Mercurial Mercurial > jdk-sandbox / comparison
summary | shortlog | changelog | graph | tags | bookmarks | branches | files | changeset | file | latest | revisions | annotate | diff | comparison | raw | help
Find changesets by keywords (author, files, the commit message), revision number or hash, or revset expression.
jdk/src/share/classes/sun/security/ssl/CipherSuite.java
changeset 6856 533f4ad71f88
parent 5506 202f599c92aa
child 7039 6464c8e62a18
equal deleted inserted replaced
5784:e565c553e9fc 6856:533f4ad71f88 
     1 /*
 
     1 /*
 
     2  * Copyright (c) 2002, 2009, Oracle and/or its affiliates. All rights reserved.
 
     2  * Copyright (c) 2002, 2010, Oracle and/or its affiliates. All rights reserved.
 
     3  * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
 
     3  * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
 
     4  *
 
     4  *
 
     5  * This code is free software; you can redistribute it and/or modify it
 
     5  * This code is free software; you can redistribute it and/or modify it
 
     6  * under the terms of the GNU General Public License version 2 only, as
 
     6  * under the terms of the GNU General Public License version 2 only, as
 
     7  * published by the Free Software Foundation.  Oracle designates this
 
     7  * published by the Free Software Foundation.  Oracle designates this
 
   124             macAlg = M_MD5;
 
   124             macAlg = M_MD5;
 
   125         } else if (name.endsWith("_SHA")) {
 
   125         } else if (name.endsWith("_SHA")) {
 
   126             macAlg = M_SHA;
 
   126             macAlg = M_SHA;
 
   127         } else if (name.endsWith("_NULL")) {
 
   127         } else if (name.endsWith("_NULL")) {
 
   128             macAlg = M_NULL;
 
   128             macAlg = M_NULL;
 
       
   129         } else if (name.endsWith("_SCSV")) {
 
       
   130             macAlg = M_NULL;
 
   129         } else {
 
   131         } else {
 
   130             throw new IllegalArgumentException
 
   132             throw new IllegalArgumentException
 
   131                     ("Unknown MAC algorithm for ciphersuite " + name);
 
   133                     ("Unknown MAC algorithm for ciphersuite " + name);
 
   132         }
 
   134         }
 
   133 
   135 
   156      * CipherSuiteList.clearAvailableCache() before this method to obtain
 
   158      * CipherSuiteList.clearAvailableCache() before this method to obtain
 
   157      * the most current status.
 
   159      * the most current status.
 
   158      */
 
   160      */
 
   159     boolean isAvailable() {
 
   161     boolean isAvailable() {
 
   160         return allowed && keyExchange.isAvailable() && cipher.isAvailable();
 
   162         return allowed && keyExchange.isAvailable() && cipher.isAvailable();
 
       
   163     }
 
       
   164 
       
   165     boolean isNegotiable() {
 
       
   166         return this != C_SCSV && isAvailable();
 
   161     }
 
   167     }
 
   162 
   168 
   163     /**
 
   169     /**
 
   164      * Compares CipherSuites based on their priority. Has the effect of
 
   170      * Compares CipherSuites based on their priority. Has the effect of
 
   165      * sorting CipherSuites when put in a sorted collection, which is
 
   171      * sorting CipherSuites when put in a sorted collection, which is
 
   266         K_ECDHE_RSA  ("ECDHE_RSA",   ALLOW_ECC),
 
   272         K_ECDHE_RSA  ("ECDHE_RSA",   ALLOW_ECC),
 
   267         K_ECDH_ANON  ("ECDH_anon",   ALLOW_ECC),
 
   273         K_ECDH_ANON  ("ECDH_anon",   ALLOW_ECC),
 
   268 
   274 
   269         // Kerberos cipher suites
 
   275         // Kerberos cipher suites
 
   270         K_KRB5       ("KRB5", true),
 
   276         K_KRB5       ("KRB5", true),
 
   271         K_KRB5_EXPORT("KRB5_EXPORT", true);
 
   277         K_KRB5_EXPORT("KRB5_EXPORT", true),
 
       
   278 
       
   279         // renegotiation protection request signaling cipher suite
 
       
   280         K_SCSV       ("SCSV",        true);
 
   272 
   281 
   273         // name of the key exchange algorithm, e.g. DHE_DSS
 
   282         // name of the key exchange algorithm, e.g. DHE_DSS
 
   274         final String name;
 
   283         final String name;
 
   275         final boolean allowed;
 
   284         final boolean allowed;
 
