OpenJDK 27 · jdk.internal.net.quic.QuicTLSEngine · APIdia, the JavaDoc alternative

Modifier and Type	Class and Description
public static enum	QuicTLSEngine.HandshakeState
public static enum	QuicTLSEngine.KeySpace Represents the encryption level associated with a packet encryption or decryption.

Method Summary

Modifier and Type	Method and Description
public ByteBuffer	Returns: mask bytes, at least 5. computeHeaderProtectionMask(QuicTLSEngine.KeySpace Packet key space keySpace, boolean true for incoming packets, false for outgoing incoming, ByteBuffer sampled data sample) Compute the header protection mask for the given sample, packet key space and direction (incoming/outgoing).
public void	consumeHandshakeBytes(QuicTLSEngine.KeySpace the key space of the packet in which the provided crypto data was encountered. keySpace, ByteBuffer contents of the next CRYPTO frame payload) This method consumes crypto stream.
public void	decryptPacket(QuicTLSEngine.KeySpace Packet key space keySpace, long full packet number packetNumber, int key phase bit (0 or 1) found on the packet, or -1 if the packet does not have a key phase bit keyPhase, ByteBuffer buffer containing encrypted packet bytes packet, int length of the packet header headerLength, ByteBuffer buffer where decrypted packet bytes will be stored output) Decrypt the given packet bytes using keys for the given packet key space.
public void	deriveInitialKeys(QuicVersion QUIC protocol version quicVersion, ByteBuffer initial destination connection ID connectionId) Derive initial keys for the given QUIC version and connection ID
public void	discardKeys(QuicTLSEngine.KeySpace The keyspace whose current keys should be discarded keySpace) Discard the keys used by the `keySpace`.
public void	encryptPacket(QuicTLSEngine.KeySpace Packet key space keySpace, long full packet number packetNumber, IntFunction<ByteBuffer> an `IntFunction` which takes a key phase and returns the packet header headerGenerator, ByteBuffer buffer containing unencrypted packet payload packetPayload, ByteBuffer buffer into which the encrypted packet payload will be written output) Encrypt into `output`, the given `packetPayload` bytes using the keys for the given `keySpace`.
public String	Returns: the most recent application protocol value negotiated by the engine. Returns null if no application protocol has yet been negotiated by the engine getApplicationProtocol() Returns the most recent application protocol value negotiated by the engine.
public int	Returns: authentication tag size getAuthTagSize() Get the authentication tag size.
public QuicTLSEngine.KeySpace	Returns: the current sending key space (encryption level) getCurrentSendKeySpace() Returns the current sending key space (encryption level).
public Runnable	Returns: a delegated `Runnable` task, or null if none are available. getDelegatedTask() Returns a delegated `Runnable` task for this `QuicTLSEngine`.
public ByteBuffer	Returns: buffer containing data that will be put by caller in a CRYPTO frame, or null if there are no more handshake bytes to send in this key space at this time. getHandshakeBytes(QuicTLSEngine.KeySpace the key space of the packet in which the requested data will be placed keySpace) If the current handshake state is `HandshakeState#NEED_SEND_CRYPTO` meaning that a CRYPTO frame needs to be sent then this method is called to obtain the contents of the frame.
public SSLSession	Returns: null if this instance is not currently handshaking, or if the current handshake has not progressed far enough to create a basic SSLSession. Otherwise, this method returns the `SSLSession` currently being negotiated. getHandshakeSession() Returns the SSLSession being constructed during a QUIC handshake.
public QuicTLSEngine.HandshakeState	Returns: the HandshakeState getHandshakeState() Returns the current handshake state of the connection.
public int	Returns: required sample size for header protection getHeaderProtectionSampleSize(QuicTLSEngine.KeySpace Packet key space keySpace) Get the sample size for header protection algorithm
public SSLSession	Returns: the SSLSession getSession() Returns the SSLSession.
public SSLParameters	Returns: the SSLParameters in effect for this engine. getSSLParameters() Returns the SSLParameters in effect for this engine.
public Set<QuicVersion>	Returns: the QUIC versions supported by this engine getSupportedQuicVersions() Returns the QUIC versions supported by this engine.
public boolean	Returns: true if this QuicTLSEngine is operating in client mode, false otherwise getUseClientMode() Returns true if this QuicTLSEngine is operating in client mode, false otherwise.
public boolean	Returns: true if TLS handshake is complete, false otherwise. isTLSHandshakeComplete() Returns true if the TLS handshake is considered complete.
public boolean	Returns: true if the given keys are available keysAvailable(QuicTLSEngine.KeySpace key space to check keySpace) Checks whether the keys for the given key space are available.
public void	restartHandshake() Reset the handshake state and produce a new ClientHello message.
public void	setLocalQuicTransportParameters(ByteBuffer encoded quic_transport_parameters params) Provide quic_transport_parameters for inclusion in handshake message.
public void	setOneRttContext(QuicOneRttContext the 1-RTT context to set ctx) Sets the `QuicOneRttContext` on the `QuicTLSEngine`.
public void	setRemoteQuicTransportParametersConsumer(QuicTransportParametersConsumer consumer for remote quic transport parameters consumer) Set consumer for quic_transport_parameters sent by the remote side.
public void	setSSLParameters(SSLParameters the SSLParameters sslParameters) Sets the `SSLParameters` to be used by this engine
public void	setUseClientMode(boolean true to make this QuicTLSEngine operate in client mode, false otherwise mode) If `mode` is `true` then configures this QuicTLSEngine to operate in client mode.
public void	signRetryPacket(QuicVersion Quic version version, ByteBuffer original destination connection ID, without length originalConnectionId, ByteBuffer retry packet bytes without tag packet, ByteBuffer buffer where integrity tag will be stored output) Sign the provided retry packet.
public boolean	Returns: true if handshake state was `NEED_SEND_HANDSHAKE_DONE`, false otherwise tryMarkHandshakeDone() Called to check if a `HANDSHAKE_DONE` frame needs to be sent by the server.
public boolean	Returns: true if handshake state was `NEED_RECV_HANDSHAKE_DONE`, false otherwise tryReceiveHandshakeDone() Called when HANDSHAKE_DONE message is received from the server.
public void	verifyRetryPacket(QuicVersion Quic version version, ByteBuffer original destination connection ID, without length originalConnectionId, ByteBuffer retry packet bytes with tag packet) Verify the provided retry packet.
public void	versionNegotiated(QuicVersion the negotiated `QuicVersion` quicVersion) Called when the client and the server, during the connection creation handshake, have settled on a Quic version to use for the connection.

