public final class Conscrypt extends Object
| Modifier and Type | Method and Description |
|---|---|
static void |
checkAvailability()
Checks that the Conscrypt support is available for the system.
|
static byte[] |
exportKeyingMaterial(SSLEngine engine,
String label,
byte[] context,
int length)
Exports a value derived from the TLS master secret as described in RFC 5705.
|
static byte[] |
exportKeyingMaterial(SSLSocket socket,
String label,
byte[] context,
int length)
Exports a value derived from the TLS master secret as described in RFC 5705.
|
static String |
getApplicationProtocol(SSLEngine engine)
Returns the ALPN protocol agreed upon by client and server.
|
static String |
getApplicationProtocol(SSLSocket socket)
Returns the ALPN protocol agreed upon by client and server.
|
static String[] |
getApplicationProtocols(SSLEngine engine)
Gets the application-layer protocols (ALPN) in prioritization order.
|
static String[] |
getApplicationProtocols(SSLSocket socket)
Gets the application-layer protocols (ALPN) in prioritization order.
|
static byte[] |
getChannelId(SSLEngine engine)
Gets the TLS Channel ID for the given server-side engine.
|
static byte[] |
getChannelId(SSLSocket socket)
Gets the TLS Channel ID for the given server-side socket.
|
static X509TrustManager |
getDefaultX509TrustManager()
Gets the default X.509 trust manager.
|
static String |
getHostname(SSLEngine engine)
Returns either the hostname supplied during socket creation or via
Conscrypt.setHostname(SSLEngine, String). |
static String |
getHostname(SSLSocket socket)
Returns either the hostname supplied during socket creation or via
Conscrypt.setHostname(SSLSocket, String). |
static String |
getHostnameOrIP(SSLSocket socket)
This method attempts to create a textual representation of the peer host or IP.
|
static byte[] |
getTlsUnique(SSLEngine engine)
Returns the tls-unique channel binding value for this connection, per RFC 5929.
|
static byte[] |
getTlsUnique(SSLSocket socket)
Returns the tls-unique channel binding value for this connection, per RFC 5929.
|
static int |
getTokenBindingParams(SSLEngine engine)
Returns the token binding parameters that were negotiated during the handshake, or -1 if
token binding parameters were not negotiated, the handshake has not yet completed,
or the connection has been closed.
|
static int |
getTokenBindingParams(SSLSocket socket)
Returns the token binding parameters that were negotiated during the handshake, or -1 if
token binding parameters were not negotiated, the handshake has not yet completed,
or the connection has been closed.
|
static boolean |
isAvailable()
Returns
true if the Conscrypt native library has been successfully loaded. |
static boolean |
isConscrypt(Provider provider)
Indicates whether the given
Provider was created by this distribution of Conscrypt. |
static boolean |
isConscrypt(SSLContext context)
Indicates whether the given
SSLContext was created by this distribution of Conscrypt. |
static boolean |
isConscrypt(SSLEngine engine)
Indicates whether the given
SSLEngine was created by this distribution of Conscrypt. |
static boolean |
isConscrypt(SSLServerSocketFactory factory)
Indicates whether the given
SSLServerSocketFactory was created by this distribution
of Conscrypt. |
static boolean |
isConscrypt(SSLSocket socket)
Indicates whether the given
SSLSocket was created by this distribution of Conscrypt. |
static boolean |
isConscrypt(SSLSocketFactory factory)
Indicates whether the given
SSLSocketFactory was created by this distribution of
Conscrypt. |
static int |
maxEncryptedPacketLength()
Returns the maximum length (in bytes) of an encrypted packet.
|
static int |
maxSealOverhead(SSLEngine engine)
Returns the maximum overhead, in bytes, of sealing a record with SSL.
|
static SSLContextSpi |
newPreferredSSLContextSpi()
Constructs a new instance of the preferred
SSLContextSpi. |
static Provider |
newProvider()
Constructs a new
Provider with the default name. |
static Provider |
newProvider(String providerName)
Constructs a new
Provider with the given name. |
static void |
setApplicationProtocols(SSLEngine engine,
String[] protocols)
Sets the application-layer protocols (ALPN) in prioritization order.
|
static void |
setApplicationProtocols(SSLSocket socket,
String[] protocols)
Sets the application-layer protocols (ALPN) in prioritization order.
