Tomcat 10.1.19 · org.apache.tomcat.util.net.openssl.ciphers.OpenSSLCipherConfigurationParser

Field Summary

Modifier and Type	Field and Description
private static final String	aDH Cipher suites effectively using DH authentication, i.e. the certificates carry DH keys.
private static final String	ADH Anonymous DH cipher suites.
private static final String	aDSS Cipher suites using DSS authentication, i.e. the certificates carry DSS keys.
private static final String	AECDH Anonymous Elliptic Curve Diffie Hellman cipher suites.
private static final String	aECDH Cipher suites effectively using ECDH authentication, i.e. the certificates carry ECDH keys.
private static final String	aECDSA Cipher suites effectively using ECDSA authentication, i.e. the certificates carry ECDSA keys.
private static final String	AES Cipher suites using either 128 or 256 bit AES.
private static final String	AES128 Cipher suites using 128 bit AES.
private static final String	AES256 Cipher suites using 256 bit AES.
private static final String	AESCCM AES in Counter with CBC-MAC Mode (CCM).
private static final String	AESCCM8 AES in Counter with CBC-MAC Mode and 8-byte authentication (CCM8).
private static final String	AESGCM AES in Galois Counter Mode (GCM): these cipher suites are only supported in TLS v1.2.
private static final String	aFZA Ciphers suites using FORTEZZA authentication algorithms.
private static final String	aGOST Cipher suites using GOST R 34.10 (either 2001 or 94) for authentication.
private static final String	aGOST01 Cipher suites using GOST R 34.10-2001 for authentication.
private static final String	aGOST94 Cipher suites using GOST R 34.10-94 authentication (note that R 34.10-94 standard has been expired so use GOST R 34.10-2001)
private static final Map<String, List<Cipher>>	aliases All ciphers by their openssl alias name.
private static final String	ALL
private static final String	AND Lists of cipher suites can be combined in a single cipher string using the + character.
private static final String	aNULL The cipher suites offering no authentication.
private static final String	aPSK Cipher suites using PSK authentication.
private static final String	ARIA Cipher suites using either 128 or 256 bit ARIA.
private static final String	ARIA128 Cipher suites using either 128 bit ARIA.
private static final String	ARIA256 Cipher suites using either 256 bit ARIA.
private static final String	aRSA Cipher suites using RSA authentication.
private static final String	aSRP Cipher suites using SRP authentication, specified in the RFC 5054.
private static final String	CAMELLIA Cipher suites using either 128 or 256 bit CAMELLIA.
private static final String	CAMELLIA128 Cipher suites using 128 bit CAMELLIA.
private static final String	CAMELLIA256 Cipher suites using 256 bit CAMELLIA.
private static final String	CHACHA20 Cipher suites using CHACHA20.
private static final String	COMPLEMENTOFALL
private static final String	COMPLEMENTOFDEFAULT
private static final String	DEFAULT
private static final String	DELETE If - is used then the ciphers are deleted from the list, but some or all of the ciphers can be added again by later options.
private static final String	DES Cipher suites using DES (not triple DES).
private static final String	DH Cipher suites using DH, including anonymous DH, ephemeral DH and fixed DH.
private static final String	DHE Cipher suites using ephemeral DH key agreement.
private static final String	DSS Cipher suites using DSS for key exchange
private static final String	ECDH Cipher suitesusing ECDH key exchange, including anonymous, ephemeral and fixed ECDH.
private static final String	ECDHE Cipher suites using authenticated ephemeral ECDH key agreement
private static final String	ECDSA Cipher suites effectively using ECDSA authentication, i.e. the certificates carry ECDSA keys.
private static final String	EDH Cipher suites using ephemeral DH key agreement.
