public final class SSL extends Object
Constructor and Description |
---|
SSL() |
Modifier and Type | Method and Description |
---|---|
static String[] |
authenticationMethods(long ssl) |
static void |
clearError()
Clear all the errors from the error queue that OpenSSL encountered on this thread.
|
static void |
clearOptions(long ssl,
int options)
Clear OpenSSL Option.
|
static int |
closeBIO(long bio)
Close BIO and dereference callback object
|
static int |
doHandshake(long ssl)
SSL_do_handshake
|
static int |
fipsModeGet()
Get the status of FIPS Mode.
|
static int |
fipsModeSet(int mode)
Enable/Disable FIPS Mode.
|
static void |
flushBIO(long bio)
BIO_flush
|
static void |
freeBIO(long bio)
BIO_free
|
static void |
freePrivateKey(long privateKey)
Free private key (
EVP_PKEY pointer). |
static void |
freeSSL(long ssl)
SSL_free
|
static void |
freeX509Chain(long x509Chain)
Free x509 chain (
STACK_OF(X509) pointer). |
static boolean |
generateRSATempKey(int idx)
Generate temporary RSA key.
|
static String |
getAlpnSelected(long ssl)
SSL_get0_alpn_selected
|
static String |
getCipherForSSL(long ssl)
SSL_get_cipher
|
static String[] |
getCiphers(long ssl)
Returns all Returns the cipher suites that are available for negotiation in an SSL handshake.
|
static int |
getError(long ssl,
int ret)
SSL_get_error
|
static String |
getErrorString(long errorNumber) |
static int |
getHandshakeCount(long ssl)
Returns the number of handshakes done for this SSL instance.
|
static String |
getLastError()
Return last SSL error string
|
static int |
getLastErrorNumber()
Get the error number representing the last error OpenSSL encountered on this thread.
|
static String |
getNextProtoNegotiated(long ssl)
SSL_get0_next_proto_negotiated
|
static int |
getOptions(long ssl)
Get OpenSSL Option.
|
static byte[][] |
getPeerCertChain(long ssl)
Get the peer certificate chain or
null if non was send. |
static byte[] |
getPeerCertificate(long ssl)
Get the peer certificate or
null if non was send. |
static byte[] |
getSessionId(long ssl)
Returns the ID of the session as byte array representation.
|
static int |
getShutdown(long ssl)
SSL_get_shutdown
|
static long |
getTime(long ssl)
SSL_get_time
|
static long |
getTimeout(long ssl)
SSL_get_timeout
|
static String |
getVersion(long ssl)
SSL_get_version
|
static boolean |
hasOp(int op)
Return true if all the requested SSL_OP_* are supported by OpenSSL.
|
static int |
initialize(String engine)
Initialize OpenSSL support.
|
static int |
isInInit(long SSL)
SSL_in_init
|
static boolean |
loadDSATempKey(int idx,
String file)
Load temporary DSA key from file
Index can be one of: |
static long |
makeNetworkBIO(long ssl)
Creates a BIO with the default max BIO size.
|
static long |
makeNetworkBIO(long ssl,
int maxBioSize)
Creates a BIO with the given max BIO size.
|
static long |
makeNetworkBIO(long ssl,
int maxInternalBIOSize,
int maxNetworkBIOSize)
Wire up internal and network BIOs for the given SSL instance.
|
static long |
newBIO(long pool,
BIOCallback callback)
Initialize new BIO
|
static long |
newMemBIO()
Initialize new in-memory BIO that is located in the secure heap.
|
static long |
newSSL(long ctx,
boolean server)
SSL_new
|
static long |
parsePrivateKey(long privateKeyBio,
String password)
Parse private key from BIO and return
EVP_PKEY pointer. |
static long |
parseX509Chain(long x509ChainBio)
Parse X509 chain from BIO and return (
STACK_OF(X509) pointer). |
static int |
pendingReadableBytesInSSL(long ssl)
SSL_pending
|
static int |
pendingWrittenBytesInBIO(long bio)
BIO_ctrl_pending
|
static boolean |
randLoad(String filename)
Add content of the file to the PRNG
|
static boolean |
randMake(String filename,
int len,
boolean base64)
Creates random data to filename
|
static boolean |
randSave(String filename)
Writes a number of random bytes (currently 1024) to
file
filename which can be used to initialize the PRNG
by calling randLoad in a later session. |
static void |
randSet(String filename)
Sets global random filename.
