Bouncy Castle Cryptography Library 1.80 · org.bouncycastle.tls.TlsPeer

Method Summary

Modifier and Type	Method and Description
public boolean	allowLegacyResumption()
public void	cancel()
public int[]	getCipherSuites()
public TlsCrypto	getCrypto()
public int	Returns: the handshake resend time, in milliseconds. getHandshakeResendTimeMillis() Specify the time, in milliseconds, after which a handshake packet is resent.
public int	Returns: the handshake timeout, in milliseconds. getHandshakeTimeoutMillis() Specify the timeout, in milliseconds, to use for the complete handshake process.
public TlsHeartbeat	Returns: an instance of `TlsHeartbeat`. getHeartbeat() Return a `TlsHeartbeat` instance that will control the generation of heartbeats locally (if permitted by the remote peer), or null to not generate heartbeats.
public short	Returns: the `HeartbeatMode` value. getHeartbeatPolicy() Return the heartbeat mode applicable to the remote peer.
public TlsKeyExchangeFactory	getKeyExchangeFactory()
public int	getMaxCertificateChainLength()
public int	getMaxHandshakeMessageSize()
public ProtocolVersion[]	getProtocolVersions()
public short[]	getPskKeyExchangeModes()
public int	Returns: The `RenegotiationPolicy` constant corresponding to the desired policy. getRenegotiationPolicy() Warning EXPERIMENTAL FEATURE Return this peer's policy on renegotiation requests from the remote peer.
public void	notifyAlertRaised(short `AlertLevel` alertLevel, short `AlertDescription` alertDescription, String A human-readable message explaining what caused this alert. May be null. message, Throwable The `Throwable` that caused this alert to be raised. May be null. cause) This method will be called when an alert is raised by the protocol.
public void	notifyAlertReceived(short `AlertLevel` alertLevel, short `AlertDescription` alertDescription) This method will be called when an alert is received from the remote peer.
public void	notifyCloseHandle(TlsCloseable closehandle)
public void	notifyConnectionClosed() Notifies the peer that the connection has been closed.
public void	notifyHandshakeBeginning() Notifies the peer that a new handshake is about to begin.
public void	notifyHandshakeComplete() Notifies the peer that the handshake has been successfully completed.
public void	notifySecureRenegotiation(boolean secureRenegotiation) RFC 5746 3.4/3.6.
public boolean	requiresCloseNotify() This option is provided as a last resort for interoperability with TLS peers that fail to correctly send a close_notify alert at end of stream.
public boolean	Returns: `true` if the handshake should be aborted when the peer does not negotiate the extended_master_secret extension, or `false` to support legacy interoperability. requiresExtendedMasterSecret() This implementation supports RFC 7627 and will always negotiate the extended_master_secret extension where possible.
public boolean	Returns: `true` if the 'signatureAlgorithm' of received certificates should be checked, or `false` to skip those checks. shouldCheckSigAlgOfPeerCerts() Deprecated No longer called by the protocol classes. Controls whether the protocol will check the 'signatureAlgorithm' of received certificates as specified in RFC 5246 7.4.2, 7.4.4, 7.4.6 and similar rules for earlier TLS versions.
public boolean	shouldUseExtendedMasterSecret()
public boolean	Returns: `true` if random extra padding should be added during block cipher encryption, or `false` to always use the minimum amount of required padding. shouldUseExtendedPadding() See RFC 5246 6.2.3.2.
public boolean	Returns: `true` if the current time should be used in the gmt_unix_time field of Random, or `false` if gmt_unix_time should contain a cryptographically random value. shouldUseGMTUnixTime() draft-mathewson-no-gmtunixtime-00 2.

Method Detail

allowLegacyResumption	back to summary
public boolean allowLegacyResumption()

cancel	back to summary
public void cancel() throws IOException

getCipherSuites	back to summary
public int[] getCipherSuites()

getCrypto	back to summary
public TlsCrypto getCrypto()

getHandshakeResendTimeMillis	back to summary
public int getHandshakeResendTimeMillis() Note Currently only respected by DTLS protocols. Specify the time, in milliseconds, after which a handshake packet is resent. Returns:int the handshake resend time, in milliseconds.

getHandshakeResendTimeMillis

back to summary

public int getHandshakeResendTimeMillis()

Note

Currently only respected by DTLS protocols.

Specify the time, in milliseconds, after which a handshake packet is resent.

Returns:int: the handshake resend time, in milliseconds.

getHandshakeTimeoutMillis	back to summary
public int getHandshakeTimeoutMillis() Note Currently only respected by DTLS protocols. Specify the timeout, in milliseconds, to use for the complete handshake process. Negative values are not allowed. A timeout of zero means an infinite timeout (i.e. the handshake will never time out). Returns:int the handshake timeout, in milliseconds.

getHandshakeTimeoutMillis

back to summary

public int getHandshakeTimeoutMillis()

Note

Currently only respected by DTLS protocols.

Specify the timeout, in milliseconds, to use for the complete handshake process. Negative values are not allowed. A timeout of zero means an infinite timeout (i.e. the handshake will never time out).