   276         private final boolean alwaysAvailable;
 
   285         private final boolean alwaysAvailable;
 
   350 
   359 
   351             this.expandedKeySize = expandedKeySize;
 
   360             this.expandedKeySize = expandedKeySize;
 
   352             this.exportable = true;
 
   361             this.exportable = true;
 
   353         }
 
   362         }
 
   354 
   363 
   355         BulkCipher(String transformation, int keySize, int ivSize, boolean allowed) {
 
   364         BulkCipher(String transformation, int keySize,
 
       
   365                 int ivSize, boolean allowed) {
 
   356             this.transformation = transformation;
 
   366             this.transformation = transformation;
 
   357             this.algorithm = transformation.split("/")[0];
 
   367             this.algorithm = transformation.split("/")[0];
 
   358             this.description = this.algorithm + "/" + (keySize << 3);
 
   368             this.description = this.algorithm + "/" + (keySize << 3);
 
   359             this.keySize = keySize;
 
   369             this.keySize = keySize;
 
   360             this.ivSize = ivSize;
 
   370             this.ivSize = ivSize;
 
   368          * Return an initialized CipherBox for this BulkCipher.
 
   378          * Return an initialized CipherBox for this BulkCipher.
 
   369          * IV must be null for stream ciphers.
 
   379          * IV must be null for stream ciphers.
 
   370          *
 
   380          *
 
   371          * @exception NoSuchAlgorithmException if anything goes wrong
 
   381          * @exception NoSuchAlgorithmException if anything goes wrong
 
   372          */
 
   382          */
 
   373         CipherBox newCipher(ProtocolVersion version, SecretKey key, IvParameterSpec iv,
 
   383         CipherBox newCipher(ProtocolVersion version,
 
       
   384                 SecretKey key, IvParameterSpec iv,
 
   374                 boolean encrypt) throws NoSuchAlgorithmException {
 
   385                 boolean encrypt) throws NoSuchAlgorithmException {
 
   375             return CipherBox.newCipherBox(version, this, key, iv, encrypt);
 
   386             return CipherBox.newCipherBox(version, this, key, iv, encrypt);
 
   376         }
 
   387         }
 
   377 
   388 
   378         /**
 
   389         /**
 
   405         private static synchronized boolean isAvailable(BulkCipher cipher) {
 
   416         private static synchronized boolean isAvailable(BulkCipher cipher) {
 
   406             Boolean b = availableCache.get(cipher);
 
   417             Boolean b = availableCache.get(cipher);
 
   407             if (b == null) {
 
   418             if (b == null) {
 
   408                 try {
 
   419                 try {
 
   409                     SecretKey key = new SecretKeySpec
 
   420                     SecretKey key = new SecretKeySpec
 
   410                             (new byte[cipher.expandedKeySize], cipher.algorithm);
 
   421                         (new byte[cipher.expandedKeySize], cipher.algorithm);
 
   411                     IvParameterSpec iv = new IvParameterSpec(new byte[cipher.ivSize]);
 
   422                     IvParameterSpec iv =
 
       
   423                         new IvParameterSpec(new byte[cipher.ivSize]);
 
   412                     cipher.newCipher(ProtocolVersion.DEFAULT, key, iv, true);
 
   424                     cipher.newCipher(ProtocolVersion.DEFAULT, key, iv, true);
 
   413                     b = Boolean.TRUE;
 
   425                     b = Boolean.TRUE;
 
   414                 } catch (NoSuchAlgorithmException e) {
 
   426                 } catch (NoSuchAlgorithmException e) {
 
   415                     b = Boolean.FALSE;
 
   427                     b = Boolean.FALSE;
 
   416                 }
 
   428                 }
 
   458             return name;
 
   470             return name;
 
   459         }
 
   471         }
 
   460     }
 
   472     }
 
   461 
   473 
   462     // export strength ciphers
 
   474     // export strength ciphers
 
   463     final static BulkCipher B_NULL    = new BulkCipher("NULL",     0,  0, 0, true);
 
   475     final static BulkCipher B_NULL    =
 
   464     final static BulkCipher B_RC4_40  = new BulkCipher(CIPHER_RC4, 5, 16, 0, true);
 
   476                         new BulkCipher("NULL",         0,  0, 0, true);
 
   465     final static BulkCipher B_RC2_40  = new BulkCipher("RC2",      5, 16, 8, false);
 
   477     final static BulkCipher B_RC4_40  =
 
   466     final static BulkCipher B_DES_40  = new BulkCipher(CIPHER_DES, 5,  8, 8, true);
 
