8187443: Forest Consolidation: Move files to unified layout

Reviewed-by: darcy, ihse

src/java.base/share/classes/javax/net/ServerSocketFactory.java

@@ -0,0 +1,233 @@
+/*
+ * Copyright (c) 1997, 2007, Oracle and/or its affiliates. All rights reserved.
+ * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
+ *
+ * This code is free software; you can redistribute it and/or modify it
+ * under the terms of the GNU General Public License version 2 only, as
+ * published by the Free Software Foundation.  Oracle designates this
+ * particular file as subject to the "Classpath" exception as provided
+ * by Oracle in the LICENSE file that accompanied this code.
+ *
+ * This code is distributed in the hope that it will be useful, but WITHOUT
+ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
+ * FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License
+ * version 2 for more details (a copy is included in the LICENSE file that
+ * accompanied this code).
+ *
+ * You should have received a copy of the GNU General Public License version
+ * 2 along with this work; if not, write to the Free Software Foundation,
+ * Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.
+ *
+ * Please contact Oracle, 500 Oracle Parkway, Redwood Shores, CA 94065 USA
+ * or visit www.oracle.com if you need additional information or have any
+ * questions.
+ */
+
+package javax.net;
+
+import java.io.IOException;
+import java.net.InetAddress;
+import java.net.ServerSocket;
+import java.net.SocketException;
+
+/**
+ * This class creates server sockets.  It may be subclassed by other
+ * factories, which create particular types of server sockets.  This
+ * provides a general framework for the addition of public socket-level
+ * functionality.  It is the server side analogue of a socket factory,
+ * and similarly provides a way to capture a variety of policies related
+ * to the sockets being constructed.
+ *
+ * <P> Like socket factories, server Socket factory instances have
+ * methods used to create sockets. There is also an environment
+ * specific default server socket factory; frameworks will often use
+ * their own customized factory.
+ *
+ * @since 1.4
+ * @see SocketFactory
+ *
+ * @author David Brownell
+ */
+public abstract class ServerSocketFactory
+{
+    //
+    // NOTE:  JDK 1.1 bug in class GC, this can get collected
+    // even though it's always accessible via getDefault().
+    //
+    private static ServerSocketFactory          theFactory;
+
+
+    /**
+     * Creates a server socket factory.
+     */
+    protected ServerSocketFactory() { /* NOTHING */ }
+
+    /**
+     * Returns a copy of the environment's default socket factory.
+     *
+     * @return the <code>ServerSocketFactory</code>
+     */
+    public static ServerSocketFactory getDefault()
+    {
+        synchronized (ServerSocketFactory.class) {
+            if (theFactory == null) {
+                //
+                // Different implementations of this method could
+                // work rather differently.  For example, driving
+                // this from a system property, or using a different
+                // implementation than JavaSoft's.
+                //
+                theFactory = new DefaultServerSocketFactory();
+            }
+        }
+
+        return theFactory;
+    }
+
+
+    /**
+     * Returns an unbound server socket.  The socket is configured with
+     * the socket options (such as accept timeout) given to this factory.
+     *
+     * @return the unbound socket
+     * @throws IOException if the socket cannot be created
+     * @see java.net.ServerSocket#bind(java.net.SocketAddress)
+     * @see java.net.ServerSocket#bind(java.net.SocketAddress, int)
+     * @see java.net.ServerSocket#ServerSocket()
+     */
+    public ServerSocket createServerSocket() throws IOException {
+        throw new SocketException("Unbound server sockets not implemented");
+    }
+
+    /**
+     * Returns a server socket bound to the specified port.
+     * The socket is configured with the socket options
+     * (such as accept timeout) given to this factory.
+     * <P>
+     * If there is a security manager, its <code>checkListen</code>
+     * method is called with the <code>port</code> argument as its
+     * argument to ensure the operation is allowed. This could result
+     * in a SecurityException.
+     *
+     * @param port the port to listen to
+     * @return the <code>ServerSocket</code>
+     * @throws IOException for networking errors
+     * @throws SecurityException if a security manager exists and its
+     *         <code>checkListen</code> method doesn't allow the operation.
+     * @throws IllegalArgumentException if the port parameter is outside the
+     *         specified range of valid port values, which is between 0 and
+     *         65535, inclusive.
+     * @see    SecurityManager#checkListen
+     * @see java.net.ServerSocket#ServerSocket(int)
+     */
+    public abstract ServerSocket createServerSocket(int port)
+        throws IOException;
+
+
+    /**
+     * Returns a server socket bound to the specified port, and uses the
+     * specified connection backlog.  The socket is configured with
+     * the socket options (such as accept timeout) given to this factory.
+     * <P>
+     * The <code>backlog</code> argument must be a positive
+     * value greater than 0. If the value passed if equal or less
+     * than 0, then the default value will be assumed.
+     * <P>
+     * If there is a security manager, its <code>checkListen</code>
+     * method is called with the <code>port</code> argument as its
+     * argument to ensure the operation is allowed. This could result
+     * in a SecurityException.
+     *
+     * @param port the port to listen to
+     * @param backlog how many connections are queued
+     * @return the <code>ServerSocket</code>
+     * @throws IOException for networking errors
+     * @throws SecurityException if a security manager exists and its
+     *         <code>checkListen</code> method doesn't allow the operation.
+     * @throws IllegalArgumentException if the port parameter is outside the
+     *         specified range of valid port values, which is between 0 and
+     *         65535, inclusive.
+     * @see    SecurityManager#checkListen
+     * @see java.net.ServerSocket#ServerSocket(int, int)
+     */
+    public abstract ServerSocket
+    createServerSocket(int port, int backlog)
+    throws IOException;
+
+
+    /**
+     * Returns a server socket bound to the specified port,
+     * with a specified listen backlog and local IP.
+     * <P>
+     * The <code>ifAddress</code> argument can be used on a multi-homed
+     * host for a <code>ServerSocket</code> that will only accept connect
+     * requests to one of its addresses. If <code>ifAddress</code> is null,
+     * it will accept connections on all local addresses. The socket is
+     * configured with the socket options (such as accept timeout) given
+     * to this factory.
+     * <P>
+     * The <code>backlog</code> argument must be a positive
+     * value greater than 0. If the value passed if equal or less
+     * than 0, then the default value will be assumed.
+     * <P>
+     * If there is a security manager, its <code>checkListen</code>
+     * method is called with the <code>port</code> argument as its
+     * argument to ensure the operation is allowed. This could result
+     * in a SecurityException.
+     *
+     * @param port the port to listen to
+     * @param backlog how many connections are queued
+     * @param ifAddress the network interface address to use
+     * @return the <code>ServerSocket</code>
+     * @throws IOException for networking errors
+     * @throws SecurityException if a security manager exists and its
+     *         <code>checkListen</code> method doesn't allow the operation.
+     * @throws IllegalArgumentException if the port parameter is outside the
+     *         specified range of valid port values, which is between 0 and
+     *         65535, inclusive.
+     * @see    SecurityManager#checkListen
+     * @see java.net.ServerSocket#ServerSocket(int, int, java.net.InetAddress)
+     */
+    public abstract ServerSocket
+    createServerSocket(int port, int backlog, InetAddress ifAddress)
+    throws IOException;
+}
+
+
+//
+// The default factory has NO intelligence.  In fact it's not clear
+// what sort of intelligence servers need; the onus is on clients,
+// who have to know how to tunnel etc.
+//
+class DefaultServerSocketFactory extends ServerSocketFactory {
+
+    DefaultServerSocketFactory()
+    {
+        /* NOTHING */
+    }
+
+    public ServerSocket createServerSocket()
+    throws IOException
+    {
+        return new ServerSocket();
+    }
+
+    public ServerSocket createServerSocket(int port)
+    throws IOException
+    {
+        return new ServerSocket(port);
+    }
+
+    public ServerSocket createServerSocket(int port, int backlog)
+    throws IOException
+    {
+        return new ServerSocket(port, backlog);
+    }
+
+    public ServerSocket
+    createServerSocket(int port, int backlog, InetAddress ifAddress)
+    throws IOException
+    {
+        return new ServerSocket(port, backlog, ifAddress);
+    }
+}

src/java.base/share/classes/javax/net/SocketFactory.java

@@ -0,0 +1,293 @@
+/*
+ * Copyright (c) 1997, 2010, Oracle and/or its affiliates. All rights reserved.
+ * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
+ *
+ * This code is free software; you can redistribute it and/or modify it
+ * under the terms of the GNU General Public License version 2 only, as
+ * published by the Free Software Foundation.  Oracle designates this
+ * particular file as subject to the "Classpath" exception as provided
+ * by Oracle in the LICENSE file that accompanied this code.
+ *
+ * This code is distributed in the hope that it will be useful, but WITHOUT
+ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
+ * FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License
+ * version 2 for more details (a copy is included in the LICENSE file that
+ * accompanied this code).
+ *
+ * You should have received a copy of the GNU General Public License version
+ * 2 along with this work; if not, write to the Free Software Foundation,
+ * Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.
+ *
+ * Please contact Oracle, 500 Oracle Parkway, Redwood Shores, CA 94065 USA
+ * or visit www.oracle.com if you need additional information or have any
+ * questions.
+ */
+
+
+package javax.net;
+
+import java.io.IOException;
+import java.net.InetAddress;
+import java.net.Socket;
+import java.net.SocketException;
+import java.net.UnknownHostException;
+
+/**
+ * This class creates sockets.  It may be subclassed by other factories,
+ * which create particular subclasses of sockets and thus provide a general
+ * framework for the addition of public socket-level functionality.
+ *
+ * <P> Socket factories are a simple way to capture a variety of policies
+ * related to the sockets being constructed, producing such sockets in
+ * a way which does not require special configuration of the code which
+ * asks for the sockets:  <UL>
+ *
+ *      <LI> Due to polymorphism of both factories and sockets, different
+ *      kinds of sockets can be used by the same application code just
+ *      by passing it different kinds of factories.
+ *
+ *      <LI> Factories can themselves be customized with parameters used
+ *      in socket construction.  So for example, factories could be
+ *      customized to return sockets with different networking timeouts
+ *      or security parameters already configured.
+ *
+ *      <LI> The sockets returned to the application can be subclasses
+ *      of java.net.Socket, so that they can directly expose new APIs
+ *      for features such as compression, security, record marking,
+ *      statistics collection, or firewall tunneling.
+ *
+ *      </UL>
+ *
+ * <P> Factory classes are specified by environment-specific configuration
+ * mechanisms.  For example, the <em>getDefault</em> method could return
+ * a factory that was appropriate for a particular user or applet, and a
+ * framework could use a factory customized to its own purposes.
+ *
+ * @since 1.4
+ * @see ServerSocketFactory
+ *
+ * @author David Brownell
+ */
+public abstract class SocketFactory
+{
+    //
+    // NOTE:  JDK 1.1 bug in class GC, this can get collected
+    // even though it's always accessible via getDefault().
+    //
+    private static SocketFactory                theFactory;
+
+    /**
+     * Creates a <code>SocketFactory</code>.
+     */
+    protected SocketFactory() { /* NOTHING */ }
+
+
+    /**
+     * Returns a copy of the environment's default socket factory.
+     *
+     * @return the default <code>SocketFactory</code>
+     */
+    public static SocketFactory getDefault()
+    {
+        synchronized (SocketFactory.class) {
+            if (theFactory == null) {
+                //
+                // Different implementations of this method SHOULD
+                // work rather differently.  For example, driving
+                // this from a system property, or using a different
+                // implementation than JavaSoft's.
+                //
+                theFactory = new DefaultSocketFactory();
+            }
+        }
+
+        return theFactory;
+    }
+
+
+    /**
+     * Creates an unconnected socket.
+     *
+     * @return the unconnected socket
+     * @throws IOException if the socket cannot be created
+     * @see java.net.Socket#connect(java.net.SocketAddress)
+     * @see java.net.Socket#connect(java.net.SocketAddress, int)
+     * @see java.net.Socket#Socket()
+     */
+    public Socket createSocket() throws IOException {
+        //
+        // bug 6771432:
+        // The Exception is used by HttpsClient to signal that
+        // unconnected sockets have not been implemented.
+        //
+        UnsupportedOperationException uop = new
+                UnsupportedOperationException();
+        SocketException se =  new SocketException(
+                "Unconnected sockets not implemented");
+        se.initCause(uop);
+        throw se;
+    }
+
+
+    /**
+     * Creates a socket and connects it to the specified remote host
+     * at the specified remote port.  This socket is configured using
+     * the socket options established for this factory.
+     * <p>
+     * If there is a security manager, its <code>checkConnect</code>
+     * method is called with the host address and <code>port</code>
+     * as its arguments. This could result in a SecurityException.
+     *
+     * @param host the server host name with which to connect, or
+     *        <code>null</code> for the loopback address.
+     * @param port the server port
+     * @return the <code>Socket</code>
+     * @throws IOException if an I/O error occurs when creating the socket
+     * @throws SecurityException if a security manager exists and its
+     *         <code>checkConnect</code> method doesn't allow the operation.
+     * @throws UnknownHostException if the host is not known
+     * @throws IllegalArgumentException if the port parameter is outside the
+     *         specified range of valid port values, which is between 0 and
+     *         65535, inclusive.
+     * @see SecurityManager#checkConnect
+     * @see java.net.Socket#Socket(String, int)
+     */
+    public abstract Socket createSocket(String host, int port)
+    throws IOException, UnknownHostException;
+
+
+    /**
+     * Creates a socket and connects it to the specified remote host
+     * on the specified remote port.
+     * The socket will also be bound to the local address and port supplied.
+     * This socket is configured using
+     * the socket options established for this factory.
+     * <p>
+     * If there is a security manager, its <code>checkConnect</code>
+     * method is called with the host address and <code>port</code>
+     * as its arguments. This could result in a SecurityException.
+     *
+     * @param host the server host name with which to connect, or
+     *        <code>null</code> for the loopback address.
+     * @param port the server port
+     * @param localHost the local address the socket is bound to
+     * @param localPort the local port the socket is bound to
+     * @return the <code>Socket</code>
+     * @throws IOException if an I/O error occurs when creating the socket
+     * @throws SecurityException if a security manager exists and its
+     *         <code>checkConnect</code> method doesn't allow the operation.
+     * @throws UnknownHostException if the host is not known
+     * @throws IllegalArgumentException if the port parameter or localPort
+     *         parameter is outside the specified range of valid port values,
+     *         which is between 0 and 65535, inclusive.
+     * @see SecurityManager#checkConnect
+     * @see java.net.Socket#Socket(String, int, java.net.InetAddress, int)
+     */
+    public abstract Socket
+    createSocket(String host, int port, InetAddress localHost, int localPort)
+    throws IOException, UnknownHostException;
+
+
+    /**
+     * Creates a socket and connects it to the specified port number
+     * at the specified address.  This socket is configured using
+     * the socket options established for this factory.
+     * <p>
+     * If there is a security manager, its <code>checkConnect</code>
+     * method is called with the host address and <code>port</code>
+     * as its arguments. This could result in a SecurityException.
+     *
+     * @param host the server host
+     * @param port the server port
+     * @return the <code>Socket</code>
+     * @throws IOException if an I/O error occurs when creating the socket
+     * @throws SecurityException if a security manager exists and its
+     *         <code>checkConnect</code> method doesn't allow the operation.
+     * @throws IllegalArgumentException if the port parameter is outside the
+     *         specified range of valid port values, which is between 0 and
+     *         65535, inclusive.
+     * @throws NullPointerException if <code>host</code> is null.
+     * @see SecurityManager#checkConnect
+     * @see java.net.Socket#Socket(java.net.InetAddress, int)
+     */
+    public abstract Socket createSocket(InetAddress host, int port)
+    throws IOException;
+
+
+    /**
+     * Creates a socket and connect it to the specified remote address
+     * on the specified remote port.  The socket will also be bound
+     * to the local address and port suplied.  The socket is configured using
+     * the socket options established for this factory.
+     * <p>
+     * If there is a security manager, its <code>checkConnect</code>
+     * method is called with the host address and <code>port</code>
+     * as its arguments. This could result in a SecurityException.
+     *
+     * @param address the server network address
+     * @param port the server port
+     * @param localAddress the client network address
+     * @param localPort the client port
+     * @return the <code>Socket</code>
+     * @throws IOException if an I/O error occurs when creating the socket
+     * @throws SecurityException if a security manager exists and its
+     *         <code>checkConnect</code> method doesn't allow the operation.
+     * @throws IllegalArgumentException if the port parameter or localPort
+     *         parameter is outside the specified range of valid port values,
+     *         which is between 0 and 65535, inclusive.
+     * @throws NullPointerException if <code>address</code> is null.
+     * @see SecurityManager#checkConnect
+     * @see java.net.Socket#Socket(java.net.InetAddress, int,
+     *     java.net.InetAddress, int)
+     */
+    public abstract Socket
+    createSocket(InetAddress address, int port,
+        InetAddress localAddress, int localPort)
+    throws IOException;
+}
+
+
+//
+// The default factory has NO intelligence about policies like tunneling
+// out through firewalls (e.g. SOCKS V4 or V5) or in through them
+// (e.g. using SSL), or that some ports are reserved for use with SSL.
+//
+// Note that at least JDK 1.1 has a low level "plainSocketImpl" that
+// knows about SOCKS V4 tunneling, so this isn't a totally bogus default.
+//
+// ALSO:  we may want to expose this class somewhere so other folk
+// can reuse it, particularly if we start to add highly useful features
+// such as ability to set connect timeouts.
+//
+class DefaultSocketFactory extends SocketFactory {
+
+    public Socket createSocket() {
+        return new Socket();
+    }
+
+    public Socket createSocket(String host, int port)
+    throws IOException, UnknownHostException
+    {
+        return new Socket(host, port);
+    }
+
+    public Socket createSocket(InetAddress address, int port)
+    throws IOException
+    {
+        return new Socket(address, port);
+    }
+
+    public Socket createSocket(String host, int port,
+        InetAddress clientAddress, int clientPort)
+    throws IOException, UnknownHostException
+    {
+        return new Socket(host, port, clientAddress, clientPort);
+    }
+
+    public Socket createSocket(InetAddress address, int port,
+        InetAddress clientAddress, int clientPort)
+    throws IOException
+    {
+        return new Socket(address, port, clientAddress, clientPort);
+    }
+}

src/java.base/share/classes/javax/net/package-info.java

@@ -0,0 +1,33 @@
+/*
+ * Copyright (c) 1999, 2001, Oracle and/or its affiliates. All rights reserved.
+ * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
+ *
+ * This code is free software; you can redistribute it and/or modify it
+ * under the terms of the GNU General Public License version 2 only, as
+ * published by the Free Software Foundation.  Oracle designates this
+ * particular file as subject to the "Classpath" exception as provided
+ * by Oracle in the LICENSE file that accompanied this code.
+ *
+ * This code is distributed in the hope that it will be useful, but WITHOUT
+ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
+ * FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License
+ * version 2 for more details (a copy is included in the LICENSE file that
+ * accompanied this code).
+ *
+ * You should have received a copy of the GNU General Public License version
+ * 2 along with this work; if not, write to the Free Software Foundation,
+ * Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.
+ *
+ * Please contact Oracle, 500 Oracle Parkway, Redwood Shores, CA 94065 USA
+ * or visit www.oracle.com if you need additional information or have any
+ * questions.
+ */
+
+/**
+ * Provides classes for networking applications. These classes include
+ * factories for creating sockets. Using socket factories you can
+ * encapsulate socket creation and configuration behavior.
+ *
+ * @since 1.4
+ */
+package javax.net;

src/java.base/share/classes/javax/net/ssl/CertPathTrustManagerParameters.java

@@ -0,0 +1,71 @@
+/*
+ * Copyright (c) 2003, Oracle and/or its affiliates. All rights reserved.
+ * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
+ *
+ * This code is free software; you can redistribute it and/or modify it
+ * under the terms of the GNU General Public License version 2 only, as
+ * published by the Free Software Foundation.  Oracle designates this
+ * particular file as subject to the "Classpath" exception as provided
+ * by Oracle in the LICENSE file that accompanied this code.
+ *
+ * This code is distributed in the hope that it will be useful, but WITHOUT
+ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
+ * FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License
+ * version 2 for more details (a copy is included in the LICENSE file that
+ * accompanied this code).
+ *
+ * You should have received a copy of the GNU General Public License version
+ * 2 along with this work; if not, write to the Free Software Foundation,
+ * Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.
+ *
+ * Please contact Oracle, 500 Oracle Parkway, Redwood Shores, CA 94065 USA
+ * or visit www.oracle.com if you need additional information or have any
+ * questions.
+ */
+
+package javax.net.ssl;
+
+import java.security.cert.CertPathParameters;
+
+/**
+ * A wrapper for CertPathParameters. This class is used to pass validation
+ * settings to CertPath based {@link TrustManager}s using the
+ * {@link TrustManagerFactory#init(ManagerFactoryParameters)
+ * TrustManagerFactory.init()} method.
+ *
+ * <p>Instances of this class are immutable.
+ *
+ * @see X509TrustManager
+ * @see TrustManagerFactory
+ * @see java.security.cert.CertPathParameters
+ *
+ * @since   1.5
+ * @author  Andreas Sterbenz
+ */
+public class CertPathTrustManagerParameters implements ManagerFactoryParameters {
+
+    private final CertPathParameters parameters;
+
+    /**
+     * Construct new CertPathTrustManagerParameters from the specified
+     * parameters. The parameters are cloned to protect against subsequent
+     * modification.
+     *
+     * @param parameters the CertPathParameters to be used
+     *
+     * @throws NullPointerException if parameters is null
+     */
+    public CertPathTrustManagerParameters(CertPathParameters parameters) {
+        this.parameters = (CertPathParameters)parameters.clone();
+    }
+
+    /**
+     * Return a clone of the CertPathParameters encapsulated by this class.
+     *
+     * @return a clone of the CertPathParameters encapsulated by this class.
+     */
+    public CertPathParameters getParameters() {
+        return (CertPathParameters)parameters.clone();
+    }
+
+}

src/java.base/share/classes/javax/net/ssl/ExtendedSSLSession.java

@@ -0,0 +1,159 @@
+/*
+ * Copyright (c) 2010, 2017, Oracle and/or its affiliates. All rights reserved.
+ * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
+ *
+ * This code is free software; you can redistribute it and/or modify it
+ * under the terms of the GNU General Public License version 2 only, as
+ * published by the Free Software Foundation.  Oracle designates this
+ * particular file as subject to the "Classpath" exception as provided
+ * by Oracle in the LICENSE file that accompanied this code.
+ *
+ * This code is distributed in the hope that it will be useful, but WITHOUT
+ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
+ * FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License
+ * version 2 for more details (a copy is included in the LICENSE file that
+ * accompanied this code).
+ *
+ * You should have received a copy of the GNU General Public License version
+ * 2 along with this work; if not, write to the Free Software Foundation,
+ * Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.
+ *
+ * Please contact Oracle, 500 Oracle Parkway, Redwood Shores, CA 94065 USA
+ * or visit www.oracle.com if you need additional information or have any
+ * questions.
+ */
+
+package javax.net.ssl;
+
+import java.util.List;
+
+/**
+ * Extends the {@code SSLSession} interface to support additional
+ * session attributes.
+ *
+ * @since 1.7
+ */
+public abstract class ExtendedSSLSession implements SSLSession {
+    /**
+     * Obtains an array of supported signature algorithms that the local side
+     * is willing to use.
+     * <p>
+     * Note: this method is used to indicate to the peer which signature
+     * algorithms may be used for digital signatures in TLS/DTLS 1.2. It is
+     * not meaningful for TLS/DTLS versions prior to 1.2.
+     * <p>
+     * The signature algorithm name must be a standard Java Security
+     * name (such as "SHA1withRSA", "SHA256withECDSA", and so on).
+     * See the <a href=
+     * "{@docRoot}/../specs/security/standard-names.html">
+     * Java Security Standard Algorithm Names</a> document
+     * for information about standard algorithm names.
+     * <p>
+     * Note: the local supported signature algorithms should conform to
+     * the algorithm constraints specified by
+     * {@link SSLParameters#getAlgorithmConstraints getAlgorithmConstraints()}
+     * method in {@code SSLParameters}.
+     *
+     * @return An array of supported signature algorithms, in descending
+     *     order of preference.  The return value is an empty array if
+     *     no signature algorithm is supported.
+     *
+     * @see SSLParameters#getAlgorithmConstraints
+     */
+    public abstract String[] getLocalSupportedSignatureAlgorithms();
+
+    /**
+     * Obtains an array of supported signature algorithms that the peer is
+     * able to use.
+     * <p>
+     * Note: this method is used to indicate to the local side which signature
+     * algorithms may be used for digital signatures in TLS/DTLS 1.2. It is
+     * not meaningful for TLS/DTLS versions prior to 1.2.
+     * <p>
+     * The signature algorithm name must be a standard Java Security
+     * name (such as "SHA1withRSA", "SHA256withECDSA", and so on).
+     * See the <a href=
+     * "{@docRoot}/../specs/security/standard-names.html">
+     * Java Security Standard Algorithm Names</a> document
+     * for information about standard algorithm names.
+     *
+     * @return An array of supported signature algorithms, in descending
+     *     order of preference.  The return value is an empty array if
+     *     the peer has not sent the supported signature algorithms.
+     *
+     * @see X509KeyManager
+     * @see X509ExtendedKeyManager
+     */
+    public abstract String[] getPeerSupportedSignatureAlgorithms();
+
+    /**
+     * Obtains a {@link List} containing all {@link SNIServerName}s
+     * of the requested Server Name Indication (SNI) extension.
+     * <P>
+     * In server mode, unless the return {@link List} is empty,
+     * the server should use the requested server names to guide its
+     * selection of an appropriate authentication certificate, and/or
+     * other aspects of security policy.
+     * <P>
+     * In client mode, unless the return {@link List} is empty,
+     * the client should use the requested server names to guide its
+     * endpoint identification of the peer's identity, and/or
+     * other aspects of security policy.
+     *
+     * @return a non-null immutable list of {@link SNIServerName}s of the
+     *         requested server name indications. The returned list may be
+     *         empty if no server name indications were requested.
+     * @throws UnsupportedOperationException if the underlying provider
+     *         does not implement the operation
+     *
+     * @see SNIServerName
+     * @see X509ExtendedTrustManager
+     * @see X509ExtendedKeyManager
+     *
+     * @since 1.8
+     */
+    public List<SNIServerName> getRequestedServerNames() {
+        throw new UnsupportedOperationException();
+    }
+
+    /**
+     * Returns a {@link List} containing DER-encoded OCSP responses
+     * (using the ASN.1 type OCSPResponse defined in RFC 6960) for
+     * the client to verify status of the server's certificate during
+     * handshaking.
+     *
+     * <P>
+     * This method only applies to certificate-based server
+     * authentication.  An {@link X509ExtendedTrustManager} will use the
+     * returned value for server certificate validation.
+     *
+     * @implSpec This method throws UnsupportedOperationException by default.
+     *         Classes derived from ExtendedSSLSession must implement
+     *         this method.
+     *
+     * @return a non-null unmodifiable list of byte arrays, each entry
+     *         containing a DER-encoded OCSP response (using the
+     *         ASN.1 type OCSPResponse defined in RFC 6960).  The order
+     *         of the responses must match the order of the certificates
+     *         presented by the server in its Certificate message (See
+     *         {@link SSLSession#getLocalCertificates()} for server mode,
+     *         and {@link SSLSession#getPeerCertificates()} for client mode).
+     *         It is possible that fewer response entries may be returned than
+     *         the number of presented certificates.  If an entry in the list
+     *         is a zero-length byte array, it should be treated by the
+     *         caller as if the OCSP entry for the corresponding certificate
+     *         is missing.  The returned list may be empty if no OCSP responses
+     *         were presented during handshaking or if OCSP stapling is not
+     *         supported by either endpoint for this handshake.
+     *
+     * @throws UnsupportedOperationException if the underlying provider
+     *         does not implement the operation
+     *
+     * @see X509ExtendedTrustManager
+     *
+     * @since 9
+     */
+    public List<byte[]> getStatusResponses() {
+        throw new UnsupportedOperationException();
+    }
+}

src/java.base/share/classes/javax/net/ssl/HandshakeCompletedEvent.java

@@ -0,0 +1,245 @@
+/*
+ * Copyright (c) 1997, 2017, Oracle and/or its affiliates. All rights reserved.
+ * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
+ *
+ * This code is free software; you can redistribute it and/or modify it
+ * under the terms of the GNU General Public License version 2 only, as
+ * published by the Free Software Foundation.  Oracle designates this
+ * particular file as subject to the "Classpath" exception as provided
+ * by Oracle in the LICENSE file that accompanied this code.
+ *
+ * This code is distributed in the hope that it will be useful, but WITHOUT
+ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
+ * FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License
+ * version 2 for more details (a copy is included in the LICENSE file that
+ * accompanied this code).
+ *
+ * You should have received a copy of the GNU General Public License version
+ * 2 along with this work; if not, write to the Free Software Foundation,
+ * Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.
+ *
+ * Please contact Oracle, 500 Oracle Parkway, Redwood Shores, CA 94065 USA
+ * or visit www.oracle.com if you need additional information or have any
+ * questions.
+ */
+
+package javax.net.ssl;
+
+import java.util.EventObject;
+import java.security.cert.Certificate;
+import java.security.Principal;
+import java.security.cert.X509Certificate;
+
+/**
+ * This event indicates that an SSL handshake completed on a given
+ * SSL connection.  All of the core information about that handshake's
+ * result is captured through an "SSLSession" object.  As a convenience,
+ * this event class provides direct access to some important session
+ * attributes.
+ *
+ * <P> The source of this event is the SSLSocket on which handshaking
+ * just completed.
+ *
+ * @see SSLSocket
+ * @see HandshakeCompletedListener
+ * @see SSLSession
+ *
+ * @since 1.4
+ * @author David Brownell
+ */
+public class HandshakeCompletedEvent extends EventObject
+{
+    private static final long serialVersionUID = 7914963744257769778L;
+
+    private transient SSLSession session;
+
+    /**
+     * Constructs a new HandshakeCompletedEvent.
+     *
+     * @param sock the SSLSocket acting as the source of the event
+     * @param s the SSLSession this event is associated with
+     */
+    public HandshakeCompletedEvent(SSLSocket sock, SSLSession s)
+    {
+        super(sock);
+        session = s;
+    }
+
+
+    /**
+     * Returns the session that triggered this event.
+     *
+     * @return the <code>SSLSession</code> for this handshake
+     */
+    public SSLSession getSession()
+    {
+        return session;
+    }
+
+
+    /**
+     * Returns the cipher suite in use by the session which was produced
+     * by the handshake.  (This is a convenience method for
+     * getting the ciphersuite from the SSLsession.)
+     *
+     * @return the name of the cipher suite negotiated during this session.
+     */
+    public String getCipherSuite()
+    {
+        return session.getCipherSuite();
+    }
+
+
+    /**
+     * Returns the certificate(s) that were sent to the peer during
+     * handshaking.
+     * Note: This method is useful only when using certificate-based
+     * cipher suites.
+     *
+     * When multiple certificates are available for use in a
+     * handshake, the implementation chooses what it considers the
+     * "best" certificate chain available, and transmits that to
+     * the other side.  This method allows the caller to know
+     * which certificate chain was actually used.
+     *
+     * @return an ordered array of certificates, with the local
+     *          certificate first followed by any
+     *          certificate authorities.  If no certificates were sent,
+     *          then null is returned.
+     * @see #getLocalPrincipal()
+     */
+    public java.security.cert.Certificate [] getLocalCertificates()
+    {
+        return session.getLocalCertificates();
+    }
+
+
+    /**
+     * Returns the identity of the peer which was established as part
+     * of defining the session.
+     * Note: This method can be used only when using certificate-based
+     * cipher suites; using it with non-certificate-based cipher suites,
+     * such as Kerberos, will throw an SSLPeerUnverifiedException.
+     * <P>
+     * Note: The returned value may not be a valid certificate chain
+     * and should not be relied on for trust decisions.
+     *
+     * @return an ordered array of the peer certificates,
+     *          with the peer's own certificate first followed by
+     *          any certificate authorities.
+     * @exception SSLPeerUnverifiedException if the peer is not verified.
+     * @see #getPeerPrincipal()
+     */
+    public java.security.cert.Certificate [] getPeerCertificates()
+            throws SSLPeerUnverifiedException
+    {
+        return session.getPeerCertificates();
+    }
+
+
+    /**
+     * Returns the identity of the peer which was identified as part
+     * of defining the session.
+     * Note: This method can be used only when using certificate-based
+     * cipher suites; using it with non-certificate-based cipher suites,
+     * such as Kerberos, will throw an SSLPeerUnverifiedException.
+     * <P>
+     * Note: The returned value may not be a valid certificate chain
+     * and should not be relied on for trust decisions.
+     *
+     * <p><em>Note: this method exists for compatibility with previous
+     * releases. New applications should use
+     * {@link #getPeerCertificates} instead.</em></p>
+     *
+     * @return an ordered array of peer X.509 certificates,
+     *          with the peer's own certificate first followed by any
+     *          certificate authorities.  (The certificates are in
+     *          the original JSSE
+     *          {@link javax.security.cert.X509Certificate} format).
+     * @exception SSLPeerUnverifiedException if the peer is not verified.
+     * @see #getPeerPrincipal()
+     * @deprecated The {@link #getPeerCertificates()} method that returns an
+     *               array of {@code java.security.cert.Certificate} should
+     *               be used instead.
+     */
+    @Deprecated(since="9")
+    public javax.security.cert.X509Certificate [] getPeerCertificateChain()
+            throws SSLPeerUnverifiedException
+    {
+        return session.getPeerCertificateChain();
+    }
+
+    /**
+     * Returns the identity of the peer which was established as part of
+     * defining the session.
+     *
+     * @return the peer's principal. Returns an X500Principal of the
+     * end-entity certiticate for X509-based cipher suites, and
+     * KerberosPrincipal for Kerberos cipher suites.
+     *
+     * @throws SSLPeerUnverifiedException if the peer's identity has not
+     *          been verified
+     *
+     * @see #getPeerCertificates()
+     * @see #getLocalPrincipal()
+     *
+     * @since 1.5
+     */
+    public Principal getPeerPrincipal()
+            throws SSLPeerUnverifiedException
+    {
+        Principal principal;
+        try {
+            principal = session.getPeerPrincipal();
+        } catch (AbstractMethodError e) {
+            // if the provider does not support it, fallback to peer certs.
+            // return the X500Principal of the end-entity cert.
+            Certificate[] certs = getPeerCertificates();
+            principal = ((X509Certificate)certs[0]).getSubjectX500Principal();
+        }
+        return principal;
+    }
+
+    /**
+     * Returns the principal that was sent to the peer during handshaking.
+     *
+     * @return the principal sent to the peer. Returns an X500Principal
+     * of the end-entity certificate for X509-based cipher suites, and
+     * KerberosPrincipal for Kerberos cipher suites. If no principal was
+     * sent, then null is returned.
+     *
+     * @see #getLocalCertificates()
+     * @see #getPeerPrincipal()
+     *
+     * @since 1.5
+     */
+    public Principal getLocalPrincipal()
+    {
+        Principal principal;
+        try {
+            principal = session.getLocalPrincipal();
+        } catch (AbstractMethodError e) {
+            principal = null;
+            // if the provider does not support it, fallback to local certs.
+            // return the X500Principal of the end-entity cert.
+            Certificate[] certs = getLocalCertificates();
+            if (certs != null) {
+                principal =
+                        ((X509Certificate)certs[0]).getSubjectX500Principal();
+            }
+        }
+        return principal;
+    }
+
+    /**
+     * Returns the socket which is the source of this event.
+     * (This is a convenience function, to let applications
+     * write code without type casts.)
+     *
+     * @return the socket on which the connection was made.
+     */
+    public SSLSocket getSocket()
+    {
+        return (SSLSocket) getSource();
+    }
+}

