Top Description Fields Constructors Methods
org.bouncycastle.tls

public abstract Class AbstractTlsPeer

extends Object
implements TlsPeer
Class Inheritance
All Implemented Interfaces
org.bouncycastle.tls.TlsPeer
Known Direct Subclasses
org.bouncycastle.tls.AbstractTlsServer, org.bouncycastle.tls.AbstractTlsClient
Imports
java.io.IOException, org.bouncycastle.tls.crypto.TlsCrypto
Base class for a TLS client or server.

Field Summary

Modifier and TypeField and Description
private volatile TlsCloseable
closeHandle

private final TlsCrypto
crypto

Constructor Summary

AccessConstructor and Description
protected
AbstractTlsPeer(TlsCrypto crypto)

Method Summary

Modifier and TypeMethod and Description
public boolean
allowLegacyResumption()

Implements org.bouncycastle.tls.TlsPeer.allowLegacyResumption.

public void
cancel()

Implements org.bouncycastle.tls.TlsPeer.cancel.

public TlsCrypto
getCrypto()

Implements org.bouncycastle.tls.TlsPeer.getCrypto.

public int
getHandshakeResendTimeMillis()

Implements org.bouncycastle.tls.TlsPeer.getHandshakeResendTimeMillis.

Specify the time, in milliseconds, after which a handshake packet is resent.

public int
getHandshakeTimeoutMillis()

Implements org.bouncycastle.tls.TlsPeer.getHandshakeTimeoutMillis.

Specify the timeout, in milliseconds, to use for the complete handshake process.

public TlsHeartbeat
getHeartbeat()

Implements org.bouncycastle.tls.TlsPeer.getHeartbeat.

Return a TlsHeartbeat instance that will control the generation of heartbeats locally (if permitted by the remote peer), or null to not generate heartbeats.

public short
getHeartbeatPolicy()

Implements org.bouncycastle.tls.TlsPeer.getHeartbeatPolicy.

Return the heartbeat mode applicable to the remote peer.

public TlsKeyExchangeFactory
getKeyExchangeFactory()

Implements org.bouncycastle.tls.TlsPeer.getKeyExchangeFactory.

public int
getMaxCertificateChainLength()

Implements org.bouncycastle.tls.TlsPeer.getMaxCertificateChainLength.

public int
getMaxHandshakeMessageSize()

Implements org.bouncycastle.tls.TlsPeer.getMaxHandshakeMessageSize.

public short[]
getPskKeyExchangeModes()

Implements org.bouncycastle.tls.TlsPeer.getPskKeyExchangeModes.

public int
getRenegotiationPolicy()

Implements org.bouncycastle.tls.TlsPeer.getRenegotiationPolicy.

Warning

EXPERIMENTAL FEATURE Return this peer's policy on renegotiation requests from the remote peer.

protected abstract int[]
getSupportedCipherSuites()

protected ProtocolVersion[]

Returns:

an array of supported ProtocolVersion values.
getSupportedVersions()

Get the ProtocolVersion values that are supported by this peer.

public void
notifyAlertRaised(short
AlertLevel
alertLevel, short
AlertDescription
alertDescription, String
A human-readable message explaining what caused this alert. May be null.
message, Throwable
The Throwable that caused this alert to be raised. May be null.
cause)

Implements org.bouncycastle.tls.TlsPeer.notifyAlertRaised.

This method will be called when an alert is raised by the protocol.

public void
notifyAlertReceived(short
AlertLevel
alertLevel, short
AlertDescription
alertDescription)

Implements org.bouncycastle.tls.TlsPeer.notifyAlertReceived.

This method will be called when an alert is received from the remote peer.

public void
notifyCloseHandle(TlsCloseable closeHandle)

Implements org.bouncycastle.tls.TlsPeer.notifyCloseHandle.

public void
notifyConnectionClosed()

Implements org.bouncycastle.tls.TlsPeer.notifyConnectionClosed.

Notifies the peer that the connection has been closed.

public void
notifyHandshakeBeginning()

Implements org.bouncycastle.tls.TlsPeer.notifyHandshakeBeginning.

