SSLEngineImpl (CryptoPro Java TLS)

java.lang.Object
- javax.net.ssl.SSLEngine
- - ru.CryptoPro.ssl.SSLEngineImpl

```
public final class SSLEngineImpl
extends javax.net.ssl.SSLEngine
```
Implementation of an non-blocking SSLEngine. *Currently*, the SSLEngine code exists in parallel with the current SSLSocket. As such, the current implementation is using legacy code with many of the same abstractions. However, it varies in many areas, most dramatically in the IO handling. There are three main I/O threads that can be existing in parallel: wrap(), unwrap(), and beginHandshake(). We are encouraging users to not call multiple instances of wrap or unwrap, because the data could appear to flow out of the SSLEngine in a non-sequential order. We take all steps we can to at least make sure the ordering remains consistent, but once the calls returns, anything can happen. For example, thread1 and thread2 both call wrap, thread1 gets the first packet, thread2 gets the second packet, but thread2 gets control back before thread1, and sends the data. The receiving side would see an out-of-order error. Handshaking is still done the same way as SSLSocket using the normal InputStream/OutputStream abstactions. We create ClientHandshakers/ServerHandshakers, which produce/consume the handshaking data. The transfer of the data is largely handled by the HandshakeInStream/HandshakeOutStreams. Lastly, the InputRecord/OutputRecords still have the same functionality, except that they are overridden with EngineInputRecord/EngineOutputRecord, which provide SSLEngine-specific functionality. Some of the major differences are: EngineInputRecord/EngineOutputRecord/EngineWriter: In order to avoid writing whole new control flows for handshaking, and to reuse most of the same code, we kept most of the actual handshake code the same. As usual, reading handshake data may trigger output of more handshake data, so what we do is write this data to internal buffers, and wait for wrap() to be called to give that data a ride. All data is routed through EngineInputRecord/EngineOutputRecord. However, all handshake data (ct_alert/ct_change_cipher_spec/ct_handshake) are passed through to the the underlying InputRecord/OutputRecord, and the data uses the internal buffers. Application data is handled slightly different, we copy the data directly from the src to the dst buffers, and do all operations on those buffers, saving the overhead of multiple copies. In the case of an inbound record, unwrap passes the inbound ByteBuffer to the InputRecord. If the data is handshake data, the data is read into the InputRecord's internal buffer. If the data is application data, the data is decoded directly into the dst buffer. In the case of an outbound record, when the write to the "real" OutputStream's would normally take place, instead we call back up to the EngineOutputRecord's version of writeBuffer, at which time we capture the resulting output in a ByteBuffer, and send that back to the EngineWriter for internal storage. EngineWriter is responsible for "handling" all outbound data, be it handshake or app data, and for returning the data to wrap() in the proper order. ClientHandshaker/ServerHandshaker/Handshaker: Methods which relied on SSLSocket now have work on either SSLSockets or SSLEngines.

Field Summary

Fields
Modifier and Type Field and Description

static byte clauth_none

static byte clauth_requested

static byte clauth_required

Fields
Modifier and Type	Field and Description
`static byte`	`clauth_none`
`static byte`	`clauth_requested`
`static byte`	`clauth_required`