   478                         new BulkCipher(CIPHER_RC4,     5, 16, 0, true);
 
       
   479     final static BulkCipher B_RC2_40  =
 
       
   480                         new BulkCipher("RC2",          5, 16, 8, false);
 
       
   481     final static BulkCipher B_DES_40  =
 
       
   482                         new BulkCipher(CIPHER_DES,     5,  8, 8, true);
 
   467 
   483 
   468     // domestic strength ciphers
 
   484     // domestic strength ciphers
 
   469     final static BulkCipher B_RC4_128 = new BulkCipher(CIPHER_RC4,  16,  0, true);
 
   485     final static BulkCipher B_RC4_128 =
 
   470     final static BulkCipher B_DES     = new BulkCipher(CIPHER_DES,   8,  8, true);
 
   486                         new BulkCipher(CIPHER_RC4,     16,  0, true);
 
   471     final static BulkCipher B_3DES    = new BulkCipher(CIPHER_3DES, 24,  8, true);
 
   487     final static BulkCipher B_DES     =
 
   472     final static BulkCipher B_IDEA    = new BulkCipher("IDEA",      16,  8, false);
 
   488                         new BulkCipher(CIPHER_DES,      8,  8, true);
 
   473     final static BulkCipher B_AES_128 = new BulkCipher(CIPHER_AES,  16, 16, true);
 
   489     final static BulkCipher B_3DES    =
 
   474     final static BulkCipher B_AES_256 = new BulkCipher(CIPHER_AES,  32, 16, true);
 
   490                         new BulkCipher(CIPHER_3DES,    24,  8, true);
 
       
   491     final static BulkCipher B_IDEA    =
 
       
   492                         new BulkCipher("IDEA",         16,  8, false);
 
       
   493     final static BulkCipher B_AES_128 =
 
       
   494                         new BulkCipher(CIPHER_AES,     16, 16, true);
 
       
   495     final static BulkCipher B_AES_256 =
 
       
   496                         new BulkCipher(CIPHER_AES,     32, 16, true);
 
   475 
   497 
   476     // MACs
 
   498     // MACs
 
   477     final static MacAlg M_NULL = new MacAlg("NULL", 0);
 
   499     final static MacAlg M_NULL = new MacAlg("NULL", 0);
 
   478     final static MacAlg M_MD5  = new MacAlg("MD5", 16);
 
   500     final static MacAlg M_MD5  = new MacAlg("MD5", 16);
 
   479     final static MacAlg M_SHA  = new MacAlg("SHA", 20);
 
   501     final static MacAlg M_SHA  = new MacAlg("SHA", 20);
 
   485         final boolean F = false;
 
   507         final boolean F = false;
 
   486         final boolean T = true;
 
   508         final boolean T = true;
 
   487         // N: ciphersuites only allowed if we are not in FIPS mode
 
   509         // N: ciphersuites only allowed if we are not in FIPS mode
 
   488         final boolean N = (SunJSSE.isFIPS() == false);
 
   510         final boolean N = (SunJSSE.isFIPS() == false);
 
   489 
   511 
   490 add("SSL_NULL_WITH_NULL_NULL",                0x0000,   1, K_NULL,       B_NULL,    F);
 
   512         add("SSL_NULL_WITH_NULL_NULL",
 
       
   513                               0x0000,   1, K_NULL,       B_NULL,    F);
 
   491 
   514 
   492         // Definition of the CipherSuites that are enabled by default.
 
   515         // Definition of the CipherSuites that are enabled by default.
 
   493         // They are listed in preference order, most preferred first.
 
   516         // They are listed in preference order, most preferred first.
 
   494         int p = DEFAULT_SUITES_PRIORITY * 2;
 
   517         int p = DEFAULT_SUITES_PRIORITY * 2;
 
   495 
   518 
   496 add("SSL_RSA_WITH_RC4_128_MD5",              0x0004, --p, K_RSA,        B_RC4_128, N);
 
   519         add("SSL_RSA_WITH_RC4_128_MD5",
 
   497 add("SSL_RSA_WITH_RC4_128_SHA",              0x0005, --p, K_RSA,        B_RC4_128, N);
 
   520                               0x0004, --p, K_RSA,        B_RC4_128, N);
 
   498 add("TLS_RSA_WITH_AES_128_CBC_SHA",          0x002f, --p, K_RSA,        B_AES_128, T);
 
   521         add("SSL_RSA_WITH_RC4_128_SHA",
 
   499 add("TLS_RSA_WITH_AES_256_CBC_SHA",          0x0035, --p, K_RSA,        B_AES_256, T);
 
