Modifier and Type	Class and Description
private class	SslSocketConnector.CachedInfo Simple bundle of information that is cached in the SSLSession.
public class	SslSocketConnector.SslConnection

Field Summary

Modifier and Type	Field and Description
private boolean	_allowRenegotiate
private String[]	_excludeCipherSuites Default value for the cipher Suites.
private int	_handshakeTimeout
private transient Password	_keyPassword
private String	_keystore Default value for the keystore location path.
private String	_keystoreType
private boolean	_needClientAuth Set to true if we require client certificate authentication.
private transient Password	_password
private String	_protocol
private String	_provider
private String	_secureRandomAlgorithm
private String	_sslKeyManagerFactoryAlgorithm
private String	_sslTrustManagerFactoryAlgorithm
private transient Password	_trustPassword
private String	_truststore
private String	_truststoreType
private boolean	_wantClientAuth Set to true if we would like client certificate authentication.
pack-priv static final String	CACHED_INFO_ATTR The name of the SSLSession attribute that will contain any cached information.
public static final String	DEFAULT_KEYSTORE Default value for the keystore location path.
public static final String	KEYPASSWORD_PROPERTY String name of key password property.
public static final String	PASSWORD_PROPERTY String name of keystore password property.

Inherited from org.mortbay.jetty.bio.SocketConnector:: _connections _serverSocket

Constructor Summary

Access	Constructor and Description
public	SslSocketConnector() Constructor.

Method Summary

Modifier and Type	Method and Description
public void	accept(int acceptorID) Overrides org.mortbay.jetty.bio.SocketConnector.accept.
protected void	configure(Socket socket) Overrides org.mortbay.jetty.AbstractConnector.configure.
protected SSLServerSocketFactory	createFactory()
public void	customize(EndPoint The Socket the request arrived on. This should be a `SocketEndPoint` wrapping a `SSLSocket`. endpoint, Request HttpRequest to be customised. request) Overrides org.mortbay.jetty.bio.SocketConnector.customize. Implements org.mortbay.jetty.Connector.customize. Allow the Listener a chance to customise the request.
private static X509Certificate[]	Returns: the chain of java.security.cert.X509Certificates used to negotiate the SSL connection. Will be null if the chain is missing or empty. getCertChain(SSLSession the javax.net.ssl.SSLSession to use as the source of the cert chain. sslSession) Return the chain of X509 certificates used to negotiate the SSL Session.
public String[]	getExcludeCipherSuites()
public int	getHandshakeTimeout()
public String	getKeystore()
public String	getKeystoreType()
public boolean	getNeedClientAuth()
public String	getProtocol()
public String	getProvider()
public String	getSecureRandomAlgorithm()
public String	getSslKeyManagerFactoryAlgorithm()
public String	getSslTrustManagerFactoryAlgorithm()
public String	getTruststore()
public String	getTruststoreType()
public boolean	getWantClientAuth()
public boolean	Returns: True if SSL re-negotiation is allowed (default false) isAllowRenegotiate()
public boolean	isConfidential(Request A request request) Overrides org.mortbay.jetty.AbstractConnector.isConfidential. Implements org.mortbay.jetty.Connector.isConfidential. By default, we're confidential, given we speak SSL.
public boolean	isIntegral(Request A request request) Overrides org.mortbay.jetty.AbstractConnector.isIntegral. Implements org.mortbay.jetty.Connector.isIntegral. By default, we're integral, given we speak SSL.
protected ServerSocket	Returns: A new `socket object` bound to the supplied address with all other settings as per the current configuration of this connector. newServerSocket(String The `address` that this server should listen on host, int port, int See `ServerSocket#bind(java.net.SocketAddress, int)` backlog) Overrides org.mortbay.jetty.bio.SocketConnector.newServerSocket.
public void	setAllowRenegotiate(boolean true if re-negotiation is allowed (default false) allowRenegotiate) Set if SSL re-negotiation is allowed.
public void	setExcludeCipherSuites(String[] cipherSuites)
public void	setHandshakeTimeout(int a non-zero value will be used to set so_timeout during ssl handshakes. A zero value means the maxIdleTime is used instead. msec) Set the time in milliseconds for so_timeout during ssl handshaking
public void	setKeyPassword(String password)
public void	setKeystore(String The resource path to the keystore, or null for built in keystores. keystore)
public void	setKeystoreType(String keystoreType)
public void	setNeedClientAuth(boolean true iff we require client certificate authentication. needClientAuth) Set the value of the needClientAuth property
public void	setPassword(String password)
public void	setProtocol(String protocol)
public void	setProvider(String _provider)
public void	setSecureRandomAlgorithm(String algorithm)
public void	setSslKeyManagerFactoryAlgorithm(String algorithm)
public void	setSslTrustManagerFactoryAlgorithm(String algorithm)
public void	setTrustPassword(String password)
public void	setTruststore(String truststore)
public void	setTruststoreType(String truststoreType)
public void	setWantClientAuth(boolean true iff we want client certificate authentication. wantClientAuth) Set the value of the _wantClientAuth property.

