javax.net.ssl
Class SSLSocket
- java.lang.Object
java.net.Socket
javax.net.ssl.SSLSocket
- public abstract class SSLSocket
- extends Socket
Socket
s and provides secure
socket using protocols such as the "Secure
Sockets Layer" (SSL) or IETF "Transport Layer Security" (TLS) protocols.
Such sockets are normal stream sockets, but they add a layer of security protections over the underlying network transport protocol, such as TCP. Those protections include:
- Integrity Protection. SSL protects against modification of messages by an active wiretapper.
- Authentication. In most modes, SSL provides peer authentication. Servers are usually authenticated, and clients may be authenticated as requested by servers.
- Confidentiality (Privacy Protection). In most modes, SSL encrypts data being sent between client and server. This protects the confidentiality of data, so that passive wiretappers won't see sensitive data such as financial information or personal information of many kinds.
These kinds of protection are specified by a "cipher suite", which is a combination of cryptographic algorithms used by a given SSL connection. During the negotiation process, the two endpoints must agree on a ciphersuite that is available in both environments. If there is no such suite in common, no SSL connection can be established, and no data can be exchanged.
The cipher suite used is established by a negotiation process called "handshaking". The goal of this process is to create or rejoin a "session", which may protect many connections over time. After handshaking has completed, you can access session attributes by using the getSession method. The initial handshake on this connection can be initiated in one of three ways:
- calling
startHandshake
which explicitly begins handshakes, or - any attempt to read or write application data on this socket causes an implicit handshake, or
- a call to
getSession
tries to set up a session if there is no currently valid session, and an implicit handshake is done.
If handshaking fails for any reason, the SSLSocket
is closed, and no futher communications can be done.
There are two groups of cipher suites which you will need to know about when managing cipher suites:
- Supported cipher suites: all the suites which are supported by the SSL implementation. This list is reported using getSupportedCipherSuites.
- Enabled cipher suites, which may be fewer than the full set of supported suites. This group is set using the setEnabledCipherSuites method, and queried using the getEnabledCipherSuites method. Initially, a default set of cipher suites will be enabled on a new socket that represents the minimum suggested configuration.
Implementation defaults require that only cipher suites which authenticate servers and provide confidentiality be enabled by default. Only if both sides explicitly agree to unauthenticated and/or non-private (unencrypted) communications will such a ciphersuite be selected.
When SSLSocket
s are first created, no handshaking
is done so that applications may first set their communication
preferences: what cipher suites to use, whether the socket should be
in client or server mode, etc.
However, security is always provided by the time that application data
is sent over the connection.
You may register to receive event notification of handshake
completion. This involves
the use of two additional classes. HandshakeCompletedEvent
objects are passed to HandshakeCompletedListener instances,
which are registered by users of this API.
SSLSocket
s are created by SSLSocketFactory
s,
or by accept
ing a connection from a
SSLServerSocket
.
A SSL socket must choose to operate in the client or server mode. This will determine who begins the handshaking process, as well as which messages should be sent by each party. Each connection must have one client and one server, or handshaking will not progress properly. Once the initial handshaking has started, a socket can not switch between client and server modes, even when performing renegotiations.
Constructor Summary
Modifier | Constructor and Description |
---|---|
|
SSLSocket()
Used only by subclasses.
|
|
SSLSocket(InetAddress address,int port)
Used only by subclasses.
|
|
SSLSocket(InetAddress address,int port,InetAddress clientAddress,int clientPort)
Used only by subclasses.
|
|
SSLSocket(String host,int port)
Used only by subclasses.
|
|
SSLSocket(String host,int port,InetAddress clientAddress,int clientPort)
Used only by subclasses.
|
Method Summary
Modifier and Type | Method and Description |
---|---|
|
addHandshakeCompletedListener(HandshakeCompletedListener listener)
Registers an event listener to receive notifications that an
SSL handshake has completed on this connection.
|
|
getEnabledCipherSuites()
Returns the names of the SSL cipher suites which are currently
enabled for use on this connection.