private static final String	EECDH Cipher suites using ephemeral ECDH key agreement, excluding anonymous cipher suites.
private static final String	eFZA Ciphers suites using FORTEZZA encryption algorithms.
private static final String	eNULL the 'NULL' ciphers that is those offering no encryption.
private static final String	EXCLUDE If !
private static final String	EXPORT Export encryption algorithms.
private static final String	EXPORT40 40 bit export encryption algorithms.
private static final String	EXPORT56 56 bit export encryption algorithms.
private static final String	FZA Ciphers suites using all FORTEZZA algorithms.
private static final String	GOST89MAC Cipher suites using GOST 28147-89 MAC instead of HMAC.
private static final String	GOST94 Cipher suites, using HMAC based on GOST R 34.11-94.
private static final String	HIGH 'high' encryption cipher suites.
private static final String	IDEA Cipher suites using IDEA.
private static boolean	initialized
private static final Map<String, String>	jsseToOpenSSL
private static final String	kDH Cipher suites using DH key agreement and DH certificates signed by CAs with RSA or DSS keys.
private static final String	kDHd Cipher suites using DH key agreement and DH certificates signed by CAs with DSS keys.
private static final String	kDHE Cipher suites using ephemeral DH key agreement.
private static final String	kDHEPSK
private static final String	kDHr Cipher suites using DH key agreement and DH certificates signed by CAs with RSA keys.
private static final String	kECDH Cipher suites using fixed ECDH key agreement signed by CAs with RSA and ECDSA keys or either respectively.
private static final String	kECDHe Cipher suites using fixed ECDH key agreement signed by CAs with ECDSA keys.
private static final String	kECDHE Cipher suites using ephemeral ECDH key agreement, including anonymous cipher suites.
private static final String	kECDHEPSK
private static final String	kECDHr Cipher suites using fixed ECDH key agreement signed by CAs with RSA keys.
private static final String	kEDH Cipher suites using ephemeral DH key agreement.
private static final String	kEECDH Cipher suites using ephemeral ECDH key agreement, including anonymous cipher suites.
private static final String	kFZA Ciphers suites using FORTEZZA key exchange algorithms.
private static final String	kGOST Cipher suites using using VKO 34.10 key exchange, specified in the RFC 4357.
private static final String	kPSK Cipher suites using PSK key 'exchange'.
private static final String	KRB5 Cipher suites using KRB5.
private static final String	kRSA Cipher suites using RSA key exchange.
private static final String	kRSAPSK
private static final String	kSRP Cipher suites using SRP key exchange, specified in the RFC 5054.
private static final Log	log
private static final String	LOW 'low' encryption cipher suites, currently those using 64 or 56 bit encryption algorithms but excluding export cipher suites.
private static final String	MD5 Cipher suites using MD5.
private static final String	MEDIUM 'medium' encryption cipher suites, currently some of those using 128 bit encryption.
private static final String	PSK Cipher suites using pre-shared keys (PSK).
private static final String	RC2 Cipher suites using RC2.
private static final String	RC4 Cipher suites using RC4.
private static final String	RSA Cipher suites using RSA for key exchange Despite what the docs say, RSA is equivalent to kRSA.
private static final String	SEED Cipher suites using SEED.
private static final String	SEPARATOR
private static final String	SHA Cipher suites using SHA1.
private static final String	SHA1 Cipher suites using SHA1.
private static final String	SHA256 Cipher suites using SHA256.
private static final String	SHA384 Cipher suites using SHA384.
private static final StringManager	sm
private static final String	SRP Same as kSRP
private static final String	TO_END If + is used then the ciphers are moved to the end of the list.
private static final String	TRIPLE_DES Cipher suites using triple DES.