Inherited from org.mortbay.jetty.bio.SocketConnector:: close doStart doStop getConnection getLocalPort newBuffer newHttpConnection open

Field Detail

_allowRenegotiate	back to summary
private boolean _allowRenegotiate

_excludeCipherSuites	back to summary
private String[] _excludeCipherSuites Default value for the cipher Suites.

_handshakeTimeout	back to summary
private int _handshakeTimeout

_keyPassword	back to summary
private transient Password _keyPassword

_keystore	back to summary
private String _keystore Default value for the keystore location path.

_keystoreType	back to summary
private String _keystoreType

_needClientAuth	back to summary
private boolean _needClientAuth Set to true if we require client certificate authentication.

_password	back to summary
private transient Password _password

_protocol	back to summary
private String _protocol

_provider	back to summary
private String _provider

_secureRandomAlgorithm	back to summary
private String _secureRandomAlgorithm

_sslKeyManagerFactoryAlgorithm	back to summary
private String _sslKeyManagerFactoryAlgorithm

_sslTrustManagerFactoryAlgorithm	back to summary
private String _sslTrustManagerFactoryAlgorithm

_trustPassword	back to summary
private transient Password _trustPassword

_truststore	back to summary
private String _truststore

_truststoreType	back to summary
private String _truststoreType

_wantClientAuth	back to summary
private boolean _wantClientAuth Set to true if we would like client certificate authentication.

CACHED_INFO_ATTR	back to summary
pack-priv static final String CACHED_INFO_ATTR The name of the SSLSession attribute that will contain any cached information.

DEFAULT_KEYSTORE	back to summary
public static final String DEFAULT_KEYSTORE Default value for the keystore location path.

KEYPASSWORD_PROPERTY	back to summary
public static final String KEYPASSWORD_PROPERTY String name of key password property.

PASSWORD_PROPERTY	back to summary
public static final String PASSWORD_PROPERTY String name of keystore password property.

Constructor Detail

SslSocketConnector	back to summary
public SslSocketConnector() Constructor.

Method Detail

accept	back to summary
public void accept(int acceptorID) throws IOException, InterruptedException Overrides org.mortbay.jetty.bio.SocketConnector.accept.

configure	back to summary
protected void configure(Socket socket) throws IOException Overrides org.mortbay.jetty.AbstractConnector.configure.

createFactory	back to summary
protected SSLServerSocketFactory createFactory() throws Exception

customize back to summary

customize	back to summary
public void customize(EndPoint endpoint, Request request) throws IOException Overrides org.mortbay.jetty.bio.SocketConnector.customize. Implements org.mortbay.jetty.Connector.customize. Allow the Listener a chance to customise the request. before the server does its stuff. This allows the required attributes to be set for SSL requests. The requirements of the Servlet specs are: an attribute named "javax.servlet.request.cipher_suite" of type String. an attribute named "javax.servlet.request.key_size" of type Integer. an attribute named "javax.servlet.request.X509Certificate" of type java.security.cert.X509Certificate[]. This is an array of objects of type X509Certificate, the order of this array is defined as being in ascending order of trust. The first certificate in the chain is the one set by the client, the next is the one used to authenticate the first, and so on. Parameters endpoint:EndPoint The Socket the request arrived on. This should be a `SocketEndPoint` wrapping a `SSLSocket`. request:Request HttpRequest to be customised.

public void customize(EndPoint endpoint, Request request) throws IOException

Overrides org.mortbay.jetty.bio.SocketConnector.customize.

Implements org.mortbay.jetty.Connector.customize.

