Package org.eclipse.jetty.io.ssl

Class SslConnection

  • All Implemented Interfaces:
    Closeable, AutoCloseable, Connection
    public class SslConnection
extends AbstractConnection
    A Connection that acts as an interceptor between an EndPoint providing SSL encrypted data and another consumer of an EndPoint (typically an Connection like HttpConnection) that wants unencrypted data.

    The connector uses an EndPoint (typically SocketChannelEndPoint) as it's source/sink of encrypted data. It then provides an endpoint via getDecryptedEndPoint() to expose a source/sink of unencrypted data to another connection (eg HttpConnection).

    The design of this class is based on a clear separation between the passive methods, which do not block nor schedule any asynchronous callbacks, and active methods that do schedule asynchronous callbacks.

    The passive methods are SslConnection.DecryptedEndPoint.fill(ByteBuffer) and SslConnection.DecryptedEndPoint.flush(ByteBuffer...). They make best effort attempts to progress the connection using only calls to the encrypted EndPoint.fill(ByteBuffer) and EndPoint.flush(ByteBuffer...) methods. They will never block nor schedule any readInterest or write callbacks. If a fill/flush cannot progress either because of network congestion or waiting for an SSL handshake message, then the fill/flush will simply return with zero bytes filled/flushed. Specifically, if a flush cannot proceed because it needs to receive a handshake message, then the flush will attempt to fill bytes from the encrypted endpoint, but if insufficient bytes are read it will NOT call EndPoint.fillInterested(Callback).

    It is only the active methods : AbstractEndPoint.fillInterested(Callback) and AbstractEndPoint.write(Callback, ByteBuffer...) that may schedule callbacks by calling the encrypted EndPoint.fillInterested(Callback) and EndPoint.write(Callback, ByteBuffer...) methods. For normal data handling, the decrypted fillInterest method will result in an encrypted fillInterest and a decrypted write will result in an encrypted write. However, due to SSL handshaking requirements, it is also possible for a decrypted fill to call the encrypted write and for the decrypted flush to call the encrypted fillInterested methods.

    MOST IMPORTANTLY, the encrypted callbacks from the active methods (#onFillable() and WriteFlusher#completeWrite()) do no filling or flushing themselves. Instead they simple make the callbacks to the decrypted callbacks, so that the passive encrypted fill/flush will be called again and make another best effort attempt to progress the connection.

    • Method Detail

      • removeHandshakeListener

        public boolean removeHandshakeListener​(SslHandshakeListener listener)

      • getSSLEngine

        public SSLEngine getSSLEngine()

      • isRenegotiationAllowed

        public boolean isRenegotiationAllowed()

      • setRenegotiationAllowed

        public void setRenegotiationAllowed​(boolean renegotiationAllowed)

      • getRenegotiationLimit

        public int getRenegotiationLimit()
        Returns:
        The number of renegotions allowed for this connection. When the limit is 0 renegotiation will be denied. If the limit is less than 0 then no limit is applied.

      • setRenegotiationLimit

        public void setRenegotiationLimit​(int renegotiationLimit)
        Parameters:
        renegotiationLimit - The number of renegotions allowed for this connection. When the limit is 0 renegotiation will be denied. If the limit is less than 0 then no limit is applied. Default -1.

      • isAllowMissingCloseMessage

        public boolean isAllowMissingCloseMessage()

      • setAllowMissingCloseMessage

        public void setAllowMissingCloseMessage​(boolean allowMissingCloseMessage)

      • onOpen

        public void onOpen()
        Description copied from interface: Connection

        Callback method invoked when this connection is opened.

        Creators of the connection implementation are responsible for calling this method.

        Specified by:
        onOpen in interface Connection
        Overrides:
        onOpen in class AbstractConnection

      • onClose

        public void onClose()
        Description copied from interface: Connection

        Callback method invoked when this connection is closed.

        Creators of the connection implementation are responsible for calling this method.

        Specified by:
        onClose in interface Connection
        Overrides:
        onClose in class AbstractConnection

      • close

        public void close()
        Description copied from interface: Connection

        Performs a logical close of this connection.

        For simple connections, this may just mean to delegate the close to the associated EndPoint but, for example, SSL connections should write the SSL close message before closing the associated EndPoint.

        Specified by:
        close in interface AutoCloseable
        Specified by:
        close in interface Closeable
        Specified by:
        close in interface Connection
        Overrides:
        close in class AbstractConnection

      • onIdleExpired

        public boolean onIdleExpired()
        Description copied from interface: Connection

        Callback method invoked upon an idle timeout event.

        Implementations of this method may return true to indicate that the idle timeout handling should proceed normally, typically failing the EndPoint and causing it to be closed.

        When false is returned, the handling of the idle timeout event is halted immediately and the EndPoint left in the state it was before the idle timeout event.

        Specified by:
        onIdleExpired in interface Connection
        Overrides:
        onIdleExpired in class AbstractConnection
        Returns:
        true to let the EndPoint handle the idle timeout, false to tell the EndPoint to halt the handling of the idle timeout.