Returns:int: the handshake timeout, in milliseconds.

getHeartbeat back to summary

getHeartbeat	back to summary
public TlsHeartbeat getHeartbeat() Return a `TlsHeartbeat` instance that will control the generation of heartbeats locally (if permitted by the remote peer), or null to not generate heartbeats. Heartbeats are described in RFC 6520. Returns:TlsHeartbeat an instance of `TlsHeartbeat`. See Also `DefaultTlsHeartbeat`

public TlsHeartbeat getHeartbeat()

Return a TlsHeartbeat instance that will control the generation of heartbeats locally (if permitted by the remote peer), or null to not generate heartbeats. Heartbeats are described in RFC 6520.

Returns:TlsHeartbeat: an instance of TlsHeartbeat.
See Also: DefaultTlsHeartbeat

getHeartbeatPolicy back to summary

getHeartbeatPolicy	back to summary
public short getHeartbeatPolicy() Return the heartbeat mode applicable to the remote peer. Heartbeats are described in RFC 6520. See enumeration class `HeartbeatMode` for appropriate return values. Returns:short the `HeartbeatMode` value.

public short getHeartbeatPolicy()

Return the heartbeat mode applicable to the remote peer. Heartbeats are described in RFC 6520.

See enumeration class HeartbeatMode for appropriate return values.

Returns:short: the HeartbeatMode value.

getKeyExchangeFactory	back to summary
public TlsKeyExchangeFactory getKeyExchangeFactory() throws IOException

getMaxCertificateChainLength	back to summary
public int getMaxCertificateChainLength()

getMaxHandshakeMessageSize	back to summary
public int getMaxHandshakeMessageSize()

getProtocolVersions	back to summary
public ProtocolVersion[] getProtocolVersions()

getPskKeyExchangeModes	back to summary
public short[] getPskKeyExchangeModes()

getRenegotiationPolicy back to summary

getRenegotiationPolicy	back to summary
public int getRenegotiationPolicy() Warning EXPERIMENTAL FEATURE Return this peer's policy on renegotiation requests from the remote peer. This will be called only outside of ongoing handshakes, either when a remote server has sent a hello_request, or a remote client has sent a new ClientHello, and only when the requirements for secure renegotiation (including those of RFC 5746) have been met. Returns:int The `RenegotiationPolicy` constant corresponding to the desired policy. See Also `RenegotiationPolicy`

public int getRenegotiationPolicy()

Warning

EXPERIMENTAL FEATURE Return this peer's policy on renegotiation requests from the remote peer. This will be called only outside of ongoing handshakes, either when a remote server has sent a hello_request, or a remote client has sent a new ClientHello, and only when the requirements for secure renegotiation (including those of RFC 5746) have been met.

Returns:int: The RenegotiationPolicy constant corresponding to the desired policy.
See Also: RenegotiationPolicy

notifyAlertRaised back to summary

notifyAlertRaised	back to summary
public void notifyAlertRaised(short alertLevel, short alertDescription, String message, Throwable cause) This method will be called when an alert is raised by the protocol. Parameters alertLevel:short `AlertLevel` alertDescription:short `AlertDescription` message:String A human-readable message explaining what caused this alert. May be null. cause:Throwable The `Throwable` that caused this alert to be raised. May be null.

public void notifyAlertRaised(short alertLevel, short alertDescription, String message, Throwable cause)

This method will be called when an alert is raised by the protocol.

Parameters

alertLevel:short: AlertLevel
alertDescription:short: AlertDescription
message:String: A human-readable message explaining what caused this alert. May be null.
cause:Throwable: The Throwable that caused this alert to be raised. May be null.

notifyAlertReceived back to summary

notifyAlertReceived	back to summary
public void notifyAlertReceived(short alertLevel, short alertDescription) This method will be called when an alert is received from the remote peer. Parameters alertLevel:short `AlertLevel` alertDescription:short `AlertDescription`

public void notifyAlertReceived(short alertLevel, short alertDescription)

This method will be called when an alert is received from the remote peer.

Parameters

alertLevel:short: AlertLevel
alertDescription:short: AlertDescription

notifyCloseHandle	back to summary
public void notifyCloseHandle(TlsCloseable closehandle)

notifyConnectionClosed	back to summary
public void notifyConnectionClosed() Notifies the peer that the connection has been closed.

notifyHandshakeBeginning	back to summary
public void notifyHandshakeBeginning() throws IOException Notifies the peer that a new handshake is about to begin.

notifyHandshakeComplete	back to summary
public void notifyHandshakeComplete() throws IOException Notifies the peer that the handshake has been successfully completed.

notifySecureRenegotiation	back to summary
public void notifySecureRenegotiation(boolean secureRenegotiation) throws IOException RFC 5746 3.4/3.6. In case this is false, peers may want to terminate the handshake instead of continuing; see Section 4.1/4.3 for discussion. Note TLS 1.3 forbids renegotiation, so this is never called when TLS 1.3 (or later) was negotiated.

