Bouncy Castle TLS/JSSE APIs (FIPS Distribution) 1.0.19 · org.bouncycastle.tls.AbstractTlsServer

Field Summary

Modifier and Type	Field and Description
protected CertificateStatusRequest	certificateStatusRequest
protected int[]	cipherSuites
protected Hashtable<K, V>	clientExtensions
protected Vector<E>	clientProtocolNames
protected boolean	clientSentECPointFormats
protected TlsServerContext	context
protected boolean	encryptThenMACOffered
protected short	maxFragmentLengthOffered
protected int[]	offeredCipherSuites
protected ProtocolVersion[]	protocolVersions
protected int	selectedCipherSuite
protected ProtocolName	selectedProtocolName
protected final Hashtable<K, V>	serverExtensions
protected Vector<E>	statusRequestV2
protected boolean	truncatedHMacOffered
protected Vector<E>	trustedCAKeys

Constructor Summary

Access	Constructor and Description
public	AbstractTlsServer(TlsCrypto crypto)

Method Summary

Modifier and Type	Method and Description
protected boolean	allowCertificateStatus()
protected boolean	allowEncryptThenMAC()
protected boolean	allowMultiCertStatus()
protected boolean	allowTruncatedHMac()
protected boolean	allowTrustedCAIndication()
protected Hashtable<K, V>	checkServerExtensions() Deprecated Use 'serverExtensions' directly, it is now never null
protected short[]	getAllowedClientCertificateTypes()
public CertificateRequest	getCertificateRequest() Implements org.bouncycastle.tls.TlsServer.getCertificateRequest.
public CertificateStatus	getCertificateStatus() Implements org.bouncycastle.tls.TlsServer.getCertificateStatus. This method will be called (only) if the server included an extension of type "status_request" with empty "extension_data" in the extended server hello.
public int[]	getCipherSuites() Implements org.bouncycastle.tls.TlsPeer.getCipherSuites.
protected String	getDetailMessageNoCipherSuite()
public TlsDHConfig	getDHConfig() Implements org.bouncycastle.tls.TlsServer.getDHConfig.
public TlsECConfig	getECDHConfig() Implements org.bouncycastle.tls.TlsServer.getECDHConfig.
public TlsPSKExternal	getExternalPSK(Vector<E> a `Vector` of `PskIdentity` instances. identities) Implements org.bouncycastle.tls.TlsServer.getExternalPSK. Warning EXPERIMENTAL FEATURE, UNSTABLE API Return the `external PSK` to select from the ClientHello.
protected int	getMaximumNegotiableCurveBits()
protected int	getMaximumNegotiableFiniteFieldBits()
protected byte[]	Returns: The connection ID to use. getNewConnectionID() RFC 9146 DTLS connection ID. This method will be called if a connection_id extension was sent by the client.
public byte[]	getNewSessionID() Implements org.bouncycastle.tls.TlsServer.getNewSessionID.
public NewSessionTicket	getNewSessionTicket() Implements org.bouncycastle.tls.TlsServer.getNewSessionTicket. RFC 5077 3.3.
protected Vector<E>	getProtocolNames()
public ProtocolVersion[]	getProtocolVersions() Implements org.bouncycastle.tls.TlsPeer.getProtocolVersions.
public TlsPSKIdentityManager	getPSKIdentityManager() Implements org.bouncycastle.tls.TlsServer.getPSKIdentityManager.
public int	getSelectedCipherSuite() Implements org.bouncycastle.tls.TlsServer.getSelectedCipherSuite.
public Hashtable<K, V>	getServerExtensions() Implements org.bouncycastle.tls.TlsServer.getServerExtensions.
public void	getServerExtensionsForConnection(Hashtable<K, V> serverExtensions) Implements org.bouncycastle.tls.TlsServer.getServerExtensionsForConnection.
public Vector<E>	getServerSupplementalData() Implements org.bouncycastle.tls.TlsServer.getServerSupplementalData.
public ProtocolVersion	getServerVersion() Implements org.bouncycastle.tls.TlsServer.getServerVersion.
public TlsSession	getSessionToResume(byte[] the ID of the session to resume. sessionID) Implements org.bouncycastle.tls.TlsServer.getSessionToResume. Return the specified session, if available.
public TlsSRPLoginParameters	getSRPLoginParameters() Implements org.bouncycastle.tls.TlsServer.getSRPLoginParameters.
public int[]	getSupportedGroups() Implements org.bouncycastle.tls.TlsServer.getSupportedGroups.
public void	init(TlsServerContext context) Implements org.bouncycastle.tls.TlsServer.init.
protected boolean	isSelectableCipherSuite(int cipherSuite, int availCurveBits, int availFiniteFieldBits, Vector<E> sigAlgs)
public void	notifyClientCertificate(Certificate the effective client certificate (may be an empty chain). clientCertificate) Implements org.bouncycastle.tls.TlsServer.notifyClientCertificate. Called by the protocol handler to report the client certificate, only if `getCertificateRequest()` returned non-null.
public void	notifyClientVersion(ProtocolVersion clientVersion) Implements org.bouncycastle.tls.TlsServer.notifyClientVersion.
public void	notifyFallback(boolean isFallback) Implements org.bouncycastle.tls.TlsServer.notifyFallback.
public void	notifyHandshakeBeginning() Overrides org.bouncycastle.tls.AbstractTlsPeer.notifyHandshakeBeginning. Implements org.bouncycastle.tls.TlsPeer.notifyHandshakeBeginning. Notifies the peer that a new handshake is about to begin.
public void	notifyOfferedCipherSuites(int[] offeredCipherSuites) Implements org.bouncycastle.tls.TlsServer.notifyOfferedCipherSuites.
public void	notifySession(TlsSession session) Implements org.bouncycastle.tls.TlsServer.notifySession.
protected boolean	preferLocalCipherSuites()
protected boolean	preferLocalClientCertificateTypes()
public void	processClientExtensions(Hashtable<K, V> clientExtensions) Implements org.bouncycastle.tls.TlsServer.processClientExtensions.
public void	processClientSupplementalData(Vector<E> clientSupplementalData) Implements org.bouncycastle.tls.TlsServer.processClientSupplementalData.
protected boolean	selectCipherSuite(int cipherSuite)
protected int	selectDH(int minimumFiniteFieldBits)
protected int	selectDHDefault(int minimumFiniteFieldBits)
protected int	selectECDH(int minimumCurveBits)
protected int	selectECDHDefault(int minimumCurveBits)
protected ProtocolName	selectProtocolName()
protected ProtocolName	selectProtocolName(Vector<E> clientProtocolNames, Vector<E> serverProtocolNames)
protected boolean	shouldSelectProtocolNameEarly()

