Top Fields Constructors Methods
io.netty.internal.tcnative

public final Class SSL

extends Object
Class Inheritance
Imports
java.nio.ByteBuffer, javax.net.ssl.SSLEngine

Field Summary

Modifier and TypeField and Description
public static final int
SSL_CERT_COMPRESSION_DIRECTION_BOTH

public static final int
SSL_CERT_COMPRESSION_DIRECTION_COMPRESS

public static final int
SSL_CERT_COMPRESSION_DIRECTION_DECOMPRESS

public static final int
SSL_CVERIFY_IGNORED

public static final int
SSL_CVERIFY_NONE

public static final int
SSL_CVERIFY_OPTIONAL

public static final int
SSL_CVERIFY_REQUIRED

public static final int
SSL_ERROR_NONE

public static final int
SSL_ERROR_SSL

public static final int
SSL_ERROR_SYSCALL

public static final int
SSL_ERROR_WANT_ACCEPT

public static final int
SSL_ERROR_WANT_CERTIFICATE_VERIFY

public static final int
SSL_ERROR_WANT_CONNECT

public static final int
SSL_ERROR_WANT_PRIVATE_KEY_OPERATION

public static final int
SSL_ERROR_WANT_READ

public static final int
SSL_ERROR_WANT_WRITE

public static final int
SSL_ERROR_WANT_X509_LOOKUP

public static final int
SSL_ERROR_ZERO_RETURN

public static final int
SSL_MAX_ENCRYPTED_LENGTH

public static final int
SSL_MAX_PLAINTEXT_LENGTH

public static final int
SSL_MAX_RECORD_LENGTH

The TLS 1.2 RFC defines the maximum length to be SSL_MAX_PLAINTEXT_LENGTH, but there are some implementations such as OpenJDK's SSLEngineImpl that also allow sending larger packets.