|
static void |
setApplicationProtocolSelector(SSLEngine engine,
ApplicationProtocolSelector selector)
Sets an application-provided ALPN protocol selector.
|
static void |
setApplicationProtocolSelector(SSLSocket socket,
ApplicationProtocolSelector selector)
Sets an application-provided ALPN protocol selector.
|
static void |
setBufferAllocator(SSLEngine engine,
BufferAllocator bufferAllocator)
Provides the given engine with the provided bufferAllocator.
|
static void |
setChannelIdEnabled(SSLEngine engine,
boolean enabled)
Enables/disables TLS Channel ID for the given server-side engine.
|
static void |
setChannelIdEnabled(SSLSocket socket,
boolean enabled)
Enables/disables TLS Channel ID for the given server-side socket.
|
static void |
setChannelIdPrivateKey(SSLEngine engine,
PrivateKey privateKey)
Sets the
PrivateKey to be used for TLS Channel ID by this client engine. |
static void |
setChannelIdPrivateKey(SSLSocket socket,
PrivateKey privateKey)
Sets the
PrivateKey to be used for TLS Channel ID by this client socket. |
static void |
setClientSessionCache(SSLContext context,
SSLClientSessionCache cache)
Sets the client-side persistent cache to be used by the context.
|
static void |
setDefaultBufferAllocator(BufferAllocator bufferAllocator)
Configures the default
BufferAllocator to be used by all future
SSLEngine instances from this provider. |
static void |
setHandshakeListener(SSLEngine engine,
HandshakeListener handshakeListener)
Sets a listener on the given engine for completion of the TLS handshake
|
static void |
setHostname(SSLEngine engine,
String hostname)
This method enables Server Name Indication (SNI) and overrides the hostname supplied
during engine creation.
|
static void |
setHostname(SSLSocket socket,
String hostname)
This method enables Server Name Indication (SNI) and overrides the hostname supplied
during socket creation.
|
static void |
setServerSessionCache(SSLContext context,
org.conscrypt.SSLServerSessionCache cache)
Sets the server-side persistent cache to be used by the context.
|
static void |
setTokenBindingParams(SSLEngine engine,
int... params)
Enables token binding parameter negotiation on this engine, or disables it if an
empty set of parameters are provided.
|
static void |
setTokenBindingParams(SSLSocket socket,
int... params)
Enables token binding parameter negotiation on this socket, or disables it if an
empty set of parameters are provided.
|
static void |
setUseEngineSocket(SSLServerSocketFactory factory,
boolean useEngineSocket)
Configures the socket to be created for the given server socket factory instance.
|
static void |
setUseEngineSocket(SSLSocketFactory factory,
boolean useEngineSocket)
Configures the socket to be created for the given socket factory instance.
|
static void |
setUseEngineSocketByDefault(boolean useEngineSocket)
Configures the default socket to be created for all socket factory instances.
|
static void |
setUseSessionTickets(SSLEngine engine,
boolean useSessionTickets)
This method enables session ticket support.
|
static void |
setUseSessionTickets(SSLSocket socket,
boolean useSessionTickets)
This method enables session ticket support.
|
static SSLEngineResult |
unwrap(SSLEngine engine,
ByteBuffer[] srcs,
ByteBuffer[] dsts)
Extended unwrap method for multiple source and destination buffers.
|
static SSLEngineResult |
unwrap(SSLEngine engine,
ByteBuffer[] srcs,
int srcsOffset,
int srcsLength,
ByteBuffer[] dsts,
int dstsOffset,
int dstsLength)
Exteneded unwrap method for multiple source and destination buffers.