|
|
getEnabledProtocols()
Returns the names of the protocol versions which are currently
enabled for use on this connection.
|
|
getEnableSessionCreation()
Returns true if new SSL sessions may be established by this socket.
|
|
getNeedClientAuth()
Returns true if the socket will require client authentication.
|
|
getSession()
Returns the SSL Session in use by this connection.
|
getSSLParameters()
Returns the SSLParameters in effect for this SSLSocket.
|
|
|
getSupportedCipherSuites()
Returns the names of the cipher suites which could be enabled for use
on this connection.
|
|
getSupportedProtocols()
Returns the names of the protocols which could be enabled for use
on an SSL connection.
|
|
getUseClientMode()
Returns true if the socket is set to use client mode when
handshaking.
|
|
getWantClientAuth()
Returns true if the socket will request client authentication.
|
|
removeHandshakeCompletedListener(HandshakeCompletedListener listener)
Removes a previously registered handshake completion listener.
|
|
setEnabledCipherSuites(String[] suites)
Sets the cipher suites enabled for use on this connection.
|
|
setEnabledProtocols(String[] protocols)
Sets the protocol versions enabled for use on this connection.
|
|
setEnableSessionCreation(boolean flag)
Controls whether new SSL sessions may be established by this socket.
|
|
setNeedClientAuth(boolean need)
Configures the socket to require client authentication.
|
|
setSSLParameters(SSLParameters params)
Applies SSLParameters to this socket.
|
|
setUseClientMode(boolean mode)
Configures the socket to use client (or server) mode when
handshaking.
|
|
setWantClientAuth(boolean want)
Configures the socket to request client authentication.
|
|
startHandshake()
Starts an SSL handshake on this connection.
|
Methods inherited from class java.lang.Object |
---|
clone, equals, finalize, getClass, hashCode, notify, notifyAll, wait, wait, wait |
Constructor Detail
SSLSocket
- protected SSLSocket()
SSLSocket
- protected SSLSocket(String host,
- int port)
- throws IOException
- UnknownHostException
host
- name of the host with which to connect port
- number of the server's port IOException
- if an I/O error occurs when creating the socket UnknownHostException
- if the host is not known SSLSocket
- protected SSLSocket(InetAddress address,
- int port)
- throws IOException
address
- the server's host port
- its port IOException
- if an I/O error occurs when creating the socket SSLSocket
- protected SSLSocket(String host,
- int port,
- InetAddress clientAddress,
- int clientPort)
- throws IOException
- UnknownHostException
host
- name of the host with which to connect port
- number of the server's port clientAddress
- the client's host clientPort
- number of the client's port IOException
- if an I/O error occurs when creating the socket UnknownHostException
- if the host is not known SSLSocket
- protected SSLSocket(InetAddress address,
- int port,
- InetAddress clientAddress,
- int clientPort)
- throws IOException
address
- the server's host port
- its port clientAddress
- the client's host clientPort
- number of the client's port IOException
- if an I/O error occurs when creating the socket Method Detail
getSupportedCipherSuites
- public abstract String[] getSupportedCipherSuites( )
getEnabledCipherSuites
- public abstract String[] getEnabledCipherSuites( )
Even if a suite has been enabled, it might never be used. (For example, the peer does not support it, the requisite certificates (and private keys) for the suite are not available, or an anonymous suite is enabled but authentication is required.
setEnabledCipherSuites
- public abstract void setEnabledCipherSuites( String[] suites)
Each cipher suite in the suites
parameter must have
been listed by getSupportedCipherSuites(), or the method will
fail. Following a successful call to this method, only suites
listed in the suites
parameter are enabled for use.
See getEnabledCipherSuites()
for more information
on why a specific ciphersuite may never be used on a connection.
suites
- Names of all the cipher suites to enable IllegalArgumentException
- when one or more of the ciphers
named by the parameter is not supported, or when the
parameter is null. getSupportedProtocols
- public abstract String[] getSupportedProtocols( )
getEnabledProtocols
- public abstract String[] getEnabledProtocols( )
setEnabledProtocols
- public abstract void setEnabledProtocols( String[] protocols)
The protocols must have been listed by
getSupportedProtocols()
as being supported.
