- java.lang.Object
-
- net.luminis.tls.engine.impl.TlsEngineImpl
-
- net.luminis.tls.engine.impl.TlsClientEngineImpl
-
- All Implemented Interfaces:
ClientMessageProcessor,MessageProcessor,TlsClientEngine,TlsEngine,TrafficSecrets
public class TlsClientEngineImpl extends TlsEngineImpl implements TlsClientEngine, ClientMessageProcessor
-
-
Field Summary
Fields Modifier and Type Field Description static java.util.List<TlsConstants.SignatureScheme>AVAILABLE_SIGNATURES-
Fields inherited from class net.luminis.tls.engine.impl.TlsEngineImpl
algorithmMapping, privateKey, publicKey, state
-
-
Constructor Summary
Constructors Constructor Description TlsClientEngineImpl(ClientMessageSender clientMessageSender, TlsStatusEventHandler tlsStatusHandler)
-
Method Summary
All Methods Instance Methods Concrete Methods Modifier and Type Method Description voidadd(Extension extension)Adds an extension to the list of extensions to be included in the ClientHello message.voidaddExtensions(java.util.List<Extension> extensions)Adds extensions to the list of extensions to be included in the ClientHello message.voidaddSupportedCiphers(java.util.List<TlsConstants.CipherSuite> supportedCiphers)Adds ciphers to the list of the symmetric cipher options supported by the client (specifically the record protection algorithm (including secret key length) and a hash to be used with HKDF), in descending order of client preference.protected voidcheckCertificateValidity(java.util.List<java.security.cert.X509Certificate> certificates)java.util.List<NewSessionTicket>getNewSessionTickets()Returns tickets provided by the current connection.TlsConstants.CipherSuitegetSelectedCipher()Returns the selected (negotiated) cipher suite.java.util.List<java.security.cert.X509Certificate>getServerCertificateChain()Returns the server certificate chain.booleanhandshakeFinished()Returns whether the handshake has (successfully) finished.voidreceived(CertificateMessage certificateMessage, ProtectionKeysType protectedBy)voidreceived(CertificateRequestMessage certificateRequestMessage, ProtectionKeysType protectedBy)voidreceived(CertificateVerifyMessage certificateVerifyMessage, ProtectionKeysType protectedBy)voidreceived(EncryptedExtensions encryptedExtensions, ProtectionKeysType protectedBy)voidreceived(FinishedMessage finishedMessage, ProtectionKeysType protectedBy)voidreceived(NewSessionTicketMessage nst, ProtectionKeysType protectedBy)voidreceived(ServerHello serverHello, ProtectionKeysType protectedBy)Updates the (handshake) state with a received Server Hello message.voidsetClientCertificateCallback(java.util.function.Function<java.util.List<javax.security.auth.x500.X500Principal>,CertificateWithPrivateKey> callback)Set the callback to be used for selecting the client certificate (for client authentication).voidsetCompatibilityMode(boolean compatibilityMode)Sets the compatibility mode, see https://davidwong.fr/tls13/#appendix-D.4 Only for use in a TLS 1.3 context.voidsetHostnameVerifier(HostnameVerifier hostnameVerifier)Sets the hostname verifier to use for verifying the server name against the server certificate.voidsetNewSessionTicket(NewSessionTicket newSessionTicket)Add ticket to use for a new session.voidsetServerName(java.lang.String serverName)Set the name of the server that is connected; will be used in the SNI extension.voidsetTrustManager(javax.net.ssl.X509TrustManager customTrustManager)Sets the trust manager to use for verifying the server certificate.voidstartHandshake()Start TLS handshake with default parametersvoidstartHandshake(TlsConstants.NamedGroup ecCurve)Start TLS handshake with given parametersvoidstartHandshake(TlsConstants.NamedGroup ecCurve, java.util.List<TlsConstants.SignatureScheme> signatureSchemes)Start TLS handshake with given parametersprotected booleanverifySignature(byte[] signatureToVerify, TlsConstants.SignatureScheme signatureScheme, java.security.cert.Certificate certificate, byte[] transcriptHash)-
Methods inherited from class net.luminis.tls.engine.impl.TlsEngineImpl
computeFinishedVerifyData, computeSignature, generateKeys, getClientApplicationTrafficSecret, getClientEarlyTrafficSecret, getClientHandshakeTrafficSecret, getServerApplicationTrafficSecret, getServerHandshakeTrafficSecret, getSignatureAlgorithm, hashLength, keyLength, recognizedExtension
-
Methods inherited from class java.lang.Object
clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait
-
Methods inherited from interface net.luminis.tls.engine.ClientMessageProcessor
received
-
Methods inherited from interface net.luminis.tls.engine.TrafficSecrets
getClientApplicationTrafficSecret, getClientEarlyTrafficSecret, getClientHandshakeTrafficSecret, getServerApplicationTrafficSecret, getServerHandshakeTrafficSecret
-
-
-
-
Field Detail
-
AVAILABLE_SIGNATURES
public static final java.util.List<TlsConstants.SignatureScheme> AVAILABLE_SIGNATURES
-
-
Constructor Detail
-
TlsClientEngineImpl
public TlsClientEngineImpl(ClientMessageSender clientMessageSender, TlsStatusEventHandler tlsStatusHandler)
-
-
Method Detail
-
startHandshake
public void startHandshake() throws java.io.IOExceptionDescription copied from interface:TlsClientEngineStart TLS handshake with default parameters- Specified by:
startHandshakein interfaceTlsClientEngine- Throws:
java.io.IOException
-
startHandshake
public void startHandshake(TlsConstants.NamedGroup ecCurve) throws java.io.IOException
Description copied from interface:TlsClientEngineStart TLS handshake with given parameters- Specified by:
startHandshakein interfaceTlsClientEngine- Parameters:
ecCurve- the EC named group to use both for the DHE key generation (and thus for the key share extension) and (as the only supported group) in the supported group extension.- Throws:
java.io.IOException
-
startHandshake
public void startHandshake(TlsConstants.NamedGroup ecCurve, java.util.List<TlsConstants.SignatureScheme> signatureSchemes) throws java.io.IOException
Start TLS handshake with given parameters- Specified by:
startHandshakein interfaceTlsClientEngine- Parameters:
ecCurve- the EC named group to use both for the DHE key generation (and thus for the key share extension) and (as the only supported group) in the supported group extension.signatureSchemes- the signature algorithms this peer is willing to accept- Throws:
java.io.IOException
-
received
public void received(ServerHello serverHello, ProtectionKeysType protectedBy) throws MissingExtensionAlert, IllegalParameterAlert
Updates the (handshake) state with a received Server Hello message.- Specified by:
receivedin interfaceMessageProcessor- Specified by:
receivedin interfaceTlsClientEngine- Parameters:
serverHello-protectedBy-- Throws:
MissingExtensionAlertIllegalParameterAlert
-
received
public void received(EncryptedExtensions encryptedExtensions, ProtectionKeysType protectedBy) throws TlsProtocolException
- Specified by:
receivedin interfaceMessageProcessor- Specified by:
receivedin interfaceTlsClientEngine- Throws:
TlsProtocolException
-
received
public void received(CertificateMessage certificateMessage, ProtectionKeysType protectedBy) throws TlsProtocolException
- Specified by:
receivedin interfaceMessageProcessor- Specified by:
receivedin interfaceTlsClientEngine- Throws:
TlsProtocolException
-
received
public void received(CertificateVerifyMessage certificateVerifyMessage, ProtectionKeysType protectedBy) throws TlsProtocolException
- Specified by:
receivedin interfaceMessageProcessor- Specified by:
receivedin interfaceTlsClientEngine- Throws:
TlsProtocolException
-
received
public void received(FinishedMessage finishedMessage, ProtectionKeysType protectedBy) throws ErrorAlert, java.io.IOException
- Specified by:
receivedin interfaceMessageProcessor- Specified by:
receivedin interfaceTlsClientEngine- Throws:
ErrorAlertjava.io.IOException
-
received
public void received(NewSessionTicketMessage nst, ProtectionKeysType protectedBy) throws UnexpectedMessageAlert
- Specified by:
receivedin interfaceMessageProcessor- Specified by:
receivedin interfaceTlsClientEngine- Throws:
UnexpectedMessageAlert
-
received
public void received(CertificateRequestMessage certificateRequestMessage, ProtectionKeysType protectedBy) throws TlsProtocolException, java.io.IOException
- Specified by:
receivedin interfaceMessageProcessor- Specified by:
receivedin interfaceTlsClientEngine- Throws:
TlsProtocolExceptionjava.io.IOException
-
verifySignature
protected boolean verifySignature(byte[] signatureToVerify, TlsConstants.SignatureScheme signatureScheme, java.security.cert.Certificate certificate, byte[] transcriptHash) throws HandshakeFailureAlert- Throws:
HandshakeFailureAlert
-
checkCertificateValidity