public static final int
SSL_MODE_ACCEPT_MOVING_WRITE_BUFFER

public static final int
SSL_MODE_CLIENT

public static final int
SSL_MODE_COMBINED

public static final int
SSL_MODE_ENABLE_FALSE_START

public static final int
SSL_MODE_ENABLE_PARTIAL_WRITE

public static final int
SSL_MODE_RELEASE_BUFFERS

public static final int
SSL_MODE_SERVER

public static final int
SSL_OP_ALLOW_UNSAFE_LEGACY_RENEGOTIATION

public static final int
SSL_OP_CIPHER_SERVER_PREFERENCE

public static final int
SSL_OP_LEGACY_SERVER_CONNECT

public static final int
SSL_OP_NO_COMPRESSION

public static final int
SSL_OP_NO_SSLv2

public static final int
SSL_OP_NO_SSLv3

public static final int
SSL_OP_NO_TICKET

public static final int
SSL_OP_NO_TLSv1

public static final int
SSL_OP_NO_TLSv1_1

public static final int
SSL_OP_NO_TLSv1_2

public static final int
SSL_OP_NO_TLSv1_3

public static final int
SSL_PROTOCOL_ALL

public static final int
SSL_PROTOCOL_NONE

public static final int
SSL_PROTOCOL_SSLV2

public static final int
SSL_PROTOCOL_SSLV3

public static final int
SSL_PROTOCOL_TLS

TLS_*method according to SSL_CTX_new

public static final int
SSL_PROTOCOL_TLSV1

public static final int
SSL_PROTOCOL_TLSV1_1

public static final int
SSL_PROTOCOL_TLSV1_2

public static final int
SSL_PROTOCOL_TLSV1_3

public static final int
SSL_RECEIVED_SHUTDOWN

public static final int
SSL_RENEGOTIATE_EXPLICIT

public static final int
SSL_RENEGOTIATE_FREELY

public static final int
SSL_RENEGOTIATE_IGNORE

public static final int
SSL_RENEGOTIATE_NEVER

public static final int
SSL_RENEGOTIATE_ONCE

public static final int
SSL_SELECTOR_FAILURE_CHOOSE_MY_LAST_PROTOCOL

public static final int
SSL_SELECTOR_FAILURE_NO_ADVERTISE

public static final int
SSL_SENT_SHUTDOWN

public static final long
SSL_SESS_CACHE_CLIENT

public static final long
SSL_SESS_CACHE_NO_INTERNAL_LOOKUP

public static final long
SSL_SESS_CACHE_NO_INTERNAL_STORE

public static final long
SSL_SESS_CACHE_OFF

public static final long
SSL_SESS_CACHE_SERVER

public static final int
SSL_ST_ACCEPT

public static final int
SSL_ST_CONNECT

public static final int
X509_CHECK_FLAG_ALWAYS_CHECK_SUBJECT

public static final int
X509_CHECK_FLAG_MULTI_LABEL_WILDCARDS

public static final int
X509_CHECK_FLAG_NO_PARTIAL_WILD_CARDS

public static final int
X509_CHECK_FLAG_NO_WILD_CARDS

Constructor Summary

AccessConstructor and Description
private
SSL()

Method Summary

Modifier and TypeMethod and Description
public static native String[]

Returns:

the methods
authenticationMethods(long
the SSL instance (SSL*)
ssl)

Return the methods used for authentication.

public static native void
bioClearByteBuffer(long
BIO*.
bio)

After you are done buffering data from bioSetByteBuffer(long, long, int, boolean), this will ensure the internal SSL write buffers are ready to capture data which may unexpectedly happen (e.g. handshake, renegotiation, etc..).

public static native int

Returns:

The number of bytes that were flushed.
bioFlushByteBuffer(long
BIO*.
bio)

Flush any pending bytes in the internal SSL write buffer.

public static native int

Returns:

The remaining length of the ByteBuffer set by bioSetByteBuffer(long, long, int, boolean).
bioLengthByteBuffer(long
BIO*.
bio)

Get the remaining length of the ByteBuffer set by bioSetByteBuffer(long, long, int, boolean).

public static native int

Returns:

the amount of data pending in buffer used for non-application writes.
bioLengthNonApplication(long
BIO*.
bio)

Get the amount of data pending in buffer used for non-application writes.

public static native long

Returns:

pointer to the Network BIO (BIO *). The memory is owned by ssl and will be cleaned up by freeSSL(long).
bioNewByteBuffer(long
the SSL instance (SSL *)
ssl, int
The size of the internal buffer for write operations that are not initiated directly by the application attempting to encrypt data. Must be >0.
nonApplicationBufferSize)

Initialize the BIO for the SSL instance.

public static native void
bioSetByteBuffer(long
BIO*.
bio, long
The memory address (typically from a direct ByteBuffer) which will be used to either write encrypted data to, or read encrypted data from by OpenSSL's internal BIO pair.
bufferAddress, int
The maximum usable length in bytes starting at bufferAddress.
maxUsableBytes, boolean
true if this buffer is expected to buffer data as a result of calls to SSL_write. false if this buffer is expected to buffer data as a result of calls to SSL_read.
isSSLWriteSink)

Set the memory location which that OpenSSL's internal BIO will use to write encrypted data to, or read encrypted data from.

public static native void
bioSetFd(long
the SSL instance (SSL *)
ssl, int
the file descriptor of the socket used for the given SSL connection
fd)

Sets the socket file descriptor of the rbio field inside the SSL struct (ssl->rbio->num)

public static native int

Returns:

The number of bytes that were written. See BIO_write for exceptional return values.
bioWrite(long
The address of a BIO*.
bioAddress, long
The address of a native char*.
wbufAddress, int
The length to write starting at wbufAddress.
wlen)

BIO_write

public static native void
clearError()

Clear all the errors from the error queue that OpenSSL encountered on this thread.

public static native void
clearOptions(long
the SSL instance (SSL *)
ssl, int
See SSL.SSL_OP_* for option flags.
options)

Clear OpenSSL Option.

public static native int

Returns:

the return code of SSL_do_handshake.
doHandshake(long
the SSL instance (SSL *)
ssl)

SSL_do_handshake

public static native void
enableOcsp(long ssl)

