• Home
  • Features
  • Pricing
  • Docs
  • Announcements
  • Sign In

grpc / grpc-java / #20230

31 Mar 2026 09:55AM UTC coverage: 88.734% (+0.01%) from 88.72%
#20230

push

github

web-flow
openTelemetry: add tcp metrics (#12652)

Implements [A80](https://github.com/grpc/proposal/pull/519)

35697 of 40229 relevant lines covered (88.73%)

0.89 hits per line

Source File
Press 'n' to go to next uncovered line, 'b' for previous

67.55
/../okhttp/src/main/java/io/grpc/okhttp/OkHttpServerBuilder.java
1
/*
2
 * Copyright 2022 The gRPC Authors
3
 *
4
 * Licensed under the Apache License, Version 2.0 (the "License");
5
 * you may not use this file except in compliance with the License.
6
 * You may obtain a copy of the License at
7
 *
8
 *     http://www.apache.org/licenses/LICENSE-2.0
9
 *
10
 * Unless required by applicable law or agreed to in writing, software
11
 * distributed under the License is distributed on an "AS IS" BASIS,
12
 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
13
 * See the License for the specific language governing permissions and
14
 * limitations under the License.
15
 */
16

17
package io.grpc.okhttp;
18

19
import static com.google.common.base.Preconditions.checkArgument;
20
import static io.grpc.internal.CertificateUtils.createTrustManager;
21

22
import com.google.common.base.Preconditions;
23
import com.google.errorprone.annotations.CanIgnoreReturnValue;
24
import com.google.errorprone.annotations.DoNotCall;
25
import io.grpc.ChoiceServerCredentials;
26
import io.grpc.ExperimentalApi;
27
import io.grpc.ForwardingServerBuilder;
28
import io.grpc.InsecureServerCredentials;
29
import io.grpc.Internal;
30
import io.grpc.MetricRecorder;
31
import io.grpc.ServerBuilder;
32
import io.grpc.ServerCredentials;
33
import io.grpc.ServerStreamTracer;
34
import io.grpc.TlsServerCredentials;
35
import io.grpc.internal.FixedObjectPool;
36
import io.grpc.internal.GrpcUtil;
37
import io.grpc.internal.InternalServer;
38
import io.grpc.internal.KeepAliveManager;
39
import io.grpc.internal.ObjectPool;
40
import io.grpc.internal.ServerImplBuilder;
41
import io.grpc.internal.SharedResourcePool;
42
import io.grpc.internal.TransportTracer;
43
import io.grpc.okhttp.internal.Platform;
44
import java.io.IOException;
45
import java.net.InetAddress;
46
import java.net.InetSocketAddress;
47
import java.net.Socket;
48
import java.net.SocketAddress;
49
import java.security.GeneralSecurityException;
50
import java.util.EnumSet;
51
import java.util.List;
52
import java.util.Set;
53
import java.util.concurrent.Executor;
54
import java.util.concurrent.ScheduledExecutorService;
55
import java.util.concurrent.TimeUnit;
56
import java.util.logging.Level;
57
import java.util.logging.Logger;
58
import javax.net.ServerSocketFactory;
59
import javax.net.ssl.KeyManager;
60
import javax.net.ssl.SSLContext;
61
import javax.net.ssl.SSLSocket;
62
import javax.net.ssl.SSLSocketFactory;
63
import javax.net.ssl.TrustManager;
64

65
/**
66
 * Build servers with the OkHttp transport.
67
 *
68
 * @since 1.49.0
69
 */
70
@ExperimentalApi("https://github.com/grpc/grpc-java/issues/1785")
71
public final class OkHttpServerBuilder extends ForwardingServerBuilder<OkHttpServerBuilder> {
72
  private static final Logger log = Logger.getLogger(OkHttpServerBuilder.class.getName());
1✔
73
  private static final int DEFAULT_FLOW_CONTROL_WINDOW = 65535;
74

75
  static final long MAX_CONNECTION_IDLE_NANOS_DISABLED = Long.MAX_VALUE;
76
  private static final long MIN_MAX_CONNECTION_IDLE_NANO = TimeUnit.SECONDS.toNanos(1L);
1✔
77
  static final long MAX_CONNECTION_AGE_NANOS_DISABLED = Long.MAX_VALUE;
78
  static final long MAX_CONNECTION_AGE_GRACE_NANOS_INFINITE = Long.MAX_VALUE;
79
  static final int MAX_CONCURRENT_STREAMS = Integer.MAX_VALUE;
80
  private static final long MIN_MAX_CONNECTION_AGE_NANO = TimeUnit.SECONDS.toNanos(1L);
1✔
81

