File 0007-Revert-Support-session-cache-for-client-an... of Package netty

Overview Repositories Revisions Requests Users Attributes Meta

File 0007-Revert-Support-session-cache-for-client-and-server-w.patch of Package netty (Revision 060333f738bd1de8f53dee6e62c2adbc)

Currently displaying revision 060333f738bd1de8f53dee6e62c2adbc , Show latest

From cb84a4f349059bde42a2867c0fdf08bcc4d1ba3b Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Fridrich=20=C5=A0trba?= <fridrich.strba@bluewin.ch>
Date: Thu, 11 Mar 2021 12:08:33 +0100
Subject: [PATCH 7/7] Revert "Support session cache for client and server when
 using native SSLEngine implementation (#10994)"

This reverts commit 7d4aaa268b8a536f61fbc7711365147c58238745.
---
 .../handler/ssl/ExtendedOpenSslSession.java   |  72 +--
 .../io/netty/handler/ssl/JdkSslContext.java   |  10 +
 .../ssl/OpenSslClientSessionCache.java        | 138 -----
 .../io/netty/handler/ssl/OpenSslSession.java  |  32 +-
 .../handler/ssl/OpenSslSessionCache.java      | 492 ------------------
 .../netty/handler/ssl/OpenSslSessionId.java   |  66 ---
 .../java/io/netty/handler/ssl/SslContext.java |   8 +-
 .../ssl/util/LazyJavaxX509Certificate.java    |   8 -
 .../ssl/ConscryptJdkSslEngineInteropTest.java |   8 -
 .../ConscryptOpenSslEngineInteropTest.java    |   8 -
 .../handler/ssl/ConscryptSslEngineTest.java   |  15 -
 .../ssl/JdkConscryptSslEngineInteropTest.java |  20 +-
 .../ssl/JdkOpenSslEngineInteroptTest.java     |   2 -
 .../OpenSslConscryptSslEngineInteropTest.java |   8 -
 .../netty/handler/ssl/OpenSslEngineTest.java  |  52 --
 .../ssl/OpenSslJdkSslEngineInteroptTest.java  |   3 +-
 .../ReferenceCountedOpenSslEngineTest.java    |   2 -
 .../io/netty/handler/ssl/SSLEngineTest.java   | 331 +-----------
 .../io/netty/handler/ssl/SslHandlerTest.java  |  75 +--
 19 files changed, 52 insertions(+), 1298 deletions(-)
 delete mode 100644 handler/src/main/java/io/netty/handler/ssl/OpenSslClientSessionCache.java
 delete mode 100644 handler/src/main/java/io/netty/handler/ssl/OpenSslSessionCache.java
 delete mode 100644 handler/src/main/java/io/netty/handler/ssl/OpenSslSessionId.java

diff --git a/handler/src/main/java/io/netty/handler/ssl/ExtendedOpenSslSession.java b/handler/src/main/java/io/netty/handler/ssl/ExtendedOpenSslSession.java
index 5924325893..79acea7686 100644
--- a/handler/src/main/java/io/netty/handler/ssl/ExtendedOpenSslSession.java
+++ b/handler/src/main/java/io/netty/handler/ssl/ExtendedOpenSslSession.java
@@ -15,14 +15,12 @@
  */
 package io.netty.handler.ssl;
 
-import io.netty.util.internal.EmptyArrays;
 import io.netty.util.internal.SuppressJava6Requirement;
 
 import javax.net.ssl.ExtendedSSLSession;
 import javax.net.ssl.SSLException;
 import javax.net.ssl.SSLPeerUnverifiedException;
-import javax.net.ssl.SSLSessionBindingEvent;
-import javax.net.ssl.SSLSessionBindingListener;
+import javax.net.ssl.SSLSessionContext;
 import javax.security.cert.X509Certificate;
 import java.security.Principal;
 import java.security.cert.Certificate;
@@ -64,23 +62,8 @@ abstract class ExtendedOpenSslSession extends ExtendedSSLSession implements Open
     }
 
     @Override
-    public OpenSslSessionId sessionId() {
-        return wrapped.sessionId();
-    }
-
-    @Override
-    public void setSessionId(OpenSslSessionId id) {
-        wrapped.setSessionId(id);
-    }
-
-    @Override
-    public final void setLocalCertificate(Certificate[] localCertificate) {
-        wrapped.setLocalCertificate(localCertificate);
-    }
-
-    @Override
-    public String[] getPeerSupportedSignatureAlgorithms() {
-        return EmptyArrays.EMPTY_STRINGS;
+    public final void handshakeFinished() throws SSLException {
+        wrapped.handshakeFinished();
     }
 
     @Override
@@ -99,7 +82,7 @@ abstract class ExtendedOpenSslSession extends ExtendedSSLSession implements Open
     }
 
     @Override
-    public final OpenSslSessionContext getSessionContext() {
+    public final SSLSessionContext getSessionContext() {
         return wrapped.getSessionContext();
     }
 
@@ -124,22 +107,13 @@ abstract class ExtendedOpenSslSession extends ExtendedSSLSession implements Open
     }
 
     @Override
-    public final void putValue(String name, Object value) {
-        if (value instanceof SSLSessionBindingListener) {
-            // Decorate the value if needed so we submit the correct SSLSession instance
-            value = new SSLSessionBindingListenerDecorator((SSLSessionBindingListener) value);
-        }
-        wrapped.putValue(name, value);
+    public final void putValue(String s, Object o) {
+        wrapped.putValue(s, o);
     }
 
     @Override
     public final Object getValue(String s) {
-        Object value =  wrapped.getValue(s);
-        if (value instanceof SSLSessionBindingListenerDecorator) {
-            // Unwrap as needed so we return the original value
-            return ((SSLSessionBindingListenerDecorator) value).delegate;
-        }
-        return value;
+        return wrapped.getValue(s);
     }
 
     @Override
@@ -206,36 +180,4 @@ abstract class ExtendedOpenSslSession extends ExtendedSSLSession implements Open
     public final int getApplicationBufferSize() {
         return wrapped.getApplicationBufferSize();
     }
-
-    private final class SSLSessionBindingListenerDecorator implements SSLSessionBindingListener {
-
-        final SSLSessionBindingListener delegate;
-
-        SSLSessionBindingListenerDecorator(SSLSessionBindingListener delegate) {
-            this.delegate = delegate;
-        }
-
-        @Override
-        public void valueBound(SSLSessionBindingEvent event) {
-            delegate.valueBound(new SSLSessionBindingEvent(ExtendedOpenSslSession.this, event.getName()));
-        }
-
-        @Override
-        public void valueUnbound(SSLSessionBindingEvent event) {
-            delegate.valueUnbound(new SSLSessionBindingEvent(ExtendedOpenSslSession.this, event.getName()));
-        }
-    }
-
-    @Override
-    public void handshakeFinished(byte[] id, String cipher, String protocol, byte[] peerCertificate,
-                                  byte[][] peerCertificateChain, long creationTime, long timeout) throws SSLException {
-        wrapped.handshakeFinished(id, cipher, protocol, peerCertificate, peerCertificateChain, creationTime, timeout);
-    }
-
-    @Override
-    public String toString() {
-        return "ExtendedOpenSslSession{" +
-                "wrapped=" + wrapped +
-                '}';
-    }
 }
diff --git a/handler/src/main/java/io/netty/handler/ssl/JdkSslContext.java b/handler/src/main/java/io/netty/handler/ssl/JdkSslContext.java
index a452924829..48e5237863 100644
--- a/handler/src/main/java/io/netty/handler/ssl/JdkSslContext.java
+++ b/handler/src/main/java/io/netty/handler/ssl/JdkSslContext.java
@@ -316,6 +316,16 @@ public class JdkSslContext extends SslContext {
         return unmodifiableCipherSuites;
     }
 