Method Detail

computeHeaderProtectionMask back to summary

computeHeaderProtectionMask	back to summary
public ByteBuffer computeHeaderProtectionMask(QuicTLSEngine.KeySpace keySpace, boolean incoming, ByteBuffer sample) throws QuicKeyUnavailableException, QuicTransportException Compute the header protection mask for the given sample, packet key space and direction (incoming/outgoing). Parameters keySpace:QuicTLSEngine.KeySpace Packet key space incoming:boolean true for incoming packets, false for outgoing sample:ByteBuffer sampled data Returns:ByteBuffer mask bytes, at least 5. Exceptions IllegalArgumentException: when keySpace does not require header protection or sample length is different from required External Specification https://www.rfc-editor.org/rfc/rfc9001.html#name-header-protection-applicati See Also `getHeaderProtectionSampleSize(KeySpace)`

public ByteBuffer computeHeaderProtectionMask(QuicTLSEngine.KeySpace keySpace, boolean incoming, ByteBuffer sample) throws QuicKeyUnavailableException, QuicTransportException

Compute the header protection mask for the given sample, packet key space and direction (incoming/outgoing).

Parameters

keySpace:QuicTLSEngine.KeySpace: Packet key space
incoming:boolean: true for incoming packets, false for outgoing
sample:ByteBuffer: sampled data

Returns:ByteBuffer

mask bytes, at least 5.

Exceptions

IllegalArgumentException:: when keySpace does not require header protection or sample length is different from required

External Specification

https://www.rfc-editor.org/rfc/rfc9001.html#name-header-protection-applicati

consumeHandshakeBytes	back to summary
public void consumeHandshakeBytes(QuicTLSEngine.KeySpace keySpace, ByteBuffer payload) throws QuicTransportException This method consumes crypto stream. Parameters keySpace:QuicTLSEngine.KeySpace the key space of the packet in which the provided crypto data was encountered. payload:ByteBuffer contents of the next CRYPTO frame Exceptions QuicTransportException: if the handshake failed IllegalArgumentException: if keySpace is ZERORTT or payload is empty

consumeHandshakeBytes

back to summary

public void consumeHandshakeBytes(QuicTLSEngine.KeySpace keySpace, ByteBuffer payload) throws QuicTransportException

This method consumes crypto stream.

Parameters

keySpace:QuicTLSEngine.KeySpace: the key space of the packet in which the provided crypto data was encountered.
payload:ByteBuffer: contents of the next CRYPTO frame

