import org.xnio.SslClientAuthMode; //导入依赖的package包/类
@Override
public Certificate[] getPeerCertificates() throws SSLPeerUnverifiedException, RenegotiationRequiredException {
    try {
        return channel.getSslSession().getPeerCertificates();
    } catch (SSLPeerUnverifiedException e) {
        try {
            SslClientAuthMode sslClientAuthMode = channel.getOption(Options.SSL_CLIENT_AUTH_MODE);
            if (sslClientAuthMode == SslClientAuthMode.NOT_REQUESTED) {
                throw new RenegotiationRequiredException();
            }
        } catch (IOException e1) {
            //ignore, will not actually happen
        }
        throw e;
    }
}
 

import org.xnio.SslClientAuthMode; //导入依赖的package包/类
@Override
public X509Certificate[] getPeerCertificateChain() throws SSLPeerUnverifiedException, RenegotiationRequiredException {
    try {
        return channel.getSslSession().getPeerCertificateChain();
    } catch (SSLPeerUnverifiedException e) {
        try {
            SslClientAuthMode sslClientAuthMode = channel.getOption(Options.SSL_CLIENT_AUTH_MODE);
            if (sslClientAuthMode == SslClientAuthMode.NOT_REQUESTED) {
                throw new RenegotiationRequiredException();
            }
        } catch (IOException e1) {
            //ignore, will not actually happen
        }
        throw e;
    }
}
 

import org.xnio.SslClientAuthMode; //导入依赖的package包/类
private static ManagementHttpServer create(Builder builder) {
    SSLContext sslContext = null;
    SslClientAuthMode sslClientAuthMode = builder.sslClientAuthMode;
    if (builder.secureBindAddress != null) {
        sslContext = getSSLContext(builder);
        if (sslContext == null) {
            throw ROOT_LOGGER.sslRequestedNoSslContext();
        }
    }

    HttpOpenListener openListener = new HttpOpenListener(new ByteBufferSlicePool(BufferAllocator.DIRECT_BYTE_BUFFER_ALLOCATOR, 4096, 10 * 4096));

    int secureRedirectPort = builder.secureBindAddress != null ? builder.secureBindAddress.getPort() : -1;
    // WFLY-2870 -- redirect not supported if bindAddress and secureBindAddress are using different InetAddress
    boolean redirectSupported = (builder.bindAddress == null || builder.secureBindAddress == null || builder.bindAddress.getAddress().equals(builder.secureBindAddress.getAddress()));
    if (!redirectSupported && secureRedirectPort > 0) {
        HttpServerLogger.ROOT_LOGGER.httpsRedirectNotSupported(builder.bindAddress.getAddress(), builder.secureBindAddress.getAddress());
        secureRedirectPort = -1;
    }

    final ExtensionHandlers extensionHandlers = setupOpenListener(openListener, secureRedirectPort, builder);
    return new ManagementHttpServer(openListener, builder.bindAddress, builder.secureBindAddress, sslContext, sslClientAuthMode, builder.worker, extensionHandlers);
}
 

import org.xnio.SslClientAuthMode; //导入依赖的package包/类
@Override
public void renegotiate(HttpServerExchange exchange, SslClientAuthMode sslClientAuthMode) throws IOException {
    if (exchange.isRequestComplete()) {
        renegotiateNoRequest(exchange, sslClientAuthMode);
    } else {
        renegotiateBufferRequest(exchange, sslClientAuthMode);
    }
}
 