+    @Override
+    public final long sessionCacheSize() {
+        return sessionContext().getSessionCacheSize();
+    }
+
+    @Override
+    public final long sessionTimeout() {
+        return sessionContext().getSessionTimeout();
+    }
+
     @Override
     public final SSLEngine newEngine(ByteBufAllocator alloc) {
         return configureAndWrapEngine(context().createSSLEngine(), alloc);
diff --git a/handler/src/main/java/io/netty/handler/ssl/OpenSslClientSessionCache.java b/handler/src/main/java/io/netty/handler/ssl/OpenSslClientSessionCache.java
deleted file mode 100644
index f0c6daf4f6..0000000000
--- a/handler/src/main/java/io/netty/handler/ssl/OpenSslClientSessionCache.java
+++ /dev/null
@@ -1,138 +0,0 @@
-/*
- * Copyright 2021 The Netty Project
- *
- * The Netty Project licenses this file to you under the Apache License,
- * version 2.0 (the "License"); you may not use this file except in compliance
- * with the License. You may obtain a copy of the License at:
- *
- *   https://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
- * WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the
- * License for the specific language governing permissions and limitations
- * under the License.
- */
-package io.netty.handler.ssl;
-
-import io.netty.internal.tcnative.SSL;
-import io.netty.util.AsciiString;
-
-import java.util.HashMap;
-import java.util.Map;
-
-/**
- * {@link OpenSslSessionCache} that is used by the client-side.
- */
-final class OpenSslClientSessionCache extends OpenSslSessionCache {
-    // TODO: Should we support to have a List of OpenSslSessions for a Host/Port key and so be able to
-    // support sessions for different protocols / ciphers to the same remote peer ?
-    private final Map<HostPort, NativeSslSession> sessions = new HashMap<HostPort, NativeSslSession>();
-
-    OpenSslClientSessionCache(OpenSslEngineMap engineMap) {
-        super(engineMap);
-    }
-
-    @Override
-    protected boolean sessionCreated(NativeSslSession session) {
-        assert Thread.holdsLock(this);
-        HostPort hostPort = keyFor(session.getPeerHost(), session.getPeerPort());
-        if (hostPort == null || sessions.containsKey(hostPort)) {
-            return false;
-        }
-        sessions.put(hostPort, session);
-        return true;
-    }
-
-    @Override
-    protected void sessionRemoved(NativeSslSession session) {
-        assert Thread.holdsLock(this);
-        HostPort hostPort = keyFor(session.getPeerHost(), session.getPeerPort());
-        if (hostPort == null) {
-            return;
-        }
-        sessions.remove(hostPort);
-    }
-
-    @Override
-    void setSession(long ssl, String host, int port) {
-        HostPort hostPort = keyFor(host, port);
-        if (hostPort == null) {
-            return;
-        }
-        final NativeSslSession session;
-        final boolean reused;
-        synchronized (this) {
-            session = sessions.get(hostPort);
-            if (session == null) {
-                return;
-            }
-            if (!session.isValid()) {
-                removeSessionWithId(session.sessionId());
-                return;
-            }
-            // Try to set the session, if true is returned OpenSSL incremented the reference count
-            // of the underlying SSL_SESSION*.
-            reused = SSL.setSession(ssl, session.session());
-        }
-
-        if (reused) {
-            if (session.shouldBeSingleUse()) {
-                // Should only be used once
-                session.invalidate();
-            }
-            session.updateLastAccessedTime();
-        }
-    }
-
-    private static HostPort keyFor(String host, int port) {
-        if (host == null && port < 1) {
-            return null;
-        }
-        return new HostPort(host, port);
-    }
-
-    @Override
-    synchronized void clear() {
-        super.clear();
-        sessions.clear();
-    }
-
-    /**
-     * Host / Port tuple used to find a {@link OpenSslSession} in the cache.
-     */
-    private static final class HostPort {
-        private final int hash;
-        private final String host;
-        private final int port;
-
-        HostPort(String host, int port) {
-            this.host = host;
-            this.port = port;
-            // Calculate a hashCode that does ignore case.
-            this.hash = 31 * AsciiString.hashCode(host) + port;
-        }
-
-        @Override
-        public int hashCode() {
-            return hash;
-        }
-
-        @Override
-        public boolean equals(Object obj) {
-            if (!(obj instanceof HostPort)) {
-                return false;
-            }
-            HostPort other = (HostPort) obj;
-            return port == other.port && host.equalsIgnoreCase(other.host);
-        }
-
-        @Override
-        public String toString() {
-            return "HostPort{" +
-                    "host='" + host + '\'' +
-                    ", port=" + port +
-                    '}';
-        }
-    }
-}
diff --git a/handler/src/main/java/io/netty/handler/ssl/OpenSslSession.java b/handler/src/main/java/io/netty/handler/ssl/OpenSslSession.java
index 4e6ef35d23..056d55f743 100644
--- a/handler/src/main/java/io/netty/handler/ssl/OpenSslSession.java
+++ b/handler/src/main/java/io/netty/handler/ssl/OpenSslSession.java
@@ -15,36 +15,16 @@
  */
 package io.netty.handler.ssl;
 
-import io.netty.util.ReferenceCounted;
-
 import javax.net.ssl.SSLException;
 import javax.net.ssl.SSLSession;
-import java.security.cert.Certificate;
 
-/**
- * {@link SSLSession} that is specific to our native implementation and {@link ReferenceCounted} to track native
- * resources.
- */
 interface OpenSslSession extends SSLSession {
 
     /**
-     * Return the {@link OpenSslSessionId} that can be used to identify this session.
-     */
-    OpenSslSessionId sessionId();
-
-    /**
-     * Set the local certificate chain that is used. It is not expected that this array will be changed at all
-     * and so its ok to not copy the array.
-     */
-    void setLocalCertificate(Certificate[] localCertificate);
-
-    /**
-     * Set the {@link OpenSslSessionId} for the {@link OpenSslSession}.
+     * Finish the handshake and so init everything in the {@link OpenSslSession} that should be accessible by
+     * the user.
      */
-    void setSessionId(OpenSslSessionId id);
-
-    @Override
-    OpenSslSessionContext getSessionContext();
+    void handshakeFinished() throws SSLException;
 