82
  private static final long AS_LARGE_AS_INFINITE = TimeUnit.DAYS.toNanos(1000L);
1✔
83
  private static final ObjectPool<Executor> DEFAULT_TRANSPORT_EXECUTOR_POOL =
1✔
84
      OkHttpChannelBuilder.DEFAULT_TRANSPORT_EXECUTOR_POOL;
85

86
  /**
87
   * Always throws, to shadow {@code ServerBuilder.forPort()}.
88
   *
89
   * @deprecated Use {@link #forPort(int, ServerCredentials)} instead
90
   */
91
  @DoNotCall("Always throws. Use forPort(int, ServerCredentials) instead")
92
  @Deprecated
93
  public static OkHttpServerBuilder forPort(int port) {
94
    throw new UnsupportedOperationException("Use forPort(int, ServerCredentials) instead");
×
95
  }
96

97
  /**
98
   * Creates a builder for a server listening on {@code port}.
99
   */
100
  public static OkHttpServerBuilder forPort(int port, ServerCredentials creds) {
101
    return forPort(new InetSocketAddress(port), creds);
1✔
102
  }
103

104
  /**
105
   * Creates a builder for a server listening on {@code address}.
106
   */
107
  public static OkHttpServerBuilder forPort(SocketAddress address, ServerCredentials creds) {
108
    HandshakerSocketFactoryResult result = handshakerSocketFactoryFrom(creds);
1✔
109
    if (result.error != null) {
1✔
110
      throw new IllegalArgumentException(result.error);
×
111
    }
112
    return new OkHttpServerBuilder(address, result.factory);
1✔
113
  }
114

115
  final ServerImplBuilder serverImplBuilder = new ServerImplBuilder(
1✔
116
      new ServerImplBuilder.ClientTransportServersBuilder() {
1✔
117
        @Override
118
        public InternalServer buildClientTransportServers(
119
            List<? extends ServerStreamTracer.Factory> streamTracerFactories,
120
            MetricRecorder metricRecorder) {
121
          return buildTransportServers(streamTracerFactories);
1✔
122
        }
123
      });
124
  final SocketAddress listenAddress;
125
  final HandshakerSocketFactory handshakerSocketFactory;
126
  TransportTracer.Factory transportTracerFactory = TransportTracer.getDefaultFactory();
1✔
127

128
  ObjectPool<Executor> transportExecutorPool = DEFAULT_TRANSPORT_EXECUTOR_POOL;
1✔
129
  ObjectPool<ScheduledExecutorService> scheduledExecutorServicePool =
1✔
130
      SharedResourcePool.forResource(GrpcUtil.TIMER_SERVICE);
1✔
131

132
  ServerSocketFactory socketFactory = ServerSocketFactory.getDefault();
1✔
133
  long keepAliveTimeNanos = GrpcUtil.DEFAULT_SERVER_KEEPALIVE_TIME_NANOS;
1✔
134
  long keepAliveTimeoutNanos = GrpcUtil.DEFAULT_SERVER_KEEPALIVE_TIMEOUT_NANOS;
1✔
135
  int flowControlWindow = DEFAULT_FLOW_CONTROL_WINDOW;
1✔
136
  int maxInboundMetadataSize = GrpcUtil.DEFAULT_MAX_HEADER_LIST_SIZE;
1✔
137
  int maxInboundMessageSize = GrpcUtil.DEFAULT_MAX_MESSAGE_SIZE;
1✔
138
  long maxConnectionIdleInNanos = MAX_CONNECTION_IDLE_NANOS_DISABLED;
1✔
139
  boolean permitKeepAliveWithoutCalls;
140
  long permitKeepAliveTimeInNanos = TimeUnit.MINUTES.toNanos(5);
1✔
141
  long maxConnectionAgeInNanos = MAX_CONNECTION_AGE_NANOS_DISABLED;
1✔
142
  long maxConnectionAgeGraceInNanos = MAX_CONNECTION_AGE_GRACE_NANOS_INFINITE;
1✔
143
  int maxConcurrentCallsPerConnection = MAX_CONCURRENT_STREAMS;
1✔
144