Allow the Listener a chance to customise the request. before the server does its stuff.
This allows the required attributes to be set for SSL requests.
The requirements of the Servlet specs are:

an attribute named "javax.servlet.request.cipher_suite" of type String.
an attribute named "javax.servlet.request.key_size" of type Integer.
an attribute named "javax.servlet.request.X509Certificate" of type java.security.cert.X509Certificate[]. This is an array of objects of type X509Certificate, the order of this array is defined as being in ascending order of trust. The first certificate in the chain is the one set by the client, the next is the one used to authenticate the first, and so on.

Parameters

endpoint:EndPoint: The Socket the request arrived on. This should be a SocketEndPoint wrapping a SSLSocket.
request:Request: HttpRequest to be customised.

getCertChain	back to summary
private static X509Certificate[] getCertChain(SSLSession sslSession) Return the chain of X509 certificates used to negotiate the SSL Session. Note in order to do this we must convert a javax.security.cert.X509Certificate[], as used by JSSE to a java.security.cert.X509Certificate[],as required by the Servlet specs. Parameters sslSession:SSLSession the javax.net.ssl.SSLSession to use as the source of the cert chain. Returns:X509Certificate[] the chain of java.security.cert.X509Certificates used to negotiate the SSL connection. Will be null if the chain is missing or empty.

getCertChain

back to summary

private static X509Certificate[] getCertChain(SSLSession sslSession)

Return the chain of X509 certificates used to negotiate the SSL Session.

Note

in order to do this we must convert a javax.security.cert.X509Certificate[], as used by JSSE to a java.security.cert.X509Certificate[],as required by the Servlet specs.

Parameters

sslSession:SSLSession: the javax.net.ssl.SSLSession to use as the source of the cert chain.

Returns:X509Certificate[]

the chain of java.security.cert.X509Certificates used to negotiate the SSL connection.
Will be null if the chain is missing or empty.

getExcludeCipherSuites	back to summary
public String[] getExcludeCipherSuites()

getHandshakeTimeout	back to summary
public int getHandshakeTimeout()

getKeystore	back to summary
public String getKeystore()

getKeystoreType	back to summary
public String getKeystoreType()

getNeedClientAuth	back to summary
public boolean getNeedClientAuth()

getProtocol	back to summary
public String getProtocol()

getProvider	back to summary
public String getProvider()

getSecureRandomAlgorithm	back to summary
public String getSecureRandomAlgorithm()

getSslKeyManagerFactoryAlgorithm	back to summary
public String getSslKeyManagerFactoryAlgorithm()

getSslTrustManagerFactoryAlgorithm	back to summary
public String getSslTrustManagerFactoryAlgorithm()

getTruststore	back to summary
public String getTruststore()

getTruststoreType	back to summary
public String getTruststoreType()

getWantClientAuth	back to summary
public boolean getWantClientAuth()

isAllowRenegotiate	back to summary
public boolean isAllowRenegotiate() Returns:boolean True if SSL re-negotiation is allowed (default false)

isConfidential	back to summary
public boolean isConfidential(Request request) Overrides org.mortbay.jetty.AbstractConnector.isConfidential. Implements org.mortbay.jetty.Connector.isConfidential. By default, we're confidential, given we speak SSL. But, if we've been told about an confidential port, and said port is not our port, then we're not. This allows separation of listeners providing INTEGRAL versus CONFIDENTIAL constraints, such as one SSL listener configured to require client certs providing CONFIDENTIAL, whereas another SSL listener not requiring client certs providing mere INTEGRAL constraints. Parameters request:Request Doc from org.mortbay.jetty.Connector.isConfidential. A request Returns:boolean Doc from org.mortbay.jetty.Connector.isConfidential. true if the request is confidential. This normally means the https schema has been used.

isConfidential

back to summary

public boolean isConfidential(Request request)

Overrides org.mortbay.jetty.AbstractConnector.isConfidential.

Implements org.mortbay.jetty.Connector.isConfidential.

By default, we're confidential, given we speak SSL. But, if we've been told about an confidential port, and said port is not our port, then we're not. This allows separation of listeners providing INTEGRAL versus CONFIDENTIAL constraints, such as one SSL listener configured to require client certs providing CONFIDENTIAL, whereas another SSL listener not requiring client certs providing mere INTEGRAL constraints.

Parameters

request:Request

Doc from org.mortbay.jetty.Connector.isConfidential.

