Bouncy Castle TLS/JSSE APIs (FIPS Distribution) 1.0.19 · org.bouncycastle.tls.AbstractTlsClient

Field Summary

Modifier and Type	Field and Description
protected int[]	cipherSuites
protected TlsClientContext	context
protected ProtocolVersion[]	protocolVersions
protected Vector<E>	supportedGroups
protected Vector<E>	supportedSignatureAlgorithms
protected Vector<E>	supportedSignatureAlgorithmsCert

Constructor Summary

Access	Constructor and Description
public	AbstractTlsClient(TlsCrypto crypto)

Method Summary

Modifier and Type	Method and Description
protected boolean	allowUnexpectedServerExtension(Integer extensionType, byte[] extensionData)
protected void	checkForUnexpectedServerExtension(Hashtable<K, V> serverExtensions, Integer extensionType)
protected short[]	getAllowedClientCertificateTypes()
protected short[]	getAllowedServerCertificateTypes()
protected Vector<E>	getCertificateAuthorities()
protected CertificateStatusRequest	getCertificateStatusRequest()
public int[]	getCipherSuites() Implements org.bouncycastle.tls.TlsPeer.getCipherSuites.
public Hashtable<K, V>	getClientExtensions() Implements org.bouncycastle.tls.TlsClient.getClientExtensions.
public Vector<E>	getClientSupplementalData() Implements org.bouncycastle.tls.TlsClient.getClientSupplementalData.
public TlsDHGroupVerifier	getDHGroupVerifier() Implements org.bouncycastle.tls.TlsClient.getDHGroupVerifier.
public Vector<E>	getEarlyKeyShareGroups() Implements org.bouncycastle.tls.TlsClient.getEarlyKeyShareGroups. If this client is offering TLS 1.3 or higher, this method may be called to determine for which groups a key share should be included in the initial ClientHello.
public Vector<E>	getExternalPSKs() Implements org.bouncycastle.tls.TlsClient.getExternalPSKs. Return the `external PSKs` to offer in the ClientHello.
protected Vector<E>	Returns: a `Vector` of `CertificateStatusRequestItemV2` (or null). getMultiCertStatusRequest()
protected Vector<E>	getNamedGroupRoles()
protected byte[]	Returns: The connection ID to use. getNewConnectionID() RFC 9146 DTLS connection ID. The default `getClientExtensions()` implementation calls this to get the connection_id extension the client will send.
protected Vector<E>	getProtocolNames()
public ProtocolVersion[]	getProtocolVersions() Implements org.bouncycastle.tls.TlsPeer.getProtocolVersions.
public TlsPSKIdentity	getPSKIdentity() Implements org.bouncycastle.tls.TlsClient.getPSKIdentity.
public TlsSession	getSessionToResume() Implements org.bouncycastle.tls.TlsClient.getSessionToResume. Return the session this client wants to resume, if any.
protected Vector<E>	getSNIServerNames()
public TlsSRPConfigVerifier	getSRPConfigVerifier() Implements org.bouncycastle.tls.TlsClient.getSRPConfigVerifier.
public TlsSRPIdentity	getSRPIdentity() Implements org.bouncycastle.tls.TlsClient.getSRPIdentity.
protected Vector<E>	Returns: a `Vector` of `Integer`. See `NamedGroup` for group constants. getSupportedGroups(Vector<E> The `named group roles` for which there should be at least one supported group. By default this is inferred from the offered cipher suites and signature algorithms. namedGroupRoles) The default `getClientExtensions()` implementation calls this to determine which named groups to include in the supported_groups extension for the ClientHello.
protected Vector<E>	getSupportedSignatureAlgorithms()
protected Vector<E>	getSupportedSignatureAlgorithmsCert()
protected Vector<E>	getTrustedCAIndication()
public void	init(TlsClientContext context) Implements org.bouncycastle.tls.TlsClient.init.
public boolean	isFallback() Implements org.bouncycastle.tls.TlsClient.isFallback.
public void	notifyHandshakeBeginning() Overrides org.bouncycastle.tls.AbstractTlsPeer.notifyHandshakeBeginning. Implements org.bouncycastle.tls.TlsPeer.notifyHandshakeBeginning. Notifies the peer that a new handshake is about to begin.
public void	notifyNewSessionTicket(NewSessionTicket The ticket. newSessionTicket) Implements org.bouncycastle.tls.TlsClient.notifyNewSessionTicket. RFC 5077 3.3.
public void	notifySelectedCipherSuite(int selectedCipherSuite) Implements org.bouncycastle.tls.TlsClient.notifySelectedCipherSuite.
public void	notifySelectedPSK(TlsPSK selectedPSK) Implements org.bouncycastle.tls.TlsClient.notifySelectedPSK.
public void	notifyServerVersion(ProtocolVersion serverVersion) Implements org.bouncycastle.tls.TlsClient.notifyServerVersion.
public void	notifySessionID(byte[] sessionID) Implements org.bouncycastle.tls.TlsClient.notifySessionID. Notifies the client of the session_id sent in the ServerHello.
public void	notifySessionToResume(TlsSession The `TlsSession` representing the resumable session to be offered for this connection, or null if there is none. session) Implements org.bouncycastle.tls.TlsClient.notifySessionToResume. Notifies the client of the session that will be offered in ClientHello for resumption, if any.
public void	processServerExtensions(Hashtable<K, V> (Integer -> byte[]) serverExtensions) Implements org.bouncycastle.tls.TlsClient.processServerExtensions. The TlsClientProtocol implementation validates that any server extensions received correspond to client extensions sent.
public void	processServerSupplementalData(Vector<E> serverSupplementalData) Implements org.bouncycastle.tls.TlsClient.processServerSupplementalData.
public boolean	shouldUseCompatibilityMode() Implements org.bouncycastle.tls.TlsClient.shouldUseCompatibilityMode.