145
  OkHttpServerBuilder(
146
      SocketAddress address, HandshakerSocketFactory handshakerSocketFactory) {
1✔
147
    this.listenAddress = Preconditions.checkNotNull(address, "address");
1✔
148
    this.handshakerSocketFactory =
1✔
149
        Preconditions.checkNotNull(handshakerSocketFactory, "handshakerSocketFactory");
1✔
150
  }
1✔
151

152
  @Internal
153
  @Override
154
  protected ServerBuilder<?> delegate() {
155
    return serverImplBuilder;
1✔
156
  }
157

158
  // @VisibleForTesting
159
  OkHttpServerBuilder setTransportTracerFactory(TransportTracer.Factory transportTracerFactory) {
160
    this.transportTracerFactory = transportTracerFactory;
1✔
161
    return this;
1✔
162
  }
163

164
  /**
165
   * Override the default executor necessary for internal transport use.
166
   *
167
   * <p>The channel does not take ownership of the given executor. It is the caller' responsibility
168
   * to shutdown the executor when appropriate.
169
   */
170
  public OkHttpServerBuilder transportExecutor(Executor transportExecutor) {
171
    if (transportExecutor == null) {
1✔
172
      this.transportExecutorPool = DEFAULT_TRANSPORT_EXECUTOR_POOL;
×
173
    } else {
174
      this.transportExecutorPool = new FixedObjectPool<>(transportExecutor);
1✔
175
    }
176
    return this;
1✔
177
  }
178

179
  /**
180
   * Override the default {@link ServerSocketFactory} used to listen. If the socket factory is not
181
   * set or set to null, a default one will be used.
182
   */
183
  public OkHttpServerBuilder socketFactory(ServerSocketFactory socketFactory) {
184
    if (socketFactory == null) {
×
185
      this.socketFactory = ServerSocketFactory.getDefault();
×
186
    } else {
187
      this.socketFactory = socketFactory;
×
188
    }
189
    return this;
×
190
  }
191

192
  /**
193
   * Sets the time without read activity before sending a keepalive ping. An unreasonably small
194
   * value might be increased, and {@code Long.MAX_VALUE} nano seconds or an unreasonably large
195
   * value will disable keepalive. Defaults to two hours.
196
   *
197
   * @throws IllegalArgumentException if time is not positive
198
   */
199
  @Override
200
  public OkHttpServerBuilder keepAliveTime(long keepAliveTime, TimeUnit timeUnit) {
201
    Preconditions.checkArgument(keepAliveTime > 0L, "keepalive time must be positive");
×
202
    keepAliveTimeNanos = timeUnit.toNanos(keepAliveTime);
×
203
    keepAliveTimeNanos = KeepAliveManager.clampKeepAliveTimeInNanos(keepAliveTimeNanos);
×
204
    if (keepAliveTimeNanos >= AS_LARGE_AS_INFINITE) {
×
205
      // Bump keepalive time to infinite. This disables keepalive.
206
      keepAliveTimeNanos = GrpcUtil.KEEPALIVE_TIME_NANOS_DISABLED;
×
207
    }
208
    return this;
×
209
  }
210

211
  /**
212
   * Sets a custom max connection idle time, connection being idle for longer than which will be
213
   * gracefully terminated. Idleness duration is defined since the most recent time the number of
214
   * outstanding RPCs became zero or the connection establishment. An unreasonably small value might
215
   * be increased. {@code Long.MAX_VALUE} nano seconds or an unreasonably large value will disable
216
   * max connection idle.
217
   */
218
  @Override
219
  public OkHttpServerBuilder maxConnectionIdle(long maxConnectionIdle, TimeUnit timeUnit) {
220
    checkArgument(maxConnectionIdle > 0L, "max connection idle must be positive: %s",
1✔
221
        maxConnectionIdle);
222
    maxConnectionIdleInNanos = timeUnit.toNanos(maxConnectionIdle);
1✔
223
    if (maxConnectionIdleInNanos >= AS_LARGE_AS_INFINITE) {
1✔
224
      maxConnectionIdleInNanos = MAX_CONNECTION_IDLE_NANOS_DISABLED;
×
225
    }
226
    if (maxConnectionIdleInNanos < MIN_MAX_CONNECTION_IDLE_NANO) {
1✔
227
      maxConnectionIdleInNanos = MIN_MAX_CONNECTION_IDLE_NANO;
×
228
    }
229
    return this;
1✔
230
  }
231