Notifies the peer that a new handshake is about to begin.

public void
notifyHandshakeComplete()

Implements org.bouncycastle.tls.TlsPeer.notifyHandshakeComplete.

Notifies the peer that the handshake has been successfully completed.

public void
notifySecureRenegotiation(boolean secureRenegotiation)

Implements org.bouncycastle.tls.TlsPeer.notifySecureRenegotiation.

RFC 5746 3.4/3.6.

public boolean
requiresCloseNotify()

Implements org.bouncycastle.tls.TlsPeer.requiresCloseNotify.

This option is provided as a last resort for interoperability with TLS peers that fail to correctly send a close_notify alert at end of stream.

public boolean
requiresExtendedMasterSecret()

Implements org.bouncycastle.tls.TlsPeer.requiresExtendedMasterSecret.

This implementation supports RFC 7627 and will always negotiate the extended_master_secret extension where possible.

public boolean
shouldCheckSigAlgOfPeerCerts()

Implements org.bouncycastle.tls.TlsPeer.shouldCheckSigAlgOfPeerCerts.

Controls whether the protocol will check the 'signatureAlgorithm' of received certificates as specified in RFC 5246 7.4.2, 7.4.4, 7.4.6 and similar rules for earlier TLS versions.

public boolean
shouldUseExtendedMasterSecret()

Implements org.bouncycastle.tls.TlsPeer.shouldUseExtendedMasterSecret.

public boolean
shouldUseExtendedPadding()

Implements org.bouncycastle.tls.TlsPeer.shouldUseExtendedPadding.

See RFC 5246 6.2.3.2.

public boolean
shouldUseGMTUnixTime()

Implements org.bouncycastle.tls.TlsPeer.shouldUseGMTUnixTime.

draft-mathewson-no-gmtunixtime-00 2.

Inherited from java.lang.Object:
cloneequalsfinalizegetClasshashCodenotifynotifyAlltoStringwaitwaitwait

Field Detail

closeHandleback to summary
private volatile TlsCloseable closeHandle
cryptoback to summary
private final TlsCrypto crypto

Constructor Detail

AbstractTlsPeerback to summary
protected AbstractTlsPeer(TlsCrypto crypto)

Method Detail

allowLegacyResumptionback to summary
public boolean allowLegacyResumption()

Implements org.bouncycastle.tls.TlsPeer.allowLegacyResumption.

cancelback to summary
public void cancel() throws IOException

Implements org.bouncycastle.tls.TlsPeer.cancel.

getCryptoback to summary
public TlsCrypto getCrypto()

Implements org.bouncycastle.tls.TlsPeer.getCrypto.

getHandshakeResendTimeMillisback to summary
public int getHandshakeResendTimeMillis()

Implements org.bouncycastle.tls.TlsPeer.getHandshakeResendTimeMillis.

Doc from org.bouncycastle.tls.TlsPeer.getHandshakeResendTimeMillis.

Note

Currently only respected by DTLS protocols.

Specify the time, in milliseconds, after which a handshake packet is resent.

Returns:int

the handshake resend time, in milliseconds.

getHandshakeTimeoutMillisback to summary
public int getHandshakeTimeoutMillis()

Implements org.bouncycastle.tls.TlsPeer.getHandshakeTimeoutMillis.

Doc from org.bouncycastle.tls.TlsPeer.getHandshakeTimeoutMillis.

Note

Currently only respected by DTLS protocols.

Specify the timeout, in milliseconds, to use for the complete handshake process. Negative values are not allowed. A timeout of zero means an infinite timeout (i.e. the handshake will never time out).

Returns:int

the handshake timeout, in milliseconds.

getHeartbeatback to summary
public TlsHeartbeat getHeartbeat()

Implements org.bouncycastle.tls.TlsPeer.getHeartbeat.

Doc from org.bouncycastle.tls.TlsPeer.getHeartbeat.

Return a TlsHeartbeat instance that will control the generation of heartbeats locally (if permitted by the remote peer), or null to not generate heartbeats. Heartbeats are described in RFC 6520.

Returns:TlsHeartbeat

an instance of TlsHeartbeat.

getHeartbeatPolicyback to summary
public short getHeartbeatPolicy()

Implements org.bouncycastle.tls.TlsPeer.getHeartbeatPolicy.

