Java Code Examples for javax.net.ssl.SSLSession#invalidate()

public SslTcpConnectorHandshaker(
    SslTcpConnectorPeer peerRef,
    SSLEngine sslEngine,
    HandshakeFinishedListener... finishedListenersRef
)
{
    SSLSession session = sslEngine.getSession();
    myAppData = ByteBuffer.allocate(session.getApplicationBufferSize() * 2);
    myNetData = ByteBuffer.allocate(session.getPacketBufferSize() * 2);
    peerAppData = ByteBuffer.allocate(session.getApplicationBufferSize() * 2);
    peerNetData = ByteBuffer.allocate(session.getPacketBufferSize() * 2);
    session.invalidate();

    peer = peerRef;
    finishedListeners = finishedListenersRef;
}
 

/**
 * Checks the validity of an SSLSession's master secret. Should be run within a doPrivileged
 * block
 */
private boolean privilegedIsMasterSecretValid(final Socket socket) {
    if (socket instanceof SSLSocket) {
        SSLSession session = getSslSession(socket);
        if (session != null) {
            String className = session.getClass().getName();
            if ("sun.security.ssl.SSLSessionImpl".equals(className)) {
                try {
                    Object masterSecret = getMasterSecret(session, className);
                    if (masterSecret == null) {
                        session.invalidate();
                        if (LOG.isDebugEnabled()) {
                            LOG.debug("Invalidated session " + session);
                        }
                        return false;
                    }
                } catch (Exception e) {
                    failedToVerifyMasterSecret(e);
                }
            }
        }
    }
    return true;

}
 

/**
 * Invalidates all SSL/TLS sessions in {@code sessionContext} associated with {@code remoteAddress}.
 *
 * @param sessionContext collection of SSL/TLS sessions to be (potentially) invalidated
 * @param remoteAddress  associated with sessions to invalidate
 */
private void clearSessionCache(final SSLSessionContext sessionContext, final InetSocketAddress remoteAddress) {
    final String hostName = remoteAddress.getHostName();
    final int port = remoteAddress.getPort();
    final Enumeration<byte[]> ids = sessionContext.getIds();

    if (ids == null) {
        return;
    }

    while (ids.hasMoreElements()) {
        final byte[] id = ids.nextElement();
        final SSLSession session = sessionContext.getSession(id);
        if (session != null && session.getPeerHost() != null && session.getPeerHost().equalsIgnoreCase(hostName)
                && session.getPeerPort() == port) {
            session.invalidate();
            if (LOG.isDebugEnabled()) {
                LOG.debug("Invalidated session " + session);
            }
        }
    }
}
 

boolean isTimedout(SSLSession sess) {
    if (timeout == 0) {
        return false;
    }

    if ((sess != null) && ((sess.getCreationTime() + timeout * 1000L)
                                    <= (System.currentTimeMillis()))) {
        sess.invalidate();
        return true;
    }

    return false;
}
 

private boolean isTimedout(SSLSession sess) {
    if (timeout == 0) {
        return false;
    }

    if ((sess != null) && ((sess.getCreationTime() + timeout * 1000L)
                                    <= (System.currentTimeMillis()))) {
        sess.invalidate();
        return true;
    }

    return false;
}
 

boolean isTimedout(SSLSession sess) {
    if (timeout == 0) {
        return false;
    }

    if ((sess != null) && ((sess.getCreationTime() + timeout * 1000L)
                                    <= (System.currentTimeMillis()))) {
        sess.invalidate();
        return true;
    }

    return false;
}
 

boolean isTimedout(SSLSession sess) {
    if (timeout == 0) {
        return false;
    }

    if ((sess != null) && ((sess.getCreationTime() + timeout * 1000L)
                                    <= (System.currentTimeMillis()))) {
        sess.invalidate();
        return true;
    }

    return false;
}
 

boolean isTimedout(SSLSession sess) {
    if (timeout == 0) {
        return false;
    }

    if ((sess != null) && ((sess.getCreationTime() + timeout * 1000L)
                                    <= (System.currentTimeMillis()))) {
        sess.invalidate();
        return true;
    }

