* After you are done buffering data you should call {@link #bioClearByteBuffer(long)}. * @param bio {@code BIO*}. * @param bufferAddress The memory address (typically from a direct {@link ByteBuffer}) which will be used * to either write encrypted data to, or read encrypted data from by OpenSSL's internal BIO pair. * @param maxUsableBytes The maximum usable length in bytes starting at {@code bufferAddress}. * @param isSSLWriteSink {@code true} if this buffer is expected to buffer data as a result of calls to {@code SSL_write}. * {@code false} if this buffer is expected to buffer data as a result of calls to {@code SSL_read}. */ public static native void bioSetByteBuffer(long bio, long bufferAddress, int maxUsableBytes, boolean isSSLWriteSink); /** * After you are done buffering data from {@link #bioSetByteBuffer(long, long, int, boolean)}, this will ensure the * internal SSL write buffers are ready to capture data which may unexpectedly happen (e.g. handshake, renegotiation, etc..). * @param bio {@code BIO*}. */ public static native void bioClearByteBuffer(long bio); /** * Flush any pending bytes in the internal SSL write buffer. *
* This does the same thing as {@code BIO_flush} for a {@code BIO*} of type {@link #bioNewByteBuffer(long, int)} but * returns the number of bytes that were flushed. * @param bio {@code BIO*}. * @return The number of bytes that were flushed. */ public static native int bioFlushByteBuffer(long bio); /** * Get the remaining length of the {@link ByteBuffer} set by {@link #bioSetByteBuffer(long, long, int, boolean)}. * @param bio {@code BIO*}. * @return The remaining length of the {@link ByteBuffer} set by {@link #bioSetByteBuffer(long, long, int, boolean)}. */ public static native int bioLengthByteBuffer(long bio); /** * Get the amount of data pending in buffer used for non-application writes. * This value will not exceed the value configured in {@link #bioNewByteBuffer(long, int)}. * @param bio {@code BIO*}. * @return the amount of data pending in buffer used for non-application writes. */ public static native int bioLengthNonApplication(long bio); /** * SSL_write * @param ssl the SSL instance (SSL *) * @param wbuf the memory address of the buffer * @param wlen the length * @return the number of written bytes */ public static native int writeToSSL(long ssl, long wbuf, int wlen); /** * SSL_read * @param ssl the SSL instance (SSL *) * @param rbuf the memory address of the buffer * @param rlen the length * @return the number of read bytes */ public static native int readFromSSL(long ssl, long rbuf, int rlen); /** * SSL_get_shutdown * @param ssl the SSL instance (SSL *) * @return the return code of {@code SSL_get_shutdown} */ public static native int getShutdown(long ssl); /** * SSL_set_shutdown * @param ssl the SSL instance (SSL *) * @param mode the mode to use */ public static native void setShutdown(long ssl, int mode); /** * SSL_free * @param ssl the SSL instance (SSL *) */ public static native void freeSSL(long ssl); /** * BIO_free * @param bio the BIO */ public static native void freeBIO(long bio); /** * SSL_shutdown * @param ssl the SSL instance (SSL *) * @return the return code of {@code SSL_shutdown} */ public static native int shutdownSSL(long ssl); /** * Get the error number representing the last error OpenSSL encountered on this thread. * @return the last error code for the calling thread. */ public static native int getLastErrorNumber(); /** * SSL_get_cipher * @param ssl the SSL instance (SSL *) * @return the name of the current cipher. */ public static native String getCipherForSSL(long ssl); /** * SSL_get_version * @param ssl the SSL instance (SSL *) * @return the version. */ public static native String getVersion(long ssl); /** * SSL_do_handshake * @param ssl the SSL instance (SSL *) * @return the return code of {@code SSL_do_handshake}. */ public static native int doHandshake(long ssl); /** * SSL_in_init * @param ssl the SSL instance (SSL *) * @return the return code of {@code SSL_in_init}. */ public static native int isInInit(long ssl); /** * SSL_get0_next_proto_negotiated * @param ssl the SSL instance (SSL *) * @return the name of the negotiated proto */ public static native String getNextProtoNegotiated(long ssl); /* * End Twitter API Additions */ /** * SSL_get0_alpn_selected * @param ssl the SSL instance (SSL *) * @return the name of the selected ALPN protocol */ public static native String getAlpnSelected(long ssl); /** * Get the peer certificate chain or {@code null} if none was send. * @param ssl the SSL instance (SSL *) * @return the chain or {@code null} if none was send */ public static native byte[][] getPeerCertChain(long ssl); /** * Get the peer certificate or {@code null} if non was send. * @param ssl the SSL instance (SSL *) * @return the peer certificate or {@code null} if none was send */ public static native byte[] getPeerCertificate(long ssl); /** * Get the error string representing