Package org.conscrypt
Class SSLParametersImpl
java.lang.Object
org.conscrypt.SSLParametersImpl
- All Implemented Interfaces:
Cloneable
The instances of this class encapsulate all the info
about enabled cipher suites and protocols,
as well as the information about client/server mode of
ssl socket, whether it require/want client authentication or not,
and controls whether new SSL sessions may be established by this
socket or not.
-
Nested Class Summary
Nested ClassesModifier and TypeClassDescription(package private) static interface
For abstracting the X509KeyManager calls betweenX509KeyManager.chooseClientAlias(String[], java.security.Principal[], java.net.Socket)
andX509ExtendedKeyManager.chooseEngineClientAlias(String[], java.security.Principal[], javax.net.ssl.SSLEngine)
(package private) static interface
For abstracting thePSKKeyManager
calls between those taking anSSLSocket
and those taking anSSLEngine
. -
Field Summary
FieldsModifier and TypeFieldDescriptionprivate AlgorithmConstraints
(package private) byte[]
(package private) ApplicationProtocolSelectorAdapter
(package private) boolean
Whether the TLS Channel ID extension is enabled.private boolean
private final ClientSessionContext
private boolean
private static SSLParametersImpl
private static X509KeyManager
private static X509TrustManager
private static final String[]
private boolean
(package private) String[]
(package private) String[]
private String
(package private) boolean
private boolean
(package private) byte[]
private final PSKKeyManager
(package private) byte[]
private final ServerSessionContext
private Collection
<SNIMatcher> private boolean
(package private) boolean
private Boolean
private boolean
private final X509KeyManager
private final X509TrustManager
-
Constructor Summary
ConstructorsModifierConstructorDescription(package private)
SSLParametersImpl
(KeyManager[] kms, TrustManager[] tms, SecureRandom sr, ClientSessionContext clientSessionContext, ServerSessionContext serverSessionContext, String[] protocols) Initializes the parameters.private
SSLParametersImpl
(ClientSessionContext clientSessionContext, ServerSessionContext serverSessionContext, X509KeyManager x509KeyManager, PSKKeyManager pskKeyManager, X509TrustManager x509TrustManager, SSLParametersImpl sslParams) -
Method Summary
Modifier and TypeMethodDescriptionprotected Object
clone()
Returns the clone of this object.(package private) SSLParametersImpl
cloneWithTrustManager
(X509TrustManager newTrustManager) private static X509KeyManager
private static X509TrustManager
private static String[]
filterFromCipherSuites
(String[] cipherSuites, Set<String> toRemove) private static String[]
filterFromProtocols
(String[] protocols, String obsoleteProtocol) This filtersobsoleteProtocol
from the list ofprotocols
down to help with app compatibility.private static PSKKeyManager
findFirstPSKKeyManager
(KeyManager[] kms) Finds the firstPSKKeyManager
element in the provided array.private static X509KeyManager
Finds the firstX509KeyManager
element in the provided array.private static X509TrustManager
Finds the firstX509TrustManager
element in the provided array.(package private) AlgorithmConstraints
(package private) String[]
(package private) ApplicationProtocolSelectorAdapter
Returns the application protocol (ALPN) selector for this socket.(package private) ClientSessionContext
(package private) static SSLParametersImpl
private static String[]
getDefaultCipherSuites
(boolean x509CipherSuitesNeeded, boolean pskCipherSuitesNeeded) private static X509KeyManager
(package private) static X509TrustManager
Gets the default X.509 trust manager.(package private) String[]
(package private) String[]
(package private) boolean
Returns the value indicating if the peer with this parameters allowed to cteate new SSL session(package private) String
(package private) boolean
Returns the value indicating if the peer with this parameters tuned to require client authentication(package private) byte[]
(package private) PSKKeyManager
(package private) AbstractSessionContext
Returns the appropriate session context.(package private) Collection
<SNIMatcher> (package private) boolean
(package private) boolean
Returns the value indicating if the parameters configured to work in client mode.(package private) boolean
Returns whether connections using this SSL connection should use the TLS extension Server Name Indication (SNI).(package private) boolean
Returns the value indicating if the peer with this parameters tuned to request client authentication(package private) X509KeyManager
(package private) X509TrustManager
(package private) boolean