    return false;
}
 

boolean isTimedout(SSLSession sess) {
    if (timeout == 0) {
        return false;
    }

    if ((sess != null) && ((sess.getCreationTime() + timeout * 1000L)
                                    <= (System.currentTimeMillis()))) {
        sess.invalidate();
        return true;
    }

    return false;
}
 

boolean isTimedout(SSLSession sess) {
    if (timeout == 0) {
        return false;
    }

    if ((sess != null) && ((sess.getCreationTime() + timeout * 1000L)
                                    <= (System.currentTimeMillis()))) {
        sess.invalidate();
        return true;
    }

    return false;
}
 

private boolean isTimedout(SSLSession sess) {
    if (timeout == 0) {
        return false;
    }

    if ((sess != null) && ((sess.getCreationTime() + timeout * 1000L)
                                    <= (System.currentTimeMillis()))) {
        sess.invalidate();
        return true;
    }

    return false;
}
 

boolean isTimedout(SSLSession sess) {
    if (timeout == 0) {
        return false;
    }

    if ((sess != null) && ((sess.getCreationTime() + timeout * 1000L)
                                    <= (System.currentTimeMillis()))) {
        sess.invalidate();
        return true;
    }

    return false;
}
 

boolean isTimedout(SSLSession sess) {
    if (timeout == 0) {
        return false;
    }

    if ((sess != null) && ((sess.getCreationTime() + timeout * 1000L)
                                    <= (System.currentTimeMillis()))) {
        sess.invalidate();
        return true;
    }

    return false;
}
 

boolean isTimedout(SSLSession sess) {
    if (timeout == 0) {
        return false;
    }

    if ((sess != null) && ((sess.getCreationTime() + timeout * 1000L)
                                    <= (System.currentTimeMillis()))) {
        sess.invalidate();
        return true;
    }

    return false;
}
 

/**
 * Negotiates a TLS session using an SSL socket factory.
 * <p>
 * Creates an SSL socket using the supplied SSL socket factory and
 * attaches it to the existing connection. Performs the TLS handshake
 * and returns the negotiated session information.
 * <p>
 * If cipher suites have been set via <tt>setEnabledCipherSuites</tt>
 * then they are enabled before the TLS handshake begins.
 * <p>
 * Hostname verification is performed after the TLS handshake completes.
 * The default check performs a case insensitive match of the server's
 * hostname against that in the server's certificate. The server's
 * hostname is extracted from the subjectAltName in the server's
 * certificate (if present). Otherwise the value of the common name
 * attribute of the subject name is used. If a callback has
 * been set via <tt>setHostnameVerifier</tt> then that verifier is used if
 * the default check fails.
 * <p>
 * If an error occurs then the SSL socket is closed and an IOException
 * is thrown. The underlying connection remains intact.
 *
 * @param factory The possibly null SSL socket factory to use.
 * If null, the default SSL socket factory is used.
 * @return The negotiated SSL session
 * @throw IOException If an IO error was encountered while establishing
 * the TLS session.
 * @see #setEnabledCipherSuites
 * @see #setHostnameVerifier
 */
public SSLSession negotiate(SSLSocketFactory factory) throws IOException {

    if (isClosed && sslSocket != null) {
        throw new IOException("TLS connection is closed.");
    }

    if (factory == null) {
        factory = getDefaultFactory();
    }

    if (debug) {
        System.out.println("StartTLS: About to start handshake");
    }

    SSLSession sslSession = startHandshake(factory).getSession();

    if (debug) {
        System.out.println("StartTLS: Completed handshake");
    }

    SSLPeerUnverifiedException verifExcep = null;
    try {
        if (verify(hostname, sslSession)) {
            isClosed = false;
            return sslSession;
        }
    } catch (SSLPeerUnverifiedException e) {
        // Save to return the cause
        verifExcep = e;
    }
    if ((verifier != null) &&
            verifier.verify(hostname, sslSession)) {
        isClosed = false;
        return sslSession;
    }