Exceptions

QuicTransportException:: if the handshake failed
IllegalArgumentException:: if keySpace is ZERORTT or payload is empty

decryptPacket back to summary

decryptPacket	back to summary
public void decryptPacket(QuicTLSEngine.KeySpace keySpace, long packetNumber, int keyPhase, ByteBuffer packet, int headerLength, ByteBuffer output) throws IllegalArgumentException, QuicKeyUnavailableException, AEADBadTagException, QuicTransportException, ShortBufferException Decrypt the given packet bytes using keys for the given packet key space. Header protection must be removed before calling this method. The input buffer contains the packet header and the encrypted packet payload. The packet header (first `headerLength` bytes of the input buffer) is consumed by this method, but is not decrypted. The packet payload (bytes following the packet header) is decrypted by this method. This method consumes the entire input buffer. The decrypted payload bytes are written to the output buffer. It is recommended to do the decryption in place by using slices of a bigger buffer as the input and output buffer: +--------+-------------------+----------+ input: \| header \| encrypted payload \| AEAD tag \| +--------+-------------------+----------+ output: \| decrypted payload \| +-------------------+ Parameters keySpace:QuicTLSEngine.KeySpace Packet key space packetNumber:long full packet number keyPhase:int key phase bit (0 or 1) found on the packet, or -1 if the packet does not have a key phase bit packet:ByteBuffer buffer containing encrypted packet bytes headerLength:int length of the packet header output:ByteBuffer buffer where decrypted packet bytes will be stored Exceptions IllegalArgumentException: if keyPhase bit is invalid QuicKeyUnavailableException: if keys are not available AEADBadTagException: if the provided packet's authentication tag is incorrect QuicTransportException: if decrypting the invalid packet resulted in exceeding the AEAD cipher integrity limit

public void decryptPacket(QuicTLSEngine.KeySpace keySpace, long packetNumber, int keyPhase, ByteBuffer packet, int headerLength, ByteBuffer output) throws IllegalArgumentException, QuicKeyUnavailableException, AEADBadTagException, QuicTransportException, ShortBufferException

Decrypt the given packet bytes using keys for the given packet key space. Header protection must be removed before calling this method.

The input buffer contains the packet header and the encrypted packet payload. The packet header (first headerLength bytes of the input buffer) is consumed by this method, but is not decrypted. The packet payload (bytes following the packet header) is decrypted by this method. This method consumes the entire input buffer.

The decrypted payload bytes are written to the output buffer.

It is recommended to do the decryption in place by using slices of a bigger buffer as the input and output buffer:

         +--------+-------------------+----------+
input:   | header | encrypted payload | AEAD tag |
         +--------+-------------------+----------+
output:           | decrypted payload |
                  +-------------------+

Parameters

keySpace:QuicTLSEngine.KeySpace: Packet key space
packetNumber:long: full packet number
keyPhase:int: key phase bit (0 or 1) found on the packet, or -1 if the packet does not have a key phase bit
packet:ByteBuffer: buffer containing encrypted packet bytes
headerLength:int: length of the packet header
output:ByteBuffer: buffer where decrypted packet bytes will be stored

Exceptions

IllegalArgumentException:: if keyPhase bit is invalid
QuicKeyUnavailableException:: if keys are not available
AEADBadTagException:: if the provided packet's authentication tag is incorrect
QuicTransportException:: if decrypting the invalid packet resulted in exceeding the AEAD cipher integrity limit

deriveInitialKeys back to summary

deriveInitialKeys	back to summary
public void deriveInitialKeys(QuicVersion quicVersion, ByteBuffer connectionId) throws IOException Derive initial keys for the given QUIC version and connection ID Parameters quicVersion:QuicVersion QUIC protocol version connectionId:ByteBuffer initial destination connection ID Exceptions IllegalArgumentException: if the `quicVersion` isn't supported on this `QuicTLSEngine`

public void deriveInitialKeys(QuicVersion quicVersion, ByteBuffer connectionId) throws IOException

Derive initial keys for the given QUIC version and connection ID

Parameters

quicVersion:QuicVersion: QUIC protocol version
connectionId:ByteBuffer: initial destination connection ID

Exceptions

IllegalArgumentException:: if the quicVersion isn't supported on this QuicTLSEngine

discardKeys back to summary

discardKeys	back to summary
public void discardKeys(QuicTLSEngine.KeySpace keySpace) Discard the keys used by the `keySpace`. Once the keys for a particular `keySpace` have been discarded, the keySpace will no longer be able to encrypt or decrypt packets. Parameters keySpace:QuicTLSEngine.KeySpace The keyspace whose current keys should be discarded

public void discardKeys(QuicTLSEngine.KeySpace keySpace)

Discard the keys used by the keySpace.

Once the keys for a particular keySpace have been discarded, the keySpace will no longer be able to encrypt or decrypt packets.

