Class FTPSClient

All Implemented Interfaces:
Configurable

public class FTPSClient extends FTPClient
FTP over SSL processing. If desired, the JVM property -Djavax.net.debug=all can be used to see wire-level SSL details. Warning: the hostname is not verified against the certificate by default, use setHostnameVerifier(HostnameVerifier) or setEndpointCheckingEnabled(boolean) (on Java 1.7+) to enable verification. Verification is only performed on client mode connections.
Since:
2.0
Version:
$Id: FTPSClient.java 1747829 2016-06-11 00:57:57Z sebb $
  • Field Details

    • DEFAULT_FTPS_DATA_PORT

      public static final int DEFAULT_FTPS_DATA_PORT
      See Also:
    • DEFAULT_FTPS_PORT

      public static final int DEFAULT_FTPS_PORT
      See Also:
    • PROT_COMMAND_VALUE

      private static final String[] PROT_COMMAND_VALUE
      The value that I can set in PROT command (C = Clear, P = Protected)
    • DEFAULT_PROT

      private static final String DEFAULT_PROT
      Default PROT Command
      See Also:
    • DEFAULT_PROTOCOL

      private static final String DEFAULT_PROTOCOL
      Default secure socket protocol name, i.e. TLS
      See Also:
    • CMD_AUTH

      private static final String CMD_AUTH
      The AUTH (Authentication/Security Mechanism) command.
      See Also:
    • CMD_ADAT

      private static final String CMD_ADAT
      The ADAT (Authentication/Security Data) command.
      See Also:
    • CMD_PROT

      private static final String CMD_PROT
      The PROT (Data Channel Protection Level) command.
      See Also:
    • CMD_PBSZ

      private static final String CMD_PBSZ
      The PBSZ (Protection Buffer Size) command.
      See Also:
    • CMD_MIC

      private static final String CMD_MIC
      The MIC (Integrity Protected Command) command.
      See Also:
    • CMD_CONF

      private static final String CMD_CONF
      The CONF (Confidentiality Protected Command) command.
      See Also:
    • CMD_ENC

      private static final String CMD_ENC
      The ENC (Privacy Protected Command) command.
      See Also:
    • CMD_CCC

      private static final String CMD_CCC
      The CCC (Clear Command Channel) command.
      See Also:
    • isImplicit

      private final boolean isImplicit
      The security mode. (True - Implicit Mode / False - Explicit Mode)
    • protocol

      private final String protocol
      The secure socket protocol to be used, e.g. SSL/TLS.
    • auth

      private String auth
      The AUTH Command value
    • context

      private SSLContext context
      The context object.
    • plainSocket

      private Socket plainSocket
      The socket object.
    • isCreation

      private boolean isCreation
      Controls whether a new SSL session may be established by this socket. Default true.
    • isClientMode

      private boolean isClientMode
      The use client mode flag.
    • isNeedClientAuth

      private boolean isNeedClientAuth
      The need client auth flag.
    • isWantClientAuth

      private boolean isWantClientAuth
      The want client auth flag.
    • suites

      private String[] suites
      The cipher suites
    • protocols

      private String[] protocols
      The protocol versions
    • trustManager

      private TrustManager trustManager
      The FTPS TrustManager implementation, default validate only TrustManagerUtils.getValidateServerCertificateTrustManager().
    • keyManager

      private KeyManager keyManager
      The KeyManager, default null (i.e. use system default).
    • hostnameVerifier

      private HostnameVerifier hostnameVerifier
      The HostnameVerifier to use post-TLS, default null (i.e. no verification).
    • tlsEndpointChecking

      private boolean tlsEndpointChecking
      Use Java 1.7+ HTTPS Endpoint Identification Algorithim.
    • KEYSTORE_ALGORITHM

      @Deprecated public static String KEYSTORE_ALGORITHM
      Deprecated.
      - not used - may be removed in a future release
    • TRUSTSTORE_ALGORITHM

      @Deprecated public static String TRUSTSTORE_ALGORITHM
      Deprecated.
      - not used - may be removed in a future release
    • PROVIDER

      @Deprecated public static String PROVIDER
      Deprecated.
      - not used - may be removed in a future release
    • STORE_TYPE

      @Deprecated public static String STORE_TYPE
      Deprecated.
      - not used - may be removed in a future release
  • Constructor Details