Method Summary

All Methods Instance Methods Concrete Methods
Modifier and Type	Method and Description
`void`	`beginHandshake()`
`void`	`closeInbound()`
`void`	`closeOutbound()`
`java.lang.String`	`getApplicationProtocol()`
`java.lang.Runnable`	`getDelegatedTask()` Returns a delegated `Runnable` task for this `SSLEngine`.
`java.lang.String[]`	`getEnabledCipherSuites()` Returns the names of the SSL cipher suites which are currently enabled for use on this connection.
`java.lang.String[]`	`getEnabledProtocols()`
`boolean`	`getEnableSessionCreation()` Returns true if new connections may cause creation of new SSL sessions.
`javax.net.ssl.SSLSession`	`getHandshakeSession()`
`javax.net.ssl.SSLEngineResult.HandshakeStatus`	`getHandshakeStatus()`
`boolean`	`getNeedClientAuth()`
`javax.net.ssl.SSLSession`	`getSession()` Returns the current `SSLSession` for this `SSLEngine`
`javax.net.ssl.SSLParameters`	`getSSLParameters()` Returns the SSLParameters in effect for this SSLEngine.
`java.lang.String[]`	`getSupportedCipherSuites()` Returns the names of the cipher suites which could be enabled for use on an SSL connection.
`java.lang.String[]`	`getSupportedProtocols()` Returns the protocols that are supported by this implementation.
`boolean`	`getUseClientMode()`
`boolean`	`getWantClientAuth()`
`boolean`	`isInboundDone()` Returns the network inbound data closure state
`boolean`	`isOutboundDone()` Returns the outbound application data closure state
`void`	`setEnabledCipherSuites(java.lang.String[] suites)` Controls which particular cipher suites are enabled for use on this connection.
`void`	`setEnabledProtocols(java.lang.String[] protocols)` Controls which protocols are enabled for use on this connection.
`void`	`setEnableSessionCreation(boolean flag)` Controls whether new connections may cause creation of new SSL sessions.
`void`	`setNeedClientAuth(boolean flag)` Sets the flag controlling whether a server mode engine REQUIRES SSL client authentication.
`void`	`setSSLParameters(javax.net.ssl.SSLParameters params)` Applies SSLParameters to this engine.
`void`	`setUseClientMode(boolean flag)` Sets the flag controlling whether the engine is in SSL client or server mode.
`void`	`setWantClientAuth(boolean flag)` Sets the flag controlling whether a server mode engine REQUESTS SSL client authentication.
`java.lang.String`	`toString()` Returns a printable representation of this end of the connection.
`javax.net.ssl.SSLEngineResult`	`unwrap(java.nio.ByteBuffer netData, java.nio.ByteBuffer[] appData, int offset, int length)` Unwraps a buffer.
`javax.net.ssl.SSLEngineResult`	`wrap(java.nio.ByteBuffer[] appData, int offset, int length, java.nio.ByteBuffer netData)` Wraps a buffer.

Methods inherited from class javax.net.ssl.SSLEngine
getPeerHost, getPeerPort, unwrap, unwrap, wrap, wrap

Methods inherited from class java.lang.Object
equals, getClass, hashCode, notify, notifyAll, wait, wait, wait

- Field Detail
  - clauth_none
```
public static final byte clauth_none
```
    See Also:
    
    Constant Field Values
  - clauth_requested
```
public static final byte clauth_requested
```
    See Also:
    
    Constant Field Values
  - clauth_required
```
public static final byte clauth_required
```
    See Also:
    
    Constant Field Values
- Method Detail
  - getHandshakeStatus
```
public javax.net.ssl.SSLEngineResult.HandshakeStatus getHandshakeStatus()
```
    Specified by:
    
    getHandshakeStatus in class javax.net.ssl.SSLEngine
  - beginHandshake
```
public void beginHandshake()
                    throws javax.net.ssl.SSLException
```
    Specified by:
    
    beginHandshake in class javax.net.ssl.SSLEngine
    
    Throws:
    
    javax.net.ssl.SSLException
  - unwrap
```
public javax.net.ssl.SSLEngineResult unwrap(java.nio.ByteBuffer netData,
                                            java.nio.ByteBuffer[] appData,
                                            int offset,
                                            int length)
                                     throws javax.net.ssl.SSLException
```
    Unwraps a buffer. Does a variety of checks before grabbing the unwrapLock, which blocks multiple unwraps from occurring.
    
    Specified by:
    
    unwrap in class javax.net.ssl.SSLEngine
    
    Throws:
    
    javax.net.ssl.SSLException
  - wrap
```
public javax.net.ssl.SSLEngineResult wrap(java.nio.ByteBuffer[] appData,
                                          int offset,
                                          int length,
                                          java.nio.ByteBuffer netData)
                                   throws javax.net.ssl.SSLException
```
    Wraps a buffer. Does a variety of checks before grabbing the wrapLock, which blocks multiple wraps from occurring.
    