|
static int |
readFromBIO(long bio,
long rbuf,
int rlen)
BIO_read
|
static int |
readFromSSL(long ssl,
long rbuf,
int rlen)
SSL_read
|
static int |
renegotiate(long ssl)
Call SSL_renegotiate.
|
static void |
setBIO(long ssl,
long rbio,
long wbio)
SSL_set_bio
|
static void |
setCertificateBio(long ssl,
long certBio,
long keyBio,
String password)
Set Certificate
Point setCertificate at a PEM encoded certificate stored in a BIO. |
static void |
setCertificateChainBio(long ssl,
long bio,
boolean skipfirst)
Set BIO of PEM-encoded Server CA Certificates
|
static boolean |
setCipherSuites(long ssl,
String ciphers)
Returns the cipher suites available for negotiation in SSL handshake.
|
static void |
setOptions(long ssl,
int options)
Set OpenSSL Option.
|
static void |
setPassword(String password)
Set global Password for decrypting certificates and keys.
|
static void |
setPasswordCallback(PasswordCallback callback)
Set global Password callback for obtaining passwords.
|
static void |
setShutdown(long ssl,
int mode)
SSL_set_shutdown
|
static void |
setState(long ssl,
int state)
Call SSL_set_state.
|
static long |
setTimeout(long ssl,
long seconds)
SSL_set_timeout
|
static void |
setTlsExtHostName(long ssl,
String hostname)
Call SSL_set_tlsext_host_name
|
static void |
setVerify(long ssl,
int level,
int depth)
Set Type of Client Certificate verification and Maximum depth of CA Certificates
in Client Certificate verification.
|
static boolean |
shouldRetryBIO(long bio)
BIO_should_retry
|
static int |
shutdownSSL(long ssl)
SSL_shutdown
|
static int |
version() |
static String |
versionString() |
static int |
writeToBIO(long bio,
long wbuf,
int wlen)
BIO_write
|
static int |
writeToSSL(long ssl,
long wbuf,
int wlen)
SSL_write
|
public static final int UNSET
public static final int SSL_ALGO_UNKNOWN
public static final int SSL_ALGO_RSA
public static final int SSL_ALGO_DSA
public static final int SSL_ALGO_ALL
@Deprecated public static final int SSL_AIDX_RSA
@Deprecated public static final int SSL_AIDX_DSA
@Deprecated public static final int SSL_AIDX_MAX
public static final int SSL_TMP_KEY_RSA_512
public static final int SSL_TMP_KEY_RSA_1024
public static final int SSL_TMP_KEY_RSA_2048
public static final int SSL_TMP_KEY_RSA_4096
public static final int SSL_TMP_KEY_DH_512
public static final int SSL_TMP_KEY_DH_1024
public static final int SSL_TMP_KEY_DH_2048
public static final int SSL_TMP_KEY_DH_4096
public static final int SSL_TMP_KEY_MAX
public static final int SSL_OPT_NONE
public static final int SSL_OPT_RELSET
public static final int SSL_OPT_STDENVVARS
public static final int SSL_OPT_EXPORTCERTDATA
public static final int SSL_OPT_FAKEBASICAUTH
public static final int SSL_OPT_STRICTREQUIRE
public static final int SSL_OPT_OPTRENEGOTIATE
public static final int SSL_OPT_ALL
public static final int SSL_PROTOCOL_NONE
public static final int SSL_PROTOCOL_SSLV2
public static final int SSL_PROTOCOL_SSLV3
public static final int SSL_PROTOCOL_TLSV1
public static final int SSL_PROTOCOL_TLSV1_1
public static final int SSL_PROTOCOL_TLSV1_2
public static final int SSL_PROTOCOL_TLS
public static final int SSL_PROTOCOL_ALL
public static final int SSL_CVERIFY_UNSET
public static final int SSL_CVERIFY_NONE
public static final int SSL_CVERIFY_OPTIONAL
public static final int SSL_CVERIFY_REQUIRE
public static final int SSL_CVERIFY_OPTIONAL_NO_CA
public static final int SSL_VERIFY_NONE