isCTVerificationEnabled
(String hostname) Check if SCT verification is enforced for a given hostname.private boolean
Returns whether Server Name Indication (SNI) is enabled by default for sockets.(package private) void
setAlgorithmConstraints
(AlgorithmConstraints algorithmConstraints) (package private) void
setApplicationProtocols
(String[] protocols) Sets the list of ALPN protocols.(package private) void
setApplicationProtocolSelector
(ApplicationProtocolSelectorAdapter applicationProtocolSelector) Used for server-mode only.(package private) void
setCTVerificationEnabled
(boolean enabled) For testing only.(package private) void
setEnabledCipherSuites
(String[] cipherSuites) Sets the enabled cipher suites after filtering through OpenSSL.(package private) void
setEnabledProtocols
(String[] protocols) Sets the list of available protocols for use in SSL connection.(package private) void
setEnableSessionCreation
(boolean flag) Allows/disallows the peer holding this parameters to create new SSL session(package private) void
setEndpointIdentificationAlgorithm
(String endpointIdentificationAlgorithm) (package private) void
setNeedClientAuth
(boolean need) Tunes the peer holding this parameters to require client authentication(package private) void
setOCSPResponse
(byte[] response) For testing only.(package private) void
setSCTExtension
(byte[] extension) For testing only.(package private) void
setSNIMatchers
(Collection<SNIMatcher> sniMatchers) (package private) void
setUseCipherSuitesOrder
(boolean useCipherSuitesOrder) (package private) void
setUseClientMode
(boolean mode) Tunes the peer holding this parameters to work in client mode.(package private) void
setUseSessionTickets
(boolean useSessionTickets) (package private) void
setUseSni
(boolean flag) Whether connections using this SSL connection should use the TLS extension Server Name Indication (SNI).(package private) void
setWantClientAuth
(boolean want) Tunes the peer holding this parameters to request client authentication
-
Field Details
-
defaultX509KeyManager
-
defaultX509TrustManager
-
defaultParameters
-
clientSessionContext
-
serverSessionContext
-
x509KeyManager
-
pskKeyManager
-
x509TrustManager
-
enabledProtocols
String[] enabledProtocols -
isEnabledProtocolsFiltered
boolean isEnabledProtocolsFiltered -
enabledCipherSuites
String[] enabledCipherSuites -
client_mode
private boolean client_mode -
need_client_auth
private boolean need_client_auth -
want_client_auth
private boolean want_client_auth -
enable_session_creation
private boolean enable_session_creation -
endpointIdentificationAlgorithm
-
useCipherSuitesOrder
private boolean useCipherSuitesOrder -
sniMatchers
-
algorithmConstraints
-
ctVerificationEnabled
private boolean ctVerificationEnabled -
sctExtension
byte[] sctExtension -
ocspResponse
byte[] ocspResponse -
applicationProtocols
byte[] applicationProtocols -
applicationProtocolSelector
ApplicationProtocolSelectorAdapter applicationProtocolSelector -
useSessionTickets
boolean useSessionTickets -
useSni
-
channelIdEnabled
boolean channelIdEnabledWhether the TLS Channel ID extension is enabled. This field is server-side only. -
EMPTY_STRING_ARRAY
-
-
Constructor Details
-
SSLParametersImpl
SSLParametersImpl(KeyManager[] kms, TrustManager[] tms, SecureRandom sr, ClientSessionContext clientSessionContext, ServerSessionContext serverSessionContext, String[] protocols) throws KeyManagementException Initializes the parameters. Naturally this constructor is used in SSLContextImpl.engineInit method which directly passes its parameters. In other words this constructor holds all the functionality provided by SSLContext.init method. SeeSSLContext.init(KeyManager[],TrustManager[], SecureRandom)
for more information- Throws:
KeyManagementException
-
SSLParametersImpl
private SSLParametersImpl(ClientSessionContext clientSessionContext, ServerSessionContext serverSessionContext, X509KeyManager x509KeyManager, PSKKeyManager pskKeyManager, X509TrustManager x509TrustManager, SSLParametersImpl sslParams)
-
-
Method Details
-
getDefault
- Throws:
KeyManagementException
-
getSessionContext
AbstractSessionContext getSessionContext()Returns the appropriate session context. -
getClientSessionContext
ClientSessionContext getClientSessionContext()- Returns:
- client session context
-
getX509KeyManager
X509KeyManager getX509KeyManager()- Returns:
- X.509 key manager or
null
for none.
-
getPSKKeyManager
PSKKeyManager getPSKKeyManager()- Returns:
- Pre-Shared Key (PSK) key manager or
null
for none.
-
getX509TrustManager
X509TrustManager getX509TrustManager()- Returns:
- X.509 trust manager or
null
for none.