Enables OCSP stapling for the given SSLEngine or throws an exception if OCSP stapling is not supported.

public static native void
fipsModeSet(int
the mode to use.
mode)

Set the FIPS mode to use.

public static native void
freeBIO(long
the BIO
bio)

BIO_free

public static native void
freePrivateKey(long
EVP_PKEY pointer
privateKey)

Free private key (EVP_PKEY pointer).

public static native void
freeSSL(long
the SSL instance (SSL *)
ssl)

SSL_free

public static native void
freeX509Chain(long
STACK_OF(X509) pointer
x509Chain)

Free x509 chain (STACK_OF(X509) pointer).

public static native String

Returns:

the name of the selected ALPN protocol
getAlpnSelected(long
the SSL instance (SSL *)
ssl)

SSL_get0_alpn_selected

public static AsyncTask

Returns:

the task to run.
getAsyncTask(long
the SSL instance (SSL *)
ssl)

Return the AsyncTask that needs to be run as an operation did signal that a task needs to be completed before we can retry it.

public static native String

Returns:

the name of the current cipher.
getCipherForSSL(long
the SSL instance (SSL *)
ssl)

SSL_get_cipher

public static native String[]

Returns:

ciphers
getCiphers(long
the SSL instance (SSL *)
ssl)

Returns all Returns the cipher suites that are available for negotiation in an SSL handshake.

public static native byte[]

Returns:

the random client value used for the ssl session
getClientRandom(long
the SSL instance (SSL *)
ssl)

Extracts the random value sent from the client to the server during the initial SSL/TLS handshake.

public static native int

Returns:

the error code
getError(long
SSL pointer (SSL *)
ssl, int
TLS/SSL I/O return value
ret)

SSL_get_error

public static native String

Returns:

the error string
getErrorString(long
the error number / code
errorNumber)

Get the error string representing for the given errorNumber.

public static native int

Returns:

the number of handshakes done for this SSL instance.
getHandshakeCount(long
the SSL instance (SSL *)
ssl)

Returns the number of handshakes done for this SSL instance.

public static native String

Returns:

the last SSL error string.
getLastError()

Return last SSL error string

public static native int

Returns:

the last error code for the calling thread.
getLastErrorNumber()

Get the error number representing the last error OpenSSL encountered on this thread.

public static native byte[]

Returns:

the master key used for the ssl session
getMasterKey(long
the SSL instance (SSL *)
ssl)

Returns the master key used for the current ssl session.

public static native int

Returns:

Maximum overhead, in bytes, of wrapping (a.k.a sealing) a record with ssl.
getMaxWrapOverhead(long
the SSL instance (SSL *).
ssl)

Get the maximum overhead, in bytes, of wrapping (a.k.a sealing) a record with ssl.

public static native int

Returns:

the mode.
getMode(long
the SSL instance (SSL *).
ssl)

Call SSL_get_mode

public static native String

Returns:

the name of the negotiated proto
getNextProtoNegotiated(long
the SSL instance (SSL *)
ssl)

SSL_get0_next_proto_negotiated

public static native byte[]
getOcspResponse(long
the SSL instance (SSL *)
ssl)

Returns the OCSP response for the given SSLEngine or null if the server didn't provide a stapled OCSP response.

public static native int

Returns:

options See SSL.SSL_OP_* for option flags.
getOptions(long
the SSL instance (SSL *)
ssl)

Get OpenSSL Option.

public static native byte[][]

Returns:

the chain or null if none was send
getPeerCertChain(long
the SSL instance (SSL *)
ssl)

Get the peer certificate chain or null if none was send.

public static native byte[]

Returns:

the peer certificate or null if none was send
getPeerCertificate(long
the SSL instance (SSL *)
ssl)

Get the peer certificate or null if non was send.

public static native byte[]

Returns:

the random server value used for the ssl session
getServerRandom(long
the SSL instance (SSL *)
ssl)

Extracts the random value sent from the server to the client during the initial SSL/TLS handshake.