public static final int SSL_VERIFY_PEER
public static final int SSL_VERIFY_FAIL_IF_NO_PEER_CERT
public static final int SSL_VERIFY_CLIENT_ONCE
public static final int SSL_VERIFY_PEER_STRICT
public static final int SSL_OP_MICROSOFT_SESS_ID_BUG
public static final int SSL_OP_NETSCAPE_CHALLENGE_BUG
public static final int SSL_OP_NETSCAPE_REUSE_CIPHER_CHANGE_BUG
public static final int SSL_OP_SSLREF2_REUSE_CERT_TYPE_BUG
public static final int SSL_OP_MICROSOFT_BIG_SSLV3_BUFFER
public static final int SSL_OP_MSIE_SSLV2_RSA_PADDING
public static final int SSL_OP_SSLEAY_080_CLIENT_DH_BUG
public static final int SSL_OP_TLS_D5_BUG
public static final int SSL_OP_TLS_BLOCK_PADDING_BUG
public static final int SSL_OP_DONT_INSERT_EMPTY_FRAGMENTS
public static final int SSL_OP_ALL
public static final int SSL_OP_NO_SESSION_RESUMPTION_ON_RENEGOTIATION
public static final int SSL_OP_NO_COMPRESSION
public static final int SSL_OP_ALLOW_UNSAFE_LEGACY_RENEGOTIATION
public static final int SSL_OP_SINGLE_ECDH_USE
public static final int SSL_OP_SINGLE_DH_USE
public static final int SSL_OP_EPHEMERAL_RSA
public static final int SSL_OP_CIPHER_SERVER_PREFERENCE
public static final int SSL_OP_TLS_ROLLBACK_BUG
public static final int SSL_OP_NO_SSLv2
public static final int SSL_OP_NO_SSLv3
public static final int SSL_OP_NO_TLSv1
public static final int SSL_OP_NO_TLSv1_2
public static final int SSL_OP_NO_TLSv1_1
public static final int SSL_OP_NO_TICKET
@Deprecated public static final int SSL_OP_PKCS1_CHECK_1
@Deprecated public static final int SSL_OP_PKCS1_CHECK_2
public static final int SSL_OP_NETSCAPE_CA_DN_BUG
public static final int SSL_OP_NETSCAPE_DEMO_CIPHER_CHANGE_BUG
public static final int SSL_CRT_FORMAT_UNDEF
public static final int SSL_CRT_FORMAT_ASN1
public static final int SSL_CRT_FORMAT_TEXT
public static final int SSL_CRT_FORMAT_PEM
public static final int SSL_CRT_FORMAT_NETSCAPE
public static final int SSL_CRT_FORMAT_PKCS12
public static final int SSL_CRT_FORMAT_SMIME
public static final int SSL_CRT_FORMAT_ENGINE
public static final int SSL_MODE_CLIENT
public static final int SSL_MODE_SERVER
public static final int SSL_MODE_COMBINED
public static final int SSL_SHUTDOWN_TYPE_UNSET
public static final int SSL_SHUTDOWN_TYPE_STANDARD
public static final int SSL_SHUTDOWN_TYPE_UNCLEAN
public static final int SSL_SHUTDOWN_TYPE_ACCURATE
public static final int SSL_INFO_SESSION_ID
public static final int SSL_INFO_CIPHER
public static final int SSL_INFO_CIPHER_USEKEYSIZE
public static final int SSL_INFO_CIPHER_ALGKEYSIZE
public static final int SSL_INFO_CIPHER_VERSION
public static final int SSL_INFO_CIPHER_DESCRIPTION
public static final int SSL_INFO_PROTOCOL
public static final int SSL_INFO_CLIENT_S_DN
public static final int SSL_INFO_CLIENT_I_DN
public static final int SSL_INFO_SERVER_S_DN
public static final int SSL_INFO_SERVER_I_DN
public static final int SSL_INFO_DN_COUNTRYNAME
public static final int SSL_INFO_DN_STATEORPROVINCENAME
public static final int SSL_INFO_DN_LOCALITYNAME
public static final int SSL_INFO_DN_ORGANIZATIONNAME
public static final int SSL_INFO_DN_ORGANIZATIONALUNITNAME
public static final int SSL_INFO_DN_COMMONNAME
public static final int SSL_INFO_DN_TITLE
public static final int SSL_INFO_DN_INITIALS
public static final int SSL_INFO_DN_GIVENNAME
public static final int SSL_INFO_DN_SURNAME
public static final int SSL_INFO_DN_DESCRIPTION