Parameters

keySpace:QuicTLSEngine.KeySpace: The keyspace whose current keys should be discarded

encryptPacket back to summary

encryptPacket	back to summary
public void encryptPacket(QuicTLSEngine.KeySpace keySpace, long packetNumber, IntFunction<ByteBuffer> headerGenerator, ByteBuffer packetPayload, ByteBuffer output) throws QuicKeyUnavailableException, QuicTransportException, ShortBufferException Encrypt into `output`, the given `packetPayload` bytes using the keys for the given `keySpace`. Before encrypting the `packetPayload`, this method invokes the `headerGenerator` passing it the key phase corresponding to the encryption key that's in use. For `KeySpace`s where key phase isn't applicable, the `headerGenerator` will be invoked with a value of `0` for the key phase. The `headerGenerator` is expected to return a `ByteBuffer` representing the packet header and where applicable, the returned header must contain the key phase that was passed to the `headerGenerator`. The packet header will be used as the Additional Authentication Data (AAD) for encrypting the `packetPayload`. Upon return, the `output` will contain the encrypted packet payload bytes and the authentication tag. The `packetPayload` and the packet header, returned by the `headerGenerator`, will have their `position` equal to their `limit`. The limit of either of those buffers will not have changed. It is recommended to do the encryption in place by using slices of a bigger buffer as the input and output buffer: +--------+-------------------+ input: \| header \| plaintext payload \| +--------+-------------------+----------+ output: \| encrypted payload \| AEAD tag \| +-------------------+----------+ Parameters keySpace:QuicTLSEngine.KeySpace Packet key space packetNumber:long full packet number headerGenerator:IntFunction<ByteBuffer> an `IntFunction` which takes a key phase and returns the packet header packetPayload:ByteBuffer buffer containing unencrypted packet payload output:ByteBuffer buffer into which the encrypted packet payload will be written Exceptions QuicKeyUnavailableException: if keys are not available QuicTransportException: if encrypting the packet would result in exceeding the AEAD cipher confidentiality limit

public void encryptPacket(QuicTLSEngine.KeySpace keySpace, long packetNumber, IntFunction<ByteBuffer> headerGenerator, ByteBuffer packetPayload, ByteBuffer output) throws QuicKeyUnavailableException, QuicTransportException, ShortBufferException

Encrypt into output, the given packetPayload bytes using the keys for the given keySpace.

Before encrypting the packetPayload, this method invokes the headerGenerator passing it the key phase corresponding to the encryption key that's in use. For KeySpaces where key phase isn't applicable, the headerGenerator will be invoked with a value of 0 for the key phase.

The headerGenerator is expected to return a ByteBuffer representing the packet header and where applicable, the returned header must contain the key phase that was passed to the headerGenerator. The packet header will be used as the Additional Authentication Data (AAD) for encrypting the packetPayload.

Upon return, the output will contain the encrypted packet payload bytes and the authentication tag. The packetPayload and the packet header, returned by the headerGenerator, will have their position equal to their limit. The limit of either of those buffers will not have changed.

It is recommended to do the encryption in place by using slices of a bigger buffer as the input and output buffer:

         +--------+-------------------+
input:   | header | plaintext payload |
         +--------+-------------------+----------+
output:           | encrypted payload | AEAD tag |
                  +-------------------+----------+

Parameters

keySpace:QuicTLSEngine.KeySpace: Packet key space
packetNumber:long: full packet number
headerGenerator:IntFunction<ByteBuffer>: an IntFunction which takes a key phase and returns the packet header
packetPayload:ByteBuffer: buffer containing unencrypted packet payload
output:ByteBuffer: buffer into which the encrypted packet payload will be written

Exceptions

QuicKeyUnavailableException:: if keys are not available
QuicTransportException:: if encrypting the packet would result in exceeding the AEAD cipher confidentiality limit

getApplicationProtocol	back to summary
public String getApplicationProtocol() Returns the most recent application protocol value negotiated by the engine. Returns null if no application protocol has yet been negotiated by the engine. Returns:String the most recent application protocol value negotiated by the engine. Returns null if no application protocol has yet been negotiated by the engine

getApplicationProtocol

back to summary

public String getApplicationProtocol()

Returns the most recent application protocol value negotiated by the engine. Returns null if no application protocol has yet been negotiated by the engine.

Returns:String: the most recent application protocol value negotiated by the engine. Returns null if no application protocol has yet been negotiated by the engine

getAuthTagSize	back to summary
public int getAuthTagSize() Get the authentication tag size. Encryption adds this number of bytes. Returns:int authentication tag size

getAuthTagSize

back to summary

public int getAuthTagSize()

Get the authentication tag size. Encryption adds this number of bytes.

Returns:int: authentication tag size

getCurrentSendKeySpace	back to summary
public QuicTLSEngine.KeySpace getCurrentSendKeySpace() Returns the current sending key space (encryption level). Returns:QuicTLSEngine.KeySpace the current sending key space (encryption level)

getCurrentSendKeySpace

back to summary

public QuicTLSEngine.KeySpace getCurrentSendKeySpace()

Returns the current sending key space (encryption level).

