protected SSLEngine() 
{

}

Constructor for an SSLEngine providing no hints for an internal session reuse strategy.

Also see:

SSLContext#createSSLEngine()
SSLSessionContext

 protected SSLEngine(String peerHost,
    int peerPort) 
{
        this.peerHost = peerHost;
        this.peerPort = peerPort;
}

Constructor for an SSLEngine.

SSLEngine implementations may use the peerHost and peerPort parameters as hints for their internal session reuse strategy.

Some cipher suites (such as Kerberos) require remote hostname information. Implementations of this class should use this constructor to use Kerberos.

The parameters are not authenticated by the SSLEngine.

Parameters:

peerHost - the name of the peer host

peerPort - the port number of the peer

Also see:

SSLContext#createSSLEngine(String, int)
SSLSessionContext

 abstract public  void beginHandshake() throws SSLException
Initiates handshaking (initial or renegotiation) on this SSLEngine.

This method is not needed for the initial handshake, as the
wrap() and unwrap() methods will
implicitly call this method if handshaking has not already begun.

Note that the peer may also request a session renegotiation with
this SSLEngine by sending the appropriate
session renegotiate handshake message.

Unlike the SSLSocket#startHandshake()  method, this method does not block
until handshaking is completed.

To force a complete SSL/TLS session renegotiation, the current
session should be invalidated prior to calling this method.

Some protocols may not support multiple handshakes on an existing
engine and may throw an SSLException.

 abstract public  void closeInbound() throws SSLException
Signals that no more inbound network data will be sent
to this SSLEngine.

If the application initiated the closing process by calling
#closeOutbound() , under some circumstances it is not
required that the initiator wait for the peer's corresponding
close message.  (See section 7.2.1 of the TLS specification (RFC 2246) for more
information on waiting for closure alerts.)  In such cases, this
method need not be called.

But if the application did not initiate the closure process, or
if the circumstances above do not apply, this method should be
called whenever the end of the SSL/TLS data stream is reached.
This ensures closure of the inbound side, and checks that the
peer followed the SSL/TLS close procedure properly, thus
detecting possible truncation attacks.

This method is idempotent:  if the inbound side has already
been closed, this method does not do anything.

 wrap()  should be
called to flush any remaining handshake data.

 abstract public  void closeOutbound()
Signals that no more outbound application data will be sent
on this SSLEngine.

This method is idempotent:  if the outbound side has already
been closed, this method does not do anything.

#wrap(ByteBuffer, ByteBuffer)  should be
called to flush any remaining handshake data.

 abstract public Runnable getDelegatedTask()
Returns a delegated Runnable task for
this SSLEngine.

SSLEngine operations may require the results of
operations that block, or may take an extended period of time to
complete.  This method is used to obtain an outstanding java.lang.Runnable  operation (task).  Each task must be assigned
a thread (possibly the current) to perform the run  operation.  Once the
run method returns, the Runnable object
is no longer needed and may be discarded.

Delegated tasks run in the AccessControlContext
in place when this object was created.

A call to this method will return each outstanding task
exactly once.

Multiple delegated tasks can be run in parallel.

 abstract public boolean getEnableSessionCreation()
Returns true if new SSL sessions may be established by this engine.

 abstract public String[] getEnabledCipherSuites()
Returns the names of the SSL cipher suites which are currently
enabled for use on this engine.  When an SSLEngine is first
created, all enabled cipher suites support a minimum quality of
service.  Thus, in some environments this value might be empty.

Even if a suite has been enabled, it might never be used.  (For
example, the peer does not support it, the requisite
certificates/private keys for the suite are not available, or an
anonymous suite is enabled but authentication is required.)

 abstract public String[] getEnabledProtocols()
Returns the names of the protocol versions which are currently
enabled for use with this SSLEngine.

 public SSLSession getHandshakeSession() 
{
        throw new UnsupportedOperationException();
}

Returns the {@code SSLSession} being constructed during a SSL/TLS handshake.

TLS protocols may negotiate parameters that are needed when using an instance of this class, but before the {@code SSLSession} has been completely initialized and made available via {@code getSession}. For example, the list of valid signature algorithms may restrict the type of certificates that can used during TrustManager decisions, or the maximum TLS fragment packet sizes can be resized to better support the network environment.

This method provides early access to the {@code SSLSession} being constructed. Depending on how far the handshake has progressed, some data may not yet be available for use. For example, if a remote server will be sending a Certificate chain, but that chain has yet not been processed, the {@code getPeerCertificates} method of {@code SSLSession} will throw a SSLPeerUnverifiedException. Once that chain has been processed, {@code getPeerCertificates} will return the proper value.

 abstract public HandshakeStatus getHandshakeStatus()
Returns the current handshake status for this SSLEngine.

 abstract public boolean getNeedClientAuth()
Returns true if the engine will require client authentication.
This option is only useful to engines in the server mode.

 public String getPeerHost() 
{
        return peerHost;
}

Returns the host name of the peer.

Note that the value is not authenticated, and should not be relied upon.

 public int getPeerPort() 
{
        return peerPort;
}

Returns the port number of the peer.