232
  /**
233
   * Sets a custom max connection age, connection lasting longer than which will be gracefully
234
   * terminated. An unreasonably small value might be increased.  A random jitter of +/-10% will be
235
   * added to it. {@code Long.MAX_VALUE} nano seconds or an unreasonably large value will disable
236
   * max connection age.
237
   */
238
  @Override
239
  public OkHttpServerBuilder maxConnectionAge(long maxConnectionAge, TimeUnit timeUnit) {
240
    checkArgument(maxConnectionAge > 0L, "max connection age must be positive: %s",
1✔
241
        maxConnectionAge);
242
    maxConnectionAgeInNanos = timeUnit.toNanos(maxConnectionAge);
1✔
243
    if (maxConnectionAgeInNanos >= AS_LARGE_AS_INFINITE) {
1✔
244
      maxConnectionAgeInNanos = MAX_CONNECTION_AGE_NANOS_DISABLED;
×
245
    }
246
    if (maxConnectionAgeInNanos < MIN_MAX_CONNECTION_AGE_NANO) {
1✔
247
      maxConnectionAgeInNanos = MIN_MAX_CONNECTION_AGE_NANO;
×
248
    }
249
    return this;
1✔
250
  }
251

252
  /**
253
   * Sets a custom grace time for the graceful connection termination. Once the max connection age
254
   * is reached, RPCs have the grace time to complete. RPCs that do not complete in time will be
255
   * cancelled, allowing the connection to terminate. {@code Long.MAX_VALUE} nano seconds or an
256
   * unreasonably large value are considered infinite.
257
   *
258
   * @see #maxConnectionAge(long, TimeUnit)
259
   */
260
  @Override
261
  public OkHttpServerBuilder maxConnectionAgeGrace(long maxConnectionAgeGrace, TimeUnit timeUnit) {
262
    checkArgument(maxConnectionAgeGrace >= 0L, "max connection age grace must be non-negative: %s",
1✔
263
        maxConnectionAgeGrace);
264
    maxConnectionAgeGraceInNanos = timeUnit.toNanos(maxConnectionAgeGrace);
1✔
265
    if (maxConnectionAgeGraceInNanos >= AS_LARGE_AS_INFINITE) {
1✔
266
      maxConnectionAgeGraceInNanos = MAX_CONNECTION_AGE_GRACE_NANOS_INFINITE;
×
267
    }
268
    return this;
1✔
269
  }
270

271
  /**
272
   * Sets a time waiting for read activity after sending a keepalive ping. If the time expires
273
   * without any read activity on the connection, the connection is considered dead. An unreasonably
274
   * small value might be increased. Defaults to 20 seconds.
275
   *
276
   * <p>This value should be at least multiple times the RTT to allow for lost packets.
277
   *
278
   * @throws IllegalArgumentException if timeout is not positive
279
   */
280
  @Override
281
  public OkHttpServerBuilder keepAliveTimeout(long keepAliveTimeout, TimeUnit timeUnit) {
282
    Preconditions.checkArgument(keepAliveTimeout > 0L, "keepalive timeout must be positive");
×
283
    keepAliveTimeoutNanos = timeUnit.toNanos(keepAliveTimeout);
×
284
    keepAliveTimeoutNanos = KeepAliveManager.clampKeepAliveTimeoutInNanos(keepAliveTimeoutNanos);
×
285
    return this;
×
286
  }
287

288
  /**
289
   * Specify the most aggressive keep-alive time clients are permitted to configure. The server will
290
   * try to detect clients exceeding this rate and when detected will forcefully close the
291
   * connection. The default is 5 minutes.
292
   *
293
   * <p>Even though a default is defined that allows some keep-alives, clients must not use
294
   * keep-alive without approval from the service owner. Otherwise, they may experience failures in
295
   * the future if the service becomes more restrictive. When unthrottled, keep-alives can cause a
296
   * significant amount of traffic and CPU usage, so clients and servers should be conservative in
297
   * what they use and accept.
298
   *
299
   * @see #permitKeepAliveWithoutCalls(boolean)
300
   */
301
  @CanIgnoreReturnValue
302
  @Override
303
  public OkHttpServerBuilder permitKeepAliveTime(long keepAliveTime, TimeUnit timeUnit) {
304
    checkArgument(keepAliveTime >= 0, "permit keepalive time must be non-negative: %s",
1✔
305
        keepAliveTime);
306
    permitKeepAliveTimeInNanos = timeUnit.toNanos(keepAliveTime);
1✔
307
    return this;
1✔
308
  }
309

