Backend API. Server-side code: this runs in a Codename One backend, not in the app on the device.
public final class Tls
- Object
- Tls
Server-side TLS. One context for the process, one session per connection.
The handshake runs on the worker that picks a connection up, not on the reactor thread: a handshake is several round trips, and doing it on the reactor would block every other connection behind one slow client.
A TLS connection costs an SSL object, so the “an idle connection allocates nothing” property of the plain server does not hold here – that is inherent to TLS, not a choice. It is also why static files lose their zero-copy path under TLS: sendfile works because the kernel moves bytes it never looks at, and encrypted bytes have to be produced in user space.
Methods
public static Tls create(String certPath, String keyPath)
throws IOException |
|
public static Tls create(String certPath, String keyPath, boolean offerHttp2)
throws IOException |
|
public long accept(int fd, long budgetMillis) | Runs the handshake on an already-blocking descriptor, giving it budgetMillis in total. |
public void close() | |
public static String negotiatedProtocol(long session) | The protocol ALPN settled on: “h2”, “http/1.1”, or null. |
Inherited methods
Method details
create
public static Tls create(String certPath, String keyPath)
throws IOExceptioncertPath: PEM certificate chain, leaf firstkeyPath: PEM private key
Throws
create
public static Tls create(String certPath, String keyPath, boolean offerHttp2)
throws IOExceptionofferHttp2: advertise “h2” in ALPN. There is no upgrade handshake for HTTP/2 over TLS, so a server that does not advertise it here will never speak it however complete the rest of its implementation is.
Throws
accept
public long accept(int fd, long budgetMillis)Runs the handshake on an already-blocking descriptor, giving it
budgetMillis in total.
Returns 0 when it fails, which is ordinary traffic – a scanner, a client with no common cipher, or a plaintext request sent to the TLS port.
A TOTAL budget, because SO_RCVTIMEO bounds one read and a handshake is several: a client that delivers a byte just inside each timeout never causes one, so the handshake could be held open for as long as it cared to drip-feed – occupying a worker throughout, before the request head’s own deadline is armed. Zero or less means unbounded, which is what the platforms with no poll in this backend get.
close
public void close()negotiatedProtocol
public static String negotiatedProtocol(long session)