Class OpenSSLPreSharedKeySelector

java.lang.Object
org.apache.tomcat.util.net.openssl.OpenSSLPreSharedKeySelector
All Implemented Interfaces:
PreSharedKeySelector
public class OpenSSLPreSharedKeySelector extends Object implements PreSharedKeySelector
Callback implementation that Tomcat uses to select a pre-shared key for a given connection based on the identity provided by the client.

  • Constructor Summary

    Constructors
    Constructor
    Description
    OpenSSLPreSharedKeySelector(Set<SSLHostConfigPreSharedKey> psks)
    Creates a selector for the given set of pre-shared keys.

  • Method Summary

    Modifier and Type
    Method
    Description
    byte[]
    select(long ssl, byte[] identity, int[] cipherSuite)
    Selects the TLSv1.3 pre-shared key and digest on the server side given the provided client identity.
    byte[]
    select(long ssl, String identity)
    Selects the TLSv1.2 pre-shared key on the server side given the provided client identity.
    byte[]
    selectClient(long ssl, String[] identity)
    Selects the TLSv1.2 identity and pre-shared key that the client will present to a server.
    byte[]
    selectClient(long ssl, String[] identity, int[] cipherSuite)
    Selects the TLSv1.3 identity, pre-shared key and digest that the client will present to a server.

    Methods inherited from class Object

    clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait

  • Constructor Details

    • OpenSSLPreSharedKeySelector

      public OpenSSLPreSharedKeySelector(Set<SSLHostConfigPreSharedKey> psks)
      Creates a selector for the given set of pre-shared keys.
      Parameters:
      psks - The pre-shared keys to select from
      Throws:
      IllegalArgumentException - if multiple pre-shared keys share the same identity

  • Method Details

    • selectClient

      public byte[] selectClient(long ssl, String[] identity)
      Description copied from interface: PreSharedKeySelector
      Selects the TLSv1.2 identity and pre-shared key that the client will present to a server.
      Specified by:
      selectClient in interface PreSharedKeySelector
      Parameters:
      ssl - the SSL instance
      identity - a single-element array that must be populated with the PSK identity
      Returns:
      the pre-shared key, or null if no key is available

    • select

      public byte[] select(long ssl, String identity)
      Description copied from interface: PreSharedKeySelector
      Selects the TLSv1.2 pre-shared key on the server side given the provided client identity.
      Specified by:
      select in interface PreSharedKeySelector
      Parameters:
      ssl - the SSL instance
      identity - the PSK identity provided by the client
      Returns:
      the pre-shared key, or null if the identity is not recognized. OpenSSL limits the key to between 1 and 512 bytes long (inclusive). If the byte sequence is truly random then 16 bytes are recommended for 128-bit ciphers and 32 bytes for 256-bit ciphers.

    • select

      public byte[] select(long ssl, byte[] identity, int[] cipherSuite)
      Description copied from interface: PreSharedKeySelector
      Selects the TLSv1.3 pre-shared key and digest on the server side given the provided client identity.

      The callback is a little more complex for TLSv1.3. The return value is still the pre-shared key but OpenSSL also needs to know which digest to use. Because the OpenSSL API only exposes a cipher for this, that is what Tomcat populates the cipherSuite array with but only the digest is relevant.

      Specified by:
      select in interface PreSharedKeySelector
      Parameters:
      ssl - the SSL instance
      identity - the PSK identity provided by the client
      cipherSuite - a single-element array that must be populated with a IANA TLSv1.3 cipher suite identifier
      Returns:
      the pre-shared key (strictly the input to the KDF), or null if the identity is not recognized. OpenSSL limits the key to between 1 and 48 bytes long (inclusive). If the byte sequence is truly random then 16 bytes are recommended for 128-bit ciphers and 32 bytes for 256-bit ciphers.

    • selectClient

      public byte[] selectClient(long ssl, String[] identity, int[] cipherSuite)
      Description copied from interface: PreSharedKeySelector
      Selects the TLSv1.3 identity, pre-shared key and digest that the client will present to a server.
      Specified by:
      selectClient in interface PreSharedKeySelector
      Parameters:
      ssl - the SSL instance
      identity - a single-element array that must be populated with the PSK identity
      cipherSuite - a single-element array that must be populated with a IANA TLSv1.3 cipher suite identifier
      Returns:
      the pre-shared key (strictly the input to the KDF), or null if no key is available