org.eclipse.californium.scandium.dtls

Class ServerHandshaker

java.lang.Object

org.eclipse.californium.scandium.dtls.Handshaker

org.eclipse.californium.scandium.dtls.ServerHandshaker

All Implemented Interfaces:

Destroyable

Direct Known Subclasses:

ResumingServerHandshaker

public class ServerHandshaker
extends Handshaker

Server handshaker does the protocol handshaking from the point of view of a server. It is message-driven by the parent Handshaker class.

Field Summary

Fields

Modifier and Type	Field and Description
protected static HandshakeState[]	NO_CLIENT_CERTIFICATE
protected List<XECDHECryptography.SupportedGroup>	supportedGroups The supported groups (curves) ordered by preference.

Fields inherited from class org.eclipse.californium.scandium.dtls.Handshaker

advancedPskStore, certificateChain, certificateVerfied, certificateVerifier, clientRandom, connectionIdGenerator, flightNumber, handshakeMessages, isClient, LOGGER, masterSecret, peerCertPath, privateKey, publicKey, reassembledMessage, recordSizeLimit, serverRandom, session, sniEnabled, states, statesIndex, usedProtocol, useKeyUsageVerification, useStateValidation, useTruncatedCertificatePathForVerification

Constructor Summary

Constructors

Constructor and Description
ServerHandshaker(int initialMessageSequenceNo, DTLSSession session, RecordLayer recordLayer, ScheduledExecutorService timer, Connection connection, DtlsConnectorConfig config) Creates a handshaker for negotiating a DTLS session with a client following the full DTLS handshake protocol.

Method Summary

Methods

Modifier and Type	Method and Description
void	destroy()
protected void	doProcessMessage(HandshakeMessage message) Does the specific processing of a message received from a peer in the course of an ongoing handshake.
PskPublicInformation	getPreSharedKeyIdentity()
protected void	negotiateCipherSuite(ClientHello clientHello, HelloExtensions serverHelloExtensions) Selects one of the client's proposed cipher suites.
protected void	processCertificateVerified() Do the handshaker specific processing of successful verified certificates
protected void	processHelloExtensions(ClientHello clientHello, HelloExtensions serverHelloExtensions)
protected void	processMasterSecret(SecretKey masterSecret) Do the handshaker specific master secret processing
void	startHandshake() Starts the handshake by sending the first flight to the peer.

Methods inherited from class org.eclipse.californium.scandium.dtls.Handshaker

addApplicationDataForDeferredProcessing, addRecordsForDeferredProcessing, addSessionListener, applyMasterSecret, calculateKeys, completePendingFlight, createFlight, ensureUndestroyed, expectChangeCipherSpecMessage, expectMessage, generateRandomSeed, getClientRandom, getConnection, getFailureCause, getHandshakeMessageDigest, getPeerAddress, getReadConnectionId, getServerRandom, getSession, handshakeAborted, handshakeCompleted, handshakeFailed, handshakeFlightRetransmitted, handshakeStarted, hasSessionEstablished, isChangeCipherSpecMessageExpected, isDestroyed, isExpired, isInboundMessageProcessed, isProbing, isPskRequestPending, isRemovingConnection, processAsyncHandshakeResult, processAsyncPskSecretResult, processCertificateVerificationResult, processMessage, processPskSecretResult, reassembleFragment, removeSessionListener, requestPskSecretResult, resetProbing, sendFlight, sendLastFlight, sessionEstablished, setCurrentReadState, setCurrentWriteState, setFailureCause, setGenerateClusterMacKeys, takeDeferredApplicationData, takeDeferredApplicationData, takeDeferredRecords, verifyCertificate, wrapMessage

Methods inherited from class java.lang.Object

clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait

Field Detail

NO_CLIENT_CERTIFICATE

protected static HandshakeState[] NO_CLIENT_CERTIFICATE

supportedGroups

protected final List<XECDHECryptography.SupportedGroup> supportedGroups

The supported groups (curves) ordered by preference.