A request

Returns:boolean

Doc from org.mortbay.jetty.Connector.isConfidential.

true if the request is confidential. This normally means the https schema has been used.

isIntegral	back to summary
public boolean isIntegral(Request request) Overrides org.mortbay.jetty.AbstractConnector.isIntegral. Implements org.mortbay.jetty.Connector.isIntegral. By default, we're integral, given we speak SSL. But, if we've been told about an integral port, and said port is not our port, then we're not. This allows separation of listeners providing INTEGRAL versus CONFIDENTIAL constraints, such as one SSL listener configured to require client certs providing CONFIDENTIAL, whereas another SSL listener not requiring client certs providing mere INTEGRAL constraints. Parameters request:Request Doc from org.mortbay.jetty.Connector.isIntegral. A request Returns:boolean Doc from org.mortbay.jetty.Connector.isIntegral. true if the request is integral. This normally means the https schema has been used.

isIntegral

back to summary

public boolean isIntegral(Request request)

Overrides org.mortbay.jetty.AbstractConnector.isIntegral.

Implements org.mortbay.jetty.Connector.isIntegral.

By default, we're integral, given we speak SSL. But, if we've been told about an integral port, and said port is not our port, then we're not. This allows separation of listeners providing INTEGRAL versus CONFIDENTIAL constraints, such as one SSL listener configured to require client certs providing CONFIDENTIAL, whereas another SSL listener not requiring client certs providing mere INTEGRAL constraints.

Parameters

request:Request

Doc from org.mortbay.jetty.Connector.isIntegral.

A request

Returns:boolean

Doc from org.mortbay.jetty.Connector.isIntegral.

true if the request is integral. This normally means the https schema has been used.

newServerSocket back to summary

newServerSocket	back to summary
protected ServerSocket newServerSocket(String host, int port, int backlog) throws IOException Overrides org.mortbay.jetty.bio.SocketConnector.newServerSocket. Parameters host:String The `address` that this server should listen on backlog:int See `ServerSocket#bind(java.net.SocketAddress, int)` Returns:ServerSocket A new `socket object` bound to the supplied address with all other settings as per the current configuration of this connector. See Also `setWantClientAuth`, `setNeedClientAuth`, `setCipherSuites`

protected ServerSocket newServerSocket(String host, int port, int backlog) throws IOException

Overrides org.mortbay.jetty.bio.SocketConnector.newServerSocket.

Parameters

host:String: The address that this server should listen on
backlog:int: See ServerSocket#bind(java.net.SocketAddress, int)

Returns:ServerSocket

A new socket object bound to the supplied address with all other settings as per the current configuration of this connector.

setAllowRenegotiate	back to summary
public void setAllowRenegotiate(boolean allowRenegotiate) Set if SSL re-negotiation is allowed. CVE-2009-3555 discovered a vulnerability in SSL/TLS with re-negotiation. If your JVM does not have CVE-2009-3555 fixed, then re-negotiation should not be allowed. Parameters allowRenegotiate:boolean true if re-negotiation is allowed (default false)

setAllowRenegotiate

back to summary

public void setAllowRenegotiate(boolean allowRenegotiate)

Set if SSL re-negotiation is allowed. CVE-2009-3555 discovered a vulnerability in SSL/TLS with re-negotiation. If your JVM does not have CVE-2009-3555 fixed, then re-negotiation should not be allowed.

Parameters

allowRenegotiate:boolean: true if re-negotiation is allowed (default false)

setExcludeCipherSuites	back to summary
public void setExcludeCipherSuites(String[] cipherSuites) Author Tony Jiang

setHandshakeTimeout

back to summary

public void setHandshakeTimeout(int msec)

Set the time in milliseconds for so_timeout during ssl handshaking

Parameters

msec:int: a non-zero value will be used to set so_timeout during ssl handshakes. A zero value means the maxIdleTime is used instead.

setKeyPassword	back to summary
public void setKeyPassword(String password)

setKeystore	back to summary
public void setKeystore(String keystore) Parameters keystore:String The resource path to the keystore, or null for built in keystores.

setKeystoreType	back to summary
public void setKeystoreType(String keystoreType)

setNeedClientAuth

back to summary

public void setNeedClientAuth(boolean needClientAuth)

Set the value of the needClientAuth property

Parameters

needClientAuth:boolean: true iff we require client certificate authentication.