for the given {@code errorNumber}. * * @param errorNumber the error number / code * @return the error string */ public static native String getErrorString(long errorNumber); /** * SSL_get_time * @param ssl the SSL instance (SSL *) * @return returns the time at which the session ssl was established. The time is given in seconds since the Epoch */ public static native long getTime(long ssl); /** * SSL_get_timeout * @param ssl the SSL instance (SSL *) * @return returns the timeout for the session ssl The time is given in seconds since the Epoch */ public static native long getTimeout(long ssl); /** * SSL_set_timeout * @param ssl the SSL instance (SSL *) * @param seconds timeout in seconds * @return returns the timeout for the session ssl before this call. The time is given in seconds since the Epoch */ public static native long setTimeout(long ssl, long seconds); /** * Set Type of Client Certificate verification and Maximum depth of CA Certificates * in Client Certificate verification. *
* This directive sets the Certificate verification level for the Client * Authentication. Notice that this directive can be used both in per-server * and per-directory context. In per-server context it applies to the client * authentication process used in the standard SSL handshake when a connection * is established. In per-directory context it forces a SSL renegotiation with * the reconfigured client verification level after the HTTP request was read * but before the HTTP response is sent. *
* The following levels are available for level: *
* This complex directive uses a colon-separated cipher-spec string consisting * of OpenSSL cipher specifications to configure the Cipher Suite the client * is permitted to negotiate in the SSL handshake phase. Notice that this * directive can be used both in per-server and per-directory context. * In per-server context it applies to the standard SSL handshake when a * connection is established. In per-directory context it forces a SSL * renegotiation with the reconfigured Cipher Suite after the HTTP request * was read but before the HTTP response is sent. * @param ssl the SSL instance (SSL *) * @param ciphers an SSL cipher specification * @return {@code true} if successful * @throws Exception if an error happened */ public static native boolean setCipherSuites(long ssl, String ciphers) throws Exception; /** * Returns the ID of the session as byte array representation. * * @param ssl the SSL instance (SSL *) * @return the session as byte array representation obtained via SSL_SESSION_get_id. */ public static native byte[] getSessionId(long ssl); /** * Returns the number of handshakes done for this SSL instance. This also includes renegations. * * @param ssl the SSL instance (SSL *) * @return the number of handshakes done for this SSL instance. */ public static native int getHandshakeCount(long ssl); /** * Clear all the errors from the error queue that OpenSSL encountered on this thread. */ public static native void clearError(); /** * Call SSL_renegotiate. * * @param ssl the SSL instance (SSL *) * @return the result of the operation */ public static native int renegotiate(long ssl); /** * Call SSL_set_state. * * @param ssl the SSL instance (SSL *) * @param state the state to set */ public static native void setState(long ssl, int state); /** * Call SSL_set_tlsext_host_name * * @param ssl the SSL instance (SSL *) * @param hostname the hostname */ public static native void setTlsExtHostName(long ssl, String hostname); /** * Explicitly control hostname validation * see X509_check_host for X509_CHECK_FLAG* definitions. * Values are defined as a bitmask of {@code X509_CHECK_FLAG*} values. * @param ssl the SSL instance (SSL*). * @param flags a bitmask of {@code X509_CHECK_FLAG*} values. * @param hostname the hostname which is expected for validation. */ public static native void setHostNameValidation(long ssl, int flags, String hostname); /** * Return the methods used for authentication. * * @param ssl the SSL instance (SSL*) * @return the methods */ public static native String[] authenticationMethods(long ssl); /** * Set BIO of PEM-encoded Server CA Certificates *
* This directive sets the optional all-in-one file where you can assemble the * certificates of Certification Authorities (CA) which form the certificate * chain of the server certificate. This starts with the issuing CA certificate * of of the server certificate and can range up to the root CA certificate. * Such a file is simply the concatenation of the various PEM-encoded CA * Certificate files, usually in certificate chain order. *
* But be careful: Providing the certificate chain works only if you are using
* a single (either RSA or DSA) based server certificate. If you are using a
* coupled RSA+DSA certificate pair, this will work only if actually both
* certificates use the same certificate chain. Otherwsie the browsers will be
* confused in this situation.