Field Detail

cipherSuites	back to summary
protected int[] cipherSuites

context	back to summary
protected TlsClientContext context

protocolVersions	back to summary
protected ProtocolVersion[] protocolVersions

supportedGroups	back to summary
protected Vector<E> supportedGroups

supportedSignatureAlgorithms	back to summary
protected Vector<E> supportedSignatureAlgorithms

supportedSignatureAlgorithmsCert	back to summary
protected Vector<E> supportedSignatureAlgorithmsCert

Constructor Detail

AbstractTlsClient	back to summary
public AbstractTlsClient(TlsCrypto crypto)

Method Detail

allowUnexpectedServerExtension	back to summary
protected boolean allowUnexpectedServerExtension(Integer extensionType, byte[] extensionData) throws IOException

checkForUnexpectedServerExtension	back to summary
protected void checkForUnexpectedServerExtension(Hashtable<K, V> serverExtensions, Integer extensionType) throws IOException

getAllowedClientCertificateTypes	back to summary
protected short[] getAllowedClientCertificateTypes()

getAllowedServerCertificateTypes	back to summary
protected short[] getAllowedServerCertificateTypes()

getCertificateAuthorities	back to summary
protected Vector<E> getCertificateAuthorities()

getCertificateStatusRequest	back to summary
protected CertificateStatusRequest getCertificateStatusRequest()

getCipherSuites	back to summary
public int[] getCipherSuites() Implements org.bouncycastle.tls.TlsPeer.getCipherSuites.

getClientExtensions	back to summary
public Hashtable<K, V> getClientExtensions() throws IOException Implements org.bouncycastle.tls.TlsClient.getClientExtensions.

getClientSupplementalData	back to summary
public Vector<E> getClientSupplementalData() throws IOException Implements org.bouncycastle.tls.TlsClient.getClientSupplementalData.

getDHGroupVerifier	back to summary
public TlsDHGroupVerifier getDHGroupVerifier() Implements org.bouncycastle.tls.TlsClient.getDHGroupVerifier.

getEarlyKeyShareGroups back to summary

getEarlyKeyShareGroups	back to summary
public Vector<E> getEarlyKeyShareGroups() Implements org.bouncycastle.tls.TlsClient.getEarlyKeyShareGroups. Doc from org.bouncycastle.tls.TlsClient.getEarlyKeyShareGroups. If this client is offering TLS 1.3 or higher, this method may be called to determine for which groups a key share should be included in the initial ClientHello. Groups that were not included in the supported_groups extension (by `getClientExtensions()` will be ignored. The protocol will then add a suitable key_share extension to the ClientHello extensions. Returns:Vector<E> a `Vector` of `named group` values, possibly empty or null.

public Vector<E> getEarlyKeyShareGroups()

Implements org.bouncycastle.tls.TlsClient.getEarlyKeyShareGroups.