Note that the value is not authenticated, and should not be relied upon.

 public SSLParameters getSSLParameters() 
{
        SSLParameters params = new SSLParameters();
        params.setCipherSuites(getEnabledCipherSuites());
        params.setProtocols(getEnabledProtocols());
        if (getNeedClientAuth()) {
            params.setNeedClientAuth(true);
        } else if (getWantClientAuth()) {
            params.setWantClientAuth(true);
        }
        return params;
}

Returns the SSLParameters in effect for this SSLEngine. The ciphersuites and protocols of the returned SSLParameters are always non-null.

 abstract public SSLSession getSession()
Returns the SSLSession in use in this
SSLEngine.

These can be long lived, and frequently correspond to an entire
login session for some user.  The session specifies a particular
cipher suite which is being actively used by all connections in
that session, as well as the identities of the session's client
and server.

Unlike SSLSocket#getSession() 
this method does not block until handshaking is complete.

Until the initial handshake has completed, this method returns
a session object which reports an invalid cipher suite of
"SSL_NULL_WITH_NULL_NULL".

 abstract public String[] getSupportedCipherSuites()
Returns the names of the cipher suites which could be enabled for use
on this engine.  Normally, only a subset of these will actually
be enabled by default, since this list may include cipher suites which
do not meet quality of service requirements for those defaults.  Such
cipher suites might be useful in specialized applications.

 abstract public String[] getSupportedProtocols()
Returns the names of the protocols which could be enabled for use
with this SSLEngine.

 abstract public boolean getUseClientMode()
Returns true if the engine is set to use client mode when
handshaking.

 abstract public boolean getWantClientAuth()
Returns true if the engine will request client authentication.
This option is only useful for engines in the server mode.

 abstract public boolean isInboundDone()
Returns whether #unwrap(ByteBuffer, ByteBuffer)  will
accept any more inbound data messages.

 abstract public boolean isOutboundDone()
Returns whether #wrap(ByteBuffer, ByteBuffer)  will
produce any more outbound data messages.

Note that during the closure phase, a SSLEngine may
generate handshake closure data that must be sent to the peer.
wrap() must be called to generate this data.  When
this method returns true, no more outbound data will be created.

 abstract public  void setEnableSessionCreation(boolean flag)
Controls whether new SSL sessions may be established by this engine.
If session creations are not allowed, and there are no
existing sessions to resume, there will be no successful
handshaking.

 abstract public  void setEnabledCipherSuites(String[] suites)
Sets the cipher suites enabled for use on this engine.

Each cipher suite in the suites parameter must have
been listed by getSupportedCipherSuites(), or the method will
fail.  Following a successful call to this method, only suites
listed in the suites parameter are enabled for use.

See #getEnabledCipherSuites()  for more information
on why a specific cipher suite may never be used on a engine.

 abstract public  void setEnabledProtocols(String[] protocols)
Set the protocol versions enabled for use on this engine.

The protocols must have been listed by getSupportedProtocols()
as being supported.  Following a successful call to this method,
only protocols listed in the protocols parameter
are enabled for use.

 abstract public  void setNeedClientAuth(boolean need)
Configures the engine to require client authentication.  This
option is only useful for engines in the server mode.

An engine's client authentication setting is one of the following:

 client authentication required
 client authentication requested
 no client authentication desired


Unlike #setWantClientAuth(boolean) , if this option is set and
the client chooses not to provide authentication information
about itself, the negotiations will stop and the engine will
begin its closure procedure.

Calling this method overrides any previous setting made by
this method or #setWantClientAuth(boolean) .

 public  void setSSLParameters(SSLParameters params) 
{
        String[] s;
        s = params.getCipherSuites();
        if (s != null) {
            setEnabledCipherSuites(s);
        }
        s = params.getProtocols();
        if (s != null) {
            setEnabledProtocols(s);
        }
        if (params.getNeedClientAuth()) {
            setNeedClientAuth(true);
        } else if (params.getWantClientAuth()) {
            setWantClientAuth(true);
        } else {
            setWantClientAuth(false);
        }
}

Applies SSLParameters to this engine.

This means:

• if params.getCipherSuites() is non-null, setEnabledCipherSuites() is called with that value
• if params.getProtocols() is non-null, setEnabledProtocols() is called with that value
• if params.getNeedClientAuth() or params.getWantClientAuth() return true, setNeedClientAuth(true) and setWantClientAuth(true) are called, respectively; otherwise setWantClientAuth(false) is called.

 abstract public  void setUseClientMode(boolean mode)
Configures the engine to use client (or server) mode when
handshaking.

This method must be called before any handshaking occurs.
Once handshaking has begun, the mode can not be reset for the
life of this engine.

Servers normally authenticate themselves, and clients
are not required to do so.

 abstract public  void setWantClientAuth(boolean want)
Configures the engine to request client authentication.
This option is only useful for engines in the server mode.

An engine's client authentication setting is one of the following:

 client authentication required
 client authentication requested
 no client authentication desired


Unlike #setNeedClientAuth(boolean) , if this option is set and
the client chooses not to provide authentication information
about itself, the negotiations will continue.