     /**
      * Expand (or increase) the value returned by {@link #getApplicationBufferSize()} if necessary.
@@ -53,10 +33,4 @@ interface OpenSslSession extends SSLSession {
      * @param packetLengthDataOnly The packet size which exceeds the current {@link #getApplicationBufferSize()}.
      */
     void tryExpandApplicationBufferSize(int packetLengthDataOnly);
-
-    /**
-     * Called once the handshake has completed.
-     */
-    void handshakeFinished(byte[] id, String cipher, String protocol, byte[] peerCertificate,
-                           byte[][] peerCertificateChain, long creationTime, long timeout) throws SSLException;
 }
diff --git a/handler/src/main/java/io/netty/handler/ssl/OpenSslSessionCache.java b/handler/src/main/java/io/netty/handler/ssl/OpenSslSessionCache.java
deleted file mode 100644
index 2881a457d9..0000000000
--- a/handler/src/main/java/io/netty/handler/ssl/OpenSslSessionCache.java
+++ /dev/null
@@ -1,492 +0,0 @@
-/*
- * Copyright 2021 The Netty Project
- *
- * The Netty Project licenses this file to you under the Apache License,
- * version 2.0 (the "License"); you may not use this file except in compliance
- * with the License. You may obtain a copy of the License at:
- *
- *   https://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
- * WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the
- * License for the specific language governing permissions and limitations
- * under the License.
- */
-package io.netty.handler.ssl;
-
-import io.netty.internal.tcnative.SSLSession;
-import io.netty.internal.tcnative.SSLSessionCache;
-import io.netty.util.ResourceLeakDetector;
-import io.netty.util.ResourceLeakDetectorFactory;
-import io.netty.util.ResourceLeakTracker;
-import io.netty.util.internal.EmptyArrays;
-import io.netty.util.internal.SystemPropertyUtil;
-
-import javax.security.cert.X509Certificate;
-import java.security.Principal;
-import java.security.cert.Certificate;
-import java.util.ArrayList;
-import java.util.Iterator;
-import java.util.LinkedHashMap;
-import java.util.List;
-import java.util.Map;
-import java.util.concurrent.atomic.AtomicInteger;
-
-/**
- * {@link SSLSessionCache} implementation for our native SSL implementation.
- */
-class OpenSslSessionCache implements SSLSessionCache {
-    private static final OpenSslSession[] EMPTY_SESSIONS = new OpenSslSession[0];
-
-    private static final int DEFAULT_CACHE_SIZE;
-    static {
-        // Respect the same system property as the JDK implementation to make it easy to switch between implementations.
-        int cacheSize = SystemPropertyUtil.getInt("javax.net.ssl.sessionCacheSize", 20480);
-        if (cacheSize >= 0) {
-            DEFAULT_CACHE_SIZE = cacheSize;
-        } else {
-            DEFAULT_CACHE_SIZE = 20480;
-        }
-    }
-    private final OpenSslEngineMap engineMap;
-
-    private final Map<OpenSslSessionId, NativeSslSession> sessions =
-            new LinkedHashMap<OpenSslSessionId, NativeSslSession>() {
-
-                private static final long serialVersionUID = -7773696788135734448L;
-
-                @Override
-                protected boolean removeEldestEntry(Map.Entry<OpenSslSessionId, NativeSslSession> eldest) {
-                    int maxSize = maximumCacheSize.get();
-                    if (maxSize >= 0 && size() > maxSize) {
-                        removeSessionWithId(eldest.getKey());
-                    }
-                    // We always need to return false as we modify the map directly.
-                    return false;
-                }
-            };
-
-    private final AtomicInteger maximumCacheSize = new AtomicInteger(DEFAULT_CACHE_SIZE);
-
-    // Let's use the same default value as OpenSSL does.
-    // See https://www.openssl.org/docs/man1.1.1/man3/SSL_get_default_timeout.html
-    private final AtomicInteger sessionTimeout = new AtomicInteger(300);
-    private int sessionCounter;
-
-    OpenSslSessionCache(OpenSslEngineMap engineMap) {
-        this.engineMap = engineMap;
-    }
-
-    final void setSessionTimeout(int seconds) {
-        int oldTimeout = sessionTimeout.getAndSet(seconds);
-        if (oldTimeout > seconds) {
-            // Drain the whole cache as this way we can use the ordering of the LinkedHashMap to detect early
-            // if there are any other sessions left that are invalid.
-            clear();
-        }
-    }
-
-    final int getSessionTimeout() {
-        return sessionTimeout.get();
-    }
-
-    /**
-     * Called once a new {@link OpenSslSession} was created.
-     *
-     * @param session the new session.
-     * @return {@code true} if the session should be cached, {@code false} otherwise.
-     */
-    protected boolean sessionCreated(NativeSslSession session) {
-        return true;
-    }
-
-    /**
-     * Called once an {@link OpenSslSession} was removed from the cache.
-     *
-     * @param session the session to remove.
-     */
-    protected void sessionRemoved(NativeSslSession session) { }
-
-    final void setSessionCacheSize(int size) {
-        long oldSize = maximumCacheSize.getAndSet(size);
-        if (oldSize > size || size == 0) {
-            // Just keep it simple for now and drain the whole cache.
-            clear();
-        }
-    }
-
-    final int getSessionCacheSize() {
-        return maximumCacheSize.get();
-    }
-
-    private void expungeInvalidSessions() {
-        if (sessions.isEmpty()) {
-            return;
-        }
-        long now = System.currentTimeMillis();
-        Iterator<Map.Entry<OpenSslSessionId, NativeSslSession>> iterator = sessions.entrySet().iterator();
-        while (iterator.hasNext()) {
-            NativeSslSession session = iterator.next().getValue();
-            // As we use a LinkedHashMap we can break the while loop as soon as we find a valid session.
-            // This is true as we always drain the cache as soon as we change the timeout to a smaller value as
-            // it was set before. This way its true that the insertion order matches the timeout order.
-            if (session.isValid(now)) {
-                break;
-            }
-            iterator.remove();
-
-            notifyRemovalAndFree(session);
-        }
-    }
-
-    @Override
-    public final boolean sessionCreated(long ssl, long sslSession) {
-        ReferenceCountedOpenSslEngine engine = engineMap.get(ssl);
-        if (engine == null) {
-            // We couldn't find the engine itself.
-            return false;
-        }
-        NativeSslSession session = new NativeSslSession(sslSession, engine.getPeerHost(), engine.getPeerPort(),
-                getSessionTimeout() * 1000L);
-        engine.setSessionId(session.sessionId());
-        synchronized (this) {
-            // Mimic what OpenSSL is doing and expunge every 255 new sessions
-            // See https://www.openssl.org/docs/man1.0.2/man3/SSL_CTX_flush_sessions.html
-            if (++sessionCounter == 255) {
-                sessionCounter = 0;
-                expungeInvalidSessions();
-            }
-
-            if (!sessionCreated(session)) {
-                // Should not be cached, return false. In this case we also need to call close() to ensure we
-                // close the ResourceLeakTracker.
-                session.close();
-                return false;
-            }
-
-            final NativeSslSession old = sessions.put(session.sessionId(), session);
-            if (old != null) {
-                notifyRemovalAndFree(old);
-            }
-        }
-        return true;
-    }
-
-    @Override
-    public final long getSession(long ssl, byte[] sessionId) {
-        OpenSslSessionId id = new OpenSslSessionId(sessionId);
-        final NativeSslSession session;
-        synchronized (this) {
-            session = sessions.get(id);
-            if (session == null) {
-                return -1;
-            }
-
-            // If the session is not valid anymore we should remove it from the cache and just signal back
-            // that we couldn't find a session that is re-usable.
-            if (!session.isValid() ||
-                    // This needs to happen in the synchronized block so we ensure we never destroy it before we
-                    // incremented the reference count. If we cant increment the reference count there is something
-                    // wrong. In this case just remove the session from the cache and signal back that we couldn't
-                    // find a session for re-use.
-                    !session.upRef()) {
-                // Remove the session from the cache. This will also take care of calling SSL_SESSION_free(...)
-                removeSessionWithId(session.sessionId());
-                return -1;
-            }
-
-            // At this point we already incremented the reference count via SSL_SESSION_up_ref(...).
-            if (session.shouldBeSingleUse()) {
-                // Should only be used once. In this case invalidate the session which will also ensure we remove it
-                // from the cache and call SSL_SESSION_free(...).
-                removeSessionWithId(session.sessionId());
-            }
-        }
-        session.updateLastAccessedTime();
-        return session.session();
-    }
-
-    void setSession(long ssl, String host, int port) {
-        // Do nothing by default as this needs special handling for the client side.
-    }
-
-    /**
-     * Remove the session with the given id from the cache
-     */
-    final synchronized void removeSessionWithId(OpenSslSessionId id) {
-        NativeSslSession sslSession = sessions.remove(id);
-        if (sslSession != null) {
-            notifyRemovalAndFree(sslSession);
-        }
-    }
-
-    /**
-     * Returns {@code true} if there is a session for the given id in the cache.
-     */
-    final synchronized boolean containsSessionWithId(OpenSslSessionId id) {
-        return sessions.containsKey(id);
-    }
-
-    private void notifyRemovalAndFree(NativeSslSession session) {
-        sessionRemoved(session);
-        session.free();
-    }
-
-    /**
-     * Return the {@link OpenSslSession} which is cached for the given id.
-     */
-    final synchronized OpenSslSession getSession(OpenSslSessionId id) {
-        NativeSslSession session = sessions.get(id);
-        if (session != null && !session.isValid()) {
-            // The session is not valid anymore, let's remove it and just signal back that there is no session
-            // with the given ID in the cache anymore. This also takes care of calling SSL_SESSION_free(...)
-            removeSessionWithId(session.sessionId());
-            return null;
-        }
-        return session;
-    }
-
-    /**
-     * Returns a snapshot of the session ids of the current valid sessions.
-     */
-    final List<OpenSslSessionId> getIds() {
-        final OpenSslSession[] sessionsArray;
-        synchronized (this) {
-            sessionsArray = sessions.values().toArray(EMPTY_SESSIONS);
-        }
-        List<OpenSslSessionId> ids = new ArrayList<OpenSslSessionId>(sessionsArray.length);
-        for (OpenSslSession session: sessionsArray) {
-            if (session.isValid()) {
-                ids.add(session.sessionId());
-            }
-        }
-        return ids;
-    }
-
-    /**
-     * Clear the cache and free all cached SSL_SESSION*.
-     */
-    synchronized void clear() {
-        Iterator<Map.Entry<OpenSslSessionId, NativeSslSession>> iterator = sessions.entrySet().iterator();
-        while (iterator.hasNext()) {
-            NativeSslSession session = iterator.next().getValue();
-            iterator.remove();
-
-            // Notify about removal. This also takes care of calling SSL_SESSION_free(...).
-            notifyRemovalAndFree(session);
-        }
-    }
-
-    /**
-     * {@link OpenSslSession} implementation which wraps the native SSL_SESSION* while in cache.
-     */
-    static final class NativeSslSession implements OpenSslSession {
-        static final ResourceLeakDetector<NativeSslSession> LEAK_DETECTOR = ResourceLeakDetectorFactory.instance()
-                .newResourceLeakDetector(NativeSslSession.class);
-        private final ResourceLeakTracker<NativeSslSession> leakTracker;
-        private final long session;
-        private final String peerHost;
-        private final int peerPort;
-        private final OpenSslSessionId id;
-        private final long timeout;
-        private final long creationTime = System.currentTimeMillis();
-        private volatile long lastAccessedTime = creationTime;
-        private volatile boolean valid = true;
-        private boolean freed;
-
-        NativeSslSession(long session, String peerHost, int peerPort, long timeout) {
-            this.session = session;
-            this.peerHost = peerHost;
-            this.peerPort = peerPort;
-            this.timeout = timeout;
-            this.id = new OpenSslSessionId(io.netty.internal.tcnative.SSLSession.getSessionId(session));
-            leakTracker = LEAK_DETECTOR.track(this);
-        }
-
-        @Override
-        public void setSessionId(OpenSslSessionId id) {
-            throw new UnsupportedOperationException();
-        }
-
-        boolean shouldBeSingleUse() {
-            assert !freed;
-            return SSLSession.shouldBeSingleUse(session);
-        }
-
-        long session() {
-            assert !freed;
-            return session;
-        }
-
-        boolean upRef() {
-            assert !freed;
-            return SSLSession.upRef(session);
-        }
-
-        synchronized void free() {
-            close();
-            SSLSession.free(session);
-        }
-
-        void close() {
-            assert !freed;
-            freed = true;
-            invalidate();
-            if (leakTracker != null) {
-                leakTracker.close(this);
-            }
-        }
-
-        @Override
-        public OpenSslSessionId sessionId() {
-            return id;
-        }
-
-        boolean isValid(long now) {
-            return creationTime + timeout >= now && valid;
-        }
-
-        @Override
-        public void setLocalCertificate(Certificate[] localCertificate) {
-            throw new UnsupportedOperationException();
-        }
-
-        @Override
-        public OpenSslSessionContext getSessionContext() {
-            return null;
-        }
-
-        @Override
-        public void tryExpandApplicationBufferSize(int packetLengthDataOnly) {
-            throw new UnsupportedOperationException();
-        }
-
-        @Override
-        public void handshakeFinished(byte[] id, String cipher, String protocol, byte[] peerCertificate,
-                                      byte[][] peerCertificateChain, long creationTime, long timeout) {
-            throw new UnsupportedOperationException();
-        }
-
-        @Override
-        public byte[] getId() {
-            return id.cloneBytes();
-        }
-
-        @Override
-        public long getCreationTime() {
-            return creationTime;
-        }
-
-        void updateLastAccessedTime() {
-            lastAccessedTime = System.currentTimeMillis();
-        }
-
-        @Override
-        public long getLastAccessedTime() {
-            return lastAccessedTime;
-        }
-
-        @Override
-        public void invalidate() {
-            valid = false;
-        }
-
-        @Override
-        public boolean isValid() {
-            return isValid(System.currentTimeMillis());
-        }
-
-        @Override
-        public void putValue(String name, Object value) {
-            throw new UnsupportedOperationException();
-        }
-
-        @Override
-        public Object getValue(String name) {
-            return null;
-        }
-
-        @Override
-        public void removeValue(String name) {
-            // NOOP
-        }
-
-        @Override
-        public String[] getValueNames() {
-            return EmptyArrays.EMPTY_STRINGS;
-        }
-
-        @Override
-        public Certificate[] getPeerCertificates() {
-            throw new UnsupportedOperationException();
-        }
-
-        @Override
-        public Certificate[] getLocalCertificates() {
-            throw new UnsupportedOperationException();
-        }
-
-        @Override
-        public X509Certificate[] getPeerCertificateChain() {
-            throw new UnsupportedOperationException();
-        }
-
-        @Override
-        public Principal getPeerPrincipal() {
-            throw new UnsupportedOperationException();
-        }
-
-        @Override
-        public Principal getLocalPrincipal() {
-            throw new UnsupportedOperationException();
-        }
-
-        @Override
-        public String getCipherSuite() {
-            return null;
-        }
-
-        @Override
-        public String getProtocol() {
-            return null;
-        }
-
-        @Override
-        public String getPeerHost() {
-            return peerHost;
-        }
-
-        @Override
-        public int getPeerPort() {
-            return peerPort;
-        }
-
-        @Override
-        public int getPacketBufferSize() {
-            return ReferenceCountedOpenSslEngine.MAX_RECORD_SIZE;
-        }
-
-        @Override
-        public int getApplicationBufferSize() {
-            return ReferenceCountedOpenSslEngine.MAX_PLAINTEXT_LENGTH;
-        }
-
-        @Override
-        public int hashCode() {
-            return id.hashCode();
-        }
-
-        @Override
-        public boolean equals(Object o) {
-            if (this == o) {
-                return true;
-            }
-            if (!(o instanceof OpenSslSession)) {
-                return false;
-            }
-            OpenSslSession session1 = (OpenSslSession) o;
-            return id.equals(session1.sessionId());
-        }
-    }
-}
diff --git a/handler/src/main/java/io/netty/handler/ssl/OpenSslSessionId.java b/handler/src/main/java/io/netty/handler/ssl/OpenSslSessionId.java
deleted file mode 100644
index 76941f74ae..0000000000
--- a/handler/src/main/java/io/netty/handler/ssl/OpenSslSessionId.java
+++ /dev/null
@@ -1,66 +0,0 @@
-/*
- * Copyright 2021 The Netty Project
- *
- * The Netty Project licenses this file to you under the Apache License,
- * version 2.0 (the "License"); you may not use this file except in compliance
- * with the License. You may obtain a copy of the License at:
- *
- *   https://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
- * WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the
- * License for the specific language governing permissions and limitations
- * under the License.
- */
-package io.netty.handler.ssl;
-
-import io.netty.util.internal.EmptyArrays;
-
-import java.util.Arrays;
-
-/**
- * Represent the session ID used by an {@link OpenSslSession}.
- */
-final class OpenSslSessionId {
-
-    private final byte[] id;
-    private final int hashCode;
-
-    static final OpenSslSessionId NULL_ID = new OpenSslSessionId(EmptyArrays.EMPTY_BYTES);
-
-    OpenSslSessionId(byte[] id) {
-        // We take ownership if the byte[] and so there is no need to clone it.
-        this.id = id;
-        // cache the hashCode as the byte[] array will never change
-        this.hashCode = Arrays.hashCode(id);
-    }
-
-    @Override
-    public boolean equals(Object o) {
-        if (this == o) {
-            return true;
-        }
-        if (!(o instanceof OpenSslSessionId)) {
-            return false;
-        }
-
-        return Arrays.equals(id, ((OpenSslSessionId) o).id);
-    }
-
-    @Override
-    public String toString() {
-        return "OpenSslSessionId{" +
-                "id=" + Arrays.toString(id) +
-                '}';
-    }
-
-    @Override
-    public int hashCode() {
-        return hashCode;
-    }
-
-    byte[] cloneBytes() {
-        return id.clone();
-    }
-}
diff --git a/handler/src/main/java/io/netty/handler/ssl/SslContext.java b/handler/src/main/java/io/netty/handler/ssl/SslContext.java
index 1c8efb7151..c3c67e0425 100644
--- a/handler/src/main/java/io/netty/handler/ssl/SslContext.java
+++ b/handler/src/main/java/io/netty/handler/ssl/SslContext.java
@@ -867,16 +867,12 @@ public abstract class SslContext {
     /**
      * Returns the size of the cache used for storing SSL session objects.
      */
-    public long sessionCacheSize() {
-        return sessionContext().getSessionCacheSize();
-    }
+    public abstract long sessionCacheSize();
 
