Modifier and Type	Class and Description
private static class	ExportControlled.HostnameChecker
private static class	ExportControlled.KeyStoreConfigurations
private static class	ExportControlled.SslContextBuilder
public static class	ExportControlled.X509TrustManagerWrapper X509TrustManager wrapper that allows skipping server certificate validation and adds certificate expiration check.

Modifier and Type	Field and Description
private static final List<String>	ALLOWED_CIPHERS
private static final String[]	APPROVED_TLS_PROTOCOLS
private static final String[]	KNOWN_TLS_PROTOCOLS
private static final String	SSL_CONTEXT_PROTOCOL
private static final String	TLS_SETTINGS_RESOURCE
private static final String	TLSv1
private static final String	TLSv1_1
private static final String	TLSv1_2
private static final String	TLSv1_3
private static final List<String>	UNACCEPTABLE_CIPHER_SUBSTR

Access	Constructor and Description
private	ExportControlled()

Method Summary

Modifier and Type	Method and Description
public static void	checkValidProtocols(List<String> protocols)
public static RSAPrivateKey	decodeRSAPrivateKey(String key)
public static RSAPublicKey	decodeRSAPublicKey(String key)
public static boolean	enabled()
public static byte[]	encryptWithRSAPublicKey(byte[] source, RSAPublicKey key, String transformation)
public static byte[]	encryptWithRSAPublicKey(byte[] source, RSAPublicKey key)
private static String[]	getAllowedCiphers(PropertySet pset, List<String> socketCipherSuites)
private static String[]	getAllowedProtocols(PropertySet pset, String[] socketProtocols)
private static ExportControlled.KeyStoreConfigurations	getKeyStoreConfigurations(PropertySet propertySet)
private static ExportControlled.KeyStoreConfigurations	getTrustStoreConfigurations(PropertySet propertySet)
private static List<String>	getValidProtocols(String[] protocols)
public static boolean	isSSLEstablished(Socket socket)
public static Socket	Returns: SSL socket performTlsHandshake(Socket original non-SSL socket rawSocket, SocketConnection the Protocol instance containing the socket to convert into an SSLSocket. socketConnection, ServerVersion ServerVersion object serverVersion, Log Logger log) Converts the socket being used in the given SocketConnection to an SSLSocket by performing the TLS handshake.
public static byte[]	sign(byte[] source, RSAPrivateKey privateKey)

Inherited from java.lang.Object:: clone equals finalize getClass hashCode notify notifyAll toString wait wait wait

ALLOWED_CIPHERS	back to summary
private static final List<String> ALLOWED_CIPHERS

APPROVED_TLS_PROTOCOLS	back to summary
private static final String[] APPROVED_TLS_PROTOCOLS

KNOWN_TLS_PROTOCOLS	back to summary
private static final String[] KNOWN_TLS_PROTOCOLS

SSL_CONTEXT_PROTOCOL	back to summary
private static final String SSL_CONTEXT_PROTOCOL

TLS_SETTINGS_RESOURCE	back to summary
private static final String TLS_SETTINGS_RESOURCE

TLSv1	back to summary
private static final String TLSv1

TLSv1_1	back to summary
private static final String TLSv1_1

TLSv1_2	back to summary
private static final String TLSv1_2

TLSv1_3	back to summary
private static final String TLSv1_3

UNACCEPTABLE_CIPHER_SUBSTR	back to summary
private static final List<String> UNACCEPTABLE_CIPHER_SUBSTR

ExportControlled	back to summary
private ExportControlled()

