HttpsClient.java revision 0
869N/A * Copyright 2001-2007 Sun Microsystems, Inc. All Rights Reserved. 869N/A * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER. 869N/A * This code is free software; you can redistribute it and/or modify it 869N/A * under the terms of the GNU General Public License version 2 only, as 869N/A * published by the Free Software Foundation. Sun designates this 869N/A * particular file as subject to the "Classpath" exception as provided 869N/A * by Sun in the LICENSE file that accompanied this code. 869N/A * This code is distributed in the hope that it will be useful, but WITHOUT 869N/A * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or 869N/A * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License 869N/A * version 2 for more details (a copy is included in the LICENSE file that 869N/A * accompanied this code). 869N/A * You should have received a copy of the GNU General Public License version 873N/A * 2 along with this work; if not, write to the Free Software Foundation, 869N/A * Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA. 869N/A * Please contact Sun Microsystems, Inc., 4150 Network Circle, Santa Clara, 869N/A * CA 95054 USA or visit www.sun.com if you need additional information or 1411N/A * This class provides HTTPS client URL support, building on the standard 1503N/A * "sun.net.www" HTTP protocol handler. HTTPS is the same protocol as HTTP, 869N/A * but differs in the transport layer which it uses: <UL> 1004N/A * <LI>There's a <em>Secure Sockets Layer</em> between TCP 0N/A * and the HTTP protocol code. 869N/A * <LI>It uses a different default TCP port. 0N/A * <LI>It doesn't use application level proxies, which can see and 0N/A * manipulate HTTP user level data, compromising privacy. It uses 65N/A * low level tunneling instead, which hides HTTP protocol and data 869N/A * from all third parties. (Traffic analysis is still possible). 65N/A * <LI>It does basic server authentication, to protect 869N/A * against "URL spoofing" attacks. This involves deciding 65N/A * whether the X.509 certificate chain identifying the server 65N/A * is trusted, and verifying that the name of the server is 65N/A * found in the certificate. (The application may enable an 65N/A * anonymous SSL cipher suite, and such checks are not done 65N/A * for anonymous ciphers.) 65N/A * <LI>It exposes key SSL session attributes, specifically the 65N/A * cipher suite in use and the server's X509 certificates, to 65N/A * application software which knows about this protocol handler. 65N/A * <P> System properties used include: <UL> 65N/A * <LI><em>https.proxyHost</em> ... the host supporting SSL 0N/A * tunneling using the conventional CONNECT syntax 868N/A * <LI><em>https.proxyPort</em> ... port to use on proxyHost 0N/A * <LI><em>https.cipherSuites</em> ... comma separated list of 0N/A * SSL cipher suite names to enable. 0N/A * <LI><em>http.nonProxyHosts</em> ... 0N/A * @author David Brownell 0N/A * @author Bill Foote 0N/A// final for export control reasons (access to APIs); remove with care 0N/A // STATIC STATE and ACCESSORS THERETO 868N/A // HTTPS uses a different default port number than HTTP. 868N/A /** Returns the default HTTPS port (443) */ 1790N/A // HttpClient.proxyDisabled will always be false, because we don't 48N/A // use an application-level HTTP proxy. We might tunnel through 869N/A // our http proxy, though. 868N/A // last negotiated SSL session 1155N/A // If ciphers are assigned, sort them into an array. 848N/A // If protocols are assigned, sort them into an array. 869N/A // should remove once HttpClient.newHttpProxy is putback 868N/A // CONSTRUCTOR, FACTORY 869N/A * Create an HTTPS client URL. Traffic will be tunneled through any 868N/A * intermediate nodes rather than proxied, so that confidentiality 868N/A * of data exchanged can be preserved. However, note that all the 868N/A * anonymous SSL flavors are subject to "person-in-the-middle" 868N/A * attacks against confidentiality. If you enable use of those 868N/A * flavors, you may be giving up the protection you get through 869N/A * Use New to get new HttpsClient. This constructor is meant to be 868N/A * used only by New method. New properly checks for URL spoofing. 868N/A * @param URL https URL with which a connection must be established 869N/A // HttpClient-level proxying is always disabled, 868N/A // because we override doConnect to do tunneling instead. 2222N/A * Create an HTTPS client URL. Traffic will be tunneled through 868N/A * the specified proxy server. 869N/A * Create an HTTPS client URL. Traffic will be tunneled through 869N/A * the specified proxy server, with a connect timeout 869N/A * Same as previous constructor except using a Proxy 869N/A // get the cookieHandler if there is any 869N/A // This code largely ripped off from HttpClient.New, and 869N/A // it uses the same keepalive cache. 869N/A /** See HttpClient for the model for this method. */ 824N/A * Get a HTTPS client to the URL. Traffic will be tunneled through 824N/A * the specified proxy server. 869N/A /* see if one's already around */ 869N/A // If we fail to connect through the tunnel, try it 869N/A // locally, as a last resort. If this doesn't work, 868N/A // throw the original exception. 869N/A // Force handshaking, so that we get any authentication. 869N/A // Register a handshake callback so our session state tracks any 869N/A // later session renegotiations. 0N/A // if the HostnameVerifier is not set, try to enable endpoint 0N/A // identification during handshaking 869N/A // change the serverSocket and serverOutput 1952N/A // check URL spoofing if it has not been checked under handshaking 869N/A // if we are reusing a cached https session, 0N/A // we don't need to do handshaking etc. But we do need to 0N/A // set the ssl session 1653N/A // Server identity checking is done according to RFC 2818: HTTP over TLS 1653N/A // Section 3.1 Server Identity 0N/A // Get authenticated server name, if any 0N/A // if IPv6 strip off the "[]" 988N/A " failed for Kerberos");
988N/A // get the subject's certificate 1102N/A // if it doesn't throw an exception, we passed. Return. 868N/A // client explicitly changed default policy and enabled 0N/A // anonymous ciphers; we can't check the standard policy 824N/A * Returns the cipher suite in use on this connection. 869N/A * Returns the certificate chain the client sent to the 869N/A * server, or null if the client did not authenticate. 869N/A * Returns the certificate chain with which the server 869N/A * authenticated itself, or throw a SSLPeerUnverifiedException 869N/A * if the server did not authenticate. 869N/A * Returns the X.509 certificate chain with which the server 868N/A * authenticated itself, or null if the server did not authenticate. 0N/A * Returns the principal with which the server authenticated 869N/A * itself, or throw a SSLPeerUnverifiedException if the 868N/A * server did not authenticate. 1801N/A // if the provider does not support it, fallback to peer certs. 1280N/A // return the X500Principal of the end-entity cert. 869N/A * Returns the principal the client sent to the 1280N/A * server, or null if the client did not authenticate. 1280N/A // if the provider does not support it, fallback to local certs. 1280N/A // return the X500Principal of the end-entity cert. 1280N/A * This method implements the SSL HandshakeCompleted callback, 1280N/A * remembering the resulting session so that it may be queried 1280N/A * for the current cipher suite and peer certificates. Servers 1280N/A * sometimes re-initiate handshaking, so the session in use on 1280N/A * a given connection may change. When sessions change, so may 1280N/A * peer identities and cipher suites. 2132N/A * @return the proxy host being used for this client, or null 2132N/A * if we're not going through a proxy 0N/A * @return the proxy port being used for this client. Meaningless 869N/A * if getProxyHostUsed() gives null.