Top Description Fields Constructors Methods
org.bouncycastle.tls

public abstract Class AbstractTlsClient

extends AbstractTlsPeer
implements TlsClient
Class Inheritance
All Implemented Interfaces
org.bouncycastle.tls.TlsClient, org.bouncycastle.tls.TlsPeer
Known Direct Subclasses
org.bouncycastle.tls.PSKTlsClient, org.bouncycastle.tls.SRPTlsClient, org.bouncycastle.tls.DefaultTlsClient
Imports
java.io.IOException, java.util.Hashtable, .Vector, org.bouncycastle.tls.crypto.TlsCrypto, org.bouncycastle.util.Integers
Base class for a TLS client.

Field Summary

Modifier and TypeField and Description
protected int[]
cipherSuites

protected TlsClientContext
context

protected ProtocolVersion[]
protocolVersions

protected Vector<E>
supportedGroups

protected Vector<E>
supportedSignatureAlgorithms

protected Vector<E>
supportedSignatureAlgorithmsCert

Constructor Summary

AccessConstructor and Description
public
AbstractTlsClient(TlsCrypto crypto)

Method Summary

Modifier and TypeMethod and Description
protected boolean
allowUnexpectedServerExtension(Integer extensionType, byte[] extensionData)

protected void
checkForUnexpectedServerExtension(Hashtable<K, V> serverExtensions, Integer extensionType)

protected short[]
getAllowedClientCertificateTypes()

protected short[]
getAllowedServerCertificateTypes()

protected Vector<E>
getCertificateAuthorities()

protected CertificateStatusRequest
getCertificateStatusRequest()

public int[]
getCipherSuites()

Implements org.bouncycastle.tls.TlsPeer.getCipherSuites.

public Hashtable<K, V>
getClientExtensions()

Implements org.bouncycastle.tls.TlsClient.getClientExtensions.

public Vector<E>
getClientSupplementalData()

Implements org.bouncycastle.tls.TlsClient.getClientSupplementalData.

public TlsDHGroupVerifier
getDHGroupVerifier()

Implements org.bouncycastle.tls.TlsClient.getDHGroupVerifier.

public Vector<E>
getEarlyKeyShareGroups()

Implements org.bouncycastle.tls.TlsClient.getEarlyKeyShareGroups.

If this client is offering TLS 1.3 or higher, this method may be called to determine for which groups a key share should be included in the initial ClientHello.

public Vector<E>
getExternalPSKs()

Implements org.bouncycastle.tls.TlsClient.getExternalPSKs.

Return the external PSKs to offer in the ClientHello.

protected Vector<E>

Returns:

a Vector of CertificateStatusRequestItemV2 (or null).
getMultiCertStatusRequest()

protected Vector<E>
getNamedGroupRoles()

protected byte[]

Returns:

The connection ID to use.
getNewConnectionID()

RFC 9146 DTLS connection ID.

The default getClientExtensions() implementation calls this to get the connection_id extension the client will send.

protected Vector<E>
getProtocolNames()

public ProtocolVersion[]
getProtocolVersions()

Implements org.bouncycastle.tls.TlsPeer.getProtocolVersions.

public TlsPSKIdentity
getPSKIdentity()

Implements org.bouncycastle.tls.TlsClient.getPSKIdentity.

public TlsSession
getSessionToResume()

Implements org.bouncycastle.tls.TlsClient.getSessionToResume.

Return the session this client wants to resume, if any.

protected Vector<E>
getSNIServerNames()

public TlsSRPConfigVerifier
getSRPConfigVerifier()

Implements org.bouncycastle.tls.TlsClient.getSRPConfigVerifier.

public TlsSRPIdentity
getSRPIdentity()

Implements org.bouncycastle.tls.TlsClient.getSRPIdentity.

protected Vector<E>

Returns:

a Vector of Integer. See NamedGroup for group constants.
getSupportedGroups(Vector<E>
The named group roles for which there should be at least one supported group. By default this is inferred from the offered cipher suites and signature algorithms.
namedGroupRoles)

The default getClientExtensions() implementation calls this to determine which named groups to include in the supported_groups extension for the ClientHello.

protected Vector<E>
getSupportedSignatureAlgorithms()

protected Vector<E>
getSupportedSignatureAlgorithmsCert()

protected Vector<E>
getTrustedCAIndication()

public void
init(TlsClientContext context)

Implements org.bouncycastle.tls.TlsClient.init.

public boolean
isFallback()

Implements org.bouncycastle.tls.TlsClient.isFallback.

public void
notifyHandshakeBeginning()

Overrides org.bouncycastle.tls.AbstractTlsPeer.notifyHandshakeBeginning.