Calling this method overrides any previous setting made by
this method or #setNeedClientAuth(boolean) .

 public SSLEngineResult unwrap(ByteBuffer src,
    ByteBuffer dst) throws SSLException 
{
        return unwrap(src, new ByteBuffer [] { dst }, 0, 1);
}

Attempts to decode SSL/TLS network data into a plaintext application data buffer.

An invocation of this method behaves in exactly the same manner as the invocation:

ByteBuffer [], int, int)
    new ByteBuffer [] { dst , 0, 1);}

 public SSLEngineResult unwrap(ByteBuffer src,
    ByteBuffer[] dsts) throws SSLException 
{
        if (dsts == null) {
            throw new IllegalArgumentException("dsts == null");
        }
        return unwrap(src, dsts, 0, dsts.length);
}

Attempts to decode SSL/TLS network data into a sequence of plaintext application data buffers.

An invocation of this method behaves in exactly the same manner as the invocation:

ByteBuffer [], int, int)
    dsts, 0, dsts.length); 

 abstract public SSLEngineResult unwrap(ByteBuffer src,
    ByteBuffer[] dsts,
    int offset,
    int length) throws SSLException
Attempts to decode SSL/TLS network data into a subsequence of
plaintext application data buffers.  This "scattering"
operation decodes, in a single invocation, a sequence of bytes
into one or more of a given sequence of buffers.  Scattering
unwraps are often useful when implementing network protocols or
file formats that, for example, group data into segments
consisting of one or more fixed-length headers followed by a
variable-length body.  See
java.nio.channels.ScatteringByteChannel  for more
information on scattering, and java.nio.channels.ScatteringByteChannel#read(ByteBuffer[],
int, int)  for more information on the subsequence
behavior.

Depending on the state of the SSLEngine, this method may consume
network data without producing any application data (for example,
it may consume handshake data.)

The application is responsible for reliably obtaining the network
data from the peer, and for invoking unwrap() on the data in the
order it was received.  The application must properly synchronize
multiple calls to this method.

If this SSLEngine has not yet started its initial
handshake, this method will automatically start the handshake.

This method will attempt to consume one complete SSL/TLS network
packet, but will never consume more than the sum of the bytes
remaining in the buffers.  Each ByteBuffer's
position is updated to reflect the amount of data consumed or
produced.  The limits remain the same.

The underlying memory used by the src and
dsts ByteBuffers must not be the same.

The inbound network buffer may be modified as a result of this
call:  therefore if the network data packet is required for some
secondary purpose, the data should be duplicated before calling this
method.  Note:  the network data will not be useful to a second
SSLEngine, as each SSLEngine contains unique random state which
influences the SSL/TLS messages.

See the class description for more information on engine closure.

 public SSLEngineResult wrap(ByteBuffer src,
    ByteBuffer dst) throws SSLException 
{
        return wrap(new ByteBuffer [] { src }, 0, 1, dst);
}

Attempts to encode a buffer of plaintext application data into SSL/TLS network data.

An invocation of this method behaves in exactly the same manner as the invocation:

[], int, int, ByteBuffer)
    ByteBuffer [] { src , 0, 1, dst);}

 public SSLEngineResult wrap(ByteBuffer[] srcs,
    ByteBuffer dst) throws SSLException 
{
        if (srcs == null) {
            throw new IllegalArgumentException("src == null");
        }
        return wrap(srcs, 0, srcs.length, dst);
}

Attempts to encode plaintext bytes from a sequence of data buffers into SSL/TLS network data.

An invocation of this method behaves in exactly the same manner as the invocation:

[], int, int, ByteBuffer)
    0, srcs.length, dst); 

 abstract public SSLEngineResult wrap(ByteBuffer[] srcs,
    int offset,
    int length,
    ByteBuffer dst) throws SSLException
Attempts to encode plaintext bytes from a subsequence of data
buffers into SSL/TLS network data.  This "gathering"
operation encodes, in a single invocation, a sequence of bytes
from one or more of a given sequence of buffers.  Gathering
wraps are often useful when implementing network protocols or
file formats that, for example, group data into segments
consisting of one or more fixed-length headers followed by a
variable-length body.  See
java.nio.channels.GatheringByteChannel  for more
information on gathering, and java.nio.channels.GatheringByteChannel#write(ByteBuffer[],
int, int)  for more information on the subsequence
behavior.

Depending on the state of the SSLEngine, this method may produce
network data without consuming any application data (for example,
it may generate handshake data.)

The application is responsible for reliably transporting the
network data to the peer, and for ensuring that data created by
multiple calls to wrap() is transported in the same order in which
it was generated.  The application must properly synchronize
multiple calls to this method.

If this SSLEngine has not yet started its initial
handshake, this method will automatically start the handshake.

This method will attempt to produce one SSL/TLS packet, and will
consume as much source data as possible, but will never consume
more than the sum of the bytes remaining in each buffer.  Each
ByteBuffer's position is updated to reflect the
amount of data consumed or produced.  The limits remain the
same.

The underlying memory used by the srcs and
dst ByteBuffers must not be the same.

See the class description for more information on engine closure.