310
  /**
311
   * Sets whether to allow clients to send keep-alive HTTP/2 PINGs even if there are no outstanding
312
   * RPCs on the connection. Defaults to {@code false}.
313
   *
314
   * @see #permitKeepAliveTime(long, TimeUnit)
315
   */
316
  @CanIgnoreReturnValue
317
  @Override
318
  public OkHttpServerBuilder permitKeepAliveWithoutCalls(boolean permit) {
319
    permitKeepAliveWithoutCalls = permit;
1✔
320
    return this;
1✔
321
  }
322

323
  /**
324
   * Sets the flow control window in bytes. If not called, the default value is 64 KiB.
325
   */
326
  public OkHttpServerBuilder flowControlWindow(int flowControlWindow) {
327
    Preconditions.checkState(flowControlWindow > 0, "flowControlWindow must be positive");
1✔
328
    this.flowControlWindow = flowControlWindow;
1✔
329
    return this;
1✔
330
  }
331

332
  /**
333
   * Provides a custom scheduled executor service.
334
   *
335
   * <p>It's an optional parameter. If the user has not provided a scheduled executor service when
336
   * the channel is built, the builder will use a static thread pool.
337
   *
338
   * @return this
339
   */
340
  public OkHttpServerBuilder scheduledExecutorService(
341
      ScheduledExecutorService scheduledExecutorService) {
342
    this.scheduledExecutorServicePool = new FixedObjectPool<>(
1✔
343
        Preconditions.checkNotNull(scheduledExecutorService, "scheduledExecutorService"));
1✔
344
    return this;
1✔
345
  }
346

347
  /**
348
   * Sets the maximum size of metadata allowed to be received. Defaults to 8 KiB.
349
   *
350
   * <p>The implementation does not currently limit memory usage; this value is checked only after
351
   * the metadata is decoded from the wire. It does prevent large metadata from being passed to the
352
   * application.
353
   *
354
   * @param bytes the maximum size of received metadata
355
   * @return this
356
   * @throws IllegalArgumentException if bytes is non-positive
357
   */
358
  @Override
359
  public OkHttpServerBuilder maxInboundMetadataSize(int bytes) {
360
    Preconditions.checkArgument(bytes > 0, "maxInboundMetadataSize must be > 0");
×
361
    this.maxInboundMetadataSize = bytes;
×
362
    return this;
×
363
  }
364

365
  /**
366
   * The maximum number of concurrent calls permitted for each incoming connection. Defaults to no
367
   * limit.
368
   */
369
  @CanIgnoreReturnValue
370
  public OkHttpServerBuilder maxConcurrentCallsPerConnection(int maxConcurrentCallsPerConnection) {
371
    checkArgument(maxConcurrentCallsPerConnection > 0,
1✔
372
        "max must be positive: %s", maxConcurrentCallsPerConnection);
373
    this.maxConcurrentCallsPerConnection = maxConcurrentCallsPerConnection;
1✔
374
    return this;
1✔
375
  }
376

377
  /**
378
   * Sets the maximum message size allowed to be received on the server. If not called, defaults to
379
   * defaults to 4 MiB. The default provides protection to servers who haven't considered the
380
   * possibility of receiving large messages while trying to be large enough to not be hit in normal
381
   * usage.
382
   *
383
   * @param bytes the maximum number of bytes a single message can be.
384
   * @return this
385
   * @throws IllegalArgumentException if bytes is negative.
386
   */
387
  @Override
388
  public OkHttpServerBuilder maxInboundMessageSize(int bytes) {
389
    Preconditions.checkArgument(bytes >= 0, "negative max bytes");
1✔
390
    maxInboundMessageSize = bytes;
1✔
391
    return this;
1✔
392
  }
393

394
  void setStatsEnabled(boolean value) {
395
    this.serverImplBuilder.setStatsEnabled(value);
1✔
396
  }
1✔
397

398
  InternalServer buildTransportServers(
399
      List<? extends ServerStreamTracer.Factory> streamTracerFactories) {
400
    return new OkHttpServer(this, streamTracerFactories, serverImplBuilder.getChannelz());
1✔
401
  }
402

403
  private static final EnumSet<TlsServerCredentials.Feature> understoodTlsFeatures =
1✔
404
      EnumSet.of(
1✔
405
          TlsServerCredentials.Feature.MTLS, TlsServerCredentials.Feature.CUSTOM_MANAGERS);
406

