New BoringSSL context option - SSL_CTX_set1_sigalgs

[jaymansfield]

My use case of this library had the requirement to use a different signing algorithm and certificate type (ed25519 to be specific).

Changes:

• New BoringSSL context option - SSL_CTX_set1_sigalgs (this expands on Allow to configure groups via BoringSSLContextOption #755 )
• Allowing certificate types in certificate callback to be modified (allows the implementer to override the defaults and use any certificate type they want now)

Result:

This increases the overall flexibility of the quic implementation.

[jaymansfield]

@normanmaurer Two new SSLContextOption's have been added for client and server certificate/key types

[normanmaurer]

LGTM @jaymansfield did you sign our icla yet ? https://netty.io/s/icla

[jaymansfield]

LGTM @jaymansfield did you sign our icla yet ? https://netty.io/s/icla

Yes just now.

[normanmaurer]

@jaymansfield thanks a lot... will merge when the build passed.

[normanmaurer]

@jaymansfield would it be possible to add a unit test as well ?

[normanmaurer]

I think this would fit well in QuicChannelConnectTest

[jaymansfield]

I think this would fit well in QuicChannelConnectTest

I added two very basic ones for the key type change. One that passes by allowing only RSA keys (using your existing self signed test certificate which is RSA), and one that is expected to fail since the self signed certificate doesn't match the newly specific key type (EdDSA) in the test case

[normanmaurer]

@jaymansfield please apply this change:

diff --git a/codec-native-quic/src/test/java/io/netty/incubator/codec/quic/QuicChannelConnectTest.java b/codec-native-quic/src/test/java/io/netty/incubator/codec/quic/QuicChannelConnectTest.java
index 099d244..c78436c 100644
--- a/codec-native-quic/src/test/java/io/netty/incubator/codec/quic/QuicChannelConnectTest.java
+++ b/codec-native-quic/src/test/java/io/netty/incubator/codec/quic/QuicChannelConnectTest.java
@@ -27,6 +27,7 @@ import io.netty.channel.ChannelOutboundHandlerAdapter;
 import io.netty.channel.ChannelPromise;
 import io.netty.channel.ConnectTimeoutException;
 import io.netty.channel.socket.ChannelInputShutdownEvent;
+import io.netty.handler.codec.ByteToMessageDecoder;
 import io.netty.handler.ssl.ClientAuth;
 import io.netty.handler.ssl.SniCompletionEvent;
 import io.netty.handler.ssl.SslHandshakeCompletionEvent;
@@ -69,8 +70,18 @@ import java.security.cert.CertificateException;
 import java.security.cert.X509Certificate;
 import java.security.spec.MGF1ParameterSpec;
 import java.security.spec.PSSParameterSpec;
-import java.util.*;
-import java.util.concurrent.*;
+import java.util.ArrayList;
+import java.util.HashMap;
+import java.util.HashSet;
+import java.util.List;
+import java.util.Map;
+import java.util.Set;
+import java.util.concurrent.BlockingQueue;
+import java.util.concurrent.CountDownLatch;
+import java.util.concurrent.ExecutionException;
+import java.util.concurrent.Executor;
+import java.util.concurrent.LinkedBlockingQueue;
+import java.util.concurrent.TimeUnit;
 import java.util.concurrent.atomic.AtomicBoolean;
 import java.util.concurrent.atomic.AtomicReference;
 import java.util.function.Consumer;
@@ -741,24 +752,16 @@ public class QuicChannelConnectTest extends AbstractQuicTest {
                     public boolean isSharable() {
                         return true;
                     }
-                }, new ChannelInboundHandlerAdapter() {
+                }, new ByteToMessageDecoder() {
                     @Override
-                    public boolean isSharable() {
-                        return true;
-                    }
-
-                    @Override
-                    public void channelRead(ChannelHandlerContext ctx, Object msg) {
-                        ByteBuf buffer = (ByteBuf) msg;
-                        try {
-                            assertEquals(4, buffer.readableBytes());
-                            assertEquals(5, buffer.readInt());
-                            readLatch.countDown();
-
-                            ctx.close();
-                        } finally {
-                            buffer.release();
+                    protected void decode(ChannelHandlerContext ctx, ByteBuf msg, List<Object> out) throws Exception {
+                        if (msg.readableBytes() < 4) {
+                            return;
                         }
+                        assertEquals(5, msg.readInt());
+                        readLatch.countDown();
+
+                        ctx.close();
                     }
                 });
 

[jaymansfield]

@jaymansfield please apply this change:

diff --git a/codec-native-quic/src/test/java/io/netty/incubator/codec/quic/QuicChannelConnectTest.java b/codec-native-quic/src/test/java/io/netty/incubator/codec/quic/QuicChannelConnectTest.java
index 099d244..c78436c 100644
--- a/codec-native-quic/src/test/java/io/netty/incubator/codec/quic/QuicChannelConnectTest.java
+++ b/codec-native-quic/src/test/java/io/netty/incubator/codec/quic/QuicChannelConnectTest.java
@@ -27,6 +27,7 @@ import io.netty.channel.ChannelOutboundHandlerAdapter;
 import io.netty.channel.ChannelPromise;
 import io.netty.channel.ConnectTimeoutException;
 import io.netty.channel.socket.ChannelInputShutdownEvent;
+import io.netty.handler.codec.ByteToMessageDecoder;
 import io.netty.handler.ssl.ClientAuth;
 import io.netty.handler.ssl.SniCompletionEvent;
 import io.netty.handler.ssl.SslHandshakeCompletionEvent;
@@ -69,8 +70,18 @@ import java.security.cert.CertificateException;
 import java.security.cert.X509Certificate;
 import java.security.spec.MGF1ParameterSpec;
 import java.security.spec.PSSParameterSpec;
-import java.util.*;
-import java.util.concurrent.*;
+import java.util.ArrayList;
+import java.util.HashMap;
+import java.util.HashSet;
+import java.util.List;
+import java.util.Map;
+import java.util.Set;
+import java.util.concurrent.BlockingQueue;
+import java.util.concurrent.CountDownLatch;
+import java.util.concurrent.ExecutionException;
+import java.util.concurrent.Executor;
+import java.util.concurrent.LinkedBlockingQueue;
+import java.util.concurrent.TimeUnit;
 import java.util.concurrent.atomic.AtomicBoolean;
 import java.util.concurrent.atomic.AtomicReference;
 import java.util.function.Consumer;
@@ -741,24 +752,16 @@ public class QuicChannelConnectTest extends AbstractQuicTest {
                     public boolean isSharable() {
                         return true;
                     }
-                }, new ChannelInboundHandlerAdapter() {
+                }, new ByteToMessageDecoder() {
                     @Override
-                    public boolean isSharable() {
-                        return true;
-                    }
-
-                    @Override
-                    public void channelRead(ChannelHandlerContext ctx, Object msg) {
-                        ByteBuf buffer = (ByteBuf) msg;
-                        try {
-                            assertEquals(4, buffer.readableBytes());
-                            assertEquals(5, buffer.readInt());
-                            readLatch.countDown();
-
-                            ctx.close();
-                        } finally {
-                            buffer.release();
+                    protected void decode(ChannelHandlerContext ctx, ByteBuf msg, List<Object> out) throws Exception {
+                        if (msg.readableBytes() < 4) {
+                            return;
                         }
+                        assertEquals(5, msg.readInt());
+                        readLatch.countDown();
+
+                        ctx.close();
                     }
                 });
 

Thanks for this! Done.

[normanmaurer]

Almost there... two more things. After this we can merge

[normanmaurer]

@jaymansfield thanks a lot again