Field Detail

certificateStatusRequest	back to summary
protected CertificateStatusRequest certificateStatusRequest

cipherSuites	back to summary
protected int[] cipherSuites

clientExtensions	back to summary
protected Hashtable<K, V> clientExtensions

clientProtocolNames	back to summary
protected Vector<E> clientProtocolNames

clientSentECPointFormats	back to summary
protected boolean clientSentECPointFormats

context	back to summary
protected TlsServerContext context

encryptThenMACOffered	back to summary
protected boolean encryptThenMACOffered

maxFragmentLengthOffered	back to summary
protected short maxFragmentLengthOffered

offeredCipherSuites	back to summary
protected int[] offeredCipherSuites

protocolVersions	back to summary
protected ProtocolVersion[] protocolVersions

selectedCipherSuite	back to summary
protected int selectedCipherSuite

selectedProtocolName	back to summary
protected ProtocolName selectedProtocolName

serverExtensions	back to summary
protected final Hashtable<K, V> serverExtensions

statusRequestV2	back to summary
protected Vector<E> statusRequestV2

truncatedHMacOffered	back to summary
protected boolean truncatedHMacOffered

trustedCAKeys	back to summary
protected Vector<E> trustedCAKeys

Constructor Detail

AbstractTlsServer	back to summary
public AbstractTlsServer(TlsCrypto crypto)