407
  static HandshakerSocketFactoryResult handshakerSocketFactoryFrom(ServerCredentials creds) {
408
    if (creds instanceof TlsServerCredentials) {
1✔
409
      TlsServerCredentials tlsCreds = (TlsServerCredentials) creds;
1✔
410
      Set<TlsServerCredentials.Feature> incomprehensible =
1✔
411
          tlsCreds.incomprehensible(understoodTlsFeatures);
1✔
412
      if (!incomprehensible.isEmpty()) {
1✔
413
        return HandshakerSocketFactoryResult.error(
×
414
            "TLS features not understood: " + incomprehensible);
415
      }
416
      KeyManager[] km = null;
1✔
417
      if (tlsCreds.getKeyManagers() != null) {
1✔
418
        km = tlsCreds.getKeyManagers().toArray(new KeyManager[0]);
×
419
      } else if (tlsCreds.getPrivateKey() != null) {
1✔
420
        if (tlsCreds.getPrivateKeyPassword() != null) {
1✔
421
          return HandshakerSocketFactoryResult.error("byte[]-based private key with password "
×
422
              + "unsupported. Use unencrypted file or KeyManager");
423
        }
424
        try {
425
          km = OkHttpChannelBuilder.createKeyManager(
1✔
426
              tlsCreds.getCertificateChain(), tlsCreds.getPrivateKey());
1✔
427
        } catch (GeneralSecurityException gse) {
×
428
          log.log(Level.FINE, "Exception loading private key from credential", gse);
×
429
          return HandshakerSocketFactoryResult.error(
×
430
              "Unable to load private key: " + gse.getMessage());
×
431
        }
1✔
432
      } // else don't have a client cert
433
      TrustManager[] tm = null;
1✔
434
      if (tlsCreds.getTrustManagers() != null) {
1✔
435
        tm = tlsCreds.getTrustManagers().toArray(new TrustManager[0]);
×
436
      } else if (tlsCreds.getRootCertificates() != null) {
1✔
437
        try {
438
          tm = createTrustManager(tlsCreds.getRootCertificates());
1✔
439
        } catch (GeneralSecurityException gse) {
×
440
          log.log(Level.FINE, "Exception loading root certificates from credential", gse);
×
441
          return HandshakerSocketFactoryResult.error(
×
442
              "Unable to load root certificates: " + gse.getMessage());
×
443
        }
1✔
444
      } // else use system default
445
      SSLContext sslContext;
446
      try {
447
        sslContext = SSLContext.getInstance("TLS", Platform.get().getProvider());
1✔
448
        sslContext.init(km, tm, null);
1✔
449
      } catch (GeneralSecurityException gse) {
×
450
        throw new RuntimeException("TLS Provider failure", gse);
×
451
      }
1✔
452
      SSLSocketFactory sslSocketFactory = sslContext.getSocketFactory();
1✔
453
      switch (tlsCreds.getClientAuth()) {
1✔
454
        case OPTIONAL:
455
          sslSocketFactory = new ClientCertRequestingSocketFactory(sslSocketFactory, false);
1✔
456
          break;
1✔
457

458
        case REQUIRE:
459
          sslSocketFactory = new ClientCertRequestingSocketFactory(sslSocketFactory, true);
1✔
460
          break;
1✔
461

462
        case NONE:
463
          // NOOP; this is the SSLContext default
464
          break;
1✔
465

466
        default:
467
          return HandshakerSocketFactoryResult.error(
×
468
              "Unknown TlsServerCredentials.ClientAuth value: " + tlsCreds.getClientAuth());
×
469
      }
470
      return HandshakerSocketFactoryResult.factory(new TlsServerHandshakerSocketFactory(
1✔
471
          new SslSocketFactoryServerCredentials.ServerCredentials(sslSocketFactory)));
472

473
    } else if (creds instanceof InsecureServerCredentials) {
1✔
474
      return HandshakerSocketFactoryResult.factory(new PlaintextHandshakerSocketFactory());
1✔
475

476
    } else if (creds instanceof SslSocketFactoryServerCredentials.ServerCredentials) {
1✔
477
      SslSocketFactoryServerCredentials.ServerCredentials factoryCreds =
×
478
          (SslSocketFactoryServerCredentials.ServerCredentials) creds;
479
      return HandshakerSocketFactoryResult.factory(
×
480
          new TlsServerHandshakerSocketFactory(factoryCreds));
481