setPassword	back to summary
public void setPassword(String password)

setProtocol	back to summary
public void setProtocol(String protocol)

setProvider	back to summary
public void setProvider(String _provider)

setSecureRandomAlgorithm	back to summary
public void setSecureRandomAlgorithm(String algorithm)

setSslKeyManagerFactoryAlgorithm	back to summary
public void setSslKeyManagerFactoryAlgorithm(String algorithm)

setSslTrustManagerFactoryAlgorithm	back to summary
public void setSslTrustManagerFactoryAlgorithm(String algorithm)

setTrustPassword	back to summary
public void setTrustPassword(String password)

setTruststore	back to summary
public void setTruststore(String truststore)

setTruststoreType	back to summary
public void setTruststoreType(String truststoreType)

setWantClientAuth back to summary

public void setWantClientAuth(boolean wantClientAuth)

Set the value of the _wantClientAuth property. This property is used when opening server sockets.

Parameters

wantClientAuth:boolean: true iff we want client certificate authentication.

See Also

SSLServerSocket#setWantClientAuth

org.mortbay.jetty.security back to summary

private Class SslSocketConnector.CachedInfo

Class Inheritance

extends Object

java.lang.Object
org.mortbay.jetty.security.SslSocketConnector.CachedInfo

Simple bundle of information that is cached in the SSLSession. Stores the effective keySize and the client certificate chain.

Field Summary

Modifier and Type	Field and Description
private X509Certificate[]	_certs
private Integer	_keySize

Constructor Summary

Access	Constructor and Description
pack-priv	CachedInfo(Integer keySize, X509Certificate[] certs)

Method Summary

Modifier and Type	Method and Description
pack-priv X509Certificate[]	getCerts()
pack-priv Integer	getKeySize()

Inherited from java.lang.Object:: clone equals finalize getClass hashCode notify notifyAll toString wait wait wait

Field Detail

_certs	back to summary
private X509Certificate[] _certs

_keySize	back to summary
private Integer _keySize

Constructor Detail

CachedInfo	back to summary
pack-priv CachedInfo(Integer keySize, X509Certificate[] certs)

Method Detail

getCerts	back to summary
pack-priv X509Certificate[] getCerts()

getKeySize	back to summary
pack-priv Integer getKeySize()

org.mortbay.jetty.security back to summary

public Class SslSocketConnector.SslConnection

Class Inheritance

extends Connection

java.lang.Object
org.mortbay.io.bio.StreamEndPoint
org.mortbay.io.bio.SocketEndPoint
org.mortbay.jetty.bio.SocketConnector.Connection
org.mortbay.jetty.security.SslSocketConnector.SslConnection

Field Summary

Inherited from org.mortbay.jetty.bio.SocketConnector.Connection:: _socket

Constructor Summary

Access	Constructor and Description
public	SslConnection(Socket socket)

Method Summary

Modifier and Type	Method and Description
public void	run() Overrides org.mortbay.jetty.bio.SocketConnector.Connection.run. Implements java.lang.Runnable.run. Runs this operation.
public void	shutdownOutput() Overrides org.mortbay.io.bio.SocketEndPoint.shutdownOutput. Implements org.mortbay.io.EndPoint.shutdownOutput. Shutdown any backing output stream associated with the endpoint

Inherited from org.mortbay.jetty.bio.SocketConnector.Connection:: dispatch fill

Constructor Detail

SslConnection	back to summary
public SslConnection(Socket socket) throws IOException

Method Detail

run

back to summary

public void run()

Overrides org.mortbay.jetty.bio.SocketConnector.Connection.run.

Implements java.lang.Runnable.run.

Doc from java.lang.Runnable.run.

Runs this operation.

shutdownOutput

back to summary

public void shutdownOutput() throws IOException

Overrides org.mortbay.io.bio.SocketEndPoint.shutdownOutput.

Implements org.mortbay.io.EndPoint.shutdownOutput.

Doc from org.mortbay.io.EndPoint.shutdownOutput.

Shutdown any backing output stream associated with the endpoint

public Class SslSocketConnector

Nested and Inner Type Summary

Field Summary

Constructor Summary

Method Summary

Field Detail

Constructor Detail

Method Detail

private Class SslSocketConnector.CachedInfo

Field Summary

Constructor Summary

Method Summary

Field Detail

Constructor Detail

Method Detail

public Class SslSocketConnector.SslConnection

Field Summary

Constructor Summary

Method Summary

Constructor Detail

Method Detail