/**
 * Create a SNI detection handler with configured {@link SslContext}
 * maintained by {@link DomainNameMapping}
 *
 * @param mapping the mapping of domain name to {@link SslContext}
 */
@SuppressWarnings("unchecked")
public SniHandler(DomainNameMapping<? extends SslContext> mapping) {
    if (mapping == null) {
        throw new NullPointerException("mapping");
    }

    this.mapping = (DomainNameMapping<SslContext>) mapping;
    handshaken = false;
}
 

@Test
public void testFallbackToDefaultContext() throws Exception {
    SslContext nettyContext = makeSslContext();
    SslContext leanContext = makeSslContext();
    SslContext leanContext2 = makeSslContext();

    DomainNameMapping<SslContext> mapping = new DomainNameMapping<SslContext>(nettyContext);
    mapping.add("*.netty.io", nettyContext);

    // input with custom cases
    mapping.add("*.LEANCLOUD.CN", leanContext);

    // a hostname conflict with previous one, since we are using order-sensitive config, the engine won't
    // be used with the handler.
    mapping.add("chat4.leancloud.cn", leanContext2);

    SniHandler handler = new SniHandler(mapping);
    EmbeddedChannel ch = new EmbeddedChannel(handler);

    // invalid
    byte[] message = { 22, 3, 1, 0, 0 };

    try {
        // Push the handshake message.
        ch.writeInbound(Unpooled.wrappedBuffer(message));
    } catch (Exception e) {
        // expected
    }

    assertThat(ch.finish(), is(false));
    assertThat(handler.hostname(), nullValue());
    assertThat(handler.sslContext(), is(nettyContext));
}
 

@Test(expected = DecoderException.class)
public void testNonAsciiServerNameParsing() throws Exception {
    SslContext nettyContext = makeSslContext(provider, false);
    SslContext leanContext = makeSslContext(provider, false);
    SslContext leanContext2 = makeSslContext(provider, false);

    try {
        DomainNameMapping<SslContext> mapping = new DomainNameMappingBuilder<SslContext>(nettyContext)
                .add("*.netty.io", nettyContext)
                // input with custom cases
                .add("*.LEANCLOUD.CN", leanContext)
                // a hostname conflict with previous one, since we are using order-sensitive config,
                // the engine won't be used with the handler.
                .add("chat4.leancloud.cn", leanContext2)
                .build();

        SniHandler handler = new SniHandler(mapping);
        EmbeddedChannel ch = new EmbeddedChannel(handler);

        try {
            // hex dump of a client hello packet, which contains an invalid hostname "CHAT4。LEANCLOUD。CN"
            String tlsHandshakeMessageHex1 = "16030100";
            // part 2
            String tlsHandshakeMessageHex = "bd010000b90303a74225676d1814ba57faff3b366" +
                    "3656ed05ee9dbb2a4dbb1bb1c32d2ea5fc39e0000000100008c0000001700150000164348" +
                    "415434E380824C45414E434C4F5544E38082434E000b000403000102000a00340032000e0" +
                    "00d0019000b000c00180009000a0016001700080006000700140015000400050012001300" +
                    "0100020003000f0010001100230000000d0020001e0601060206030501050205030401040" +
                    "20403030103020303020102020203000f00010133740000";

            // Push the handshake message.
            // Decode should fail because of the badly encoded "HostName" string in the SNI extension
            // that isn't ASCII as per RFC 6066 - https://tools.ietf.org/html/rfc6066#page-6
            ch.writeInbound(Unpooled.wrappedBuffer(StringUtil.decodeHexDump(tlsHandshakeMessageHex1)));
            ch.writeInbound(Unpooled.wrappedBuffer(StringUtil.decodeHexDump(tlsHandshakeMessageHex)));
        } finally {
            ch.finishAndReleaseAll();
        }
    } finally {
        releaseAll(leanContext, leanContext2, nettyContext);
    }
}
 

@Test
public void testFallbackToDefaultContext() throws Exception {
    SslContext nettyContext = makeSslContext(provider, false);
    SslContext leanContext = makeSslContext(provider, false);
    SslContext leanContext2 = makeSslContext(provider, false);

    try {
        DomainNameMapping<SslContext> mapping = new DomainNameMappingBuilder<SslContext>(nettyContext)
                .add("*.netty.io", nettyContext)
                // input with custom cases
                .add("*.LEANCLOUD.CN", leanContext)
                // a hostname conflict with previous one, since we are using order-sensitive config,
                // the engine won't be used with the handler.
                .add("chat4.leancloud.cn", leanContext2)
                .build();

