Example usage for javax.net.ssl SSLSocket getSupportedProtocols

List of usage examples for javax.net.ssl SSLSocket getSupportedProtocols

  1. HOME
  2. Java
  3. javax
  4. javax.net.ssl.*
  5. SSLSocket
  6. getSupportedProtocols

Introduction

In this page you can find the example usage for javax.net.ssl SSLSocket getSupportedProtocols.

Prototype

public abstract String[] getSupportedProtocols();

Source Link

Document

Returns the names of the protocols which could be enabled for use on an SSL connection.

Usage

From source file:net.i2p.util.I2PSSLSocketFactory.java

/**
 * Select protocols and cipher suites to be used
 * based on configured inclusion and exclusion lists
 * as well as enabled and supported protocols and cipher suites.
 *
 * Adapted from Jetty SslContextFactory.java
 *
 * @since 0.9.16/*from  w ww .  jav a 2s.com*/
 */
public static void setProtocolsAndCiphers(SSLSocket socket) {
    socket.setEnabledProtocols(selectProtocols(socket.getEnabledProtocols(), socket.getSupportedProtocols()));
    socket.setEnabledCipherSuites(
            selectCipherSuites(socket.getEnabledCipherSuites(), socket.getSupportedCipherSuites()));
}

From source file:com.ksc.http.conn.ssl.SdkTLSSocketFactory.java

/**
 * {@inheritDoc} Used to enforce the preferred TLS protocol during SSL handshake.
 *//*w w w . j  a  v a2s  . c o m*/
@Override
protected final void prepareSocket(final SSLSocket socket) {
    String[] supported = socket.getSupportedProtocols();
    String[] enabled = socket.getEnabledProtocols();
    if (LOG.isDebugEnabled()) {
        LOG.debug("socket.getSupportedProtocols(): " + Arrays.toString(supported)
                + ", socket.getEnabledProtocols(): " + Arrays.toString(enabled));
    }
    List<String> target = new ArrayList<String>();
    if (supported != null) {
        // Append the preferred protocols in descending order of preference
        // but only do so if the protocols are supported
        TLSProtocol[] values = TLSProtocol.values();
        for (int i = 0; i < values.length; i++) {
            final String pname = values[i].getProtocolName();
            if (existsIn(pname, supported)) {
                target.add(pname);
            }
        }
    }
    if (enabled != null) {
        // Append the rest of the already enabled protocols to the end
        // if not already included in the list
        for (String pname : enabled) {
            if (!target.contains(pname)) {
                target.add(pname);
            }
        }
    }
    if (target.size() > 0) {
        String[] enabling = target.toArray(new String[target.size()]);
        socket.setEnabledProtocols(enabling);
        if (LOG.isDebugEnabled()) {
            LOG.debug("TLS protocol enabled for SSL handshake: " + Arrays.toString(enabling));
        }
    }
}

From source file:com.amazonaws.http.conn.ssl.SdkTLSSocketFactory.java

/**
 * {@inheritDoc}//from  w w w  .  j a  v a 2  s  .  co  m
 * 
 * Used to enforce the preferred TLS protocol during SSL handshake.
 */
@Override
protected final void prepareSocket(final SSLSocket socket) {
    String[] supported = socket.getSupportedProtocols();
    String[] enabled = socket.getEnabledProtocols();
    if (log.isDebugEnabled()) {
        log.debug("socket.getSupportedProtocols(): " + Arrays.toString(supported)
                + ", socket.getEnabledProtocols(): " + Arrays.toString(enabled));
    }
    List<String> target = new ArrayList<String>();
    if (supported != null) {
        // Append the preferred protocols in descending order of preference
        // but only do so if the protocols are supported
        TLSProtocol[] values = TLSProtocol.values();
        for (int i = 0; i < values.length; i++) {
            final String pname = values[i].getProtocolName();
            if (existsIn(pname, supported))
                target.add(pname);
        }
    }
    if (enabled != null) {
        // Append the rest of the already enabled protocols to the end
        // if not already included in the list
        for (String pname : enabled) {
            if (!target.contains(pname))
                target.add(pname);
        }
    }
    if (target.size() > 0) {
        String[] enabling = target.toArray(new String[target.size()]);
        socket.setEnabledProtocols(enabling);
        if (log.isDebugEnabled()) {
            log.debug("TLS protocol enabled for SSL handshake: " + Arrays.toString(enabling));
        }
    }
}