    // Verification failed
    close();
    sslSession.invalidate();
    if (verifExcep == null) {
        verifExcep = new SSLPeerUnverifiedException(
                    "hostname of the server '" + hostname +
                    "' does not match the hostname in the " +
                    "server's certificate.");
    }
    throw verifExcep;
}
 

/**
 * Negotiates a TLS session using an SSL socket factory.
 * <p>
 * Creates an SSL socket using the supplied SSL socket factory and
 * attaches it to the existing connection. Performs the TLS handshake
 * and returns the negotiated session information.
 * <p>
 * If cipher suites have been set via <tt>setEnabledCipherSuites</tt>
 * then they are enabled before the TLS handshake begins.
 * <p>
 * Hostname verification is performed after the TLS handshake completes.
 * The default check performs a case insensitive match of the server's
 * hostname against that in the server's certificate. The server's
 * hostname is extracted from the subjectAltName in the server's
 * certificate (if present). Otherwise the value of the common name
 * attribute of the subject name is used. If a callback has
 * been set via <tt>setHostnameVerifier</tt> then that verifier is used if
 * the default check fails.
 * <p>
 * If an error occurs then the SSL socket is closed and an IOException
 * is thrown. The underlying connection remains intact.
 *
 * @param factory The possibly null SSL socket factory to use.
 * If null, the default SSL socket factory is used.
 * @return The negotiated SSL session
 * @throw IOException If an IO error was encountered while establishing
 * the TLS session.
 * @see #setEnabledCipherSuites
 * @see #setHostnameVerifier
 */
public SSLSession negotiate(SSLSocketFactory factory) throws IOException {

    if (isClosed && sslSocket != null) {
        throw new IOException("TLS connection is closed.");
    }

    if (factory == null) {
        factory = getDefaultFactory();
    }

    if (debug) {
        System.out.println("StartTLS: About to start handshake");
    }

    SSLSession sslSession = startHandshake(factory).getSession();

    if (debug) {
        System.out.println("StartTLS: Completed handshake");
    }

    SSLPeerUnverifiedException verifExcep = null;
    try {
        if (verify(hostname, sslSession)) {
            isClosed = false;
            return sslSession;
        }
    } catch (SSLPeerUnverifiedException e) {
        // Save to return the cause
        verifExcep = e;
    }
    if ((verifier != null) &&
            verifier.verify(hostname, sslSession)) {
        isClosed = false;
        return sslSession;
    }

    // Verification failed
    close();
    sslSession.invalidate();
    if (verifExcep == null) {
        verifExcep = new SSLPeerUnverifiedException(
                    "hostname of the server '" + hostname +
                    "' does not match the hostname in the " +
                    "server's certificate.");
    }
    throw verifExcep;
}
 

/**
 * Negotiates a TLS session using an SSL socket factory.
 * <p>
 * Creates an SSL socket using the supplied SSL socket factory and
 * attaches it to the existing connection. Performs the TLS handshake
 * and returns the negotiated session information.
 * <p>
 * If cipher suites have been set via <tt>setEnabledCipherSuites</tt>
 * then they are enabled before the TLS handshake begins.
 * <p>
 * Hostname verification is performed after the TLS handshake completes.
 * The default check performs a case insensitive match of the server's
 * hostname against that in the server's certificate. The server's
 * hostname is extracted from the subjectAltName in the server's
 * certificate (if present). Otherwise the value of the common name
 * attribute of the subject name is used. If a callback has
 * been set via <tt>setHostnameVerifier</tt> then that verifier is used if
 * the default check fails.
 * <p>
 * If an error occurs then the SSL socket is closed and an IOException
 * is thrown. The underlying connection remains intact.
 *
 * @param factory The possibly null SSL socket factory to use.
 * If null, the default SSL socket factory is used.
 * @return The negotiated SSL session
 * @throw IOException If an IO error was encountered while establishing
 * the TLS session.
 * @see #setEnabledCipherSuites
 * @see #setHostnameVerifier
 */
public SSLSession negotiate(SSLSocketFactory factory) throws IOException {

    if (isClosed && sslSocket != null) {
        throw new IOException("TLS connection is closed.");
    }

    if (factory == null) {
        factory = getDefaultFactory();
    }

    if (debug) {
        System.out.println("StartTLS: About to start handshake");
    }