Implements org.bouncycastle.tls.TlsPeer.notifyHandshakeBeginning.

Notifies the peer that a new handshake is about to begin.

public void
notifyNewSessionTicket(NewSessionTicket
The ticket.
newSessionTicket)

Implements org.bouncycastle.tls.TlsClient.notifyNewSessionTicket.

RFC 5077 3.3.

public void
notifySelectedCipherSuite(int selectedCipherSuite)

Implements org.bouncycastle.tls.TlsClient.notifySelectedCipherSuite.

public void
notifySelectedPSK(TlsPSK selectedPSK)

Implements org.bouncycastle.tls.TlsClient.notifySelectedPSK.

public void
notifyServerVersion(ProtocolVersion serverVersion)

Implements org.bouncycastle.tls.TlsClient.notifyServerVersion.

public void
notifySessionID(byte[] sessionID)

Implements org.bouncycastle.tls.TlsClient.notifySessionID.

Notifies the client of the session_id sent in the ServerHello.

public void
notifySessionToResume(TlsSession
The TlsSession representing the resumable session to be offered for this connection, or null if there is none.
session)

Implements org.bouncycastle.tls.TlsClient.notifySessionToResume.

Notifies the client of the session that will be offered in ClientHello for resumption, if any.

public void
processServerExtensions(Hashtable<K, V>
(Integer -> byte[])
serverExtensions)

Implements org.bouncycastle.tls.TlsClient.processServerExtensions.

The TlsClientProtocol implementation validates that any server extensions received correspond to client extensions sent.

public void
processServerSupplementalData(Vector<E> serverSupplementalData)

Implements org.bouncycastle.tls.TlsClient.processServerSupplementalData.

public boolean
shouldUseCompatibilityMode()

Implements org.bouncycastle.tls.TlsClient.shouldUseCompatibilityMode.

Inherited from org.bouncycastle.tls.AbstractTlsPeer:
allowLegacyResumptioncancelgetCryptogetHandshakeResendTimeMillisgetHandshakeTimeoutMillisgetHeartbeatgetHeartbeatPolicygetKeyExchangeFactorygetMaxCertificateChainLengthgetMaxHandshakeMessageSizegetPskKeyExchangeModesgetRenegotiationPolicygetSupportedCipherSuitesgetSupportedVersionsnotifyAlertRaisednotifyAlertReceivednotifyCloseHandlenotifyConnectionClosednotifyHandshakeCompletenotifySecureRenegotiationrequiresCloseNotifyrequiresExtendedMasterSecretshouldCheckSigAlgOfPeerCertsshouldUseExtendedMasterSecretshouldUseExtendedPaddingshouldUseGMTUnixTime

Field Detail

cipherSuitesback to summary
protected int[] cipherSuites
contextback to summary
protected TlsClientContext context
protocolVersionsback to summary
protected ProtocolVersion[] protocolVersions
supportedGroupsback to summary
protected Vector<E> supportedGroups
supportedSignatureAlgorithmsback to summary
protected Vector<E> supportedSignatureAlgorithms
supportedSignatureAlgorithmsCertback to summary
protected Vector<E> supportedSignatureAlgorithmsCert

Constructor Detail

AbstractTlsClientback to summary
public AbstractTlsClient(TlsCrypto crypto)

Method Detail

allowUnexpectedServerExtensionback to summary
protected boolean allowUnexpectedServerExtension(Integer extensionType, byte[] extensionData) throws IOException
checkForUnexpectedServerExtensionback to summary
protected void checkForUnexpectedServerExtension(Hashtable<K, V> serverExtensions, Integer extensionType) throws IOException
getAllowedClientCertificateTypesback to summary
protected short[] getAllowedClientCertificateTypes()
getAllowedServerCertificateTypesback to summary
protected short[] getAllowedServerCertificateTypes()
getCertificateAuthoritiesback to summary
protected Vector<E> getCertificateAuthorities()
getCertificateStatusRequestback to summary
protected CertificateStatusRequest getCertificateStatusRequest()
getCipherSuitesback to summary
public int[] getCipherSuites()