|
public static boolean isAvailable()
true if the Conscrypt native library has been successfully loaded.public static void checkAvailability()
UnsatisfiedLinkError - if unavailablepublic static boolean isConscrypt(Provider provider)
Provider was created by this distribution of Conscrypt.public static Provider newProvider(String providerName)
Provider with the given name.public static int maxEncryptedPacketLength()
@ExperimentalApi public static X509TrustManager getDefaultX509TrustManager() throws KeyManagementException
KeyManagementExceptionpublic static boolean isConscrypt(SSLContext context)
SSLContext was created by this distribution of Conscrypt.public static SSLContextSpi newPreferredSSLContextSpi()
SSLContextSpi.public static void setClientSessionCache(SSLContext context, SSLClientSessionCache cache)
public static void setServerSessionCache(SSLContext context, org.conscrypt.SSLServerSessionCache cache)
public static boolean isConscrypt(SSLSocketFactory factory)
SSLSocketFactory was created by this distribution of
Conscrypt.@ExperimentalApi public static void setUseEngineSocketByDefault(boolean useEngineSocket)
@ExperimentalApi public static void setUseEngineSocket(SSLSocketFactory factory, boolean useEngineSocket)
public static boolean isConscrypt(SSLServerSocketFactory factory)
SSLServerSocketFactory was created by this distribution
of Conscrypt.@ExperimentalApi public static void setUseEngineSocket(SSLServerSocketFactory factory, boolean useEngineSocket)
public static boolean isConscrypt(SSLSocket socket)
SSLSocket was created by this distribution of Conscrypt.public static void setHostname(SSLSocket socket, String hostname)
socket - the sockethostname - the desired SNI hostname, or null to disablepublic static String getHostname(SSLSocket socket)
Conscrypt.setHostname(SSLSocket, String). No DNS resolution is attempted before
returning the hostname.public static String getHostnameOrIP(SSLSocket socket)
public static void setUseSessionTickets(SSLSocket socket, boolean useSessionTickets)
socket - the socketuseSessionTickets - True to enable session ticketspublic static void setChannelIdEnabled(SSLSocket socket, boolean enabled)
This method needs to be invoked before the handshake starts.
socket - the socketenabled - Whether to enable channel ID.IllegalStateException - if this is a client socket or if the handshake has already
started.public static byte[] getChannelId(SSLSocket socket) throws SSLException
socket - the socketnull if not available.IllegalStateException - if this is a client socket or if the handshake has not yet
completed.SSLException - if channel ID is available but could not be obtained.public static void setChannelIdPrivateKey(SSLSocket socket, PrivateKey privateKey)
PrivateKey to be used for TLS Channel ID by this client socket.
This method needs to be invoked before the handshake starts.
socket - the socketprivateKey - private key (enables TLS Channel ID) or null for no key
(disables TLS Channel ID).
The private key must be an Elliptic Curve (EC) key based on the NIST P-256 curve (aka
SECG secp256r1 or ANSI
X9.62 prime256v1).IllegalStateException - if this is a server socket or if the handshake has already
started.public static String getApplicationProtocol(SSLSocket socket)
socket - the socketnull if no protocol was agreed upon.public static void setApplicationProtocolSelector(SSLSocket socket, ApplicationProtocolSelector selector)
Conscrypt.setApplicationProtocols(SSLSocket, String[]).socket - the socketselector - the ALPN protocol selectorpublic static void setApplicationProtocols(SSLSocket socket, String[] protocols)
socket - the socket being configuredprotocols - the protocols in descending order of preference. If empty, no protocol
indications will be used. This array will be copied.IllegalArgumentException - - if protocols is null, or if any element in a non-empty
array is null or an empty (zero-length) stringpublic static String[] getApplicationProtocols(SSLSocket socket)
socket - the socketpublic static byte[] getTlsUnique(SSLSocket socket)
null if there is no such value available, such as if the handshake
has not yet completed or this connection is closed.@ExperimentalApi public static void setTokenBindingParams(SSLSocket socket, int... params) throws SSLException
This method needs to be invoked before the handshake starts.
Token binding is currently an Internet Draft that's subject to change, so the current implementation may not be compatible with future changes in the protocol.
params - a list of Token Binding key parameters in descending order of preference,
as described in draft-ietf-tokbind-negotiation-09.IllegalStateException - if the handshake has already started.SSLException - if the setting could not be applied.@ExperimentalApi public static int getTokenBindingParams(SSLSocket socket)
public static byte[] exportKeyingMaterial(SSLSocket socket, String label, byte[] context, int length) throws SSLException
label - the label to use in calculating the exported value. This must be
an ASCII-only string.context - the application-specific context value to use in calculating the
exported value. This may be null to use no application context, which is
treated differently than an empty byte array.length - the number of bytes of keying material to return.null if the handshake has not yet
completed or the connection has been closed.SSLException - if the value could not be exported.public static boolean isConscrypt(SSLEngine engine)
SSLEngine was created by this distribution of Conscrypt.@ExperimentalApi public static void setBufferAllocator(SSLEngine engine, BufferAllocator bufferAllocator)
@ExperimentalApi public static void setDefaultBufferAllocator(BufferAllocator bufferAllocator)
BufferAllocator to be used by all future
SSLEngine instances from this provider.public static void setHostname(SSLEngine engine, String hostname)
engine - the enginehostname - the desired SNI hostname, or null to disablepublic static String getHostname(SSLEngine engine)
Conscrypt.setHostname(SSLEngine, String). No DNS resolution is attempted before
returning the hostname.public static int maxSealOverhead(SSLEngine engine)
public static void setHandshakeListener(SSLEngine engine, HandshakeListener handshakeListener)
public static void setChannelIdEnabled(SSLEngine engine, boolean enabled)
This method needs to be invoked before the handshake starts.