   522                               0x0005, --p, K_RSA,        B_RC4_128, N);
 
   500 
   523         add("TLS_RSA_WITH_AES_128_CBC_SHA",
 
   501 add("TLS_ECDH_ECDSA_WITH_RC4_128_SHA",       0xC002, --p, K_ECDH_ECDSA, B_RC4_128, N);
 
   524                               0x002f, --p, K_RSA,        B_AES_128, T);
 
   502 add("TLS_ECDH_ECDSA_WITH_AES_128_CBC_SHA",   0xC004, --p, K_ECDH_ECDSA, B_AES_128, T);
 
   525         add("TLS_RSA_WITH_AES_256_CBC_SHA",
 
   503 add("TLS_ECDH_ECDSA_WITH_AES_256_CBC_SHA",   0xC005, --p, K_ECDH_ECDSA, B_AES_256, T);
 
   526                               0x0035, --p, K_RSA,        B_AES_256, T);
 
   504 add("TLS_ECDH_RSA_WITH_RC4_128_SHA",         0xC00C, --p, K_ECDH_RSA,   B_RC4_128, N);
 
   527 
   505 add("TLS_ECDH_RSA_WITH_AES_128_CBC_SHA",     0xC00E, --p, K_ECDH_RSA,   B_AES_128, T);
 
   528         add("TLS_ECDH_ECDSA_WITH_RC4_128_SHA",
 
   506 add("TLS_ECDH_RSA_WITH_AES_256_CBC_SHA",     0xC00F, --p, K_ECDH_RSA,   B_AES_256, T);
 
   529                               0xC002, --p, K_ECDH_ECDSA, B_RC4_128, N);
 
   507 
   530         add("TLS_ECDH_ECDSA_WITH_AES_128_CBC_SHA",
 
   508 add("TLS_ECDHE_ECDSA_WITH_RC4_128_SHA",      0xC007, --p, K_ECDHE_ECDSA,B_RC4_128, N);
 
   531                               0xC004, --p, K_ECDH_ECDSA, B_AES_128, T);
 
   509 add("TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA",  0xC009, --p, K_ECDHE_ECDSA,B_AES_128, T);
 
   532         add("TLS_ECDH_ECDSA_WITH_AES_256_CBC_SHA",
 
   510 add("TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA",  0xC00A, --p, K_ECDHE_ECDSA,B_AES_256, T);
 
   533                               0xC005, --p, K_ECDH_ECDSA, B_AES_256, T);
 
   511 add("TLS_ECDHE_RSA_WITH_RC4_128_SHA",        0xC011, --p, K_ECDHE_RSA,  B_RC4_128, N);
 
   534         add("TLS_ECDH_RSA_WITH_RC4_128_SHA",
 
   512 add("TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA",    0xC013, --p, K_ECDHE_RSA,  B_AES_128, T);
 
   535                               0xC00C, --p, K_ECDH_RSA,   B_RC4_128, N);
 
   513 add("TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA",    0xC014, --p, K_ECDHE_RSA,  B_AES_256, T);
 
   536         add("TLS_ECDH_RSA_WITH_AES_128_CBC_SHA",
 
   514 
   537                               0xC00E, --p, K_ECDH_RSA,   B_AES_128, T);
 
   515 add("TLS_DHE_RSA_WITH_AES_128_CBC_SHA",      0x0033, --p, K_DHE_RSA,    B_AES_128, T);
 
   538         add("TLS_ECDH_RSA_WITH_AES_256_CBC_SHA",
 
   516 add("TLS_DHE_RSA_WITH_AES_256_CBC_SHA",      0x0039, --p, K_DHE_RSA,    B_AES_256, T);
 
   539                               0xC00F, --p, K_ECDH_RSA,   B_AES_256, T);
 
   517 add("TLS_DHE_DSS_WITH_AES_128_CBC_SHA",      0x0032, --p, K_DHE_DSS,    B_AES_128, T);
 
   540 
   518 add("TLS_DHE_DSS_WITH_AES_256_CBC_SHA",      0x0038, --p, K_DHE_DSS,    B_AES_256, T);
 
   541         add("TLS_ECDHE_ECDSA_WITH_RC4_128_SHA",
 
   519 
   542                               0xC007, --p, K_ECDHE_ECDSA,B_RC4_128, N);
 
   520 add("SSL_RSA_WITH_3DES_EDE_CBC_SHA",         0x000a, --p, K_RSA,        B_3DES,    T);
 