Doc from org.bouncycastle.tls.TlsPeer.getHeartbeatPolicy.

Return the heartbeat mode applicable to the remote peer. Heartbeats are described in RFC 6520.

See enumeration class HeartbeatMode for appropriate return values.

Returns:short

the HeartbeatMode value.

getKeyExchangeFactoryback to summary
public TlsKeyExchangeFactory getKeyExchangeFactory() throws IOException

Implements org.bouncycastle.tls.TlsPeer.getKeyExchangeFactory.

getMaxCertificateChainLengthback to summary
public int getMaxCertificateChainLength()

Implements org.bouncycastle.tls.TlsPeer.getMaxCertificateChainLength.

getMaxHandshakeMessageSizeback to summary
public int getMaxHandshakeMessageSize()

Implements org.bouncycastle.tls.TlsPeer.getMaxHandshakeMessageSize.

getPskKeyExchangeModesback to summary
public short[] getPskKeyExchangeModes()

Implements org.bouncycastle.tls.TlsPeer.getPskKeyExchangeModes.

getRenegotiationPolicyback to summary
public int getRenegotiationPolicy()

Implements org.bouncycastle.tls.TlsPeer.getRenegotiationPolicy.

Doc from org.bouncycastle.tls.TlsPeer.getRenegotiationPolicy.

Warning

EXPERIMENTAL FEATURE Return this peer's policy on renegotiation requests from the remote peer. This will be called only outside of ongoing handshakes, either when a remote server has sent a hello_request, or a remote client has sent a new ClientHello, and only when the requirements for secure renegotiation (including those of RFC 5746) have been met.

Returns:int

The RenegotiationPolicy constant corresponding to the desired policy.

getSupportedCipherSuitesback to summary
protected abstract int[] getSupportedCipherSuites()
getSupportedVersionsback to summary
protected ProtocolVersion[] getSupportedVersions()

Get the ProtocolVersion values that are supported by this peer.

Warning

Mixing DTLS and TLS versions in the returned array is currently NOT supported. Use a separate (sub-)class for each case.

Returns:ProtocolVersion[]

an array of supported ProtocolVersion values.

notifyAlertRaisedback to summary
public void notifyAlertRaised(short alertLevel, short alertDescription, String message, Throwable cause)

Implements org.bouncycastle.tls.TlsPeer.notifyAlertRaised.

Doc from org.bouncycastle.tls.TlsPeer.notifyAlertRaised.

This method will be called when an alert is raised by the protocol.

Parameters
alertLevel:short

AlertLevel

alertDescription:short

AlertDescription

message:String

A human-readable message explaining what caused this alert. May be null.

cause:Throwable

The Throwable that caused this alert to be raised. May be null.

notifyAlertReceivedback to summary
public void notifyAlertReceived(short alertLevel, short alertDescription)

Implements org.bouncycastle.tls.TlsPeer.notifyAlertReceived.

Doc from org.bouncycastle.tls.TlsPeer.notifyAlertReceived.

This method will be called when an alert is received from the remote peer.

Parameters
alertLevel:short

AlertLevel

alertDescription:short

AlertDescription

notifyCloseHandleback to summary
public void notifyCloseHandle(TlsCloseable closeHandle)

Implements org.bouncycastle.tls.TlsPeer.notifyCloseHandle.

notifyConnectionClosedback to summary
public void notifyConnectionClosed()

Implements org.bouncycastle.tls.TlsPeer.notifyConnectionClosed.

Doc from org.bouncycastle.tls.TlsPeer.notifyConnectionClosed.

Notifies the peer that the connection has been closed.

notifyHandshakeBeginningback to summary
public void notifyHandshakeBeginning() throws IOException

Implements org.bouncycastle.tls.TlsPeer.notifyHandshakeBeginning.

Doc from org.bouncycastle.tls.TlsPeer.notifyHandshakeBeginning.

Notifies the peer that a new handshake is about to begin.

notifyHandshakeCompleteback to summary
public void notifyHandshakeComplete() throws IOException

Implements org.bouncycastle.tls.TlsPeer.notifyHandshakeComplete.