Since:

2.3

Constructor Detail

ServerHandshaker

public ServerHandshaker(int initialMessageSequenceNo,
                DTLSSession session,
                RecordLayer recordLayer,
                ScheduledExecutorService timer,
                Connection connection,
                DtlsConnectorConfig config)

Creates a handshaker for negotiating a DTLS session with a client following the full DTLS handshake protocol.

Parameters:

initialMessageSequenceNo - the initial message sequence number to expect from the peer (this parameter can be used to initialize the receive_next_seq counter to another value than 0, e.g. if one or more cookie exchange round-trips have been performed with the peer before the handshake starts).

session - the session to negotiate with the client.

recordLayer - the object to use for sending flights to the peer.

timer - scheduled executor for flight retransmission (since 2.4).

connection - the connection related with the session.

config - the DTLS configuration.

Throws:

IllegalStateException - if the message digest required for computing the FINISHED message hash cannot be instantiated.

IllegalArgumentException - if the initialMessageSequenceNo is negative.

NullPointerException - if session, recordLayer or config is null.

Method Detail

getPreSharedKeyIdentity

public PskPublicInformation getPreSharedKeyIdentity()

doProcessMessage

protected void doProcessMessage(HandshakeMessage message)
                         throws HandshakeException,
                                GeneralSecurityException

Description copied from class: Handshaker

Does the specific processing of a message received from a peer in the course of an ongoing handshake. This method does not do anything. Concrete handshaker implementations should override this method in order to prepare the response to the received record.

Specified by:

doProcessMessage in class Handshaker

Parameters:

message - the message received from the peer

Throws:

HandshakeException - if the record's plaintext fragment cannot be parsed into a handshake message or cannot be processed properly

GeneralSecurityException - if the record's ciphertext fragment cannot be decrypted

processMasterSecret

protected void processMasterSecret(SecretKey masterSecret)

Description copied from class: Handshaker

Do the handshaker specific master secret processing

Specified by:

processMasterSecret in class Handshaker

Parameters:

masterSecret - master secret

processCertificateVerified

protected void processCertificateVerified()

Description copied from class: Handshaker

Do the handshaker specific processing of successful verified certificates

Specified by:

processCertificateVerified in class Handshaker

processHelloExtensions

protected void processHelloExtensions(ClientHello clientHello,
                          HelloExtensions serverHelloExtensions)

startHandshake

public void startHandshake()
                    throws HandshakeException

Description copied from class: Handshaker

Starts the handshake by sending the first flight to the peer.

The particular message to be sent depends on this peer's role in the handshake, i.e. if this end represents the client or server.

Specified by:

startHandshake in class Handshaker

Throws:

HandshakeException - if the message to start the handshake cannot be created and sent using the session's current security parameters.

negotiateCipherSuite

protected void negotiateCipherSuite(ClientHello clientHello,
                        HelloExtensions serverHelloExtensions)
                             throws HandshakeException

Selects one of the client's proposed cipher suites.

Iterates through the provided (ordered) list of the client's preferred ciphers until one is found that is also contained in the supportedCipherSuites.

If the client proposes an ECC based cipher suite this method also tries to determine an appropriate Supported Group by means of invoking the getCommonSupportedGroups(ClientHello) method. If at least one group is found it will be stored in the selectedCipherSuiteParameters list. A ECC based cipher suite will only be accepted, if a server certificate with the used curve is available.

The selected cipher suite is set on the session to be negotiated using the DTLSSession.setCipherSuite(CipherSuite) method. The negotiatedServerCertificateType, negotiatedClientCertificateType and negotiatedSupportedGroup fields are set to values corresponding to the selected cipher suite.

The SSL_NULL_WITH_NULL_NULL cipher suite is never negotiated as mandated by RFC 5246 Appendix A.5

Parameters:

clientHello - the CLIENT_HELLO message containing the list of cipher suites the client supports (ordered by preference).

serverHelloExtensions - the container object to add server extensions to that are required for the selected cipher suite.

Throws:

HandshakeException - if this server's configuration does not support any of the cipher suites proposed by the client.

destroy

public void destroy()
             throws DestroyFailedException

Specified by:

destroy in interface Destroyable

Overrides:

destroy in class Handshaker

Throws:

DestroyFailedException