Java Network Programming (3rd ed) [Electronic resources] نسخه متنی

11.5 Methods of the SSLServerSocket Class

Once
you've successfully created and initialized an
SSLServerSocket, there are a lot of applications
you can write using nothing more than the methods inherited from
java.net.ServerSocket. However, there are times
when you need to adjust its behavior a little. Like
SSLSocket, SSLServerSocket
provides methods to choose cipher suites, manage sessions, and
establish whether clients are required to authenticate themselves.
Most of these methods are very similar to the methods of the same
name in SSLSocket. The difference is that they
work on the server side and set the defaults for sockets accepted by
an SSLServerSocket. In some cases, once an
SSLSocket has been accepted, you can still use the
methods of SSLSocket to configure that one socket
rather than all sockets accepted by this
SSLServerSocket.

11.5.1 Choosing the Cipher Suites

The
SSLServerSocket class has the same three methods for
determining which cipher suites are supported and enabled as
SSLSocket does:

public abstract String[] getSupportedCipherSuites( )
public abstract String[] getEnabledCipherSuites( )
public abstract void     setEnabledCipherSuites(String[] suites)

These methods use the same suite names as the similarly named methods
in SSLSocket. The difference is that these methods
apply to all sockets accepted by the
SSLServerSocket rather than to just one
SSLSocket. For example, this code fragment has the
effect of enabling anonymous, unauthenticated connections on the
SSLServerSocket server. It
relies on the names of these suites containing the string
"_anon_". This is true for
Sun's reference implementations, though
there's no guarantee that other implementers will
follow this convention:

String[] supported = server.getSupportedCipherSuites( );
String[] anonCipherSuitesSupported = new String[supported.length];      
int numAnonCipherSuitesSupported = 0;
for (int i = 0; i < supported.length; i++) {
if (supported[i].indexOf("_anon_") > 0) {
anonCipherSuitesSupported[numAnonCipherSuitesSupported++] 
= supported[i];
}
}  
String[] oldEnabled = server.getEnabledCipherSuites( );
String[] newEnabled = new String[oldEnabled.length
+ numAnonCipherSuitesSupported];
System.arraycopy(oldEnabled, 0, newEnabled, 0, oldEnabled.length);
System.arraycopy(anonCipherSuitesSupported, 0, newEnabled, 
oldEnabled.length, numAnonCipherSuitesSupported);
server.setEnabledCipherSuites(newEnabled);

This fragment retrieves the list of both supported and enabled cipher
suites using getSupportedCipherSuites( ) and
getEnabledCipherSuites( ). It looks at the name of
every supported suite to see whether it contains the substring
"_anon_". If the suite name does
contain this substring, the suite is added to a list of anonymous
cipher suites. Once the list of anonymous cipher suites is built,
it's combined in a new array with the previous list
of enabled cipher suites. The new array is then passed to
setEnabledCipherSuites( ) so that both the
previously enabled and the anonymous cipher suites can now be used.

11.5.2 Session Management

Both client and server must agree
to establish a session. The server side uses the
setEnableSessionCreation( ) method to specify
whether this will be allowed and the
getEnableSessionCreation() method to determine whether this is
currently allowed:

public abstract void setEnableSessionCreation(boolean allowSessions)
public abstract boolean getEnableSessionCreation( )

Session creation is enabled by default. If the server disallows
session creation, then a client that wants a session will still be
able to connect. It just won't get a session and
will have to handshake again for every socket. Similarly, if the
client refuses sessions but the server allows them,
they'll still be able to talk to each other but
without sessions.

11.5.3 Client Mode

The
SSLServerSocket class has two methods for determining and
specifying whether client sockets are required to authenticate
themselves to the server. By passing true to the
setNeedClientAuth(
) method, you specify that only
connections in which the client is able to authenticate itself will
be accepted. By passing false, you specify that
authentication is not required of clients. The default is
false. If for some reason you need to know what
the current state of this property is, the
getNeedClientAuth() method will tell you:

public abstract void setNeedClientAuth(boolean flag)
public abstract boolean getNeedClientAuth( )

The setUseClientMode( ) method allows a program to
indicate that even though it has created an
SSLServerSocket, it is and should be treated as a
client in the communication with respect to authentication and other
negotiations. For example, in an FTP session, the client program
opens a server socket to receive data from the server, but that
doesn't make it less of a client. The
getUseClientMode( ) method returns
true if the SSLServerSocket is
in client mode, false otherwise:

public abstract void setUseClientMode(boolean flag)
public abstract boolean getUseClientMode( )