/* * Copyright (c) 2003, 2008, Oracle and/or its affiliates. All rights reserved. * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER. * * This code is free software; you can redistribute it and/or modify it * under the terms of the GNU General Public License version 2 only, as * published by the Free Software Foundation.  Oracle designates this * particular file as subject to the "Classpath" exception as provided * by Oracle in the LICENSE file that accompanied this code. * * This code is distributed in the hope that it will be useful, but WITHOUT * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or * FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License * version 2 for more details (a copy is included in the LICENSE file that * accompanied this code). * * You should have received a copy of the GNU General Public License version * 2 along with this work; if not, write to the Free Software Foundation, * Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA. * * Please contact Oracle, 500 Oracle Parkway, Redwood Shores, CA 94065 USA * or visit www.oracle.com if you need additional information or have any * questions. */ package javax.rmi.ssl; import java.io.IOException;import java.net.ServerSocket;import java.net.Socket;import java.rmi.server.RMIServerSocketFactory;import java.util.Arrays;import java.util.List;import javax.net.ssl.SSLContext;import javax.net.ssl.SSLServerSocketFactory;import javax.net.ssl.SSLSocket;import javax.net.ssl.SSLSocketFactory; /** * <p>An <code>SslRMIServerSocketFactory</code> instance is used by the RMI * runtime in order to obtain server sockets for RMI calls via SSL.</p> * * <p>This class implements <code>RMIServerSocketFactory</code> over * the Secure Sockets Layer (SSL) or Transport Layer Security (TLS) * protocols.</p> * * <p>This class creates SSL sockets using the default * <code>SSLSocketFactory</code> (see {@link * SSLSocketFactory#getDefault}) or the default * <code>SSLServerSocketFactory</code> (see {@link * SSLServerSocketFactory#getDefault}) unless the * constructor taking an <code>SSLContext</code> is * used in which case the SSL sockets are created using * the <code>SSLSocketFactory</code> returned by * {@link SSLContext#getSocketFactory} or the * <code>SSLServerSocketFactory</code> returned by * {@link SSLContext#getServerSocketFactory}. * * When an <code>SSLContext</code> is not supplied all the instances of this * class share the same keystore, and the same truststore (when client * authentication is required by the server). This behavior can be modified * by supplying an already initialized <code>SSLContext</code> instance. * * @see javax.net.ssl.SSLSocketFactory * @see javax.net.ssl.SSLServerSocketFactory * @see javax.rmi.ssl.SslRMIClientSocketFactory * @since 1.5 */public class SslRMIServerSocketFactory implements RMIServerSocketFactory {     /**     * <p>Creates a new <code>SslRMIServerSocketFactory</code> with     * the default SSL socket configuration.</p>     *     * <p>SSL connections accepted by server sockets created by this     * factory have the default cipher suites and protocol versions     * enabled and do not require client authentication.</p>     */    public SslRMIServerSocketFactory() {        this(null, null, false);    }     /**     * <p>Creates a new <code>SslRMIServerSocketFactory</code> with     * the specified SSL socket configuration.</p>     *     * @param enabledCipherSuites names of all the cipher suites to     * enable on SSL connections accepted by server sockets created by     * this factory, or <code>null</code> to use the cipher suites     * that are enabled by default     *     * @param enabledProtocols names of all the protocol versions to     * enable on SSL connections accepted by server sockets created by     * this factory, or <code>null</code> to use the protocol versions     * that are enabled by default     *     * @param needClientAuth <code>true</code> to require client     * authentication on SSL connections accepted by server sockets     * created by this factory; <code>false</code> to not require     * client authentication     *     * @exception IllegalArgumentException when one or more of the cipher     * suites named by the <code>enabledCipherSuites</code> parameter is     * not supported, when one or more of the protocols named by the     * <code>enabledProtocols</code> parameter is not supported or when     * a problem is encountered while trying to check if the supplied     * cipher suites and protocols to be enabled are supported.     *     * @see SSLSocket#setEnabledCipherSuites     * @see SSLSocket#setEnabledProtocols     * @see SSLSocket#setNeedClientAuth     */    public SslRMIServerSocketFactory(            String[] enabledCipherSuites,            String[] enabledProtocols,            boolean needClientAuth)            throws IllegalArgumentException {        this(null, enabledCipherSuites, enabledProtocols, needClientAuth);    }     /**     * <p>Creates a new <code>SslRMIServerSocketFactory</code> with the     * specified <code>SSLContext</code> and SSL socket configuration.