Method Detail

checkValidProtocols	back to summary
public static void checkValidProtocols(List<String> protocols)

decodeRSAPrivateKey	back to summary
public static RSAPrivateKey decodeRSAPrivateKey(String key) throws RSAException

decodeRSAPublicKey	back to summary
public static RSAPublicKey decodeRSAPublicKey(String key) throws RSAException

enabled	back to summary
public static boolean enabled()

encryptWithRSAPublicKey	back to summary
public static byte[] encryptWithRSAPublicKey(byte[] source, RSAPublicKey key, String transformation) throws RSAException

encryptWithRSAPublicKey	back to summary
public static byte[] encryptWithRSAPublicKey(byte[] source, RSAPublicKey key) throws RSAException

getAllowedCiphers	back to summary
private static String[] getAllowedCiphers(PropertySet pset, List<String> socketCipherSuites)

getAllowedProtocols	back to summary
private static String[] getAllowedProtocols(PropertySet pset, String[] socketProtocols)

getKeyStoreConfigurations	back to summary
private static ExportControlled.KeyStoreConfigurations getKeyStoreConfigurations(PropertySet propertySet)

getTrustStoreConfigurations	back to summary
private static ExportControlled.KeyStoreConfigurations getTrustStoreConfigurations(PropertySet propertySet)

getValidProtocols	back to summary
private static List<String> getValidProtocols(String[] protocols)

isSSLEstablished	back to summary
public static boolean isSSLEstablished(Socket socket)

performTlsHandshake	back to summary
public static Socket performTlsHandshake(Socket rawSocket, SocketConnection socketConnection, ServerVersion serverVersion, Log log) throws IOException, SSLParamsException, FeatureNotAvailableException Converts the socket being used in the given SocketConnection to an SSLSocket by performing the TLS handshake. Parameters rawSocket:Socket original non-SSL socket socketConnection:SocketConnection the Protocol instance containing the socket to convert into an SSLSocket. serverVersion:ServerVersion ServerVersion object log:Log Logger Returns:Socket SSL socket Exceptions IOException: if an I/O exception occurs SSLParamsException: if the handshake fails FeatureNotAvailableException: if TLS is not supported

performTlsHandshake

back to summary

public static Socket performTlsHandshake(Socket rawSocket, SocketConnection socketConnection, ServerVersion serverVersion, Log log) throws IOException, SSLParamsException, FeatureNotAvailableException

Converts the socket being used in the given SocketConnection to an SSLSocket by performing the TLS handshake.

Parameters

rawSocket:Socket: original non-SSL socket
socketConnection:SocketConnection: the Protocol instance containing the socket to convert into an SSLSocket.
serverVersion:ServerVersion: ServerVersion object
log:Log: Logger

Returns:Socket

SSL socket

Exceptions

IOException:: if an I/O exception occurs
SSLParamsException:: if the handshake fails
FeatureNotAvailableException:: if TLS is not supported

sign	back to summary
public static byte[] sign(byte[] source, RSAPrivateKey privateKey) throws RSAException

com.mysql.cj.protocol back to summary

private Class ExportControlled.HostnameChecker

Class Inheritance

extends Object

java.lang.Object
com.mysql.cj.protocol.ExportControlled.HostnameChecker

Field Summary

Modifier and Type	Field and Description
private String	hostname

Constructor Summary

Access	Constructor and Description
public	HostnameChecker(String hostname)

Method Summary

Modifier and Type	Method and Description
public void	match(X509Certificate certificate)
private boolean	Returns: `true` if the host name matches the pattern, `false` otherwise. verifyHostName(String the pattern to match with the host name. ptn) Verify the host name against the given pattern, using the rules specified in RFC 6125, Section 6.4.3.

Inherited from java.lang.Object:: clone equals finalize getClass hashCode notify notifyAll toString wait wait wait

Field Detail

hostname	back to summary
private String hostname

Constructor Detail

HostnameChecker	back to summary
public HostnameChecker(String hostname)

Method Detail

match	back to summary
public void match(X509Certificate certificate) throws CertificateException

verifyHostName back to summary

verifyHostName	back to summary
private boolean verifyHostName(String ptn) Verify the host name against the given pattern, using the rules specified in RFC 6125, Section 6.4.3. Support wildcard character as defined in the RFC. Parameters ptn:String the pattern to match with the host name. Returns:boolean `true` if the host name matches the pattern, `false` otherwise.

private boolean verifyHostName(String ptn)

Verify the host name against the given pattern, using the rules specified in RFC 6125, Section 6.4.3. Support wildcard character as defined in the RFC.