     /**
      * Returns the timeout for the cached SSL session objects, in seconds.
      */
-    public long sessionTimeout() {
-        return sessionContext().getSessionTimeout();
-    }
+    public abstract long sessionTimeout();
 
     /**
      * @deprecated Use {@link #applicationProtocolNegotiator()} instead.
diff --git a/handler/src/main/java/io/netty/handler/ssl/util/LazyJavaxX509Certificate.java b/handler/src/main/java/io/netty/handler/ssl/util/LazyJavaxX509Certificate.java
index 66a769d14a..65831c0628 100644
--- a/handler/src/main/java/io/netty/handler/ssl/util/LazyJavaxX509Certificate.java
+++ b/handler/src/main/java/io/netty/handler/ssl/util/LazyJavaxX509Certificate.java
@@ -101,14 +101,6 @@ public final class LazyJavaxX509Certificate extends X509Certificate {
         return bytes.clone();
     }
 
-    /**
-     * Return the underyling {@code byte[]} without cloning it first. This {@code byte[]} <strong>must</strong> never
-     * be mutated.
-     */
-    byte[] getBytes() {
-        return bytes;
-    }
-
     @Override
     public void verify(PublicKey key)
             throws CertificateException, NoSuchAlgorithmException, InvalidKeyException, NoSuchProviderException,
diff --git a/handler/src/test/java/io/netty/handler/ssl/ConscryptJdkSslEngineInteropTest.java b/handler/src/test/java/io/netty/handler/ssl/ConscryptJdkSslEngineInteropTest.java
index 6d8a9c7e3e..20af113d86 100644
--- a/handler/src/test/java/io/netty/handler/ssl/ConscryptJdkSslEngineInteropTest.java
+++ b/handler/src/test/java/io/netty/handler/ssl/ConscryptJdkSslEngineInteropTest.java
@@ -22,9 +22,6 @@ import org.junit.jupiter.api.condition.DisabledIf;
 import org.junit.jupiter.params.ParameterizedTest;
 import org.junit.jupiter.params.provider.MethodSource;
 
-import javax.net.ssl.SSLSessionContext;
-
-
 @DisabledIf("checkConscryptDisabled")
 public class ConscryptJdkSslEngineInteropTest extends SSLEngineTest {
 
@@ -75,11 +72,6 @@ public class ConscryptJdkSslEngineInteropTest extends SSLEngineTest {
         return super.mySetupMutualAuthServerIsValidServerException(cause) || causedBySSLException(cause);
     }
 
-    @Override
-    protected void invalidateSessionsAndAssert(SSLSessionContext context) {
-        // Not supported by conscrypt
-    }
-
     @MethodSource("newTestParams")
     @ParameterizedTest
     @Disabled("Disabled due a conscrypt bug")
diff --git a/handler/src/test/java/io/netty/handler/ssl/ConscryptOpenSslEngineInteropTest.java b/handler/src/test/java/io/netty/handler/ssl/ConscryptOpenSslEngineInteropTest.java
index 9e3c485b58..ef0147e518 100644
--- a/handler/src/test/java/io/netty/handler/ssl/ConscryptOpenSslEngineInteropTest.java
+++ b/handler/src/test/java/io/netty/handler/ssl/ConscryptOpenSslEngineInteropTest.java
@@ -22,7 +22,6 @@ import org.junit.jupiter.params.ParameterizedTest;
 import org.junit.jupiter.params.provider.MethodSource;
 
 import javax.net.ssl.SSLEngine;
-import javax.net.ssl.SSLSessionContext;
 
 import java.security.Provider;
 import java.util.ArrayList;
@@ -162,11 +161,6 @@ public class ConscryptOpenSslEngineInteropTest extends ConscryptSslEngineTest {
         super.testSessionLocalWhenNonMutualWithoutKeyManager(param);
     }
 