public static final int SSL_INFO_DN_UNIQUEIDENTIFIER
public static final int SSL_INFO_DN_EMAILADDRESS
public static final int SSL_INFO_CLIENT_M_VERSION
public static final int SSL_INFO_CLIENT_M_SERIAL
public static final int SSL_INFO_CLIENT_V_START
public static final int SSL_INFO_CLIENT_V_END
public static final int SSL_INFO_CLIENT_A_SIG
public static final int SSL_INFO_CLIENT_A_KEY
public static final int SSL_INFO_CLIENT_CERT
public static final int SSL_INFO_CLIENT_V_REMAIN
public static final int SSL_INFO_SERVER_M_VERSION
public static final int SSL_INFO_SERVER_M_SERIAL
public static final int SSL_INFO_SERVER_V_START
public static final int SSL_INFO_SERVER_V_END
public static final int SSL_INFO_SERVER_A_SIG
public static final int SSL_INFO_SERVER_A_KEY
public static final int SSL_INFO_SERVER_CERT
public static final int SSL_INFO_CLIENT_CERT_CHAIN
public static final long SSL_SESS_CACHE_OFF
public static final long SSL_SESS_CACHE_SERVER
public static final int SSL_SELECTOR_FAILURE_NO_ADVERTISE
public static final int SSL_SELECTOR_FAILURE_CHOOSE_MY_LAST_PROTOCOL
public static final int SSL_ST_CONNECT
public static final int SSL_ST_ACCEPT
public static final int SSL_MODE_ENABLE_PARTIAL_WRITE
public static final int SSL_MODE_ACCEPT_MOVING_WRITE_BUFFER
public static final int SSL_MODE_AUTO_RETRY
public static final int SSL_MODE_NO_AUTO_CHAIN
public static final int SSL_MODE_RELEASE_BUFFERS
public static final int SSL_MODE_SEND_CLIENTHELLO_TIME
public static final int SSL_MODE_SEND_SERVERHELLO_TIME
public static final int SSL_MODE_SEND_FALLBACK_SCSV
public static final int SSL_SENT_SHUTDOWN
public static final int SSL_RECEIVED_SHUTDOWN
public static final int SSL_ERROR_NONE
public static final int SSL_ERROR_SSL
public static final int SSL_ERROR_WANT_READ
public static final int SSL_ERROR_WANT_WRITE
public static final int SSL_ERROR_WANT_X509_LOOKUP
public static final int SSL_ERROR_SYSCALL
public static final int SSL_ERROR_ZERO_RETURN
public static final int SSL_ERROR_WANT_CONNECT
public static final int SSL_ERROR_WANT_ACCEPT
public static int version()
public static String versionString()
public static int initialize(String engine)
engine
- Support for external a Crypto Device ("engine"),
usually
a hardware accelerator card for crypto operations.public static int fipsModeGet() throws Exception
0
if OpenSSL is not
in FIPS mode, 1
if OpenSSL is in FIPS Mode.Exception
- If tcnative was not compiled with FIPS Mode available.public static int fipsModeSet(int mode) throws Exception
mode
- 1 - enable, 0 - disableException
- If tcnative was not compiled with FIPS Mode available,
or if FIPS_mode_set()
call returned an error value.public static boolean randLoad(String filename)
filename
- Filename containing random data.
If null the default file will be tested.
The seed file is $RANDFILE if that environment variable is
set, $HOME/.rnd otherwise.
In case both files are unavailable builtin
random seed generator is used.public static boolean randSave(String filename)
filename
which can be used to initialize the PRNG
by calling randLoad in a later session.filename
- Filename to save the datapublic static boolean randMake(String filename, int len, boolean base64)
filename
- Filename to save the datalen
- The length of random sequence in bytesbase64
- Output the data in Base64 encoded formatpublic static void randSet(String filename)
filename
- Filename to use.