From source file:org.transdroid.util.IgnoreTlsSniSocketFactory.java

@Override
@TargetApi(Build.VERSION_CODES.JELLY_BEAN_MR1)
public Socket createSocket(Socket plainSocket, String host, int port, boolean autoClose) throws IOException {
    if (autoClose) {
        // we don't need the plainSocket
        plainSocket.close();//from   w ww .  j a va  2  s .  c  o  m
    }

    SSLCertificateSocketFactory sslSocketFactory = (SSLCertificateSocketFactory) SSLCertificateSocketFactory
            .getDefault(0);

    // For self-signed certificates use a custom trust manager
    sslSocketFactory.setTrustManagers(new TrustManager[] { new IgnoreSSLTrustManager() });

    // create and connect SSL socket, but don't do hostname/certificate verification yet
    SSLSocket ssl = (SSLSocket) sslSocketFactory.createSocket(InetAddress.getByName(host), port);

    // enable TLSv1.1/1.2 if available
    ssl.setEnabledProtocols(ssl.getSupportedProtocols());

    // set up SNI before the handshake
    if (Build.VERSION.SDK_INT >= Build.VERSION_CODES.JELLY_BEAN_MR1) {
        sslSocketFactory.setHostname(ssl, host);
    } else {
        try {
            java.lang.reflect.Method setHostnameMethod = ssl.getClass().getMethod("setHostname", String.class);
            setHostnameMethod.invoke(ssl, host);
        } catch (Exception e) {
            throw new IOException("SNI not usable: " + e, e);
        }
    }

    return ssl;
}

From source file:org.transdroid.util.TlsSniSocketFactory.java

@Override
@TargetApi(Build.VERSION_CODES.JELLY_BEAN_MR1)
public Socket createSocket(Socket plainSocket, String host, int port, boolean autoClose) throws IOException {
    if (autoClose) {
        // we don't need the plainSocket
        plainSocket.close();//www  . j av a  2  s  .  c o  m
    }

    SSLCertificateSocketFactory sslSocketFactory = (SSLCertificateSocketFactory) SSLCertificateSocketFactory
            .getDefault(0);

    // create and connect SSL socket, but don't do hostname/certificate verification yet
    SSLSocket ssl = (SSLSocket) sslSocketFactory.createSocket(InetAddress.getByName(host), port);

    // enable TLSv1.1/1.2 if available
    ssl.setEnabledProtocols(ssl.getSupportedProtocols());

    // set up SNI before the handshake
    if (Build.VERSION.SDK_INT >= Build.VERSION_CODES.JELLY_BEAN_MR1) {
        sslSocketFactory.setHostname(ssl, host);
    } else {
        try {
            java.lang.reflect.Method setHostnameMethod = ssl.getClass().getMethod("setHostname", String.class);
            setHostnameMethod.invoke(ssl, host);
        } catch (Exception e) {
            Log.d(TlsSniSocketFactory.class.getSimpleName(), "SNI not usable: " + e);
        }
    }

    // verify hostname and certificate
    SSLSession session = ssl.getSession();
    if (!hostnameVerifier.verify(host, session)) {
        throw new SSLPeerUnverifiedException("Cannot verify hostname: " + host);
    }

    return ssl;
}

From source file:org.transdroid.daemon.util.TlsSniSocketFactory.java

@Override
@TargetApi(Build.VERSION_CODES.JELLY_BEAN_MR1)
public Socket createSocket(Socket plainSocket, String host, int port, boolean autoClose) throws IOException {
    if (autoClose) {
        // we don't need the plainSocket
        plainSocket.close();/*from   w  w  w.  ja  v a  2 s. c om*/
    }

    SSLCertificateSocketFactory sslSocketFactory = (SSLCertificateSocketFactory) SSLCertificateSocketFactory
            .getDefault(0);

    // For self-signed certificates use a custom trust manager
    if (acceptAllCertificates) {
        sslSocketFactory.setTrustManagers(new TrustManager[] { new IgnoreSSLTrustManager() });
    } else if (selfSignedCertificateKey != null) {
        sslSocketFactory
                .setTrustManagers(new TrustManager[] { new SelfSignedTrustManager(selfSignedCertificateKey) });
    }