Returns:QuicTLSEngine.KeySpace: the current sending key space (encryption level)

getDelegatedTask back to summary

getDelegatedTask	back to summary
public Runnable getDelegatedTask() Returns a delegated `Runnable` task for this `QuicTLSEngine`. `QuicTLSEngine` operations may require the results of operations that block, or may take an extended period of time to complete. This method is used to obtain an outstanding `java.lang.Runnable` operation (task). Each task must be assigned a thread (possibly the current) to perform the `run` operation. Once the `run` method returns, the `Runnable` object is no longer needed and may be discarded. A call to this method will return each outstanding task exactly once. Multiple delegated tasks can be run in parallel. Returns:Runnable a delegated `Runnable` task, or null if none are available.

public Runnable getDelegatedTask()

Returns a delegated Runnable task for this QuicTLSEngine.

QuicTLSEngine operations may require the results of operations that block, or may take an extended period of time to complete. This method is used to obtain an outstanding java.lang.Runnable operation (task). Each task must be assigned a thread (possibly the current) to perform the run operation. Once the run method returns, the Runnable object is no longer needed and may be discarded.

A call to this method will return each outstanding task exactly once.

Multiple delegated tasks can be run in parallel.

Returns:Runnable: a delegated Runnable task, or null if none are available.

getHandshakeBytes back to summary

getHandshakeBytes	back to summary
public ByteBuffer getHandshakeBytes(QuicTLSEngine.KeySpace keySpace) throws IOException If the current handshake state is `HandshakeState#NEED_SEND_CRYPTO` meaning that a CRYPTO frame needs to be sent then this method is called to obtain the contents of the frame. Current handshake state can be obtained from `getHandshakeState()`, and the current key space can be obtained with `getCurrentSendKeySpace()` The bytes returned by this call are used to build a CRYPTO frame. Parameters keySpace:QuicTLSEngine.KeySpace the key space of the packet in which the requested data will be placed Returns:ByteBuffer buffer containing data that will be put by caller in a CRYPTO frame, or null if there are no more handshake bytes to send in this key space at this time.

public ByteBuffer getHandshakeBytes(QuicTLSEngine.KeySpace keySpace) throws IOException

If the current handshake state is HandshakeState#NEED_SEND_CRYPTO meaning that a CRYPTO frame needs to be sent then this method is called to obtain the contents of the frame. Current handshake state can be obtained from getHandshakeState(), and the current key space can be obtained with getCurrentSendKeySpace() The bytes returned by this call are used to build a CRYPTO frame.

Parameters

keySpace:QuicTLSEngine.KeySpace: the key space of the packet in which the requested data will be placed

Returns:ByteBuffer

buffer containing data that will be put by caller in a CRYPTO frame, or null if there are no more handshake bytes to send in this key space at this time.

getHandshakeSession back to summary

getHandshakeSession	back to summary
public SSLSession getHandshakeSession() Returns the SSLSession being constructed during a QUIC handshake. Returns:SSLSession null if this instance is not currently handshaking, or if the current handshake has not progressed far enough to create a basic SSLSession. Otherwise, this method returns the `SSLSession` currently being negotiated. See Also `SSLEngine#getHandshakeSession()`

public SSLSession getHandshakeSession()

Returns the SSLSession being constructed during a QUIC handshake.

Returns:SSLSession: null if this instance is not currently handshaking, or if the current handshake has not progressed far enough to create a basic SSLSession. Otherwise, this method returns the SSLSession currently being negotiated.
See Also: SSLEngine#getHandshakeSession()

getHandshakeState	back to summary
public QuicTLSEngine.HandshakeState getHandshakeState() Returns the current handshake state of the connection. Sometimes packets that could be decrypted can be received before the handshake has completed, but should not be decrypted until it is complete Returns:QuicTLSEngine.HandshakeState the HandshakeState

getHandshakeState

back to summary

public QuicTLSEngine.HandshakeState getHandshakeState()

Returns the current handshake state of the connection. Sometimes packets that could be decrypted can be received before the handshake has completed, but should not be decrypted until it is complete

Returns:QuicTLSEngine.HandshakeState: the HandshakeState

getHeaderProtectionSampleSize	back to summary
public int getHeaderProtectionSampleSize(QuicTLSEngine.KeySpace keySpace) Get the sample size for header protection algorithm Parameters keySpace:QuicTLSEngine.KeySpace Packet key space Returns:int required sample size for header protection Exceptions IllegalArgumentException: when keySpace does not require header protection

getHeaderProtectionSampleSize

back to summary

public int getHeaderProtectionSampleSize(QuicTLSEngine.KeySpace keySpace)

Get the sample size for header protection algorithm

Parameters

keySpace:QuicTLSEngine.KeySpace: Packet key space

Returns:int

required sample size for header protection

Exceptions

IllegalArgumentException:: when keySpace does not require header protection

getSession back to summary

getSession	back to summary
public SSLSession getSession() Returns the SSLSession. Returns:SSLSession the SSLSession See Also `SSLEngine#getSession()`

public SSLSession getSession()

Returns the SSLSession.