If set it will be used for SSL initialization
and all contexts where explicitly not set.public static long newBIO(long pool, BIOCallback callback) throws Exception
pool
- The pool to use.callback
- BIOCallback to useException
public static long newMemBIO() throws Exception
Exception
public static int closeBIO(long bio)
bio
- BIO to close and destroy.public static void setPasswordCallback(PasswordCallback callback)
callback
- PasswordCallback implementation to use.public static void setPassword(String password)
password
- Password to use.public static boolean generateRSATempKey(int idx)
SSL_TMP_KEY_RSA_512 SSL_TMP_KEY_RSA_1024 SSL_TMP_KEY_RSA_2048 SSL_TMP_KEY_RSA_4096By default 512 and 1024 keys are generated on startup. You can use a low priority thread to generate them on the fly.
idx
- temporary key index.public static boolean loadDSATempKey(int idx, String file)
SSL_TMP_KEY_DH_512 SSL_TMP_KEY_DH_1024 SSL_TMP_KEY_DH_2048 SSL_TMP_KEY_DH_4096
idx
- temporary key index.file
- File containing DH params.public static String getLastError()
public static boolean hasOp(int op)
true
if and only if op
=
SSL_OP_ALLOW_UNSAFE_LEGACY_RENEGOTIATION
and tcnative
supports that flag.op
- Bitwise-OR of all SSL_OP_* to test.public static long newSSL(long ctx, boolean server)
ctx
- Server or Client context to use.server
- if true configure SSL instance to use accept handshake routines
if false configure SSL instance to use connect handshake routinespublic static void setBIO(long ssl, long rbio, long wbio)
ssl
- SSL pointer (SSL *)rbio
- read BIO pointer (BIO *)wbio
- write BIO pointer (BIO *)public static int getError(long ssl, int ret)
ssl
- SSL pointer (SSL *)ret
- TLS/SSL I/O return valuepublic static int pendingWrittenBytesInBIO(long bio)
bio
- BIO pointer (BIO *)public static int pendingReadableBytesInSSL(long ssl)
ssl
- SSL pointer (SSL *)public static int writeToBIO(long bio, long wbuf, int wlen)
bio
- wbuf
- wlen
- public static int readFromBIO(long bio, long rbuf, int rlen)
bio
- rbuf
- rlen
- public static boolean shouldRetryBIO(long bio)
bio
- the BIO.true
if the failed BIO operation should be retried later.public static int writeToSSL(long ssl, long wbuf, int wlen)
ssl
- the SSL instance (SSL *)wbuf
- wlen
- public static int readFromSSL(long ssl, long rbuf, int rlen)
ssl
- the SSL instance (SSL *)rbuf
- rlen
- public static int getShutdown(long ssl)
ssl
- the SSL instance (SSL *)public static void setShutdown(long ssl, int mode)
ssl
- the SSL instance (SSL *)mode
- public static void freeSSL(long ssl)
ssl
- the SSL instance (SSL *)public static long makeNetworkBIO(long ssl)
makeNetworkBIO(long, int)
public static long makeNetworkBIO(long ssl, int maxBioSize)
makeNetworkBIO(long, int, int)
public static long makeNetworkBIO(long ssl, int maxInternalBIOSize, int maxNetworkBIOSize)
ssl
- the SSL instance (SSL *)maxInternalBIOSize
- The maximum size of the application side BIO. Pass 0 to use the default max size.maxNetworkBIOSize
- The maximum size of the network side BIO. Pass 0 to use the default max size.public static void freeBIO(long bio)
bio
- public static void flushBIO(long bio)
bio
- public static int shutdownSSL(long ssl)
ssl
- the SSL instance (SSL *)public static int getLastErrorNumber()
public static String getCipherForSSL(long ssl)
ssl
- the SSL instance (SSL *)public static String getVersion(long ssl)
ssl
- the SSL instance (SSL *)public static int doHandshake(long ssl)
ssl
- the SSL instance (SSL *)public static int isInInit(long SSL)
SSL
- public static String getNextProtoNegotiated(long ssl)
ssl
- the SSL instance (SSL *)public static String getAlpnSelected(long ssl)
ssl
- the SSL instance (SSL *)public static byte[][] getPeerCertChain(long ssl)
null
if non was send.public static byte[] getPeerCertificate(long ssl)
null
if non was send.public static String getErrorString(long errorNumber)
public static long getTime(long ssl)
ssl
- the SSL instance (SSL *)public static long getTimeout(long ssl)
ssl
- the SSL instance (SSL *)public static long setTimeout(long ssl, long seconds)
ssl
- the SSL instance (SSL *)seconds