    // create and connect SSL socket, but don't do hostname/certificate verification yet
    SSLSocket ssl = (SSLSocket) sslSocketFactory.createSocket(InetAddress.getByName(host), port);

    // enable TLSv1.1/1.2 if available
    ssl.setEnabledProtocols(ssl.getSupportedProtocols());

    // set up SNI before the handshake
    if (Build.VERSION.SDK_INT >= Build.VERSION_CODES.JELLY_BEAN_MR1) {
        sslSocketFactory.setHostname(ssl, host);
    } else {
        try {
            java.lang.reflect.Method setHostnameMethod = ssl.getClass().getMethod("setHostname", String.class);
            setHostnameMethod.invoke(ssl, host);
        } catch (Exception e) {
            Log.d(TlsSniSocketFactory.class.getSimpleName(), "SNI not usable: " + e);
        }
    }

    // verify hostname and certificate
    SSLSession session = ssl.getSession();
    if (!(acceptAllCertificates || selfSignedCertificateKey != null)
            && !hostnameVerifier.verify(host, session)) {
        throw new SSLPeerUnverifiedException("Cannot verify hostname: " + host);
    }

    /*DLog.d(TlsSniSocketFactory.class.getSimpleName(),
    "Established " + session.getProtocol() + " connection with " + session.getPeerHost() +
          " using " + session.getCipherSuite());*/

    return ssl;
}

From source file:com.rastating.droidbeard.net.TlsSocketFactory.java

@Override
public Socket createSocket(Socket plainSocket, String host, int port, boolean autoClose)
        throws IOException, UnknownHostException {
    // Create and connect SSL socket, but don't do hostname/certificate verification yet
    SSLCertificateSocketFactory sslSocketFactory = (SSLCertificateSocketFactory) SSLCertificateSocketFactory
            .getDefault(0);/*from www .j  a v  a  2s . co  m*/

    // Setup custom trust manager if we are trusting all certificates
    if (mTrustAllCertificates) {
        TrustManager tm = new X509TrustManager() {
            public void checkClientTrusted(X509Certificate[] chain, String authType)
                    throws CertificateException {
            }

            public void checkServerTrusted(X509Certificate[] chain, String authType)
                    throws CertificateException {
            }

            public X509Certificate[] getAcceptedIssuers() {
                return null;
            }
        };

        sslSocketFactory.setTrustManagers(new TrustManager[] { tm });
    }

    SSLSocket ssl = (SSLSocket) sslSocketFactory.createSocket(InetAddress.getByName(host), port);

    // Enable TLSv1.1/1.2 if available
    // (see https://github.com/rfc2822/davdroid/issues/229)
    ssl.setEnabledProtocols(ssl.getSupportedProtocols());
    SSLSession session = ssl.getSession();

    // Verify hostname and certificate if we aren't trusting all certificates
    if (!mTrustAllCertificates) {
        if (!hostnameVerifier.verify(host, session))
            throw new SSLPeerUnverifiedException("Cannot verify hostname: " + host);
    }

    Log.i("droidbeard", "Established " + session.getProtocol() + " connection with " + session.getPeerHost()
            + " using " + session.getCipherSuite());
    return ssl;
}

From source file:com.eviware.soapui.impl.wsdl.support.http.SoapUIEasySSLProtocolSocketFactory.java

private synchronized Socket enableSocket(SSLSocket socket) {
    socket.getSession().invalidate();//w  w w.ja  v  a  2  s. co  m

    String protocols = System.getProperty("soapui.https.protocols");
    String ciphers = System.getProperty("soapui.https.ciphers");

    if (StringUtils.hasContent(protocols)) {
        socket.setEnabledProtocols(protocols.split(","));
    } else if (socket.getSupportedProtocols() != null) {
        socket.setEnabledProtocols(socket.getSupportedProtocols());
    }

    if (StringUtils.hasContent(ciphers)) {
        socket.setEnabledCipherSuites(ciphers.split(","));
    } else if (socket.getSupportedCipherSuites() != null) {
        socket.setEnabledCipherSuites(socket.getSupportedCipherSuites());
    }
    return socket;
}

From source file:org.andstatus.app.net.http.TlsSniSocketFactory.java

@TargetApi(Build.VERSION_CODES.JELLY_BEAN_MR1)
private void connectWithSNI(SSLSocket ssl, String host) throws SSLPeerUnverifiedException {
    // set reasonable SSL/TLS settings before the handshake:
    // - enable all supported protocols (enables TLSv1.1 and TLSv1.2 on Android <4.4.3, if available)
    ssl.setEnabledProtocols(ssl.getSupportedProtocols());