    Specified by:
    
    wrap in class javax.net.ssl.SSLEngine
    
    Throws:
    
    javax.net.ssl.SSLException
  - closeOutbound
```
public void closeOutbound()
```
    Specified by:
    
    closeOutbound in class javax.net.ssl.SSLEngine
  - isOutboundDone
```
public boolean isOutboundDone()
```
    Returns the outbound application data closure state
    
    Specified by:
    
    isOutboundDone in class javax.net.ssl.SSLEngine
  - closeInbound
```
public void closeInbound()
                  throws javax.net.ssl.SSLException
```
    Specified by:
    
    closeInbound in class javax.net.ssl.SSLEngine
    
    Throws:
    
    javax.net.ssl.SSLException
  - isInboundDone
```
public boolean isInboundDone()
```
    Returns the network inbound data closure state
    
    Specified by:
    
    isInboundDone in class javax.net.ssl.SSLEngine
  - getSession
```
public javax.net.ssl.SSLSession getSession()
```
    Returns the current SSLSession for this SSLEngine
    These can be long lived, and frequently correspond to an entire login session for some user.
    
    Specified by:
    
    getSession in class javax.net.ssl.SSLEngine
  - getHandshakeSession
```
public javax.net.ssl.SSLSession getHandshakeSession()
```
    Overrides:
    
    getHandshakeSession in class javax.net.ssl.SSLEngine
  - getDelegatedTask
```
public java.lang.Runnable getDelegatedTask()
```
    Returns a delegated Runnable task for this SSLEngine.
    
    Specified by:
    
    getDelegatedTask in class javax.net.ssl.SSLEngine
  - setEnableSessionCreation
```
public void setEnableSessionCreation(boolean flag)
```
    Controls whether new connections may cause creation of new SSL sessions. As long as handshaking has not started, we can change whether we enable session creations. Otherwise, we will need to wait for the next handshake.
    
    Specified by:
    
    setEnableSessionCreation in class javax.net.ssl.SSLEngine
  - getEnableSessionCreation
```
public boolean getEnableSessionCreation()
```
    Returns true if new connections may cause creation of new SSL sessions.
    
    Specified by:
    
    getEnableSessionCreation in class javax.net.ssl.SSLEngine
  - setNeedClientAuth
```
public void setNeedClientAuth(boolean flag)
```
    Sets the flag controlling whether a server mode engine *REQUIRES* SSL client authentication. As long as handshaking has not started, we can change whether client authentication is needed. Otherwise, we will need to wait for the next handshake.
    
    Specified by:
    
    setNeedClientAuth in class javax.net.ssl.SSLEngine
  - getNeedClientAuth
```
public boolean getNeedClientAuth()
```
    Specified by:
    
    getNeedClientAuth in class javax.net.ssl.SSLEngine
  - setWantClientAuth
```
public void setWantClientAuth(boolean flag)
```
    Sets the flag controlling whether a server mode engine *REQUESTS* SSL client authentication. As long as handshaking has not started, we can change whether client authentication is requested. Otherwise, we will need to wait for the next handshake.
    
    Specified by:
    
    setWantClientAuth in class javax.net.ssl.SSLEngine
  - getWantClientAuth
```
public boolean getWantClientAuth()
```
    Specified by:
    
    getWantClientAuth in class javax.net.ssl.SSLEngine
  - setUseClientMode
```
public void setUseClientMode(boolean flag)
```
    Sets the flag controlling whether the engine is in SSL client or server mode. Must be called before any SSL traffic has started.
    
    Specified by:
    
    setUseClientMode in class javax.net.ssl.SSLEngine
  - getUseClientMode
```
public boolean getUseClientMode()
```
    Specified by:
    
    getUseClientMode in class javax.net.ssl.SSLEngine
  - getSupportedCipherSuites
```
public java.lang.String[] getSupportedCipherSuites()
```
    Returns the names of the cipher suites which could be enabled for use on an SSL connection. Normally, only a subset of these will actually be enabled by default, since this list may include cipher suites which do not support the mutual authentication of servers and clients, or which do not protect data confidentiality. Servers may also need certain kinds of certificates to use certain cipher suites.
    