  • Method Details

    • setAuthValue

      public void setAuthValue(String auth)
      Set AUTH command use value. This processing is done before connected processing.
      Parameters:
      auth - AUTH command use value.
    • getAuthValue

      public String getAuthValue()
      Return AUTH command use value.
      Returns:
      AUTH command use value.
    • _connectAction_

      protected void _connectAction_() throws IOException
      Because there are so many connect() methods, the _connectAction_() method is provided as a means of performing some action immediately after establishing a connection, rather than reimplementing all of the connect() methods.
      Overrides:
      _connectAction_ in class FTPClient
      Throws:
      IOException - If it throw by _connectAction_.
      See Also:
    • execAUTH

      protected void execAUTH() throws SSLException, IOException
      AUTH command.
      Throws:
      SSLException - If it server reply code not equal "234" and "334".
      IOException - If an I/O error occurs while either sending the command.
    • initSslContext

      private void initSslContext() throws IOException
      Performs a lazy init of the SSL context
      Throws:
      IOException
    • sslNegotiation

      protected void sslNegotiation() throws IOException
      SSL/TLS negotiation. Acquires an SSL socket of a control connection and carries out handshake processing.
      Throws:
      IOException - If server negotiation fails
    • getKeyManager

      private KeyManager getKeyManager()
      Get the KeyManager instance.
      Returns:
      The KeyManager instance
    • setKeyManager

      public void setKeyManager(KeyManager keyManager)
      Set a KeyManager to use
      Parameters:
      keyManager - The KeyManager implementation to set.
      See Also:
    • setEnabledSessionCreation

      public void setEnabledSessionCreation(boolean isCreation)
      Controls whether a new SSL session may be established by this socket.
      Parameters:
      isCreation - The established socket flag.
    • getEnableSessionCreation

      public boolean getEnableSessionCreation()
      Returns true if new SSL sessions may be established by this socket. When the underlying Socket instance is not SSL-enabled (i.e. an instance of SSLSocket with SSLSocketgetEnableSessionCreation()) enabled, this returns False.
      Returns:
      true - Indicates that sessions may be created; this is the default. false - indicates that an existing session must be resumed.
    • setNeedClientAuth

      public void setNeedClientAuth(boolean isNeedClientAuth)
      Configures the socket to require client authentication.
      Parameters:
      isNeedClientAuth - The need client auth flag.
    • getNeedClientAuth

      public boolean getNeedClientAuth()
      Returns true if the socket will require client authentication. When the underlying Socket is not an SSLSocket instance, returns false.
      Returns:
      true - If the server mode socket should request that the client authenticate itself.
    • setWantClientAuth

      public void setWantClientAuth(boolean isWantClientAuth)
      Configures the socket to request client authentication, but only if such a request is appropriate to the cipher suite negotiated.
      Parameters:
      isWantClientAuth - The want client auth flag.
    • getWantClientAuth

      public boolean getWantClientAuth()
      Returns true if the socket will request client authentication. When the underlying Socket is not an SSLSocket instance, returns false.
      Returns:
      true - If the server mode socket should request that the client authenticate itself.
    • setUseClientMode

      public void setUseClientMode(boolean isClientMode)
      Configures the socket to use client (or server) mode in its first handshake.
      Parameters:
      isClientMode - The use client mode flag.
    • getUseClientMode

      public boolean getUseClientMode()
      Returns true if the socket is set to use client mode in its first handshake. When the underlying Socket is not an SSLSocket instance, returns false.
      Returns:
      true - If the socket should start its first handshake in "client" mode.
    • setEnabledCipherSuites

      public void setEnabledCipherSuites(String[] cipherSuites)
      Controls which particular cipher suites are enabled for use on this connection. Called before server negotiation.
      Parameters:
      cipherSuites - The cipher suites.
    • getEnabledCipherSuites

      public String[] getEnabledCipherSuites()
      Returns the names of the cipher suites which could be enabled for use on this connection. When the underlying Socket is not an SSLSocket instance, returns null.
      Returns:
      An array of cipher suite names, or null
    • setEnabledProtocols

      public void setEnabledProtocols(String[] protocolVersions)
      Controls which particular protocol versions are enabled for use on this connection. I perform setting before a server negotiation.
      Parameters:
      protocolVersions - The protocol versions.
    • getEnabledProtocols