Doc from org.bouncycastle.tls.TlsPeer.notifyHandshakeComplete.

Notifies the peer that the handshake has been successfully completed.

notifySecureRenegotiationback to summary
public void notifySecureRenegotiation(boolean secureRenegotiation) throws IOException

Implements org.bouncycastle.tls.TlsPeer.notifySecureRenegotiation.

Doc from org.bouncycastle.tls.TlsPeer.notifySecureRenegotiation.

RFC 5746 3.4/3.6. In case this is false, peers may want to terminate the handshake instead of continuing; see Section 4.1/4.3 for discussion.

Note

TLS 1.3 forbids renegotiation, so this is never called when TLS 1.3 (or later) was negotiated.

requiresCloseNotifyback to summary
public boolean requiresCloseNotify()

Implements org.bouncycastle.tls.TlsPeer.requiresCloseNotify.

Doc from org.bouncycastle.tls.TlsPeer.requiresCloseNotify.

This option is provided as a last resort for interoperability with TLS peers that fail to correctly send a close_notify alert at end of stream. Implementations SHOULD return true; caution is advised if returning false without a full understanding of the implications.

requiresExtendedMasterSecretback to summary
public boolean requiresExtendedMasterSecret()

Implements org.bouncycastle.tls.TlsPeer.requiresExtendedMasterSecret.

Doc from org.bouncycastle.tls.TlsPeer.requiresExtendedMasterSecret.

This implementation supports RFC 7627 and will always negotiate the extended_master_secret extension where possible. When connecting to a peer that does not offer/accept this extension, it is recommended to abort the handshake. This option is provided for interoperability with legacy peers, although some TLS features will be disabled in that case (see RFC 7627 5.4).

Returns:boolean

true if the handshake should be aborted when the peer does not negotiate the extended_master_secret extension, or false to support legacy interoperability.

shouldCheckSigAlgOfPeerCertsback to summary
public boolean shouldCheckSigAlgOfPeerCerts()

Implements org.bouncycastle.tls.TlsPeer.shouldCheckSigAlgOfPeerCerts.

Doc from org.bouncycastle.tls.TlsPeer.shouldCheckSigAlgOfPeerCerts.

Controls whether the protocol will check the 'signatureAlgorithm' of received certificates as specified in RFC 5246 7.4.2, 7.4.4, 7.4.6 and similar rules for earlier TLS versions. We recommend to enable these checks, but this option is provided for cases where the default checks are for some reason too strict.

Returns:boolean

true if the 'signatureAlgorithm' of received certificates should be checked, or false to skip those checks.

shouldUseExtendedMasterSecretback to summary
public boolean shouldUseExtendedMasterSecret()

Implements org.bouncycastle.tls.TlsPeer.shouldUseExtendedMasterSecret.

shouldUseExtendedPaddingback to summary
public boolean shouldUseExtendedPadding()

Implements org.bouncycastle.tls.TlsPeer.shouldUseExtendedPadding.

Doc from org.bouncycastle.tls.TlsPeer.shouldUseExtendedPadding.

See RFC 5246 6.2.3.2. Controls whether block cipher encryption may randomly add extra padding beyond the minimum. Note that in configurations where this is known to be potential security risk this setting will be ignored (and extended padding disabled). Extra padding is always supported when decrypting received records.

Returns:boolean

true if random extra padding should be added during block cipher encryption, or false to always use the minimum amount of required padding.

shouldUseGMTUnixTimeback to summary
public boolean shouldUseGMTUnixTime()

Implements org.bouncycastle.tls.TlsPeer.shouldUseGMTUnixTime.

Doc from org.bouncycastle.tls.TlsPeer.shouldUseGMTUnixTime.

draft-mathewson-no-gmtunixtime-00 2. "If existing users of a TLS implementation may rely on gmt_unix_time containing the current time, we recommend that implementors MAY provide the ability to set gmt_unix_time as an option only, off by default."

Note

For a server that has negotiated TLS 1.3 (or later), or a client that has offered TLS 1.3 (or later), this is not called and gmt_unix_time is not used.

Returns:boolean

true if the current time should be used in the gmt_unix_time field of Random, or false if gmt_unix_time should contain a cryptographically random value.