Doc from org.bouncycastle.tls.TlsClient.getEarlyKeyShareGroups.

If this client is offering TLS 1.3 or higher, this method may be called to determine for which groups a key share should be included in the initial ClientHello. Groups that were not included in the supported_groups extension (by getClientExtensions() will be ignored. The protocol will then add a suitable key_share extension to the ClientHello extensions.

Returns:Vector<E>: a Vector of named group values, possibly empty or null.

getExternalPSKs back to summary

getExternalPSKs	back to summary
public Vector<E> getExternalPSKs() Implements org.bouncycastle.tls.TlsClient.getExternalPSKs. Doc from org.bouncycastle.tls.TlsClient.getExternalPSKs. Return the `external PSKs` to offer in the ClientHello. Note that this will only be called when TLS 1.3 or higher is amongst the offered protocol versions. Returns:Vector<E> a `Vector` of `TlsPSKExternal` instances, or null if none should be offered.

public Vector<E> getExternalPSKs()

Implements org.bouncycastle.tls.TlsClient.getExternalPSKs.

Doc from org.bouncycastle.tls.TlsClient.getExternalPSKs.

Return the external PSKs to offer in the ClientHello. Note that this will only be called when TLS 1.3 or higher is amongst the offered protocol versions.

Returns:Vector<E>: a Vector of TlsPSKExternal instances, or null if none should be offered.

getMultiCertStatusRequest	back to summary
protected Vector<E> getMultiCertStatusRequest() Returns:Vector<E> a `Vector` of `CertificateStatusRequestItemV2` (or null).

getNamedGroupRoles	back to summary
protected Vector<E> getNamedGroupRoles()

getNewConnectionID back to summary

getNewConnectionID	back to summary
protected byte[] getNewConnectionID() RFC 9146 DTLS connection ID. The default `getClientExtensions()` implementation calls this to get the connection_id extension the client will send. As future communication doesn't include the connection IDs length, this should either be fixed-length or include the connection ID's length. (see explanation in RFC 9146 4. "cid:") Returns:byte[] The connection ID to use.

protected byte[] getNewConnectionID()

RFC 9146 DTLS connection ID.

The default getClientExtensions() implementation calls this to get the connection_id extension the client will send. As future communication doesn't include the connection IDs length, this should either be fixed-length or include the connection ID's length. (see explanation in RFC 9146 4. "cid:")

Returns:byte[]: The connection ID to use.

getProtocolNames	back to summary
protected Vector<E> getProtocolNames()

getProtocolVersions	back to summary
public ProtocolVersion[] getProtocolVersions() Implements org.bouncycastle.tls.TlsPeer.getProtocolVersions.

getPSKIdentity	back to summary
public TlsPSKIdentity getPSKIdentity() throws IOException Implements org.bouncycastle.tls.TlsClient.getPSKIdentity.

getSessionToResume back to summary

getSessionToResume	back to summary
public TlsSession getSessionToResume() Implements org.bouncycastle.tls.TlsClient.getSessionToResume. Doc from org.bouncycastle.tls.TlsClient.getSessionToResume. Return the session this client wants to resume, if any. Note that the peer's certificate chain for the session (if any) may need to be periodically revalidated. Returns:TlsSession A `TlsSession` representing the resumable session to be used for this connection, or null to use a new session.

public TlsSession getSessionToResume()

Implements org.bouncycastle.tls.TlsClient.getSessionToResume.

Doc from org.bouncycastle.tls.TlsClient.getSessionToResume.