Access	Constructor and Description
public	OpenSSLCipherConfigurationParser()

Method Summary

Modifier and Type	Method and Description
pack-priv static void	add(final LinkedHashSet<Cipher> ciphers, final String alias)
pack-priv static void	addListAlias(String alias, Set<Cipher> ciphers)
public static List<String>	convertForJSSE(Collection<Cipher> ciphers)
pack-priv static LinkedHashSet<Cipher>	defaultSort(final LinkedHashSet<Cipher> ciphers)
pack-priv static String	displayResult(Collection<Cipher> ciphers, boolean useJSSEFormat, String separator)
pack-priv static LinkedHashSet<Cipher>	filter(Set<Cipher> ciphers, Set<Protocol> protocol, Set<KeyExchange> kx, Set<Authentication> au, Set<Encryption> enc, Set<EncryptionLevel> level, Set<MessageDigest> mac)
pack-priv static LinkedHashSet<Cipher>	filterByAuthentication(Set<Cipher> ciphers, Set<Authentication> au)
pack-priv static Set<Cipher>	filterByEncryption(Set<Cipher> ciphers, Set<Encryption> enc)
pack-priv static Set<Cipher>	filterByEncryptionLevel(Set<Cipher> ciphers, Set<EncryptionLevel> level)
pack-priv static LinkedHashSet<Cipher>	filterByKeyExchange(Set<Cipher> ciphers, Set<KeyExchange> kx)
pack-priv static Set<Cipher>	filterByMessageDigest(Set<Cipher> ciphers, Set<MessageDigest> mac)
pack-priv static Set<Cipher>	filterByProtocol(Set<Cipher> ciphers, Set<Protocol> protocol)
pack-priv static Set<Cipher>	filterByStrengthBits(Set<Cipher> ciphers, int strength_bits)
private static void	init()
public static String	Returns: The OpenSSL name for the specified JSSE cipher jsseToOpenSSL(String The JSSE name for a cipher jsseCipherName) Converts a JSSE cipher name to an OpenSSL cipher name.
public static void	main(String[] args)
pack-priv static void	moveToEnd(final LinkedHashSet<Cipher> ciphers, final String alias)
pack-priv static void	moveToEnd(final LinkedHashSet<Cipher> ciphers, final Collection<Cipher> toBeMovedCiphers)
pack-priv static void	moveToStart(final LinkedHashSet<Cipher> ciphers, final Collection<Cipher> toBeMovedCiphers)
public static String	Returns: The JSSE name for the specified OpenSSL cipher. If none is known, the IANA standard name will be returned instead openSSLToJsse(String The OpenSSL name for a cipher opensslCipherName) Converts an OpenSSL cipher name to a JSSE cipher name.
public static LinkedHashSet<Cipher>	parse(String expression)
public static List<String>	Returns: the corresponding list of ciphers. parseExpression(String the openssl expression to define a list of cipher. expression) Parse the specified expression according to the OpenSSL syntax and returns a list of standard JSSE cipher names.
pack-priv static void	remove(final Set<Cipher> ciphers, final String alias)
pack-priv static LinkedHashSet<Cipher>	strengthSort(final LinkedHashSet<Cipher> ciphers)
public static void	usage()

Inherited from java.lang.Object:: clone equals finalize getClass hashCode notify notifyAll toString wait wait wait

Field Detail

aDH	back to summary
private static final String aDH Cipher suites effectively using DH authentication, i.e. the certificates carry DH keys.

ADH	back to summary
private static final String ADH Anonymous DH cipher suites.

aDSS	back to summary
private static final String aDSS Cipher suites using DSS authentication, i.e. the certificates carry DSS keys.

AECDH	back to summary
private static final String AECDH Anonymous Elliptic Curve Diffie Hellman cipher suites.

aECDH	back to summary
private static final String aECDH Cipher suites effectively using ECDH authentication, i.e. the certificates carry ECDH keys.

aECDSA	back to summary
private static final String aECDSA Cipher suites effectively using ECDSA authentication, i.e. the certificates carry ECDSA keys.

AES	back to summary
private static final String AES Cipher suites using either 128 or 256 bit AES.

AES128	back to summary
private static final String AES128 Cipher suites using 128 bit AES.

AES256	back to summary
private static final String AES256 Cipher suites using 256 bit AES.

AESCCM	back to summary
private static final String AESCCM AES in Counter with CBC-MAC Mode (CCM).

AESCCM8	back to summary
private static final String AESCCM8 AES in Counter with CBC-MAC Mode and 8-byte authentication (CCM8).

AESGCM	back to summary
private static final String AESGCM AES in Galois Counter Mode (GCM): these cipher suites are only supported in TLS v1.2.

aFZA	back to summary
private static final String aFZA Ciphers suites using FORTEZZA authentication algorithms.

aGOST	back to summary
private static final String aGOST Cipher suites using GOST R 34.10 (either 2001 or 94) for authentication.

aGOST01	back to summary
private static final String aGOST01 Cipher suites using GOST R 34.10-2001 for authentication.

aGOST94	back to summary
private static final String aGOST94 Cipher suites using GOST R 34.10-94 authentication (note that R 34.10-94 standard has been expired so use GOST R 34.10-2001)

aliases	back to summary
private static final Map<String, List<Cipher>> aliases All ciphers by their openssl alias name.