-    @Override
-    protected void invalidateSessionsAndAssert(SSLSessionContext context) {
-        // Not supported by conscrypt
-    }
-
     @MethodSource("newTestParams")
     @ParameterizedTest
     @Override
@@ -211,8 +205,6 @@ public class ConscryptOpenSslEngineInteropTest extends ConscryptSslEngineTest {
             if (param instanceof OpenSslEngineTestParam) {
                 ((OpenSslContext) context).setUseTasks(((OpenSslEngineTestParam) param).useTasks);
             }
-            // Explicit enable the session cache as its disabled by default on the client side.
-            ((OpenSslContext) context).sessionContext().setSessionCacheEnabled(true);
         }
         return context;
     }
diff --git a/handler/src/test/java/io/netty/handler/ssl/ConscryptSslEngineTest.java b/handler/src/test/java/io/netty/handler/ssl/ConscryptSslEngineTest.java
index 58221857f0..2698acc09e 100644
--- a/handler/src/test/java/io/netty/handler/ssl/ConscryptSslEngineTest.java
+++ b/handler/src/test/java/io/netty/handler/ssl/ConscryptSslEngineTest.java
@@ -21,7 +21,6 @@ import org.junit.jupiter.api.condition.DisabledIf;
 import org.junit.jupiter.params.ParameterizedTest;
 import org.junit.jupiter.params.provider.MethodSource;
 
-import javax.net.ssl.SSLSessionContext;
 import java.security.Provider;
 
 @DisabledIf("checkConscryptDisabled")
@@ -69,20 +68,6 @@ public class ConscryptSslEngineTest extends SSLEngineTest {
     public void testMutualAuthValidClientCertChainTooLongFailRequireClientAuth(SSLEngineTestParam param) {
     }
 
-    @Override
-    protected void invalidateSessionsAndAssert(SSLSessionContext context) {
-        // Not supported by conscrypt
-    }
-
-    @MethodSource("newTestParams")
-    @ParameterizedTest
-    @Disabled("Possible Conscrypt bug")
-    @Override
-    public void testSessionCacheTimeout(SSLEngineTestParam param) throws Exception {
-        // Skip
-        // https://github.com/google/conscrypt/issues/851
-    }
-
     @Disabled("Not supported")
     @Override
     public void testRSASSAPSS(SSLEngineTestParam param) {
diff --git a/handler/src/test/java/io/netty/handler/ssl/JdkConscryptSslEngineInteropTest.java b/handler/src/test/java/io/netty/handler/ssl/JdkConscryptSslEngineInteropTest.java
index be453dbbfa..8d0e66f96d 100644
--- a/handler/src/test/java/io/netty/handler/ssl/JdkConscryptSslEngineInteropTest.java
+++ b/handler/src/test/java/io/netty/handler/ssl/JdkConscryptSslEngineInteropTest.java
@@ -22,7 +22,13 @@ import org.junit.jupiter.api.condition.DisabledIf;
 import org.junit.jupiter.params.ParameterizedTest;
 import org.junit.jupiter.params.provider.MethodSource;
 
+<<<<<<< HEAD
 import javax.net.ssl.SSLSessionContext;
+=======
+import java.util.ArrayList;
+import java.util.Collection;
+import java.util.List;
+>>>>>>> 5b23a90531 (Revert "Support session cache for client and server when using native SSLEngine implementation (#10994)")
 
 @DisabledIf("checkConscryptDisabled")
 public class JdkConscryptSslEngineInteropTest extends SSLEngineTest {
@@ -83,20 +89,6 @@ public class JdkConscryptSslEngineInteropTest extends SSLEngineTest {
         // See https://github.com/google/conscrypt/issues/634
     }
 
-    @Override
-    protected void invalidateSessionsAndAssert(SSLSessionContext context) {
-        // Not supported by conscrypt
-    }
-
-    @MethodSource("newTestParams")
-    @ParameterizedTest
-    @Disabled("Possible Conscrypt bug")
-    @Override
-    public void testSessionCacheTimeout(SSLEngineTestParam param) {
-        // Skip
-        // https://github.com/google/conscrypt/issues/851
-    }
-
     @Disabled("Not supported")
     @Override
     public void testRSASSAPSS(SSLEngineTestParam param) {
diff --git a/handler/src/test/java/io/netty/handler/ssl/JdkOpenSslEngineInteroptTest.java b/handler/src/test/java/io/netty/handler/ssl/JdkOpenSslEngineInteroptTest.java
index a0c04188b4..534beeec65 100644
--- a/handler/src/test/java/io/netty/handler/ssl/JdkOpenSslEngineInteroptTest.java
+++ b/handler/src/test/java/io/netty/handler/ssl/JdkOpenSslEngineInteroptTest.java
@@ -247,8 +247,6 @@ public class JdkOpenSslEngineInteroptTest extends SSLEngineTest {
     protected SslContext wrapContext(SSLEngineTestParam param, SslContext context) {
         if (context instanceof OpenSslContext && param instanceof OpenSslEngineTestParam) {
             ((OpenSslContext) context).setUseTasks(((OpenSslEngineTestParam) param).useTasks);
-            // Explicit enable the session cache as its disabled by default on the client side.
-            ((OpenSslContext) context).sessionContext().setSessionCacheEnabled(true);
         }
         return context;
     }
diff --git a/handler/src/test/java/io/netty/handler/ssl/OpenSslConscryptSslEngineInteropTest.java b/handler/src/test/java/io/netty/handler/ssl/OpenSslConscryptSslEngineInteropTest.java
index b5d4903938..8014000630 100644
--- a/handler/src/test/java/io/netty/handler/ssl/OpenSslConscryptSslEngineInteropTest.java
+++ b/handler/src/test/java/io/netty/handler/ssl/OpenSslConscryptSslEngineInteropTest.java
@@ -22,7 +22,6 @@ import org.junit.jupiter.params.ParameterizedTest;
 import org.junit.jupiter.params.provider.MethodSource;
 
 import javax.net.ssl.SSLEngine;
-import javax.net.ssl.SSLSessionContext;
 import java.security.Provider;
 import java.util.ArrayList;
 import java.util.List;
@@ -166,11 +165,6 @@ public class OpenSslConscryptSslEngineInteropTest extends ConscryptSslEngineTest
         super.testSessionCacheSize(param);
     }
 
-    @Override
-    protected void invalidateSessionsAndAssert(SSLSessionContext context) {
-        // Not supported by conscrypt
-    }
-
     @Override
     protected SSLEngine wrapEngine(SSLEngine engine) {
         return Java8SslTestUtils.wrapSSLEngineForTesting(engine);
@@ -183,8 +177,6 @@ public class OpenSslConscryptSslEngineInteropTest extends ConscryptSslEngineTest
             if (param instanceof OpenSslEngineTestParam) {
                 ((OpenSslContext) context).setUseTasks(((OpenSslEngineTestParam) param).useTasks);
             }
-            // Explicit enable the session cache as its disabled by default on the client side.
-            ((OpenSslContext) context).sessionContext().setSessionCacheEnabled(true);
         }
         return context;
     }
diff --git a/handler/src/test/java/io/netty/handler/ssl/OpenSslEngineTest.java b/handler/src/test/java/io/netty/handler/ssl/OpenSslEngineTest.java
index 9ad1c3b10f..ef559db1df 100644
--- a/handler/src/test/java/io/netty/handler/ssl/OpenSslEngineTest.java
+++ b/handler/src/test/java/io/netty/handler/ssl/OpenSslEngineTest.java
@@ -1514,62 +1514,10 @@ public class OpenSslEngineTest extends SSLEngineTest {
             if (param instanceof OpenSslEngineTestParam) {
                 ((OpenSslContext) context).setUseTasks(((OpenSslEngineTestParam) param).useTasks);
             }
-            // Explicit enable the session cache as its disabled by default on the client side.
-            ((OpenSslContext) context).sessionContext().setSessionCacheEnabled(true);
         }
         return context;
     }
 