* @param ssl Server or Client to use.
* @param bio BIO of PEM-encoded Server CA Certificates.
* @param skipfirst Skip first certificate if chain file is inside
* certificate file.
*/
public static native void setCertificateChainBio(long ssl, long bio, boolean skipfirst);
/**
* Set Certificate
*
* Point setCertificate at a PEM encoded certificate stored in a BIO. If
* the certificate is encrypted, then you will be prompted for a
* pass phrase. Note that a kill -HUP will prompt again. A test
* certificate can be generated with `make certificate' under
* built time. Keep in mind that if you've both a RSA and a DSA
* certificate you can configure both in parallel (to also allow
* the use of DSA ciphers, etc.)
*
* If the key is not combined with the certificate, use key param
* to point at the key file. Keep in mind that if
* you've both a RSA and a DSA private key you can configure
* both in parallel (to also allow the use of DSA ciphers, etc.)
* @param ssl Server or Client to use.
* @param certBio Certificate BIO.
* @param keyBio Private Key BIO to use if not in cert.
* @param password Certificate password. If null and certificate
* is encrypted.
* @throws Exception if an error happened
*/
public static native void setCertificateBio(
long ssl, long certBio, long keyBio, String password) throws Exception;
/**
* Parse private key from BIO and return {@code EVP_PKEY} pointer.
*
*
Be sure you understand how OpenSsl will behave with respect to reference counting! * * If the {@code EVP_PKEY} pointer is used with the client certificate callback * {@link CertificateRequestedCallback} the ownership goes over to OpenSsl / Tcnative and so calling * {@link #freePrivateKey(long)} should NOT be done in this case. Otherwise you may * need to call {@link #freePrivateKey(long)} to decrement the reference count and free memory. * * @param privateKeyBio the pointer to the {@code BIO} that contains the private key * @param password the password or {@code null} if no password is needed * @return {@code EVP_PKEY} pointer * @throws Exception if an error happened */ public static native long parsePrivateKey(long privateKeyBio, String password) throws Exception; /** * Free private key ({@code EVP_PKEY} pointer). * * @param privateKey {@code EVP_PKEY} pointer */ public static native void freePrivateKey(long privateKey); /** * Parse X509 chain from BIO and return ({@code STACK_OF(X509)} pointer). * *
Be sure you understand how OpenSsl will behave with respect to reference counting! * * If the {@code STACK_OF(X509)} pointer is used with the client certificate callback * {@link CertificateRequestedCallback} the ownership goes over to OpenSsl / Tcnative and and so calling * {@link #freeX509Chain(long)} should NOT be done in this case. Otherwise you may * need to call {@link #freeX509Chain(long)} to decrement the reference count and free memory. * * @param x509ChainBio the pointer to the {@code BIO} that contains the X509 chain * @return {@code STACK_OF(X509)} pointer * @throws Exception if an error happened */ public static native long parseX509Chain(long x509ChainBio) throws Exception; /** * Free x509 chain ({@code STACK_OF(X509)} pointer). * * @param x509Chain {@code STACK_OF(X509)} pointer */ public static native void freeX509Chain(long x509Chain); }