ALL	back to summary
private static final String ALL

AND	back to summary
private static final String AND Lists of cipher suites can be combined in a single cipher string using the + character. This is used as a logical and operation. For example SHA1+DES represents all cipher suites containing the SHA1 and the DES algorithms.

aNULL	back to summary
private static final String aNULL The cipher suites offering no authentication. This is currently the anonymous DH algorithms. T These cipher suites are vulnerable to a 'man in the middle' attack and so their use is normally discouraged.

aPSK	back to summary
private static final String aPSK Cipher suites using PSK authentication.

ARIA	back to summary
private static final String ARIA Cipher suites using either 128 or 256 bit ARIA.

ARIA128	back to summary
private static final String ARIA128 Cipher suites using either 128 bit ARIA.

ARIA256	back to summary
private static final String ARIA256 Cipher suites using either 256 bit ARIA.

aRSA	back to summary
private static final String aRSA Cipher suites using RSA authentication.

aSRP	back to summary
private static final String aSRP Cipher suites using SRP authentication, specified in the RFC 5054.

CAMELLIA	back to summary
private static final String CAMELLIA Cipher suites using either 128 or 256 bit CAMELLIA.

CAMELLIA128	back to summary
private static final String CAMELLIA128 Cipher suites using 128 bit CAMELLIA.

CAMELLIA256	back to summary
private static final String CAMELLIA256 Cipher suites using 256 bit CAMELLIA.

CHACHA20	back to summary
private static final String CHACHA20 Cipher suites using CHACHA20.

COMPLEMENTOFALL	back to summary
private static final String COMPLEMENTOFALL

COMPLEMENTOFDEFAULT	back to summary
private static final String COMPLEMENTOFDEFAULT

DEFAULT	back to summary
private static final String DEFAULT

DELETE	back to summary
private static final String DELETE If - is used then the ciphers are deleted from the list, but some or all of the ciphers can be added again by later options.

DES	back to summary
private static final String DES Cipher suites using DES (not triple DES).

DH	back to summary
private static final String DH Cipher suites using DH, including anonymous DH, ephemeral DH and fixed DH.

DHE	back to summary
private static final String DHE Cipher suites using ephemeral DH key agreement. equivalent to kEDH:-ADH

DSS	back to summary
private static final String DSS Cipher suites using DSS for key exchange

ECDH	back to summary
private static final String ECDH Cipher suitesusing ECDH key exchange, including anonymous, ephemeral and fixed ECDH.

ECDHE	back to summary
private static final String ECDHE Cipher suites using authenticated ephemeral ECDH key agreement

ECDSA	back to summary
private static final String ECDSA Cipher suites effectively using ECDSA authentication, i.e. the certificates carry ECDSA keys.

EDH	back to summary
private static final String EDH Cipher suites using ephemeral DH key agreement. equivalent to kEDH:-ADH

EECDH	back to summary
private static final String EECDH Cipher suites using ephemeral ECDH key agreement, excluding anonymous cipher suites. Same as "kEECDH:-AECDH"

eFZA	back to summary
private static final String eFZA Ciphers suites using FORTEZZA encryption algorithms.

eNULL	back to summary
private static final String eNULL the 'NULL' ciphers that is those offering no encryption. Because these offer no encryption at all and are a security risk they are disabled unless explicitly included.

EXCLUDE	back to summary
private static final String EXCLUDE If ! is used then the ciphers are permanently deleted from the list. The ciphers deleted can never reappear in the list even if they are explicitly stated.

EXPORT	back to summary
private static final String EXPORT Export encryption algorithms. Including 40 and 56 bits algorithms.

EXPORT40	back to summary
private static final String EXPORT40 40 bit export encryption algorithms.

EXPORT56	back to summary
private static final String EXPORT56 56 bit export encryption algorithms.

FZA	back to summary
private static final String FZA Ciphers suites using all FORTEZZA algorithms.

GOST89MAC	back to summary
private static final String GOST89MAC Cipher suites using GOST 28147-89 MAC instead of HMAC.

