org.jivesoftware.smack.util

Class TLSUtils

java.lang.Object

org.jivesoftware.smack.util.TLSUtils

public class TLSUtils
extends Object

Nested Class Summary

Nested Classes

Modifier and Type	Class and Description
static class	TLSUtils.AcceptAllTrustManager A X509TrustManager that doesn't validate X.509 certificates.

Field Summary

Fields

Modifier and Type	Field and Description
static String	PROTO_SSL3
static String	PROTO_TLSV1
static String	PROTO_TLSV1_1
static String	PROTO_TLSV1_2
static String	SSL
static String	TLS

Constructor Summary

Constructors

Constructor and Description
TLSUtils()

Method Summary

Modifier and Type	Method and Description
static <B extends ConnectionConfiguration.Builder<B,?>> B	acceptAllCertificates(B builder) Accept all TLS certificates.
static <B extends ConnectionConfiguration.Builder<B,?>> B	disableHostnameVerificationForTlsCertificates(B builder) Disable the hostname verification of TLS certificates.
static byte[]	getChannelBindingTlsServerEndPoint(SSLSession sslSession) Get the channel binding data for the 'tls-server-end-point' channel binding type.
static void	setEnabledProtocolsAndCiphers(SSLSocket sslSocket, String[] enabledProtocols, String[] enabledCiphers)
static <B extends ConnectionConfiguration.Builder<B,?>> B	setSSLv3AndTLSOnly(B builder) Enable only TLS and SSLv3.
static <B extends ConnectionConfiguration.Builder<B,?>> B	setTLSOnly(B builder) Enable only TLS.

Methods inherited from class java.lang.Object

clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait

Field Detail

SSL

public static final String SSL

See Also:

Constant Field Values

TLS

public static final String TLS

See Also:

Constant Field Values

PROTO_SSL3

public static final String PROTO_SSL3

See Also:

Constant Field Values

PROTO_TLSV1

public static final String PROTO_TLSV1

See Also:

Constant Field Values

PROTO_TLSV1_1

public static final String PROTO_TLSV1_1

See Also:

Constant Field Values

PROTO_TLSV1_2

public static final String PROTO_TLSV1_2

See Also:

Constant Field Values

Constructor Detail

TLSUtils

public TLSUtils()

Method Detail

setTLSOnly

public static <B extends ConnectionConfiguration.Builder<B,?>> B setTLSOnly(B builder)

Enable only TLS. Connections created with the given ConnectionConfiguration will only support TLS.

According to the Encrypted XMPP Manifesto, TLSv1.2 shall be deployed, providing fallback support for SSLv3 and TLSv1.1. This method goes one step beyond and upgrades the handshake to use TLSv1 or better. This method requires the underlying OS to support all of TLSv1.2 , 1.1 and 1.0.

Type Parameters:

B - Type of the ConnectionConfiguration builder.

Parameters:

builder - the configuration builder to apply this setting to

Returns:

the given builder

setSSLv3AndTLSOnly

public static <B extends ConnectionConfiguration.Builder<B,?>> B setSSLv3AndTLSOnly(B builder)

Enable only TLS and SSLv3. Connections created with the given ConnectionConfiguration will only support TLS and SSLv3.

According to the Encrypted XMPP Manifesto, TLSv1.2 shall be deployed, providing fallback support for SSLv3 and TLSv1.1.

Type Parameters:

B - Type of the ConnectionConfiguration builder.

Parameters:

builder - the configuration builder to apply this setting to

Returns:

the given builder

acceptAllCertificates

public static <B extends ConnectionConfiguration.Builder<B,?>> B acceptAllCertificates(B builder)
                                                                                throws NoSuchAlgorithmException,
                                                                                       KeyManagementException

Accept all TLS certificates.

Warning: Use with care. This method make the Connection use TLSUtils.AcceptAllTrustManager and essentially invalidates all security guarantees provided by TLS. Only use this method if you understand the implications.

Type Parameters:

B - Type of the ConnectionConfiguration builder.

Parameters:

builder - a connection configuration builder.

Returns:

the given builder.

Throws:

NoSuchAlgorithmException

KeyManagementException

disableHostnameVerificationForTlsCertificates

public static <B extends ConnectionConfiguration.Builder<B,?>> B disableHostnameVerificationForTlsCertificates(B builder)

Disable the hostname verification of TLS certificates.

Warning: Use with care. This disables hostname verification of TLS certificates and essentially invalidates all security guarantees provided by TLS. Only use this method if you understand the implications.

Type Parameters:

B - Type of the ConnectionConfiguration builder.

Parameters:

builder - a connection configuration builder.

Returns:

the given builder.

setEnabledProtocolsAndCiphers

public static void setEnabledProtocolsAndCiphers(SSLSocket sslSocket,
                                                 String[] enabledProtocols,
                                                 String[] enabledCiphers)
                                          throws SmackException.SecurityNotPossibleException

Throws:

SmackException.SecurityNotPossibleException

getChannelBindingTlsServerEndPoint

public static byte[] getChannelBindingTlsServerEndPoint(SSLSession sslSession)
                                                 throws SSLPeerUnverifiedException,
                                                        CertificateEncodingException,
                                                        NoSuchAlgorithmException

Get the channel binding data for the 'tls-server-end-point' channel binding type. This channel binding type is defined in RFC 5929 § 4.

Parameters:

sslSession - the SSL/TLS session from which the data should be retrieved.

Returns:

the channel binding data.

Throws:

SSLPeerUnverifiedException

CertificateEncodingException

NoSuchAlgorithmException

See Also:

RFC 5929 § 4.