protected void checkCertificateValidity(java.util.List<java.security.cert.X509Certificate> certificates) throws BadCertificateAlert- Throws:
BadCertificateAlert
-
setServerName
public void setServerName(java.lang.String serverName)
Description copied from interface:TlsClientEngineSet the name of the server that is connected; will be used in the SNI extension.- Specified by:
setServerNamein interfaceTlsClientEngine
-
setCompatibilityMode
public void setCompatibilityMode(boolean compatibilityMode)
Description copied from interface:TlsClientEngineSets the compatibility mode, see https://davidwong.fr/tls13/#appendix-D.4 Only for use in a TLS 1.3 context. Must _not_ be set for QUIC usage, see https://www.rfc-editor.org/rfc/rfc9001.html#name-prohibit-tls-middlebox-com: "A client MUST NOT request the use of the TLS 1.3 compatibility mode."- Specified by:
setCompatibilityModein interfaceTlsClientEngine
-
addSupportedCiphers
public void addSupportedCiphers(java.util.List<TlsConstants.CipherSuite> supportedCiphers)
Description copied from interface:TlsClientEngineAdds ciphers to the list of the symmetric cipher options supported by the client (specifically the record protection algorithm (including secret key length) and a hash to be used with HKDF), in descending order of client preference.- Specified by:
addSupportedCiphersin interfaceTlsClientEngine
-
addExtensions
public void addExtensions(java.util.List<Extension> extensions)
Description copied from interface:TlsClientEngineAdds extensions to the list of extensions to be included in the ClientHello message.- Specified by:
addExtensionsin interfaceTlsClientEngine
-
add
public void add(Extension extension)
Description copied from interface:TlsClientEngineAdds an extension to the list of extensions to be included in the ClientHello message.- Specified by:
addin interfaceTlsClientEngine
-
setTrustManager
public void setTrustManager(javax.net.ssl.X509TrustManager customTrustManager)
Description copied from interface:TlsClientEngineSets the trust manager to use for verifying the server certificate. If not set, the default Java trust manager is used.- Specified by:
setTrustManagerin interfaceTlsClientEngine
-
setNewSessionTicket
public void setNewSessionTicket(NewSessionTicket newSessionTicket)
Add ticket to use for a new session.- Specified by:
setNewSessionTicketin interfaceTlsClientEngine- Parameters:
newSessionTicket-
-
getSelectedCipher
public TlsConstants.CipherSuite getSelectedCipher()
Description copied from interface:TlsClientEngineReturns the selected (negotiated) cipher suite.- Specified by:
getSelectedCipherin interfaceTlsClientEngine- Specified by:
getSelectedCipherin classTlsEngineImpl- Returns:
-
getNewSessionTickets
public java.util.List<NewSessionTicket> getNewSessionTickets()
Returns tickets provided by the current connection.- Specified by:
getNewSessionTicketsin interfaceTlsClientEngine- Returns:
-
getServerCertificateChain
public java.util.List<java.security.cert.X509Certificate> getServerCertificateChain()
Description copied from interface:TlsClientEngineReturns the server certificate chain.- Specified by:
getServerCertificateChainin interfaceTlsClientEngine- Returns:
-
setHostnameVerifier
public void setHostnameVerifier(HostnameVerifier hostnameVerifier)
Description copied from interface:TlsClientEngineSets the hostname verifier to use for verifying the server name against the server certificate. If not set, the DefaultHostnameVerifier is used, which checks that - the server name equals the CN part of the certificate's subject DN, or - the server name matches one of the dnsName-type "Subject Alternative Name" entries of the certificate.- Specified by:
setHostnameVerifierin interfaceTlsClientEngine
-
handshakeFinished
public boolean handshakeFinished()
Description copied from interface:TlsClientEngineReturns whether the handshake has (successfully) finished.- Specified by:
handshakeFinishedin interfaceTlsClientEngine- Returns:
-
setClientCertificateCallback
public void setClientCertificateCallback(java.util.function.Function<java.util.List<javax.security.auth.x500.X500Principal>,CertificateWithPrivateKey> callback)
Description copied from interface:TlsClientEngineSet the callback to be used for selecting the client certificate (for client authentication).- Specified by:
setClientCertificateCallbackin interfaceTlsClientEngine
-
-