   543         add("TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA",
 
   521 add("TLS_ECDH_ECDSA_WITH_3DES_EDE_CBC_SHA",  0xC003, --p, K_ECDH_ECDSA, B_3DES,    T);
 
   544                               0xC009, --p, K_ECDHE_ECDSA,B_AES_128, T);
 
   522 add("TLS_ECDH_RSA_WITH_3DES_EDE_CBC_SHA",    0xC00D, --p, K_ECDH_RSA,   B_3DES,    T);
 
   545         add("TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA",
 
   523 add("TLS_ECDHE_ECDSA_WITH_3DES_EDE_CBC_SHA", 0xC008, --p, K_ECDHE_ECDSA,B_3DES,    T);
 
   546                               0xC00A, --p, K_ECDHE_ECDSA,B_AES_256, T);
 
   524 add("TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA",   0xC012, --p, K_ECDHE_RSA,  B_3DES,    T);
 
   547         add("TLS_ECDHE_RSA_WITH_RC4_128_SHA",
 
   525 add("SSL_DHE_RSA_WITH_3DES_EDE_CBC_SHA",     0x0016, --p, K_DHE_RSA,    B_3DES,    T);
 
   548                               0xC011, --p, K_ECDHE_RSA,  B_RC4_128, N);
 
   526 add("SSL_DHE_DSS_WITH_3DES_EDE_CBC_SHA",     0x0013, --p, K_DHE_DSS,    B_3DES,    N);
 
   549         add("TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA",
 
   527 
   550                               0xC013, --p, K_ECDHE_RSA,  B_AES_128, T);
 
   528 add("SSL_RSA_WITH_DES_CBC_SHA",              0x0009, --p, K_RSA,        B_DES,     N);
 
   551         add("TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA",
 
   529 add("SSL_DHE_RSA_WITH_DES_CBC_SHA",          0x0015, --p, K_DHE_RSA,    B_DES,     N);
 
   552                               0xC014, --p, K_ECDHE_RSA,  B_AES_256, T);
 
   530 add("SSL_DHE_DSS_WITH_DES_CBC_SHA",          0x0012, --p, K_DHE_DSS,    B_DES,     N);
 
   553 
   531 add("SSL_RSA_EXPORT_WITH_RC4_40_MD5",        0x0003, --p, K_RSA_EXPORT, B_RC4_40,  N);
 
   554         add("TLS_DHE_RSA_WITH_AES_128_CBC_SHA",
 
   532 add("SSL_RSA_EXPORT_WITH_DES40_CBC_SHA",     0x0008, --p, K_RSA_EXPORT, B_DES_40,  N);
 
   555                               0x0033, --p, K_DHE_RSA,    B_AES_128, T);
 
   533 add("SSL_DHE_RSA_EXPORT_WITH_DES40_CBC_SHA", 0x0014, --p, K_DHE_RSA,    B_DES_40,  N);
 
   556         add("TLS_DHE_RSA_WITH_AES_256_CBC_SHA",
 
   534 add("SSL_DHE_DSS_EXPORT_WITH_DES40_CBC_SHA", 0x0011, --p, K_DHE_DSS,    B_DES_40,  N);
 
   557                               0x0039, --p, K_DHE_RSA,    B_AES_256, T);
 
       
   558         add("TLS_DHE_DSS_WITH_AES_128_CBC_SHA",
 
       
   559                               0x0032, --p, K_DHE_DSS,    B_AES_128, T);
 
       
   560         add("TLS_DHE_DSS_WITH_AES_256_CBC_SHA",
 
       
   561                               0x0038, --p, K_DHE_DSS,    B_AES_256, T);
 
       
   562 
       
   563         add("SSL_RSA_WITH_3DES_EDE_CBC_SHA",
 
       
   564                               0x000a, --p, K_RSA,        B_3DES,    T);
 
       
   565         add("TLS_ECDH_ECDSA_WITH_3DES_EDE_CBC_SHA",
 
       
   566                               0xC003, --p, K_ECDH_ECDSA, B_3DES,    T);
 
       
   567         add("TLS_ECDH_RSA_WITH_3DES_EDE_CBC_SHA",
 
       
   568                               0xC00D, --p, K_ECDH_RSA,   B_3DES,    T);
 
       
   569         add("TLS_ECDHE_ECDSA_WITH_3DES_EDE_CBC_SHA",
 
       
   570                               0xC008, --p, K_ECDHE_ECDSA,B_3DES,    T);
 