Returns:SSLSession: the SSLSession
See Also: SSLEngine#getSession()

getSSLParameters	back to summary
public SSLParameters getSSLParameters() Returns the SSLParameters in effect for this engine. Returns:SSLParameters the SSLParameters in effect for this engine.

getSSLParameters

back to summary

public SSLParameters getSSLParameters()

Returns the SSLParameters in effect for this engine.

Returns:SSLParameters: the SSLParameters in effect for this engine.

getSupportedQuicVersions	back to summary
public Set<QuicVersion> getSupportedQuicVersions() Returns the QUIC versions supported by this engine. Returns:Set<QuicVersion> the QUIC versions supported by this engine

getSupportedQuicVersions

back to summary

public Set<QuicVersion> getSupportedQuicVersions()

Returns the QUIC versions supported by this engine.

Returns:Set<QuicVersion>: the QUIC versions supported by this engine

getUseClientMode	back to summary
public boolean getUseClientMode() Returns true if this QuicTLSEngine is operating in client mode, false otherwise. Returns:boolean true if this QuicTLSEngine is operating in client mode, false otherwise

getUseClientMode

back to summary

public boolean getUseClientMode()

Returns true if this QuicTLSEngine is operating in client mode, false otherwise.

Returns:boolean: true if this QuicTLSEngine is operating in client mode, false otherwise

isTLSHandshakeComplete back to summary

isTLSHandshakeComplete	back to summary
public boolean isTLSHandshakeComplete() Returns true if the TLS handshake is considered complete. The TLS handshake is considered complete when the TLS stack has reported that the handshake is complete. This happens when the TLS stack has both sent a `Finished` message and verified the peer's `Finished` message. Returns:boolean true if TLS handshake is complete, false otherwise.

public boolean isTLSHandshakeComplete()

Returns true if the TLS handshake is considered complete.

The TLS handshake is considered complete when the TLS stack has reported that the handshake is complete. This happens when the TLS stack has both sent a Finished message and verified the peer's Finished message.

Returns:boolean: true if TLS handshake is complete, false otherwise.

keysAvailable	back to summary
public boolean keysAvailable(QuicTLSEngine.KeySpace keySpace) Checks whether the keys for the given key space are available. Keys are available when they are already computed and not discarded yet. Parameters keySpace:QuicTLSEngine.KeySpace key space to check Returns:boolean true if the given keys are available

keysAvailable

back to summary

public boolean keysAvailable(QuicTLSEngine.KeySpace keySpace)

Checks whether the keys for the given key space are available.

Keys are available when they are already computed and not discarded yet.

Parameters

keySpace:QuicTLSEngine.KeySpace: key space to check

Returns:boolean

true if the given keys are available

restartHandshake	back to summary
public void restartHandshake() throws IOException Reset the handshake state and produce a new ClientHello message. When a Quic client receives a Version Negotiation packet, it restarts the handshake by calling this method after updating the transport parameters with the new version information.

setLocalQuicTransportParameters	back to summary
public void setLocalQuicTransportParameters(ByteBuffer params) Provide quic_transport_parameters for inclusion in handshake message. Parameters params:ByteBuffer encoded quic_transport_parameters

setLocalQuicTransportParameters

back to summary

public void setLocalQuicTransportParameters(ByteBuffer params)

Provide quic_transport_parameters for inclusion in handshake message.

Parameters

params:ByteBuffer: encoded quic_transport_parameters

setOneRttContext back to summary

setOneRttContext	back to summary
public void setOneRttContext(QuicOneRttContext ctx) Sets the `QuicOneRttContext` on the `QuicTLSEngine`. The `ctx` will be used by the `QuicTLSEngine` to access contextual 1-RTT data that might be required for the TLS operations. Parameters ctx:QuicOneRttContext the 1-RTT context to set Exceptions NullPointerException: if `ctx` is null

public void setOneRttContext(QuicOneRttContext ctx)

Sets the QuicOneRttContext on the QuicTLSEngine.

The ctx will be used by the QuicTLSEngine to access contextual 1-RTT data that might be required for the TLS operations.

Parameters

ctx:QuicOneRttContext: the 1-RTT context to set

Exceptions

NullPointerException:: if ctx is null

setRemoteQuicTransportParametersConsumer	back to summary
public void setRemoteQuicTransportParametersConsumer(QuicTransportParametersConsumer consumer) Set consumer for quic_transport_parameters sent by the remote side. Consumer will receive a byte buffer containing the value of quic_transport_parameters extension sent by the remote endpoint. Parameters consumer:QuicTransportParametersConsumer consumer for remote quic transport parameters

setRemoteQuicTransportParametersConsumer

back to summary

public void setRemoteQuicTransportParametersConsumer(QuicTransportParametersConsumer consumer)

Set consumer for quic_transport_parameters sent by the remote side. Consumer will receive a byte buffer containing the value of quic_transport_parameters extension sent by the remote endpoint.