-
getEnabledCipherSuites
String[] getEnabledCipherSuites()- Returns:
- the names of enabled cipher suites
-
setEnabledCipherSuites
Sets the enabled cipher suites after filtering through OpenSSL. -
getEnabledProtocols
String[] getEnabledProtocols()- Returns:
- the set of enabled protocols
-
setEnabledProtocols
Sets the list of available protocols for use in SSL connection.- Throws:
IllegalArgumentException
- ifprotocols == null
-
setApplicationProtocols
Sets the list of ALPN protocols.- Parameters:
protocols
- the list of ALPN protocols
-
getApplicationProtocols
String[] getApplicationProtocols() -
setApplicationProtocolSelector
Used for server-mode only. Sets or clears the application-provided ALPN protocol selector. If set, will override the protocol list provided bysetApplicationProtocols(String[])
. -
getApplicationProtocolSelector
ApplicationProtocolSelectorAdapter getApplicationProtocolSelector()Returns the application protocol (ALPN) selector for this socket. -
setUseClientMode
void setUseClientMode(boolean mode) Tunes the peer holding this parameters to work in client mode.- Parameters:
mode
- if the peer is configured to work in client mode
-
getUseClientMode
boolean getUseClientMode()Returns the value indicating if the parameters configured to work in client mode. -
setNeedClientAuth
void setNeedClientAuth(boolean need) Tunes the peer holding this parameters to require client authentication -
getNeedClientAuth
boolean getNeedClientAuth()Returns the value indicating if the peer with this parameters tuned to require client authentication -
setWantClientAuth
void setWantClientAuth(boolean want) Tunes the peer holding this parameters to request client authentication -
getWantClientAuth
boolean getWantClientAuth()Returns the value indicating if the peer with this parameters tuned to request client authentication -
setEnableSessionCreation
void setEnableSessionCreation(boolean flag) Allows/disallows the peer holding this parameters to create new SSL session -
getEnableSessionCreation
boolean getEnableSessionCreation()Returns the value indicating if the peer with this parameters allowed to cteate new SSL session -
setUseSessionTickets
void setUseSessionTickets(boolean useSessionTickets) -
setUseSni
void setUseSni(boolean flag) Whether connections using this SSL connection should use the TLS extension Server Name Indication (SNI). -
getUseSni
boolean getUseSni()Returns whether connections using this SSL connection should use the TLS extension Server Name Indication (SNI). -
setCTVerificationEnabled
void setCTVerificationEnabled(boolean enabled) For testing only. -
setSCTExtension
void setSCTExtension(byte[] extension) For testing only. -
setOCSPResponse
void setOCSPResponse(byte[] response) For testing only. -
getOCSPResponse
byte[] getOCSPResponse() -
filterFromProtocols
This filtersobsoleteProtocol
from the list ofprotocols
down to help with app compatibility. -
filterFromCipherSuites
-
isSniEnabledByDefault
private boolean isSniEnabledByDefault()Returns whether Server Name Indication (SNI) is enabled by default for sockets. For more information on SNI, see RFC 6066 section 3. -
clone
Returns the clone of this object. -
cloneWithTrustManager
-
getDefaultX509KeyManager
- Throws:
KeyManagementException
-
createDefaultX509KeyManager
- Throws:
KeyManagementException
-
findFirstX509KeyManager
Finds the firstX509KeyManager
element in the provided array.- Returns:
- the first
X509KeyManager
ornull
if not found.
-
findFirstPSKKeyManager
Finds the firstPSKKeyManager
element in the provided array.- Returns:
- the first
PSKKeyManager
ornull
if not found.
-
getDefaultX509TrustManager
Gets the default X.509 trust manager.- Throws:
KeyManagementException
-
createDefaultX509TrustManager
- Throws:
KeyManagementException
-
findFirstX509TrustManager
Finds the firstX509TrustManager
element in the provided array.- Returns:
- the first
X509ExtendedTrustManager
orX509TrustManager
ornull
if not found.
-
getEndpointIdentificationAlgorithm
String getEndpointIdentificationAlgorithm() -
setEndpointIdentificationAlgorithm
-
getUseCipherSuitesOrder
boolean getUseCipherSuitesOrder() -
getSNIMatchers
Collection<SNIMatcher> getSNIMatchers() -
setSNIMatchers
-
getAlgorithmConstraints
AlgorithmConstraints getAlgorithmConstraints() -
setAlgorithmConstraints
-
setUseCipherSuitesOrder
void setUseCipherSuitesOrder(boolean useCipherSuitesOrder) -
getDefaultCipherSuites
private static String[] getDefaultCipherSuites(boolean x509CipherSuitesNeeded, boolean pskCipherSuitesNeeded) -
isCTVerificationEnabled
Check if SCT verification is enforced for a given hostname.
-