Method Detail

allowCertificateStatus	back to summary
protected boolean allowCertificateStatus()

allowEncryptThenMAC	back to summary
protected boolean allowEncryptThenMAC()

allowMultiCertStatus	back to summary
protected boolean allowMultiCertStatus()

allowTruncatedHMac	back to summary
protected boolean allowTruncatedHMac()

allowTrustedCAIndication	back to summary
protected boolean allowTrustedCAIndication()

checkServerExtensions	back to summary
protected Hashtable<K, V> checkServerExtensions() Deprecated Use 'serverExtensions' directly, it is now never null

getAllowedClientCertificateTypes	back to summary
protected short[] getAllowedClientCertificateTypes()

getCertificateRequest	back to summary
public CertificateRequest getCertificateRequest() throws IOException Implements org.bouncycastle.tls.TlsServer.getCertificateRequest.

getCertificateStatus back to summary

getCertificateStatus	back to summary
public CertificateStatus getCertificateStatus() throws IOException Implements org.bouncycastle.tls.TlsServer.getCertificateStatus. Doc from org.bouncycastle.tls.TlsServer.getCertificateStatus. This method will be called (only) if the server included an extension of type "status_request" with empty "extension_data" in the extended server hello. See RFC 3546 3.6. Certificate Status Request. If a non-null `CertificateStatus` is returned, it is sent to the client as a handshake message of type "certificate_status". Returns:CertificateStatus A `CertificateStatus` to be sent to the client (or null for none).

public CertificateStatus getCertificateStatus() throws IOException

Implements org.bouncycastle.tls.TlsServer.getCertificateStatus.

Doc from org.bouncycastle.tls.TlsServer.getCertificateStatus.

This method will be called (only) if the server included an extension of type "status_request" with empty "extension_data" in the extended server hello. See RFC 3546 3.6. Certificate Status Request. If a non-null CertificateStatus is returned, it is sent to the client as a handshake message of type "certificate_status".

Returns:CertificateStatus: A CertificateStatus to be sent to the client (or null for none).

getCipherSuites	back to summary
public int[] getCipherSuites() Implements org.bouncycastle.tls.TlsPeer.getCipherSuites.

getDetailMessageNoCipherSuite	back to summary
protected String getDetailMessageNoCipherSuite()

getDHConfig	back to summary
public TlsDHConfig getDHConfig() throws IOException Implements org.bouncycastle.tls.TlsServer.getDHConfig.

getECDHConfig	back to summary
public TlsECConfig getECDHConfig() throws IOException Implements org.bouncycastle.tls.TlsServer.getECDHConfig.

getExternalPSK back to summary

getExternalPSK	back to summary
public TlsPSKExternal getExternalPSK(Vector<E> identities) Implements org.bouncycastle.tls.TlsServer.getExternalPSK. Doc from org.bouncycastle.tls.TlsServer.getExternalPSK. Warning EXPERIMENTAL FEATURE, UNSTABLE API Return the `external PSK` to select from the ClientHello. Note that this will only be called when TLS 1.3 or higher is amongst the offered protocol versions, and one or more PSKs are actually offered. Parameters identities:Vector<E> a `Vector` of `PskIdentity` instances. Returns:TlsPSKExternal the `TlsPSKExternal` corresponding to the selected identity, or null to not select any.

public TlsPSKExternal getExternalPSK(Vector<E> identities)

Implements org.bouncycastle.tls.TlsServer.getExternalPSK.

Doc from org.bouncycastle.tls.TlsServer.getExternalPSK.

Warning

EXPERIMENTAL FEATURE, UNSTABLE API Return the external PSK to select from the ClientHello. Note that this will only be called when TLS 1.3 or higher is amongst the offered protocol versions, and one or more PSKs are actually offered.

Parameters

identities:Vector<E>: a Vector of PskIdentity instances.