Parameters

consumer:QuicTransportParametersConsumer: consumer for remote quic transport parameters

setSSLParameters back to summary

setSSLParameters	back to summary
public void setSSLParameters(SSLParameters sslParameters) Sets the `SSLParameters` to be used by this engine Parameters sslParameters:SSLParameters the SSLParameters Exceptions IllegalArgumentException: if TLS protocol versions on the `sslParameters` is either empty or contains anything other than `TLSv1.3` NullPointerException: if `sslParameters` is null

public void setSSLParameters(SSLParameters sslParameters)

Sets the SSLParameters to be used by this engine

Parameters

sslParameters:SSLParameters: the SSLParameters

Exceptions

IllegalArgumentException:: if TLS protocol versions on the sslParameters is either empty or contains anything other than TLSv1.3
NullPointerException:: if sslParameters is null

setUseClientMode back to summary

setUseClientMode	back to summary
public void setUseClientMode(boolean mode) If `mode` is `true` then configures this QuicTLSEngine to operate in client mode. If `false`, then this QuicTLSEngine operates in server mode. Parameters mode:boolean true to make this QuicTLSEngine operate in client mode, false otherwise

public void setUseClientMode(boolean mode)

If mode is true then configures this QuicTLSEngine to operate in client mode. If false, then this QuicTLSEngine operates in server mode.

Parameters

mode:boolean: true to make this QuicTLSEngine operate in client mode, false otherwise

signRetryPacket back to summary

signRetryPacket	back to summary
public void signRetryPacket(QuicVersion version, ByteBuffer originalConnectionId, ByteBuffer packet, ByteBuffer output) throws ShortBufferException, QuicTransportException Sign the provided retry packet. Input buffer contains the retry packet payload. Integrity tag is stored in the output buffer. Parameters version:QuicVersion Quic version originalConnectionId:ByteBuffer original destination connection ID, without length packet:ByteBuffer retry packet bytes without tag output:ByteBuffer buffer where integrity tag will be stored Exceptions ShortBufferException: if output buffer is too short to hold the tag IllegalArgumentException: if originalConnectionId is longer than 255 bytes if `version` isn't supported

public void signRetryPacket(QuicVersion version, ByteBuffer originalConnectionId, ByteBuffer packet, ByteBuffer output) throws ShortBufferException, QuicTransportException

Sign the provided retry packet. Input buffer contains the retry packet payload. Integrity tag is stored in the output buffer.

Parameters

version:QuicVersion: Quic version
originalConnectionId:ByteBuffer: original destination connection ID, without length
packet:ByteBuffer: retry packet bytes without tag
output:ByteBuffer: buffer where integrity tag will be stored

Exceptions

ShortBufferException:

if output buffer is too short to hold the tag

IllegalArgumentException:

if originalConnectionId is longer than 255 bytes
if version isn't supported

tryMarkHandshakeDone back to summary

tryMarkHandshakeDone	back to summary
public boolean tryMarkHandshakeDone() throws IllegalStateException Called to check if a `HANDSHAKE_DONE` frame needs to be sent by the server. This method will only be called for a `QuicTLSEngine` which is in server mode. If the current TLS handshake state is `NEED_SEND_HANDSHAKE_DONE` then this method returns `true` and advances the TLS handshake state to `HANDSHAKE_CONFIRMED`. Else returns `false`. Returns:boolean true if handshake state was `NEED_SEND_HANDSHAKE_DONE`, false otherwise Exceptions IllegalStateException: If this `QuicTLSEngine` is not in server mode

public boolean tryMarkHandshakeDone() throws IllegalStateException

Called to check if a HANDSHAKE_DONE frame needs to be sent by the server. This method will only be called for a QuicTLSEngine which is in server mode. If the current TLS handshake state is NEED_SEND_HANDSHAKE_DONE then this method returns true and advances the TLS handshake state to HANDSHAKE_CONFIRMED. Else returns false.

Returns:boolean

true if handshake state was NEED_SEND_HANDSHAKE_DONE, false otherwise

Exceptions

IllegalStateException:: If this QuicTLSEngine is not in server mode

tryReceiveHandshakeDone back to summary

tryReceiveHandshakeDone	back to summary
public boolean tryReceiveHandshakeDone() throws IllegalStateException Called when HANDSHAKE_DONE message is received from the server. This method will only be called for a `QuicTLSEngine` which is in client mode. If the current TLS handshake state is `NEED_RECV_HANDSHAKE_DONE` then this method returns `true` and advances the TLS handshake state to `HANDSHAKE_CONFIRMED`. Else returns `false`. Returns:boolean true if handshake state was `NEED_RECV_HANDSHAKE_DONE`, false otherwise Exceptions IllegalStateException: if this `QuicTLSEngine` is not in client mode

public boolean tryReceiveHandshakeDone() throws IllegalStateException

Called when HANDSHAKE_DONE message is received from the server. This method will only be called for a QuicTLSEngine which is in client mode. If the current TLS handshake state is NEED_RECV_HANDSHAKE_DONE then this method returns true and advances the TLS handshake state to HANDSHAKE_CONFIRMED. Else returns false.