src/java.base/share/classes/javax/net/ssl/HandshakeCompletedListener.java

@@ -0,0 +1,54 @@
+/*
+ * Copyright (c) 1997, 2001, Oracle and/or its affiliates. All rights reserved.
+ * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
+ *
+ * This code is free software; you can redistribute it and/or modify it
+ * under the terms of the GNU General Public License version 2 only, as
+ * published by the Free Software Foundation.  Oracle designates this
+ * particular file as subject to the "Classpath" exception as provided
+ * by Oracle in the LICENSE file that accompanied this code.
+ *
+ * This code is distributed in the hope that it will be useful, but WITHOUT
+ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
+ * FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License
+ * version 2 for more details (a copy is included in the LICENSE file that
+ * accompanied this code).
+ *
+ * You should have received a copy of the GNU General Public License version
+ * 2 along with this work; if not, write to the Free Software Foundation,
+ * Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.
+ *
+ * Please contact Oracle, 500 Oracle Parkway, Redwood Shores, CA 94065 USA
+ * or visit www.oracle.com if you need additional information or have any
+ * questions.
+ */
+
+package javax.net.ssl;
+
+import java.util.EventListener;
+
+/**
+ * This interface is implemented by any class which wants to receive
+ * notifications about the completion of an SSL protocol handshake
+ * on a given SSL connection.
+ *
+ * <P> When an SSL handshake completes, new security parameters will
+ * have been established.  Those parameters always include the security
+ * keys used to protect messages.  They may also include parameters
+ * associated with a new <em>session</em> such as authenticated
+ * peer identity and a new SSL cipher suite.
+ *
+ * @since 1.4
+ * @author David Brownell
+ */
+public interface HandshakeCompletedListener extends EventListener
+{
+    /**
+     * This method is invoked on registered objects
+     * when a SSL handshake is completed.
+     *
+     * @param event the event identifying when the SSL Handshake
+     *          completed on a given SSL connection
+     */
+    void handshakeCompleted(HandshakeCompletedEvent event);
+}

src/java.base/share/classes/javax/net/ssl/HostnameVerifier.java

@@ -0,0 +1,56 @@
+/*
+ * Copyright (c) 2001, 2012, Oracle and/or its affiliates. All rights reserved.
+ * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
+ *
+ * This code is free software; you can redistribute it and/or modify it
+ * under the terms of the GNU General Public License version 2 only, as
+ * published by the Free Software Foundation.  Oracle designates this
+ * particular file as subject to the "Classpath" exception as provided
+ * by Oracle in the LICENSE file that accompanied this code.
+ *
+ * This code is distributed in the hope that it will be useful, but WITHOUT
+ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
+ * FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License
+ * version 2 for more details (a copy is included in the LICENSE file that
+ * accompanied this code).
+ *
+ * You should have received a copy of the GNU General Public License version
+ * 2 along with this work; if not, write to the Free Software Foundation,
+ * Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.
+ *
+ * Please contact Oracle, 500 Oracle Parkway, Redwood Shores, CA 94065 USA
+ * or visit www.oracle.com if you need additional information or have any
+ * questions.
+ */
+
+package javax.net.ssl;
+
+/**
+ * This class is the base interface for hostname verification.
+ * <P>
+ * During handshaking, if the URL's hostname and
+ * the server's identification hostname mismatch, the
+ * verification mechanism can call back to implementers of this
+ * interface to determine if this connection should be allowed.
+ * <P>
+ * The policies can be certificate-based
+ * or may depend on other authentication schemes.
+ * <P>
+ * These callbacks are used when the default rules for URL hostname
+ * verification fail.
+ *
+ * @author Brad R. Wetmore
+ * @since 1.4
+ */
+
+public interface HostnameVerifier {
+    /**
+     * Verify that the host name is an acceptable match with
+     * the server's authentication scheme.
+     *
+     * @param hostname the host name
+     * @param session SSLSession used on the connection to host
+     * @return true if the host name is acceptable
+     */
+    public boolean verify(String hostname, SSLSession session);
+}

src/java.base/share/classes/javax/net/ssl/HttpsURLConnection.java

@@ -0,0 +1,381 @@
+/*
+ * Copyright (c) 1999, 2016, Oracle and/or its affiliates. All rights reserved.
+ * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
+ *
+ * This code is free software; you can redistribute it and/or modify it
+ * under the terms of the GNU General Public License version 2 only, as
+ * published by the Free Software Foundation.  Oracle designates this
+ * particular file as subject to the "Classpath" exception as provided
+ * by Oracle in the LICENSE file that accompanied this code.
+ *
+ * This code is distributed in the hope that it will be useful, but WITHOUT
+ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
+ * FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License
+ * version 2 for more details (a copy is included in the LICENSE file that
+ * accompanied this code).
+ *
+ * You should have received a copy of the GNU General Public License version
+ * 2 along with this work; if not, write to the Free Software Foundation,
+ * Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.
+ *
+ * Please contact Oracle, 500 Oracle Parkway, Redwood Shores, CA 94065 USA
+ * or visit www.oracle.com if you need additional information or have any
+ * questions.
+ */
+
+package javax.net.ssl;
+
+import java.net.URL;
+import java.net.HttpURLConnection;
+import java.security.Principal;
+import java.security.cert.X509Certificate;
+
+/**
+ * <code>HttpsURLConnection</code> extends <code>HttpURLConnection</code>
+ * with support for https-specific features.
+ * <P>
+ * See <A HREF="http://www.w3.org/pub/WWW/Protocols/">
+ * http://www.w3.org/pub/WWW/Protocols/</A> and
+ * <A HREF="http://www.ietf.org/"> RFC 2818 </A>
+ * for more details on the
+ * https specification.
+ * <P>
+ * This class uses <code>HostnameVerifier</code> and
+ * <code>SSLSocketFactory</code>.
+ * There are default implementations defined for both classes.
+ * However, the implementations can be replaced on a per-class (static) or
+ * per-instance basis.  All new <code>HttpsURLConnection</code>s instances
+ * will be assigned
+ * the "default" static values at instance creation, but they can be overriden
+ * by calling the appropriate per-instance set method(s) before
+ * <code>connect</code>ing.
+ *
+ * @since 1.4
+ */
+public abstract
+class HttpsURLConnection extends HttpURLConnection
+{
+    /**
+     * Creates an <code>HttpsURLConnection</code> using the
+     * URL specified.
+     *
+     * @param url the URL
+     */
+    protected HttpsURLConnection(URL url) {
+        super(url);
+    }
+
+    /**
+     * Returns the cipher suite in use on this connection.
+     *
+     * @return the cipher suite
+     * @throws IllegalStateException if this method is called before
+     *          the connection has been established.
+     */
+    public abstract String getCipherSuite();
+
+    /**
+     * Returns the certificate(s) that were sent to the server during
+     * handshaking.
+     * <P>
+     * Note: This method is useful only when using certificate-based
+     * cipher suites.
+     * <P>
+     * When multiple certificates are available for use in a
+     * handshake, the implementation chooses what it considers the
+     * "best" certificate chain available, and transmits that to
+     * the other side.  This method allows the caller to know
+     * which certificate chain was actually sent.
+     *
+     * @return an ordered array of certificates,
+     *          with the client's own certificate first followed by any
+     *          certificate authorities.  If no certificates were sent,
+     *          then null is returned.
+     * @throws IllegalStateException if this method is called before
+     *          the connection has been established.
+     * @see #getLocalPrincipal()
+     */
+    public abstract java.security.cert.Certificate [] getLocalCertificates();
+
+    /**
+     * Returns the server's certificate chain which was established
+     * as part of defining the session.
+     * <P>
+     * Note: This method can be used only when using certificate-based
+     * cipher suites; using it with non-certificate-based cipher suites,
+     * such as Kerberos, will throw an SSLPeerUnverifiedException.
+     * <P>
+     * Note: The returned value may not be a valid certificate chain
+     * and should not be relied on for trust decisions.
+     *
+     * @return an ordered array of server certificates,
+     *          with the peer's own certificate first followed by
+     *          any certificate authorities.
+     * @throws SSLPeerUnverifiedException if the peer is not verified.
+     * @throws IllegalStateException if this method is called before
+     *          the connection has been established.
+     * @see #getPeerPrincipal()
+     */
+    public abstract java.security.cert.Certificate [] getServerCertificates()
+            throws SSLPeerUnverifiedException;
+
+    /**
+     * Returns the server's principal which was established as part of
+     * defining the session.
+     * <P>
+     * Note: Subclasses should override this method. If not overridden, it
+     * will default to returning the X500Principal of the server's end-entity
+     * certificate for certificate-based ciphersuites, or throw an
+     * SSLPeerUnverifiedException for non-certificate based ciphersuites,
+     * such as Kerberos.
+     *
+     * @return the server's principal. Returns an X500Principal of the
+     * end-entity certiticate for X509-based cipher suites, and
+     * KerberosPrincipal for Kerberos cipher suites.
+     *
+     * @throws SSLPeerUnverifiedException if the peer was not verified
+     * @throws IllegalStateException if this method is called before
+     *          the connection has been established.
+     *
+     * @see #getServerCertificates()
+     * @see #getLocalPrincipal()
+     *
+     * @since 1.5
+     */
+    public Principal getPeerPrincipal()
+            throws SSLPeerUnverifiedException {
+
+        java.security.cert.Certificate[] certs = getServerCertificates();
+        return ((X509Certificate)certs[0]).getSubjectX500Principal();
+    }
+
+    /**
+     * Returns the principal that was sent to the server during handshaking.
+     * <P>
+     * Note: Subclasses should override this method. If not overridden, it
+     * will default to returning the X500Principal of the end-entity certificate
+     * that was sent to the server for certificate-based ciphersuites or,
+     * return null for non-certificate based ciphersuites, such as Kerberos.
+     *
+     * @return the principal sent to the server. Returns an X500Principal
+     * of the end-entity certificate for X509-based cipher suites, and
+     * KerberosPrincipal for Kerberos cipher suites. If no principal was
+     * sent, then null is returned.
+     *
+     * @throws IllegalStateException if this method is called before
+     *          the connection has been established.
+     *
+     * @see #getLocalCertificates()
+     * @see #getPeerPrincipal()
+     *
+     * @since 1.5
+     */
+    public Principal getLocalPrincipal() {
+
+        java.security.cert.Certificate[] certs = getLocalCertificates();
+        if (certs != null) {
+            return ((X509Certificate)certs[0]).getSubjectX500Principal();
+        } else {
+            return null;
+        }
+    }
+
+    /**
+     * <code>HostnameVerifier</code> provides a callback mechanism so that
+     * implementers of this interface can supply a policy for
+     * handling the case where the host to connect to and
+     * the server name from the certificate mismatch.
+     * <p>
+     * The default implementation will deny such connections.
+     */
+    private static HostnameVerifier defaultHostnameVerifier =
+                                        new DefaultHostnameVerifier();
+
+    /*
+     * The initial default <code>HostnameVerifier</code>.  Should be
+     * updated for another other type of <code>HostnameVerifier</code>
+     * that are created.
+     */
+    private static class DefaultHostnameVerifier
+            implements HostnameVerifier {
+        @Override
+        public boolean verify(String hostname, SSLSession session) {
+            return false;
+        }
+    }
+
+    /**
+     * The <code>hostnameVerifier</code> for this object.
+     */
+    protected HostnameVerifier hostnameVerifier = defaultHostnameVerifier;
+
+    /**
+     * Sets the default <code>HostnameVerifier</code> inherited by a
+     * new instance of this class.
+     * <P>
+     * If this method is not called, the default
+     * <code>HostnameVerifier</code> assumes the connection should not
+     * be permitted.
+     *
+     * @param v the default host name verifier
+     * @throws IllegalArgumentException if the <code>HostnameVerifier</code>
+     *          parameter is null.
+     * @throws SecurityException if a security manager exists and its
+     *         <code>checkPermission</code> method does not allow
+     *         <code>SSLPermission("setHostnameVerifier")</code>
+     * @see #getDefaultHostnameVerifier()
+     */
+    public static void setDefaultHostnameVerifier(HostnameVerifier v) {
+        if (v == null) {
+            throw new IllegalArgumentException(
+                "no default HostnameVerifier specified");
+        }
+
+        SecurityManager sm = System.getSecurityManager();
+        if (sm != null) {
+            sm.checkPermission(new SSLPermission("setHostnameVerifier"));
+        }
+        defaultHostnameVerifier = v;
+    }
+
+    /**
+     * Gets the default <code>HostnameVerifier</code> that is inherited
+     * by new instances of this class.
+     *
+     * @return the default host name verifier
+     * @see #setDefaultHostnameVerifier(HostnameVerifier)
+     */
+    public static HostnameVerifier getDefaultHostnameVerifier() {
+        return defaultHostnameVerifier;
+    }
+
+    /**
+     * Sets the <code>HostnameVerifier</code> for this instance.
+     * <P>
+     * New instances of this class inherit the default static hostname
+     * verifier set by {@link #setDefaultHostnameVerifier(HostnameVerifier)
+     * setDefaultHostnameVerifier}.  Calls to this method replace
+     * this object's <code>HostnameVerifier</code>.
+     *
+     * @param v the host name verifier
+     * @throws IllegalArgumentException if the <code>HostnameVerifier</code>
+     *  parameter is null.
+     * @see #getHostnameVerifier()
+     * @see #setDefaultHostnameVerifier(HostnameVerifier)
+     */
+    public void setHostnameVerifier(HostnameVerifier v) {
+        if (v == null) {
+            throw new IllegalArgumentException(
+                "no HostnameVerifier specified");
+        }
+
+        hostnameVerifier = v;
+    }
+
+    /**
+     * Gets the <code>HostnameVerifier</code> in place on this instance.
+     *
+     * @return the host name verifier
+     * @see #setHostnameVerifier(HostnameVerifier)
+     * @see #setDefaultHostnameVerifier(HostnameVerifier)
+     */
+    public HostnameVerifier getHostnameVerifier() {
+        return hostnameVerifier;
+    }
+
+    private static SSLSocketFactory defaultSSLSocketFactory = null;
+
+    /**
+     * The <code>SSLSocketFactory</code> inherited when an instance
+     * of this class is created.
+     */
+    private SSLSocketFactory sslSocketFactory = getDefaultSSLSocketFactory();
+
+    /**
+     * Sets the default <code>SSLSocketFactory</code> inherited by new
+     * instances of this class.
+     * <P>
+     * The socket factories are used when creating sockets for secure
+     * https URL connections.
+     *
+     * @param sf the default SSL socket factory
+     * @throws IllegalArgumentException if the SSLSocketFactory
+     *          parameter is null.
+     * @throws SecurityException if a security manager exists and its
+     *         <code>checkSetFactory</code> method does not allow
+     *         a socket factory to be specified.
+     * @see #getDefaultSSLSocketFactory()
+     */
+    public static void setDefaultSSLSocketFactory(SSLSocketFactory sf) {
+        if (sf == null) {
+            throw new IllegalArgumentException(
+                "no default SSLSocketFactory specified");
+        }
+
+        SecurityManager sm = System.getSecurityManager();
+        if (sm != null) {
+            sm.checkSetFactory();
+        }
+        defaultSSLSocketFactory = sf;
+    }
+
+    /**
+     * Gets the default static <code>SSLSocketFactory</code> that is
+     * inherited by new instances of this class.
+     * <P>
+     * The socket factories are used when creating sockets for secure
+     * https URL connections.
+     *
+     * @return the default <code>SSLSocketFactory</code>
+     * @see #setDefaultSSLSocketFactory(SSLSocketFactory)
+     */
+    public static SSLSocketFactory getDefaultSSLSocketFactory() {
+        if (defaultSSLSocketFactory == null) {
+            defaultSSLSocketFactory =
+                (SSLSocketFactory)SSLSocketFactory.getDefault();
+        }
+        return defaultSSLSocketFactory;
+    }
+
+    /**
+     * Sets the <code>SSLSocketFactory</code> to be used when this instance
+     * creates sockets for secure https URL connections.
+     * <P>
+     * New instances of this class inherit the default static
+     * <code>SSLSocketFactory</code> set by
+     * {@link #setDefaultSSLSocketFactory(SSLSocketFactory)
+     * setDefaultSSLSocketFactory}.  Calls to this method replace
+     * this object's <code>SSLSocketFactory</code>.
+     *
+     * @param sf the SSL socket factory
+     * @throws IllegalArgumentException if the <code>SSLSocketFactory</code>
+     *          parameter is null.
+     * @throws SecurityException if a security manager exists and its
+     *         <code>checkSetFactory</code> method does not allow
+     *         a socket factory to be specified.
+     * @see #getSSLSocketFactory()
+     */
+    public void setSSLSocketFactory(SSLSocketFactory sf) {
+        if (sf == null) {
+            throw new IllegalArgumentException(
+                "no SSLSocketFactory specified");
+        }
+
+        SecurityManager sm = System.getSecurityManager();
+        if (sm != null) {
+            sm.checkSetFactory();
+        }
+        sslSocketFactory = sf;
+    }
+
+    /**
+     * Gets the SSL socket factory to be used when creating sockets
+     * for secure https URL connections.
+     *
+     * @return the <code>SSLSocketFactory</code>
+     * @see #setSSLSocketFactory(SSLSocketFactory)
+     */
+    public SSLSocketFactory getSSLSocketFactory() {
+        return sslSocketFactory;
+    }
+}

src/java.base/share/classes/javax/net/ssl/KeyManager.java

@@ -0,0 +1,44 @@
+/*
+ * Copyright (c) 1999, 2003, Oracle and/or its affiliates. All rights reserved.
+ * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
+ *
+ * This code is free software; you can redistribute it and/or modify it
+ * under the terms of the GNU General Public License version 2 only, as
+ * published by the Free Software Foundation.  Oracle designates this
+ * particular file as subject to the "Classpath" exception as provided
+ * by Oracle in the LICENSE file that accompanied this code.
+ *
+ * This code is distributed in the hope that it will be useful, but WITHOUT
+ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
+ * FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License
+ * version 2 for more details (a copy is included in the LICENSE file that
+ * accompanied this code).
+ *
+ * You should have received a copy of the GNU General Public License version
+ * 2 along with this work; if not, write to the Free Software Foundation,
+ * Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.
+ *
+ * Please contact Oracle, 500 Oracle Parkway, Redwood Shores, CA 94065 USA
+ * or visit www.oracle.com if you need additional information or have any
+ * questions.
+ */
+
+package javax.net.ssl;
+
+/**
+ * This is the base interface for JSSE key managers.
+ * <P>
+ * <code>KeyManager</code>s are responsible for managing the
+ * key material which is used to authenticate the local SSLSocket
+ * to its peer.  If no key material is available, the socket will
+ * be unable to present authentication credentials.
+ * <P>
+ * <code>KeyManager</code>s are created by either
+ * using a <code>KeyManagerFactory</code>,
+ * or by implementing one of the <code>KeyManager</code> subclasses.
+ *
+ * @since 1.4
+ * @see KeyManagerFactory
+ */
+public interface KeyManager {
+}

src/java.base/share/classes/javax/net/ssl/KeyManagerFactory.java

@@ -0,0 +1,306 @@
+/*
+ * Copyright (c) 1999, 2017, Oracle and/or its affiliates. All rights reserved.
+ * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
+ *
+ * This code is free software; you can redistribute it and/or modify it
+ * under the terms of the GNU General Public License version 2 only, as
+ * published by the Free Software Foundation.  Oracle designates this
+ * particular file as subject to the "Classpath" exception as provided
+ * by Oracle in the LICENSE file that accompanied this code.
+ *
+ * This code is distributed in the hope that it will be useful, but WITHOUT
+ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
+ * FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License
+ * version 2 for more details (a copy is included in the LICENSE file that
+ * accompanied this code).
+ *
+ * You should have received a copy of the GNU General Public License version
+ * 2 along with this work; if not, write to the Free Software Foundation,
+ * Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.
+ *
+ * Please contact Oracle, 500 Oracle Parkway, Redwood Shores, CA 94065 USA
+ * or visit www.oracle.com if you need additional information or have any
+ * questions.
+ */
+
+package javax.net.ssl;
+
+import java.security.Security;
+import java.security.*;
+import java.util.Objects;
+
+import sun.security.jca.GetInstance;
+
+/**
+ * This class acts as a factory for key managers based on a
+ * source of key material. Each key manager manages a specific
+ * type of key material for use by secure sockets. The key
+ * material is based on a KeyStore and/or provider specific sources.
+ *
+ * @since 1.4
+ * @see KeyManager
+ */
+public class KeyManagerFactory {
+    // The provider
+    private Provider provider;
+
+    // The provider implementation (delegate)
+    private KeyManagerFactorySpi factorySpi;
+
+    // The name of the key management algorithm.
+    private String algorithm;
+
+    /**
+     * Obtains the default KeyManagerFactory algorithm name.
+     *
+     * <p>The default algorithm can be changed at runtime by setting
+     * the value of the {@code ssl.KeyManagerFactory.algorithm}
+     * security property to the desired algorithm name.
+     *
+     * @see java.security.Security security properties
+     * @return the default algorithm name as specified by the
+     *          {@code ssl.KeyManagerFactory.algorithm} security property, or an
+     *          implementation-specific default if no such property exists.
+     */
+    public static final String getDefaultAlgorithm() {
+        String type;
+        type = AccessController.doPrivileged(new PrivilegedAction<>() {
+            @Override
+            public String run() {
+                return Security.getProperty(
+                    "ssl.KeyManagerFactory.algorithm");
+            }
+        });
+        if (type == null) {
+            type = "SunX509";
+        }
+        return type;
+    }
+
+    /**
+     * Creates a KeyManagerFactory object.
+     *
+     * @param factorySpi the delegate
+     * @param provider the provider
+     * @param algorithm the algorithm
+     */
+    protected KeyManagerFactory(KeyManagerFactorySpi factorySpi,
+                                Provider provider, String algorithm) {
+        this.factorySpi = factorySpi;
+        this.provider = provider;
+        this.algorithm = algorithm;
+    }
+
+    /**
+     * Returns the algorithm name of this <code>KeyManagerFactory</code> object.
+     *
+     * <p>This is the same name that was specified in one of the
+     * <code>getInstance</code> calls that created this
+     * <code>KeyManagerFactory</code> object.
+     *
+     * @return the algorithm name of this <code>KeyManagerFactory</code> object.
+     */
+    public final String getAlgorithm() {
+        return this.algorithm;
+    }
+
+    /**
+     * Returns a <code>KeyManagerFactory</code> object that acts as a
+     * factory for key managers.
+     *
+     * <p> This method traverses the list of registered security Providers,
+     * starting with the most preferred Provider.
+     * A new KeyManagerFactory object encapsulating the
+     * KeyManagerFactorySpi implementation from the first
+     * Provider that supports the specified algorithm is returned.
+     *
+     * <p> Note that the list of registered providers may be retrieved via
+     * the {@link Security#getProviders() Security.getProviders()} method.
+     *
+     * @implNote
+     * The JDK Reference Implementation additionally uses the
+     * {@code jdk.security.provider.preferred}
+     * {@link Security#getProperty(String) Security} property to determine
+     * the preferred provider order for the specified algorithm. This
+     * may be different than the order of providers returned by
+     * {@link Security#getProviders() Security.getProviders()}.
+     *
+     * @param algorithm the standard name of the requested algorithm.
+     *          See the <a href=
+     *          "{@docRoot}/../specs/security/standard-names.html">
+     *          Java Security Standard Algorithm Names</a> document
+     *          for information about standard algorithm names.
+     *
+     * @return the new {@code KeyManagerFactory} object
+     *
+     * @throws NoSuchAlgorithmException if no {@code Provider} supports a
+     *         {@code KeyManagerFactorySpi} implementation for the
+     *         specified algorithm
+     *
+     * @throws NullPointerException if {@code algorithm} is {@code null}
+     *
+     * @see java.security.Provider
+     */
+    public static final KeyManagerFactory getInstance(String algorithm)
+            throws NoSuchAlgorithmException {
+        Objects.requireNonNull(algorithm, "null algorithm name");
+        GetInstance.Instance instance = GetInstance.getInstance
+                ("KeyManagerFactory", KeyManagerFactorySpi.class,
+                algorithm);
+        return new KeyManagerFactory((KeyManagerFactorySpi)instance.impl,
+                instance.provider, algorithm);
+    }
+
+    /**
+     * Returns a <code>KeyManagerFactory</code> object that acts as a
+     * factory for key managers.
+     *
+     * <p> A new KeyManagerFactory object encapsulating the
+     * KeyManagerFactorySpi implementation from the specified provider
+     * is returned.  The specified provider must be registered
+     * in the security provider list.
+     *
+     * <p> Note that the list of registered providers may be retrieved via
+     * the {@link Security#getProviders() Security.getProviders()} method.
+
+     * @param algorithm the standard name of the requested algorithm.
+     *          See the <a href=
+     *          "{@docRoot}/../specs/security/standard-names.html">
+     *          Java Security Standard Algorithm Names</a> document
+     *          for information about standard algorithm names.
+     *
+     * @param provider the name of the provider.
+     *
+     * @return the new {@code KeyManagerFactory} object
+     *
+     * @throws IllegalArgumentException if the provider name is {@code null}
+     *         or empty
+     *
+     * @throws NoSuchAlgorithmException if a {@code KeyManagerFactorySpi}
+     *         implementation for the specified algorithm is not
+     *         available from the specified provider
+     *
+     * @throws NoSuchProviderException if the specified provider is not
+     *         registered in the security provider list
+     *
+     * @throws NullPointerException if {@code algorithm} is {@code null}
+     *
+     * @see java.security.Provider
+     */
+    public static final KeyManagerFactory getInstance(String algorithm,
+            String provider) throws NoSuchAlgorithmException,
+            NoSuchProviderException {
+        Objects.requireNonNull(algorithm, "null algorithm name");
+        GetInstance.Instance instance = GetInstance.getInstance
+                ("KeyManagerFactory", KeyManagerFactorySpi.class,
+                algorithm, provider);
+        return new KeyManagerFactory((KeyManagerFactorySpi)instance.impl,
+                instance.provider, algorithm);
+    }
+
+    /**
+     * Returns a <code>KeyManagerFactory</code> object that acts as a
+     * factory for key managers.
+     *
+     * <p> A new KeyManagerFactory object encapsulating the
+     * KeyManagerFactorySpi implementation from the specified Provider
+     * object is returned.  Note that the specified Provider object
+     * does not have to be registered in the provider list.
+     *
+     * @param algorithm the standard name of the requested algorithm.
+     *          See the <a href=
+     *          "{@docRoot}/../specs/security/standard-names.html">
+     *          Java Security Standard Algorithm Names</a> document
+     *          for information about standard algorithm names.
+     *
+     * @param provider an instance of the provider.
+     *
+     * @return the new {@code KeyManagerFactory} object
+     *
+     * @throws IllegalArgumentException if provider is {@code null}
+     *
+     * @throws NoSuchAlgorithmException if a {@code @KeyManagerFactorySpi}
+     *         implementation for the specified algorithm is not available
+     *         from the specified Provider object
+     *
+     * @throws NullPointerException if {@code algorithm} is {@code null}
+     *
+     * @see java.security.Provider
+     */
+    public static final KeyManagerFactory getInstance(String algorithm,
+            Provider provider) throws NoSuchAlgorithmException {
+        Objects.requireNonNull(algorithm, "null algorithm name");
+        GetInstance.Instance instance = GetInstance.getInstance
+                ("KeyManagerFactory", KeyManagerFactorySpi.class,
+                algorithm, provider);
+        return new KeyManagerFactory((KeyManagerFactorySpi)instance.impl,
+                instance.provider, algorithm);
+    }
+
+    /**
+     * Returns the provider of this <code>KeyManagerFactory</code> object.
+     *
+     * @return the provider of this <code>KeyManagerFactory</code> object
+     */
+    public final Provider getProvider() {
+        return this.provider;
+    }
+
+
+    /**
+     * Initializes this factory with a source of key material.
+     * <P>
+     * The provider typically uses a KeyStore for obtaining
+     * key material for use during secure socket negotiations.
+     * The KeyStore is generally password-protected.
+     * <P>
+     * For more flexible initialization, please see
+     * {@link #init(ManagerFactoryParameters)}.
+     *
+     * @param ks the key store or null
+     * @param password the password for recovering keys in the KeyStore
+     * @throws KeyStoreException if this operation fails
+     * @throws NoSuchAlgorithmException if the specified algorithm is not
+     *          available from the specified provider.
+     * @throws UnrecoverableKeyException if the key cannot be recovered
+     *          (e.g. the given password is wrong).
+     */
+    public final void init(KeyStore ks, char[] password) throws
+            KeyStoreException, NoSuchAlgorithmException,
+            UnrecoverableKeyException {
+        factorySpi.engineInit(ks, password);
+    }
+
+
+    /**
+     * Initializes this factory with a source of provider-specific
+     * key material.
+     * <P>
+     * In some cases, initialization parameters other than a keystore
+     * and password may be needed by a provider.  Users of that
+     * particular provider are expected to pass an implementation of
+     * the appropriate <CODE>ManagerFactoryParameters</CODE> as
+     * defined by the provider.  The provider can then call the
+     * specified methods in the <CODE>ManagerFactoryParameters</CODE>
+     * implementation to obtain the needed information.
+     *
+     * @param spec an implementation of a provider-specific parameter
+     *          specification
+     * @throws InvalidAlgorithmParameterException if an error is encountered
+     */
+    public final void init(ManagerFactoryParameters spec) throws
+            InvalidAlgorithmParameterException {
+        factorySpi.engineInit(spec);
+    }
+
+
+    /**
+     * Returns one key manager for each type of key material.
+     *
+     * @return the key managers
+     * @throws IllegalStateException if the KeyManagerFactory is not initialized
+     */
+    public final KeyManager[] getKeyManagers() {
+        return factorySpi.engineGetKeyManagers();
+    }
+}