Parameters

ptn:String: the pattern to match with the host name.

Returns:boolean

true if the host name matches the pattern, false otherwise.

com.mysql.cj.protocol back to summary

private Class ExportControlled.KeyStoreConfigurations

Class Inheritance

extends Object

java.lang.Object
com.mysql.cj.protocol.ExportControlled.KeyStoreConfigurations

Field Summary

Modifier and Type	Field and Description
public String	keyStorePassword
public String	keyStoreType
public String	keyStoreUrl

Constructor Summary

Access	Constructor and Description
public	KeyStoreConfigurations()
public	KeyStoreConfigurations(String keyStoreUrl, String keyStorePassword, String keyStoreType)

Method Summary

Inherited from java.lang.Object:: clone equals finalize getClass hashCode notify notifyAll toString wait wait wait

Field Detail

keyStorePassword	back to summary
public String keyStorePassword

keyStoreType	back to summary
public String keyStoreType

keyStoreUrl	back to summary
public String keyStoreUrl

Constructor Detail

KeyStoreConfigurations	back to summary
public KeyStoreConfigurations()

KeyStoreConfigurations	back to summary
public KeyStoreConfigurations(String keyStoreUrl, String keyStorePassword, String keyStoreType)

com.mysql.cj.protocol back to summary

private Class ExportControlled.SslContextBuilder

Class Inheritance

extends Object

java.lang.Object
com.mysql.cj.protocol.ExportControlled.SslContextBuilder

Field Summary

Modifier and Type	Field and Description
private ExceptionInterceptor	exceptionInterceptor
private boolean	fallbackToSystemTrustStore
private boolean	fipsCompliantJsse
private String	KeyManagerFactoryProvider
private String	keyStoreProvider
private ExportControlled.KeyStoreConfigurations	keyStoreSettings
private String	sslContextProvider
private String	trustManagerFactoryProvider
private ExportControlled.KeyStoreConfigurations	trustStoreSettings
private boolean	verifyServerCertificate

Constructor Summary

Access	Constructor and Description
public	SslContextBuilder()

Method Summary

Modifier and Type	Method and Description
public SSLContext	build()
public void	setExceptionInterceptor(ExceptionInterceptor exceptionInterceptor)
public void	setFallbackToSystemTrustStore(boolean fallbackToDefaultTrustStore)
public void	setFipsCompliantJsse(boolean fipsCompliantJsse)
public void	setKeyManagerFactoryProvider(String keyManagerFactoryProvider)
public void	setKeyStoreProvider(String keyStoreProvider)
public void	setKeyStoreSettings(ExportControlled.KeyStoreConfigurations keyStoreSettings)
public void	setSslContextProvider(String sslContextProvider)
public void	setTrustManagerFactoryProvider(String trustManagerFactoryProvider)
public void	setTrustStoreSettings(ExportControlled.KeyStoreConfigurations keyStoreSettings)
public void	setVerifyServerCertificate(boolean verifyServerCertificate)

Inherited from java.lang.Object:: clone equals finalize getClass hashCode notify notifyAll toString wait wait wait

Field Detail

exceptionInterceptor	back to summary
private ExceptionInterceptor exceptionInterceptor

fallbackToSystemTrustStore	back to summary
private boolean fallbackToSystemTrustStore

fipsCompliantJsse	back to summary
private boolean fipsCompliantJsse

KeyManagerFactoryProvider	back to summary
private String KeyManagerFactoryProvider

keyStoreProvider	back to summary
private String keyStoreProvider

keyStoreSettings	back to summary
private ExportControlled.KeyStoreConfigurations keyStoreSettings

sslContextProvider	back to summary
private String sslContextProvider

trustManagerFactoryProvider	back to summary
private String trustManagerFactoryProvider

trustStoreSettings	back to summary
private ExportControlled.KeyStoreConfigurations trustStoreSettings

verifyServerCertificate	back to summary
private boolean verifyServerCertificate

Constructor Detail

SslContextBuilder	back to summary
public SslContextBuilder()

