Source code
package io.netty.handler.codec.quic;
import io.netty.util.concurrent.FastThreadLocal;
import javax.crypto.Mac;
import javax.crypto.spec.SecretKeySpec;
import java.nio.ByteBuffer;
import java.security.InvalidKeyException;
import java.security.NoSuchAlgorithmException;
import java.security.SecureRandom;
import java.util.Arrays;
final class Hmac {
private static final String ALGORITHM = "HmacSHA256";
private static final byte[] CID_KEY = new byte[32];
private static final byte[] TOKEN_KEY = new byte[32];
static {
SecureRandom rng = new SecureRandom();
rng.nextBytes(CID_KEY);
rng.nextBytes(TOKEN_KEY);
}
private static final FastThreadLocal<Mac> CID_MACS = new FastThreadLocal<Mac>() {
@Override
protected Mac initialValue() {
return newMac(CID_KEY);
}
};
private static final FastThreadLocal<Mac> TOKEN_MACS = new FastThreadLocal<Mac>() {
@Override
protected Mac initialValue() {
return newMac(TOKEN_KEY);
}
};
private static Mac newMac(byte[] key) {
try {
SecretKeySpec keySpec = new SecretKeySpec(key, ALGORITHM);
Mac mac = Mac.getInstance(ALGORITHM);
mac.init(keySpec);
return mac;
} catch (NoSuchAlgorithmException | InvalidKeyException exception) {
throw new IllegalStateException(exception);
}
}
private static ByteBuffer sign(Mac mac, ByteBuffer input, int outLength) {
mac.reset();
mac.update(input);
byte[] signBytes = mac.doFinal();
if (signBytes.length != outLength) {
signBytes = Arrays.copyOf(signBytes, outLength);
}
return ByteBuffer.wrap(signBytes);
}
static ByteBuffer signCid(ByteBuffer input, int outLength) {
return sign(CID_MACS.get(), input, outLength);
}
static ByteBuffer signToken(ByteBuffer input, int outLength) {
return sign(TOKEN_MACS.get(), input, outLength);
}
private Hmac() { }
}
Run 1
The code is well-structured with clear separation of concerns. Static initialization, thread-local management, and signing logic are organized into distinct sections. Nesting is minimal, with only one level for exception handling. Intent is clear: an HMAC utility for QUIC connection IDs and tokens. Code length is appropriate - no unnecessary verbosity. Action granularity is good, with one logical operation per line in most places. Reading flow is natural and logical. Minor deductions: empty comment lines (1-3) look like placeholders, the redundant array copy check could be simplified since HMAC-SHA256 always outputs 32 bytes, and constants could benefit from brief doc comments explaining their security role.
Run 2
The code is generally well-structured with clear separation of concerns: key generation, MAC initialization, signing logic, and public API methods. It maintains flat nesting throughout, with only one level of indentation in the try-catch block. Intent is clear - this is a utility class for HMAC-SHA256 signing with thread-local MAC instances. The static initializer and thread-local setup are logically organized. Minor readability concerns include: empty Javadoc comments that add no value, the somewhat cryptic signBytes.length != outLength check (which truncates or pads via copyOf), and lack of documentation on why CID and TOKEN need separate keys. The FastThreadLocal anonymous classes add slight noise compared to lambda-style initialization. Overall the code is concise, uses meaningful method names, and follows good action granularity.
Run 3
The code is well-structured with clear separation of concerns: constants, initialization, thread-local setup, and signing logic. Nesting is minimal—only one level in the static initializer and no nested conditionals. The intent is clear from method names like signCid and signToken. Action granularity is good, with one logical operation per line. Reading flow is natural, moving from setup to helper methods to public API. The try-catch for checked exceptions is handled cleanly via IllegalStateException. Minor deductions: the three blank lines after the ALGORITHM constant feel excessive, and the anonymous inner classes for FastThreadLocal add some verbosity, but overall the code is concise and readable.
Run 1
Code Structure: Constants, key initialization, thread-local instances, shared helpers, and public-facing operations are logically organized. Nesting: Shallow try/catch and conditional blocks keep complexity low. Clarity of intent: Descriptive names and the HmacSHA256 constant make the signing purpose clear, though CID is unexplained and input buffer consumption and output truncation/padding are undocumented. Code length: Concise overall; duplicated thread-local setup is modest, while excess blank lines add minor clutter. Action granularity: Each statement performs a distinct action, making initialization and signing easy to follow. Reading flow: Progression from configuration to implementation to entry points is natural, with consistent formatting apart from extra whitespace.
Run 2
Code Structure: Logically separates key initialization, thread-local MAC instances, shared helpers, and public-facing signing methods. Nesting: Shallow, with only simple initialization blocks, a try/catch, and one conditional. Clarity of intent: Descriptive names and the explicit algorithm make the purpose clear, though input buffer consumption and output truncation or padding are not documented. Code length: Concise overall; the two similar thread-local declarations introduce minor repetition. Action granularity: Almost every statement performs one action, making operations easy to follow. Reading flow: Natural progression from configuration to initialization and implementation, then signing entry points. Excess blank lines and slightly inconsistent spacing are minor distractions.
Run 3
Code Structure: Logically organized into constants, key initialization, thread-local MAC instances, shared helpers, and public-facing signing methods. Nesting: Shallow, with only simple try/catch and conditional blocks. Clarity of intent: Descriptive names make HMAC creation and separate CID/token signing clear; input buffer consumption and output truncation or padding are not documented. Code length: Concise overall, though the two thread-local initializers repeat a small amount of boilerplate. Action granularity: Each statement performs one clear action, making operations easy to follow. Reading flow: Natural progression from setup to implementation to entry points; extra blank lines and slightly inconsistent spacing introduce minor visual noise.