Class Tls

java.lang.Object

com.codename1.backend.Tls

public final class Tls
extends Object

Server-side TLS. One context for the process, one session per connection.

The handshake runs on the worker that picks a connection up, not on the reactor thread: a handshake is several round trips, and doing it on the reactor would block every other connection behind one slow client.

A TLS connection costs an SSL object, so the "an idle connection allocates nothing" property of the plain server does not hold here -- that is inherent to TLS, not a choice. It is also why static files lose their zero-copy path under TLS: sendfile works because the kernel moves bytes it never looks at, and encrypted bytes have to be produced in user space.

Method Summary

Modifier and Type	Method	Description
long	accept(int fd, long budgetMillis)	Runs the handshake on an already-blocking descriptor, giving it budgetMillis in total.
void	close()
static Tls	create(String certPath, String keyPath)	certPath: PEM certificate chain, leaf first
static Tls	create(String certPath, String keyPath, boolean offerHttp2)	offerHttp2: advertise "h2" in ALPN.
static String	negotiatedProtocol(long session)	The protocol ALPN settled on: "h2", "http/1.1", or null.

Methods inherited from class Object

clone, equals, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait

Method Details

create

public static Tls create(String certPath,
 String keyPath)
                  throws IOException

• certPath: PEM certificate chain, leaf first
• keyPath: PEM private key

Throws:

IOException

create

public static Tls create(String certPath,
 String keyPath,
 boolean offerHttp2)
                  throws IOException

• offerHttp2: advertise "h2" in ALPN. There is no upgrade handshake for HTTP/2 over TLS, so a server that does not advertise it here will never speak it however complete the rest of its implementation is.

Throws:

IOException

accept

public long accept(int fd,
 long budgetMillis)

Runs the handshake on an already-blocking descriptor, giving it budgetMillis in total.

Returns 0 when it fails, which is ordinary traffic -- a scanner, a client with no common cipher, or a plaintext request sent to the TLS port.

A TOTAL budget, because SO_RCVTIMEO bounds one read and a handshake is several: a client that delivers a byte just inside each timeout never causes one, so the handshake could be held open for as long as it cared to drip-feed -- occupying a worker throughout, before the request head's own deadline is armed. Zero or less means unbounded, which is what the platforms with no poll in this backend get.

close

public void close()

negotiatedProtocol

public static String negotiatedProtocol(long session)

The protocol ALPN settled on: "h2", "http/1.1", or null.