      public String[] getEnabledProtocols()
      Returns the names of the protocol versions which are currently enabled for use on this connection. When the underlying Socket is not an SSLSocket instance, returns null.
      Returns:
      An array of protocols, or null
    • execPBSZ

      public void execPBSZ(long pbsz) throws SSLException, IOException
      PBSZ command. pbsz value: 0 to (2^32)-1 decimal integer.
      Parameters:
      pbsz - Protection Buffer Size.
      Throws:
      SSLException - If the server reply code does not equal "200".
      IOException - If an I/O error occurs while sending the command.
      See Also:
    • parsePBSZ

      public long parsePBSZ(long pbsz) throws SSLException, IOException
      PBSZ command. pbsz value: 0 to (2^32)-1 decimal integer. Issues the command and parses the response to return the negotiated value.
      Parameters:
      pbsz - Protection Buffer Size.
      Returns:
      the negotiated value.
      Throws:
      SSLException - If the server reply code does not equal "200".
      IOException - If an I/O error occurs while sending the command.
      Since:
      3.0
      See Also:
    • execPROT

      public void execPROT(String prot) throws SSLException, IOException
      PROT command.
      • C - Clear
      • S - Safe(SSL protocol only)
      • E - Confidential(SSL protocol only)
      • P - Private
      N.B. the method calls SocketClient.setSocketFactory(javax.net.SocketFactory) and SocketClient.setServerSocketFactory(javax.net.ServerSocketFactory)
      Parameters:
      prot - Data Channel Protection Level, if null, use DEFAULT_PROT.
      Throws:
      SSLException - If the server reply code does not equal 200.
      IOException - If an I/O error occurs while sending the command.
    • checkPROTValue

      private boolean checkPROTValue(String prot)
      Check the value that can be set in PROT Command value.
      Parameters:
      prot - Data Channel Protection Level.
      Returns:
      True - A set point is right / False - A set point is not right
    • sendCommand

      public int sendCommand(String command, String args) throws IOException
      Send an FTP command. A successful CCC (Clear Command Channel) command causes the underlying SSLSocket instance to be assigned to a plain Socket
      Overrides:
      sendCommand in class FTP
      Parameters:
      command - The FTP command.
      args - The arguments to the FTP command. If this parameter is set to null, then the command is sent with no argument.
      Returns:
      server reply.
      Throws:
      IOException - If an I/O error occurs while sending the command.
      SSLException - if a CCC command fails
      See Also:
    • _openDataConnection_

      @Deprecated protected Socket _openDataConnection_(int command, String arg) throws IOException
      Deprecated.
      Returns a socket of the data connection. Wrapped as an SSLSocket, which carries out handshake processing.
      Overrides:
      _openDataConnection_ in class FTPClient
      Parameters:
      command - The int representation of the FTP command to send.
      arg - The arguments to the FTP command. If this parameter is set to null, then the command is sent with no arguments.
      Returns:
      corresponding to the established data connection. Null is returned if an FTP protocol error is reported at any point during the establishment and initialization of the connection.
      Throws:
      IOException - If there is any problem with the connection.
      See Also:
    • _openDataConnection_

      protected Socket _openDataConnection_(String command, String arg) throws IOException
      Returns a socket of the data connection. Wrapped as an SSLSocket, which carries out handshake processing.
      Overrides:
      _openDataConnection_ in class FTPClient
      Parameters:
      command - The textual representation of the FTP command to send.
      arg - The arguments to the FTP command. If this parameter is set to null, then the command is sent with no arguments.
      Returns:
      corresponding to the established data connection. Null is returned if an FTP protocol error is reported at any point during the establishment and initialization of the connection.
      Throws:
      IOException - If there is any problem with the connection.
      Since:
      3.2
      See Also:
    • _prepareDataSocket_

      protected void _prepareDataSocket_(Socket socket) throws IOException
      Performs any custom initialization for a newly created SSLSocket (before the SSL handshake happens). Called by _openDataConnection_(int, String) immediately after creating the socket. The default implementation is a no-op
      Parameters:
      socket - the socket to set up
      Throws:
      IOException - on error
      Since:
      3.1
    • getTrustManager

      public TrustManager getTrustManager()
      Get the currently configured TrustManager.
      Returns:
      A TrustManager instance.
    • setTrustManager

