org.apache.tomcat.jni.SSLExt Maven / Gradle / Ivy
/*
* Licensed to the Apache Software Foundation (ASF) under one or more
* contributor license agreements. See the NOTICE file distributed with
* this work for additional information regarding copyright ownership.
* The ASF licenses this file to You under the Apache License, Version 2.0
* (the "License"); you may not use this file except in compliance with
* the License. You may obtain a copy of the License at
*
* http://www.apache.org/licenses/LICENSE-2.0
*
* Unless required by applicable law or agreed to in writing, software
* distributed under the License is distributed on an "AS IS" BASIS,
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
* See the License for the specific language governing permissions and
* limitations under the License.
*/
package org.apache.tomcat.jni;
/**
* Support TLS extensions and extra methods.
*
* The methods are separated to make it easier for java code to
* support existing native library - it can check if this class can
* be loaded in order to use the exensions.
*
* @author Costin Manolache
*/
public final class SSLExt {
/**
* Set advertised NPN protocol.
* This is only available for recent or patched openssl.
*
* Example: "\x06spdy/2"
*
* Works with TLS1, doesn't with SSL2/SSL3
*
* Servers sends list in ServerHelo, client selects it and
* sends it back after ChangeChipher
*
* Not supported in 1.0.0, seems to be in 1.0.1 and after
*/
public static native int setNPN(long tcctx, byte[] proto, int len);
/**
* Get other side's advertised protocols.
* Only works after handshake.
*/
public static native int getNPN(long tcsock, byte[] proto);
/**
* Enabling dump/debugging on the socket. Both raw and decrypted
* packets will be logged.
*/
public static native int debug(long tcsock);
/**
* Server: Extract the session data associated with the socket.
* Must be saved, keyed by session ID.
*/
public static native byte[] getSessionData(long tcsock);
/**
* Server: Set the session data for a socket.
*/
public static native int setSessionData(long tcsock, byte[] data, int len);
/**
* Client: get the ticket received from server, if tickets are supported.
*/
public static native int getTicket(long tcsock, byte[] resBuf);
/**
* Client: set the previously received ticket.
*/
public static native int setTicket(long tcsock, byte[] data, int len);
/**
* Set the key used by server to generate tickets.
* Key must be 48 bytes.
*/
public static native int setTicketKeys(long ctx, byte[] data, int len);
/**
* For client side calls. Data should be a \0 terminated string
*/
public static native int setSNI(long tcsock, byte[] data, int len);
/**
* Return the last openssl error
*/
public static native String sslErrReasonErrorString();
public static native long sslCtxSetMode(long ctx, long mode);
/* Allow SSL_write(..., n) to return r with 0 < r < n (i.e. report success
* when just a single record has been written): */
public static final int SSL_MODE_ENABLE_PARTIAL_WRITE = 0x1;
/* Make it possible to retry SSL_write() with changed buffer location
* (buffer contents must stay the same!); this is not the default to avoid
* the misconception that non-blocking SSL_write() behaves like
* non-blocking write(): */
public static final int SSL_MODE_ACCEPT_MOVING_WRITE_BUFFER = 0x2;
/* Don't attempt to automatically build certificate chain */
static final int SSL_MODE_NO_AUTO_CHAIN = 0x8;
/* Save RAM by releasing read and write buffers when they're empty. (SSL3 and
* TLS only.) "Released" buffers are put onto a free-list in the context
* or just freed (depending on the context's setting for freelist_max_len). */
public static final int SSL_MODE_RELEASE_BUFFERS = 0x10;
// 1.1
//static final int SSL_MODE_HANDSHAKE_CUTTHROUGH = ..;
/**
* SSL_set_mode
*/
public static native long sslSetMode(long tcsock, long mode);
public static int setNPN(long sslContext, byte[] spdyNPN) {
try {
return SSLExt.setNPN(sslContext, spdyNPN, spdyNPN.length);
} catch (Throwable t) {
t.printStackTrace();
return -1;
}
}
/**
* Higher level method, checking if the specified protocol has been
* negotiated.
*/
public static boolean checkNPN(long tcsocket, byte[] expected) {
byte[] npn = new byte[expected.length + 1];
int npnLen = 0;
try {
npnLen = SSLExt.getNPN(tcsocket, npn);
if (npnLen != expected.length) {
return false;
}
} catch (Throwable t) {
// ignore
return false;
}
for (int i = 0; i < expected.length; i++) {
if (expected[i] != npn[i]) {
return false;
}
}
return true;
}
}