Method Detail

build	back to summary
public SSLContext build()

setExceptionInterceptor	back to summary
public void setExceptionInterceptor(ExceptionInterceptor exceptionInterceptor)

setFallbackToSystemTrustStore	back to summary
public void setFallbackToSystemTrustStore(boolean fallbackToDefaultTrustStore)

setFipsCompliantJsse	back to summary
public void setFipsCompliantJsse(boolean fipsCompliantJsse)

setKeyManagerFactoryProvider	back to summary
public void setKeyManagerFactoryProvider(String keyManagerFactoryProvider)

setKeyStoreProvider	back to summary
public void setKeyStoreProvider(String keyStoreProvider)

setKeyStoreSettings	back to summary
public void setKeyStoreSettings(ExportControlled.KeyStoreConfigurations keyStoreSettings)

setSslContextProvider	back to summary
public void setSslContextProvider(String sslContextProvider)

setTrustManagerFactoryProvider	back to summary
public void setTrustManagerFactoryProvider(String trustManagerFactoryProvider)

setTrustStoreSettings	back to summary
public void setTrustStoreSettings(ExportControlled.KeyStoreConfigurations keyStoreSettings)

setVerifyServerCertificate	back to summary
public void setVerifyServerCertificate(boolean verifyServerCertificate)

com.mysql.cj.protocol back to summary

public Class ExportControlled.X509TrustManagerWrapper

Class Inheritance

extends Object
implements X509TrustManager

java.lang.Object
com.mysql.cj.protocol.ExportControlled.X509TrustManagerWrapper

All Implemented Interfaces

javax.net.ssl.X509TrustManager, javax.net.ssl.TrustManager

X509TrustManager wrapper that allows skipping server certificate validation and adds certificate expiration check.

Field Summary

Modifier and Type	Field and Description
private static final String	CERT_FACTORY_TYPE
private static final String	CERT_PATH_VALIDATOR_ALGORITHM
private CertificateFactory	certFactory
private CertPathValidator	certPathValidator
private X509TrustManager	originalTrustManager
private PKIXParameters	pkixParams
private boolean	validateServerCert

Constructor Summary

Access	Constructor and Description
pack-priv	X509TrustManagerWrapper(X509TrustManager if null then enables just certificate expiration check. tm) Constructor for enabling server certificate validation and certificate expiration check.
pack-priv	X509TrustManagerWrapper() Constructor for enabling just certificate expiration check.

Method Summary

Modifier and Type	Method and Description
public void	checkClientTrusted(X509Certificate[] the peer certificate chain chain, String the authentication type based on the client certificate authType) Implements javax.net.ssl.X509TrustManager.checkClientTrusted. Given the partial or complete certificate chain provided by the peer, build a certificate path to a trusted root and return if it can be validated and is trusted for client SSL authentication based on the authentication type.
public void	checkServerTrusted(X509Certificate[] the peer certificate chain chain, String the key exchange algorithm used authType) Implements javax.net.ssl.X509TrustManager.checkServerTrusted. Given the partial or complete certificate chain provided by the peer, build a certificate path to a trusted root and return if it can be validated and is trusted for server SSL authentication based on the authentication type.
public X509Certificate[]	getAcceptedIssuers() Implements javax.net.ssl.X509TrustManager.getAcceptedIssuers. Return an array of certificate authority certificates which are trusted for authenticating peers.