Returns:TlsPSKExternal

the TlsPSKExternal corresponding to the selected identity, or null to not select any.

getMaximumNegotiableCurveBits	back to summary
protected int getMaximumNegotiableCurveBits()

getMaximumNegotiableFiniteFieldBits	back to summary
protected int getMaximumNegotiableFiniteFieldBits()

getNewConnectionID	back to summary
protected byte[] getNewConnectionID() RFC 9146 DTLS connection ID. This method will be called if a connection_id extension was sent by the client. If the return value is non-null, the server will send this connection ID to the client to use in future packets. As future communication doesn't include the connection IDs length, this should either be fixed-length or include the connection ID's length. (see explanation in RFC 9146 4. "cid:") Returns:byte[] The connection ID to use.

getNewConnectionID

back to summary

protected byte[] getNewConnectionID()

RFC 9146 DTLS connection ID.

This method will be called if a connection_id extension was sent by the client. If the return value is non-null, the server will send this connection ID to the client to use in future packets. As future communication doesn't include the connection IDs length, this should either be fixed-length or include the connection ID's length. (see explanation in RFC 9146 4. "cid:")

Returns:byte[]: The connection ID to use.

getNewSessionID	back to summary
public byte[] getNewSessionID() Implements org.bouncycastle.tls.TlsServer.getNewSessionID.

getNewSessionTicket	back to summary
public NewSessionTicket getNewSessionTicket() throws IOException Implements org.bouncycastle.tls.TlsServer.getNewSessionTicket. Doc from org.bouncycastle.tls.TlsServer.getNewSessionTicket. RFC 5077 3.3. NewSessionTicket Handshake Message. This method will be called (only) if a NewSessionTicket extension was sent by the server. See RFC 5077 4. Recommended Ticket Construction for recommended format and protection. Returns:NewSessionTicket The ticket.

getNewSessionTicket

back to summary

public NewSessionTicket getNewSessionTicket() throws IOException

Implements org.bouncycastle.tls.TlsServer.getNewSessionTicket.

Doc from org.bouncycastle.tls.TlsServer.getNewSessionTicket.

RFC 5077 3.3. NewSessionTicket Handshake Message.

This method will be called (only) if a NewSessionTicket extension was sent by the server. See RFC 5077 4. Recommended Ticket Construction for recommended format and protection.

Returns:NewSessionTicket: The ticket.

getProtocolNames	back to summary
protected Vector<E> getProtocolNames()

getProtocolVersions	back to summary
public ProtocolVersion[] getProtocolVersions() Implements org.bouncycastle.tls.TlsPeer.getProtocolVersions.

getPSKIdentityManager	back to summary
public TlsPSKIdentityManager getPSKIdentityManager() throws IOException Implements org.bouncycastle.tls.TlsServer.getPSKIdentityManager.

getSelectedCipherSuite	back to summary
public int getSelectedCipherSuite() throws IOException Implements org.bouncycastle.tls.TlsServer.getSelectedCipherSuite.

getServerExtensions	back to summary
public Hashtable<K, V> getServerExtensions() throws IOException Implements org.bouncycastle.tls.TlsServer.getServerExtensions.

getServerExtensionsForConnection	back to summary
public void getServerExtensionsForConnection(Hashtable<K, V> serverExtensions) throws IOException Implements org.bouncycastle.tls.TlsServer.getServerExtensionsForConnection.

getServerSupplementalData	back to summary
public Vector<E> getServerSupplementalData() throws IOException Implements org.bouncycastle.tls.TlsServer.getServerSupplementalData.

getServerVersion	back to summary
public ProtocolVersion getServerVersion() throws IOException Implements org.bouncycastle.tls.TlsServer.getServerVersion.

getSessionToResume back to summary

getSessionToResume	back to summary
public TlsSession getSessionToResume(byte[] sessionID) Implements org.bouncycastle.tls.TlsServer.getSessionToResume. Doc from org.bouncycastle.tls.TlsServer.getSessionToResume. Return the specified session, if available. Note that the peer's certificate chain for the session (if any) may need to be periodically revalidated. Parameters sessionID:byte[] the ID of the session to resume. Returns:TlsSession A `TlsSession` with the specified session ID, or null.

public TlsSession getSessionToResume(byte[] sessionID)

Implements org.bouncycastle.tls.TlsServer.getSessionToResume.

Doc from org.bouncycastle.tls.TlsServer.getSessionToResume.