requiresCloseNotify	back to summary
public boolean requiresCloseNotify() This option is provided as a last resort for interoperability with TLS peers that fail to correctly send a close_notify alert at end of stream. Implementations SHOULD return true; caution is advised if returning false without a full understanding of the implications.

requiresExtendedMasterSecret back to summary

requiresExtendedMasterSecret	back to summary
public boolean requiresExtendedMasterSecret() This implementation supports RFC 7627 and will always negotiate the extended_master_secret extension where possible. When connecting to a peer that does not offer/accept this extension, it is recommended to abort the handshake. This option is provided for interoperability with legacy peers, although some TLS features will be disabled in that case (see RFC 7627 5.4). Returns:boolean `true` if the handshake should be aborted when the peer does not negotiate the extended_master_secret extension, or `false` to support legacy interoperability.

public boolean requiresExtendedMasterSecret()

This implementation supports RFC 7627 and will always negotiate the extended_master_secret extension where possible. When connecting to a peer that does not offer/accept this extension, it is recommended to abort the handshake. This option is provided for interoperability with legacy peers, although some TLS features will be disabled in that case (see RFC 7627 5.4).

Returns:boolean: true if the handshake should be aborted when the peer does not negotiate the extended_master_secret extension, or false to support legacy interoperability.

shouldCheckSigAlgOfPeerCerts back to summary

shouldCheckSigAlgOfPeerCerts	back to summary
public boolean shouldCheckSigAlgOfPeerCerts() Deprecated No longer called by the protocol classes. Can call `TlsUtils#checkPeerSigAlgs(TlsContext, TlsCertificate[])` once a complete CertPath has been determined (i.e. as part of chain validation). Controls whether the protocol will check the 'signatureAlgorithm' of received certificates as specified in RFC 5246 7.4.2, 7.4.4, 7.4.6 and similar rules for earlier TLS versions. We recommend to enable these checks, but this option is provided for cases where the default checks are for some reason too strict. Returns:boolean `true` if the 'signatureAlgorithm' of received certificates should be checked, or `false` to skip those checks.

public boolean shouldCheckSigAlgOfPeerCerts()

Deprecated

No longer called by the protocol classes. Can call TlsUtils#checkPeerSigAlgs(TlsContext, TlsCertificate[]) once a complete CertPath has been determined (i.e. as part of chain validation).

Controls whether the protocol will check the 'signatureAlgorithm' of received certificates as specified in RFC 5246 7.4.2, 7.4.4, 7.4.6 and similar rules for earlier TLS versions. We recommend to enable these checks, but this option is provided for cases where the default checks are for some reason too strict.

Returns:boolean: true if the 'signatureAlgorithm' of received certificates should be checked, or false to skip those checks.

shouldUseExtendedMasterSecret	back to summary
public boolean shouldUseExtendedMasterSecret()

shouldUseExtendedPadding back to summary

shouldUseExtendedPadding	back to summary
public boolean shouldUseExtendedPadding() See RFC 5246 6.2.3.2. Controls whether block cipher encryption may randomly add extra padding beyond the minimum. Note that in configurations where this is known to be potential security risk this setting will be ignored (and extended padding disabled). Extra padding is always supported when decrypting received records. Returns:boolean `true` if random extra padding should be added during block cipher encryption, or `false` to always use the minimum amount of required padding.

public boolean shouldUseExtendedPadding()

See RFC 5246 6.2.3.2. Controls whether block cipher encryption may randomly add extra padding beyond the minimum. Note that in configurations where this is known to be potential security risk this setting will be ignored (and extended padding disabled). Extra padding is always supported when decrypting received records.

Returns:boolean: true if random extra padding should be added during block cipher encryption, or false to always use the minimum amount of required padding.

shouldUseGMTUnixTime back to summary

shouldUseGMTUnixTime	back to summary
public boolean shouldUseGMTUnixTime() draft-mathewson-no-gmtunixtime-00 2. "If existing users of a TLS implementation may rely on gmt_unix_time containing the current time, we recommend that implementors MAY provide the ability to set gmt_unix_time as an option only, off by default." Note For a server that has negotiated TLS 1.3 (or later), or a client that has offered TLS 1.3 (or later), this is not called and gmt_unix_time is not used. Returns:boolean `true` if the current time should be used in the gmt_unix_time field of Random, or `false` if gmt_unix_time should contain a cryptographically random value.

public boolean shouldUseGMTUnixTime()

draft-mathewson-no-gmtunixtime-00 2. "If existing users of a TLS implementation may rely on gmt_unix_time containing the current time, we recommend that implementors MAY provide the ability to set gmt_unix_time as an option only, off by default."

Note

For a server that has negotiated TLS 1.3 (or later), or a client that has offered TLS 1.3 (or later), this is not called and gmt_unix_time is not used.

Returns:boolean: true if the current time should be used in the gmt_unix_time field of Random, or false if gmt_unix_time should contain a cryptographically random value.

public Interface TlsPeer

Method Summary

Method Detail