import org.xnio.SslClientAuthMode; //导入依赖的package包/类
public void renegotiateNoRequest(HttpServerExchange exchange, SslClientAuthMode newAuthMode) throws IOException {
    AbstractServerConnection.ConduitState oldState = serverConnection.resetChannel();
    try {
        SslClientAuthMode sslClientAuthMode = channel.getOption(Options.SSL_CLIENT_AUTH_MODE);
        if (sslClientAuthMode == SslClientAuthMode.NOT_REQUESTED) {
            SslHandshakeWaiter waiter = new SslHandshakeWaiter();
            channel.getHandshakeSetter().set(waiter);
            //we use requested, to place nicely with other auth modes
            channel.setOption(Options.SSL_CLIENT_AUTH_MODE, newAuthMode);
            channel.getSslSession().invalidate();
            channel.startHandshake();
            ByteBuffer buff = ByteBuffer.wrap(new byte[1]);
            while (!waiter.isDone() && serverConnection.isOpen()) {
                int read = serverConnection.getSourceChannel().read(buff);
                if (read != 0) {
                    throw new SSLPeerUnverifiedException("");
                }
                if (!waiter.isDone()) {
                    serverConnection.getSourceChannel().awaitReadable();
                }
            }
        }
    } finally {
        if (oldState != null) {
            serverConnection.restoreChannel(oldState);
        }
    }
}
 

import org.xnio.SslClientAuthMode; //导入依赖的package包/类
private SslClientAuthMode getSslClientAuthMode(Ssl ssl) {
	if (ssl.getClientAuth() == ClientAuth.NEED) {
		return SslClientAuthMode.REQUIRED;
	}
	if (ssl.getClientAuth() == ClientAuth.WANT) {
		return SslClientAuthMode.REQUESTED;
	}
	return SslClientAuthMode.NOT_REQUESTED;
}
 

import org.xnio.SslClientAuthMode; //导入依赖的package包/类
private ManagementHttpServer(HttpOpenListener openListener, InetSocketAddress httpAddress, InetSocketAddress secureAddress, SSLContext sslContext,
                             SslClientAuthMode sslClientAuthMode, XnioWorker worker, ExtensionHandlers extensionExtensionHandlers) {
    this.openListener = openListener;
    this.httpAddress = httpAddress;
    this.secureAddress = secureAddress;
    this.sslContext = sslContext;
    this.sslClientAuthMode = sslClientAuthMode;
    this.worker = worker;
    this.extensionHandlers = extensionExtensionHandlers;
}
 

import org.xnio.SslClientAuthMode; //导入依赖的package包/类
private static SslClientAuthMode getSslClientAuthMode(final SecurityRealm securityRealm) {
    Set<AuthMechanism> supportedMechanisms = securityRealm.getSupportedAuthenticationMechanisms();
    if (supportedMechanisms.contains(AuthMechanism.CLIENT_CERT)) {
        if (supportedMechanisms.contains(AuthMechanism.DIGEST)
                || supportedMechanisms.contains(AuthMechanism.PLAIN)) {
            // Username / Password auth is possible so don't mandate a client certificate.
            return SslClientAuthMode.REQUESTED;
        } else {
            return SslClientAuthMode.REQUIRED;
        }
    }

    return null;
}
 

import org.xnio.SslClientAuthMode; //导入依赖的package包/类
@Override
public void renegotiate(HttpServerExchange exchange, SslClientAuthMode sslClientAuthMode) throws IOException {
    throw UndertowMessages.MESSAGES.renegotiationNotSupported();
}
 

import org.xnio.SslClientAuthMode; //导入依赖的package包/类
/**
 * Set the SSL client authentication mode.
 *
 * Note: This should only be used for {@link SecurityRealm} provided {@link SSLContext} instances.
 *
 * @param sslClientAuthMode the SSL client authentication mode.
 * @return {@code this} to allow chaining of commands.
 */
public Builder setSSLClientAuthMode(SslClientAuthMode sslClientAuthMode) {
    assertNotBuilt();
    this.sslClientAuthMode = sslClientAuthMode;

    return this;
}
 

import org.xnio.SslClientAuthMode; //导入依赖的package包/类
/**
 * Renegotiate in a blocking manner. This will set the client aut
 *
 * TODO: we also need a non-blocking version
 *
 * @throws IOException
 * @param exchange The exchange
 * @param sslClientAuthMode The client cert mode to use when renegotiating
 */
void renegotiate(HttpServerExchange exchange, SslClientAuthMode sslClientAuthMode) throws IOException;