Read IPs from SSLEngine session

When SSLEngine is used IPs cannot be retrieved from the socket or stream proxies so they are stored into the SSLEngine session. This is an extension to the standard because the SSLEngine should be unaware of the underlying communication but it is needed for the audit.
dogtagpki · Jun 23, 2023 · 4b50c69 · 4b50c69
1 parent 9bafa9e
commit 4b50c69
Showing 1 changed file with 19 additions and 11 deletions.
diff --git a/base/server/src/main/java/org/dogtagpki/server/PKIServerSocketListener.java b/base/server/src/main/java/org/dogtagpki/server/PKIServerSocketListener.java
@@ -81,7 +81,7 @@ public void alertReceived(SSLAlertEvent event) {
 
         try {
             SSLSocket socket = event.getSocket();
-            JSSEngine engine = event.getEngine();
+            JSSEngine sslEngine = event.getEngine();
 
             InetAddress clientAddress = null;
             InetAddress serverAddress = null;
@@ -107,8 +107,8 @@ public void alertReceived(SSLAlertEvent event) {
                 Principal subjectDN = peerCertificate == null ? null : peerCertificate.getSubjectDN();
                 subjectID = subjectDN == null ? "" : subjectDN.toString();
             } else {
-                if(engine != null) {
-                    JSSSession session = engine.getSession();
+                if(sslEngine != null) {
+                    JSSSession session = sslEngine.getSession();
                     if(session != null) {
                         Certificate[] certs = session.getPeerCertificates();
                         if(certs != null) {
@@ -117,6 +117,8 @@ public void alertReceived(SSLAlertEvent event) {
                                 subjectID = cert.getSubjectDN().toString();
                             }
                         }
+                        clientIP = session.getRemoteAddr();
+                        serverIP = session.getLocalAddr();
                     }
                 }
             }
@@ -151,7 +153,7 @@ public void alertSent(SSLAlertEvent event) {
 
         try {
             SSLSocket socket = event.getSocket();
-            JSSEngine engine = event.getEngine();
+            JSSEngine sslEngine = event.getEngine();
 
             int description = event.getDescription();
             String reason = "serverAlertSent: " + SSLAlertDescription.valueOf(description).toString();
@@ -173,14 +175,16 @@ public void alertSent(SSLAlertEvent event) {
                 serverIP = (String)info.get("serverIP");
                 subjectID = (String)info.get("subjectID");
             } else {
-                if(engine != null) {
-                    JSSSession session = engine.getSession();
+                if(sslEngine != null) {
+                    JSSSession session = sslEngine.getSession();
                     if(session != null) {
                         Certificate[] certs = session.getPeerCertificates();
                         if(certs != null) {
                              X509Certificate cert = (X509Certificate) certs[0];
                              subjectID = cert.getSubjectDN().toString();
                         }
+                        clientIP = session.getRemoteAddr();
+                        serverIP = session.getLocalAddr();
                     }
                 }
             }
@@ -205,8 +209,8 @@ public void alertSent(SSLAlertEvent event) {
                     subjectID = subjectDN == null ? "" : subjectDN.toString();
 
                } else {
-                   if(engine != null) {
-                        JSSSession session = engine.getSession();
+                   if(sslEngine != null) {
+                        JSSSession session = sslEngine.getSession();
                         if(session != null) {
                             Certificate[] certs = session.getPeerCertificates();
                             if(certs != null) {
@@ -215,6 +219,8 @@ public void alertSent(SSLAlertEvent event) {
                                      subjectID = cert.getSubjectDN().toString();
                                  }
                             }
+                            clientIP = session.getRemoteAddr();
+                            serverIP = session.getLocalAddr();
                         }
                     }
                 }
@@ -250,7 +256,7 @@ public void handshakeCompleted(SSLHandshakeCompletedEvent event) {
 
         try {
             SSLSocket socket = event.getSocket();
-            JSSEngine engine = event.getEngine();
+            JSSEngine sslEngine = event.getEngine();
 
             InetAddress clientAddress = null;
             InetAddress serverAddress = null;
@@ -278,8 +284,8 @@ public void handshakeCompleted(SSLHandshakeCompletedEvent event) {
                 info.put("subjectID", subjectID);
                 socketInfos.put(socket, info);
             } else {
-                if(engine != null) {
-                    JSSSession session = engine.getSession();
+                if(sslEngine != null) {
+                    JSSSession session = sslEngine.getSession();
                     if(session != null) {
                         Certificate[] certs = session.getPeerCertificates();
                         if(certs != null) {
@@ -289,6 +295,8 @@ public void handshakeCompleted(SSLHandshakeCompletedEvent event) {
                             }
                         }
                     }
+                    clientIP = session.getRemoteAddr();
+                    serverIP = session.getLocalAddr();
                 }
             }
             logger.debug("PKIServerSocketListener: Handshake completed:");