    SSLSession sslSession = startHandshake(factory).getSession();

    if (debug) {
        System.out.println("StartTLS: Completed handshake");
    }

    SSLPeerUnverifiedException verifExcep = null;
    try {
        if (verify(hostname, sslSession)) {
            isClosed = false;
            return sslSession;
        }
    } catch (SSLPeerUnverifiedException e) {
        // Save to return the cause
        verifExcep = e;
    }
    if ((verifier != null) &&
            verifier.verify(hostname, sslSession)) {
        isClosed = false;
        return sslSession;
    }

    // Verification failed
    close();
    sslSession.invalidate();
    if (verifExcep == null) {
        verifExcep = new SSLPeerUnverifiedException(
                    "hostname of the server '" + hostname +
                    "' does not match the hostname in the " +
                    "server's certificate.");
    }
    throw verifExcep;
}
 

/**
 * Negotiates a TLS session using an SSL socket factory.
 * <p>
 * Creates an SSL socket using the supplied SSL socket factory and
 * attaches it to the existing connection. Performs the TLS handshake
 * and returns the negotiated session information.
 * <p>
 * If cipher suites have been set via {@code setEnabledCipherSuites}
 * then they are enabled before the TLS handshake begins.
 * <p>
 * Hostname verification is performed after the TLS handshake completes.
 * The default check performs a case insensitive match of the server's
 * hostname against that in the server's certificate. The server's
 * hostname is extracted from the subjectAltName in the server's
 * certificate (if present). Otherwise the value of the common name
 * attribute of the subject name is used. If a callback has
 * been set via {@code setHostnameVerifier} then that verifier is used if
 * the default check fails.
 * <p>
 * If an error occurs then the SSL socket is closed and an IOException
 * is thrown. The underlying connection remains intact.
 *
 * @param factory The possibly null SSL socket factory to use.
 * If null, the default SSL socket factory is used.
 * @return The negotiated SSL session
 * @throws IOException If an IO error was encountered while establishing
 * the TLS session.
 * @see #setEnabledCipherSuites
 * @see #setHostnameVerifier
 */
public SSLSession negotiate(SSLSocketFactory factory) throws IOException {

    if (isClosed && sslSocket != null) {
        throw new IOException("TLS connection is closed.");
    }

    if (factory == null) {
        factory = getDefaultFactory();
    }

    if (debug) {
        System.out.println("StartTLS: About to start handshake");
    }

    SSLSession sslSession = startHandshake(factory).getSession();

    if (debug) {
        System.out.println("StartTLS: Completed handshake");
    }

    SSLPeerUnverifiedException verifExcep = null;
    try {
        if (verify(hostname, sslSession)) {
            isClosed = false;
            return sslSession;
        }
    } catch (SSLPeerUnverifiedException e) {
        // Save to return the cause
        verifExcep = e;
    }
    if ((verifier != null) &&
            verifier.verify(hostname, sslSession)) {
        isClosed = false;
        return sslSession;
    }

    // Verification failed
    close();
    sslSession.invalidate();
    if (verifExcep == null) {
        verifExcep = new SSLPeerUnverifiedException(
                    "hostname of the server '" + hostname +
                    "' does not match the hostname in the " +
                    "server's certificate.");
    }
    throw verifExcep;
}
 

/**
 * Negotiates a TLS session using an SSL socket factory.
 * <p>
 * Creates an SSL socket using the supplied SSL socket factory and
 * attaches it to the existing connection. Performs the TLS handshake
 * and returns the negotiated session information.
 * <p>
 * If cipher suites have been set via <tt>setEnabledCipherSuites</tt>
 * then they are enabled before the TLS handshake begins.
 * <p>
 * Hostname verification is performed after the TLS handshake completes.
 * The default check performs a case insensitive match of the server's
 * hostname against that in the server's certificate. The server's
 * hostname is extracted from the subjectAltName in the server's
 * certificate (if present). Otherwise the value of the common name
 * attribute of the subject name is used. If a callback has
 * been set via <tt>setHostnameVerifier</tt> then that verifier is used if
 * the default check fails.
 * <p>
 * If an error occurs then the SSL socket is closed and an IOException
 * is thrown. The underlying connection remains intact.
 *
 * @param factory The possibly null SSL socket factory to use.
 * If null, the default SSL socket factory is used.
 * @return The negotiated SSL session
 * @throw IOException If an IO error was encountered while establishing
 * the TLS session.
 * @see #setEnabledCipherSuites
 * @see #setHostnameVerifier
 */
public SSLSession negotiate(SSLSocketFactory factory) throws IOException {