       
   571         add("TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA",
 
       
   572                               0xC012, --p, K_ECDHE_RSA,  B_3DES,    T);
 
       
   573         add("SSL_DHE_RSA_WITH_3DES_EDE_CBC_SHA",
 
       
   574                               0x0016, --p, K_DHE_RSA,    B_3DES,    T);
 
       
   575         add("SSL_DHE_DSS_WITH_3DES_EDE_CBC_SHA",
 
       
   576                               0x0013, --p, K_DHE_DSS,    B_3DES,    N);
 
       
   577 
       
   578         add("SSL_RSA_WITH_DES_CBC_SHA",
 
       
   579                               0x0009, --p, K_RSA,        B_DES,     N);
 
       
   580         add("SSL_DHE_RSA_WITH_DES_CBC_SHA",
 
       
   581                               0x0015, --p, K_DHE_RSA,    B_DES,     N);
 
       
   582         add("SSL_DHE_DSS_WITH_DES_CBC_SHA",
 
       
   583                               0x0012, --p, K_DHE_DSS,    B_DES,     N);
 
       
   584         add("SSL_RSA_EXPORT_WITH_RC4_40_MD5",
 
       
   585                               0x0003, --p, K_RSA_EXPORT, B_RC4_40,  N);
 
       
   586         add("SSL_RSA_EXPORT_WITH_DES40_CBC_SHA",
 
       
   587                               0x0008, --p, K_RSA_EXPORT, B_DES_40,  N);
 
       
   588         add("SSL_DHE_RSA_EXPORT_WITH_DES40_CBC_SHA",
 
       
   589                               0x0014, --p, K_DHE_RSA,    B_DES_40,  N);
 
       
   590         add("SSL_DHE_DSS_EXPORT_WITH_DES40_CBC_SHA",
 
       
   591                               0x0011, --p, K_DHE_DSS,    B_DES_40,  N);
 
       
   592 
       
   593         // Renegotiation protection request Signalling Cipher Suite Value (SCSV)
 
       
   594         add("TLS_EMPTY_RENEGOTIATION_INFO_SCSV",
 
       
   595                               0x00ff, --p, K_SCSV,       B_NULL,    T);
 
   535 
   596 
   536         // Definition of the CipherSuites that are supported but not enabled
 
   597         // Definition of the CipherSuites that are supported but not enabled
 
   537         // by default.
 
   598         // by default.
 
   538         // They are listed in preference order, preferred first.
 
   599         // They are listed in preference order, preferred first.
 
   539         p = DEFAULT_SUITES_PRIORITY;
 
   600         p = DEFAULT_SUITES_PRIORITY;
 
   540 
   601 
   541 // Anonymous key exchange and the NULL ciphers
 
   602         // Anonymous key exchange and the NULL ciphers
 
   542 add("SSL_RSA_WITH_NULL_MD5",                 0x0001, --p, K_RSA,        B_NULL,    N);
 
   603         add("SSL_RSA_WITH_NULL_MD5",
 
   543 add("SSL_RSA_WITH_NULL_SHA",                 0x0002, --p, K_RSA,        B_NULL,    N);
 
   604                               0x0001, --p, K_RSA,        B_NULL,    N);
 
   544 add("TLS_ECDH_ECDSA_WITH_NULL_SHA",          0xC001, --p, K_ECDH_ECDSA, B_NULL,    N);
 
   605         add("SSL_RSA_WITH_NULL_SHA",
 
   545 add("TLS_ECDH_RSA_WITH_NULL_SHA",            0xC00B, --p, K_ECDH_RSA,   B_NULL,    N);
 
   606                               0x0002, --p, K_RSA,        B_NULL,    N);
 
   546 add("TLS_ECDHE_ECDSA_WITH_NULL_SHA",         0xC006, --p, K_ECDHE_ECDSA,B_NULL,    N);
 
   607         add("TLS_ECDH_ECDSA_WITH_NULL_SHA",
 
   547 add("TLS_ECDHE_RSA_WITH_NULL_SHA",           0xC010, --p, K_ECDHE_RSA,  B_NULL,    N);
 
   608                               0xC001, --p, K_ECDH_ECDSA, B_NULL,    N);
 
   548 
   609         add("TLS_ECDH_RSA_WITH_NULL_SHA",
 
   549 add("SSL_DH_anon_WITH_RC4_128_MD5",          0x0018, --p, K_DH_ANON,    B_RC4_128, N);
 
   610                               0xC00B, --p, K_ECDH_RSA,   B_NULL,    N);
 