</p>     *     * @param context the SSL context to be used for creating SSL sockets.     * If <code>context</code> is null the default <code>SSLSocketFactory</code>     * or the default <code>SSLServerSocketFactory</code> will be used to     * create SSL sockets. Otherwise, the socket factory returned by     * <code>SSLContext.getSocketFactory()</code> or     * <code>SSLContext.getServerSocketFactory()</code> will be used instead.     *     * @param enabledCipherSuites names of all the cipher suites to     * enable on SSL connections accepted by server sockets created by     * this factory, or <code>null</code> to use the cipher suites     * that are enabled by default     *     * @param enabledProtocols names of all the protocol versions to     * enable on SSL connections accepted by server sockets created by     * this factory, or <code>null</code> to use the protocol versions     * that are enabled by default     *     * @param needClientAuth <code>true</code> to require client     * authentication on SSL connections accepted by server sockets     * created by this factory; <code>false</code> to not require     * client authentication     *     * @exception IllegalArgumentException when one or more of the cipher     * suites named by the <code>enabledCipherSuites</code> parameter is     * not supported, when one or more of the protocols named by the     * <code>enabledProtocols</code> parameter is not supported or when     * a problem is encountered while trying to check if the supplied     * cipher suites and protocols to be enabled are supported.     *     * @see SSLSocket#setEnabledCipherSuites     * @see SSLSocket#setEnabledProtocols     * @see SSLSocket#setNeedClientAuth     * @since 1.7     */    public SslRMIServerSocketFactory(            SSLContext context,            String[] enabledCipherSuites,            String[] enabledProtocols,            boolean needClientAuth)            throws IllegalArgumentException {        // Initialize the configuration parameters.        //        this.enabledCipherSuites = enabledCipherSuites == null ?            null : enabledCipherSuites.clone();        this.enabledProtocols = enabledProtocols == null ?            null : enabledProtocols.clone();        this.needClientAuth = needClientAuth;         // Force the initialization of the default at construction time,        // rather than delaying it to the first time createServerSocket()        // is called.        //        this.context = context;        final SSLSocketFactory sslSocketFactory =                context == null ?                    getDefaultSSLSocketFactory() : context.getSocketFactory();        SSLSocket sslSocket = null;        if (this.enabledCipherSuites != null || this.enabledProtocols != null) {            try {                sslSocket = (SSLSocket) sslSocketFactory.createSocket();            } catch (Exception e) {                final String msg = "Unable to check if the cipher suites " +                        "and protocols to enable are supported";                throw (IllegalArgumentException)                new IllegalArgumentException(msg).initCause(e);            }        }         // Check if all the cipher suites and protocol versions to enable        // are supported by the underlying SSL/TLS implementation and if        // true create lists from arrays.        //        if (this.enabledCipherSuites != null) {            sslSocket.setEnabledCipherSuites(this.enabledCipherSuites);            enabledCipherSuitesList = Arrays.asList(this.enabledCipherSuites);        }        if (this.enabledProtocols != null) {            sslSocket.setEnabledProtocols(this.enabledProtocols);            enabledProtocolsList = Arrays.asList(this.enabledProtocols);        }    }     /**     * <p>Returns the names of the cipher suites enabled on SSL     * connections accepted by server sockets created by this factory,     * or <code>null</code> if this factory uses the cipher suites     * that are enabled by default.</p>     *     * @return an array of cipher suites enabled, or <code>null</code>     *     * @see SSLSocket#setEnabledCipherSuites     */    public final String[] getEnabledCipherSuites() {        return enabledCipherSuites == null ?            null : enabledCipherSuites.clone();    }     /**     * <p>Returns the names of the protocol versions enabled on SSL     * connections accepted by server sockets created by this factory,     * or <code>null</code> if this factory uses the protocol versions     * that are enabled by default.</p>     *     * @return an array of protocol versions enabled, or     * <code>null</code>     *     * @see SSLSocket#setEnabledProtocols     */    public final String[] getEnabledProtocols() {        return enabledProtocols == null ?            null : enabledProtocols.clone();    }     /**     * <p>Returns <code>true</code> if client authentication is     * required on SSL connections accepted by server sockets created     * by this factory.