    if (isClosed && sslSocket != null) {
        throw new IOException("TLS connection is closed.");
    }

    if (factory == null) {
        factory = getDefaultFactory();
    }

    if (debug) {
        System.out.println("StartTLS: About to start handshake");
    }

    SSLSession sslSession = startHandshake(factory).getSession();

    if (debug) {
        System.out.println("StartTLS: Completed handshake");
    }

    SSLPeerUnverifiedException verifExcep = null;
    try {
        if (verify(hostname, sslSession)) {
            isClosed = false;
            return sslSession;
        }
    } catch (SSLPeerUnverifiedException e) {
        // Save to return the cause
        verifExcep = e;
    }
    if ((verifier != null) &&
            verifier.verify(hostname, sslSession)) {
        isClosed = false;
        return sslSession;
    }

    // Verification failed
    close();
    sslSession.invalidate();
    if (verifExcep == null) {
        verifExcep = new SSLPeerUnverifiedException(
                    "hostname of the server '" + hostname +
                    "' does not match the hostname in the " +
                    "server's certificate.");
    }
    throw verifExcep;
}
 

/**
 * Negotiates a TLS session using an SSL socket factory.
 * <p>
 * Creates an SSL socket using the supplied SSL socket factory and
 * attaches it to the existing connection. Performs the TLS handshake
 * and returns the negotiated session information.
 * <p>
 * If cipher suites have been set via <tt>setEnabledCipherSuites</tt>
 * then they are enabled before the TLS handshake begins.
 * <p>
 * Hostname verification is performed after the TLS handshake completes.
 * The default check performs a case insensitive match of the server's
 * hostname against that in the server's certificate. The server's
 * hostname is extracted from the subjectAltName in the server's
 * certificate (if present). Otherwise the value of the common name
 * attribute of the subject name is used. If a callback has
 * been set via <tt>setHostnameVerifier</tt> then that verifier is used if
 * the default check fails.
 * <p>
 * If an error occurs then the SSL socket is closed and an IOException
 * is thrown. The underlying connection remains intact.
 *
 * @param factory The possibly null SSL socket factory to use.
 * If null, the default SSL socket factory is used.
 * @return The negotiated SSL session
 * @throw IOException If an IO error was encountered while establishing
 * the TLS session.
 * @see #setEnabledCipherSuites
 * @see #setHostnameVerifier
 */
public SSLSession negotiate(SSLSocketFactory factory) throws IOException {

    if (isClosed && sslSocket != null) {
        throw new IOException("TLS connection is closed.");
    }

    if (factory == null) {
        factory = getDefaultFactory();
    }

    if (debug) {
        System.out.println("StartTLS: About to start handshake");
    }

    SSLSession sslSession = startHandshake(factory).getSession();

    if (debug) {
        System.out.println("StartTLS: Completed handshake");
    }

    SSLPeerUnverifiedException verifExcep = null;
    try {
        if (verify(hostname, sslSession)) {
            isClosed = false;
            return sslSession;
        }
    } catch (SSLPeerUnverifiedException e) {
        // Save to return the cause
        verifExcep = e;
    }
    if ((verifier != null) &&
            verifier.verify(hostname, sslSession)) {
        isClosed = false;
        return sslSession;
    }

    // Verification failed
    close();
    sslSession.invalidate();
    if (verifExcep == null) {
        verifExcep = new SSLPeerUnverifiedException(
                    "hostname of the server '" + hostname +
                    "' does not match the hostname in the " +
                    "server's certificate.");
    }
    throw verifExcep;
}