        SniHandler handler = new SniHandler(mapping);
        EmbeddedChannel ch = new EmbeddedChannel(handler);

        // invalid
        byte[] message = {22, 3, 1, 0, 0};
        try {
            // Push the handshake message.
            ch.writeInbound(Unpooled.wrappedBuffer(message));
            // TODO(scott): This should fail becasue the engine should reject zero length records during handshake.
            // See https://github.com/netty/netty/issues/6348.
            // fail();
        } catch (Exception e) {
            // expected
        }

        ch.close();

        // When the channel is closed the SslHandler will write an empty buffer to the channel.
        ByteBuf buf = ch.readOutbound();
        // TODO(scott): if the engine is shutdown correctly then this buffer shouldn't be null!
        // See https://github.com/netty/netty/issues/6348.
        if (buf != null) {
            assertFalse(buf.isReadable());
            buf.release();
        }

        assertThat(ch.finish(), is(false));
        assertThat(handler.hostname(), nullValue());
        assertThat(handler.sslContext(), is(nettyContext));
    } finally {
        releaseAll(leanContext, leanContext2, nettyContext);
    }
}
 

/**
 * New instance.
 * @param domainNameMapping to use for configuring SSL.
 */
public SslServerChannelInitializer(DomainNameMapping<SslContext> domainNameMapping) {
    this.domainNameMapping = requireNonNull(domainNameMapping);
    sslContext = null;
}
 

SniHandlerWithPooledAllocator(final DomainNameMapping<SslContext> domainNameMapping) {
    super(domainNameMapping);
}
 

@Test
public void testServerNameParsing() throws Exception {
    SslContext nettyContext = makeSslContext();
    SslContext leanContext = makeSslContext();
    SslContext leanContext2 = makeSslContext();

    DomainNameMapping<SslContext> mapping = new DomainNameMapping<SslContext>(nettyContext);
    mapping.add("*.netty.io", nettyContext);

    // input with custom cases
    mapping.add("*.LEANCLOUD.CN", leanContext);

    // a hostname conflict with previous one, since we are using order-sensitive config, the engine won't
    // be used with the handler.
    mapping.add("chat4.leancloud.cn", leanContext2);

    SniHandler handler = new SniHandler(mapping);
    EmbeddedChannel ch = new EmbeddedChannel(handler);

    // hex dump of a client hello packet, which contains hostname "CHAT4。LEANCLOUD。CN"
    String tlsHandshakeMessageHex1 = "16030100";
    // part 2
    String tlsHandshakeMessageHex = "bd010000b90303a74225676d1814ba57faff3b366" +
            "3656ed05ee9dbb2a4dbb1bb1c32d2ea5fc39e0000000100008c0000001700150000164348" +
            "415434E380824C45414E434C4F5544E38082434E000b000403000102000a00340032000e0" +
            "00d0019000b000c00180009000a0016001700080006000700140015000400050012001300" +
            "0100020003000f0010001100230000000d0020001e0601060206030501050205030401040" +
            "20403030103020303020102020203000f00010133740000";

    try {
        // Push the handshake message.
        // Decode should fail because SNI error
        ch.writeInbound(Unpooled.wrappedBuffer(DatatypeConverter.parseHexBinary(tlsHandshakeMessageHex1)));
        ch.writeInbound(Unpooled.wrappedBuffer(DatatypeConverter.parseHexBinary(tlsHandshakeMessageHex)));
        fail();
    } catch (DecoderException e) {
        // expected
    }

    assertThat(ch.finish(), is(false));
    assertThat(handler.hostname(), is("chat4.leancloud.cn"));
    assertThat(handler.sslContext(), is(leanContext));
}
 

/**
 * Creates a SNI detection handler with configured {@link SslContext}
 * maintained by {@link DomainNameMapping}
 * 使用由DomainNameMapping维护的配置SslContext创建SNI检测处理程序
 *
 * @param mapping the mapping of domain name to {@link SslContext}
 */
public SniHandler(DomainNameMapping<? extends SslContext> mapping) {
    this((Mapping<String, ? extends SslContext>) mapping);
}
 

/**
 * Gets {@link DomainNameMapping}, if any.
 *
 * @return Configured mapping, {@code null} if none configured
 */
@Nullable
public DomainNameMapping<SslContext> domainNameMapping() {
    return mappings;
}