In order to securely store sessions, along with private key data, * the abstract methods {@lnk {@link #load(char[])} and {@link #store(char[])} * come into play. When storing sessions, a session context implementation * must pass this password to the {@link Session#prepare(char[])} method, * before either writing the {@link java.io.Serializable} session to the * underlying store, or getting the opaque {@link Session#privateData()} * class from the session, and storing that. * *
As a simple example, that writes sessions to some object output * stream: * *
char[] password = ...;
ObjectOutputStream out = ...;
...
for (Session s : this)
{
s.prepare(password);
out.writeObject(s);
}
*
* The reverse must be done when deserializing sessions, by using the * {@link Session#repair(char[])} method, possibly by first calling * {@link Session#setPrivateData(java.io.Serializable)} with the read, * opaque private data type. Thus an example of reading may be: * *
char[] password = ...;
ObjectInputStream in = ...;
...
while (hasMoreSessions(in))
{
Session s = (Session) in.readObject();
s.repair(password);
addToThisStore(s);
}
*
* @author Casey Marshall (csm@gnu.org)
*/
public abstract class AbstractSessionContext implements SSLSessionContext
{
protected long timeout;
private static Class
implClass = SimpleSessionContext.class;
/**
* Create a new instance of a session context, according to the configured
* implementation class.
*
* @return The new session context.
* @throws SSLException If an error occurs in creating the instance.
*/
public static AbstractSessionContext newInstance () throws SSLException
{
try
{
return implClass.newInstance();
}
catch (IllegalAccessException iae)
{
throw new SSLException(iae);
}
catch (InstantiationException ie)
{
throw new SSLException(ie);
}
}
/**
* Reconfigure this instance to use a different session context
* implementation.
*
* Note: this method requires that the caller have
* {@link SSLPermission} with target
* gnu.javax.net.ssl.AbstractSessionContext and action
* setImplClass.
*
* @param clazz The new implementation class.
* @throws SecurityException If the caller does not have permission to
* change the session context.
*/
@Requires(permissionClass = SSLPermission.class,
target = "gnu.javax.net.ssl.AbstractSessionContext",
action = "setImplClass")
public static synchronized void setImplClass
(Class clazz)
throws SecurityException
{
SecurityManager sm = System.getSecurityManager ();
if (sm != null)
sm.checkPermission(new SSLPermission("gnu.javax.net.ssl.AbstractSessionContext",
"setImplClass"));
implClass = clazz;
}
/**
* @param timeout The initial session timeout.
*/
protected AbstractSessionContext (final int timeout)
{
setSessionTimeout(timeout);
}
/**
* Fetch a saved session by its ID. This method will (possibly)
* deserialize and return the SSL session with that ID, or null if
* the requested session does not exist, or has expired.
*
*
Subclasses implementing this class must not
* perform any blocking operations in this method. If any blocking
* behavior is required, it must be done in the {@link load(char[])}
* method.
*
* @param sessionId The ID of the session to get.
* @return The found session, or null if no such session was found,
* or if that session has expired.
*/
public final SSLSession getSession (byte[] sessionId)
{
Session s = implGet (sessionId);
if (s != null
&& System.currentTimeMillis () - s.getLastAccessedTime () > timeout)
{
remove (sessionId);
return null;
}
return s;
}
public final SSLSession getSession(String host, int port)
{
for (Enumeration e = getIds(); e.hasMoreElements(); )
{
byte[] id = (byte[]) e.nextElement();
SSLSession s = getSession(id);
if (s == null) // session expired.
continue;
String host2 = s.getPeerHost();
if (host == null)
{
if (host2 != null)
continue;
}
else if (!host.equals(host2))
continue;
int port2 = s.getPeerPort();
if (port != port2)
continue;
// Else, a match.
return s;
}
return null;
}
/**
* To be implemented by subclasses. Subclasses do not need to check
* timeouts in this method.
*
* @param sessionId The session ID.
* @return The session, or null if the requested session
* was not found.
*/
protected abstract Session implGet (byte[] sessionId);
public int getSessionTimeout()
{
return (int) (timeout / 1000);
}
/**
* Load this session store from the underlying media, if supported
* by the implementation.
*
* @param password The password that protects the sensitive data in
* this store.
* @throws SessionStoreException If reading this store fails, such
* as when an I/O exception occurs, or if the password is incorrect.
*/
public abstract void load (char[] password) throws SessionStoreException;
/**
* Add a new session to the store. The underlying implementation
* will add the session to its store, possibly overwriting any
* existing session with the same ID.
*
*
Subclasses implementing this class must not * perform any blocking operations in this method. If any blocking * behavior is required, it must be done in the {@link * #store(char[])} method. * * @param session The session to add. * @throws NullPointerException If the argument is null. */ public abstract void put (Session session); /** * Remove a session from this store. * *
Subclasses implementing this class must not * perform any blocking operations in this method. If any blocking * behavior is required, it must be done in the {@link * #store(char[])} method. * * @param sessionId The ID of the session to remove. */ public abstract void remove (byte[] sessionId); /** * */ public final void setSessionTimeout(int seconds) { if (timeout < 0) throw new IllegalArgumentException("timeout may not be negative"); this.timeout = (long) seconds * 1000; } /** * Commit this session store to the underlying media. For session * store implementations that support saving sessions across * invocations of the JVM, this method will save any sessions that * have not expired to some persistent media, so they may be loaded * and used again later. * * @param password The password that will protect the sensitive data * in this store. */ public abstract void store (char[] password) throws SessionStoreException; }