   550 add("TLS_DH_anon_WITH_AES_128_CBC_SHA",      0x0034, --p, K_DH_ANON,    B_AES_128, N);
 
   611         add("TLS_ECDHE_ECDSA_WITH_NULL_SHA",
 
   551 add("TLS_DH_anon_WITH_AES_256_CBC_SHA",      0x003a, --p, K_DH_ANON,    B_AES_256, N);
 
   612                               0xC006, --p, K_ECDHE_ECDSA,B_NULL,    N);
 
   552 add("SSL_DH_anon_WITH_3DES_EDE_CBC_SHA",     0x001b, --p, K_DH_ANON,    B_3DES,    N);
 
   613         add("TLS_ECDHE_RSA_WITH_NULL_SHA",
 
   553 add("SSL_DH_anon_WITH_DES_CBC_SHA",          0x001a, --p, K_DH_ANON,    B_DES,     N);
 
   614                               0xC010, --p, K_ECDHE_RSA,  B_NULL,    N);
 
   554 
   615 
   555 add("TLS_ECDH_anon_WITH_RC4_128_SHA",        0xC016, --p, K_ECDH_ANON,  B_RC4_128, N);
 
   616         add("SSL_DH_anon_WITH_RC4_128_MD5",
 
   556 add("TLS_ECDH_anon_WITH_AES_128_CBC_SHA",    0xC018, --p, K_ECDH_ANON,  B_AES_128, T);
 
   617                               0x0018, --p, K_DH_ANON,    B_RC4_128, N);
 
   557 add("TLS_ECDH_anon_WITH_AES_256_CBC_SHA",    0xC019, --p, K_ECDH_ANON,  B_AES_256, T);
 
   618         add("TLS_DH_anon_WITH_AES_128_CBC_SHA",
 
   558 add("TLS_ECDH_anon_WITH_3DES_EDE_CBC_SHA",   0xC017, --p, K_ECDH_ANON,  B_3DES,    T);
 
   619                               0x0034, --p, K_DH_ANON,    B_AES_128, N);
 
   559 
   620         add("TLS_DH_anon_WITH_AES_256_CBC_SHA",
 
   560 add("SSL_DH_anon_EXPORT_WITH_RC4_40_MD5",    0x0017, --p, K_DH_ANON,    B_RC4_40,  N);
 
   621                               0x003a, --p, K_DH_ANON,    B_AES_256, N);
 
   561 add("SSL_DH_anon_EXPORT_WITH_DES40_CBC_SHA", 0x0019, --p, K_DH_ANON,    B_DES_40,  N);
 
   622         add("SSL_DH_anon_WITH_3DES_EDE_CBC_SHA",
 
   562 
   623                               0x001b, --p, K_DH_ANON,    B_3DES,    N);
 
   563 add("TLS_ECDH_anon_WITH_NULL_SHA",           0xC015, --p, K_ECDH_ANON,  B_NULL,    N);
 
   624         add("SSL_DH_anon_WITH_DES_CBC_SHA",
 
   564 
   625                               0x001a, --p, K_DH_ANON,    B_DES,     N);
 
   565 // Supported Kerberos ciphersuites from RFC2712
 
   626 
   566 add("TLS_KRB5_WITH_RC4_128_SHA",             0x0020, --p, K_KRB5,        B_RC4_128, N);
 
   627         add("TLS_ECDH_anon_WITH_RC4_128_SHA",
 
   567 add("TLS_KRB5_WITH_RC4_128_MD5",             0x0024, --p, K_KRB5,        B_RC4_128, N);
 
   628                               0xC016, --p, K_ECDH_ANON,  B_RC4_128, N);
 
   568 add("TLS_KRB5_WITH_3DES_EDE_CBC_SHA",        0x001f, --p, K_KRB5,        B_3DES,    N);
 
   629         add("TLS_ECDH_anon_WITH_AES_128_CBC_SHA",
 
   569 add("TLS_KRB5_WITH_3DES_EDE_CBC_MD5",        0x0023, --p, K_KRB5,        B_3DES,    N);
 
   630                               0xC018, --p, K_ECDH_ANON,  B_AES_128, T);
 
   570 add("TLS_KRB5_WITH_DES_CBC_SHA",             0x001e, --p, K_KRB5,        B_DES,     N);
 
   631         add("TLS_ECDH_anon_WITH_AES_256_CBC_SHA",
 
   571 add("TLS_KRB5_WITH_DES_CBC_MD5",             0x0022, --p, K_KRB5,        B_DES,     N);
 
   632                               0xC019, --p, K_ECDH_ANON,  B_AES_256, T);
 