src/java.base/share/classes/javax/net/ssl/KeyManagerFactorySpi.java

@@ -0,0 +1,85 @@
+/*
+ * Copyright (c) 1999, 2001, Oracle and/or its affiliates. All rights reserved.
+ * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
+ *
+ * This code is free software; you can redistribute it and/or modify it
+ * under the terms of the GNU General Public License version 2 only, as
+ * published by the Free Software Foundation.  Oracle designates this
+ * particular file as subject to the "Classpath" exception as provided
+ * by Oracle in the LICENSE file that accompanied this code.
+ *
+ * This code is distributed in the hope that it will be useful, but WITHOUT
+ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
+ * FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License
+ * version 2 for more details (a copy is included in the LICENSE file that
+ * accompanied this code).
+ *
+ * You should have received a copy of the GNU General Public License version
+ * 2 along with this work; if not, write to the Free Software Foundation,
+ * Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.
+ *
+ * Please contact Oracle, 500 Oracle Parkway, Redwood Shores, CA 94065 USA
+ * or visit www.oracle.com if you need additional information or have any
+ * questions.
+ */
+
+package javax.net.ssl;
+
+import java.security.*;
+
+/**
+ * This class defines the <i>Service Provider Interface</i> (<b>SPI</b>)
+ * for the <code>KeyManagerFactory</code> class.
+ *
+ * <p> All the abstract methods in this class must be implemented by each
+ * cryptographic service provider who wishes to supply the implementation
+ * of a particular key manager factory.
+ *
+ * @since 1.4
+ * @see KeyManagerFactory
+ * @see KeyManager
+ */
+public abstract class KeyManagerFactorySpi {
+    /**
+     * Initializes this factory with a source of key material.
+     *
+     * @param ks the key store or null
+     * @param password the password for recovering keys
+     * @throws KeyStoreException if this operation fails
+     * @throws NoSuchAlgorithmException if the specified algorithm is not
+     *          available from the specified provider.
+     * @throws UnrecoverableKeyException if the key cannot be recovered
+     * @see KeyManagerFactory#init(KeyStore, char[])
+     */
+    protected abstract void engineInit(KeyStore ks, char[] password) throws
+        KeyStoreException, NoSuchAlgorithmException, UnrecoverableKeyException;
+
+    /**
+     * Initializes this factory with a source of key material.
+     * <P>
+     * In some cases, initialization parameters other than a keystore
+     * and password may be needed by a provider.  Users of that
+     * particular provider are expected to pass an implementation of
+     * the appropriate <CODE>ManagerFactoryParameters</CODE> as
+     * defined by the provider.  The provider can then call the
+     * specified methods in the ManagerFactoryParameters
+     * implementation to obtain the needed information.
+     *
+     * @param spec an implementation of a provider-specific parameter
+     *          specification
+     * @throws InvalidAlgorithmParameterException if there is problem
+     *          with the parameters
+     * @see KeyManagerFactory#init(ManagerFactoryParameters spec)
+     */
+    protected abstract void engineInit(ManagerFactoryParameters spec)
+        throws InvalidAlgorithmParameterException;
+
+    /**
+     * Returns one key manager for each type of key material.
+     *
+     * @return the key managers
+     * @throws IllegalStateException
+     *         if the KeyManagerFactorySpi is not initialized
+     */
+    protected abstract KeyManager[] engineGetKeyManagers();
+}

src/java.base/share/classes/javax/net/ssl/KeyStoreBuilderParameters.java

@@ -0,0 +1,88 @@
+/*
+ * Copyright (c) 2003, 2011, Oracle and/or its affiliates. All rights reserved.
+ * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
+ *
+ * This code is free software; you can redistribute it and/or modify it
+ * under the terms of the GNU General Public License version 2 only, as
+ * published by the Free Software Foundation.  Oracle designates this
+ * particular file as subject to the "Classpath" exception as provided
+ * by Oracle in the LICENSE file that accompanied this code.
+ *
+ * This code is distributed in the hope that it will be useful, but WITHOUT
+ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
+ * FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License
+ * version 2 for more details (a copy is included in the LICENSE file that
+ * accompanied this code).
+ *
+ * You should have received a copy of the GNU General Public License version
+ * 2 along with this work; if not, write to the Free Software Foundation,
+ * Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.
+ *
+ * Please contact Oracle, 500 Oracle Parkway, Redwood Shores, CA 94065 USA
+ * or visit www.oracle.com if you need additional information or have any
+ * questions.
+ */
+
+package javax.net.ssl;
+
+import java.util.*;
+
+import java.security.KeyStore.*;
+
+/**
+ * A parameters object for X509KeyManagers that encapsulates a List
+ * of KeyStore.Builders.
+ *
+ * @see java.security.KeyStore.Builder
+ * @see X509KeyManager
+ *
+ * @author  Andreas Sterbenz
+ * @since   1.5
+ */
+public class KeyStoreBuilderParameters implements ManagerFactoryParameters {
+
+    private final List<Builder> parameters;
+
+    /**
+     * Construct new KeyStoreBuilderParameters from the specified
+     * {@linkplain java.security.KeyStore.Builder}.
+     *
+     * @param builder the Builder object
+     * @exception NullPointerException if builder is null
+     */
+    public KeyStoreBuilderParameters(Builder builder) {
+        parameters = Collections.singletonList(Objects.requireNonNull(builder));
+    }
+
+    /**
+     * Construct new KeyStoreBuilderParameters from a List
+     * of {@linkplain java.security.KeyStore.Builder}s. Note that the list
+     * is cloned to protect against subsequent modification.
+     *
+     * @param parameters the List of Builder objects
+     * @exception NullPointerException if parameters is null
+     * @exception IllegalArgumentException if parameters is an empty list
+     */
+    public KeyStoreBuilderParameters(List<Builder> parameters) {
+        if (parameters.isEmpty()) {
+            throw new IllegalArgumentException();
+        }
+
+        this.parameters = Collections.unmodifiableList(
+            new ArrayList<Builder>(parameters));
+    }
+
+    /**
+     * Return the unmodifiable List of the
+     * {@linkplain java.security.KeyStore.Builder}s
+     * encapsulated by this object.
+     *
+     * @return the unmodifiable List of the
+     * {@linkplain java.security.KeyStore.Builder}s
+     * encapsulated by this object.
+     */
+    public List<Builder> getParameters() {
+        return parameters;
+    }
+
+}

src/java.base/share/classes/javax/net/ssl/ManagerFactoryParameters.java

@@ -0,0 +1,46 @@
+/*
+ * Copyright (c) 2001, Oracle and/or its affiliates. All rights reserved.
+ * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
+ *
+ * This code is free software; you can redistribute it and/or modify it
+ * under the terms of the GNU General Public License version 2 only, as
+ * published by the Free Software Foundation.  Oracle designates this
+ * particular file as subject to the "Classpath" exception as provided
+ * by Oracle in the LICENSE file that accompanied this code.
+ *
+ * This code is distributed in the hope that it will be useful, but WITHOUT
+ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
+ * FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License
+ * version 2 for more details (a copy is included in the LICENSE file that
+ * accompanied this code).
+ *
+ * You should have received a copy of the GNU General Public License version
+ * 2 along with this work; if not, write to the Free Software Foundation,
+ * Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.
+ *
+ * Please contact Oracle, 500 Oracle Parkway, Redwood Shores, CA 94065 USA
+ * or visit www.oracle.com if you need additional information or have any
+ * questions.
+ */
+
+package javax.net.ssl;
+
+/**
+ * This class is the base interface for providing
+ * algorithm-specific information to a KeyManagerFactory or
+ * TrustManagerFactory.
+ * <P>
+ * In some cases, initialization parameters other than keystores
+ * may be needed by a provider.  Users of that particular provider
+ * are expected to pass an implementation of the appropriate
+ * sub-interface of this class as defined by the
+ * provider.  The provider can then call the specified methods in
+ * the <CODE>ManagerFactoryParameters</CODE> implementation to obtain the
+ * needed information.
+ *
+ * @author Brad R. Wetmore
+ * @since 1.4
+ */
+
+public interface ManagerFactoryParameters {
+}

src/java.base/share/classes/javax/net/ssl/SNIHostName.java

@@ -0,0 +1,396 @@
+/*
+ * Copyright (c) 2012, 2013, Oracle and/or its affiliates. All rights reserved.
+ * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
+ *
+ * This code is free software; you can redistribute it and/or modify it
+ * under the terms of the GNU General Public License version 2 only, as
+ * published by the Free Software Foundation.  Oracle designates this
+ * particular file as subject to the "Classpath" exception as provided
+ * by Oracle in the LICENSE file that accompanied this code.
+ *
+ * This code is distributed in the hope that it will be useful, but WITHOUT
+ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
+ * FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License
+ * version 2 for more details (a copy is included in the LICENSE file that
+ * accompanied this code).
+ *
+ * You should have received a copy of the GNU General Public License version
+ * 2 along with this work; if not, write to the Free Software Foundation,
+ * Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.
+ *
+ * Please contact Oracle, 500 Oracle Parkway, Redwood Shores, CA 94065 USA
+ * or visit www.oracle.com if you need additional information or have any
+ * questions.
+ */
+
+package javax.net.ssl;
+
+import java.net.IDN;
+import java.nio.ByteBuffer;
+import java.nio.charset.CodingErrorAction;
+import java.nio.charset.StandardCharsets;
+import java.nio.charset.CharsetDecoder;
+import java.nio.charset.CharacterCodingException;
+import java.util.Locale;
+import java.util.Objects;
+import java.util.regex.Pattern;
+
+/**
+ * Instances of this class represent a server name of type
+ * {@link StandardConstants#SNI_HOST_NAME host_name} in a Server Name
+ * Indication (SNI) extension.
+ * <P>
+ * As described in section 3, "Server Name Indication", of
+ * <A HREF="http://www.ietf.org/rfc/rfc6066.txt">TLS Extensions (RFC 6066)</A>,
+ * "HostName" contains the fully qualified DNS hostname of the server, as
+ * understood by the client.  The encoded server name value of a hostname is
+ * represented as a byte string using ASCII encoding without a trailing dot.
+ * This allows the support of Internationalized Domain Names (IDN) through
+ * the use of A-labels (the ASCII-Compatible Encoding (ACE) form of a valid
+ * string of Internationalized Domain Names for Applications (IDNA)) defined
+ * in <A HREF="http://www.ietf.org/rfc/rfc5890.txt">RFC 5890</A>.
+ * <P>
+ * Note that {@code SNIHostName} objects are immutable.
+ *
+ * @see SNIServerName
+ * @see StandardConstants#SNI_HOST_NAME
+ *
+ * @since 1.8
+ */
+public final class SNIHostName extends SNIServerName {
+
+    // the decoded string value of the server name
+    private final String hostname;
+
+    /**
+     * Creates an {@code SNIHostName} using the specified hostname.
+     * <P>
+     * Note that per <A HREF="http://www.ietf.org/rfc/rfc6066.txt">RFC 6066</A>,
+     * the encoded server name value of a hostname is
+     * {@link StandardCharsets#US_ASCII}-compliant.  In this method,
+     * {@code hostname} can be a user-friendly Internationalized Domain Name
+     * (IDN).  {@link IDN#toASCII(String, int)} is used to enforce the
+     * restrictions on ASCII characters in hostnames (see
+     * <A HREF="http://www.ietf.org/rfc/rfc3490.txt">RFC 3490</A>,
+     * <A HREF="http://www.ietf.org/rfc/rfc1122.txt">RFC 1122</A>,
+     * <A HREF="http://www.ietf.org/rfc/rfc1123.txt">RFC 1123</A>) and
+     * translate the {@code hostname} into ASCII Compatible Encoding (ACE), as:
+     * <pre>
+     *     IDN.toASCII(hostname, IDN.USE_STD3_ASCII_RULES);
+     * </pre>
+     * <P>
+     * The {@code hostname} argument is illegal if it:
+     * <ul>
+     * <li> {@code hostname} is empty,</li>
+     * <li> {@code hostname} ends with a trailing dot,</li>
+     * <li> {@code hostname} is not a valid Internationalized
+     *      Domain Name (IDN) compliant with the RFC 3490 specification.</li>
+     * </ul>
+     * @param  hostname
+     *         the hostname of this server name
+     *
+     * @throws NullPointerException if {@code hostname} is {@code null}
+     * @throws IllegalArgumentException if {@code hostname} is illegal
+     */
+    public SNIHostName(String hostname) {
+        // IllegalArgumentException will be thrown if {@code hostname} is
+        // not a valid IDN.
+        super(StandardConstants.SNI_HOST_NAME,
+                (hostname = IDN.toASCII(
+                    Objects.requireNonNull(hostname,
+                        "Server name value of host_name cannot be null"),
+                    IDN.USE_STD3_ASCII_RULES))
+                .getBytes(StandardCharsets.US_ASCII));
+
+        this.hostname = hostname;
+
+        // check the validity of the string hostname
+        checkHostName();
+    }
+
+    /**
+     * Creates an {@code SNIHostName} using the specified encoded value.
+     * <P>
+     * This method is normally used to parse the encoded name value in a
+     * requested SNI extension.
+     * <P>
+     * Per <A HREF="http://www.ietf.org/rfc/rfc6066.txt">RFC 6066</A>,
+     * the encoded name value of a hostname is
+     * {@link StandardCharsets#US_ASCII}-compliant.  However, in the previous
+     * version of the SNI extension (
+     * <A HREF="http://www.ietf.org/rfc/rfc4366.txt">RFC 4366</A>),
+     * the encoded hostname is represented as a byte string using UTF-8
+     * encoding.  For the purpose of version tolerance, this method allows
+     * that the charset of {@code encoded} argument can be
+     * {@link StandardCharsets#UTF_8}, as well as
+     * {@link StandardCharsets#US_ASCII}.  {@link IDN#toASCII(String)} is used
+     * to translate the {@code encoded} argument into ASCII Compatible
+     * Encoding (ACE) hostname.
+     * <P>
+     * It is strongly recommended that this constructor is only used to parse
+     * the encoded name value in a requested SNI extension.  Otherwise, to
+     * comply with <A HREF="http://www.ietf.org/rfc/rfc6066.txt">RFC 6066</A>,
+     * please always use {@link StandardCharsets#US_ASCII}-compliant charset
+     * and enforce the restrictions on ASCII characters in hostnames (see
+     * <A HREF="http://www.ietf.org/rfc/rfc3490.txt">RFC 3490</A>,
+     * <A HREF="http://www.ietf.org/rfc/rfc1122.txt">RFC 1122</A>,
+     * <A HREF="http://www.ietf.org/rfc/rfc1123.txt">RFC 1123</A>)
+     * for {@code encoded} argument, or use
+     * {@link SNIHostName#SNIHostName(String)} instead.
+     * <P>
+     * The {@code encoded} argument is illegal if it:
+     * <ul>
+     * <li> {@code encoded} is empty,</li>
+     * <li> {@code encoded} ends with a trailing dot,</li>
+     * <li> {@code encoded} is not encoded in
+     *      {@link StandardCharsets#US_ASCII} or
+     *      {@link StandardCharsets#UTF_8}-compliant charset,</li>
+     * <li> {@code encoded} is not a valid Internationalized
+     *      Domain Name (IDN) compliant with the RFC 3490 specification.</li>
+     * </ul>
+     *
+     * <P>
+     * Note that the {@code encoded} byte array is cloned
+     * to protect against subsequent modification.
+     *
+     * @param  encoded
+     *         the encoded hostname of this server name
+     *
+     * @throws NullPointerException if {@code encoded} is {@code null}
+     * @throws IllegalArgumentException if {@code encoded} is illegal
+     */
+    public SNIHostName(byte[] encoded) {
+        // NullPointerException will be thrown if {@code encoded} is null
+        super(StandardConstants.SNI_HOST_NAME, encoded);
+
+        // Compliance: RFC 4366 requires that the hostname is represented
+        // as a byte string using UTF_8 encoding [UTF8]
+        try {
+            // Please don't use {@link String} constructors because they
+            // do not report coding errors.
+            CharsetDecoder decoder = StandardCharsets.UTF_8.newDecoder()
+                    .onMalformedInput(CodingErrorAction.REPORT)
+                    .onUnmappableCharacter(CodingErrorAction.REPORT);
+
+            this.hostname = IDN.toASCII(
+                    decoder.decode(ByteBuffer.wrap(encoded)).toString());
+        } catch (RuntimeException | CharacterCodingException e) {
+            throw new IllegalArgumentException(
+                        "The encoded server name value is invalid", e);
+        }
+
+        // check the validity of the string hostname
+        checkHostName();
+    }
+
+    /**
+     * Returns the {@link StandardCharsets#US_ASCII}-compliant hostname of
+     * this {@code SNIHostName} object.
+     * <P>
+     * Note that, per
+     * <A HREF="http://www.ietf.org/rfc/rfc6066.txt">RFC 6066</A>, the
+     * returned hostname may be an internationalized domain name that
+     * contains A-labels. See
+     * <A HREF="http://www.ietf.org/rfc/rfc5890.txt">RFC 5890</A>
+     * for more information about the detailed A-label specification.
+     *
+     * @return the {@link StandardCharsets#US_ASCII}-compliant hostname
+     *         of this {@code SNIHostName} object
+     */
+    public String getAsciiName() {
+        return hostname;
+    }
+
+    /**
+     * Compares this server name to the specified object.
+     * <P>
+     * Per <A HREF="http://www.ietf.org/rfc/rfc6066.txt">RFC 6066</A>, DNS
+     * hostnames are case-insensitive.  Two server hostnames are equal if,
+     * and only if, they have the same name type, and the hostnames are
+     * equal in a case-independent comparison.
+     *
+     * @param  other
+     *         the other server name object to compare with.
+     * @return true if, and only if, the {@code other} is considered
+     *         equal to this instance
+     */
+    @Override
+    public boolean equals(Object other) {
+        if (this == other) {
+            return true;
+        }
+
+        if (other instanceof SNIHostName) {
+            return hostname.equalsIgnoreCase(((SNIHostName)other).hostname);
+        }
+
+        return false;
+    }
+
+    /**
+     * Returns a hash code value for this {@code SNIHostName}.
+     * <P>
+     * The hash code value is generated using the case-insensitive hostname
+     * of this {@code SNIHostName}.
+     *
+     * @return a hash code value for this {@code SNIHostName}.
+     */
+    @Override
+    public int hashCode() {
+        int result = 17;        // 17/31: prime number to decrease collisions
+        result = 31 * result + hostname.toUpperCase(Locale.ENGLISH).hashCode();
+
+        return result;
+    }
+
+    /**
+     * Returns a string representation of the object, including the DNS
+     * hostname in this {@code SNIHostName} object.
+     * <P>
+     * The exact details of the representation are unspecified and subject
+     * to change, but the following may be regarded as typical:
+     * <pre>
+     *     "type=host_name (0), value={@literal <hostname>}"
+     * </pre>
+     * The "{@literal <hostname>}" is an ASCII representation of the hostname,
+     * which may contains A-labels.  For example, a returned value of an pseudo
+     * hostname may look like:
+     * <pre>
+     *     "type=host_name (0), value=www.example.com"
+     * </pre>
+     * or
+     * <pre>
+     *     "type=host_name (0), value=xn--fsqu00a.xn--0zwm56d"
+     * </pre>
+     * <P>
+     * Please NOTE that the exact details of the representation are unspecified
+     * and subject to change.
+     *
+     * @return a string representation of the object.
+     */
+    @Override
+    public String toString() {
+        return "type=host_name (0), value=" + hostname;
+    }
+
+    /**
+     * Creates an {@link SNIMatcher} object for {@code SNIHostName}s.
+     * <P>
+     * This method can be used by a server to verify the acceptable
+     * {@code SNIHostName}s.  For example,
+     * <pre>
+     *     SNIMatcher matcher =
+     *         SNIHostName.createSNIMatcher("www\\.example\\.com");
+     * </pre>
+     * will accept the hostname "www.example.com".
+     * <pre>
+     *     SNIMatcher matcher =
+     *         SNIHostName.createSNIMatcher("www\\.example\\.(com|org)");
+     * </pre>
+     * will accept hostnames "www.example.com" and "www.example.org".
+     *
+     * @param  regex
+     *         the <a href="{@docRoot}/java/util/regex/Pattern.html#sum">
+     *         regular expression pattern</a>
+     *         representing the hostname(s) to match
+     * @return a {@code SNIMatcher} object for {@code SNIHostName}s
+     * @throws NullPointerException if {@code regex} is
+     *         {@code null}
+     * @throws java.util.regex.PatternSyntaxException if the regular expression's
+     *         syntax is invalid
+     */
+    public static SNIMatcher createSNIMatcher(String regex) {
+        if (regex == null) {
+            throw new NullPointerException(
+                "The regular expression cannot be null");
+        }
+
+        return new SNIHostNameMatcher(regex);
+    }
+
+    // check the validity of the string hostname
+    private void checkHostName() {
+        if (hostname.isEmpty()) {
+            throw new IllegalArgumentException(
+                "Server name value of host_name cannot be empty");
+        }
+
+        if (hostname.endsWith(".")) {
+            throw new IllegalArgumentException(
+                "Server name value of host_name cannot have the trailing dot");
+        }
+    }
+
+    private static final class SNIHostNameMatcher extends SNIMatcher {
+
+        // the compiled representation of a regular expression.
+        private final Pattern pattern;
+
+        /**
+         * Creates an SNIHostNameMatcher object.
+         *
+         * @param  regex
+         *         the <a href="{@docRoot}/java/util/regex/Pattern.html#sum">
+         *         regular expression pattern</a>
+         *         representing the hostname(s) to match
+         * @throws NullPointerException if {@code regex} is
+         *         {@code null}
+         * @throws PatternSyntaxException if the regular expression's syntax
+         *         is invalid
+         */
+        SNIHostNameMatcher(String regex) {
+            super(StandardConstants.SNI_HOST_NAME);
+            pattern = Pattern.compile(regex, Pattern.CASE_INSENSITIVE);
+        }
+
+        /**
+         * Attempts to match the given {@link SNIServerName}.
+         *
+         * @param  serverName
+         *         the {@link SNIServerName} instance on which this matcher
+         *         performs match operations
+         *
+         * @return {@code true} if, and only if, the matcher matches the
+         *         given {@code serverName}
+         *
+         * @throws NullPointerException if {@code serverName} is {@code null}
+         * @throws IllegalArgumentException if {@code serverName} is
+         *         not of {@code StandardConstants#SNI_HOST_NAME} type
+         *
+         * @see SNIServerName
+         */
+        @Override
+        public boolean matches(SNIServerName serverName) {
+            if (serverName == null) {
+                throw new NullPointerException(
+                    "The SNIServerName argument cannot be null");
+            }
+
+            SNIHostName hostname;
+            if (!(serverName instanceof SNIHostName)) {
+                if (serverName.getType() != StandardConstants.SNI_HOST_NAME) {
+                    throw new IllegalArgumentException(
+                        "The server name type is not host_name");
+                }
+
+                try {
+                    hostname = new SNIHostName(serverName.getEncoded());
+                } catch (NullPointerException | IllegalArgumentException e) {
+                    return false;
+                }
+            } else {
+                hostname = (SNIHostName)serverName;
+            }
+
+            // Let's first try the ascii name matching
+            String asciiName = hostname.getAsciiName();
+            if (pattern.matcher(asciiName).matches()) {
+                return true;
+            }
+
+            // May be an internationalized domain name, check the Unicode
+            // representations.
+            return pattern.matcher(IDN.toUnicode(asciiName)).matches();
+        }
+    }
+}

src/java.base/share/classes/javax/net/ssl/SNIMatcher.java

@@ -0,0 +1,105 @@
+/*
+ * Copyright (c) 2012, Oracle and/or its affiliates. All rights reserved.
+ * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
+ *
+ * This code is free software; you can redistribute it and/or modify it
+ * under the terms of the GNU General Public License version 2 only, as
+ * published by the Free Software Foundation.  Oracle designates this
+ * particular file as subject to the "Classpath" exception as provided
+ * by Oracle in the LICENSE file that accompanied this code.
+ *
+ * This code is distributed in the hope that it will be useful, but WITHOUT
+ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
+ * FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License
+ * version 2 for more details (a copy is included in the LICENSE file that
+ * accompanied this code).
+ *
+ * You should have received a copy of the GNU General Public License version
+ * 2 along with this work; if not, write to the Free Software Foundation,
+ * Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.
+ *
+ * Please contact Oracle, 500 Oracle Parkway, Redwood Shores, CA 94065 USA
+ * or visit www.oracle.com if you need additional information or have any
+ * questions.
+ */
+
+package javax.net.ssl;
+
+/**
+ * Instances of this class represent a matcher that performs match
+ * operations on an {@link SNIServerName} instance.
+ * <P>
+ * Servers can use Server Name Indication (SNI) information to decide if
+ * specific {@link SSLSocket} or {@link SSLEngine} instances should accept
+ * a connection.  For example, when multiple "virtual" or "name-based"
+ * servers are hosted on a single underlying network address, the server
+ * application can use SNI information to determine whether this server is
+ * the exact server that the client wants to access.  Instances of this
+ * class can be used by a server to verify the acceptable server names of
+ * a particular type, such as host names.
+ * <P>
+ * {@code SNIMatcher} objects are immutable.  Subclasses should not provide
+ * methods that can change the state of an instance once it has been created.
+ *
+ * @see SNIServerName
+ * @see SNIHostName
+ * @see SSLParameters#getSNIMatchers()
+ * @see SSLParameters#setSNIMatchers(Collection)
+ *
+ * @since 1.8
+ */
+public abstract class SNIMatcher {
+
+    // the type of the server name that this matcher performs on
+    private final int type;
+
+    /**
+     * Creates an {@code SNIMatcher} using the specified server name type.
+     *
+     * @param  type
+     *         the type of the server name that this matcher performs on
+     *
+     * @throws IllegalArgumentException if {@code type} is not in the range
+     *         of 0 to 255, inclusive.
+     */
+    protected SNIMatcher(int type) {
+        if (type < 0) {
+            throw new IllegalArgumentException(
+                "Server name type cannot be less than zero");
+        } else if (type > 255) {
+            throw new IllegalArgumentException(
+                "Server name type cannot be greater than 255");
+        }
+
+        this.type = type;
+    }
+
+    /**
+     * Returns the server name type of this {@code SNIMatcher} object.
+     *
+     * @return the server name type of this {@code SNIMatcher} object.
+     *
+     * @see SNIServerName
+     */
+    public final int getType() {
+        return type;
+    }
+
+    /**
+     * Attempts to match the given {@link SNIServerName}.
+     *
+     * @param  serverName
+     *         the {@link SNIServerName} instance on which this matcher
+     *         performs match operations
+     *
+     * @return {@code true} if, and only if, the matcher matches the
+     *         given {@code serverName}
+     *
+     * @throws NullPointerException if {@code serverName} is {@code null}
+     * @throws IllegalArgumentException if {@code serverName} is
+     *         not of the given server name type of this matcher
+     *
+     * @see SNIServerName
+     */
+    public abstract boolean matches(SNIServerName serverName);
+}

src/java.base/share/classes/javax/net/ssl/SNIServerName.java

@@ -0,0 +1,213 @@
+/*
+ * Copyright (c) 2012, 2015, Oracle and/or its affiliates. All rights reserved.
+ * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
+ *
+ * This code is free software; you can redistribute it and/or modify it
+ * under the terms of the GNU General Public License version 2 only, as
+ * published by the Free Software Foundation.  Oracle designates this
+ * particular file as subject to the "Classpath" exception as provided
+ * by Oracle in the LICENSE file that accompanied this code.
+ *
+ * This code is distributed in the hope that it will be useful, but WITHOUT
+ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
+ * FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License
+ * version 2 for more details (a copy is included in the LICENSE file that
+ * accompanied this code).
+ *
+ * You should have received a copy of the GNU General Public License version
+ * 2 along with this work; if not, write to the Free Software Foundation,
+ * Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.
+ *
+ * Please contact Oracle, 500 Oracle Parkway, Redwood Shores, CA 94065 USA
+ * or visit www.oracle.com if you need additional information or have any
+ * questions.
+ */
+
+package javax.net.ssl;
+
+import java.util.Arrays;
+
+/**
+ * Instances of this class represent a server name in a Server Name
+ * Indication (SNI) extension.
+ * <P>
+ * The SNI extension is a feature that extends the SSL/TLS/DTLS protocols to
+ * indicate what server name the client is attempting to connect to during
+ * handshaking.  See section 3, "Server Name Indication", of <A
+ * HREF="http://www.ietf.org/rfc/rfc6066.txt">TLS Extensions (RFC 6066)</A>.
+ * <P>
+ * {@code SNIServerName} objects are immutable.  Subclasses should not provide
+ * methods that can change the state of an instance once it has been created.
+ *
+ * @see SSLParameters#getServerNames()
+ * @see SSLParameters#setServerNames(List)
+ *
+ * @since 1.8
+ */
+public abstract class SNIServerName {
+
+    // the type of the server name
+    private final int type;
+
+    // the encoded value of the server name
+    private final byte[] encoded;
+
+    // the hex digitals
+    private static final char[] HEXES = "0123456789ABCDEF".toCharArray();
+
+    /**
+     * Creates an {@code SNIServerName} using the specified name type and
+     * encoded value.
+     * <P>
+     * Note that the {@code encoded} byte array is cloned to protect against
+     * subsequent modification.
+     *
+     * @param  type
+     *         the type of the server name
+     * @param  encoded
+     *         the encoded value of the server name
+     *
+     * @throws IllegalArgumentException if {@code type} is not in the range
+     *         of 0 to 255, inclusive.
+     * @throws NullPointerException if {@code encoded} is null
+     */
+    protected SNIServerName(int type, byte[] encoded) {
+        if (type < 0) {
+            throw new IllegalArgumentException(
+                "Server name type cannot be less than zero");
+        } else if (type > 255) {
+            throw new IllegalArgumentException(
+                "Server name type cannot be greater than 255");
+        }
+        this.type = type;
+
+        if (encoded == null) {
+            throw new NullPointerException(
+                "Server name encoded value cannot be null");
+        }
+        this.encoded = encoded.clone();
+    }
+
+
+    /**
+     * Returns the name type of this server name.
+     *
+     * @return the name type of this server name
+     */
+    public final int getType() {
+        return type;
+    }
+
+    /**
+     * Returns a copy of the encoded server name value of this server name.
+     *
+     * @return a copy of the encoded server name value of this server name
+     */
+    public final byte[] getEncoded() {
+        return encoded.clone();
+    }
+
+    /**
+     * Indicates whether some other object is "equal to" this server name.
+     *
+     * @return true if, and only if, {@code other} is of the same class
+     *         of this object, and has the same name type and
+     *         encoded value as this server name.
+     */
+    @Override
+    public boolean equals(Object other) {
+        if (this == other) {
+            return true;
+        }
+
+        if (this.getClass() != other.getClass()) {
+            return false;
+        }
+
+        SNIServerName that = (SNIServerName)other;
+        return (this.type == that.type) &&
+                    Arrays.equals(this.encoded, that.encoded);
+    }
+
+    /**
+     * Returns a hash code value for this server name.
+     * <P>
+     * The hash code value is generated using the name type and encoded
+     * value of this server name.
+     *
+     * @return a hash code value for this server name.
+     */
+    @Override
+    public int hashCode() {
+        int result = 17;    // 17/31: prime number to decrease collisions
+        result = 31 * result + type;
+        result = 31 * result + Arrays.hashCode(encoded);
+
+        return result;
+    }
+
+    /**
+     * Returns a string representation of this server name, including the server
+     * name type and the encoded server name value in this
+     * {@code SNIServerName} object.
+     * <P>
+     * The exact details of the representation are unspecified and subject
+     * to change, but the following may be regarded as typical:
+     * <pre>
+     *     "type={@literal <name type>}, value={@literal <name value>}"
+     * </pre>
+     * <P>
+     * In this class, the format of "{@literal <name type>}" is
+     * "[LITERAL] (INTEGER)", where the optional "LITERAL" is the literal
+     * name, and INTEGER is the integer value of the name type.  The format
+     * of "{@literal <name value>}" is "XX:...:XX", where "XX" is the
+     * hexadecimal digit representation of a byte value. For example, a
+     * returned value of an pseudo server name may look like:
+     * <pre>
+     *     "type=(31), value=77:77:77:2E:65:78:61:6D:70:6C:65:2E:63:6E"
+     * </pre>
+     * or
+     * <pre>
+     *     "type=host_name (0), value=77:77:77:2E:65:78:61:6D:70:6C:65:2E:63:6E"
+     * </pre>
+     *
+     * <P>
+     * Please NOTE that the exact details of the representation are unspecified
+     * and subject to change, and subclasses may override the method with
+     * their own formats.
+     *
+     * @return a string representation of this server name
+     */
+    @Override
+    public String toString() {
+        if (type == StandardConstants.SNI_HOST_NAME) {
+            return "type=host_name (0), value=" + toHexString(encoded);
+        } else {
+            return "type=(" + type + "), value=" + toHexString(encoded);
+        }
+    }
+
+    // convert byte array to hex string
+    private static String toHexString(byte[] bytes) {
+        if (bytes.length == 0) {
+            return "(empty)";
+        }
+
+        StringBuilder sb = new StringBuilder(bytes.length * 3 - 1);
+        boolean isInitial = true;
+        for (byte b : bytes) {
+            if (isInitial) {
+                isInitial = false;
+            } else {
+                sb.append(':');
+            }
+
+            int k = b & 0xFF;
+            sb.append(HEXES[k >>> 4]);
+            sb.append(HEXES[k & 0xF]);
+        }
+
+        return sb.toString();
+    }
+}
+