-    @MethodSource("newTestParams")
-    @ParameterizedTest
-    @Override
-    public void testSessionCache(SSLEngineTestParam param) throws Exception {
-        assumeTrue(OpenSsl.isSessionCacheSupported());
-        super.testSessionCache(param);
-        assertSessionContext(clientSslCtx);
-        assertSessionContext(serverSslCtx);
-    }
-
-    @MethodSource("newTestParams")
-    @ParameterizedTest
-    @Override
-    public void testSessionCacheTimeout(SSLEngineTestParam param) throws Exception {
-        assumeTrue(OpenSsl.isSessionCacheSupported());
-        super.testSessionCacheTimeout(param);
-    }
-
-    @MethodSource("newTestParams")
-    @ParameterizedTest
-    @Override
-    public void testSessionCacheSize(SSLEngineTestParam param) throws Exception {
-        assumeTrue(OpenSsl.isSessionCacheSupported());
-        super.testSessionCacheSize(param);
-    }
-
-    private static void assertSessionContext(SslContext context) {
-        if (context == null) {
-            return;
-        }
-        OpenSslSessionContext serverSessionCtx = (OpenSslSessionContext) context.sessionContext();
-        assertTrue(serverSessionCtx.isSessionCacheEnabled());
-        if (serverSessionCtx.getIds().hasMoreElements()) {
-            serverSessionCtx.setSessionCacheEnabled(false);
-            assertFalse(serverSessionCtx.getIds().hasMoreElements());
-            assertFalse(serverSessionCtx.isSessionCacheEnabled());
-        }
-    }
-
-    @Override
-    protected void assertSessionReusedForEngine(SSLEngine clientEngine, SSLEngine serverEngine, boolean reuse) {
-        assertEquals(reuse, unwrapEngine(clientEngine).isSessionReused());
-        assertEquals(reuse, unwrapEngine(serverEngine).isSessionReused());
-    }
-
-    @Override
-    protected boolean isSessionMaybeReused(SSLEngine engine) {
-        return unwrapEngine(engine).isSessionReused();
-    }
-
     @MethodSource("newTestParams")
     @ParameterizedTest
     @Override
diff --git a/handler/src/test/java/io/netty/handler/ssl/OpenSslJdkSslEngineInteroptTest.java b/handler/src/test/java/io/netty/handler/ssl/OpenSslJdkSslEngineInteroptTest.java
index 0d47fd09b3..3eda99e7f9 100644
--- a/handler/src/test/java/io/netty/handler/ssl/OpenSslJdkSslEngineInteroptTest.java
+++ b/handler/src/test/java/io/netty/handler/ssl/OpenSslJdkSslEngineInteroptTest.java
@@ -19,6 +19,7 @@ import org.junit.jupiter.api.BeforeAll;
 import org.junit.jupiter.api.Disabled;
 import org.junit.jupiter.params.ParameterizedTest;
 import org.junit.jupiter.params.provider.MethodSource;
+import io.netty.util.internal.PlatformDependent;
 
 import javax.net.ssl.SSLEngine;
 
@@ -194,8 +195,6 @@ public class OpenSslJdkSslEngineInteroptTest extends SSLEngineTest {
     protected SslContext wrapContext(SSLEngineTestParam param, SslContext context) {
         if (context instanceof OpenSslContext && param instanceof OpenSslEngineTestParam) {
             ((OpenSslContext) context).setUseTasks(((OpenSslEngineTestParam) param).useTasks);
-            // Explicit enable the session cache as its disabled by default on the client side.
-            ((OpenSslContext) context).sessionContext().setSessionCacheEnabled(true);
         }
         return context;
     }
diff --git a/handler/src/test/java/io/netty/handler/ssl/ReferenceCountedOpenSslEngineTest.java b/handler/src/test/java/io/netty/handler/ssl/ReferenceCountedOpenSslEngineTest.java
index aa32b7de2f..01f56519ee 100644
--- a/handler/src/test/java/io/netty/handler/ssl/ReferenceCountedOpenSslEngineTest.java
+++ b/handler/src/test/java/io/netty/handler/ssl/ReferenceCountedOpenSslEngineTest.java
@@ -84,8 +84,6 @@ public class ReferenceCountedOpenSslEngineTest extends OpenSslEngineTest {
             if (param instanceof OpenSslEngineTestParam) {
                 ((ReferenceCountedOpenSslContext) context).setUseTasks(((OpenSslEngineTestParam) param).useTasks);
             }
-            // Explicit enable the session cache as its disabled by default on the client side.
-            ((ReferenceCountedOpenSslContext) context).sessionContext().setSessionCacheEnabled(true);
         }
         return context;
     }
diff --git a/handler/src/test/java/io/netty/handler/ssl/SSLEngineTest.java b/handler/src/test/java/io/netty/handler/ssl/SSLEngineTest.java
index 6a187fded3..fba11d0ce3 100644
--- a/handler/src/test/java/io/netty/handler/ssl/SSLEngineTest.java
+++ b/handler/src/test/java/io/netty/handler/ssl/SSLEngineTest.java
@@ -88,7 +88,6 @@ import java.security.cert.CertificateException;
 import java.util.ArrayList;
 import java.util.Arrays;
 import java.util.Collections;
-import java.util.Enumeration;
 import java.util.HashSet;
 import java.util.List;
 import java.util.Set;
@@ -116,7 +115,6 @@ import javax.net.ssl.SSLPeerUnverifiedException;
 import javax.net.ssl.SSLSession;
 import javax.net.ssl.SSLSessionBindingEvent;
 import javax.net.ssl.SSLSessionBindingListener;
-import javax.net.ssl.SSLSessionContext;
 import javax.net.ssl.SSLSocketFactory;
 import javax.net.ssl.TrustManager;
 import javax.net.ssl.TrustManagerFactory;
@@ -1366,14 +1364,14 @@ public abstract class SSLEngineTest {
                 .trustManager(InsecureTrustManagerFactory.INSTANCE)
                 .sslProvider(sslClientProvider())
                 // This test only works for non TLSv1.3 for now
-                .protocols(param.protocols())
+                .protocols(PROTOCOL_TLS_V1_2)
                 .sslContextProvider(clientSslContextProvider())
                 .build());
         SelfSignedCertificate ssc = new SelfSignedCertificate();
         serverSslCtx = wrapContext(param, SslContextBuilder.forServer(ssc.certificate(), ssc.privateKey())
                 .sslProvider(sslServerProvider())
                 // This test only works for non TLSv1.3 for now
-                .protocols(param.protocols())
+                .protocols(PROTOCOL_TLS_V1_2)
                 .sslContextProvider(serverSslContextProvider())
                 .build());
         SSLEngine clientEngine = null;
@@ -1388,54 +1386,10 @@ public abstract class SSLEngineTest {
 
             handshake(param.type(), param.delegate(), clientEngine, serverEngine);
 
-            if (param.protocolCipherCombo == ProtocolCipherCombo.TLSV13) {
-                // Allocate something which is big enough for sure
-                ByteBuffer packetBuffer = allocateBuffer(param.type(), 32 * 1024);
-                ByteBuffer appBuffer = allocateBuffer(param.type(), 32 * 1024);
-
-                appBuffer.clear().position(4).flip();
-                packetBuffer.clear();
-
-                do {
-                    SSLEngineResult result;
-
-                    do {
-                        result = serverEngine.wrap(appBuffer, packetBuffer);
-                    } while (appBuffer.hasRemaining() || result.bytesProduced() > 0);
-
-                    appBuffer.clear();
-                    packetBuffer.flip();
-                    do {
-                        result = clientEngine.unwrap(packetBuffer, appBuffer);
-                    } while (packetBuffer.hasRemaining() || result.bytesProduced() > 0);
-
-                    packetBuffer.clear();
-                    appBuffer.clear().position(4).flip();
-
-                    do {
-                        result = clientEngine.wrap(appBuffer, packetBuffer);
-                    } while (appBuffer.hasRemaining() || result.bytesProduced() > 0);
-
-                    appBuffer.clear();
-                    packetBuffer.flip();
-
-                    do {
-                        result = serverEngine.unwrap(packetBuffer, appBuffer);
-                    } while (packetBuffer.hasRemaining() || result.bytesProduced() > 0);
-
-                    packetBuffer.clear();
-                    appBuffer.clear().position(4).flip();
-                } while (clientEngine.getSession().getId().length == 0);
-
-                // With TLS1.3 we should see pseudo IDs and so these should never match.
-                assertFalse(Arrays.equals(clientEngine.getSession().getId(), serverEngine.getSession().getId()));
-            } else {
-                // After the handshake the id should have length > 0
-                assertNotEquals(0, clientEngine.getSession().getId().length);
-                assertNotEquals(0, serverEngine.getSession().getId().length);
-
-                assertArrayEquals(clientEngine.getSession().getId(), serverEngine.getSession().getId());
-            }
+            // After the handshake the id should have length > 0
+            assertNotEquals(0, clientEngine.getSession().getId().length);
+            assertNotEquals(0, serverEngine.getSession().getId().length);
+            assertArrayEquals(clientEngine.getSession().getId(), serverEngine.getSession().getId());
         } finally {
             cleanupClientSslEngine(clientEngine);
             cleanupServerSslEngine(serverEngine);
@@ -1629,6 +1583,7 @@ public abstract class SSLEngineTest {
 
         boolean clientHandshakeFinished = false;
         boolean serverHandshakeFinished = false;
+
         boolean cTOsHasRemaining;
         boolean sTOcHasRemaining;
 