engine - the engineenabled - Whether to enable channel ID.IllegalStateException - if this is a client engine or if the handshake has already
started.public static byte[] getChannelId(SSLEngine engine) throws SSLException
engine - the enginenull if not available.IllegalStateException - if this is a client engine or if the handshake has not yet
completed.SSLException - if channel ID is available but could not be obtained.public static void setChannelIdPrivateKey(SSLEngine engine, PrivateKey privateKey)
PrivateKey to be used for TLS Channel ID by this client engine.
This method needs to be invoked before the handshake starts.
engine - the engineprivateKey - private key (enables TLS Channel ID) or null for no key
(disables TLS Channel ID).
The private key must be an Elliptic Curve (EC) key based on the NIST P-256 curve (aka
SECG secp256r1 or ANSI X9.62 prime256v1).IllegalStateException - if this is a server engine or if the handshake has already
started.public static SSLEngineResult unwrap(SSLEngine engine, ByteBuffer[] srcs, ByteBuffer[] dsts) throws SSLException
engine - the target engine for the unwrapsrcs - the source buffersdsts - the destination buffersSSLException - thrown if an SSL error occurredpublic static SSLEngineResult unwrap(SSLEngine engine, ByteBuffer[] srcs, int srcsOffset, int srcsLength, ByteBuffer[] dsts, int dstsOffset, int dstsLength) throws SSLException
engine - the target engine for the unwrap.srcs - the source bufferssrcsOffset - the offset in the srcs array of the first source buffersrcsLength - the number of source buffers starting at srcsOffsetdsts - the destination buffersdstsOffset - the offset in the dsts array of the first destination bufferdstsLength - the number of destination buffers starting at dstsOffsetSSLException - thrown if an SSL error occurredpublic static void setUseSessionTickets(SSLEngine engine, boolean useSessionTickets)
engine - the engineuseSessionTickets - True to enable session ticketspublic static void setApplicationProtocols(SSLEngine engine, String[] protocols)
engine - the engine being configuredprotocols - the protocols in descending order of preference. If empty, no protocol
indications will be used. This array will be copied.IllegalArgumentException - - if protocols is null, or if any element in a non-empty
array is null or an empty (zero-length) stringpublic static String[] getApplicationProtocols(SSLEngine engine)
engine - the enginepublic static void setApplicationProtocolSelector(SSLEngine engine, ApplicationProtocolSelector selector)
Conscrypt.setApplicationProtocols(SSLEngine, String[]).engine - the engineselector - the ALPN protocol selectorpublic static String getApplicationProtocol(SSLEngine engine)
engine - the enginenull if no protocol was agreed upon.public static byte[] getTlsUnique(SSLEngine engine)
null if there is no such value available, such as if the handshake
has not yet completed or this connection is closed.public static void setTokenBindingParams(SSLEngine engine, int... params) throws SSLException
This method needs to be invoked before the handshake starts.
params - a list of Token Binding key parameters in descending order of preference,
as described in draft-ietf-tokbind-negotiation-09.IllegalStateException - if the handshake has already started.SSLException - if the setting could not be applied.public static int getTokenBindingParams(SSLEngine engine)
public static byte[] exportKeyingMaterial(SSLEngine engine, String label, byte[] context, int length) throws SSLException
label - the label to use in calculating the exported value. This must be
an ASCII-only string.context - the application-specific context value to use in calculating the
exported value. This may be null to use no application context, which is
treated differently than an empty byte array.length - the number of bytes of keying material to return.null if the handshake has not yet
completed or the connection has been closed.SSLException - if the value could not be exported.