src/java.base/share/classes/javax/net/ssl/SSLContext.java

@@ -0,0 +1,458 @@
+/*
+ * Copyright (c) 1999, 2017, Oracle and/or its affiliates. All rights reserved.
+ * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
+ *
+ * This code is free software; you can redistribute it and/or modify it
+ * under the terms of the GNU General Public License version 2 only, as
+ * published by the Free Software Foundation.  Oracle designates this
+ * particular file as subject to the "Classpath" exception as provided
+ * by Oracle in the LICENSE file that accompanied this code.
+ *
+ * This code is distributed in the hope that it will be useful, but WITHOUT
+ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
+ * FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License
+ * version 2 for more details (a copy is included in the LICENSE file that
+ * accompanied this code).
+ *
+ * You should have received a copy of the GNU General Public License version
+ * 2 along with this work; if not, write to the Free Software Foundation,
+ * Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.
+ *
+ * Please contact Oracle, 500 Oracle Parkway, Redwood Shores, CA 94065 USA
+ * or visit www.oracle.com if you need additional information or have any
+ * questions.
+ */
+
+package javax.net.ssl;
+
+import java.security.*;
+import java.util.Objects;
+
+import sun.security.jca.GetInstance;
+
+/**
+ * Instances of this class represent a secure socket protocol
+ * implementation which acts as a factory for secure socket
+ * factories or {@code SSLEngine}s. This class is initialized
+ * with an optional set of key and trust managers and source of
+ * secure random bytes.
+ *
+ * <p> Every implementation of the Java platform is required to support the
+ * following standard {@code SSLContext} protocols:
+ * <ul>
+ * <li>{@code TLSv1}</li>
+ * <li>{@code TLSv1.1}</li>
+ * <li>{@code TLSv1.2}</li>
+ * </ul>
+ * These protocols are described in the <a href=
+ * "{@docRoot}/../specs/security/standard-names.html#sslcontext-algorithms">
+ * SSLContext section</a> of the
+ * Java Security Standard Algorithm Names Specification.
+ * Consult the release documentation for your implementation to see if any
+ * other algorithms are supported.
+ *
+ * @since 1.4
+ */
+public class SSLContext {
+    private final Provider provider;
+
+    private final SSLContextSpi contextSpi;
+
+    private final String protocol;
+
+    /**
+     * Creates an SSLContext object.
+     *
+     * @param contextSpi the delegate
+     * @param provider the provider
+     * @param protocol the protocol
+     */
+    protected SSLContext(SSLContextSpi contextSpi, Provider provider,
+            String protocol) {
+        this.contextSpi = contextSpi;
+        this.provider = provider;
+        this.protocol = protocol;
+    }
+
+    private static SSLContext defaultContext;
+
+    /**
+     * Returns the default SSL context.
+     *
+     * <p>If a default context was set using the {@link #setDefault
+     * SSLContext.setDefault()} method, it is returned. Otherwise, the first
+     * call of this method triggers the call
+     * {@code SSLContext.getInstance("Default")}.
+     * If successful, that object is made the default SSL context and returned.
+     *
+     * <p>The default context is immediately
+     * usable and does not require {@linkplain #init initialization}.
+     *
+     * @return the default SSL context
+     * @throws NoSuchAlgorithmException if the
+     *   {@link SSLContext#getInstance SSLContext.getInstance()} call fails
+     * @since 1.6
+     */
+    public static synchronized SSLContext getDefault()
+            throws NoSuchAlgorithmException {
+        if (defaultContext == null) {
+            defaultContext = SSLContext.getInstance("Default");
+        }
+        return defaultContext;
+    }
+
+    /**
+     * Sets the default SSL context. It will be returned by subsequent calls
+     * to {@link #getDefault}. The default context must be immediately usable
+     * and not require {@linkplain #init initialization}.
+     *
+     * @param context the SSLContext
+     * @throws  NullPointerException if context is null
+     * @throws  SecurityException if a security manager exists and its
+     *          {@code checkPermission} method does not allow
+     *          {@code SSLPermission("setDefaultSSLContext")}
+     * @since 1.6
+     */
+    public static synchronized void setDefault(SSLContext context) {
+        if (context == null) {
+            throw new NullPointerException();
+        }
+        SecurityManager sm = System.getSecurityManager();
+        if (sm != null) {
+            sm.checkPermission(new SSLPermission("setDefaultSSLContext"));
+        }
+        defaultContext = context;
+    }
+
+    /**
+     * Returns a {@code SSLContext} object that implements the
+     * specified secure socket protocol.
+     *
+     * <p> This method traverses the list of registered security Providers,
+     * starting with the most preferred Provider.
+     * A new SSLContext object encapsulating the
+     * SSLContextSpi implementation from the first
+     * Provider that supports the specified protocol is returned.
+     *
+     * <p> Note that the list of registered providers may be retrieved via
+     * the {@link Security#getProviders() Security.getProviders()} method.
+     *
+     * @implNote
+     * The JDK Reference Implementation additionally uses the
+     * {@code jdk.security.provider.preferred}
+     * {@link Security#getProperty(String) Security} property to determine
+     * the preferred provider order for the specified algorithm. This
+     * may be different than the order of providers returned by
+     * {@link Security#getProviders() Security.getProviders()}.
+     *
+     * @param protocol the standard name of the requested protocol.
+     *          See the SSLContext section in the <a href=
+     * "{@docRoot}/../specs/security/standard-names.html#sslcontext-algorithms">
+     *          Java Security Standard Algorithm Names Specification</a>
+     *          for information about standard protocol names.
+     *
+     * @return the new {@code SSLContext} object
+     *
+     * @throws NoSuchAlgorithmException if no {@code Provider} supports a
+     *         {@code SSLContextSpi} implementation for the
+     *         specified protocol
+     *
+     * @throws NullPointerException if {@code protocol} is {@code null}
+     *
+     * @see java.security.Provider
+     */
+    public static SSLContext getInstance(String protocol)
+            throws NoSuchAlgorithmException {
+        Objects.requireNonNull(protocol, "null protocol name");
+        GetInstance.Instance instance = GetInstance.getInstance
+                ("SSLContext", SSLContextSpi.class, protocol);
+        return new SSLContext((SSLContextSpi)instance.impl, instance.provider,
+                protocol);
+    }
+
+    /**
+     * Returns a {@code SSLContext} object that implements the
+     * specified secure socket protocol.
+     *
+     * <p> A new SSLContext object encapsulating the
+     * SSLContextSpi implementation from the specified provider
+     * is returned.  The specified provider must be registered
+     * in the security provider list.
+     *
+     * <p> Note that the list of registered providers may be retrieved via
+     * the {@link Security#getProviders() Security.getProviders()} method.
+     *
+     * @param protocol the standard name of the requested protocol.
+     *          See the SSLContext section in the <a href=
+     * "{@docRoot}/../specs/security/standard-names.html#sslcontext-algorithms">
+     *          Java Security Standard Algorithm Names Specification</a>
+     *          for information about standard protocol names.
+     *
+     * @param provider the name of the provider.
+     *
+     * @return the new {@code SSLContext} object
+     *
+     * @throws IllegalArgumentException if the provider name is
+     *         {@code null} or empty
+     *
+     * @throws NoSuchAlgorithmException if a {@code SSLContextSpi}
+     *         implementation for the specified protocol is not
+     *         available from the specified provider
+     *
+     * @throws NoSuchProviderException if the specified provider is not
+     *         registered in the security provider list
+     *
+     * @throws NullPointerException if {@code protocol} is {@code null}
+     *
+     * @see java.security.Provider
+     */
+    public static SSLContext getInstance(String protocol, String provider)
+            throws NoSuchAlgorithmException, NoSuchProviderException {
+        Objects.requireNonNull(protocol, "null protocol name");
+        GetInstance.Instance instance = GetInstance.getInstance
+                ("SSLContext", SSLContextSpi.class, protocol, provider);
+        return new SSLContext((SSLContextSpi)instance.impl, instance.provider,
+                protocol);
+    }
+
+    /**
+     * Returns a {@code SSLContext} object that implements the
+     * specified secure socket protocol.
+     *
+     * <p> A new SSLContext object encapsulating the
+     * SSLContextSpi implementation from the specified Provider
+     * object is returned.  Note that the specified Provider object
+     * does not have to be registered in the provider list.
+     *
+     * @param protocol the standard name of the requested protocol.
+     *          See the SSLContext section in the <a href=
+     * "{@docRoot}/../specs/security/standard-names.html#sslcontext-algorithms">
+     *          Java Security Standard Algorithm Names Specification</a>
+     *          for information about standard protocol names.
+     *
+     * @param provider an instance of the provider.
+     *
+     * @return the new {@code SSLContext} object
+     *
+     * @throws IllegalArgumentException if the provider is {@code null}
+     *
+     * @throws NoSuchAlgorithmException if a {@code SSLContextSpi}
+     *         implementation for the specified protocol is not available
+     *         from the specified {@code Provider} object
+     *
+     * @throws NullPointerException if {@code protocol} is {@code null}
+     *
+     * @see java.security.Provider
+     */
+    public static SSLContext getInstance(String protocol, Provider provider)
+            throws NoSuchAlgorithmException {
+        Objects.requireNonNull(protocol, "null protocol name");
+        GetInstance.Instance instance = GetInstance.getInstance
+                ("SSLContext", SSLContextSpi.class, protocol, provider);
+        return new SSLContext((SSLContextSpi)instance.impl, instance.provider,
+                protocol);
+    }
+
+    /**
+     * Returns the protocol name of this {@code SSLContext} object.
+     *
+     * <p>This is the same name that was specified in one of the
+     * {@code getInstance} calls that created this
+     * {@code SSLContext} object.
+     *
+     * @return the protocol name of this {@code SSLContext} object.
+     */
+    public final String getProtocol() {
+        return this.protocol;
+    }
+
+    /**
+     * Returns the provider of this {@code SSLContext} object.
+     *
+     * @return the provider of this {@code SSLContext} object
+     */
+    public final Provider getProvider() {
+        return this.provider;
+    }
+
+    /**
+     * Initializes this context. Either of the first two parameters
+     * may be null in which case the installed security providers will
+     * be searched for the highest priority implementation of the
+     * appropriate factory. Likewise, the secure random parameter may
+     * be null in which case the default implementation will be used.
+     * <P>
+     * Only the first instance of a particular key and/or trust manager
+     * implementation type in the array is used.  (For example, only
+     * the first javax.net.ssl.X509KeyManager in the array will be used.)
+     *
+     * @param km the sources of authentication keys or null
+     * @param tm the sources of peer authentication trust decisions or null
+     * @param random the source of randomness for this generator or null
+     * @throws KeyManagementException if this operation fails
+     */
+    public final void init(KeyManager[] km, TrustManager[] tm,
+                                SecureRandom random)
+        throws KeyManagementException {
+        contextSpi.engineInit(km, tm, random);
+    }
+
+    /**
+     * Returns a {@code SocketFactory} object for this
+     * context.
+     *
+     * @return the {@code SocketFactory} object
+     * @throws UnsupportedOperationException if the underlying provider
+     *         does not implement the operation.
+     * @throws IllegalStateException if the SSLContextImpl requires
+     *         initialization and the {@code init()} has not been called
+     */
+    public final SSLSocketFactory getSocketFactory() {
+        return contextSpi.engineGetSocketFactory();
+    }
+
+    /**
+     * Returns a {@code ServerSocketFactory} object for
+     * this context.
+     *
+     * @return the {@code ServerSocketFactory} object
+     * @throws UnsupportedOperationException if the underlying provider
+     *         does not implement the operation.
+     * @throws IllegalStateException if the SSLContextImpl requires
+     *         initialization and the {@code init()} has not been called
+     */
+    public final SSLServerSocketFactory getServerSocketFactory() {
+        return contextSpi.engineGetServerSocketFactory();
+    }
+
+    /**
+     * Creates a new {@code SSLEngine} using this context.
+     * <P>
+     * Applications using this factory method are providing no hints
+     * for an internal session reuse strategy. If hints are desired,
+     * {@link #createSSLEngine(String, int)} should be used
+     * instead.
+     * <P>
+     * Some cipher suites (such as Kerberos) require remote hostname
+     * information, in which case this factory method should not be used.
+     *
+     * @return  the {@code SSLEngine} object
+     * @throws  UnsupportedOperationException if the underlying provider
+     *          does not implement the operation.
+     * @throws  IllegalStateException if the SSLContextImpl requires
+     *          initialization and the {@code init()} has not been called
+     * @since   1.5
+     */
+    public final SSLEngine createSSLEngine() {
+        try {
+            return contextSpi.engineCreateSSLEngine();
+        } catch (AbstractMethodError e) {
+            UnsupportedOperationException unsup =
+                new UnsupportedOperationException(
+                    "Provider: " + getProvider() +
+                    " doesn't support this operation");
+            unsup.initCause(e);
+            throw unsup;
+        }
+    }
+
+    /**
+     * Creates a new {@code SSLEngine} using this context using
+     * advisory peer information.
+     * <P>
+     * Applications using this factory method are providing hints
+     * for an internal session reuse strategy.
+     * <P>
+     * Some cipher suites (such as Kerberos) require remote hostname
+     * information, in which case peerHost needs to be specified.
+     *
+     * @param   peerHost the non-authoritative name of the host
+     * @param   peerPort the non-authoritative port
+     * @return  the new {@code SSLEngine} object
+     * @throws  UnsupportedOperationException if the underlying provider
+     *          does not implement the operation.
+     * @throws  IllegalStateException if the SSLContextImpl requires
+     *          initialization and the {@code init()} has not been called
+     * @since   1.5
+     */
+    public final SSLEngine createSSLEngine(String peerHost, int peerPort) {
+        try {
+            return contextSpi.engineCreateSSLEngine(peerHost, peerPort);
+        } catch (AbstractMethodError e) {
+            UnsupportedOperationException unsup =
+                new UnsupportedOperationException(
+                    "Provider: " + getProvider() +
+                    " does not support this operation");
+            unsup.initCause(e);
+            throw unsup;
+        }
+    }
+
+    /**
+     * Returns the server session context, which represents the set of
+     * SSL sessions available for use during the handshake phase of
+     * server-side SSL sockets.
+     * <P>
+     * This context may be unavailable in some environments, in which
+     * case this method returns null. For example, when the underlying
+     * SSL provider does not provide an implementation of SSLSessionContext
+     * interface, this method returns null. A non-null session context
+     * is returned otherwise.
+     *
+     * @return server session context bound to this SSL context
+     */
+    public final SSLSessionContext getServerSessionContext() {
+        return contextSpi.engineGetServerSessionContext();
+    }
+
+    /**
+     * Returns the client session context, which represents the set of
+     * SSL sessions available for use during the handshake phase of
+     * client-side SSL sockets.
+     * <P>
+     * This context may be unavailable in some environments, in which
+     * case this method returns null. For example, when the underlying
+     * SSL provider does not provide an implementation of SSLSessionContext
+     * interface, this method returns null. A non-null session context
+     * is returned otherwise.
+     *
+     * @return client session context bound to this SSL context
+     */
+    public final SSLSessionContext getClientSessionContext() {
+        return contextSpi.engineGetClientSessionContext();
+    }
+
+    /**
+     * Returns a copy of the SSLParameters indicating the default
+     * settings for this SSL context.
+     *
+     * <p>The parameters will always have the ciphersuites and protocols
+     * arrays set to non-null values.
+     *
+     * @return a copy of the SSLParameters object with the default settings
+     * @throws UnsupportedOperationException if the default SSL parameters
+     *   could not be obtained.
+     * @since 1.6
+     */
+    public final SSLParameters getDefaultSSLParameters() {
+        return contextSpi.engineGetDefaultSSLParameters();
+    }
+
+    /**
+     * Returns a copy of the SSLParameters indicating the supported
+     * settings for this SSL context.
+     *
+     * <p>The parameters will always have the ciphersuites and protocols
+     * arrays set to non-null values.
+     *
+     * @return a copy of the SSLParameters object with the supported
+     *   settings
+     * @throws UnsupportedOperationException if the supported SSL parameters
+     *   could not be obtained.
+     * @since 1.6
+     */
+    public final SSLParameters getSupportedSSLParameters() {
+        return contextSpi.engineGetSupportedSSLParameters();
+    }
+
+}

src/java.base/share/classes/javax/net/ssl/SSLContextSpi.java

@@ -0,0 +1,203 @@
+/*
+ * Copyright (c) 1999, 2015, Oracle and/or its affiliates. All rights reserved.
+ * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
+ *
+ * This code is free software; you can redistribute it and/or modify it
+ * under the terms of the GNU General Public License version 2 only, as
+ * published by the Free Software Foundation.  Oracle designates this
+ * particular file as subject to the "Classpath" exception as provided
+ * by Oracle in the LICENSE file that accompanied this code.
+ *
+ * This code is distributed in the hope that it will be useful, but WITHOUT
+ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
+ * FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License
+ * version 2 for more details (a copy is included in the LICENSE file that
+ * accompanied this code).
+ *
+ * You should have received a copy of the GNU General Public License version
+ * 2 along with this work; if not, write to the Free Software Foundation,
+ * Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.
+ *
+ * Please contact Oracle, 500 Oracle Parkway, Redwood Shores, CA 94065 USA
+ * or visit www.oracle.com if you need additional information or have any
+ * questions.
+ */
+
+package javax.net.ssl;
+
+import java.security.*;
+
+/**
+ * This class defines the <i>Service Provider Interface</i> (<b>SPI</b>)
+ * for the {@code SSLContext} class.
+ *
+ * <p> All the abstract methods in this class must be implemented by each
+ * cryptographic service provider who wishes to supply the implementation
+ * of a particular SSL context.
+ *
+ * @since 1.4
+ * @see SSLContext
+ */
+public abstract class SSLContextSpi {
+    /**
+     * Initializes this context.
+     *
+     * @param km the sources of authentication keys
+     * @param tm the sources of peer authentication trust decisions
+     * @param sr the source of randomness
+     * @throws KeyManagementException if this operation fails
+     * @see SSLContext#init(KeyManager [], TrustManager [], SecureRandom)
+     */
+    protected abstract void engineInit(KeyManager[] km, TrustManager[] tm,
+        SecureRandom sr) throws KeyManagementException;
+
+    /**
+     * Returns a {@code SocketFactory} object for this
+     * context.
+     *
+     * @return the {@code SocketFactory} object
+     * @throws UnsupportedOperationException if the underlying provider
+     *         does not implement the operation.
+     * @throws IllegalStateException if the SSLContextImpl requires
+     *         initialization and the {@code engineInit()}
+     *         has not been called
+     * @see javax.net.ssl.SSLContext#getSocketFactory()
+     */
+    protected abstract SSLSocketFactory engineGetSocketFactory();
+
+    /**
+     * Returns a {@code ServerSocketFactory} object for
+     * this context.
+     *
+     * @return the {@code ServerSocketFactory} object
+     * @throws UnsupportedOperationException if the underlying provider
+     *         does not implement the operation.
+     * @throws IllegalStateException if the SSLContextImpl requires
+     *         initialization and the {@code engineInit()}
+     *         has not been called
+     * @see javax.net.ssl.SSLContext#getServerSocketFactory()
+     */
+    protected abstract SSLServerSocketFactory engineGetServerSocketFactory();
+
+    /**
+     * Creates a new {@code SSLEngine} using this context.
+     * <P>
+     * Applications using this factory method are providing no hints
+     * for an internal session reuse strategy. If hints are desired,
+     * {@link #engineCreateSSLEngine(String, int)} should be used
+     * instead.
+     * <P>
+     * Some cipher suites (such as Kerberos) require remote hostname
+     * information, in which case this factory method should not be used.
+     *
+     * @return  the {@code SSLEngine} Object
+     * @throws IllegalStateException if the SSLContextImpl requires
+     *         initialization and the {@code engineInit()}
+     *         has not been called
+     *
+     * @see     SSLContext#createSSLEngine()
+     *
+     * @since   1.5
+     */
+    protected abstract SSLEngine engineCreateSSLEngine();
+
+    /**
+     * Creates a {@code SSLEngine} using this context.
+     * <P>
+     * Applications using this factory method are providing hints
+     * for an internal session reuse strategy.
+     * <P>
+     * Some cipher suites (such as Kerberos) require remote hostname
+     * information, in which case peerHost needs to be specified.
+     *
+     * @param host the non-authoritative name of the host
+     * @param port the non-authoritative port
+     * @return  the {@code SSLEngine} Object
+     * @throws IllegalStateException if the SSLContextImpl requires
+     *         initialization and the {@code engineInit()}
+     *         has not been called
+     *
+     * @see     SSLContext#createSSLEngine(String, int)
+     *
+     * @since   1.5
+     */
+    protected abstract SSLEngine engineCreateSSLEngine(String host, int port);
+
+    /**
+     * Returns a server {@code SSLSessionContext} object for
+     * this context.
+     *
+     * @return the {@code SSLSessionContext} object
+     * @see javax.net.ssl.SSLContext#getServerSessionContext()
+     */
+    protected abstract SSLSessionContext engineGetServerSessionContext();
+
+    /**
+     * Returns a client {@code SSLSessionContext} object for
+     * this context.
+     *
+     * @return the {@code SSLSessionContext} object
+     * @see javax.net.ssl.SSLContext#getClientSessionContext()
+     */
+    protected abstract SSLSessionContext engineGetClientSessionContext();
+
+    private SSLSocket getDefaultSocket() {
+        try {
+            SSLSocketFactory factory = engineGetSocketFactory();
+            return (SSLSocket)factory.createSocket();
+        } catch (java.io.IOException e) {
+            throw new UnsupportedOperationException("Could not obtain parameters", e);
+        }
+    }
+
+    /**
+     * Returns a copy of the SSLParameters indicating the default
+     * settings for this SSL context.
+     *
+     * <p>The parameters will always have the ciphersuite and protocols
+     * arrays set to non-null values.
+     *
+     * <p>The default implementation obtains the parameters from an
+     * SSLSocket created by calling the
+     * {@linkplain javax.net.SocketFactory#createSocket
+     * SocketFactory.createSocket()} method of this context's SocketFactory.
+     *
+     * @return a copy of the SSLParameters object with the default settings
+     * @throws UnsupportedOperationException if the default SSL parameters
+     *   could not be obtained.
+     *
+     * @since 1.6
+     */
+    protected SSLParameters engineGetDefaultSSLParameters() {
+        SSLSocket socket = getDefaultSocket();
+        return socket.getSSLParameters();
+    }
+
+    /**
+     * Returns a copy of the SSLParameters indicating the maximum supported
+     * settings for this SSL context.
+     *
+     * <p>The parameters will always have the ciphersuite and protocols
+     * arrays set to non-null values.
+     *
+     * <p>The default implementation obtains the parameters from an
+     * SSLSocket created by calling the
+     * {@linkplain javax.net.SocketFactory#createSocket
+     * SocketFactory.createSocket()} method of this context's SocketFactory.
+     *
+     * @return a copy of the SSLParameters object with the maximum supported
+     *   settings
+     * @throws UnsupportedOperationException if the supported SSL parameters
+     *   could not be obtained.
+     *
+     * @since 1.6
+     */
+    protected SSLParameters engineGetSupportedSSLParameters() {
+        SSLSocket socket = getDefaultSocket();
+        SSLParameters params = new SSLParameters();
+        params.setCipherSuites(socket.getSupportedCipherSuites());
+        params.setProtocols(socket.getSupportedProtocols());
+        return params;
+    }
+
+}

src/java.base/share/classes/javax/net/ssl/SSLEngineResult.java

@@ -0,0 +1,325 @@
+/*
+ * Copyright (c) 2003, 2017, Oracle and/or its affiliates. All rights reserved.
+ * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
+ *
+ * This code is free software; you can redistribute it and/or modify it
+ * under the terms of the GNU General Public License version 2 only, as
+ * published by the Free Software Foundation.  Oracle designates this
+ * particular file as subject to the "Classpath" exception as provided
+ * by Oracle in the LICENSE file that accompanied this code.
+ *
+ * This code is distributed in the hope that it will be useful, but WITHOUT
+ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
+ * FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License
+ * version 2 for more details (a copy is included in the LICENSE file that
+ * accompanied this code).
+ *
+ * You should have received a copy of the GNU General Public License version
+ * 2 along with this work; if not, write to the Free Software Foundation,
+ * Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.
+ *
+ * Please contact Oracle, 500 Oracle Parkway, Redwood Shores, CA 94065 USA
+ * or visit www.oracle.com if you need additional information or have any
+ * questions.
+ */
+
+package javax.net.ssl;
+
+/**
+ * An encapsulation of the result state produced by
+ * {@code SSLEngine} I/O calls.
+ *
+ * <p> A {@code SSLEngine} provides a means for establishing
+ * secure communication sessions between two peers.  {@code SSLEngine}
+ * operations typically consume bytes from an input buffer and produce
+ * bytes in an output buffer.  This class provides operational result
+ * values describing the state of the {@code SSLEngine}, including
+ * indications of what operations are needed to finish an
+ * ongoing handshake.  Lastly, it reports the number of bytes consumed
+ * and produced as a result of this operation.
+ *
+ * @see SSLEngine
+ * @see SSLEngine#wrap(ByteBuffer, ByteBuffer)
+ * @see SSLEngine#unwrap(ByteBuffer, ByteBuffer)
+ *
+ * @author Brad R. Wetmore
+ * @since 1.5
+ */
+
+public class SSLEngineResult {
+
+    /**
+     * An {@code SSLEngineResult} enum describing the overall result
+     * of the {@code SSLEngine} operation.
+     *
+     * The {@code Status} value does not reflect the
+     * state of a {@code SSLEngine} handshake currently
+     * in progress.  The {@code SSLEngineResult's HandshakeStatus}
+     * should be consulted for that information.
+     *
+     * @author Brad R. Wetmore
+     * @since 1.5
+     */
+    public static enum Status {
+
+        /**
+         * The {@code SSLEngine} was not able to unwrap the
+         * incoming data because there were not enough source bytes
+         * available to make a complete packet.
+         *
+         * <P>
+         * Repeat the call once more bytes are available.
+         */
+        BUFFER_UNDERFLOW,
+
+        /**
+         * The {@code SSLEngine} was not able to process the
+         * operation because there are not enough bytes available in the
+         * destination buffer to hold the result.
+         * <P>
+         * Repeat the call once more bytes are available.
+         *
+         * @see SSLSession#getPacketBufferSize()
+         * @see SSLSession#getApplicationBufferSize()
+         */
+        BUFFER_OVERFLOW,
+
+        /**
+         * The {@code SSLEngine} completed the operation, and
+         * is available to process similar calls.
+         */
+        OK,
+
+        /**
+         * The operation just closed this side of the
+         * {@code SSLEngine}, or the operation
+         * could not be completed because it was already closed.
+         */
+        CLOSED;
+    }
+
+    /**
+     * An {@code SSLEngineResult} enum describing the current
+     * handshaking state of this {@code SSLEngine}.
+     *
+     * @author Brad R. Wetmore
+     * @since 1.5
+     */
+    public static enum HandshakeStatus {
+
+        /**
+         * The {@code SSLEngine} is not currently handshaking.
+         */
+        NOT_HANDSHAKING,
+
+        /**
+         * The {@code SSLEngine} has just finished handshaking.
+         * <P>
+         * This value is only generated by a call to
+         * {@code SSLEngine.wrap()/unwrap()} when that call
+         * finishes a handshake.  It is never generated by
+         * {@code SSLEngine.getHandshakeStatus()}.
+         *
+         * @see SSLEngine#wrap(ByteBuffer, ByteBuffer)
+         * @see SSLEngine#unwrap(ByteBuffer, ByteBuffer)
+         * @see SSLEngine#getHandshakeStatus()
+         */
+        FINISHED,
+
+        /**
+         * The {@code SSLEngine} needs the results of one (or more)
+         * delegated tasks before handshaking can continue.
+         *
+         * @see SSLEngine#getDelegatedTask()
+         */
+        NEED_TASK,
+
+        /**
+         * The {@code SSLEngine} must send data to the remote side
+         * before handshaking can continue, so {@code SSLEngine.wrap()}
+         * should be called.
+         *
+         * @see SSLEngine#wrap(ByteBuffer, ByteBuffer)
+         */
+        NEED_WRAP,
+
+        /**
+         * The {@code SSLEngine} needs to receive data from the
+         * remote side before handshaking can continue.
+         */
+        NEED_UNWRAP,
+
+        /**
+         * The {@code SSLEngine} needs to unwrap before handshaking can
+         * continue.
+         * <P>
+         * This value is used to indicate that not-yet-interpreted data
+         * has been previously received from the remote side, and does
+         * not need to be received again.
+         * <P>
+         * This handshake status only applies to DTLS.
+         *
+         * @since   9
+         */
+        NEED_UNWRAP_AGAIN;
+    }
+
+
+    private final Status status;
+    private final HandshakeStatus handshakeStatus;
+    private final int bytesConsumed;
+    private final int bytesProduced;
+    private final long sequenceNumber;
+
+    /**
+     * Initializes a new instance of this class.
+     *
+     * @param   status
+     *          the return value of the operation.
+     *
+     * @param   handshakeStatus
+     *          the current handshaking status.
+     *
+     * @param   bytesConsumed
+     *          the number of bytes consumed from the source ByteBuffer
+     *
+     * @param   bytesProduced
+     *          the number of bytes placed into the destination ByteBuffer
+     *
+     * @throws  IllegalArgumentException
+     *          if the {@code status} or {@code handshakeStatus}
+     *          arguments are null, or if {@code bytesConsumed} or
+     *          {@code bytesProduced} is negative.
+     */
+    public SSLEngineResult(Status status, HandshakeStatus handshakeStatus,
+            int bytesConsumed, int bytesProduced) {
+        this(status, handshakeStatus, bytesConsumed, bytesProduced, -1);
+    }
+
+    /**
+     * Initializes a new instance of this class.
+     *
+     * @param   status
+     *          the return value of the operation.
+     *
+     * @param   handshakeStatus
+     *          the current handshaking status.
+     *
+     * @param   bytesConsumed
+     *          the number of bytes consumed from the source ByteBuffer
+     *
+     * @param   bytesProduced
+     *          the number of bytes placed into the destination ByteBuffer
+     *
+     * @param   sequenceNumber
+     *          the sequence number (unsigned long) of the produced or
+     *          consumed SSL/TLS/DTLS record, or {@code -1L} if no record
+     *          produced or consumed
+     *
+     * @throws  IllegalArgumentException
+     *          if the {@code status} or {@code handshakeStatus}
+     *          arguments are null, or if {@code bytesConsumed} or
+     *          {@code bytesProduced} is negative
+     *
+     * @since   9
+     */
+    public SSLEngineResult(Status status, HandshakeStatus handshakeStatus,
+            int bytesConsumed, int bytesProduced, long sequenceNumber) {
+
+        if ((status == null) || (handshakeStatus == null) ||
+                (bytesConsumed < 0) || (bytesProduced < 0)) {
+            throw new IllegalArgumentException("Invalid Parameter(s)");
+        }
+
+        this.status = status;
+        this.handshakeStatus = handshakeStatus;
+        this.bytesConsumed = bytesConsumed;
+        this.bytesProduced = bytesProduced;
+        this.sequenceNumber = sequenceNumber;
+    }
+
+    /**
+     * Gets the return value of this {@code SSLEngine} operation.
+     *
+     * @return  the return value
+     */
+    public final Status getStatus() {
+        return status;
+    }
+
+    /**
+     * Gets the handshake status of this {@code SSLEngine}
+     * operation.
+     *
+     * @return  the handshake status
+     */
+    public final HandshakeStatus getHandshakeStatus() {
+        return handshakeStatus;
+    }
+
+    /**
+     * Returns the number of bytes consumed from the input buffer.
+     *
+     * @return  the number of bytes consumed.
+     */
+    public final int bytesConsumed() {
+        return bytesConsumed;
+    }
+
+    /**
+     * Returns the number of bytes written to the output buffer.
+     *
+     * @return  the number of bytes produced
+     */
+    public final int bytesProduced() {
+        return bytesProduced;
+    }
+
+    /**
+     * Returns the sequence number of the produced or consumed SSL/TLS/DTLS
+     * record (optional operation).
+     *
+     * @apiNote  Note that sequence number is an unsigned long and cannot
+     *           exceed {@code -1L}.  It is desired to use the unsigned
+     *           long comparing mode for comparison of unsigned long values
+     *           (see also {@link java.lang.Long#compareUnsigned(long, long)
+     *           Long.compareUnsigned()}).
+     *           <P>
+     *           For DTLS protocols, the first 16 bits of the sequence
+     *           number is a counter value (epoch) that is incremented on
+     *           every cipher state change.  The remaining 48 bits on the
+     *           right side of the sequence number represents the sequence
+     *           of the record, which is maintained separately for each epoch.
+     *
+     * @implNote It is recommended that providers should never allow the
+     *           sequence number incremented to {@code -1L}.  If the sequence
+     *           number is close to wrapping, renegotiate should be requested,
+     *           otherwise the connection should be closed immediately.
+     *           This should be carried on automatically by the underlying
+     *           implementation.
+     *
+     * @return  the sequence number of the produced or consumed SSL/TLS/DTLS
+     *          record; or {@code -1L} if no record is produced or consumed,
+     *          or this operation is not supported by the underlying provider
+     *
+     * @see     java.lang.Long#compareUnsigned(long, long)
+     *
+     * @since   9
+     */
+    public final long sequenceNumber() {
+        return sequenceNumber;
+    }
+
+    /**
+     * Returns a String representation of this object.
+     */
+    @Override
+    public String toString() {
+        return ("Status = " + status +
+            " HandshakeStatus = " + handshakeStatus +
+            "\nbytesConsumed = " + bytesConsumed +
+            " bytesProduced = " + bytesProduced +
+            (sequenceNumber == -1 ? "" :
+                " sequenceNumber = " + Long.toUnsignedString(sequenceNumber)));
+    }
+}