Implements org.bouncycastle.tls.TlsPeer.getCipherSuites.

getClientExtensionsback to summary
public Hashtable<K, V> getClientExtensions() throws IOException

Implements org.bouncycastle.tls.TlsClient.getClientExtensions.

getClientSupplementalDataback to summary
public Vector<E> getClientSupplementalData() throws IOException

Implements org.bouncycastle.tls.TlsClient.getClientSupplementalData.

getDHGroupVerifierback to summary
public TlsDHGroupVerifier getDHGroupVerifier()

Implements org.bouncycastle.tls.TlsClient.getDHGroupVerifier.

getEarlyKeyShareGroupsback to summary
public Vector<E> getEarlyKeyShareGroups()

Implements org.bouncycastle.tls.TlsClient.getEarlyKeyShareGroups.

Doc from org.bouncycastle.tls.TlsClient.getEarlyKeyShareGroups.

If this client is offering TLS 1.3 or higher, this method may be called to determine for which groups a key share should be included in the initial ClientHello. Groups that were not included in the supported_groups extension (by getClientExtensions() will be ignored. The protocol will then add a suitable key_share extension to the ClientHello extensions.

Returns:Vector<E>

a Vector of named group values, possibly empty or null.

getExternalPSKsback to summary
public Vector<E> getExternalPSKs()

Implements org.bouncycastle.tls.TlsClient.getExternalPSKs.

Doc from org.bouncycastle.tls.TlsClient.getExternalPSKs.

Return the external PSKs to offer in the ClientHello. Note that this will only be called when TLS 1.3 or higher is amongst the offered protocol versions.

Returns:Vector<E>

a Vector of TlsPSKExternal instances, or null if none should be offered.

getMultiCertStatusRequestback to summary
protected Vector<E> getMultiCertStatusRequest()
Returns:Vector<E>

a Vector of CertificateStatusRequestItemV2 (or null).

getNamedGroupRolesback to summary
protected Vector<E> getNamedGroupRoles()
getNewConnectionIDback to summary
protected byte[] getNewConnectionID()

RFC 9146 DTLS connection ID.

The default getClientExtensions() implementation calls this to get the connection_id extension the client will send. As future communication doesn't include the connection IDs length, this should either be fixed-length or include the connection ID's length. (see explanation in RFC 9146 4. "cid:")

Returns:byte[]

The connection ID to use.

getProtocolNamesback to summary
protected Vector<E> getProtocolNames()
getProtocolVersionsback to summary
public ProtocolVersion[] getProtocolVersions()

Implements org.bouncycastle.tls.TlsPeer.getProtocolVersions.

getPSKIdentityback to summary
public TlsPSKIdentity getPSKIdentity() throws IOException

Implements org.bouncycastle.tls.TlsClient.getPSKIdentity.

getSessionToResumeback to summary
public TlsSession getSessionToResume()

Implements org.bouncycastle.tls.TlsClient.getSessionToResume.

Doc from org.bouncycastle.tls.TlsClient.getSessionToResume.

Return the session this client wants to resume, if any. Note that the peer's certificate chain for the session (if any) may need to be periodically revalidated.

Returns:TlsSession

A TlsSession representing the resumable session to be used for this connection, or null to use a new session.

getSNIServerNamesback to summary
protected Vector<E> getSNIServerNames()
getSRPConfigVerifierback to summary
public TlsSRPConfigVerifier getSRPConfigVerifier()

Implements org.bouncycastle.tls.TlsClient.getSRPConfigVerifier.

getSRPIdentityback to summary
public TlsSRPIdentity getSRPIdentity() throws IOException

Implements org.bouncycastle.tls.TlsClient.getSRPIdentity.

getSupportedGroupsback to summary
protected Vector<E> getSupportedGroups(Vector<E> namedGroupRoles)

The default getClientExtensions() implementation calls this to determine which named groups to include in the supported_groups extension for the ClientHello.

