check if a mTLS connection has been established with access to the SSLSession. Modifications ------------- This changeset introduces a new API to the OpenSslSession which allows to check if peer certs are available (hasPeerCertificates) and returns true if this is the case. Result ------ It is now possible to check if mTLS is enabled (through checking if peer certs are presented) without throwing an exception if not. Co-authored-by: Michael Nitschinger <[email protected]>

daschl requested review from chrisvest and normanmaurer January 7, 2025 10:45

idelpivnitskiy approved these changes Jan 7, 2025

View reviewed changes

chrisvest reviewed Jan 7, 2025

View reviewed changes