src/java.base/share/classes/javax/net/ssl/SSLException.java

@@ -0,0 +1,88 @@
+/*
+ * Copyright (c) 1996, 2004, Oracle and/or its affiliates. All rights reserved.
+ * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
+ *
+ * This code is free software; you can redistribute it and/or modify it
+ * under the terms of the GNU General Public License version 2 only, as
+ * published by the Free Software Foundation.  Oracle designates this
+ * particular file as subject to the "Classpath" exception as provided
+ * by Oracle in the LICENSE file that accompanied this code.
+ *
+ * This code is distributed in the hope that it will be useful, but WITHOUT
+ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
+ * FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License
+ * version 2 for more details (a copy is included in the LICENSE file that
+ * accompanied this code).
+ *
+ * You should have received a copy of the GNU General Public License version
+ * 2 along with this work; if not, write to the Free Software Foundation,
+ * Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.
+ *
+ * Please contact Oracle, 500 Oracle Parkway, Redwood Shores, CA 94065 USA
+ * or visit www.oracle.com if you need additional information or have any
+ * questions.
+ */
+
+
+package javax.net.ssl;
+
+import java.io.IOException;
+
+/**
+ * Indicates some kind of error detected by an SSL subsystem.
+ * This class is the general class of exceptions produced
+ * by failed SSL-related operations.
+ *
+ * @since 1.4
+ * @author David Brownell
+ */
+public
+class SSLException extends IOException
+{
+    private static final long serialVersionUID = 4511006460650708967L;
+
+    /**
+     * Constructs an exception reporting an error found by
+     * an SSL subsystem.
+     *
+     * @param reason describes the problem.
+     */
+    public SSLException(String reason)
+    {
+        super(reason);
+    }
+
+    /**
+     * Creates a {@code SSLException} with the specified
+     * detail message and cause.
+     *
+     * @param message the detail message (which is saved for later retrieval
+     *          by the {@link #getMessage()} method).
+     * @param cause the cause (which is saved for later retrieval by the
+     *          {@link #getCause()} method).  (A {@code null} value is
+     *          permitted, and indicates that the cause is nonexistent or
+     *          unknown.)
+     * @since 1.5
+     */
+    public SSLException(String message, Throwable cause) {
+        super(message);
+        initCause(cause);
+    }
+
+    /**
+     * Creates a {@code SSLException} with the specified cause
+     * and a detail message of {@code (cause==null ? null : cause.toString())}
+     * (which typically contains the class and detail message of
+     * {@code cause}).
+     *
+     * @param cause the cause (which is saved for later retrieval by the
+     *          {@link #getCause()} method).  (A {@code null} value is
+     *          permitted, and indicates that the cause is nonexistent or
+     *          unknown.)
+     * @since 1.5
+     */
+    public SSLException(Throwable cause) {
+        super(cause == null ? null : cause.toString());
+        initCause(cause);
+    }
+}

src/java.base/share/classes/javax/net/ssl/SSLHandshakeException.java

@@ -0,0 +1,52 @@
+/*
+ * Copyright (c) 1996, 2003, Oracle and/or its affiliates. All rights reserved.
+ * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
+ *
+ * This code is free software; you can redistribute it and/or modify it
+ * under the terms of the GNU General Public License version 2 only, as
+ * published by the Free Software Foundation.  Oracle designates this
+ * particular file as subject to the "Classpath" exception as provided
+ * by Oracle in the LICENSE file that accompanied this code.
+ *
+ * This code is distributed in the hope that it will be useful, but WITHOUT
+ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
+ * FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License
+ * version 2 for more details (a copy is included in the LICENSE file that
+ * accompanied this code).
+ *
+ * You should have received a copy of the GNU General Public License version
+ * 2 along with this work; if not, write to the Free Software Foundation,
+ * Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.
+ *
+ * Please contact Oracle, 500 Oracle Parkway, Redwood Shores, CA 94065 USA
+ * or visit www.oracle.com if you need additional information or have any
+ * questions.
+ */
+
+
+package javax.net.ssl;
+
+
+/**
+ * Indicates that the client and server could not negotiate the
+ * desired level of security.  The connection is no longer usable.
+ *
+ * @since 1.4
+ * @author David Brownell
+ */
+public
+class SSLHandshakeException extends SSLException
+{
+    private static final long serialVersionUID = -5045881315018326890L;
+
+    /**
+     * Constructs an exception reporting an error found by
+     * an SSL subsystem during handshaking.
+     *
+     * @param reason describes the problem.
+     */
+    public SSLHandshakeException(String reason)
+    {
+        super(reason);
+    }
+}

src/java.base/share/classes/javax/net/ssl/SSLKeyException.java

@@ -0,0 +1,51 @@
+/*
+ * Copyright (c) 1996, 2003, Oracle and/or its affiliates. All rights reserved.
+ * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
+ *
+ * This code is free software; you can redistribute it and/or modify it
+ * under the terms of the GNU General Public License version 2 only, as
+ * published by the Free Software Foundation.  Oracle designates this
+ * particular file as subject to the "Classpath" exception as provided
+ * by Oracle in the LICENSE file that accompanied this code.
+ *
+ * This code is distributed in the hope that it will be useful, but WITHOUT
+ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
+ * FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License
+ * version 2 for more details (a copy is included in the LICENSE file that
+ * accompanied this code).
+ *
+ * You should have received a copy of the GNU General Public License version
+ * 2 along with this work; if not, write to the Free Software Foundation,
+ * Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.
+ *
+ * Please contact Oracle, 500 Oracle Parkway, Redwood Shores, CA 94065 USA
+ * or visit www.oracle.com if you need additional information or have any
+ * questions.
+ */
+
+
+package javax.net.ssl;
+
+/**
+ * Reports a bad SSL key.  Normally, this indicates misconfiguration
+ * of the server or client SSL certificate and private key.
+ *
+ * @since 1.4
+ * @author David Brownell
+ */
+public
+class SSLKeyException extends SSLException
+{
+    private static final long serialVersionUID = -8071664081941937874L;
+
+    /**
+     * Constructs an exception reporting a key management error
+     * found by an SSL subsystem.
+     *
+     * @param reason describes the problem.
+     */
+    public SSLKeyException(String reason)
+    {
+        super(reason);
+    }
+}

src/java.base/share/classes/javax/net/ssl/SSLParameters.java

@@ -0,0 +1,678 @@
+/*
+ * Copyright (c) 2005, 2017, Oracle and/or its affiliates. All rights reserved.
+ * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
+ *
+ * This code is free software; you can redistribute it and/or modify it
+ * under the terms of the GNU General Public License version 2 only, as
+ * published by the Free Software Foundation.  Oracle designates this
+ * particular file as subject to the "Classpath" exception as provided
+ * by Oracle in the LICENSE file that accompanied this code.
+ *
+ * This code is distributed in the hope that it will be useful, but WITHOUT
+ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
+ * FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License
+ * version 2 for more details (a copy is included in the LICENSE file that
+ * accompanied this code).
+ *
+ * You should have received a copy of the GNU General Public License version
+ * 2 along with this work; if not, write to the Free Software Foundation,
+ * Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.
+ *
+ * Please contact Oracle, 500 Oracle Parkway, Redwood Shores, CA 94065 USA
+ * or visit www.oracle.com if you need additional information or have any
+ * questions.
+ */
+
+package javax.net.ssl;
+
+import java.security.AlgorithmConstraints;
+import java.util.Map;
+import java.util.List;
+import java.util.HashMap;
+import java.util.ArrayList;
+import java.util.Collection;
+import java.util.Collections;
+import java.util.LinkedHashMap;
+
+/**
+ * Encapsulates parameters for an SSL/TLS/DTLS connection. The parameters
+ * are the list of ciphersuites to be accepted in an SSL/TLS/DTLS handshake,
+ * the list of protocols to be allowed, the endpoint identification
+ * algorithm during SSL/TLS/DTLS handshaking, the Server Name Indication (SNI),
+ * the maximum network packet size, the algorithm constraints and whether
+ * SSL/TLS/DTLS servers should request or require client authentication, etc.
+ * <p>
+ * SSLParameters can be created via the constructors in this class.
+ * Objects can also be obtained using the {@code getSSLParameters()}
+ * methods in
+ * {@link SSLSocket#getSSLParameters SSLSocket} and
+ * {@link SSLServerSocket#getSSLParameters SSLServerSocket} and
+ * {@link SSLEngine#getSSLParameters SSLEngine} or the
+ * {@link SSLContext#getDefaultSSLParameters getDefaultSSLParameters()} and
+ * {@link SSLContext#getSupportedSSLParameters getSupportedSSLParameters()}
+ * methods in {@code SSLContext}.
+ * <p>
+ * SSLParameters can be applied to a connection via the methods
+ * {@link SSLSocket#setSSLParameters SSLSocket.setSSLParameters()} and
+ * {@link SSLServerSocket#setSSLParameters SSLServerSocket.setSSLParameters()}
+ * and {@link SSLEngine#setSSLParameters SSLEngine.setSSLParameters()}.
+ * <p>
+ * For example:
+ *
+ * <blockquote><pre>
+ *     SSLParameters p = sslSocket.getSSLParameters();
+ *     p.setProtocols(new String[] { "TLSv1.2" });
+ *     p.setCipherSuites(
+ *         new String[] { "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", ... });
+ *     p.setApplicationProtocols(new String[] {"h2", "http/1.1"});
+ *     sslSocket.setSSLParameters(p);
+ * </pre></blockquote>
+ *
+ * @see SSLSocket
+ * @see SSLEngine
+ * @see SSLContext
+ *
+ * @since 1.6
+ */
+public class SSLParameters {
+
+    private String[] cipherSuites;
+    private String[] protocols;
+    private boolean wantClientAuth;
+    private boolean needClientAuth;
+    private String identificationAlgorithm;
+    private AlgorithmConstraints algorithmConstraints;
+    private Map<Integer, SNIServerName> sniNames = null;
+    private Map<Integer, SNIMatcher> sniMatchers = null;
+    private boolean preferLocalCipherSuites;
+    private boolean enableRetransmissions = true;
+    private int maximumPacketSize = 0;
+    private String[] applicationProtocols = new String[0];
+
+    /**
+     * Constructs SSLParameters.
+     * <p>
+     * The values of cipherSuites, protocols, cryptographic algorithm
+     * constraints, endpoint identification algorithm, server names and
+     * server name matchers are set to {@code null}; useCipherSuitesOrder,
+     * wantClientAuth and needClientAuth are set to {@code false};
+     * enableRetransmissions is set to {@code true}; maximum network packet
+     * size is set to {@code 0}.
+     */
+    public SSLParameters() {
+        // empty
+    }
+
+    /**
+     * Constructs SSLParameters from the specified array of ciphersuites.
+     * <p>
+     * Calling this constructor is equivalent to calling the no-args
+     * constructor followed by
+     * {@code setCipherSuites(cipherSuites);}.  Note that the
+     * standard list of cipher suite names may be found in the <a href=
+     * "{@docRoot}/../specs/security/standard-names.html#jsse-cipher-suite-names">
+     * JSSE Cipher Suite Names</a> section of the Java Cryptography
+     * Architecture Standard Algorithm Name Documentation.  Providers
+     * may support cipher suite names not found in this list.
+     *
+     * @param cipherSuites the array of ciphersuites (or null)
+     */
+    public SSLParameters(String[] cipherSuites) {
+        setCipherSuites(cipherSuites);
+    }
+
+    /**
+     * Constructs SSLParameters from the specified array of ciphersuites
+     * and protocols.
+     * <p>
+     * Calling this constructor is equivalent to calling the no-args
+     * constructor followed by
+     * {@code setCipherSuites(cipherSuites); setProtocols(protocols);}.
+     * Note that the standard list of cipher suite names may be found in the
+     * <a href=
+     * "{@docRoot}/../specs/security/standard-names.html#jsse-cipher-suite-names">
+     * JSSE Cipher Suite Names</a> section of the Java Cryptography
+     * Architecture Standard Algorithm Name Documentation.  Providers
+     * may support cipher suite names not found in this list.
+     *
+     * @param cipherSuites the array of ciphersuites (or null)
+     * @param protocols the array of protocols (or null)
+     */
+    public SSLParameters(String[] cipherSuites, String[] protocols) {
+        setCipherSuites(cipherSuites);
+        setProtocols(protocols);
+    }
+
+    private static String[] clone(String[] s) {
+        return (s == null) ? null : s.clone();
+    }
+
+    /**
+     * Returns a copy of the array of ciphersuites or null if none
+     * have been set.
+     * <P>
+     * The returned array includes cipher suites from the list of standard
+     * cipher suite names in the <a href=
+     * "{@docRoot}/../specs/security/standard-names.html#jsse-cipher-suite-names">
+     * JSSE Cipher Suite Names</a> section of the Java Cryptography
+     * Architecture Standard Algorithm Name Documentation, and may also
+     * include other cipher suites that the provider supports.
+     *
+     * @return a copy of the array of ciphersuites or null if none
+     * have been set.
+     */
+    public String[] getCipherSuites() {
+        return clone(cipherSuites);
+    }
+
+    /**
+     * Sets the array of ciphersuites.
+     *
+     * @param cipherSuites the array of ciphersuites (or null).  Note that the
+     * standard list of cipher suite names may be found in the <a href=
+     * "{@docRoot}/../specs/security/standard-names.html#jsse-cipher-suite-names">
+     * JSSE Cipher Suite Names</a> section of the Java Cryptography
+     * Architecture Standard Algorithm Name Documentation.  Providers
+     * may support cipher suite names not found in this list or might not
+     * use the recommended name for a certain cipher suite.
+     */
+    public void setCipherSuites(String[] cipherSuites) {
+        this.cipherSuites = clone(cipherSuites);
+    }
+
+    /**
+     * Returns a copy of the array of protocols or null if none
+     * have been set.
+     *
+     * @return a copy of the array of protocols or null if none
+     * have been set.
+     */
+    public String[] getProtocols() {
+        return clone(protocols);
+    }
+
+    /**
+     * Sets the array of protocols.
+     *
+     * @param protocols the array of protocols (or null)
+     */
+    public void setProtocols(String[] protocols) {
+        this.protocols = clone(protocols);
+    }
+
+    /**
+     * Returns whether client authentication should be requested.
+     *
+     * @return whether client authentication should be requested.
+     */
+    public boolean getWantClientAuth() {
+        return wantClientAuth;
+    }
+
+    /**
+     * Sets whether client authentication should be requested. Calling
+     * this method clears the {@code needClientAuth} flag.
+     *
+     * @param wantClientAuth whether client authentication should be requested
+     */
+    public void setWantClientAuth(boolean wantClientAuth) {
+        this.wantClientAuth = wantClientAuth;
+        this.needClientAuth = false;
+    }
+
+    /**
+     * Returns whether client authentication should be required.
+     *
+     * @return whether client authentication should be required.
+     */
+    public boolean getNeedClientAuth() {
+        return needClientAuth;
+    }
+
+    /**
+     * Sets whether client authentication should be required. Calling
+     * this method clears the {@code wantClientAuth} flag.
+     *
+     * @param needClientAuth whether client authentication should be required
+     */
+    public void setNeedClientAuth(boolean needClientAuth) {
+        this.wantClientAuth = false;
+        this.needClientAuth = needClientAuth;
+    }
+
+    /**
+     * Returns the cryptographic algorithm constraints.
+     *
+     * @return the cryptographic algorithm constraints, or null if the
+     *     constraints have not been set
+     *
+     * @see #setAlgorithmConstraints(AlgorithmConstraints)
+     *
+     * @since 1.7
+     */
+    public AlgorithmConstraints getAlgorithmConstraints() {
+        return algorithmConstraints;
+    }
+
+    /**
+     * Sets the cryptographic algorithm constraints, which will be used
+     * in addition to any configured by the runtime environment.
+     * <p>
+     * If the {@code constraints} parameter is non-null, every
+     * cryptographic algorithm, key and algorithm parameters used in the
+     * SSL/TLS/DTLS handshake must be permitted by the constraints.
+     *
+     * @param constraints the algorithm constraints (or null)
+     *
+     * @since 1.7
+     */
+    public void setAlgorithmConstraints(AlgorithmConstraints constraints) {
+        // the constraints object is immutable
+        this.algorithmConstraints = constraints;
+    }
+
+    /**
+     * Gets the endpoint identification algorithm.
+     *
+     * @return the endpoint identification algorithm, or null if none
+     * has been set.
+     *
+     * @see X509ExtendedTrustManager
+     * @see #setEndpointIdentificationAlgorithm(String)
+     *
+     * @since 1.7
+     */
+    public String getEndpointIdentificationAlgorithm() {
+        return identificationAlgorithm;
+    }
+
+    /**
+     * Sets the endpoint identification algorithm.
+     * <p>
+     * If the {@code algorithm} parameter is non-null or non-empty, the
+     * endpoint identification/verification procedures must be handled during
+     * SSL/TLS/DTLS handshaking.  This is to prevent man-in-the-middle attacks.
+     *
+     * @param algorithm The standard string name of the endpoint
+     *     identification algorithm (or null).
+     *     See the <a href=
+     *     "{@docRoot}/../specs/security/standard-names.html">
+     *     Java Security Standard Algorithm Names</a> document
+     *     for information about standard algorithm names.
+     *
+     * @see X509ExtendedTrustManager
+     *
+     * @since 1.7
+     */
+    public void setEndpointIdentificationAlgorithm(String algorithm) {
+        this.identificationAlgorithm = algorithm;
+    }
+
+    /**
+     * Sets the desired {@link SNIServerName}s of the Server Name
+     * Indication (SNI) parameter.
+     * <P>
+     * This method is only useful to {@link SSLSocket}s or {@link SSLEngine}s
+     * operating in client mode.
+     * <P>
+     * Note that the {@code serverNames} list is cloned
+     * to protect against subsequent modification.
+     *
+     * @param  serverNames
+     *         the list of desired {@link SNIServerName}s (or null)
+     *
+     * @throws NullPointerException if the {@code serverNames}
+     *         contains {@code null} element
+     * @throws IllegalArgumentException if the {@code serverNames}
+     *         contains more than one name of the same name type
+     *
+     * @see SNIServerName
+     * @see #getServerNames()
+     *
+     * @since 1.8
+     */
+    public final void setServerNames(List<SNIServerName> serverNames) {
+        if (serverNames != null) {
+            if (!serverNames.isEmpty()) {
+                sniNames = new LinkedHashMap<>(serverNames.size());
+                for (SNIServerName serverName : serverNames) {
+                    if (sniNames.put(serverName.getType(),
+                                                serverName) != null) {
+                        throw new IllegalArgumentException(
+                                    "Duplicated server name of type " +
+                                    serverName.getType());
+                    }
+                }
+            } else {
+                sniNames = Collections.<Integer, SNIServerName>emptyMap();
+            }
+        } else {
+            sniNames = null;
+        }
+    }
+
+    /**
+     * Returns a {@link List} containing all {@link SNIServerName}s of the
+     * Server Name Indication (SNI) parameter, or null if none has been set.
+     * <P>
+     * This method is only useful to {@link SSLSocket}s or {@link SSLEngine}s
+     * operating in client mode.
+     * <P>
+     * For SSL/TLS/DTLS connections, the underlying SSL/TLS/DTLS provider
+     * may specify a default value for a certain server name type.  In
+     * client mode, it is recommended that, by default, providers should
+     * include the server name indication whenever the server can be located
+     * by a supported server name type.
+     * <P>
+     * It is recommended that providers initialize default Server Name
+     * Indications when creating {@code SSLSocket}/{@code SSLEngine}s.
+     * In the following examples, the server name could be represented by an
+     * instance of {@link SNIHostName} which has been initialized with the
+     * hostname "www.example.com" and type
+     * {@link StandardConstants#SNI_HOST_NAME}.
+     *
+     * <pre>
+     *     Socket socket =
+     *         sslSocketFactory.createSocket("www.example.com", 443);
+     * </pre>
+     * or
+     * <pre>
+     *     SSLEngine engine =
+     *         sslContext.createSSLEngine("www.example.com", 443);
+     * </pre>
+     *
+     * @return null or an immutable list of non-null {@link SNIServerName}s
+     *
+     * @see List
+     * @see #setServerNames(List)
+     *
+     * @since 1.8
+     */
+    public final List<SNIServerName> getServerNames() {
+        if (sniNames != null) {
+            if (!sniNames.isEmpty()) {
+                return Collections.<SNIServerName>unmodifiableList(
+                                        new ArrayList<>(sniNames.values()));
+            } else {
+                return Collections.<SNIServerName>emptyList();
+            }
+        }
+
+        return null;
+    }
+
+    /**
+     * Sets the {@link SNIMatcher}s of the Server Name Indication (SNI)
+     * parameter.
+     * <P>
+     * This method is only useful to {@link SSLSocket}s or {@link SSLEngine}s
+     * operating in server mode.
+     * <P>
+     * Note that the {@code matchers} collection is cloned to protect
+     * against subsequent modification.
+     *
+     * @param  matchers
+     *         the collection of {@link SNIMatcher}s (or null)
+     *
+     * @throws NullPointerException if the {@code matchers}
+     *         contains {@code null} element
+     * @throws IllegalArgumentException if the {@code matchers}
+     *         contains more than one name of the same name type
+     *
+     * @see Collection
+     * @see SNIMatcher
+     * @see #getSNIMatchers()
+     *
+     * @since 1.8
+     */
+    public final void setSNIMatchers(Collection<SNIMatcher> matchers) {
+        if (matchers != null) {
+            if (!matchers.isEmpty()) {
+                sniMatchers = new HashMap<>(matchers.size());
+                for (SNIMatcher matcher : matchers) {
+                    if (sniMatchers.put(matcher.getType(),
+                                                matcher) != null) {
+                        throw new IllegalArgumentException(
+                                    "Duplicated server name of type " +
+                                    matcher.getType());
+                    }
+                }
+            } else {
+                sniMatchers = Collections.<Integer, SNIMatcher>emptyMap();
+            }
+        } else {
+            sniMatchers = null;
+        }
+    }
+
+    /**
+     * Returns a {@link Collection} containing all {@link SNIMatcher}s of the
+     * Server Name Indication (SNI) parameter, or null if none has been set.
+     * <P>
+     * This method is only useful to {@link SSLSocket}s or {@link SSLEngine}s
+     * operating in server mode.
+     * <P>
+     * For better interoperability, providers generally will not define
+     * default matchers so that by default servers will ignore the SNI
+     * extension and continue the handshake.
+     *
+     * @return null or an immutable collection of non-null {@link SNIMatcher}s
+     *
+     * @see SNIMatcher
+     * @see #setSNIMatchers(Collection)
+     *
+     * @since 1.8
+     */
+    public final Collection<SNIMatcher> getSNIMatchers() {
+        if (sniMatchers != null) {
+            if (!sniMatchers.isEmpty()) {
+                return Collections.<SNIMatcher>unmodifiableList(
+                                        new ArrayList<>(sniMatchers.values()));
+            } else {
+                return Collections.<SNIMatcher>emptyList();
+            }
+        }
+
+        return null;
+    }
+
+    /**
+     * Sets whether the local cipher suites preference should be honored.
+     *
+     * @param honorOrder whether local cipher suites order in
+     *        {@code #getCipherSuites} should be honored during
+     *        SSL/TLS/DTLS handshaking.
+     *
+     * @see #getUseCipherSuitesOrder()
+     *
+     * @since 1.8
+     */
+    public final void setUseCipherSuitesOrder(boolean honorOrder) {
+        this.preferLocalCipherSuites = honorOrder;
+    }
+
+    /**
+     * Returns whether the local cipher suites preference should be honored.
+     *
+     * @return whether local cipher suites order in {@code #getCipherSuites}
+     *         should be honored during SSL/TLS/DTLS handshaking.
+     *
+     * @see #setUseCipherSuitesOrder(boolean)
+     *
+     * @since 1.8
+     */
+    public final boolean getUseCipherSuitesOrder() {
+        return preferLocalCipherSuites;
+    }
+
+    /**
+     * Sets whether DTLS handshake retransmissions should be enabled.
+     *
+     * This method only applies to DTLS.
+     *
+     * @param   enableRetransmissions
+     *          {@code true} indicates that DTLS handshake retransmissions
+     *          should be enabled; {@code false} indicates that DTLS handshake
+     *          retransmissions should be disabled
+     *
+     * @see     #getEnableRetransmissions()
+     *
+     * @since 9
+     */
+    public void setEnableRetransmissions(boolean enableRetransmissions) {
+        this.enableRetransmissions = enableRetransmissions;
+    }
+
+    /**
+     * Returns whether DTLS handshake retransmissions should be enabled.
+     *
+     * This method only applies to DTLS.
+     *
+     * @return  true, if DTLS handshake retransmissions should be enabled
+     *
+     * @see     #setEnableRetransmissions(boolean)
+     *
+     * @since 9
+     */
+    public boolean getEnableRetransmissions() {
+        return enableRetransmissions;
+    }
+
+    /**
+     * Sets the maximum expected network packet size in bytes for
+     * SSL/TLS/DTLS records.
+     *
+     * @apiNote  It is recommended that if possible, the maximum packet size
+     *           should not be less than 256 bytes so that small handshake
+     *           messages, such as HelloVerifyRequests, are not fragmented.
+     *
+     * @implNote If the maximum packet size is too small to hold a minimal
+     *           record, an implementation may attempt to generate as minimal
+     *           records as possible.  However, this may cause a generated
+     *           packet to be larger than the maximum packet size.
+     *
+     * @param   maximumPacketSize
+     *          the maximum expected network packet size in bytes, or
+     *          {@code 0} to use the implicit size that is automatically
+     *          specified by the underlying implementation.
+     * @throws  IllegalArgumentException
+     *          if {@code maximumPacketSize} is negative.
+     *
+     * @see     #getMaximumPacketSize()
+     *
+     * @since 9
+     */
+    public void setMaximumPacketSize(int maximumPacketSize) {
+        if (maximumPacketSize < 0) {
+            throw new IllegalArgumentException(
+                "The maximum packet size cannot be negative");
+        }
+
+        this.maximumPacketSize = maximumPacketSize;
+    }
+
+    /**
+     * Returns the maximum expected network packet size in bytes for
+     * SSL/TLS/DTLS records.
+     *
+     * @apiNote  The implicit size may not be a fixed value, especially
+     *           for a DTLS protocols implementation.
+     *
+     * @implNote For SSL/TLS/DTLS connections, the underlying provider
+     *           should calculate and specify the implicit value of the
+     *           maximum expected network packet size if it is not
+     *           configured explicitly.  For any connection populated
+     *           object, this method should never return {@code 0} so
+     *           that applications can retrieve the actual implicit size
+     *           of the underlying implementation.
+     *           <P>
+     *           An implementation should attempt to comply with the maximum
+     *           packet size configuration.  However, if the maximum packet
+     *           size is too small to hold a minimal record, an implementation
+     *           may try to generate as minimal records as possible.  This
+     *           may cause a generated packet to be larger than the maximum
+     *           packet size.
+     *
+     * @return   the maximum expected network packet size, or {@code 0} if
+     *           use the implicit size that is automatically specified by
+     *           the underlying implementation and this object has not been
+     *           populated by any connection.
+     *
+     * @see      #setMaximumPacketSize(int)
+     *
+     * @since 9
+     */
+    public int getMaximumPacketSize() {
+        return maximumPacketSize;
+    }
+
+    /**
+     * Returns a prioritized array of application-layer protocol names that
+     * can be negotiated over the SSL/TLS/DTLS protocols.
+     * <p>
+     * The array could be empty (zero-length), in which case protocol
+     * indications will not be used.
+     * <p>
+     * This method will return a new array each time it is invoked.
+     *
+     * @return a non-null, possibly zero-length array of application protocol
+     *         {@code String}s.  The array is ordered based on protocol
+     *         preference, with {@code protocols[0]} being the most preferred.
+     * @see #setApplicationProtocols
+     * @since 9
+     */
+    public String[] getApplicationProtocols() {
+        return applicationProtocols.clone();
+    }
+
+    /**
+     * Sets the prioritized array of application-layer protocol names that
+     * can be negotiated over the SSL/TLS/DTLS protocols.
+     * <p>
+     * If application-layer protocols are supported by the underlying
+     * SSL/TLS implementation, this method configures which values can
+     * be negotiated by protocols such as <a
+     * href="http://www.ietf.org/rfc/rfc7301.txt"> RFC 7301 </a>, the
+     * Application Layer Protocol Negotiation (ALPN).
+     * <p>
+     * If this end of the connection is expected to offer application protocol
+     * values, all protocols configured by this method will be sent to the
+     * peer.
+     * <p>
+     * If this end of the connection is expected to select the application
+     * protocol value, the {@code protocols} configured by this method are
+     * compared with those sent by the peer.  The first matched value becomes
+     * the negotiated value.  If none of the {@code protocols} were actually
+     * requested by the peer, the underlying protocol will determine what
+     * action to take.  (For example, ALPN will send a
+     * {@code "no_application_protocol"} alert and terminate the connection.)
+     *
+     * @implSpec
+     * This method will make a copy of the {@code protocols} array.
+     *
+     * @param protocols   an ordered array of application protocols,
+     *                    with {@code protocols[0]} being the most preferred.
+     *                    If the array is empty (zero-length), protocol
+     *                    indications will not be used.
+     * @throws IllegalArgumentException if protocols is null, or if
+     *                    any element in a non-empty array is null or an
+     *                    empty (zero-length) string
+     * @see #getApplicationProtocols
+     * @since 9
+     */
+    public void setApplicationProtocols(String[] protocols) {
+        if (protocols == null) {
+            throw new IllegalArgumentException("protocols was null");
+        }
+
+        String[] tempProtocols = protocols.clone();
+
+        for (String p : tempProtocols) {
+            if (p == null || p.equals("")) {
+                throw new IllegalArgumentException(
+                    "An element of protocols was null/empty");
+            }
+        }
+        applicationProtocols = tempProtocols;
+    }
+}

src/java.base/share/classes/javax/net/ssl/SSLPeerUnverifiedException.java

@@ -0,0 +1,57 @@
+/*
+ * Copyright (c) 1996, 2013, Oracle and/or its affiliates. All rights reserved.
+ * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
+ *
+ * This code is free software; you can redistribute it and/or modify it
+ * under the terms of the GNU General Public License version 2 only, as
+ * published by the Free Software Foundation.  Oracle designates this
+ * particular file as subject to the "Classpath" exception as provided
+ * by Oracle in the LICENSE file that accompanied this code.
+ *
+ * This code is distributed in the hope that it will be useful, but WITHOUT
+ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
+ * FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License
+ * version 2 for more details (a copy is included in the LICENSE file that
+ * accompanied this code).
+ *
+ * You should have received a copy of the GNU General Public License version
+ * 2 along with this work; if not, write to the Free Software Foundation,
+ * Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.
+ *
+ * Please contact Oracle, 500 Oracle Parkway, Redwood Shores, CA 94065 USA
+ * or visit www.oracle.com if you need additional information or have any
+ * questions.
+ */
+
+
+package javax.net.ssl;
+
+
+/**
+ * Indicates that the peer's identity has not been verified.
+ * <P>
+ * When the peer was not able to
+ * identify itself (for example; no certificate, the particular
+ * cipher suite being used does not support authentication, or no
+ * peer authentication was established during SSL handshaking) this
+ * exception is thrown.
+ *
+ * @since 1.4
+ * @author David Brownell
+ */
+public
+class SSLPeerUnverifiedException extends SSLException
+{
+    private static final long serialVersionUID = -8919512675000600547L;
+
+    /**
+     * Constructs an exception reporting that the SSL peer's
+     * identity has not been verified.
+     *
+     * @param reason describes the problem.
+     */
+    public SSLPeerUnverifiedException(String reason)
+    {
+        super(reason);
+    }
+}