GOST94	back to summary
private static final String GOST94 Cipher suites, using HMAC based on GOST R 34.11-94.

HIGH	back to summary
private static final String HIGH 'high' encryption cipher suites. This currently means those with key lengths larger than 128 bits, and some cipher suites with 128-bit keys.

IDEA	back to summary
private static final String IDEA Cipher suites using IDEA.

initialized	back to summary
private static boolean initialized

jsseToOpenSSL	back to summary
private static final Map<String, String> jsseToOpenSSL

kDH	back to summary
private static final String kDH Cipher suites using DH key agreement and DH certificates signed by CAs with RSA or DSS keys.

kDHd	back to summary
private static final String kDHd Cipher suites using DH key agreement and DH certificates signed by CAs with DSS keys.

kDHE	back to summary
private static final String kDHE Cipher suites using ephemeral DH key agreement.

kDHEPSK	back to summary
private static final String kDHEPSK

kDHr	back to summary
private static final String kDHr Cipher suites using DH key agreement and DH certificates signed by CAs with RSA keys.

kECDH	back to summary
private static final String kECDH Cipher suites using fixed ECDH key agreement signed by CAs with RSA and ECDSA keys or either respectively.

kECDHe	back to summary
private static final String kECDHe Cipher suites using fixed ECDH key agreement signed by CAs with ECDSA keys.

kECDHE	back to summary
private static final String kECDHE Cipher suites using ephemeral ECDH key agreement, including anonymous cipher suites.

kECDHEPSK	back to summary
private static final String kECDHEPSK

kECDHr	back to summary
private static final String kECDHr Cipher suites using fixed ECDH key agreement signed by CAs with RSA keys.

kEDH	back to summary
private static final String kEDH Cipher suites using ephemeral DH key agreement.

kEECDH	back to summary
private static final String kEECDH Cipher suites using ephemeral ECDH key agreement, including anonymous cipher suites.

kFZA	back to summary
private static final String kFZA Ciphers suites using FORTEZZA key exchange algorithms.

kGOST	back to summary
private static final String kGOST Cipher suites using using VKO 34.10 key exchange, specified in the RFC 4357.

kPSK	back to summary
private static final String kPSK Cipher suites using PSK key 'exchange'.

KRB5	back to summary
private static final String KRB5 Cipher suites using KRB5.

kRSA	back to summary
private static final String kRSA Cipher suites using RSA key exchange.

kRSAPSK	back to summary
private static final String kRSAPSK

kSRP	back to summary
private static final String kSRP Cipher suites using SRP key exchange, specified in the RFC 5054.

log	back to summary
private static final Log log

LOW	back to summary
private static final String LOW 'low' encryption cipher suites, currently those using 64 or 56 bit encryption algorithms but excluding export cipher suites.

MD5	back to summary
private static final String MD5 Cipher suites using MD5.

MEDIUM	back to summary
private static final String MEDIUM 'medium' encryption cipher suites, currently some of those using 128 bit encryption.

PSK	back to summary
private static final String PSK Cipher suites using pre-shared keys (PSK).

RC2	back to summary
private static final String RC2 Cipher suites using RC2.

RC4	back to summary
private static final String RC4 Cipher suites using RC4.

RSA	back to summary
private static final String RSA Cipher suites using RSA for key exchange Despite what the docs say, RSA is equivalent to kRSA.

SEED	back to summary
private static final String SEED Cipher suites using SEED.

SEPARATOR	back to summary
private static final String SEPARATOR

SHA	back to summary
private static final String SHA Cipher suites using SHA1.

SHA1	back to summary
private static final String SHA1 Cipher suites using SHA1.

SHA256	back to summary
private static final String SHA256 Cipher suites using SHA256.

SHA384	back to summary
private static final String SHA384 Cipher suites using SHA384.

sm	back to summary
private static final StringManager sm

SRP	back to summary
private static final String SRP Same as kSRP

TO_END	back to summary
private static final String TO_END If + is used then the ciphers are moved to the end of the list. This option doesn't add any new ciphers it just moves matching existing ones.

TRIPLE_DES	back to summary
private static final String TRIPLE_DES Cipher suites using triple DES.