    // - set SNI host name
    if (Build.VERSION.SDK_INT >= Build.VERSION_CODES.JELLY_BEAN_MR1) {
        MyLog.d(this, "Using documented SNI with host name " + host);
        sslSocketFactory.setHostname(ssl, host);
    } else {/*from w w  w.  j a  v a 2 s .c o  m*/
        MyLog.d(this, "No documented SNI support on Android <4.2, trying with reflection");
        try {
            java.lang.reflect.Method setHostnameMethod = ssl.getClass().getMethod("setHostname", String.class);
            setHostnameMethod.invoke(ssl, host);
        } catch (Exception e) {
            MyLog.i(this, "SNI not useable", e);
        }
    }

    // verify hostname and certificate
    SSLSession session = ssl.getSession();
    if (!session.isValid()) {
        MyLog.i(this, "Invalid session to host:'" + host + "'");
    }

    HostnameVerifier hostnameVerifier = secure ? new BrowserCompatHostnameVerifier()
            : new AllowAllHostnameVerifier();
    if (!hostnameVerifier.verify(host, session)) {
        throw new SSLPeerUnverifiedException("Cannot verify hostname: " + host);
    }

    MyLog.i(this, "Established " + session.getProtocol() + " connection with " + session.getPeerHost()
            + " using " + session.getCipherSuite());
}

From source file:at.bitfire.davdroid.mirakel.webdav.TlsSniSocketFactory.java

@SuppressLint("DefaultLocale")
private void setReasonableEncryption(SSLSocket ssl) {
    // set reasonable SSL/TLS settings before the handshake

    // Android 5.0+ (API level21) provides reasonable default settings
    // but it still allows SSLv3
    // https://developer.android.com/about/versions/android-5.0-changes.html#ssl

    // - enable all supported protocols (enables TLSv1.1 and TLSv1.2 on Android <5.0, if available)
    // - remove all SSL versions (especially SSLv3) because they're insecure now
    List<String> protocols = new LinkedList<String>();
    for (String protocol : ssl.getSupportedProtocols())
        if (!protocol.toUpperCase().contains("SSL"))
            protocols.add(protocol);//from  w w w .jav a2 s.  co m
    Log.v(TAG, "Setting allowed TLS protocols: " + StringUtils.join(protocols, ", "));
    ssl.setEnabledProtocols(protocols.toArray(new String[0]));

    if (android.os.Build.VERSION.SDK_INT < 21) {
        // choose secure cipher suites
        List<String> allowedCiphers = Arrays.asList(// TLS 1.2
                "TLS_RSA_WITH_AES_256_GCM_SHA384", "TLS_RSA_WITH_AES_128_GCM_SHA256",
                "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256", "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256",
                "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256",
                "TLS_ECHDE_RSA_WITH_AES_128_GCM_SHA256",
                // maximum interoperability
                "TLS_RSA_WITH_3DES_EDE_CBC_SHA", "TLS_RSA_WITH_AES_128_CBC_SHA",
                // additionally
                "TLS_RSA_WITH_AES_256_CBC_SHA", "TLS_ECDHE_ECDSA_WITH_3DES_EDE_CBC_SHA",
                "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA",
                "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA");

        List<String> availableCiphers = Arrays.asList(ssl.getSupportedCipherSuites());

        // preferred ciphers = allowed Ciphers \ availableCiphers
        HashSet<String> preferredCiphers = new HashSet<String>(allowedCiphers);
        preferredCiphers.retainAll(availableCiphers);

        // add preferred ciphers to enabled ciphers
        // for maximum security, preferred ciphers should *replace* enabled ciphers,
        // but I guess for the security level of DAVdroid, disabling of insecure
        // ciphers should be a server-side task
        HashSet<String> enabledCiphers = preferredCiphers;
        enabledCiphers.addAll(new HashSet<String>(Arrays.asList(ssl.getEnabledCipherSuites())));

        Log.v(TAG, "Setting allowed TLS ciphers: " + StringUtils.join(enabledCiphers, ", "));
        ssl.setEnabledCipherSuites(enabledCiphers.toArray(new String[0]));
    }
}