src/java.base/share/classes/javax/net/ssl/SSLPermission.java

@@ -0,0 +1,142 @@
+/*
+ * Copyright (c) 2000, 2017, Oracle and/or its affiliates. All rights reserved.
+ * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
+ *
+ * This code is free software; you can redistribute it and/or modify it
+ * under the terms of the GNU General Public License version 2 only, as
+ * published by the Free Software Foundation.  Oracle designates this
+ * particular file as subject to the "Classpath" exception as provided
+ * by Oracle in the LICENSE file that accompanied this code.
+ *
+ * This code is distributed in the hope that it will be useful, but WITHOUT
+ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
+ * FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License
+ * version 2 for more details (a copy is included in the LICENSE file that
+ * accompanied this code).
+ *
+ * You should have received a copy of the GNU General Public License version
+ * 2 along with this work; if not, write to the Free Software Foundation,
+ * Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.
+ *
+ * Please contact Oracle, 500 Oracle Parkway, Redwood Shores, CA 94065 USA
+ * or visit www.oracle.com if you need additional information or have any
+ * questions.
+ */
+
+package javax.net.ssl;
+
+import java.security.*;
+
+/**
+ * This class is for various network permissions.
+ * An SSLPermission contains a name (also referred to as a "target name") but
+ * no actions list; you either have the named permission
+ * or you don't.
+ * <P>
+ * The target name is the name of the network permission (see below). The naming
+ * convention follows the  hierarchical property naming convention.
+ * Also, an asterisk
+ * may appear at the end of the name, following a ".", or by itself, to
+ * signify a wildcard match. For example: "foo.*" and "*" signify a wildcard
+ * match, while "*foo" and "a*b" do not.
+ * <P>
+ * The following table lists all the possible SSLPermission target names,
+ * and for each provides a description of what the permission allows
+ * and a discussion of the risks of granting code the permission.
+ *
+ * <table class="striped">
+ * <caption style="display:none">permission name, what it allows, and associated risks</caption>
+ * <thead>
+ * <tr>
+ * <th scope="col">Permission Target Name</th>
+ * <th scope="col">What the Permission Allows</th>
+ * <th scope="col">Risks of Allowing this Permission</th>
+ * </tr>
+ * </thead>
+ *
+ * <tbody>
+ * <tr>
+ *   <th scope="row">setHostnameVerifier</th>
+ *   <td>The ability to set a callback which can decide whether to
+ * allow a mismatch between the host being connected to by
+ * an HttpsURLConnection and the common name field in
+ * server certificate.
+ *  </td>
+ *   <td>Malicious
+ * code can set a verifier that monitors host names visited by
+ * HttpsURLConnection requests or that allows server certificates
+ * with invalid common names.
+ * </td>
+ * </tr>
+ *
+ * <tr>
+ *   <th scope="row">getSSLSessionContext</th>
+ *   <td>The ability to get the SSLSessionContext of an SSLSession.
+ * </td>
+ *   <td>Malicious code may monitor sessions which have been established
+ * with SSL peers or might invalidate sessions to slow down performance.
+ * </td>
+ * </tr>
+ *
+ * <tr>
+ *   <th scope="row">setDefaultSSLContext</th>
+ *   <td>The ability to set the default SSL context
+ * </td>
+ *   <td>Malicious code can set a context that monitors the opening of
+ * connections or the plaintext data that is transmitted.
+ * </td>
+ * </tr>
+ *
+ * </tbody>
+ * </table>
+ *
+ * @see java.security.BasicPermission
+ * @see java.security.Permission
+ * @see java.security.Permissions
+ * @see java.security.PermissionCollection
+ * @see java.lang.SecurityManager
+ *
+ * @since 1.4
+ * @author Marianne Mueller
+ * @author Roland Schemers
+ */
+
+public final class SSLPermission extends BasicPermission {
+
+    private static final long serialVersionUID = -3456898025505876775L;
+
+    /**
+     * Creates a new SSLPermission with the specified name.
+     * The name is the symbolic name of the SSLPermission, such as
+     * "setDefaultAuthenticator", etc. An asterisk
+     * may appear at the end of the name, following a ".", or by itself, to
+     * signify a wildcard match.
+     *
+     * @param name the name of the SSLPermission.
+     *
+     * @throws NullPointerException if <code>name</code> is null.
+     * @throws IllegalArgumentException if <code>name</code> is empty.
+     */
+
+    public SSLPermission(String name)
+    {
+        super(name);
+    }
+
+    /**
+     * Creates a new SSLPermission object with the specified name.
+     * The name is the symbolic name of the SSLPermission, and the
+     * actions String is currently unused and should be null.
+     *
+     * @param name the name of the SSLPermission.
+     * @param actions ignored.
+     *
+     * @throws NullPointerException if <code>name</code> is null.
+     * @throws IllegalArgumentException if <code>name</code> is empty.
+     */
+
+    public SSLPermission(String name, String actions)
+    {
+        super(name, actions);
+    }
+}

src/java.base/share/classes/javax/net/ssl/SSLProtocolException.java

@@ -0,0 +1,51 @@
+/*
+ * Copyright (c) 1996, 2003, Oracle and/or its affiliates. All rights reserved.
+ * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
+ *
+ * This code is free software; you can redistribute it and/or modify it
+ * under the terms of the GNU General Public License version 2 only, as
+ * published by the Free Software Foundation.  Oracle designates this
+ * particular file as subject to the "Classpath" exception as provided
+ * by Oracle in the LICENSE file that accompanied this code.
+ *
+ * This code is distributed in the hope that it will be useful, but WITHOUT
+ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
+ * FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License
+ * version 2 for more details (a copy is included in the LICENSE file that
+ * accompanied this code).
+ *
+ * You should have received a copy of the GNU General Public License version
+ * 2 along with this work; if not, write to the Free Software Foundation,
+ * Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.
+ *
+ * Please contact Oracle, 500 Oracle Parkway, Redwood Shores, CA 94065 USA
+ * or visit www.oracle.com if you need additional information or have any
+ * questions.
+ */
+
+
+package javax.net.ssl;
+
+/**
+ * Reports an error in the operation of the SSL protocol.  Normally
+ * this indicates a flaw in one of the protocol implementations.
+ *
+ * @since 1.4
+ * @author David Brownell
+ */
+public
+class SSLProtocolException extends SSLException
+{
+    private static final long serialVersionUID = 5445067063799134928L;
+
+    /**
+     * Constructs an exception reporting an SSL protocol error
+     * detected by an SSL subsystem.
+     *
+     * @param reason describes the problem.
+     */
+    public SSLProtocolException(String reason)
+    {
+        super(reason);
+    }
+}

src/java.base/share/classes/javax/net/ssl/SSLServerSocket.java

@@ -0,0 +1,557 @@
+/*
+ * Copyright (c) 1997, 2017, Oracle and/or its affiliates. All rights reserved.
+ * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
+ *
+ * This code is free software; you can redistribute it and/or modify it
+ * under the terms of the GNU General Public License version 2 only, as
+ * published by the Free Software Foundation.  Oracle designates this
+ * particular file as subject to the "Classpath" exception as provided
+ * by Oracle in the LICENSE file that accompanied this code.
+ *
+ * This code is distributed in the hope that it will be useful, but WITHOUT
+ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
+ * FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License
+ * version 2 for more details (a copy is included in the LICENSE file that
+ * accompanied this code).
+ *
+ * You should have received a copy of the GNU General Public License version
+ * 2 along with this work; if not, write to the Free Software Foundation,
+ * Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.
+ *
+ * Please contact Oracle, 500 Oracle Parkway, Redwood Shores, CA 94065 USA
+ * or visit www.oracle.com if you need additional information or have any
+ * questions.
+ */
+
+
+package javax.net.ssl;
+
+import java.io.*;
+import java.net.*;
+
+
+/**
+ * This class extends <code>ServerSocket</code> and
+ * provides secure server sockets using protocols such as the Secure
+ * Sockets Layer (SSL) or Transport Layer Security (TLS) protocols.
+ * <P>
+ * Instances of this class are generally created using an
+ * <code>SSLServerSocketFactory</code>.  The primary function
+ * of an <code>SSLServerSocket</code>
+ * is to create <code>SSLSocket</code>s by <code>accept</code>ing
+ * connections.
+ * <P>
+ * An <code>SSLServerSocket</code> contains several pieces of state data
+ * which are inherited by the <code>SSLSocket</code> at
+ * socket creation.  These include the enabled cipher
+ * suites and protocols, whether client
+ * authentication is necessary, and whether created sockets should
+ * begin handshaking in client or server mode.  The state
+ * inherited by the created <code>SSLSocket</code> can be
+ * overriden by calling the appropriate methods.
+ *
+ * @see java.net.ServerSocket
+ * @see SSLSocket
+ *
+ * @since 1.4
+ * @author David Brownell
+ */
+public abstract class SSLServerSocket extends ServerSocket {
+
+    /**
+     * Used only by subclasses.
+     * <P>
+     * Create an unbound TCP server socket using the default authentication
+     * context.
+     *
+     * @throws IOException if an I/O error occurs when creating the socket
+     */
+    protected SSLServerSocket()
+    throws IOException
+        { super(); }
+
+
+    /**
+     * Used only by subclasses.
+     * <P>
+     * Create a TCP server socket on a port, using the default
+     * authentication context.  The connection backlog defaults to
+     * fifty connections queued up before the system starts to
+     * reject new connection requests.
+     * <P>
+     * A port number of <code>0</code> creates a socket on any free port.
+     * <P>
+     * If there is a security manager, its <code>checkListen</code>
+     * method is called with the <code>port</code> argument as its
+     * argument to ensure the operation is allowed. This could result
+     * in a SecurityException.
+     *
+     * @param port the port on which to listen
+     * @throws IOException if an I/O error occurs when creating the socket
+     * @throws SecurityException if a security manager exists and its
+     *         <code>checkListen</code> method doesn't allow the operation.
+     * @throws IllegalArgumentException if the port parameter is outside the
+     *         specified range of valid port values, which is between 0 and
+     *         65535, inclusive.
+     * @see    SecurityManager#checkListen
+     */
+    protected SSLServerSocket(int port)
+    throws IOException
+        { super(port); }
+
+
+    /**
+     * Used only by subclasses.
+     * <P>
+     * Create a TCP server socket on a port, using the default
+     * authentication context and a specified backlog of connections.
+     * <P>
+     * A port number of <code>0</code> creates a socket on any free port.
+     * <P>
+     * The <code>backlog</code> argument is the requested maximum number of
+     * pending connections on the socket. Its exact semantics are implementation
+     * specific. In particular, an implementation may impose a maximum length
+     * or may choose to ignore the parameter altogther. The value provided
+     * should be greater than <code>0</code>. If it is less than or equal to
+     * <code>0</code>, then an implementation specific default will be used.
+     * <P>
+     * If there is a security manager, its <code>checkListen</code>
+     * method is called with the <code>port</code> argument as its
+     * argument to ensure the operation is allowed. This could result
+     * in a SecurityException.
+     *
+     * @param port the port on which to listen
+     * @param backlog  requested maximum length of the queue of incoming
+     *                  connections.
+     * @throws IOException if an I/O error occurs when creating the socket
+     * @throws SecurityException if a security manager exists and its
+     *         <code>checkListen</code> method doesn't allow the operation.
+     * @throws IllegalArgumentException if the port parameter is outside the
+     *         specified range of valid port values, which is between 0 and
+     *         65535, inclusive.
+     * @see    SecurityManager#checkListen
+     */
+    protected SSLServerSocket(int port, int backlog)
+    throws IOException
+        { super(port, backlog); }
+
+
+    /**
+     * Used only by subclasses.
+     * <P>
+     * Create a TCP server socket on a port, using the default
+     * authentication context and a specified backlog of connections
+     * as well as a particular specified network interface.  This
+     * constructor is used on multihomed hosts, such as those used
+     * for firewalls or as routers, to control through which interface
+     * a network service is provided.
+     * <P>
+     * If there is a security manager, its <code>checkListen</code>
+     * method is called with the <code>port</code> argument as its
+     * argument to ensure the operation is allowed. This could result
+     * in a SecurityException.
+     * <P>
+     * A port number of <code>0</code> creates a socket on any free port.
+     * <P>
+     * The <code>backlog</code> argument is the requested maximum number of
+     * pending connections on the socket. Its exact semantics are implementation
+     * specific. In particular, an implementation may impose a maximum length
+     * or may choose to ignore the parameter altogther. The value provided
+     * should be greater than <code>0</code>. If it is less than or equal to
+     * <code>0</code>, then an implementation specific default will be used.
+     * <P>
+     * If <i>address</i> is null, it will default accepting connections
+     * on any/all local addresses.
+     *
+     * @param port the port on which to listen
+     * @param backlog  requested maximum length of the queue of incoming
+     *                  connections.
+     * @param address the address of the network interface through
+     *          which connections will be accepted
+     * @throws IOException if an I/O error occurs when creating the socket
+     * @throws SecurityException if a security manager exists and its
+     *         <code>checkListen</code> method doesn't allow the operation.
+     * @throws IllegalArgumentException if the port parameter is outside the
+     *         specified range of valid port values, which is between 0 and
+     *         65535, inclusive.
+     * @see    SecurityManager#checkListen
+     */
+    protected SSLServerSocket(int port, int backlog, InetAddress address)
+    throws IOException
+        { super(port, backlog, address); }
+
+
+
+    /**
+     * Returns the list of cipher suites which are currently enabled
+     * for use by newly accepted connections.
+     * <P>
+     * If this list has not been explicitly modified, a system-provided
+     * default guarantees a minimum quality of service in all enabled
+     * cipher suites.
+     * <P>
+     * Note that even if a suite is enabled, it may never be used. This
+     * can occur if the peer does not support it, or its use is restricted,
+     * or the requisite certificates (and private keys) for the suite are
+     * not available, or an anonymous suite is enabled but authentication
+     * is required.
+     * <P>
+     * The returned array includes cipher suites from the list of standard
+     * cipher suite names in the <a href=
+     * "{@docRoot}/../specs/security/standard-names.html#jsse-cipher-suite-names">
+     * JSSE Cipher Suite Names</a> section of the Java Cryptography
+     * Architecture Standard Algorithm Name Documentation, and may also
+     * include other cipher suites that the provider supports.
+     *
+     * @return an array of cipher suites enabled
+     * @see #getSupportedCipherSuites()
+     * @see #setEnabledCipherSuites(String [])
+     */
+    public abstract String [] getEnabledCipherSuites();
+
+
+    /**
+     * Sets the cipher suites enabled for use by accepted connections.
+     * <P>
+     * The cipher suites must have been listed by getSupportedCipherSuites()
+     * as being supported.  Following a successful call to this method,
+     * only suites listed in the <code>suites</code> parameter are enabled
+     * for use.
+     * <P>
+     * Suites that require authentication information which is not available
+     * in this ServerSocket's authentication context will not be used
+     * in any case, even if they are enabled.
+     * <P>
+     * Note that the standard list of cipher suite names may be found in the
+     * <a href=
+     * "{@docRoot}/../specs/security/standard-names.html#jsse-cipher-suite-names">
+     * JSSE Cipher Suite Names</a> section of the Java Cryptography
+     * Architecture Standard Algorithm Name Documentation.  Providers
+     * may support cipher suite names not found in this list or might not
+     * use the recommended name for a certain cipher suite.
+     * <P>
+     * <code>SSLSocket</code>s returned from <code>accept()</code>
+     * inherit this setting.
+     *
+     * @param suites Names of all the cipher suites to enable
+     * @exception IllegalArgumentException when one or more of ciphers
+     *          named by the parameter is not supported, or when
+     *          the parameter is null.
+     * @see #getSupportedCipherSuites()
+     * @see #getEnabledCipherSuites()
+     */
+    public abstract void setEnabledCipherSuites(String suites []);
+
+
+    /**
+     * Returns the names of the cipher suites which could be enabled for use
+     * on an SSL connection.
+     * <P>
+     * Normally, only a subset of these will actually
+     * be enabled by default, since this list may include cipher suites which
+     * do not meet quality of service requirements for those defaults.  Such
+     * cipher suites are useful in specialized applications.
+     * <P>
+     * The returned array includes cipher suites from the list of standard
+     * cipher suite names in the <a href=
+     * "{@docRoot}/../specs/security/standard-names.html#jsse-cipher-suite-names">
+     * JSSE Cipher Suite Names</a> section of the Java Cryptography
+     * Architecture Standard Algorithm Name Documentation, and may also
+     * include other cipher suites that the provider supports.
+     *
+     * @return an array of cipher suite names
+     * @see #getEnabledCipherSuites()
+     * @see #setEnabledCipherSuites(String [])
+     */
+    public abstract String [] getSupportedCipherSuites();
+
+
+    /**
+     * Returns the names of the protocols which could be enabled for use.
+     *
+     * @return an array of protocol names supported
+     * @see #getEnabledProtocols()
+     * @see #setEnabledProtocols(String [])
+     */
+    public abstract String [] getSupportedProtocols();
+
+
+    /**
+     * Returns the names of the protocols which are currently
+     * enabled for use by the newly accepted connections.
+     * <P>
+     * Note that even if a protocol is enabled, it may never be used.
+     * This can occur if the peer does not support the protocol, or its
+     * use is restricted, or there are no enabled cipher suites supported
+     * by the protocol.
+     *
+     * @return an array of protocol names
+     * @see #getSupportedProtocols()
+     * @see #setEnabledProtocols(String [])
+     */
+    public abstract String [] getEnabledProtocols();
+
+
+    /**
+     * Controls which particular protocols are enabled for use by
+     * accepted connections.
+     * <P>
+     * The protocols must have been listed by
+     * getSupportedProtocols() as being supported.
+     * Following a successful call to this method, only protocols listed
+     * in the <code>protocols</code> parameter are enabled for use.
+     * <P>
+     * <code>SSLSocket</code>s returned from <code>accept()</code>
+     * inherit this setting.
+     *
+     * @param protocols Names of all the protocols to enable.
+     * @exception IllegalArgumentException when one or more of
+     *            the protocols named by the parameter is not supported or
+     *            when the protocols parameter is null.
+     * @see #getEnabledProtocols()
+     * @see #getSupportedProtocols()
+     */
+    public abstract void setEnabledProtocols(String protocols[]);
+
+
+    /**
+     * Controls whether <code>accept</code>ed server-mode
+     * <code>SSLSockets</code> will be initially configured to
+     * <i>require</i> client authentication.
+     * <P>
+     * A socket's client authentication setting is one of the following:
+     * <ul>
+     * <li> client authentication required
+     * <li> client authentication requested
+     * <li> no client authentication desired
+     * </ul>
+     * <P>
+     * Unlike {@link #setWantClientAuth(boolean)}, if the accepted
+     * socket's option is set and the client chooses not to provide
+     * authentication information about itself, <i>the negotiations
+     * will stop and the connection will be dropped</i>.
+     * <P>
+     * Calling this method overrides any previous setting made by
+     * this method or {@link #setWantClientAuth(boolean)}.
+     * <P>
+     * The initial inherited setting may be overridden by calling
+     * {@link SSLSocket#setNeedClientAuth(boolean)} or
+     * {@link SSLSocket#setWantClientAuth(boolean)}.
+     *
+     * @param   need set to true if client authentication is required,
+     *          or false if no client authentication is desired.
+     * @see #getNeedClientAuth()
+     * @see #setWantClientAuth(boolean)
+     * @see #getWantClientAuth()
+     * @see #setUseClientMode(boolean)
+     */
+    public abstract void setNeedClientAuth(boolean need);
+
+
+    /**
+     * Returns true if client authentication will be <i>required</i> on
+     * newly <code>accept</code>ed server-mode <code>SSLSocket</code>s.
+     * <P>
+     * The initial inherited setting may be overridden by calling
+     * {@link SSLSocket#setNeedClientAuth(boolean)} or
+     * {@link SSLSocket#setWantClientAuth(boolean)}.
+     *
+     * @return  true if client authentication is required,
+     *          or false if no client authentication is desired.
+     * @see #setNeedClientAuth(boolean)
+     * @see #setWantClientAuth(boolean)
+     * @see #getWantClientAuth()
+     * @see #setUseClientMode(boolean)
+     */
+    public abstract boolean getNeedClientAuth();
+
+
+    /**
+     * Controls whether <code>accept</code>ed server-mode
+     * <code>SSLSockets</code> will be initially configured to
+     * <i>request</i> client authentication.
+     * <P>
+     * A socket's client authentication setting is one of the following:
+     * <ul>
+     * <li> client authentication required
+     * <li> client authentication requested
+     * <li> no client authentication desired
+     * </ul>
+     * <P>
+     * Unlike {@link #setNeedClientAuth(boolean)}, if the accepted
+     * socket's option is set and the client chooses not to provide
+     * authentication information about itself, <i>the negotiations
+     * will continue</i>.
+     * <P>
+     * Calling this method overrides any previous setting made by
+     * this method or {@link #setNeedClientAuth(boolean)}.
+     * <P>
+     * The initial inherited setting may be overridden by calling
+     * {@link SSLSocket#setNeedClientAuth(boolean)} or
+     * {@link SSLSocket#setWantClientAuth(boolean)}.
+     *
+     * @param   want set to true if client authentication is requested,
+     *          or false if no client authentication is desired.
+     * @see #getWantClientAuth()
+     * @see #setNeedClientAuth(boolean)
+     * @see #getNeedClientAuth()
+     * @see #setUseClientMode(boolean)
+     */
+    public abstract void setWantClientAuth(boolean want);
+
+
+    /**
+     * Returns true if client authentication will be <i>requested</i> on
+     * newly accepted server-mode connections.
+     * <P>
+     * The initial inherited setting may be overridden by calling
+     * {@link SSLSocket#setNeedClientAuth(boolean)} or
+     * {@link SSLSocket#setWantClientAuth(boolean)}.
+     *
+     * @return  true if client authentication is requested,
+     *          or false if no client authentication is desired.
+     * @see #setWantClientAuth(boolean)
+     * @see #setNeedClientAuth(boolean)
+     * @see #getNeedClientAuth()
+     * @see #setUseClientMode(boolean)
+     */
+    public abstract boolean getWantClientAuth();
+
+
+    /**
+     * Controls whether accepted connections are in the (default) SSL
+     * server mode, or the SSL client mode.
+     * <P>
+     * Servers normally authenticate themselves, and clients are not
+     * required to do so.
+     * <P>
+     * In rare cases, TCP servers
+     * need to act in the SSL client mode on newly accepted
+     * connections. For example, FTP clients acquire server sockets
+     * and listen there for reverse connections from the server. An
+     * FTP client would use an SSLServerSocket in "client" mode to
+     * accept the reverse connection while the FTP server uses an
+     * SSLSocket with "client" mode disabled to initiate the
+     * connection. During the resulting handshake, existing SSL
+     * sessions may be reused.
+     * <P>
+     * <code>SSLSocket</code>s returned from <code>accept()</code>
+     * inherit this setting.
+     *
+     * @param mode true if newly accepted connections should use SSL
+     *          client mode.
+     * @see #getUseClientMode()
+     */
+    public abstract void setUseClientMode(boolean mode);
+
+
+    /**
+     * Returns true if accepted connections will be in SSL client mode.
+     *
+     * @see #setUseClientMode(boolean)
+     * @return true if the connection should use SSL client mode.
+     */
+    public abstract boolean getUseClientMode();
+
+
+    /**
+     * Controls whether new SSL sessions may be established by the
+     * sockets which are created from this server socket.
+     * <P>
+     * <code>SSLSocket</code>s returned from <code>accept()</code>
+     * inherit this setting.
+     *
+     * @param flag true indicates that sessions may be created; this
+     *          is the default. false indicates that an existing session
+     *          must be resumed.
+     * @see #getEnableSessionCreation()
+     */
+    public abstract void setEnableSessionCreation(boolean flag);
+
+
+    /**
+     * Returns true if new SSL sessions may be established by the
+     * sockets which are created from this server socket.
+     *
+     * @return true indicates that sessions may be created; this
+     *          is the default.  false indicates that an existing
+     *          session must be resumed
+     * @see #setEnableSessionCreation(boolean)
+     */
+    public abstract boolean getEnableSessionCreation();
+
+    /**
+     * Returns the SSLParameters in effect for newly accepted connections.
+     * The ciphersuites and protocols of the returned SSLParameters
+     * are always non-null.
+     *
+     * @return the SSLParameters in effect for newly accepted connections
+     *
+     * @see #setSSLParameters(SSLParameters)
+     *
+     * @since 1.7
+     */
+    public SSLParameters getSSLParameters() {
+        SSLParameters parameters = new SSLParameters();
+
+        parameters.setCipherSuites(getEnabledCipherSuites());
+        parameters.setProtocols(getEnabledProtocols());
+        if (getNeedClientAuth()) {
+            parameters.setNeedClientAuth(true);
+        } else if (getWantClientAuth()) {
+            parameters.setWantClientAuth(true);
+        }
+
+        return parameters;
+    }
+
+    /**
+     * Applies SSLParameters to newly accepted connections.
+     *
+     * <p>This means:
+     * <ul>
+     * <li>If {@code params.getCipherSuites()} is non-null,
+     *   {@code setEnabledCipherSuites()} is called with that value.</li>
+     * <li>If {@code params.getProtocols()} is non-null,
+     *   {@code setEnabledProtocols()} is called with that value.</li>
+     * <li>If {@code params.getNeedClientAuth()} or
+     *   {@code params.getWantClientAuth()} return {@code true},
+     *   {@code setNeedClientAuth(true)} and
+     *   {@code setWantClientAuth(true)} are called, respectively;
+     *   otherwise {@code setWantClientAuth(false)} is called.</li>
+     * <li>If {@code params.getServerNames()} is non-null, the socket will
+     *   configure its server names with that value.</li>
+     * <li>If {@code params.getSNIMatchers()} is non-null, the socket will
+     *   configure its SNI matchers with that value.</li>
+     * </ul>
+     *
+     * @param params the parameters
+     * @throws IllegalArgumentException if the setEnabledCipherSuites() or
+     *    the setEnabledProtocols() call fails
+     *
+     * @see #getSSLParameters()
+     *
+     * @since 1.7
+     */
+    public void setSSLParameters(SSLParameters params) {
+        String[] s;
+        s = params.getCipherSuites();
+        if (s != null) {
+            setEnabledCipherSuites(s);
+        }
+
+        s = params.getProtocols();
+        if (s != null) {
+            setEnabledProtocols(s);
+        }
+
+        if (params.getNeedClientAuth()) {
+            setNeedClientAuth(true);
+        } else if (params.getWantClientAuth()) {
+            setWantClientAuth(true);
+        } else {
+            setWantClientAuth(false);
+        }
+    }
+
+}

src/java.base/share/classes/javax/net/ssl/SSLServerSocketFactory.java

@@ -0,0 +1,215 @@
+/*
+ * Copyright (c) 1997, 2017, Oracle and/or its affiliates. All rights reserved.
+ * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
+ *
+ * This code is free software; you can redistribute it and/or modify it
+ * under the terms of the GNU General Public License version 2 only, as
+ * published by the Free Software Foundation.  Oracle designates this
+ * particular file as subject to the "Classpath" exception as provided
+ * by Oracle in the LICENSE file that accompanied this code.
+ *
+ * This code is distributed in the hope that it will be useful, but WITHOUT
+ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
+ * FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License
+ * version 2 for more details (a copy is included in the LICENSE file that
+ * accompanied this code).
+ *
+ * You should have received a copy of the GNU General Public License version
+ * 2 along with this work; if not, write to the Free Software Foundation,
+ * Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.
+ *
+ * Please contact Oracle, 500 Oracle Parkway, Redwood Shores, CA 94065 USA
+ * or visit www.oracle.com if you need additional information or have any
+ * questions.
+ */
+
+
+package javax.net.ssl;
+
+import java.io.IOException;
+import java.net.InetAddress;
+import java.net.ServerSocket;
+import java.net.SocketException;
+import javax.net.ServerSocketFactory;
+import java.security.*;
+
+/**
+ * <code>SSLServerSocketFactory</code>s create
+ * <code>SSLServerSocket</code>s.
+ *
+ * @since 1.4
+ * @see SSLSocket
+ * @see SSLServerSocket
+ * @author David Brownell
+ */
+public abstract class SSLServerSocketFactory extends ServerSocketFactory
+{
+    private static SSLServerSocketFactory theFactory;
+
+    private static boolean propertyChecked;
+
+    private static void log(String msg) {
+        if (SSLSocketFactory.DEBUG) {
+            System.out.println(msg);
+        }
+    }
+
+    /**
+     * Constructor is used only by subclasses.
+     */
+    protected SSLServerSocketFactory() { /* NOTHING */ }
+
+    /**
+     * Returns the default SSL server socket factory.
+     *
+     * <p>The first time this method is called, the security property
+     * "ssl.ServerSocketFactory.provider" is examined. If it is non-null, a
+     * class by that name is loaded and instantiated. If that is successful and
+     * the object is an instance of SSLServerSocketFactory, it is made the
+     * default SSL server socket factory.
+     *
+     * <p>Otherwise, this method returns
+     * <code>SSLContext.getDefault().getServerSocketFactory()</code>. If that
+     * call fails, an inoperative factory is returned.
+     *
+     * @return the default <code>ServerSocketFactory</code>
+     * @see SSLContext#getDefault
+     */
+    public static synchronized ServerSocketFactory getDefault() {
+        if (theFactory != null) {
+            return theFactory;
+        }
+
+        if (propertyChecked == false) {
+            propertyChecked = true;
+            String clsName = SSLSocketFactory.getSecurityProperty
+                                        ("ssl.ServerSocketFactory.provider");
+            if (clsName != null) {
+                log("setting up default SSLServerSocketFactory");
+                try {
+                    Class<?> cls = null;
+                    try {
+                        cls = Class.forName(clsName);
+                    } catch (ClassNotFoundException e) {
+                        ClassLoader cl = ClassLoader.getSystemClassLoader();
+                        if (cl != null) {
+                            cls = cl.loadClass(clsName);
+                        }
+                    }
+                    log("class " + clsName + " is loaded");
+                    @SuppressWarnings("deprecation")
+                    SSLServerSocketFactory fac = (SSLServerSocketFactory)cls.newInstance();
+                    log("instantiated an instance of class " + clsName);
+                    theFactory = fac;
+                    return fac;
+                } catch (Exception e) {
+                    log("SSLServerSocketFactory instantiation failed: " + e);
+                    theFactory = new DefaultSSLServerSocketFactory(e);
+                    return theFactory;
+                }
+            }
+        }
+
+        try {
+            return SSLContext.getDefault().getServerSocketFactory();
+        } catch (NoSuchAlgorithmException e) {
+            return new DefaultSSLServerSocketFactory(e);
+        }
+    }
+
+    /**
+     * Returns the list of cipher suites which are enabled by default.
+     * Unless a different list is enabled, handshaking on an SSL connection
+     * will use one of these cipher suites.  The minimum quality of service
+     * for these defaults requires confidentiality protection and server
+     * authentication (that is, no anonymous cipher suites).
+     * <P>
+     * The returned array includes cipher suites from the list of standard
+     * cipher suite names in the <a href=
+     * "{@docRoot}/../specs/security/standard-names.html#jsse-cipher-suite-names">
+     * JSSE Cipher Suite Names</a> section of the Java Cryptography
+     * Architecture Standard Algorithm Name Documentation, and may also
+     * include other cipher suites that the provider supports.
+     *
+     * @see #getSupportedCipherSuites()
+     * @return array of the cipher suites enabled by default
+     */
+    public abstract String [] getDefaultCipherSuites();
+
+
+    /**
+     * Returns the names of the cipher suites which could be enabled for use
+     * on an SSL connection created by this factory.
+     * Normally, only a subset of these will actually
+     * be enabled by default, since this list may include cipher suites which
+     * do not meet quality of service requirements for those defaults.  Such
+     * cipher suites are useful in specialized applications.
+     * <P>
+     * The returned array includes cipher suites from the list of standard
+     * cipher suite names in the <a href=
+     * "{@docRoot}/../specs/security/standard-names.html#jsse-cipher-suite-names">
+     * JSSE Cipher Suite Names</a> section of the Java Cryptography
+     * Architecture Standard Algorithm Name Documentation, and may also
+     * include other cipher suites that the provider supports.
+     *
+     * @return an array of cipher suite names
+     * @see #getDefaultCipherSuites()
+     */
+    public abstract String [] getSupportedCipherSuites();
+}
+
+
+//
+// The default factory does NOTHING.
+//
+class DefaultSSLServerSocketFactory extends SSLServerSocketFactory {
+
+    private final Exception reason;
+
+    DefaultSSLServerSocketFactory(Exception reason) {
+        this.reason = reason;
+    }
+
+    private ServerSocket throwException() throws SocketException {
+        throw (SocketException)
+            new SocketException(reason.toString()).initCause(reason);
+    }
+
+    @Override
+    public ServerSocket createServerSocket() throws IOException {
+        return throwException();
+    }
+
+
+    @Override
+    public ServerSocket createServerSocket(int port)
+    throws IOException
+    {
+        return throwException();
+    }
+
+    @Override
+    public ServerSocket createServerSocket(int port, int backlog)
+    throws IOException
+    {
+        return throwException();
+    }
+
+    @Override
+    public ServerSocket
+    createServerSocket(int port, int backlog, InetAddress ifAddress)
+    throws IOException
+    {
+        return throwException();
+    }
+
+    @Override
+    public String [] getDefaultCipherSuites() {
+        return new String[0];
+    }
+
+    @Override
+    public String [] getSupportedCipherSuites() {
+        return new String[0];
+    }
+}