482
    } else if (creds instanceof ChoiceServerCredentials) {
1✔
483
      ChoiceServerCredentials choiceCreds = (ChoiceServerCredentials) creds;
×
484
      StringBuilder error = new StringBuilder();
×
485
      for (ServerCredentials innerCreds : choiceCreds.getCredentialsList()) {
×
486
        HandshakerSocketFactoryResult result = handshakerSocketFactoryFrom(innerCreds);
×
487
        if (result.error == null) {
×
488
          return result;
×
489
        }
490
        error.append(", ");
×
491
        error.append(result.error);
×
492
      }
×
493
      return HandshakerSocketFactoryResult.error(error.substring(2));
×
494

495
    } else {
496
      return HandshakerSocketFactoryResult.error(
1✔
497
          "Unsupported credential type: " + creds.getClass().getName());
1✔
498
    }
499
  }
500

501
  static final class HandshakerSocketFactoryResult {
502
    public final HandshakerSocketFactory factory;
503
    public final String error;
504

505
    private HandshakerSocketFactoryResult(HandshakerSocketFactory factory, String error) {
1✔
506
      this.factory = factory;
1✔
507
      this.error = error;
1✔
508
    }
1✔
509

510
    public static HandshakerSocketFactoryResult error(String error) {
511
      return new HandshakerSocketFactoryResult(
1✔
512
          null, Preconditions.checkNotNull(error, "error"));
1✔
513
    }
514

515
    public static HandshakerSocketFactoryResult factory(HandshakerSocketFactory factory) {
516
      return new HandshakerSocketFactoryResult(
1✔
517
          Preconditions.checkNotNull(factory, "factory"), null);
1✔
518
    }
519
  }
520

521
  static final class ClientCertRequestingSocketFactory extends SSLSocketFactory {
522
    private final SSLSocketFactory socketFactory;
523
    private final boolean required;
524

525
    public ClientCertRequestingSocketFactory(SSLSocketFactory socketFactory, boolean required) {
1✔
526
      this.socketFactory = Preconditions.checkNotNull(socketFactory, "socketFactory");
1✔
527
      this.required = required;
1✔
528
    }
1✔
529

530
    private Socket apply(Socket s) throws IOException {
531
      if (!(s instanceof SSLSocket)) {
1✔
532
        throw new IOException(
×
533
            "SocketFactory " + socketFactory + " did not produce an SSLSocket: " + s.getClass());
×
534
      }
535
      SSLSocket sslSocket = (SSLSocket) s;
1✔
536
      if (required) {
1✔
537
        sslSocket.setNeedClientAuth(true);
1✔
538
      } else {
539
        sslSocket.setWantClientAuth(true);
1✔
540
      }
541
      return sslSocket;
1✔
542
    }
543

544
    @Override public Socket createSocket(Socket s, String host, int port, boolean autoClose)
545
        throws IOException {
546
      return apply(socketFactory.createSocket(s, host, port, autoClose));
1✔
547
    }
548

549
    @Override public Socket createSocket(String host, int port) throws IOException {
550
      return apply(socketFactory.createSocket(host, port));
×
551
    }
552

553
    @Override public Socket createSocket(
554
        String host, int port, InetAddress localHost, int localPort) throws IOException {
555
      return apply(socketFactory.createSocket(host, port, localHost, localPort));
×
556
    }
557

558
    @Override public Socket createSocket(InetAddress host, int port) throws IOException {
559
      return apply(socketFactory.createSocket(host, port));
×
560
    }
561

562
    @Override public Socket createSocket(
563
        InetAddress host, int port, InetAddress localAddress, int localPort) throws IOException {
564
      return apply(socketFactory.createSocket(host, port, localAddress, localPort));
×
565
    }
566

567
    @Override public String[] getDefaultCipherSuites() {
568
      return socketFactory.getDefaultCipherSuites();
×
569
    }
570

571
    @Override public String[] getSupportedCipherSuites() {
572
      return socketFactory.getSupportedCipherSuites();
×
573
    }
574
  }
575
}
STATUS · Troubleshooting · Open an Issue · Sales · Support · CAREERS · ENTERPRISE · START FREE · SCHEDULE DEMO
ANNOUNCEMENTS · TWITTER · TOS & SLA · Supported CI Services · What's a CI service? · Automated Testing

© 2026 Coveralls, Inc