Return the session this client wants to resume, if any. Note that the peer's certificate chain for the session (if any) may need to be periodically revalidated.

Returns:TlsSession: A TlsSession representing the resumable session to be used for this connection, or null to use a new session.

getSNIServerNames	back to summary
protected Vector<E> getSNIServerNames()

getSRPConfigVerifier	back to summary
public TlsSRPConfigVerifier getSRPConfigVerifier() Implements org.bouncycastle.tls.TlsClient.getSRPConfigVerifier.

getSRPIdentity	back to summary
public TlsSRPIdentity getSRPIdentity() throws IOException Implements org.bouncycastle.tls.TlsClient.getSRPIdentity.

getSupportedGroups back to summary

getSupportedGroups	back to summary
protected Vector<E> getSupportedGroups(Vector<E> namedGroupRoles) The default `getClientExtensions()` implementation calls this to determine which named groups to include in the supported_groups extension for the ClientHello. Parameters namedGroupRoles:Vector<E> The `named group roles` for which there should be at least one supported group. By default this is inferred from the offered cipher suites and signature algorithms. Returns:Vector<E> a `Vector` of `Integer`. See `NamedGroup` for group constants.

protected Vector<E> getSupportedGroups(Vector<E> namedGroupRoles)

The default getClientExtensions() implementation calls this to determine which named groups to include in the supported_groups extension for the ClientHello.

Parameters

namedGroupRoles:Vector<E>: The named group roles for which there should be at least one supported group. By default this is inferred from the offered cipher suites and signature algorithms.

Returns:Vector<E>

a Vector of Integer. See NamedGroup for group constants.

getSupportedSignatureAlgorithms	back to summary
protected Vector<E> getSupportedSignatureAlgorithms()

getSupportedSignatureAlgorithmsCert	back to summary
protected Vector<E> getSupportedSignatureAlgorithmsCert()

getTrustedCAIndication	back to summary
protected Vector<E> getTrustedCAIndication()

init	back to summary
public void init(TlsClientContext context) Implements org.bouncycastle.tls.TlsClient.init.

isFallback	back to summary
public boolean isFallback() Implements org.bouncycastle.tls.TlsClient.isFallback.

notifyHandshakeBeginning	back to summary
public void notifyHandshakeBeginning() throws IOException Overrides org.bouncycastle.tls.AbstractTlsPeer.notifyHandshakeBeginning. Implements org.bouncycastle.tls.TlsPeer.notifyHandshakeBeginning. Doc from org.bouncycastle.tls.TlsPeer.notifyHandshakeBeginning. Notifies the peer that a new handshake is about to begin.

notifyHandshakeBeginning

back to summary

public void notifyHandshakeBeginning() throws IOException

Overrides org.bouncycastle.tls.AbstractTlsPeer.notifyHandshakeBeginning.

Implements org.bouncycastle.tls.TlsPeer.notifyHandshakeBeginning.

Doc from org.bouncycastle.tls.TlsPeer.notifyHandshakeBeginning.

Notifies the peer that a new handshake is about to begin.

notifyNewSessionTicket	back to summary
public void notifyNewSessionTicket(NewSessionTicket newSessionTicket) throws IOException Implements org.bouncycastle.tls.TlsClient.notifyNewSessionTicket. Doc from org.bouncycastle.tls.TlsClient.notifyNewSessionTicket. RFC 5077 3.3. NewSessionTicket Handshake Message This method will be called (only) when a NewSessionTicket handshake message is received. The ticket is opaque to the client and clients MUST NOT examine the ticket under the assumption that it complies with e.g. RFC 5077 4. Recommended Ticket Construction. Parameters newSessionTicket:NewSessionTicket The ticket.

notifyNewSessionTicket

back to summary

public void notifyNewSessionTicket(NewSessionTicket newSessionTicket) throws IOException

Implements org.bouncycastle.tls.TlsClient.notifyNewSessionTicket.

Doc from org.bouncycastle.tls.TlsClient.notifyNewSessionTicket.