src/java.base/share/classes/javax/net/ssl/SSLSession.java

@@ -0,0 +1,420 @@
+/*
+ * Copyright (c) 1997, 2017, Oracle and/or its affiliates. All rights reserved.
+ * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
+ *
+ * This code is free software; you can redistribute it and/or modify it
+ * under the terms of the GNU General Public License version 2 only, as
+ * published by the Free Software Foundation.  Oracle designates this
+ * particular file as subject to the "Classpath" exception as provided
+ * by Oracle in the LICENSE file that accompanied this code.
+ *
+ * This code is distributed in the hope that it will be useful, but WITHOUT
+ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
+ * FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License
+ * version 2 for more details (a copy is included in the LICENSE file that
+ * accompanied this code).
+ *
+ * You should have received a copy of the GNU General Public License version
+ * 2 along with this work; if not, write to the Free Software Foundation,
+ * Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.
+ *
+ * Please contact Oracle, 500 Oracle Parkway, Redwood Shores, CA 94065 USA
+ * or visit www.oracle.com if you need additional information or have any
+ * questions.
+ */
+
+package javax.net.ssl;
+
+import java.security.Principal;
+
+/**
+ * In SSL, sessions are used to describe an ongoing relationship between
+ * two entities.  Each SSL connection involves one session at a time, but
+ * that session may be used on many connections between those entities,
+ * simultaneously or sequentially.  The session used on a connection may
+ * also be replaced by a different session.  Sessions are created, or
+ * rejoined, as part of the SSL handshaking protocol. Sessions may be
+ * invalidated due to policies affecting security or resource usage,
+ * or by an application explicitly calling {@code invalidate}.
+ * Session management policies are typically used to tune performance.
+ *
+ * <P> In addition to the standard session attributes, SSL sessions expose
+ * these read-only attributes:  <UL>
+ *
+ *      <LI> <em>Peer Identity.</em>  Sessions are between a particular
+ *      client and a particular server.  The identity of the peer may
+ *      have been established as part of session setup.  Peers are
+ *      generally identified by X.509 certificate chains.
+ *
+ *      <LI> <em>Cipher Suite Name.</em>  Cipher suites describe the
+ *      kind of cryptographic protection that's used by connections
+ *      in a particular session.
+ *
+ *      <LI> <em>Peer Host.</em>  All connections in a session are
+ *      between the same two hosts.  The address of the host on the other
+ *      side of the connection is available.
+ *
+ *      </UL>
+ *
+ * <P> Sessions may be explicitly invalidated.  Invalidation may also
+ * be done implicitly, when faced with certain kinds of errors.
+ *
+ * @since 1.4
+ * @author David Brownell
+ */
+public interface SSLSession {
+
+    /**
+     * Returns the identifier assigned to this Session.
+     *
+     * @return the Session identifier
+     */
+    public byte[] getId();
+
+
+    /**
+     * Returns the context in which this session is bound.
+     * <P>
+     * This context may be unavailable in some environments,
+     * in which case this method returns null.
+     * <P>
+     * If the context is available and there is a
+     * security manager installed, the caller may require
+     * permission to access it or a security exception may be thrown.
+     * In a Java environment, the security manager's
+     * {@code checkPermission} method is called with a
+     * {@code SSLPermission("getSSLSessionContext")} permission.
+     *
+     * @throws SecurityException if the calling thread does not have
+     *         permission to get SSL session context.
+     * @return the session context used for this session, or null
+     * if the context is unavailable.
+     */
+    public SSLSessionContext getSessionContext();
+
+
+    /**
+     * Returns the time at which this Session representation was created,
+     * in milliseconds since midnight, January 1, 1970 UTC.
+     *
+     * @return the time this Session was created
+     */
+    public long getCreationTime();
+
+
+    /**
+     * Returns the last time this Session representation was accessed by the
+     * session level infrastructure, in milliseconds since
+     * midnight, January 1, 1970 UTC.
+     * <P>
+     * Access indicates a new connection being established using session data.
+     * Application level operations, such as getting or setting a value
+     * associated with the session, are not reflected in this access time.
+     *
+     * <P> This information is particularly useful in session management
+     * policies.  For example, a session manager thread could leave all
+     * sessions in a given context which haven't been used in a long time;
+     * or, the sessions might be sorted according to age to optimize some task.
+     *
+     * @return the last time this Session was accessed
+     */
+    public long getLastAccessedTime();
+
+
+    /**
+     * Invalidates the session.
+     * <P>
+     * Future connections will not be able to
+     * resume or join this session.  However, any existing connection
+     * using this session can continue to use the session until the
+     * connection is closed.
+     *
+     * @see #isValid()
+     */
+    public void invalidate();
+
+
+    /**
+     * Returns whether this session is valid and available for resuming or
+     * joining.
+     *
+     * @return true if this session may be rejoined.
+     * @see #invalidate()
+     *
+     * @since 1.5
+     */
+    public boolean isValid();
+
+
+    /**
+     *
+     * Binds the specified {@code value} object into the
+     * session's application layer data
+     * with the given {@code name}.
+     * <P>
+     * Any existing binding using the same {@code name} is
+     * replaced.  If the new (or existing) {@code value} implements the
+     * {@code SSLSessionBindingListener} interface, the object
+     * represented by {@code value} is notified appropriately.
+     * <p>
+     * For security reasons, the same named values may not be
+     * visible across different access control contexts.
+     *
+     * @param name the name to which the data object will be bound.
+     *          This may not be null.
+     * @param value the data object to be bound. This may not be null.
+     * @throws IllegalArgumentException if either argument is null.
+     */
+    public void putValue(String name, Object value);
+
+
+    /**
+     * Returns the object bound to the given name in the session's
+     * application layer data.  Returns null if there is no such binding.
+     * <p>
+     * For security reasons, the same named values may not be
+     * visible across different access control contexts.
+     *
+     * @param name the name of the binding to find.
+     * @return the value bound to that name, or null if the binding does
+     *          not exist.
+     * @throws IllegalArgumentException if the argument is null.
+     */
+    public Object getValue(String name);
+
+
+    /**
+     * Removes the object bound to the given name in the session's
+     * application layer data.  Does nothing if there is no object
+     * bound to the given name.  If the bound existing object
+     * implements the {@code SessionBindingListener} interface,
+     * it is notified appropriately.
+     * <p>
+     * For security reasons, the same named values may not be
+     * visible across different access control contexts.
+     *
+     * @param name the name of the object to remove visible
+     *          across different access control contexts
+     * @throws IllegalArgumentException if the argument is null.
+     */
+    public void removeValue(String name);
+
+
+    /**
+     * Returns an array of the names of all the application layer
+     * data objects bound into the Session.
+     * <p>
+     * For security reasons, the same named values may not be
+     * visible across different access control contexts.
+     *
+     * @return a non-null (possibly empty) array of names of the objects
+     *  bound to this Session.
+     */
+    public String [] getValueNames();
+
+    /**
+     * Returns the identity of the peer which was established as part
+     * of defining the session.
+     * <P>
+     * Note: This method can be used only when using certificate-based
+     * cipher suites; using it with non-certificate-based cipher suites,
+     * such as Kerberos, will throw an SSLPeerUnverifiedException.
+     * <P>
+     * Note: The returned value may not be a valid certificate chain
+     * and should not be relied on for trust decisions.
+     *
+     * @return an ordered array of peer certificates,
+     *          with the peer's own certificate first followed by any
+     *          certificate authorities.
+     * @exception SSLPeerUnverifiedException if the peer's identity has not
+     *          been verified
+     * @see #getPeerPrincipal()
+     */
+    public java.security.cert.Certificate [] getPeerCertificates()
+            throws SSLPeerUnverifiedException;
+
+    /**
+     * Returns the certificate(s) that were sent to the peer during
+     * handshaking.
+     * <P>
+     * Note: This method is useful only when using certificate-based
+     * cipher suites.
+     * <P>
+     * When multiple certificates are available for use in a
+     * handshake, the implementation chooses what it considers the
+     * "best" certificate chain available, and transmits that to
+     * the other side.  This method allows the caller to know
+     * which certificate chain was actually used.
+     *
+     * @return an ordered array of certificates,
+     * with the local certificate first followed by any
+     * certificate authorities.  If no certificates were sent,
+     * then null is returned.
+     *
+     * @see #getLocalPrincipal()
+     */
+    public java.security.cert.Certificate [] getLocalCertificates();
+
+    /**
+     * Returns the identity of the peer which was identified as part
+     * of defining the session.
+     * <P>
+     * Note: This method can be used only when using certificate-based
+     * cipher suites; using it with non-certificate-based cipher suites,
+     * such as Kerberos, will throw an SSLPeerUnverifiedException.
+     * <P>
+     * Note: The returned value may not be a valid certificate chain
+     * and should not be relied on for trust decisions.
+     *
+     * <p><em>Note: this method exists for compatibility with previous
+     * releases. New applications should use
+     * {@link #getPeerCertificates} instead.</em></p>
+     *
+     * @return an ordered array of peer X.509 certificates,
+     *          with the peer's own certificate first followed by any
+     *          certificate authorities.  (The certificates are in
+     *          the original JSSE certificate
+     *          {@link javax.security.cert.X509Certificate} format.)
+     * @exception SSLPeerUnverifiedException if the peer's identity
+     *          has not been verified
+     * @see #getPeerPrincipal()
+     * @deprecated The {@link #getPeerCertificates()} method that returns an
+     *               array of {@code java.security.cert.Certificate} should
+     *               be used instead.
+     */
+    @Deprecated(since="9")
+    public javax.security.cert.X509Certificate [] getPeerCertificateChain()
+            throws SSLPeerUnverifiedException;
+
+    /**
+     * Returns the identity of the peer which was established as part of
+     * defining the session.
+     *
+     * @return the peer's principal. Returns an X500Principal of the
+     * end-entity certiticate for X509-based cipher suites, and
+     * KerberosPrincipal for Kerberos cipher suites.
+     *
+     * @throws SSLPeerUnverifiedException if the peer's identity has not
+     *          been verified
+     *
+     * @see #getPeerCertificates()
+     * @see #getLocalPrincipal()
+     *
+     * @since 1.5
+     */
+    public Principal getPeerPrincipal()
+            throws SSLPeerUnverifiedException;
+
+    /**
+     * Returns the principal that was sent to the peer during handshaking.
+     *
+     * @return the principal sent to the peer. Returns an X500Principal
+     * of the end-entity certificate for X509-based cipher suites, and
+     * KerberosPrincipal for Kerberos cipher suites. If no principal was
+     * sent, then null is returned.
+     *
+     * @see #getLocalCertificates()
+     * @see #getPeerPrincipal()
+     *
+     * @since 1.5
+     */
+    public Principal getLocalPrincipal();
+
+    /**
+     * Returns the name of the SSL cipher suite which is used for all
+     * connections in the session.
+     *
+     * <P> This defines the level of protection
+     * provided to the data sent on the connection, including the kind
+     * of encryption used and most aspects of how authentication is done.
+     *
+     * @return the name of the session's cipher suite
+     */
+    public String getCipherSuite();
+
+    /**
+     * Returns the standard name of the protocol used for all
+     * connections in the session.
+     *
+     * <P> This defines the protocol used in the connection.
+     *
+     * @return the standard name of the protocol used for all
+     * connections in the session.
+     */
+    public String getProtocol();
+
+    /**
+     * Returns the host name of the peer in this session.
+     * <P>
+     * For the server, this is the client's host;  and for
+     * the client, it is the server's host. The name may not be
+     * a fully qualified host name or even a host name at all as
+     * it may represent a string encoding of the peer's network address.
+     * If such a name is desired, it might
+     * be resolved through a name service based on the value returned
+     * by this method.
+     * <P>
+     * This value is not authenticated and should not be relied upon.
+     * It is mainly used as a hint for {@code SSLSession} caching
+     * strategies.
+     *
+     * @return  the host name of the peer host, or null if no information
+     *          is available.
+     */
+    public String getPeerHost();
+
+    /**
+     * Returns the port number of the peer in this session.
+     * <P>
+     * For the server, this is the client's port number;  and for
+     * the client, it is the server's port number.
+     * <P>
+     * This value is not authenticated and should not be relied upon.
+     * It is mainly used as a hint for {@code SSLSession} caching
+     * strategies.
+     *
+     * @return  the port number of the peer host, or -1 if no information
+     *          is available.
+     *
+     * @since 1.5
+     */
+    public int getPeerPort();
+
+    /**
+     * Gets the current size of the largest SSL/TLS/DTLS packet that is
+     * expected when using this session.
+     * <P>
+     * An {@code SSLEngine} using this session may generate SSL/TLS/DTLS
+     * packets of any size up to and including the value returned by this
+     * method. All {@code SSLEngine} network buffers should be sized
+     * at least this large to avoid insufficient space problems when
+     * performing {@code wrap} and {@code unwrap} calls.
+     *
+     * @return  the current maximum expected network packet size
+     *
+     * @see SSLEngine#wrap(ByteBuffer, ByteBuffer)
+     * @see SSLEngine#unwrap(ByteBuffer, ByteBuffer)
+     *
+     * @since 1.5
+     */
+    public int getPacketBufferSize();
+
+
+    /**
+     * Gets the current size of the largest application data that is
+     * expected when using this session.
+     * <P>
+     * {@code SSLEngine} application data buffers must be large
+     * enough to hold the application data from any inbound network
+     * application data packet received.  Typically, outbound
+     * application data buffers can be of any size.
+     *
+     * @return  the current maximum expected application packet size
+     *
+     * @see SSLEngine#wrap(ByteBuffer, ByteBuffer)
+     * @see SSLEngine#unwrap(ByteBuffer, ByteBuffer)
+     *
+     * @since 1.5
+     */
+    public int getApplicationBufferSize();
+}

src/java.base/share/classes/javax/net/ssl/SSLSessionBindingEvent.java

@@ -0,0 +1,93 @@
+/*
+ * Copyright (c) 1997, 2005, Oracle and/or its affiliates. All rights reserved.
+ * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
+ *
+ * This code is free software; you can redistribute it and/or modify it
+ * under the terms of the GNU General Public License version 2 only, as
+ * published by the Free Software Foundation.  Oracle designates this
+ * particular file as subject to the "Classpath" exception as provided
+ * by Oracle in the LICENSE file that accompanied this code.
+ *
+ * This code is distributed in the hope that it will be useful, but WITHOUT
+ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
+ * FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License
+ * version 2 for more details (a copy is included in the LICENSE file that
+ * accompanied this code).
+ *
+ * You should have received a copy of the GNU General Public License version
+ * 2 along with this work; if not, write to the Free Software Foundation,
+ * Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.
+ *
+ * Please contact Oracle, 500 Oracle Parkway, Redwood Shores, CA 94065 USA
+ * or visit www.oracle.com if you need additional information or have any
+ * questions.
+ */
+
+
+package javax.net.ssl;
+
+import java.util.EventObject;
+
+
+/**
+ * This event is propagated to a SSLSessionBindingListener.
+ * When a listener object is bound or unbound to an SSLSession by
+ * {@link SSLSession#putValue(String, Object)}
+ * or {@link SSLSession#removeValue(String)}, objects which
+ * implement the SSLSessionBindingListener will be receive an
+ * event of this type.  The event's <code>name</code> field is the
+ * key in which the listener is being bound or unbound.
+ *
+ * @see SSLSession
+ * @see SSLSessionBindingListener
+ *
+ * @since 1.4
+ * @author Nathan Abramson
+ * @author David Brownell
+ */
+public
+class SSLSessionBindingEvent
+extends EventObject
+{
+    private static final long serialVersionUID = 3989172637106345L;
+
+    /**
+     * @serial The name to which the object is being bound or unbound
+     */
+    private String name;
+
+    /**
+     * Constructs a new SSLSessionBindingEvent.
+     *
+     * @param session the SSLSession acting as the source of the event
+     * @param name the name to which the object is being bound or unbound
+     * @exception  IllegalArgumentException  if <code>session</code> is null.
+     */
+    public SSLSessionBindingEvent(SSLSession session, String name)
+    {
+        super(session);
+        this.name = name;
+    }
+
+    /**
+     * Returns the name to which the object is being bound, or the name
+     * from which the object is being unbound.
+     *
+     * @return the name to which the object is being bound or unbound
+     */
+    public String getName()
+    {
+        return name;
+    }
+
+    /**
+     * Returns the SSLSession into which the listener is being bound or
+     * from which the listener is being unbound.
+     *
+     * @return the <code>SSLSession</code>
+     */
+    public SSLSession getSession()
+    {
+        return (SSLSession) getSource();
+    }
+}

src/java.base/share/classes/javax/net/ssl/SSLSessionBindingListener.java

@@ -0,0 +1,66 @@
+/*
+ * Copyright (c) 1997, 2001, Oracle and/or its affiliates. All rights reserved.
+ * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
+ *
+ * This code is free software; you can redistribute it and/or modify it
+ * under the terms of the GNU General Public License version 2 only, as
+ * published by the Free Software Foundation.  Oracle designates this
+ * particular file as subject to the "Classpath" exception as provided
+ * by Oracle in the LICENSE file that accompanied this code.
+ *
+ * This code is distributed in the hope that it will be useful, but WITHOUT
+ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
+ * FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License
+ * version 2 for more details (a copy is included in the LICENSE file that
+ * accompanied this code).
+ *
+ * You should have received a copy of the GNU General Public License version
+ * 2 along with this work; if not, write to the Free Software Foundation,
+ * Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.
+ *
+ * Please contact Oracle, 500 Oracle Parkway, Redwood Shores, CA 94065 USA
+ * or visit www.oracle.com if you need additional information or have any
+ * questions.
+ */
+
+
+package javax.net.ssl;
+
+import java.util.EventListener;
+
+/**
+ * This interface is implemented by objects which want to know when
+ * they are being bound or unbound from a SSLSession.  When either event
+ * occurs via {@link SSLSession#putValue(String, Object)}
+ * or {@link SSLSession#removeValue(String)}, the event is communicated
+ * through a SSLSessionBindingEvent identifying the session.
+ *
+ * @see SSLSession
+ * @see SSLSessionBindingEvent
+ *
+ * @since 1.4
+ * @author Nathan Abramson
+ * @author David Brownell
+ */
+public
+interface SSLSessionBindingListener
+extends EventListener
+{
+    /**
+     * This is called to notify the listener that it is being bound into
+     * an SSLSession.
+     *
+     * @param event the event identifying the SSLSession into
+     *          which the listener is being bound.
+     */
+    public void valueBound(SSLSessionBindingEvent event);
+
+    /**
+     * This is called to notify the listener that it is being unbound
+     * from a SSLSession.
+     *
+     * @param event the event identifying the SSLSession from
+     *          which the listener is being unbound.
+     */
+    public void valueUnbound(SSLSessionBindingEvent event);
+}

src/java.base/share/classes/javax/net/ssl/SSLSessionContext.java

@@ -0,0 +1,141 @@
+/*
+ * Copyright (c) 1997, 2013, Oracle and/or its affiliates. All rights reserved.
+ * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
+ *
+ * This code is free software; you can redistribute it and/or modify it
+ * under the terms of the GNU General Public License version 2 only, as
+ * published by the Free Software Foundation.  Oracle designates this
+ * particular file as subject to the "Classpath" exception as provided
+ * by Oracle in the LICENSE file that accompanied this code.
+ *
+ * This code is distributed in the hope that it will be useful, but WITHOUT
+ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
+ * FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License
+ * version 2 for more details (a copy is included in the LICENSE file that
+ * accompanied this code).
+ *
+ * You should have received a copy of the GNU General Public License version
+ * 2 along with this work; if not, write to the Free Software Foundation,
+ * Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.
+ *
+ * Please contact Oracle, 500 Oracle Parkway, Redwood Shores, CA 94065 USA
+ * or visit www.oracle.com if you need additional information or have any
+ * questions.
+ */
+
+
+package javax.net.ssl;
+
+import java.util.Enumeration;
+
+
+/**
+ * A <code>SSLSessionContext</code> represents a set of
+ * <code>SSLSession</code>s associated with a single entity. For example,
+ * it could be associated with a server or client who participates in many
+ * sessions concurrently.
+ * <p>
+ * Not all environments will contain session contexts.
+ * <p>
+ * There are <code>SSLSessionContext</code> parameters that affect how
+ * sessions are stored:
+ * <UL>
+ *      <LI>Sessions can be set to expire after a specified
+ *      time limit.
+ *      <LI>The number of sessions that can be stored in context
+ *      can be limited.
+ * </UL>
+ * A session can be retrieved based on its session id, and all session id's
+ * in a <code>SSLSessionContext</code> can be listed.
+ *
+ * @see SSLSession
+ *
+ * @since 1.4
+ * @author Nathan Abramson
+ * @author David Brownell
+ */
+public interface SSLSessionContext {
+
+    /**
+     * Returns the <code>SSLSession</code> bound to the specified session id.
+     *
+     * @param sessionId the Session identifier
+     * @return the <code>SSLSession</code> or null if
+     * the specified session id does not refer to a valid SSLSession.
+     *
+     * @throws NullPointerException if <code>sessionId</code> is null.
+     */
+    public SSLSession getSession(byte[] sessionId);
+
+    /**
+     * Returns an Enumeration of all session id's grouped under this
+     * <code>SSLSessionContext</code>.
+     *
+     * @return an enumeration of all the Session id's
+     */
+    public Enumeration<byte[]> getIds();
+
+    /**
+     * Sets the timeout limit for <code>SSLSession</code> objects grouped
+     * under this <code>SSLSessionContext</code>.
+     * <p>
+     * If the timeout limit is set to 't' seconds, a session exceeds the
+     * timeout limit 't' seconds after its creation time.
+     * When the timeout limit is exceeded for a session, the
+     * <code>SSLSession</code> object is invalidated and future connections
+     * cannot resume or rejoin the session.
+     * A check for sessions exceeding the timeout is made immediately whenever
+     * the timeout limit is changed for this <code>SSLSessionContext</code>.
+     *
+     * @param seconds the new session timeout limit in seconds; zero means
+     *          there is no limit.
+     *
+     * @exception IllegalArgumentException if the timeout specified is {@code < 0}.
+     * @see #getSessionTimeout
+     */
+    public void setSessionTimeout(int seconds)
+                 throws IllegalArgumentException;
+
+    /**
+     * Returns the timeout limit of <code>SSLSession</code> objects grouped
+     * under this <code>SSLSessionContext</code>.
+     * <p>
+     * If the timeout limit is set to 't' seconds, a session exceeds the
+     * timeout limit 't' seconds after its creation time.
+     * When the timeout limit is exceeded for a session, the
+     * <code>SSLSession</code> object is invalidated and future connections
+     * cannot resume or rejoin the session.
+     * A check for sessions exceeding the timeout limit is made immediately
+     * whenever the timeout limit is changed for this
+     * <code>SSLSessionContext</code>.
+     *
+     * @return the session timeout limit in seconds; zero means there is no
+     * limit.
+     * @see #setSessionTimeout
+     */
+    public int getSessionTimeout();
+
+    /**
+     * Sets the size of the cache used for storing
+     * <code>SSLSession</code> objects grouped under this
+     * <code>SSLSessionContext</code>.
+     *
+     * @param size the new session cache size limit; zero means there is no
+     * limit.
+     * @exception IllegalArgumentException if the specified size is {@code < 0}.
+     * @see #getSessionCacheSize
+     */
+    public void setSessionCacheSize(int size)
+                 throws IllegalArgumentException;
+
+    /**
+     * Returns the size of the cache used for storing
+     * <code>SSLSession</code> objects grouped under this
+     * <code>SSLSessionContext</code>.
+     *
+     * @return size of the session cache; zero means there is no size limit.
+     * @see #setSessionCacheSize
+     */
+    public int getSessionCacheSize();
+
+}