Return the specified session, if available. Note that the peer's certificate chain for the session (if any) may need to be periodically revalidated.

Parameters

sessionID:byte[]: the ID of the session to resume.

Returns:TlsSession

A TlsSession with the specified session ID, or null.

getSRPLoginParameters	back to summary
public TlsSRPLoginParameters getSRPLoginParameters() throws IOException Implements org.bouncycastle.tls.TlsServer.getSRPLoginParameters.

getSupportedGroups	back to summary
public int[] getSupportedGroups() throws IOException Implements org.bouncycastle.tls.TlsServer.getSupportedGroups.

init	back to summary
public void init(TlsServerContext context) Implements org.bouncycastle.tls.TlsServer.init.

isSelectableCipherSuite	back to summary
protected boolean isSelectableCipherSuite(int cipherSuite, int availCurveBits, int availFiniteFieldBits, Vector<E> sigAlgs)

notifyClientCertificate back to summary

public void notifyClientCertificate(Certificate clientCertificate) throws IOException

Implements org.bouncycastle.tls.TlsServer.notifyClientCertificate.

Doc from org.bouncycastle.tls.TlsServer.notifyClientCertificate.

Called by the protocol handler to report the client certificate, only if getCertificateRequest() returned non-null.

Note

this method is responsible for certificate verification and validation.

Parameters

clientCertificate:Certificate: the effective client certificate (may be an empty chain).

notifyClientVersion	back to summary
public void notifyClientVersion(ProtocolVersion clientVersion) throws IOException Implements org.bouncycastle.tls.TlsServer.notifyClientVersion.

notifyFallback	back to summary
public void notifyFallback(boolean isFallback) throws IOException Implements org.bouncycastle.tls.TlsServer.notifyFallback.

notifyHandshakeBeginning

back to summary

public void notifyHandshakeBeginning() throws IOException

Overrides org.bouncycastle.tls.AbstractTlsPeer.notifyHandshakeBeginning.

Implements org.bouncycastle.tls.TlsPeer.notifyHandshakeBeginning.

Doc from org.bouncycastle.tls.TlsPeer.notifyHandshakeBeginning.

Notifies the peer that a new handshake is about to begin.

notifyOfferedCipherSuites	back to summary
public void notifyOfferedCipherSuites(int[] offeredCipherSuites) throws IOException Implements org.bouncycastle.tls.TlsServer.notifyOfferedCipherSuites.

notifySession	back to summary
public void notifySession(TlsSession session) Implements org.bouncycastle.tls.TlsServer.notifySession.

preferLocalCipherSuites	back to summary
protected boolean preferLocalCipherSuites()

preferLocalClientCertificateTypes	back to summary
protected boolean preferLocalClientCertificateTypes()

processClientExtensions	back to summary
public void processClientExtensions(Hashtable<K, V> clientExtensions) throws IOException Implements org.bouncycastle.tls.TlsServer.processClientExtensions.

processClientSupplementalData	back to summary
public void processClientSupplementalData(Vector<E> clientSupplementalData) throws IOException Implements org.bouncycastle.tls.TlsServer.processClientSupplementalData.

selectCipherSuite	back to summary
protected boolean selectCipherSuite(int cipherSuite) throws IOException

selectDH	back to summary
protected int selectDH(int minimumFiniteFieldBits)

selectDHDefault	back to summary
protected int selectDHDefault(int minimumFiniteFieldBits)

selectECDH	back to summary
protected int selectECDH(int minimumCurveBits)

selectECDHDefault	back to summary
protected int selectECDHDefault(int minimumCurveBits)

selectProtocolName	back to summary
protected ProtocolName selectProtocolName() throws IOException

selectProtocolName	back to summary
protected ProtocolName selectProtocolName(Vector<E> clientProtocolNames, Vector<E> serverProtocolNames)

shouldSelectProtocolNameEarly	back to summary
protected boolean shouldSelectProtocolNameEarly()

public abstract Class AbstractTlsServer

Field Summary

Constructor Summary

Method Summary

Field Detail

Constructor Detail

Method Detail