SSLSocketFactorys create SSLSockets.
*
* @since 1.4
* @see SSLSocket
* @author David Brownell
*/
public abstract class SSLSocketFactory extends SocketFactory
{
// Android-changed: Renamed field.
// Some apps rely on changing this field via reflection, so we can't change the name
// without introducing app compatibility problems. See http://b/62248930.
private static SSLSocketFactory defaultSocketFactory;
// Android-changed: Check Security.getVersion() on each update.
// If the set of providers or other such things changes, it may change the default
// factory, so we track the version returned from Security.getVersion() instead of
// only having a flag that says if we've ever initialized the default.
// private static boolean propertyChecked;
private static int lastVersion = -1;
static final boolean DEBUG;
static {
String s = java.security.AccessController.doPrivileged(
new GetPropertyAction("javax.net.debug", "")).toLowerCase(
Locale.ENGLISH);
DEBUG = s.contains("all") || s.contains("ssl");
}
private static void log(String msg) {
if (DEBUG) {
System.out.println(msg);
}
}
/**
* Constructor is used only by subclasses.
*/
public SSLSocketFactory() {
}
/**
* Returns the default SSL socket factory.
*
* The first time this method is called, the security property * "ssl.SocketFactory.provider" is examined. If it is non-null, a class by * that name is loaded and instantiated. If that is successful and the * object is an instance of SSLSocketFactory, it is made the default SSL * socket factory. * *
Otherwise, this method returns
* Applications should not blindly enable all supported
* cipher suites. The supported cipher suites can include signaling cipher suite
* values that can cause connection problems if enabled inappropriately.
*
* The proper way to use this method is to either check if a specific cipher
* suite is supported via {@code Arrays.asList(getSupportedCipherSuites()).contains(...)}
* or to filter a desired list of cipher suites to only the supported ones via
* {@code desiredSuiteSet.retainAll(Arrays.asList(getSupportedCipherSuites()))}.
*
* @see #getDefaultCipherSuites()
* @return an array of cipher suite names
*/
public abstract String [] getSupportedCipherSuites();
/**
* Returns a socket layered over an existing socket connected to the named
* host, at the given port. This constructor can be used when tunneling SSL
* through a proxy or when negotiating the use of SSL over an existing
* socket. The host and port refer to the logical peer destination.
* This socket is configured using the socket options established for
* this factory.
*
* @param s the existing socket
* @param host the server host
* @param port the server port
* @param autoClose close the underlying socket when this socket is closed
* @return a socket connected to the specified host and port
* @throws IOException if an I/O error occurs when creating the socket
* @throws NullPointerException if the parameter s is null
*/
public abstract Socket createSocket(Socket s, String host,
int port, boolean autoClose) throws IOException;
/**
* Creates a server mode {@link Socket} layered over an
* existing connected socket, and is able to read data which has
* already been consumed/removed from the {@link Socket}'s
* underlying {@link InputStream}.
*
* This method can be used by a server application that needs to
* observe the inbound data but still create valid SSL/TLS
* connections: for example, inspection of Server Name Indication
* (SNI) extensions (See section 3 of TLS Extensions
* (RFC6066)). Data that has been already removed from the
* underlying {@link InputStream} should be loaded into the
* {@code consumed} stream before this method is called, perhaps
* using a {@link java.io.ByteArrayInputStream}. When this
* {@link Socket} begins handshaking, it will read all of the data in
* {@code consumed} until it reaches {@code EOF}, then all further
* data is read from the underlying {@link InputStream} as
* usual.
*
* The returned socket is configured using the socket options
* established for this factory, and is set to use server mode when
* handshaking (see {@link SSLSocket#setUseClientMode(boolean)}).
*
* @param s
* the existing socket
* @param consumed
* the consumed inbound network data that has already been
* removed from the existing {@link Socket}
* {@link InputStream}. This parameter may be
* {@code null} if no data has been removed.
* @param autoClose close the underlying socket when this socket is closed.