    Specified by:
    
    getSupportedCipherSuites in class javax.net.ssl.SSLEngine
    
    Returns:
    
    an array of cipher suite names
  - setEnabledCipherSuites
```
public void setEnabledCipherSuites(java.lang.String[] suites)
```
    Controls which particular cipher suites are enabled for use on this connection. The cipher suites must have been listed by getCipherSuites() as being supported. Even if a suite has been enabled, it might never be used if no peer supports it or the requisite certificates (and private keys) are not available.
    
    Specified by:
    
    setEnabledCipherSuites in class javax.net.ssl.SSLEngine
    
    Parameters:
    
    suites - Names of all the cipher suites to enable.
  - getEnabledCipherSuites
```
public java.lang.String[] getEnabledCipherSuites()
```
    Returns the names of the SSL cipher suites which are currently enabled for use on this connection. When an SSL engine is first created, all enabled cipher suites (a) protect data confidentiality, by traffic encryption, and (b) can mutually authenticate both clients and servers. Thus, in some environments, this value might be empty.
    
    Specified by:
    
    getEnabledCipherSuites in class javax.net.ssl.SSLEngine
    
    Returns:
    
    an array of cipher suite names
  - getSupportedProtocols
```
public java.lang.String[] getSupportedProtocols()
```
    Returns the protocols that are supported by this implementation. A subset of the supported protocols may be enabled for this connection
    
    Specified by:
    
    getSupportedProtocols in class javax.net.ssl.SSLEngine
    
    Returns:
    
    an array of protocol names.
  - setEnabledProtocols
```
public void setEnabledProtocols(java.lang.String[] protocols)
```
    Controls which protocols are enabled for use on this connection. The protocols must have been listed by getSupportedProtocols() as being supported.
    
    Specified by:
    
    setEnabledProtocols in class javax.net.ssl.SSLEngine
    
    Parameters:
    
    protocols - protocols to enable.
    
    Throws:
    
    java.lang.IllegalArgumentException - when one of the protocols named by the parameter is not supported.
  - getEnabledProtocols
```
public java.lang.String[] getEnabledProtocols()
```
    Specified by:
    
    getEnabledProtocols in class javax.net.ssl.SSLEngine
  - getSSLParameters
```
public javax.net.ssl.SSLParameters getSSLParameters()
```
    Returns the SSLParameters in effect for this SSLEngine.
    
    Overrides:
    
    getSSLParameters in class javax.net.ssl.SSLEngine
  - setSSLParameters
```
public void setSSLParameters(javax.net.ssl.SSLParameters params)
```
    Applies SSLParameters to this engine.
    
    Overrides:
    
    setSSLParameters in class javax.net.ssl.SSLEngine
  - getApplicationProtocol
```
public java.lang.String getApplicationProtocol()
```
  - toString
```
public java.lang.String toString()
```
    Returns a printable representation of this end of the connection.
    
    Overrides:
    
    toString in class java.lang.Object

Class SSLEngineImpl

Field Summary

Method Summary

Methods inherited from class javax.net.ssl.SSLEngine

Methods inherited from class java.lang.Object

Field Detail

clauth_none

clauth_requested

clauth_required

Method Detail

getHandshakeStatus

beginHandshake

unwrap

wrap

closeOutbound

isOutboundDone

closeInbound

isInboundDone

getSession

getHandshakeSession

getDelegatedTask

setEnableSessionCreation

getEnableSessionCreation

setNeedClientAuth

getNeedClientAuth

setWantClientAuth

getWantClientAuth

setUseClientMode

getUseClientMode

getSupportedCipherSuites

setEnabledCipherSuites

getEnabledCipherSuites

getSupportedProtocols

setEnabledProtocols

getEnabledProtocols

getSSLParameters

setSSLParameters

getApplicationProtocol

toString