- timeout in secondspublic static void setVerify(long ssl, int level, int depth)
SSL_CVERIFY_NONE - No client Certificate is required at all SSL_CVERIFY_OPTIONAL - The client may present a valid Certificate SSL_CVERIFY_REQUIRE - The client has to present a valid Certificate SSL_CVERIFY_OPTIONAL_NO_CA - The client may present a valid Certificate but it need not to be (successfully) verifiable
setCACertificatePath
, etc.ssl
- the SSL instance (SSL *)level
- Type of Client Certificate verification.depth
- Maximum depth of CA Certificates in Client Certificate
verification.public static void setOptions(long ssl, int options)
ssl
- the SSL instance (SSL *)options
- See SSL.SSL_OP_* for option flags.public static void clearOptions(long ssl, int options)
ssl
- the SSL instance (SSL *)options
- See SSL.SSL_OP_* for option flags.public static int getOptions(long ssl)
ssl
- the SSL instance (SSL *)public static String[] getCiphers(long ssl)
ssl
- the SSL instance (SSL *)public static boolean setCipherSuites(long ssl, String ciphers) throws Exception
ssl
- the SSL instance (SSL *)ciphers
- an SSL cipher specificationException
public static byte[] getSessionId(long ssl)
ssl
- the SSL instance (SSL *)public static int getHandshakeCount(long ssl)
ssl
- the SSL instance (SSL *)public static void clearError()
public static int renegotiate(long ssl)
ssl
- the SSL instance (SSL *)public static void setState(long ssl, int state)
ssl
- the SSL instance (SSL *)public static void setTlsExtHostName(long ssl, String hostname)
ssl
- the SSL instance (SSL *)hostname
- the hostnamepublic static String[] authenticationMethods(long ssl)
public static void setCertificateChainBio(long ssl, long bio, boolean skipfirst)
This directive sets the optional all-in-one file where you can assemble the certificates of Certification Authorities (CA) which form the certificate chain of the server certificate. This starts with the issuing CA certificate of of the server certificate and can range up to the root CA certificate. Such a file is simply the concatenation of the various PEM-encoded CA Certificate files, usually in certificate chain order.
But be careful: Providing the certificate chain works only if you are using a single (either RSA or DSA) based server certificate. If you are using a coupled RSA+DSA certificate pair, this will work only if actually both certificates use the same certificate chain. Otherwsie the browsers will be confused in this situation.
ssl
- Server or Client to use.bio
- BIO of PEM-encoded Server CA Certificates.skipfirst
- Skip first certificate if chain file is inside
certificate file.public static void setCertificateBio(long ssl, long certBio, long keyBio, String password) throws Exception
ssl
- Server or Client to use.certBio
- Certificate BIO.keyBio
- Private Key BIO to use if not in cert.password
- Certificate password. If null and certificate
is encrypted.Exception
public static long parsePrivateKey(long privateKeyBio, String password) throws Exception
EVP_PKEY
pointer.
Be sure you understand how OpenSsl will behave with respect to reference counting!
If the EVP_PKEY
pointer is used with the client certificate callback
CertificateRequestedCallback
the ownership goes over to OpenSsl / Tcnative and so calling
freePrivateKey(long)
should NOT be done in this case. Otherwise you may
need to call freePrivateKey(long)
to decrement the reference count and free memory.
Exception
public static void freePrivateKey(long privateKey)
EVP_PKEY
pointer).public static long parseX509Chain(long x509ChainBio) throws Exception
STACK_OF(X509)
pointer).
Be sure you understand how OpenSsl will behave with respect to reference counting!
If the STACK_OF(X509)
pointer is used with the client certificate callback
CertificateRequestedCallback
the ownership goes over to OpenSsl / Tcnative and and so calling
freeX509Chain(long)
should NOT be done in this case. Otherwise you may
need to call freeX509Chain(long)
to decrement the reference count and free memory.
Exception
public static void freeX509Chain(long x509Chain)
STACK_OF(X509)
pointer).Copyright © 2008–2024 The Netty Project. All rights reserved.