</p>     *     * @return <code>true</code> if client authentication is required     *     * @see SSLSocket#setNeedClientAuth     */    public final boolean getNeedClientAuth() {        return needClientAuth;    }     /**     * <p>Creates a server socket that accepts SSL connections     * configured according to this factory's SSL socket configuration     * parameters.</p>     */    public ServerSocket createServerSocket(int port) throws IOException {        final SSLSocketFactory sslSocketFactory =                context == null ?                    getDefaultSSLSocketFactory() : context.getSocketFactory();        return new ServerSocket(port) {            public Socket accept() throws IOException {                Socket socket = super.accept();                SSLSocket sslSocket = (SSLSocket) sslSocketFactory.createSocket(                        socket, socket.getInetAddress().getHostName(),                        socket.getPort(), true);                sslSocket.setUseClientMode(false);                if (enabledCipherSuites != null) {                    sslSocket.setEnabledCipherSuites(enabledCipherSuites);                }                if (enabledProtocols != null) {                    sslSocket.setEnabledProtocols(enabledProtocols);                }                sslSocket.setNeedClientAuth(needClientAuth);                return sslSocket;            }        };    }     /**     * <p>Indicates whether some other object is "equal to" this one.</p>     *     * <p>Two <code>SslRMIServerSocketFactory</code> objects are equal     * if they have been constructed with the same SSL context and     * SSL socket configuration parameters.</p>     *     * <p>A subclass should override this method (as well as     * {@link #hashCode()}) if it adds instance state that affects     * equality.</p>     */    public boolean equals(Object obj) {        if (obj == null) return false;        if (obj == this) return true;        if (!(obj instanceof SslRMIServerSocketFactory))            return false;        SslRMIServerSocketFactory that = (SslRMIServerSocketFactory) obj;        return (getClass().equals(that.getClass()) && checkParameters(that));    }     private boolean checkParameters(SslRMIServerSocketFactory that) {        // SSL context        //        if (context == null ? that.context != null : !context.equals(that.context))            return false;         // needClientAuth flag        //        if (needClientAuth != that.needClientAuth)            return false;         // enabledCipherSuites        //        if ((enabledCipherSuites == null && that.enabledCipherSuites != null) ||                (enabledCipherSuites != null && that.enabledCipherSuites == null))            return false;        if (enabledCipherSuites != null && that.enabledCipherSuites != null) {            List<String> thatEnabledCipherSuitesList =                    Arrays.asList(that.enabledCipherSuites);            if (!enabledCipherSuitesList.equals(thatEnabledCipherSuitesList))                return false;        }         // enabledProtocols        //        if ((enabledProtocols == null && that.enabledProtocols != null) ||                (enabledProtocols != null && that.enabledProtocols == null))            return false;        if (enabledProtocols != null && that.enabledProtocols != null) {            List<String> thatEnabledProtocolsList =                    Arrays.asList(that.enabledProtocols);            if (!enabledProtocolsList.equals(thatEnabledProtocolsList))                return false;        }         return true;    }     /**     * <p>Returns a hash code value for this     * <code>SslRMIServerSocketFactory</code>.</p>     *     * @return a hash code value for this     * <code>SslRMIServerSocketFactory</code>.     */    public int hashCode() {        return getClass().hashCode() +                (context == null ? 0 : context.hashCode()) +                (needClientAuth ? Boolean.TRUE.hashCode() : Boolean.FALSE.hashCode()) +                (enabledCipherSuites == null ? 0 : enabledCipherSuitesList.hashCode()) +                (enabledProtocols == null ? 0 : enabledProtocolsList.hashCode());    }     // We use a static field because:    //    //    SSLSocketFactory.getDefault() always returns the same object    //    (at least on Sun's implementation), and we want to make sure    //    that the Javadoc & the implementation stay in sync.    //    // If someone needs to have different SslRMIServerSocketFactory    // factories with different underlying SSLSocketFactory objects    // using different keystores and truststores, he/she can always    // use the constructor that takes an SSLContext as input.    //    private static SSLSocketFactory defaultSSLSocketFactory = null;     private static synchronized SSLSocketFactory getDefaultSSLSocketFactory() {        if (defaultSSLSocketFactory == null)            defaultSSLSocketFactory =                    (SSLSocketFactory) SSLSocketFactory.getDefault();        return defaultSSLSocketFactory;    }     private final String[] enabledCipherSuites;    private final String[] enabledProtocols;    private final boolean needClientAuth;    private List<String> enabledCipherSuitesList;    private List<String> enabledProtocolsList;    private SSLContext context;}