RFC 5077 3.3. NewSessionTicket Handshake Message

This method will be called (only) when a NewSessionTicket handshake message is received. The ticket is opaque to the client and clients MUST NOT examine the ticket under the assumption that it complies with e.g. RFC 5077 4. Recommended Ticket Construction.

Parameters

newSessionTicket:NewSessionTicket: The ticket.

notifySelectedCipherSuite	back to summary
public void notifySelectedCipherSuite(int selectedCipherSuite) Implements org.bouncycastle.tls.TlsClient.notifySelectedCipherSuite.

notifySelectedPSK	back to summary
public void notifySelectedPSK(TlsPSK selectedPSK) throws IOException Implements org.bouncycastle.tls.TlsClient.notifySelectedPSK.

notifyServerVersion	back to summary
public void notifyServerVersion(ProtocolVersion serverVersion) throws IOException Implements org.bouncycastle.tls.TlsClient.notifyServerVersion.

notifySessionID	back to summary
public void notifySessionID(byte[] sessionID) Implements org.bouncycastle.tls.TlsClient.notifySessionID. Doc from org.bouncycastle.tls.TlsClient.notifySessionID. Notifies the client of the session_id sent in the ServerHello.

notifySessionID

back to summary

public void notifySessionID(byte[] sessionID)

Implements org.bouncycastle.tls.TlsClient.notifySessionID.

Doc from org.bouncycastle.tls.TlsClient.notifySessionID.

Notifies the client of the session_id sent in the ServerHello.

notifySessionToResume back to summary

notifySessionToResume	back to summary
public void notifySessionToResume(TlsSession session) Implements org.bouncycastle.tls.TlsClient.notifySessionToResume. Doc from org.bouncycastle.tls.TlsClient.notifySessionToResume. Notifies the client of the session that will be offered in ClientHello for resumption, if any. This will be either the session returned from `getSessionToResume()` or null if that session was unusable. Note the actual negotiated session_id is notified by `notifySessionID(byte[])`. Parameters session:TlsSession The `TlsSession` representing the resumable session to be offered for this connection, or null if there is none.

public void notifySessionToResume(TlsSession session)

Implements org.bouncycastle.tls.TlsClient.notifySessionToResume.

Doc from org.bouncycastle.tls.TlsClient.notifySessionToResume.

Notifies the client of the session that will be offered in ClientHello for resumption, if any. This will be either the session returned from getSessionToResume() or null if that session was unusable.

Note

the actual negotiated session_id is notified by notifySessionID(byte[]).

Parameters

session:TlsSession: The TlsSession representing the resumable session to be offered for this connection, or null if there is none.

processServerExtensions	back to summary
public void processServerExtensions(Hashtable<K, V> serverExtensions) throws IOException Implements org.bouncycastle.tls.TlsClient.processServerExtensions. Doc from org.bouncycastle.tls.TlsClient.processServerExtensions. The TlsClientProtocol implementation validates that any server extensions received correspond to client extensions sent. If further processing of the server extensions is needed, it can be done in this callback. Note This is not called for session resumption handshakes. Parameters serverExtensions:Hashtable<K, V> (Integer -> byte[])

processServerExtensions

back to summary

public void processServerExtensions(Hashtable<K, V> serverExtensions) throws IOException

Implements org.bouncycastle.tls.TlsClient.processServerExtensions.

Doc from org.bouncycastle.tls.TlsClient.processServerExtensions.

The TlsClientProtocol implementation validates that any server extensions received correspond to client extensions sent. If further processing of the server extensions is needed, it can be done in this callback.

Note

This is not called for session resumption handshakes.

Parameters

serverExtensions:Hashtable<K, V>: (Integer -> byte[])

processServerSupplementalData	back to summary
public void processServerSupplementalData(Vector<E> serverSupplementalData) throws IOException Implements org.bouncycastle.tls.TlsClient.processServerSupplementalData.

shouldUseCompatibilityMode	back to summary
public boolean shouldUseCompatibilityMode() Implements org.bouncycastle.tls.TlsClient.shouldUseCompatibilityMode.

public abstract Class AbstractTlsClient

Field Summary

Constructor Summary

Method Summary

Field Detail

Constructor Detail

Method Detail