*
* @return the {@link Socket} compliant with the socket options
* established for this factory
*
* @throws IOException if an I/O error occurs when creating the socket
* @throws UnsupportedOperationException if the underlying provider
* does not implement the operation
* @throws NullPointerException if {@code s} is {@code null}
*
* @since 1.8
*
* @hide
*/
public Socket createSocket(Socket s, InputStream consumed,
boolean autoClose) throws IOException {
throw new UnsupportedOperationException();
}
}
// file private
class DefaultSSLSocketFactory extends SSLSocketFactory
{
private Exception reason;
DefaultSSLSocketFactory(Exception reason) {
this.reason = reason;
}
private Socket throwException() throws SocketException {
throw (SocketException)
new SocketException(reason.toString()).initCause(reason);
}
@Override
public Socket createSocket()
throws IOException
{
return throwException();
}
@Override
public Socket createSocket(String host, int port)
throws IOException
{
return throwException();
}
@Override
public Socket createSocket(Socket s, String host,
int port, boolean autoClose)
throws IOException
{
return throwException();
}
@Override
public Socket createSocket(InetAddress address, int port)
throws IOException
{
return throwException();
}
@Override
public Socket createSocket(String host, int port,
InetAddress clientAddress, int clientPort)
throws IOException
{
return throwException();
}
@Override
public Socket createSocket(InetAddress address, int port,
InetAddress clientAddress, int clientPort)
throws IOException
{
return throwException();
}
@Override
public String [] getDefaultCipherSuites() {
return new String[0];
}
@Override
public String [] getSupportedCipherSuites() {
return new String[0];
}
}
SSLContext.getDefault().getSocketFactory(). If that
* call fails, an inoperative factory is returned.
*
* @return the default SocketFactory
* @see SSLContext#getDefault
*/
public static synchronized SocketFactory getDefault() {
// Android-changed: Check Security.getVersion() on each update.
if (defaultSocketFactory != null && lastVersion == Security.getVersion()) {
return defaultSocketFactory;
}
lastVersion = Security.getVersion();
SSLSocketFactory previousDefaultSocketFactory = defaultSocketFactory;
defaultSocketFactory = null;
String clsName = getSecurityProperty("ssl.SocketFactory.provider");
if (clsName != null) {
// Android-changed: Check if we already have an instance of the default factory class.
// The instance for the default socket factory is checked for updates quite
// often (for instance, every time a security provider is added). Which leads
// to unnecessary overload and excessive error messages in case of class-loading
// errors. Avoid creating a new object if the class name is the same as before.
if (previousDefaultSocketFactory != null
&& clsName.equals(previousDefaultSocketFactory.getClass().getName())) {
defaultSocketFactory = previousDefaultSocketFactory;
return defaultSocketFactory;
}
log("setting up default SSLSocketFactory");
try {
Class cls = null;
try {
cls = Class.forName(clsName);
} catch (ClassNotFoundException e) {
// Android-changed: Try the contextClassLoader first.
ClassLoader cl = Thread.currentThread().getContextClassLoader();
if (cl == null) {
cl = ClassLoader.getSystemClassLoader();
}
if (cl != null) {
// Android-changed: Use Class.forName() so the class gets initialized.
cls = Class.forName(clsName, true, cl);
}
}
log("class " + clsName + " is loaded");
SSLSocketFactory fac = (SSLSocketFactory)cls.newInstance();
log("instantiated an instance of class " + clsName);
defaultSocketFactory = fac;
return fac;
} catch (Exception e) {
log("SSLSocketFactory instantiation failed: " + e.toString());
// Android-changed: Fallback to the default SSLContext on exception.
}
}
try {
// Android-changed: Allow for {@code null} SSLContext.getDefault.
SSLContext context = SSLContext.getDefault();
if (context != null) {
defaultSocketFactory = context.getSocketFactory();
} else {
defaultSocketFactory = new DefaultSSLSocketFactory(new IllegalStateException("No factory found."));
}
return defaultSocketFactory;
} catch (NoSuchAlgorithmException e) {
return new DefaultSSLSocketFactory(e);
}
}
static String getSecurityProperty(final String name) {
return AccessController.doPrivileged(new PrivilegedAction