public static native long

Returns:

the SSL_SESSION instance (SSL_SESSION *) used
getSession(long
the SSL instance (SSL *)
ssl)

Returns the SSL_SESSION that is used for SSL.

public static native byte[]

Returns:

the session as byte array representation obtained via SSL_SESSION_get_id.
getSessionId(long
the SSL instance (SSL *)
ssl)

Returns the ID of the session as byte array representation.

public static native int

Returns:

the return code of SSL_get_shutdown
getShutdown(long
the SSL instance (SSL *)
ssl)

SSL_get_shutdown

public static native String[]

Returns:

the signature algorithms or null.
getSigAlgs(long
the SSL instance (SSL *)
ssl)

Return the signature algorithms that the remote peer supports or null if none are supported.

public static native String

Returns:

the SNI hostname or null if none was used.
getSniHostname(long
the SSL instance (SSL *)
ssl)

Return the SNI hostname that was sent as part of the SSL Hello.

public static native Runnable

Returns:

the task to run.
getTask(long
the SSL instance (SSL *)
ssl)

Return the Runnable that needs to be run as an operation did signal that a task needs to be completed before we can retry the previous action.

public static native long

Returns:

returns the time at which the session ssl was established. The time is given in seconds since the Epoch
getTime(long
the SSL instance (SSL *)
ssl)

SSL_get_time

public static native long

Returns:

returns the timeout for the session ssl The time is given in seconds since the Epoch
getTimeout(long
the SSL instance (SSL *)
ssl)

SSL_get_timeout

public static native String

Returns:

the version.
getVersion(long
the SSL instance (SSL *)
ssl)

SSL_get_version

pack-priv static native int

Returns:

APR status code
initialize(String
Support for external a Crypto Device ("engine"), usually a hardware accelerator card for crypto operations.
engine)

Initialize OpenSSL support.

public static native int

Returns:

the return code of SSL_in_init.
isInInit(long
the SSL instance (SSL *)
ssl)

SSL_in_init

public static native boolean

Returns:

true if the SSL_SESSION was reused, false otherwise.
isSessionReused(long
the SSL instance (SSL *)
ssl)

Return true if the SSL_SESSION was reused.

public static native long

Returns:

EVP_PKEY pointer
loadPrivateKeyFromEngine(String
the id of the key.
keyId, String
the password to use or null if none.
password)

Load a private key from the used OpenSSL ENGINE via the ENGINE_load_private_key function.

public static native long

Returns:

New BIO handle
newMemBIO()

Initialize new in-memory BIO that is located in the secure heap.

public static native long

Returns:

pointer to SSL instance (SSL *)
newSSL(long
Server or Client context to use.
ctx, boolean
if true configure SSL instance to use accept handshake routines if false configure SSL instance to use connect handshake routines
server)

SSL_new

public static native long

Returns:

EVP_PKEY pointer
parsePrivateKey(long
the pointer to the BIO that contains the private key
privateKeyBio, String
the password or null if no password is needed
password)

Parse private key from BIO and return EVP_PKEY pointer.

public static native long

Returns:

STACK_OF(X509) pointer
parseX509Chain(long
the pointer to the BIO that contains the X509 chain
x509ChainBio)

Parse X509 chain from BIO and return (STACK_OF(X509) pointer).

public static native int

Returns:

the number of read bytes
readFromSSL(long
the SSL instance (SSL *)
ssl, long
the memory address of the buffer
rbuf, int
the length
rlen)

SSL_read

public static native void
setCertificateBio(long
Server or Client to use.
ssl, long
Certificate BIO.
certBio, long
Private Key BIO to use if not in cert.
keyBio, String
Certificate password. If null and certificate is encrypted.
password)

Deprecated use setKeyMaterial(long, long, long)
Set Certificate Point setCertificate at a PEM encoded certificate stored in a BIO.
public static native void
setCertificateChainBio(long
Server or Client to use.
ssl, long
BIO of PEM-encoded Server CA Certificates.
bio, boolean
Skip first certificate if chain file is inside certificate file.
skipfirst)

Deprecated use setKeyMaterial(long, long, long)
Set BIO of PEM-encoded Server CA Certificates