@@ -3127,274 +3082,6 @@ public abstract class SSLEngineTest {
         }
     }
 
-    @MethodSource("newTestParams")
-    @ParameterizedTest
-    public void testSessionCache(SSLEngineTestParam param) throws Exception {
-        clientSslCtx = wrapContext(param, SslContextBuilder.forClient()
-                .trustManager(InsecureTrustManagerFactory.INSTANCE)
-                .sslProvider(sslClientProvider())
-                .sslContextProvider(clientSslContextProvider())
-                .protocols(param.protocols())
-                .ciphers(param.ciphers())
-                .build());
-        SelfSignedCertificate ssc = new SelfSignedCertificate();
-        serverSslCtx = wrapContext(param, SslContextBuilder.forServer(ssc.certificate(), ssc.privateKey())
-                .sslProvider(sslServerProvider())
-                .sslContextProvider(serverSslContextProvider())
-                .protocols(param.protocols())
-                .ciphers(param.ciphers())
-                .build());
-
-        try {
-            doHandshakeVerifyReusedAndClose(param, "a.netty.io", 9999, false);
-            doHandshakeVerifyReusedAndClose(param, "a.netty.io", 9999, true);
-            doHandshakeVerifyReusedAndClose(param, "b.netty.io", 9999, false);
-            invalidateSessionsAndAssert(serverSslCtx.sessionContext());
-            invalidateSessionsAndAssert(clientSslCtx.sessionContext());
-        } finally {
-            ssc.delete();
-        }
-    }
-
-    protected void invalidateSessionsAndAssert(SSLSessionContext context) {
-        Enumeration<byte[]> ids = context.getIds();
-        while (ids.hasMoreElements()) {
-            byte[] id = ids.nextElement();
-            SSLSession session = context.getSession(id);
-            if (session != null) {
-                session.invalidate();
-                assertFalse(session.isValid());
-                assertNull(context.getSession(id));
-            }
-        }
-    }
-
-    private static void assertSessionCache(SSLSessionContext sessionContext, int numSessions) {
-        Enumeration<byte[]> ids = sessionContext.getIds();
-        int numIds = 0;
-        while (ids.hasMoreElements()) {
-            numIds++;
-            byte[] id = ids.nextElement();
-            assertNotEquals(0, id.length);
-            SSLSession session = sessionContext.getSession(id);
-            assertArrayEquals(id, session.getId());
-        }
-        assertEquals(numSessions, numIds);
-    }
-
-    private void doHandshakeVerifyReusedAndClose(SSLEngineTestParam param, String host, int port, boolean reuse)
-            throws Exception {
-        SSLEngine clientEngine = null;
-        SSLEngine serverEngine = null;
-        try {
-            clientEngine = wrapEngine(clientSslCtx.newEngine(UnpooledByteBufAllocator.DEFAULT, host, port));
-            serverEngine = wrapEngine(serverSslCtx.newEngine(UnpooledByteBufAllocator.DEFAULT));
-            handshake(param.type(), param.delegate(), clientEngine, serverEngine);
-            int clientSessions = currentSessionCacheSize(clientSslCtx.sessionContext());
-            int serverSessions = currentSessionCacheSize(serverSslCtx.sessionContext());
-            int nCSessions = clientSessions;
-            int nSSessions = serverSessions;
-            boolean clientSessionReused = false;
-            boolean serverSessionReused = false;
-            if (param.protocolCipherCombo == ProtocolCipherCombo.TLSV13) {
-                // Allocate something which is big enough for sure
-                ByteBuffer packetBuffer = allocateBuffer(param.type(), 32 * 1024);
-                ByteBuffer appBuffer = allocateBuffer(param.type(), 32 * 1024);
-
-                appBuffer.clear().position(4).flip();
-                packetBuffer.clear();
-
-                do {
-                    SSLEngineResult result;
-
-                    do {
-                        result = serverEngine.wrap(appBuffer, packetBuffer);
-                    } while (appBuffer.hasRemaining() || result.bytesProduced() > 0);
-
-                    appBuffer.clear();
-                    packetBuffer.flip();
-                    do {
-                        result = clientEngine.unwrap(packetBuffer, appBuffer);
-                    } while (packetBuffer.hasRemaining() || result.bytesProduced() > 0);
-
-                    packetBuffer.clear();
-                    appBuffer.clear().position(4).flip();
-
-                    do {
-                        result = clientEngine.wrap(appBuffer, packetBuffer);
-                    } while (appBuffer.hasRemaining() || result.bytesProduced() > 0);
-
-                    appBuffer.clear();
-                    packetBuffer.flip();
-
-                    do {
-                        result = serverEngine.unwrap(packetBuffer, appBuffer);
-                    } while (packetBuffer.hasRemaining() || result.bytesProduced() > 0);
-
-                    packetBuffer.clear();
-                    appBuffer.clear().position(4).flip();
-                    nCSessions = currentSessionCacheSize(clientSslCtx.sessionContext());
-                    nSSessions = currentSessionCacheSize(serverSslCtx.sessionContext());
-                    clientSessionReused = isSessionMaybeReused(clientEngine);
-                    serverSessionReused = isSessionMaybeReused(serverEngine);
-                } while ((reuse && (!clientSessionReused || !serverSessionReused))
-                        || (!reuse && (nCSessions < clientSessions ||
-                        // server may use multiple sessions
-                        nSSessions < serverSessions)));
-            }
-
-            assertSessionReusedForEngine(clientEngine, serverEngine, reuse);
-
-            closeOutboundAndInbound(param.type(), clientEngine, serverEngine);
-        } finally {
-            cleanupClientSslEngine(clientEngine);
-            cleanupServerSslEngine(serverEngine);
-        }
-    }
-
-    protected boolean isSessionMaybeReused(SSLEngine engine) {
-        return true;
-    }
-
-    private static int currentSessionCacheSize(SSLSessionContext ctx) {
-        Enumeration<byte[]> ids = ctx.getIds();
-        int i = 0;
-        while (ids.hasMoreElements()) {
-            i++;
-            ids.nextElement();
-        }
-        return i;
-    }
-
-    private void closeOutboundAndInbound(
-            BufferType type, SSLEngine clientEngine, SSLEngine serverEngine) throws SSLException {
-        assertFalse(clientEngine.isInboundDone());
-        assertFalse(clientEngine.isOutboundDone());
-        assertFalse(serverEngine.isInboundDone());
-        assertFalse(serverEngine.isOutboundDone());
-
-        ByteBuffer empty = allocateBuffer(type, 0);
-
-        // Ensure we allocate a bit more so we can fit in multiple packets. This is needed as we may call multiple
-        // time wrap / unwrap in a for loop before we drain the buffer we are writing in.
-        ByteBuffer cTOs = allocateBuffer(type, clientEngine.getSession().getPacketBufferSize() * 4);
-        ByteBuffer sTOs = allocateBuffer(type, serverEngine.getSession().getPacketBufferSize() * 4);
-        ByteBuffer cApps = allocateBuffer(type, clientEngine.getSession().getApplicationBufferSize() * 4);
-        ByteBuffer sApps = allocateBuffer(type, serverEngine.getSession().getApplicationBufferSize() * 4);
-
-        clientEngine.closeOutbound();
-        for (;;) {
-            // call wrap till we produced all data
-            SSLEngineResult result = clientEngine.wrap(empty, cTOs);
-            if (result.getStatus() == Status.CLOSED && result.bytesProduced() == 0) {
-                break;
-            }
-            assertTrue(cTOs.hasRemaining());
-        }
-        cTOs.flip();
-
-        for (;;) {
-            // call unwrap till we consumed all data
-            SSLEngineResult result = serverEngine.unwrap(cTOs, sApps);
-            if (result.getStatus() == Status.CLOSED && result.bytesProduced() == 0) {
-                break;
-            }
-            assertTrue(sApps.hasRemaining());
-        }
-
-        serverEngine.closeOutbound();
-        for (;;) {
-            // call wrap till we produced all data
-            SSLEngineResult result = serverEngine.wrap(empty, sTOs);
-            if (result.getStatus() == Status.CLOSED && result.bytesProduced() == 0) {
-                break;
-            }
-            assertTrue(sTOs.hasRemaining());
-        }
-        sTOs.flip();
-
-        for (;;) {
-            // call unwrap till we consumed all data
-            SSLEngineResult result = clientEngine.unwrap(sTOs, cApps);
-            if (result.getStatus() == Status.CLOSED && result.bytesProduced() == 0) {
-                break;
-            }
-            assertTrue(cApps.hasRemaining());
-        }
-
-        // Now close the inbound as well
-        clientEngine.closeInbound();
-        serverEngine.closeInbound();
-    }
-
-    protected void assertSessionReusedForEngine(SSLEngine clientEngine, SSLEngine serverEngine, boolean reuse) {
-        // NOOP
-    }
-
-    @MethodSource("newTestParams")
-    @ParameterizedTest
-    public void testSessionCacheTimeout(SSLEngineTestParam param) throws Exception {
-        clientSslCtx = wrapContext(param, SslContextBuilder.forClient()
-                .trustManager(InsecureTrustManagerFactory.INSTANCE)
-                .sslProvider(sslClientProvider())
-                .sslContextProvider(clientSslContextProvider())
-                .protocols(param.protocols())
-                .ciphers(param.ciphers())
-                .sessionTimeout(1)
-                .build());
-        SelfSignedCertificate ssc = new SelfSignedCertificate();
-        serverSslCtx = wrapContext(param, SslContextBuilder.forServer(ssc.certificate(), ssc.privateKey())
-                .sslProvider(sslServerProvider())
-                .sslContextProvider(serverSslContextProvider())
-                .protocols(param.protocols())
-                .ciphers(param.ciphers())
-                .sessionTimeout(1)
-                .build());
-
-        try {
-            doHandshakeVerifyReusedAndClose(param, "a.netty.io", 9999, false);
-
-            // Let's sleep for a bit more then 1 second so the cache should timeout the sessions.
-            Thread.sleep(1500);
-
-            assertSessionCache(serverSslCtx.sessionContext(), 0);
-            assertSessionCache(clientSslCtx.sessionContext(), 0);
-        } finally {
-            ssc.delete();
-        }
-    }
-
-    @MethodSource("newTestParams")
-    @ParameterizedTest
-    public void testSessionCacheSize(SSLEngineTestParam param) throws Exception {
-        clientSslCtx = wrapContext(param, SslContextBuilder.forClient()
-                .trustManager(InsecureTrustManagerFactory.INSTANCE)
-                .sslProvider(sslClientProvider())
-                .sslContextProvider(clientSslContextProvider())
-                .protocols(param.protocols())
-                .ciphers(param.ciphers())
-                .sessionCacheSize(1)
-                .build());
-        SelfSignedCertificate ssc = new SelfSignedCertificate();
-        serverSslCtx = wrapContext(param, SslContextBuilder.forServer(ssc.certificate(), ssc.privateKey())
-                .sslProvider(sslServerProvider())
-                .sslContextProvider(serverSslContextProvider())
-                .protocols(param.protocols())
-                .ciphers(param.ciphers())
-                .build());
-
-        try {
-            doHandshakeVerifyReusedAndClose(param, "a.netty.io", 9999, false);
-            // As we have a cache size of 1 we should never have more then one session in the cache
-            doHandshakeVerifyReusedAndClose(param, "b.netty.io", 9999, false);
-
-            // We should at least reuse b.netty.io
-            doHandshakeVerifyReusedAndClose(param, "b.netty.io", 9999, true);
-        } finally {
-            ssc.delete();
-        }
-    }
-
     @MethodSource("newTestParams")
     @ParameterizedTest
     public void testSessionBindingEvent(SSLEngineTestParam param) throws Exception {
@@ -4020,7 +3707,7 @@ public abstract class SSLEngineTest {
             final Promise<SecretKey> promise = sb.config().group().next().newPromise();
             serverChannel = sb.childHandler(new ChannelInitializer<Channel>() {
                 @Override
-                protected void initChannel(Channel ch) {
+                protected void initChannel(Channel ch) throws Exception {
                     ch.config().setAllocator(new TestByteBufAllocator(ch.config().getAllocator(), param.type()));
 