   572 add("TLS_KRB5_EXPORT_WITH_RC4_40_SHA",       0x0028, --p, K_KRB5_EXPORT, B_RC4_40,  N);
 
   633         add("TLS_ECDH_anon_WITH_3DES_EDE_CBC_SHA",
 
   573 add("TLS_KRB5_EXPORT_WITH_RC4_40_MD5",       0x002b, --p, K_KRB5_EXPORT, B_RC4_40,  N);
 
   634                               0xC017, --p, K_ECDH_ANON,  B_3DES,    T);
 
   574 add("TLS_KRB5_EXPORT_WITH_DES_CBC_40_SHA",   0x0026, --p, K_KRB5_EXPORT, B_DES_40,  N);
 
   635 
   575 add("TLS_KRB5_EXPORT_WITH_DES_CBC_40_MD5",   0x0029, --p, K_KRB5_EXPORT, B_DES_40,  N);
 
   636         add("SSL_DH_anon_EXPORT_WITH_RC4_40_MD5",
 
   576 
   637                               0x0017, --p, K_DH_ANON,    B_RC4_40,  N);
 
       
   638         add("SSL_DH_anon_EXPORT_WITH_DES40_CBC_SHA",
 
       
   639                               0x0019, --p, K_DH_ANON,    B_DES_40,  N);
 
       
   640 
       
   641         add("TLS_ECDH_anon_WITH_NULL_SHA",
 
       
   642                               0xC015, --p, K_ECDH_ANON,  B_NULL,    N);
 
       
   643 
       
   644         // Supported Kerberos ciphersuites from RFC2712
 
       
   645         add("TLS_KRB5_WITH_RC4_128_SHA",
 
       
   646                               0x0020, --p, K_KRB5,        B_RC4_128, N);
 
       
   647         add("TLS_KRB5_WITH_RC4_128_MD5",
 
       
   648                               0x0024, --p, K_KRB5,        B_RC4_128, N);
 
       
   649         add("TLS_KRB5_WITH_3DES_EDE_CBC_SHA",
 
       
   650                               0x001f, --p, K_KRB5,        B_3DES,    N);
 
       
   651         add("TLS_KRB5_WITH_3DES_EDE_CBC_MD5",
 
       
   652                               0x0023, --p, K_KRB5,        B_3DES,    N);
 
       
   653         add("TLS_KRB5_WITH_DES_CBC_SHA",
 
       
   654                               0x001e, --p, K_KRB5,        B_DES,     N);
 
       
   655         add("TLS_KRB5_WITH_DES_CBC_MD5",
 
       
   656                               0x0022, --p, K_KRB5,        B_DES,     N);
 
       
   657         add("TLS_KRB5_EXPORT_WITH_RC4_40_SHA",
 
       
   658                               0x0028, --p, K_KRB5_EXPORT, B_RC4_40,  N);
 
       
   659         add("TLS_KRB5_EXPORT_WITH_RC4_40_MD5",
 
       
   660                               0x002b, --p, K_KRB5_EXPORT, B_RC4_40,  N);
 
       
   661         add("TLS_KRB5_EXPORT_WITH_DES_CBC_40_SHA",
 
       
   662                               0x0026, --p, K_KRB5_EXPORT, B_DES_40,  N);
 
       
   663         add("TLS_KRB5_EXPORT_WITH_DES_CBC_40_MD5",
 
       
   664                               0x0029, --p, K_KRB5_EXPORT, B_DES_40,  N);
 
   577 
   665 
   578         // Register the names of a few additional CipherSuites.
 
   666         // Register the names of a few additional CipherSuites.
 
   579         // Makes them show up as names instead of numbers in
 
   667         // Makes them show up as names instead of numbers in
 
   580         // the debug output.
 
   668         // the debug output.
 
   581 
   669 
   616     }
 
   704     }
 
   617 
   705 
   618     // ciphersuite SSL_NULL_WITH_NULL_NULL
 
   706     // ciphersuite SSL_NULL_WITH_NULL_NULL
 
   619     final static CipherSuite C_NULL = CipherSuite.valueOf(0, 0);
 
   707     final static CipherSuite C_NULL = CipherSuite.valueOf(0, 0);
 
   620 
   708 
       
   709     // ciphersuite TLS_EMPTY_RENEGOTIATION_INFO_SCSV
 
       
   710     final static CipherSuite C_SCSV = CipherSuite.valueOf(0x00, 0xff);
 
   621 }
 
   711 }
jdk-sandbox