This directive sets the optional all-in-one file where you can assemble the certificates of Certification Authorities (CA) which form the certificate chain of the server certificate.

public static boolean

Returns:

true if successful
setCipherSuites(long
the SSL instance (SSL *)
ssl, String
an SSL cipher specification
ciphers)

Deprecated Use setCipherSuites(long, String, boolean)
Returns the cipher suites available for negotiation in SSL handshake.
public static native boolean

Returns:

true if successful
setCipherSuites(long
the SSL instance (SSL *)
ssl, String
an SSL cipher specification
ciphers, boolean
true if the ciphers are for TLSv1.3
tlsv13)

Returns the cipher suites available for negotiation in SSL handshake.

public static native void
setHostNameValidation(long
the SSL instance (SSL*).
ssl, int
a bitmask of X509_CHECK_FLAG* values.
flags, String
the hostname which is expected for validation.
hostname)

Explicitly control hostname validation see X509_check_host for X509_CHECK_FLAG* definitions.

public static native void
setKeyMaterial(long ssl, long chain, long key)

Sets the keymaterial to be used.

public static native void
setKeyMaterialClientSide(long ssl, long x509Out, long pkeyOut, long chain, long key)

Deprecated use setKeyMaterial(long, long, long)
Sets the keymaterial to be used for the client side.
public static void
setKeyMaterialServerSide(long ssl, long chain, long key)

Deprecated use setKeyMaterial(long, long, long)
Sets the keymaterial to be used for the server side.
public static native int

Returns:

the set mode.
setMode(long
the SSL instance (SSL *).
ssl, int
the mode
mode)

Call SSL_set_mode

public static native void
setOcspResponse(long
the SSL instance (SSL *)
ssl, byte[] response)

Sets the OCSP response for the given SSLEngine or throws an exception in case of an error.

public static native void
setOptions(long
the SSL instance (SSL *)
ssl, int
See SSL.SSL_OP_* for option flags.
options)

Set OpenSSL Option.

public static native void
setRenegotiateMode(long
the SSL instance (SSL *)
ssl, int
the mode.
mode)

Allow to set the renegotiation mode that is used.

public static native boolean

Returns:

true if successful, false otherwise.
setSession(long
the SSL instance (SSL *)
ssl, long
the SSL_SESSION instance (SSL_SESSION *)
session)

Sets the SSL_SESSION that should be used for SSL.

public static native void
setShutdown(long
the SSL instance (SSL *)
ssl, int
the mode to use
mode)

SSL_set_shutdown

public static native long

Returns:

returns the timeout for the session ssl before this call. The time is given in seconds since the Epoch
setTimeout(long
the SSL instance (SSL *)
ssl, long
timeout in seconds
seconds)

SSL_set_timeout

public static void
setTlsExtHostName(long
the SSL instance (SSL *)
ssl, String
the hostname
hostname)

Call SSL_set_tlsext_host_name

private static native void
setTlsExtHostName0(long ssl, String hostname)

public static native void
setVerify(long
the SSL instance (SSL *)
ssl, int
Type of Client Certificate verification.
level, int
Maximum depth of CA Certificates in Client Certificate verification. Ignored if value is <0.
depth)

Set Type of Client Certificate verification and Maximum depth of CA Certificates in Client Certificate verification.

public static native int

Returns:

the return code of SSL_shutdown
shutdownSSL(long
the SSL instance (SSL *)
ssl)

SSL_shutdown

public static native int

Returns:

The number of bytes pending in SSL which can be read immediately.
sslPending(long
the SSL instance (SSL *)
ssl)

The number of bytes pending in SSL which can be read immediately.

public static native int
version()

public static native String
versionString()

public static native int

Returns:

the number of written bytes
writeToSSL(long
the SSL instance (SSL *)
ssl, long
the memory address of the buffer
wbuf, int
the length
wlen)

SSL_write

Inherited from java.lang.Object:
cloneequalsfinalizegetClasshashCodenotifynotifyAlltoStringwaitwaitwait