                     SslHandler sslHandler = !param.delegate() ?
@@ -4078,7 +3765,7 @@ public abstract class SSLEngineTest {
                 new java.security.cert.X509Certificate[] { ssc.cert() }, null, ssc.key(), null, null, null);
     }
 
-    private static final class TestTrustManagerFactory extends X509ExtendedTrustManager {
+    private final class TestTrustManagerFactory extends X509ExtendedTrustManager {
         private final Certificate localCert;
         private volatile boolean verified;
 
diff --git a/handler/src/test/java/io/netty/handler/ssl/SslHandlerTest.java b/handler/src/test/java/io/netty/handler/ssl/SslHandlerTest.java
index 70aef23b60..53f5a2fcbc 100644
--- a/handler/src/test/java/io/netty/handler/ssl/SslHandlerTest.java
+++ b/handler/src/test/java/io/netty/handler/ssl/SslHandlerTest.java
@@ -1297,10 +1297,6 @@ public class SslHandlerTest {
                 .protocols(protocol)
                 .build();
 
-        // Explicit enable session cache as it's disabled by default atm.
-        ((OpenSslContext) sslClientCtx).sessionContext()
-                .setSessionCacheEnabled(true);
-
         final SelfSignedCertificate cert = new SelfSignedCertificate();
         final SslContext sslServerCtx = SslContextBuilder.forServer(cert.key(), cert.cert())
                 .sslProvider(provider)
@@ -1319,41 +1315,25 @@ public class SslHandlerTest {
 
         EventLoopGroup group = new NioEventLoopGroup();
         Channel sc = null;
+        Channel cc = null;
+        final SslHandler clientSslHandler = sslClientCtx.newHandler(UnpooledByteBufAllocator.DEFAULT);
+        final SslHandler serverSslHandler = sslServerCtx.newHandler(UnpooledByteBufAllocator.DEFAULT);
+
+        final BlockingQueue<Object> queue = new LinkedBlockingQueue<Object>();
         final byte[] bytes = new byte[96];
         PlatformDependent.threadLocalRandom().nextBytes(bytes);
         try {
-            final AtomicReference<AssertionError> assertErrorRef = new AtomicReference<AssertionError>();
             sc = new ServerBootstrap()
                     .group(group)
                     .channel(NioServerSocketChannel.class)
                     .childHandler(new ChannelInitializer<Channel>() {
                         @Override
                         protected void initChannel(Channel ch) {
-                            final SslHandler sslHandler = sslServerCtx.newHandler(ch.alloc());
-                            ch.pipeline().addLast(sslServerCtx.newHandler(UnpooledByteBufAllocator.DEFAULT));
+                            ch.pipeline().addLast(serverSslHandler);
                             ch.pipeline().addLast(new ChannelInboundHandlerAdapter() {
-
-                                private int handshakeCount;
-
                                 @Override
                                 public void userEventTriggered(ChannelHandlerContext ctx, Object evt)  {
                                     if (evt instanceof SslHandshakeCompletionEvent) {
-                                        handshakeCount++;
-                                        ReferenceCountedOpenSslEngine engine =
-                                                (ReferenceCountedOpenSslEngine) sslHandler.engine();
-                                        // This test only works for non TLSv1.3 as TLSv1.3 will establish sessions after
-                                        // the handshake is done.
-                                        // See https://www.openssl.org/docs/man1.1.1/man3/SSL_CTX_sess_set_get_cb.html
-                                        if (!SslProtocols.TLS_v1_3.equals(engine.getSession().getProtocol())) {
-                                            // First should not re-use the session
-                                            try {
-                                                assertEquals(handshakeCount > 1, engine.isSessionReused());
-                                            } catch (AssertionError error) {
-                                                assertErrorRef.set(error);
-                                                return;
-                                            }
-                                        }
-
                                         ctx.writeAndFlush(Unpooled.wrappedBuffer(bytes));
                                     }
                                 }
@@ -1362,31 +1342,6 @@ public class SslHandlerTest {
                     })
                     .bind(new InetSocketAddress(0)).syncUninterruptibly().channel();
 
-            InetSocketAddress serverAddr = (InetSocketAddress) sc.localAddress();
-            testSessionTickets(serverAddr, group, sslClientCtx, bytes, false);
-            testSessionTickets(serverAddr, group, sslClientCtx, bytes, true);
-            AssertionError error = assertErrorRef.get();
-            if (error != null) {
-                throw error;
-            }
-        } finally {
-            if (sc != null) {
-                sc.close().syncUninterruptibly();
-            }
-            group.shutdownGracefully();
-            ReferenceCountUtil.release(sslClientCtx);
-        }
-    }
-
-    private static void testSessionTickets(InetSocketAddress serverAddress, EventLoopGroup group,
-                                           SslContext sslClientCtx, final byte[] bytes, boolean isReused)
-            throws Throwable {
-        Channel cc = null;
-        final BlockingQueue<Object> queue = new LinkedBlockingQueue<Object>();
-        try {
-            final SslHandler clientSslHandler = sslClientCtx.newHandler(UnpooledByteBufAllocator.DEFAULT,
-                    serverAddress.getAddress().getHostAddress(), serverAddress.getPort());
-
             ChannelFuture future = new Bootstrap()
                     .group(group)
                     .channel(NioSocketChannel.class)
@@ -1409,18 +1364,11 @@ public class SslHandlerTest {
                                 }
                             });
                         }
-                    }).connect(serverAddress);
+                    }).connect(sc.localAddress());
             cc = future.syncUninterruptibly().channel();
 
-            assertTrue(clientSslHandler.handshakeFuture().sync().isSuccess());
-
-            ReferenceCountedOpenSslEngine engine = (ReferenceCountedOpenSslEngine) clientSslHandler.engine();
-            // This test only works for non TLSv1.3 as TLSv1.3 will establish sessions after
-            // the handshake is done.
-            // See https://www.openssl.org/docs/man1.1.1/man3/SSL_CTX_sess_set_get_cb.html
-            if (!SslProtocols.TLS_v1_3.equals(engine.getSession().getProtocol())) {
-                assertEquals(isReused, engine.isSessionReused());
-            }
+            assertTrue(clientSslHandler.handshakeFuture().await().isSuccess());
+            assertTrue(serverSslHandler.handshakeFuture().await().isSuccess());
             Object obj = queue.take();
             if (obj instanceof ByteBuf) {
                 ByteBuf buffer = (ByteBuf) obj;
@@ -1438,6 +1386,11 @@ public class SslHandlerTest {
             if (cc != null) {
                 cc.close().syncUninterruptibly();
             }
+            if (sc != null) {
+                sc.close().syncUninterruptibly();
+            }
+            group.shutdownGracefully();
+            ReferenceCountUtil.release(sslClientCtx);
         }
     }
 
-- 
2.35.1

Places

File 0007-Revert-Support-session-cache-for-client-and-server-w.patch of Package netty (Revision 060333f738bd1de8f53dee6e62c2adbc)

Places