Parameters
namedGroupRoles:Vector<E>

The named group roles for which there should be at least one supported group. By default this is inferred from the offered cipher suites and signature algorithms.

Returns:Vector<E>

a Vector of Integer. See NamedGroup for group constants.

getSupportedSignatureAlgorithmsback to summary
protected Vector<E> getSupportedSignatureAlgorithms()
getSupportedSignatureAlgorithmsCertback to summary
protected Vector<E> getSupportedSignatureAlgorithmsCert()
getTrustedCAIndicationback to summary
protected Vector<E> getTrustedCAIndication()
initback to summary
public void init(TlsClientContext context)

Implements org.bouncycastle.tls.TlsClient.init.

isFallbackback to summary
public boolean isFallback()

Implements org.bouncycastle.tls.TlsClient.isFallback.

notifyHandshakeBeginningback to summary
public void notifyHandshakeBeginning() throws IOException

Overrides org.bouncycastle.tls.AbstractTlsPeer.notifyHandshakeBeginning.

Implements org.bouncycastle.tls.TlsPeer.notifyHandshakeBeginning.

Doc from org.bouncycastle.tls.TlsPeer.notifyHandshakeBeginning.

Notifies the peer that a new handshake is about to begin.

notifyNewSessionTicketback to summary
public void notifyNewSessionTicket(NewSessionTicket newSessionTicket) throws IOException

Implements org.bouncycastle.tls.TlsClient.notifyNewSessionTicket.

Doc from org.bouncycastle.tls.TlsClient.notifyNewSessionTicket.

RFC 5077 3.3. NewSessionTicket Handshake Message

This method will be called (only) when a NewSessionTicket handshake message is received. The ticket is opaque to the client and clients MUST NOT examine the ticket under the assumption that it complies with e.g. RFC 5077 4. Recommended Ticket Construction.

Parameters
newSessionTicket:NewSessionTicket

The ticket.

notifySelectedCipherSuiteback to summary
public void notifySelectedCipherSuite(int selectedCipherSuite)

Implements org.bouncycastle.tls.TlsClient.notifySelectedCipherSuite.

notifySelectedPSKback to summary
public void notifySelectedPSK(TlsPSK selectedPSK) throws IOException

Implements org.bouncycastle.tls.TlsClient.notifySelectedPSK.

notifyServerVersionback to summary
public void notifyServerVersion(ProtocolVersion serverVersion) throws IOException

Implements org.bouncycastle.tls.TlsClient.notifyServerVersion.

notifySessionIDback to summary
public void notifySessionID(byte[] sessionID)

Implements org.bouncycastle.tls.TlsClient.notifySessionID.

Doc from org.bouncycastle.tls.TlsClient.notifySessionID.

Notifies the client of the session_id sent in the ServerHello.

notifySessionToResumeback to summary
public void notifySessionToResume(TlsSession session)

Implements org.bouncycastle.tls.TlsClient.notifySessionToResume.

Doc from org.bouncycastle.tls.TlsClient.notifySessionToResume.

Notifies the client of the session that will be offered in ClientHello for resumption, if any. This will be either the session returned from getSessionToResume() or null if that session was unusable.

Note

the actual negotiated session_id is notified by notifySessionID(byte[]).

Parameters
session:TlsSession

The TlsSession representing the resumable session to be offered for this connection, or null if there is none.

processServerExtensionsback to summary
public void processServerExtensions(Hashtable<K, V> serverExtensions) throws IOException

Implements org.bouncycastle.tls.TlsClient.processServerExtensions.

Doc from org.bouncycastle.tls.TlsClient.processServerExtensions.

The TlsClientProtocol implementation validates that any server extensions received correspond to client extensions sent. If further processing of the server extensions is needed, it can be done in this callback.

Note

This is not called for session resumption handshakes.

Parameters
serverExtensions:Hashtable<K, V>

(Integer -> byte[])

processServerSupplementalDataback to summary
public void processServerSupplementalData(Vector<E> serverSupplementalData) throws IOException

Implements org.bouncycastle.tls.TlsClient.processServerSupplementalData.

shouldUseCompatibilityModeback to summary
public boolean shouldUseCompatibilityMode()

Implements org.bouncycastle.tls.TlsClient.shouldUseCompatibilityMode.