Returns:boolean

true if handshake state was NEED_RECV_HANDSHAKE_DONE, false otherwise

Exceptions

IllegalStateException:: if this QuicTLSEngine is not in client mode

verifyRetryPacket back to summary

verifyRetryPacket	back to summary
public void verifyRetryPacket(QuicVersion version, ByteBuffer originalConnectionId, ByteBuffer packet) throws AEADBadTagException, QuicTransportException Verify the provided retry packet. Parameters version:QuicVersion Quic version originalConnectionId:ByteBuffer original destination connection ID, without length packet:ByteBuffer retry packet bytes with tag Exceptions AEADBadTagException: if integrity tag is invalid IllegalArgumentException: if originalConnectionId is longer than 255 bytes if `version` isn't supported

public void verifyRetryPacket(QuicVersion version, ByteBuffer originalConnectionId, ByteBuffer packet) throws AEADBadTagException, QuicTransportException

Verify the provided retry packet.

Parameters

version:QuicVersion: Quic version
originalConnectionId:ByteBuffer: original destination connection ID, without length
packet:ByteBuffer: retry packet bytes with tag

Exceptions

AEADBadTagException:

if integrity tag is invalid

IllegalArgumentException:

if originalConnectionId is longer than 255 bytes
if version isn't supported

versionNegotiated back to summary

versionNegotiated	back to summary
public void versionNegotiated(QuicVersion quicVersion) Called when the client and the server, during the connection creation handshake, have settled on a Quic version to use for the connection. This can happen either due to an explicit version negotiation (as outlined in Quic RFC) or the server accepting the Quic version that the client chose in its first INITIAL packet. In either of those cases, this method will be called. Parameters quicVersion:QuicVersion the negotiated `QuicVersion` Exceptions IllegalArgumentException: if the `quicVersion` isn't supported on this engine

public void versionNegotiated(QuicVersion quicVersion)

Called when the client and the server, during the connection creation handshake, have settled on a Quic version to use for the connection. This can happen either due to an explicit version negotiation (as outlined in Quic RFC) or the server accepting the Quic version that the client chose in its first INITIAL packet. In either of those cases, this method will be called.

Parameters

quicVersion:QuicVersion: the negotiated QuicVersion

Exceptions

IllegalArgumentException:: if the quicVersion isn't supported on this engine

Modifier and Type	Field and Description
public static final QuicTLSEngine.HandshakeState	HANDSHAKE_CONFIRMED Handshake is confirmed, as specified in section 4.1.2 of RFC-9001
public static final QuicTLSEngine.HandshakeState	NEED_RECV_CRYPTO Need to receive a CRYPTO frame
public static final QuicTLSEngine.HandshakeState	NEED_RECV_HANDSHAKE_DONE Need to receive a HANDSHAKE_DONE frame from server to complete the handshake, but application data can be sent in this state (client only state).
public static final QuicTLSEngine.HandshakeState	NEED_SEND_CRYPTO Need to send a CRYPTO frame
public static final QuicTLSEngine.HandshakeState	NEED_SEND_HANDSHAKE_DONE Need to send a HANDSHAKE_DONE frame to complete the handshake, but application data can be sent in this state (server only state)
public static final QuicTLSEngine.HandshakeState	NEED_TASK Need to execute a task

Modifier and Type	Method and Description
public static QuicTLSEngine.HandshakeState	valueOf(String name)
public static QuicTLSEngine.HandshakeState[]	values()

Modifier and Type	Field and Description
public static final QuicTLSEngine.KeySpace	HANDSHAKE
public static final QuicTLSEngine.KeySpace	INITIAL
public static final QuicTLSEngine.KeySpace	ONE_RTT
public static final QuicTLSEngine.KeySpace	RETRY
public static final QuicTLSEngine.KeySpace	ZERO_RTT

Modifier and Type	Method and Description
public static QuicTLSEngine.KeySpace	valueOf(String name)
public static QuicTLSEngine.KeySpace[]	values()

public Interface QuicTLSEngine

Nested and Inner Type Summary

Method Summary

Method Detail

public final Enum QuicTLSEngine.HandshakeState

Field Summary

Constructor Summary

Method Summary

Field Detail

Constructor Detail

Method Detail

public final Enum QuicTLSEngine.KeySpace

Field Summary

Constructor Summary

Method Summary

Field Detail

Constructor Detail

Method Detail