Inherited from java.lang.Object:: clone equals finalize getClass hashCode notify notifyAll toString wait wait wait

Field Detail

CERT_FACTORY_TYPE	back to summary
private static final String CERT_FACTORY_TYPE

CERT_PATH_VALIDATOR_ALGORITHM	back to summary
private static final String CERT_PATH_VALIDATOR_ALGORITHM

certFactory	back to summary
private CertificateFactory certFactory

certPathValidator	back to summary
private CertPathValidator certPathValidator

originalTrustManager	back to summary
private X509TrustManager originalTrustManager

pkixParams	back to summary
private PKIXParameters pkixParams

validateServerCert	back to summary
private boolean validateServerCert

Constructor Detail

X509TrustManagerWrapper

back to summary

pack-priv X509TrustManagerWrapper(X509TrustManager tm) throws CertificateException

Constructor for enabling server certificate validation and certificate expiration check.

Parameters

tm:X509TrustManager: if null then enables just certificate expiration check.

X509TrustManagerWrapper	back to summary
pack-priv X509TrustManagerWrapper() throws CertificateException Constructor for enabling just certificate expiration check.

Method Detail

checkClientTrusted

back to summary

public void checkClientTrusted(X509Certificate[] chain, String authType) throws CertificateException

Implements javax.net.ssl.X509TrustManager.checkClientTrusted.

Doc from javax.net.ssl.X509TrustManager.checkClientTrusted.

Given the partial or complete certificate chain provided by the peer, build a certificate path to a trusted root and return if it can be validated and is trusted for client SSL authentication based on the authentication type.

The authentication type is determined by the actual certificate used. For instance, if RSAPublicKey is used, the authType should be "RSA". Checking is case-sensitive.

Parameters

chain:X509Certificate[]: the peer certificate chain
authType:String: the authentication type based on the client certificate

Annotations

@Override

Exceptions

CertificateException:: if the certificate chain is not trusted by this TrustManager.

checkServerTrusted

back to summary

public void checkServerTrusted(X509Certificate[] chain, String authType) throws CertificateException

Implements javax.net.ssl.X509TrustManager.checkServerTrusted.

Doc from javax.net.ssl.X509TrustManager.checkServerTrusted.

Given the partial or complete certificate chain provided by the peer, build a certificate path to a trusted root and return if it can be validated and is trusted for server SSL authentication based on the authentication type.

The authentication type is the key exchange algorithm portion of the cipher suites represented as a String, such as "RSA", "DHE_DSS".

Note

for some exportable cipher suites, the key exchange algorithm is determined at run time during the handshake. For instance, for TLS_RSA_EXPORT_WITH_RC4_40_MD5, the authType should be RSA_EXPORT when an ephemeral RSA key is used for the key exchange, and RSA when the key from the server certificate is used. Checking is case-sensitive.

Parameters

chain:X509Certificate[]: the peer certificate chain
authType:String: the key exchange algorithm used

Annotations

@Override

Exceptions

CertificateException:: if the certificate chain is not trusted by this TrustManager.

getAcceptedIssuers

back to summary

public X509Certificate[] getAcceptedIssuers()

Implements javax.net.ssl.X509TrustManager.getAcceptedIssuers.

Doc from javax.net.ssl.X509TrustManager.getAcceptedIssuers.

Return an array of certificate authority certificates which are trusted for authenticating peers.

Returns:X509Certificate[]

a non-null (possibly empty) array of acceptable CA issuer certificates.

Annotations

@Override

public Class ExportControlled

Nested and Inner Type Summary

Field Summary

Constructor Summary

Method Summary

Field Detail

Constructor Detail

Method Detail

private Class ExportControlled.HostnameChecker

Field Summary

Constructor Summary

Method Summary

Field Detail

Constructor Detail

Method Detail

private Class ExportControlled.KeyStoreConfigurations

Field Summary

Constructor Summary

Method Summary

Field Detail

Constructor Detail

private Class ExportControlled.SslContextBuilder

Field Summary

Constructor Summary

Method Summary

Field Detail

Constructor Detail

Method Detail

public Class ExportControlled.X509TrustManagerWrapper

Field Summary

Constructor Summary

Method Summary

Field Detail

Constructor Detail

Method Detail