      public void setTrustManager(TrustManager trustManager)
      Override the default TrustManager to use; if set to null, the default TrustManager from the JVM will be used.
      Parameters:
      trustManager - The TrustManager implementation to set, may be null
      See Also:
    • getHostnameVerifier

      public HostnameVerifier getHostnameVerifier()
      Get the currently configured HostnameVerifier. The verifier is only used on client mode connections.
      Returns:
      A HostnameVerifier instance.
      Since:
      3.4
    • setHostnameVerifier

      public void setHostnameVerifier(HostnameVerifier newHostnameVerifier)
      Override the default HostnameVerifier to use. The verifier is only used on client mode connections.
      Parameters:
      newHostnameVerifier - The HostnameVerifier implementation to set or null to disable.
      Since:
      3.4
    • isEndpointCheckingEnabled

      public boolean isEndpointCheckingEnabled()
      Return whether or not endpoint identification using the HTTPS algorithm on Java 1.7+ is enabled. The default behaviour is for this to be disabled. This check is only performed on client mode connections.
      Returns:
      True if enabled, false if not.
      Since:
      3.4
    • setEndpointCheckingEnabled

      public void setEndpointCheckingEnabled(boolean enable)
      Automatic endpoint identification checking using the HTTPS algorithm is supported on Java 1.7+. The default behaviour is for this to be disabled. This check is only performed on client mode connections.
      Parameters:
      enable - Enable automatic endpoint identification checking using the HTTPS algorithm on Java 1.7+.
      Since:
      3.4
    • disconnect

      public void disconnect() throws IOException
      Closes the connection to the FTP server and restores connection parameters to the default values.

      Calls setSocketFactory(null) and setServerSocketFactory(null) to reset the factories that may have been changed during the session, e.g. by execPROT(String)

      Overrides:
      disconnect in class FTPClient
      Throws:
      IOException - If an error occurs while disconnecting.
      Since:
      3.0
    • execAUTH

      public int execAUTH(String mechanism) throws IOException
      Send the AUTH command with the specified mechanism.
      Parameters:
      mechanism - The mechanism name to send with the command.
      Returns:
      server reply.
      Throws:
      IOException - If an I/O error occurs while sending the command.
      Since:
      3.0
    • execADAT

      public int execADAT(byte[] data) throws IOException
      Send the ADAT command with the specified authentication data.
      Parameters:
      data - The data to send with the command.
      Returns:
      server reply.
      Throws:
      IOException - If an I/O error occurs while sending the command.
      Since:
      3.0
    • execCCC

      public int execCCC() throws IOException
      Send the CCC command to the server. The CCC (Clear Command Channel) command causes the underlying SSLSocket instance to be assigned to a plain Socket instances
      Returns:
      server reply.
      Throws:
      IOException - If an I/O error occurs while sending the command.
      Since:
      3.0
    • execMIC

      public int execMIC(byte[] data) throws IOException
      Send the MIC command with the specified data.
      Parameters:
      data - The data to send with the command.
      Returns:
      server reply.
      Throws:
      IOException - If an I/O error occurs while sending the command.
      Since:
      3.0
    • execCONF

      public int execCONF(byte[] data) throws IOException
      Send the CONF command with the specified data.
      Parameters:
      data - The data to send with the command.
      Returns:
      server reply.
      Throws:
      IOException - If an I/O error occurs while sending the command.
      Since:
      3.0
    • execENC

      public int execENC(byte[] data) throws IOException
      Send the ENC command with the specified data.
      Parameters:
      data - The data to send with the command.
      Returns:
      server reply.
      Throws:
      IOException - If an I/O error occurs while sending the command.
      Since:
      3.0
    • parseADATReply

      public byte[] parseADATReply(String reply)
      Parses the given ADAT response line and base64-decodes the data.
      Parameters:
      reply - The ADAT reply to parse.
      Returns:
      the data in the reply, base64-decoded.
      Since:
      3.0
    • extractPrefixedData

      private String extractPrefixedData(String prefix, String reply)
      Extract the data from a reply with a prefix, e.g. PBSZ=1234 => 1234
      Parameters:
      prefix - the prefix to find
      reply - where to find the prefix
      Returns:
      the remainder of the string after the prefix, or null if the prefix was not present.