Constructor Detail

OpenSSLCipherConfigurationParser	back to summary
public OpenSSLCipherConfigurationParser()

Method Detail

add	back to summary
pack-priv static void add(final LinkedHashSet<Cipher> ciphers, final String alias)

addListAlias	back to summary
pack-priv static void addListAlias(String alias, Set<Cipher> ciphers)

convertForJSSE	back to summary
public static List<String> convertForJSSE(Collection<Cipher> ciphers)

defaultSort	back to summary
pack-priv static LinkedHashSet<Cipher> defaultSort(final LinkedHashSet<Cipher> ciphers)

displayResult	back to summary
pack-priv static String displayResult(Collection<Cipher> ciphers, boolean useJSSEFormat, String separator)

filter	back to summary
pack-priv static LinkedHashSet<Cipher> filter(Set<Cipher> ciphers, Set<Protocol> protocol, Set<KeyExchange> kx, Set<Authentication> au, Set<Encryption> enc, Set<EncryptionLevel> level, Set<MessageDigest> mac)

filterByAuthentication	back to summary
pack-priv static LinkedHashSet<Cipher> filterByAuthentication(Set<Cipher> ciphers, Set<Authentication> au)

filterByEncryption	back to summary
pack-priv static Set<Cipher> filterByEncryption(Set<Cipher> ciphers, Set<Encryption> enc)

filterByEncryptionLevel	back to summary
pack-priv static Set<Cipher> filterByEncryptionLevel(Set<Cipher> ciphers, Set<EncryptionLevel> level)

filterByKeyExchange	back to summary
pack-priv static LinkedHashSet<Cipher> filterByKeyExchange(Set<Cipher> ciphers, Set<KeyExchange> kx)

filterByMessageDigest	back to summary
pack-priv static Set<Cipher> filterByMessageDigest(Set<Cipher> ciphers, Set<MessageDigest> mac)

filterByProtocol	back to summary
pack-priv static Set<Cipher> filterByProtocol(Set<Cipher> ciphers, Set<Protocol> protocol)

filterByStrengthBits	back to summary
pack-priv static Set<Cipher> filterByStrengthBits(Set<Cipher> ciphers, int strength_bits)

init	back to summary
private static void init()

jsseToOpenSSL

back to summary

public static String jsseToOpenSSL(String jsseCipherName)

Converts a JSSE cipher name to an OpenSSL cipher name.

Parameters

jsseCipherName:String: The JSSE name for a cipher

Returns:String

The OpenSSL name for the specified JSSE cipher

main	back to summary
public static void main(String[] args) throws Exception

moveToEnd	back to summary
pack-priv static void moveToEnd(final LinkedHashSet<Cipher> ciphers, final String alias)

moveToEnd	back to summary
pack-priv static void moveToEnd(final LinkedHashSet<Cipher> ciphers, final Collection<Cipher> toBeMovedCiphers)

moveToStart	back to summary
pack-priv static void moveToStart(final LinkedHashSet<Cipher> ciphers, final Collection<Cipher> toBeMovedCiphers)

openSSLToJsse

back to summary

public static String openSSLToJsse(String opensslCipherName)

Converts an OpenSSL cipher name to a JSSE cipher name.

Parameters

opensslCipherName:String: The OpenSSL name for a cipher

Returns:String

The JSSE name for the specified OpenSSL cipher. If none is known, the IANA standard name will be returned instead

parse	back to summary
public static LinkedHashSet<Cipher> parse(String expression)

parseExpression

back to summary

public static List<String> parseExpression(String expression)

Parse the specified expression according to the OpenSSL syntax and returns a list of standard JSSE cipher names.

Parameters

expression:String: the openssl expression to define a list of cipher.

Returns:List<String>

the corresponding list of ciphers.

remove	back to summary
pack-priv static void remove(final Set<Cipher> ciphers, final String alias)

strengthSort	back to summary
pack-priv static LinkedHashSet<Cipher> strengthSort(final LinkedHashSet<Cipher> ciphers)

usage	back to summary
public static void usage()

public Class OpenSSLCipherConfigurationParser

Field Summary

Constructor Summary

Method Summary

Field Detail

Constructor Detail

Method Detail