Following a successful call to this method, only protocols listed
in the protocols
parameter are enabled for use.
protocols
- Names of all the protocols to enable. IllegalArgumentException
- when one or more of
the protocols named by the parameter is not supported or
when the protocols parameter is null. getSession
- public abstract SSLSession getSession( )
This method will initiate the initial handshake if necessary and then block until the handshake has been established.
If an error occurs during the initial handshake, this method returns an invalid session object which reports an invalid cipher suite of "SSL_NULL_WITH_NULL_NULL".
SSLSession
addHandshakeCompletedListener
- public abstract void addHandshakeCompletedListener( HandshakeCompletedListener listener)
listener
- the HandShake Completed event listener IllegalArgumentException
- if the argument is null. removeHandshakeCompletedListener
- public abstract void removeHandshakeCompletedListener( HandshakeCompletedListener listener)
listener
- the HandShake Completed event listener IllegalArgumentException
- if the listener is not registered,
or the argument is null. startHandshake
- public abstract void startHandshake( )
- throws IOException
If data has already been sent on the connection, it continues to flow during this handshake. When the handshake completes, this will be signaled with an event. This method is synchronous for the initial handshake on a connection and returns when the negotiated handshake is complete. Some protocols may not support multiple handshakes on an existing socket and may throw an IOException.
setUseClientMode
- public abstract void setUseClientMode( boolean mode)
This method must be called before any handshaking occurs. Once handshaking has begun, the mode can not be reset for the life of this socket.
Servers normally authenticate themselves, and clients are not required to do so.
mode
- true if the socket should start its handshaking
in "client" mode IllegalArgumentException
- if a mode change is attempted
after the initial handshake has begun. getUseClientMode
- public abstract boolean getUseClientMode( )
setNeedClientAuth
- public abstract void setNeedClientAuth( boolean need)
A socket's client authentication setting is one of the following:
- client authentication required
- client authentication requested
- no client authentication desired
Unlike setWantClientAuth(boolean)
, if this option is set and
the client chooses not to provide authentication information
about itself, the negotiations will stop and the connection
will be dropped.
Calling this method overrides any previous setting made by
this method or setWantClientAuth(boolean)
.
need
- set to true if client authentication is required,
or false if no client authentication is desired. getNeedClientAuth
- public abstract boolean getNeedClientAuth( )
setWantClientAuth
- public abstract void setWantClientAuth( boolean want)
A socket's client authentication setting is one of the following:
- client authentication required
- client authentication requested
- no client authentication desired
Unlike setNeedClientAuth(boolean)
, if this option is set and
the client chooses not to provide authentication information
about itself, the negotiations will continue.
Calling this method overrides any previous setting made by
this method or setNeedClientAuth(boolean)
.
want
- set to true if client authentication is requested,
or false if no client authentication is desired. getWantClientAuth
- public abstract boolean getWantClientAuth( )
setEnableSessionCreation
- public abstract void setEnableSessionCreation( boolean flag)
flag
- true indicates that sessions may be created; this
is the default. false indicates that an existing session
must be resumed getEnableSessionCreation
- public abstract boolean getEnableSessionCreation( )
getSSLParameters
- public SSLParameters getSSLParameters( )
setSSLParameters
- public void setSSLParameters(SSLParameters params)
This means:
- if
params.getCipherSuites()
is non-null,setEnabledCipherSuites()
is called with that value - if
params.getProtocols()
is non-null,setEnabledProtocols()
is called with that value - if
params.getNeedClientAuth()
orparams.getWantClientAuth()
returntrue
,setNeedClientAuth(true)
andsetWantClientAuth(true)
are called, respectively; otherwisesetWantClientAuth(false)
is called.
params
- the parameters IllegalArgumentException
- if the setEnabledCipherSuites() or
the setEnabledProtocols() call fails