src/java.base/share/classes/javax/net/ssl/SSLSocket.java

@@ -0,0 +1,834 @@
+/*
+ * Copyright (c) 1997, 2017, Oracle and/or its affiliates. All rights reserved.
+ * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
+ *
+ * This code is free software; you can redistribute it and/or modify it
+ * under the terms of the GNU General Public License version 2 only, as
+ * published by the Free Software Foundation.  Oracle designates this
+ * particular file as subject to the "Classpath" exception as provided
+ * by Oracle in the LICENSE file that accompanied this code.
+ *
+ * This code is distributed in the hope that it will be useful, but WITHOUT
+ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
+ * FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License
+ * version 2 for more details (a copy is included in the LICENSE file that
+ * accompanied this code).
+ *
+ * You should have received a copy of the GNU General Public License version
+ * 2 along with this work; if not, write to the Free Software Foundation,
+ * Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.
+ *
+ * Please contact Oracle, 500 Oracle Parkway, Redwood Shores, CA 94065 USA
+ * or visit www.oracle.com if you need additional information or have any
+ * questions.
+ */
+
+
+package javax.net.ssl;
+
+import java.io.IOException;
+import java.net.*;
+import java.util.List;
+import java.util.function.BiFunction;
+
+/**
+ * This class extends <code>Socket</code> and provides secure
+ * sockets using protocols such as the "Secure
+ * Sockets Layer" (SSL) or IETF "Transport Layer Security" (TLS) protocols.
+ * <P>
+ * Such sockets are normal stream sockets, but they
+ * add a layer of security protections over the underlying network transport
+ * protocol, such as TCP.  Those protections include: <UL>
+ *
+ *      <LI> <em>Integrity Protection</em>.  SSL protects against
+ *      modification of messages by an active wiretapper.
+ *
+ *      <LI> <em>Authentication</em>.  In most modes, SSL provides
+ *      peer authentication.  Servers are usually authenticated,
+ *      and clients may be authenticated as requested by servers.
+ *
+ *      <LI> <em>Confidentiality (Privacy Protection)</em>.  In most
+ *      modes, SSL encrypts data being sent between client and server.
+ *      This protects the confidentiality of data, so that passive
+ *      wiretappers won't see sensitive data such as financial
+ *      information or personal information of many kinds.
+ *
+ *      </UL>
+ *
+ * <P>These kinds of protection are specified by a "cipher suite", which
+ * is a combination of cryptographic algorithms used by a given SSL connection.
+ * During the negotiation process, the two endpoints must agree on
+ * a ciphersuite that is available in both environments.
+ * If there is no such suite in common, no SSL connection can
+ * be established, and no data can be exchanged.
+ *
+ * <P> The cipher suite used is established by a negotiation process
+ * called "handshaking".  The goal of this
+ * process is to create or rejoin a "session", which may protect many
+ * connections over time.  After handshaking has completed, you can access
+ * session attributes by using the <em>getSession</em> method.
+ * The initial handshake on this connection can be initiated in
+ * one of three ways: <UL>
+ *
+ *      <LI> calling <code>startHandshake</code> which explicitly
+ *              begins handshakes, or
+ *      <LI> any attempt to read or write application data on
+ *              this socket causes an implicit handshake, or
+ *      <LI> a call to <code>getSession</code> tries to set up a session
+ *              if there is no currently valid session, and
+ *              an implicit handshake is done.
+ * </UL>
+ *
+ * <P>If handshaking fails for any reason, the <code>SSLSocket</code>
+ * is closed, and no further communications can be done.
+ *
+ * <P>There are two groups of cipher suites which you will need to know
+ * about when managing cipher suites: <UL>
+ *
+ *      <LI> <em>Supported</em> cipher suites:  all the suites which are
+ *      supported by the SSL implementation.  This list is reported
+ *      using <em>getSupportedCipherSuites</em>.
+ *
+ *      <LI> <em>Enabled</em> cipher suites, which may be fewer
+ *      than the full set of supported suites.  This group is
+ *      set using the <em>setEnabledCipherSuites</em> method, and
+ *      queried using the <em>getEnabledCipherSuites</em> method.
+ *      Initially, a default set of cipher suites will be enabled on
+ *      a new socket that represents the minimum suggested configuration.
+ *
+ *      </UL>
+ *
+ * <P> Implementation defaults require that only cipher
+ * suites which authenticate servers and provide confidentiality
+ * be enabled by default.
+ * Only if both sides explicitly agree to unauthenticated and/or
+ * non-private (unencrypted) communications will such a ciphersuite be
+ * selected.
+ *
+ * <P>When an <code>SSLSocket</code> is first created, no handshaking
+ * is done so that applications may first set their communication
+ * preferences:  what cipher suites to use, whether the socket should be
+ * in client or server mode, etc.
+ * However, security is always provided by the time that application data
+ * is sent over the connection.
+ *
+ * <P> You may register to receive event notification of handshake
+ * completion.  This involves
+ * the use of two additional classes.  <em>HandshakeCompletedEvent</em>
+ * objects are passed to <em>HandshakeCompletedListener</em> instances,
+ * which are registered by users of this API.
+ *
+ * An <code>SSLSocket</code> is created by <code>SSLSocketFactory</code>,
+ * or by <code>accept</code>ing a connection from a
+ * <code>SSLServerSocket</code>.
+ *
+ * <P>A SSL socket must choose to operate in the client or server mode.
+ * This will determine who begins the handshaking process, as well
+ * as which messages should be sent by each party.  Each
+ * connection must have one client and one server, or handshaking
+ * will not progress properly.  Once the initial handshaking has started, a
+ * socket can not switch between client and server modes, even when
+ * performing renegotiations.
+ *
+ * @see java.net.Socket
+ * @see SSLServerSocket
+ * @see SSLSocketFactory
+ *
+ * @since 1.4
+ * @author David Brownell
+ */
+public abstract class SSLSocket extends Socket
+{
+    /**
+     * Used only by subclasses.
+     * Constructs an uninitialized, unconnected TCP socket.
+     */
+    protected SSLSocket()
+        { super(); }
+
+
+    /**
+     * Used only by subclasses.
+     * Constructs a TCP connection to a named host at a specified port.
+     * This acts as the SSL client.
+     * <p>
+     * If there is a security manager, its <code>checkConnect</code>
+     * method is called with the host address and <code>port</code>
+     * as its arguments. This could result in a SecurityException.
+     *
+     * @param host name of the host with which to connect, or
+     *        <code>null</code> for the loopback address.
+     * @param port number of the server's port
+     * @throws IOException if an I/O error occurs when creating the socket
+     * @throws SecurityException if a security manager exists and its
+     *         <code>checkConnect</code> method doesn't allow the operation.
+     * @throws UnknownHostException if the host is not known
+     * @throws IllegalArgumentException if the port parameter is outside the
+     *         specified range of valid port values, which is between 0 and
+     *         65535, inclusive.
+     * @see SecurityManager#checkConnect
+     */
+    protected SSLSocket(String host, int port)
+    throws IOException, UnknownHostException
+        { super(host, port); }
+
+
+    /**
+     * Used only by subclasses.
+     * Constructs a TCP connection to a server at a specified address
+     * and port.  This acts as the SSL client.
+     * <p>
+     * If there is a security manager, its <code>checkConnect</code>
+     * method is called with the host address and <code>port</code>
+     * as its arguments. This could result in a SecurityException.
+     *
+     * @param address the server's host
+     * @param port its port
+     * @throws IOException if an I/O error occurs when creating the socket
+     * @throws SecurityException if a security manager exists and its
+     *         <code>checkConnect</code> method doesn't allow the operation.
+     * @throws IllegalArgumentException if the port parameter is outside the
+     *         specified range of valid port values, which is between 0 and
+     *         65535, inclusive.
+     * @throws NullPointerException if <code>address</code> is null.
+     * @see SecurityManager#checkConnect
+     */
+    protected SSLSocket(InetAddress address, int port)
+    throws IOException
+        { super(address, port); }
+
+
+    /**
+     * Used only by subclasses.
+     * Constructs an SSL connection to a named host at a specified port,
+     * binding the client side of the connection a given address and port.
+     * This acts as the SSL client.
+     * <p>
+     * If there is a security manager, its <code>checkConnect</code>
+     * method is called with the host address and <code>port</code>
+     * as its arguments. This could result in a SecurityException.
+     *
+     * @param host name of the host with which to connect, or
+     *        <code>null</code> for the loopback address.
+     * @param port number of the server's port
+     * @param clientAddress the client's address the socket is bound to, or
+     *        <code>null</code> for the <code>anyLocal</code> address.
+     * @param clientPort the client's port the socket is bound to, or
+     *        <code>zero</code> for a system selected free port.
+     * @throws IOException if an I/O error occurs when creating the socket
+     * @throws SecurityException if a security manager exists and its
+     *         <code>checkConnect</code> method doesn't allow the operation.
+     * @throws UnknownHostException if the host is not known
+     * @throws IllegalArgumentException if the port parameter or clientPort
+     *         parameter is outside the specified range of valid port values,
+     *         which is between 0 and 65535, inclusive.
+     * @see SecurityManager#checkConnect
+     */
+    protected SSLSocket(String host, int port,
+        InetAddress clientAddress, int clientPort)
+    throws IOException, UnknownHostException
+        { super(host, port, clientAddress, clientPort); }
+
+
+    /**
+     * Used only by subclasses.
+     * Constructs an SSL connection to a server at a specified address
+     * and TCP port, binding the client side of the connection a given
+     * address and port.  This acts as the SSL client.
+     * <p>
+     * If there is a security manager, its <code>checkConnect</code>
+     * method is called with the host address and <code>port</code>
+     * as its arguments. This could result in a SecurityException.
+     *
+     * @param address the server's host
+     * @param port its port
+     * @param clientAddress the client's address the socket is bound to, or
+     *        <code>null</code> for the <code>anyLocal</code> address.
+     * @param clientPort the client's port the socket is bound to, or
+     *        <code>zero</code> for a system selected free port.
+     * @throws IOException if an I/O error occurs when creating the socket
+     * @throws SecurityException if a security manager exists and its
+     *         <code>checkConnect</code> method doesn't allow the operation.
+     * @throws IllegalArgumentException if the port parameter or clientPort
+     *         parameter is outside the specified range of valid port values,
+     *         which is between 0 and 65535, inclusive.
+     * @throws NullPointerException if <code>address</code> is null.
+     * @see SecurityManager#checkConnect
+     */
+    protected SSLSocket(InetAddress address, int port,
+        InetAddress clientAddress, int clientPort)
+    throws IOException
+        { super(address, port, clientAddress, clientPort); }
+
+
+    /**
+     * Returns the names of the cipher suites which could be enabled for use
+     * on this connection.  Normally, only a subset of these will actually
+     * be enabled by default, since this list may include cipher suites which
+     * do not meet quality of service requirements for those defaults.  Such
+     * cipher suites might be useful in specialized applications.
+     * <P>
+     * The returned array includes cipher suites from the list of standard
+     * cipher suite names in the <a href=
+     * "{@docRoot}/../specs/security/standard-names.html#jsse-cipher-suite-names">
+     * JSSE Cipher Suite Names</a> section of the Java Cryptography
+     * Architecture Standard Algorithm Name Documentation, and may also
+     * include other cipher suites that the provider supports.
+     *
+     * @return an array of cipher suite names
+     * @see #getEnabledCipherSuites()
+     * @see #setEnabledCipherSuites(String [])
+     */
+    public abstract String [] getSupportedCipherSuites();
+
+
+    /**
+     * Returns the names of the SSL cipher suites which are currently
+     * enabled for use on this connection.  When an SSLSocket is first
+     * created, all enabled cipher suites support a minimum quality of
+     * service.  Thus, in some environments this value might be empty.
+     * <P>
+     * Note that even if a suite is enabled, it may never be used. This
+     * can occur if the peer does not support it, or its use is restricted,
+     * or the requisite certificates (and private keys) for the suite are
+     * not available, or an anonymous suite is enabled but authentication
+     * is required.
+     * <P>
+     * The returned array includes cipher suites from the list of standard
+     * cipher suite names in the <a href=
+     * "{@docRoot}/../specs/security/standard-names.html#jsse-cipher-suite-names">
+     * JSSE Cipher Suite Names</a> section of the Java Cryptography
+     * Architecture Standard Algorithm Name Documentation, and may also
+     * include other cipher suites that the provider supports.
+     *
+     * @return an array of cipher suite names
+     * @see #getSupportedCipherSuites()
+     * @see #setEnabledCipherSuites(String [])
+     */
+    public abstract String [] getEnabledCipherSuites();
+
+
+    /**
+     * Sets the cipher suites enabled for use on this connection.
+     * <P>
+     * Each cipher suite in the <code>suites</code> parameter must have
+     * been listed by getSupportedCipherSuites(), or the method will
+     * fail.  Following a successful call to this method, only suites
+     * listed in the <code>suites</code> parameter are enabled for use.
+     * <P>
+     * Note that the standard list of cipher suite names may be found in the
+     * <a href=
+     * "{@docRoot}/../specs/security/standard-names.html#jsse-cipher-suite-names">
+     * JSSE Cipher Suite Names</a> section of the Java Cryptography
+     * Architecture Standard Algorithm Name Documentation.  Providers
+     * may support cipher suite names not found in this list or might not
+     * use the recommended name for a certain cipher suite.
+     * <P>
+     * See {@link #getEnabledCipherSuites()} for more information
+     * on why a specific ciphersuite may never be used on a connection.
+     *
+     * @param suites Names of all the cipher suites to enable
+     * @throws IllegalArgumentException when one or more of the ciphers
+     *          named by the parameter is not supported, or when the
+     *          parameter is null.
+     * @see #getSupportedCipherSuites()
+     * @see #getEnabledCipherSuites()
+     */
+    public abstract void setEnabledCipherSuites(String suites []);
+
+
+    /**
+     * Returns the names of the protocols which could be enabled for use
+     * on an SSL connection.
+     *
+     * @return an array of protocols supported
+     */
+    public abstract String [] getSupportedProtocols();
+
+
+    /**
+     * Returns the names of the protocol versions which are currently
+     * enabled for use on this connection.
+     * <P>
+     * Note that even if a protocol is enabled, it may never be used.
+     * This can occur if the peer does not support the protocol, or its
+     * use is restricted, or there are no enabled cipher suites supported
+     * by the protocol.
+     *
+     * @see #setEnabledProtocols(String [])
+     * @return an array of protocols
+     */
+    public abstract String [] getEnabledProtocols();
+
+
+    /**
+     * Sets the protocol versions enabled for use on this connection.
+     * <P>
+     * The protocols must have been listed by
+     * <code>getSupportedProtocols()</code> as being supported.
+     * Following a successful call to this method, only protocols listed
+     * in the <code>protocols</code> parameter are enabled for use.
+     *
+     * @param protocols Names of all the protocols to enable.
+     * @throws IllegalArgumentException when one or more of
+     *            the protocols named by the parameter is not supported or
+     *            when the protocols parameter is null.
+     * @see #getEnabledProtocols()
+     */
+    public abstract void setEnabledProtocols(String protocols[]);
+
+
+    /**
+     * Returns the SSL Session in use by this connection.  These can
+     * be long lived, and frequently correspond to an entire login session
+     * for some user.  The session specifies a particular cipher suite
+     * which is being actively used by all connections in that session,
+     * as well as the identities of the session's client and server.
+     * <P>
+     * This method will initiate the initial handshake if
+     * necessary and then block until the handshake has been
+     * established.
+     * <P>
+     * If an error occurs during the initial handshake, this method
+     * returns an invalid session object which reports an invalid
+     * cipher suite of "SSL_NULL_WITH_NULL_NULL".
+     *
+     * @return the <code>SSLSession</code>
+     */
+    public abstract SSLSession getSession();
+
+
+    /**
+     * Returns the {@code SSLSession} being constructed during a SSL/TLS
+     * handshake.
+     * <p>
+     * TLS protocols may negotiate parameters that are needed when using
+     * an instance of this class, but before the {@code SSLSession} has
+     * been completely initialized and made available via {@code getSession}.
+     * For example, the list of valid signature algorithms may restrict
+     * the type of certificates that can used during TrustManager
+     * decisions, or the maximum TLS fragment packet sizes can be
+     * resized to better support the network environment.
+     * <p>
+     * This method provides early access to the {@code SSLSession} being
+     * constructed.  Depending on how far the handshake has progressed,
+     * some data may not yet be available for use.  For example, if a
+     * remote server will be sending a Certificate chain, but that chain
+     * has yet not been processed, the {@code getPeerCertificates}
+     * method of {@code SSLSession} will throw a
+     * SSLPeerUnverifiedException.  Once that chain has been processed,
+     * {@code getPeerCertificates} will return the proper value.
+     * <p>
+     * Unlike {@link #getSession()}, this method does not initiate the
+     * initial handshake and does not block until handshaking is
+     * complete.
+     *
+     * @see SSLEngine
+     * @see SSLSession
+     * @see ExtendedSSLSession
+     * @see X509ExtendedKeyManager
+     * @see X509ExtendedTrustManager
+     *
+     * @return null if this instance is not currently handshaking, or
+     *         if the current handshake has not progressed far enough to
+     *         create a basic SSLSession.  Otherwise, this method returns the
+     *         {@code SSLSession} currently being negotiated.
+     * @throws UnsupportedOperationException if the underlying provider
+     *         does not implement the operation.
+     *
+     * @since 1.7
+     */
+    public SSLSession getHandshakeSession() {
+        throw new UnsupportedOperationException();
+    }
+
+
+    /**
+     * Registers an event listener to receive notifications that an
+     * SSL handshake has completed on this connection.
+     *
+     * @param listener the HandShake Completed event listener
+     * @see #startHandshake()
+     * @see #removeHandshakeCompletedListener(HandshakeCompletedListener)
+     * @throws IllegalArgumentException if the argument is null.
+     */
+    public abstract void addHandshakeCompletedListener(
+        HandshakeCompletedListener listener);
+
+
+    /**
+     * Removes a previously registered handshake completion listener.
+     *
+     * @param listener the HandShake Completed event listener
+     * @throws IllegalArgumentException if the listener is not registered,
+     * or the argument is null.
+     * @see #addHandshakeCompletedListener(HandshakeCompletedListener)
+     */
+    public abstract void removeHandshakeCompletedListener(
+        HandshakeCompletedListener listener);
+
+
+    /**
+     * Starts an SSL handshake on this connection.  Common reasons include
+     * a need to use new encryption keys, to change cipher suites, or to
+     * initiate a new session.  To force complete reauthentication, the
+     * current session could be invalidated before starting this handshake.
+     *
+     * <P> If data has already been sent on the connection, it continues
+     * to flow during this handshake.  When the handshake completes, this
+     * will be signaled with an event.
+     *
+     * This method is synchronous for the initial handshake on a connection
+     * and returns when the negotiated handshake is complete. Some
+     * protocols may not support multiple handshakes on an existing socket
+     * and may throw an IOException.
+     *
+     * @throws IOException on a network level error
+     * @see #addHandshakeCompletedListener(HandshakeCompletedListener)
+     */
+    public abstract void startHandshake() throws IOException;
+
+
+    /**
+     * Configures the socket to use client (or server) mode when
+     * handshaking.
+     * <P>
+     * This method must be called before any handshaking occurs.
+     * Once handshaking has begun, the mode can not be reset for the
+     * life of this socket.
+     * <P>
+     * Servers normally authenticate themselves, and clients
+     * are not required to do so.
+     *
+     * @param mode true if the socket should start its handshaking
+     *          in "client" mode
+     * @throws IllegalArgumentException if a mode change is attempted
+     *          after the initial handshake has begun.
+     * @see #getUseClientMode()
+     */
+    public abstract void setUseClientMode(boolean mode);
+
+
+    /**
+     * Returns true if the socket is set to use client mode when
+     * handshaking.
+     *
+     * @return true if the socket should do handshaking
+     *          in "client" mode
+     * @see #setUseClientMode(boolean)
+     */
+    public abstract boolean getUseClientMode();
+
+
+    /**
+     * Configures the socket to <i>require</i> client authentication.  This
+     * option is only useful for sockets in the server mode.
+     * <P>
+     * A socket's client authentication setting is one of the following:
+     * <ul>
+     * <li> client authentication required
+     * <li> client authentication requested
+     * <li> no client authentication desired
+     * </ul>
+     * <P>
+     * Unlike {@link #setWantClientAuth(boolean)}, if this option is set and
+     * the client chooses not to provide authentication information
+     * about itself, <i>the negotiations will stop and the connection
+     * will be dropped</i>.
+     * <P>
+     * Calling this method overrides any previous setting made by
+     * this method or {@link #setWantClientAuth(boolean)}.
+     *
+     * @param   need set to true if client authentication is required,
+     *          or false if no client authentication is desired.
+     * @see #getNeedClientAuth()
+     * @see #setWantClientAuth(boolean)
+     * @see #getWantClientAuth()
+     * @see #setUseClientMode(boolean)
+     */
+    public abstract void setNeedClientAuth(boolean need);
+
+
+    /**
+     * Returns true if the socket will <i>require</i> client authentication.
+     * This option is only useful to sockets in the server mode.
+     *
+     * @return  true if client authentication is required,
+     *          or false if no client authentication is desired.
+     * @see #setNeedClientAuth(boolean)
+     * @see #setWantClientAuth(boolean)
+     * @see #getWantClientAuth()
+     * @see #setUseClientMode(boolean)
+     */
+    public abstract boolean getNeedClientAuth();
+
+
+    /**
+     * Configures the socket to <i>request</i> client authentication.
+     * This option is only useful for sockets in the server mode.
+     * <P>
+     * A socket's client authentication setting is one of the following:
+     * <ul>
+     * <li> client authentication required
+     * <li> client authentication requested
+     * <li> no client authentication desired
+     * </ul>
+     * <P>
+     * Unlike {@link #setNeedClientAuth(boolean)}, if this option is set and
+     * the client chooses not to provide authentication information
+     * about itself, <i>the negotiations will continue</i>.
+     * <P>
+     * Calling this method overrides any previous setting made by
+     * this method or {@link #setNeedClientAuth(boolean)}.
+     *
+     * @param   want set to true if client authentication is requested,
+     *          or false if no client authentication is desired.
+     * @see #getWantClientAuth()
+     * @see #setNeedClientAuth(boolean)
+     * @see #getNeedClientAuth()
+     * @see #setUseClientMode(boolean)
+     */
+    public abstract void setWantClientAuth(boolean want);
+
+
+    /**
+     * Returns true if the socket will <i>request</i> client authentication.
+     * This option is only useful for sockets in the server mode.
+     *
+     * @return  true if client authentication is requested,
+     *          or false if no client authentication is desired.
+     * @see #setNeedClientAuth(boolean)
+     * @see #getNeedClientAuth()
+     * @see #setWantClientAuth(boolean)
+     * @see #setUseClientMode(boolean)
+     */
+    public abstract boolean getWantClientAuth();
+
+
+    /**
+     * Controls whether new SSL sessions may be established by this socket.
+     * If session creations are not allowed, and there are no
+     * existing sessions to resume, there will be no successful
+     * handshaking.
+     *
+     * @param flag true indicates that sessions may be created; this
+     *          is the default.  false indicates that an existing session
+     *          must be resumed
+     * @see #getEnableSessionCreation()
+     */
+    public abstract void setEnableSessionCreation(boolean flag);
+
+
+    /**
+     * Returns true if new SSL sessions may be established by this socket.
+     *
+     * @return true indicates that sessions may be created; this
+     *          is the default.  false indicates that an existing session
+     *          must be resumed
+     * @see #setEnableSessionCreation(boolean)
+     */
+    public abstract boolean getEnableSessionCreation();
+
+    /**
+     * Returns the SSLParameters in effect for this SSLSocket.
+     * The ciphersuites and protocols of the returned SSLParameters
+     * are always non-null.
+     *
+     * @return the SSLParameters in effect for this SSLSocket.
+     * @since 1.6
+     */
+    public SSLParameters getSSLParameters() {
+        SSLParameters params = new SSLParameters();
+        params.setCipherSuites(getEnabledCipherSuites());
+        params.setProtocols(getEnabledProtocols());
+        if (getNeedClientAuth()) {
+            params.setNeedClientAuth(true);
+        } else if (getWantClientAuth()) {
+            params.setWantClientAuth(true);
+        }
+        return params;
+    }
+
+    /**
+     * Applies SSLParameters to this socket.
+     *
+     * <p>This means:
+     * <ul>
+     * <li>If {@code params.getCipherSuites()} is non-null,
+     *   {@code setEnabledCipherSuites()} is called with that value.</li>
+     * <li>If {@code params.getProtocols()} is non-null,
+     *   {@code setEnabledProtocols()} is called with that value.</li>
+     * <li>If {@code params.getNeedClientAuth()} or
+     *   {@code params.getWantClientAuth()} return {@code true},
+     *   {@code setNeedClientAuth(true)} and
+     *   {@code setWantClientAuth(true)} are called, respectively;
+     *   otherwise {@code setWantClientAuth(false)} is called.</li>
+     * <li>If {@code params.getServerNames()} is non-null, the socket will
+     *   configure its server names with that value.</li>
+     * <li>If {@code params.getSNIMatchers()} is non-null, the socket will
+     *   configure its SNI matchers with that value.</li>
+     * </ul>
+     *
+     * @param params the parameters
+     * @throws IllegalArgumentException if the setEnabledCipherSuites() or
+     *    the setEnabledProtocols() call fails
+     * @since 1.6
+     */
+    public void setSSLParameters(SSLParameters params) {
+        String[] s;
+        s = params.getCipherSuites();
+        if (s != null) {
+            setEnabledCipherSuites(s);
+        }
+        s = params.getProtocols();
+        if (s != null) {
+            setEnabledProtocols(s);
+        }
+        if (params.getNeedClientAuth()) {
+            setNeedClientAuth(true);
+        } else if (params.getWantClientAuth()) {
+            setWantClientAuth(true);
+        } else {
+            setWantClientAuth(false);
+        }
+    }
+
+    /**
+     * Returns the most recent application protocol value negotiated for this
+     * connection.
+     * <p>
+     * If supported by the underlying SSL/TLS/DTLS implementation,
+     * application name negotiation mechanisms such as <a
+     * href="http://www.ietf.org/rfc/rfc7301.txt"> RFC 7301 </a>, the
+     * Application-Layer Protocol Negotiation (ALPN), can negotiate
+     * application-level values between peers.
+     *
+     * @implSpec
+     * The implementation in this class throws
+     * {@code UnsupportedOperationException} and performs no other action.
+     *
+     * @return null if it has not yet been determined if application
+     *         protocols might be used for this connection, an empty
+     *         {@code String} if application protocols values will not
+     *         be used, or a non-empty application protocol {@code String}
+     *         if a value was successfully negotiated.
+     * @throws UnsupportedOperationException if the underlying provider
+     *         does not implement the operation.
+     * @since 9
+     */
+    public String getApplicationProtocol() {
+        throw new UnsupportedOperationException();
+    }
+
+    /**
+     * Returns the application protocol value negotiated on a SSL/TLS
+     * handshake currently in progress.
+     * <p>
+     * Like {@link #getHandshakeSession()},
+     * a connection may be in the middle of a handshake. The
+     * application protocol may or may not yet be available.
+     *
+     * @implSpec
+     * The implementation in this class throws
+     * {@code UnsupportedOperationException} and performs no other action.
+     *
+     * @return null if it has not yet been determined if application
+     *         protocols might be used for this handshake, an empty
+     *         {@code String} if application protocols values will not
+     *         be used, or a non-empty application protocol {@code String}
+     *         if a value was successfully negotiated.
+     * @throws UnsupportedOperationException if the underlying provider
+     *         does not implement the operation.
+     * @since 9
+     */
+    public String getHandshakeApplicationProtocol() {
+        throw new UnsupportedOperationException();
+    }
+
+
+    /**
+     * Registers a callback function that selects an application protocol
+     * value for a SSL/TLS/DTLS handshake.
+     * The function overrides any values supplied using
+     * {@link SSLParameters#setApplicationProtocols
+     * SSLParameters.setApplicationProtocols} and it supports the following
+     * type parameters:
+     * <blockquote>
+     * <dl>
+     * <dt> {@code SSLSocket}
+     * <dd> The function's first argument allows the current {@code SSLSocket}
+     *      to be inspected, including the handshake session and configuration
+     *      settings.
+     * <dt> {@code List<String>}
+     * <dd> The function's second argument lists the application protocol names
+     *      advertised by the TLS peer.
+     * <dt> {@code String}
+     * <dd> The function's result is an application protocol name, or null to
+     *      indicate that none of the advertised names are acceptable.
+     *      If the return value is an empty {@code String} then application
+     *      protocol indications will not be used.
+     *      If the return value is null (no value chosen) or is a value that
+     *      was not advertised by the peer, the underlying protocol will
+     *      determine what action to take. (For example, ALPN will send a
+     *      "no_application_protocol" alert and terminate the connection.)
+     * </dl>
+     * </blockquote>
+     *
+     * For example, the following call registers a callback function that
+     * examines the TLS handshake parameters and selects an application protocol
+     * name:
+     * <pre>{@code
+     *     serverSocket.setHandshakeApplicationProtocolSelector(
+     *         (serverSocket, clientProtocols) -> {
+     *             SSLSession session = serverSocket.getHandshakeSession();
+     *             return chooseApplicationProtocol(
+     *                 serverSocket,
+     *                 clientProtocols,
+     *                 session.getProtocol(),
+     *                 session.getCipherSuite());
+     *         });
+     * }</pre>
+     *
+     * @apiNote
+     * This method should be called by TLS server applications before the TLS
+     * handshake begins. Also, this {@code SSLSocket} should be configured with
+     * parameters that are compatible with the application protocol selected by
+     * the callback function. For example, enabling a poor choice of cipher
+     * suites could result in no suitable application protocol.
+     * See {@link SSLParameters}.
+     *
+     * @implSpec
+     * The implementation in this class throws
+     * {@code UnsupportedOperationException} and performs no other action.
+     *
+     * @param selector the callback function, or null to de-register.
+     * @throws UnsupportedOperationException if the underlying provider
+     *         does not implement the operation.
+     * @since 9
+     */
+    public void setHandshakeApplicationProtocolSelector(
+            BiFunction<SSLSocket, List<String>, String> selector) {
+        throw new UnsupportedOperationException();
+    }
+
+    /**
+     * Retrieves the callback function that selects an application protocol
+     * value during a SSL/TLS/DTLS handshake.
+     * See {@link #setHandshakeApplicationProtocolSelector
+     * setHandshakeApplicationProtocolSelector}
+     * for the function's type parameters.
+     *
+     * @implSpec
+     * The implementation in this class throws
+     * {@code UnsupportedOperationException} and performs no other action.
+     *
+     * @return the callback function, or null if none has been set.
+     * @throws UnsupportedOperationException if the underlying provider
+     *         does not implement the operation.
+     * @since 9
+     */
+    public BiFunction<SSLSocket, List<String>, String>
+            getHandshakeApplicationProtocolSelector() {
+        throw new UnsupportedOperationException();
+    }
+}

src/java.base/share/classes/javax/net/ssl/SSLSocketFactory.java

@@ -0,0 +1,320 @@
+/*
+ * Copyright (c) 1997, 2017, Oracle and/or its affiliates. All rights reserved.
+ * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
+ *
+ * This code is free software; you can redistribute it and/or modify it
+ * under the terms of the GNU General Public License version 2 only, as
+ * published by the Free Software Foundation.  Oracle designates this
+ * particular file as subject to the "Classpath" exception as provided
+ * by Oracle in the LICENSE file that accompanied this code.
+ *
+ * This code is distributed in the hope that it will be useful, but WITHOUT
+ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
+ * FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License
+ * version 2 for more details (a copy is included in the LICENSE file that
+ * accompanied this code).
+ *
+ * You should have received a copy of the GNU General Public License version
+ * 2 along with this work; if not, write to the Free Software Foundation,
+ * Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.
+ *
+ * Please contact Oracle, 500 Oracle Parkway, Redwood Shores, CA 94065 USA
+ * or visit www.oracle.com if you need additional information or have any
+ * questions.
+ */
+
+
+package javax.net.ssl;
+
+import java.net.*;
+import javax.net.SocketFactory;
+import java.io.IOException;
+import java.io.InputStream;
+import java.security.*;
+import java.util.Locale;
+
+import sun.security.action.GetPropertyAction;
+
+/**
+ * <code>SSLSocketFactory</code>s create <code>SSLSocket</code>s.
+ *
+ * @since 1.4
+ * @see SSLSocket
+ * @author David Brownell
+ */
+public abstract class SSLSocketFactory extends SocketFactory
+{
+    private static SSLSocketFactory theFactory;
+
+    private static boolean propertyChecked;
+
+    static final boolean DEBUG;
+
+    static {
+        String s = GetPropertyAction.privilegedGetProperty("javax.net.debug", "")
+                .toLowerCase(Locale.ENGLISH);
+
+        DEBUG = s.contains("all") || s.contains("ssl");
+    }
+
+    private static void log(String msg) {
+        if (DEBUG) {
+            System.out.println(msg);
+        }
+    }
+
+    /**
+     * Constructor is used only by subclasses.
+     */
+    public SSLSocketFactory() {
+    }
+
+    /**
+     * Returns the default SSL socket factory.
+     *
+     * <p>The first time this method is called, the security property
+     * "ssl.SocketFactory.provider" is examined. If it is non-null, a class by
+     * that name is loaded and instantiated. If that is successful and the
+     * object is an instance of SSLSocketFactory, it is made the default SSL
+     * socket factory.
+     *
+     * <p>Otherwise, this method returns
+     * <code>SSLContext.getDefault().getSocketFactory()</code>. If that
+     * call fails, an inoperative factory is returned.
+     *
+     * @return the default <code>SocketFactory</code>
+     * @see SSLContext#getDefault
+     */
+    public static synchronized SocketFactory getDefault() {
+        if (theFactory != null) {
+            return theFactory;
+        }
+
+        if (propertyChecked == false) {
+            propertyChecked = true;
+            String clsName = getSecurityProperty("ssl.SocketFactory.provider");
+            if (clsName != null) {
+                log("setting up default SSLSocketFactory");
+                try {
+                    Class<?> cls = null;
+                    try {
+                        cls = Class.forName(clsName);
+                    } catch (ClassNotFoundException e) {
+                        ClassLoader cl = ClassLoader.getSystemClassLoader();
+                        if (cl != null) {
+                            cls = cl.loadClass(clsName);
+                        }
+                    }
+                    log("class " + clsName + " is loaded");
+                    @SuppressWarnings("deprecation")
+                    SSLSocketFactory fac = (SSLSocketFactory)cls.newInstance();
+                    log("instantiated an instance of class " + clsName);
+                    theFactory = fac;
+                    return fac;
+                } catch (Exception e) {
+                    log("SSLSocketFactory instantiation failed: " + e.toString());
+                    theFactory = new DefaultSSLSocketFactory(e);
+                    return theFactory;
+                }
+            }
+        }
+
+        try {
+            return SSLContext.getDefault().getSocketFactory();
+        } catch (NoSuchAlgorithmException e) {
+            return new DefaultSSLSocketFactory(e);
+        }
+    }
+
+    static String getSecurityProperty(final String name) {
+        return AccessController.doPrivileged(new PrivilegedAction<>() {
+            @Override
+            public String run() {
+                String s = java.security.Security.getProperty(name);
+                if (s != null) {
+                    s = s.trim();
+                    if (s.length() == 0) {
+                        s = null;
+                    }
+                }
+                return s;
+            }
+        });
+    }
+
+    /**
+     * Returns the list of cipher suites which are enabled by default.
+     * Unless a different list is enabled, handshaking on an SSL connection
+     * will use one of these cipher suites.  The minimum quality of service
+     * for these defaults requires confidentiality protection and server
+     * authentication (that is, no anonymous cipher suites).
+     * <P>
+     * The returned array includes cipher suites from the list of standard
+     * cipher suite names in the <a href=
+     * "{@docRoot}/../specs/security/standard-names.html#jsse-cipher-suite-names">
+     * JSSE Cipher Suite Names</a> section of the Java Cryptography
+     * Architecture Standard Algorithm Name Documentation, and may also
+     * include other cipher suites that the provider supports.
+     *
+     * @see #getSupportedCipherSuites()
+     * @return array of the cipher suites enabled by default
+     */
+    public abstract String [] getDefaultCipherSuites();
+
+    /**
+     * Returns the names of the cipher suites which could be enabled for use
+     * on an SSL connection.  Normally, only a subset of these will actually
+     * be enabled by default, since this list may include cipher suites which
+     * do not meet quality of service requirements for those defaults.  Such
+     * cipher suites are useful in specialized applications.
+     * <P>
+     * The returned array includes cipher suites from the list of standard
+     * cipher suite names in the <a href=
+     * "{@docRoot}/../specs/security/standard-names.html#jsse-cipher-suite-names">
+     * JSSE Cipher Suite Names</a> section of the Java Cryptography
+     * Architecture Standard Algorithm Name Documentation, and may also
+     * include other cipher suites that the provider supports.
+     *
+     * @see #getDefaultCipherSuites()
+     * @return an array of cipher suite names
+     */
+    public abstract String [] getSupportedCipherSuites();
+
+    /**
+     * Returns a socket layered over an existing socket connected to the named
+     * host, at the given port.  This constructor can be used when tunneling SSL
+     * through a proxy or when negotiating the use of SSL over an existing
+     * socket. The host and port refer to the logical peer destination.
+     * This socket is configured using the socket options established for
+     * this factory.
+     *
+     * @param s the existing socket
+     * @param host the server host
+     * @param port the server port
+     * @param autoClose close the underlying socket when this socket is closed
+     * @return a socket connected to the specified host and port
+     * @throws IOException if an I/O error occurs when creating the socket
+     * @throws NullPointerException if the parameter s is null
+     */
+    public abstract Socket createSocket(Socket s, String host,
+            int port, boolean autoClose) throws IOException;
+
+    /**
+     * Creates a server mode {@link Socket} layered over an
+     * existing connected socket, and is able to read data which has
+     * already been consumed/removed from the {@link Socket}'s
+     * underlying {@link InputStream}.
+     * <p>
+     * This method can be used by a server application that needs to
+     * observe the inbound data but still create valid SSL/TLS
+     * connections: for example, inspection of Server Name Indication
+     * (SNI) extensions (See section 3 of <A
+     * HREF="http://www.ietf.org/rfc/rfc6066.txt">TLS Extensions
+     * (RFC6066)</A>).  Data that has been already removed from the
+     * underlying {@link InputStream} should be loaded into the
+     * {@code consumed} stream before this method is called, perhaps
+     * using a {@link java.io.ByteArrayInputStream}.  When this
+     * {@link Socket} begins handshaking, it will read all of the data in
+     * {@code consumed} until it reaches {@code EOF}, then all further
+     * data is read from the underlying {@link InputStream} as
+     * usual.
+     * <p>
+     * The returned socket is configured using the socket options
+     * established for this factory, and is set to use server mode when
+     * handshaking (see {@link SSLSocket#setUseClientMode(boolean)}).
+     *
+     * @param  s
+     *         the existing socket
+     * @param  consumed
+     *         the consumed inbound network data that has already been
+     *         removed from the existing {@link Socket}
+     *         {@link InputStream}.  This parameter may be
+     *         {@code null} if no data has been removed.
+     * @param  autoClose close the underlying socket when this socket is closed.
+     *
+     * @return the {@link Socket} compliant with the socket options
+     *         established for this factory
+     *
+     * @throws IOException if an I/O error occurs when creating the socket
+     * @throws UnsupportedOperationException if the underlying provider
+     *         does not implement the operation
+     * @throws NullPointerException if {@code s} is {@code null}
+     *
+     * @since 1.8
+     */
+    public Socket createSocket(Socket s, InputStream consumed,
+            boolean autoClose) throws IOException {
+        throw new UnsupportedOperationException();
+    }
+}
+
+
+// file private
+class DefaultSSLSocketFactory extends SSLSocketFactory
+{
+    private Exception reason;
+
+    DefaultSSLSocketFactory(Exception reason) {
+        this.reason = reason;
+    }
+
+    private Socket throwException() throws SocketException {
+        throw (SocketException)
+            new SocketException(reason.toString()).initCause(reason);
+    }
+
+    @Override
+    public Socket createSocket()
+    throws IOException
+    {
+        return throwException();
+    }
+
+    @Override
+    public Socket createSocket(String host, int port)
+    throws IOException
+    {
+        return throwException();
+    }
+
+    @Override
+    public Socket createSocket(Socket s, String host,
+                                int port, boolean autoClose)
+    throws IOException
+    {
+        return throwException();
+    }
+
+    @Override
+    public Socket createSocket(InetAddress address, int port)
+    throws IOException
+    {
+        return throwException();
+    }
+
+    @Override
+    public Socket createSocket(String host, int port,
+        InetAddress clientAddress, int clientPort)
+    throws IOException
+    {
+        return throwException();
+    }
+
+    @Override
+    public Socket createSocket(InetAddress address, int port,
+        InetAddress clientAddress, int clientPort)
+    throws IOException
+    {
+        return throwException();
+    }
+
+    @Override
+    public String [] getDefaultCipherSuites() {
+        return new String[0];
+    }
+
+    @Override
+    public String [] getSupportedCipherSuites() {
+        return new String[0];
+    }
+}

src/java.base/share/classes/javax/net/ssl/StandardConstants.java

@@ -0,0 +1,56 @@
+/*
+ * Copyright (c) 2012, Oracle and/or its affiliates. All rights reserved.
+ * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
+ *
+ * This code is free software; you can redistribute it and/or modify it
+ * under the terms of the GNU General Public License version 2 only, as
+ * published by the Free Software Foundation.  Oracle designates this
+ * particular file as subject to the "Classpath" exception as provided
+ * by Oracle in the LICENSE file that accompanied this code.
+ *
+ * This code is distributed in the hope that it will be useful, but WITHOUT
+ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
+ * FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License
+ * version 2 for more details (a copy is included in the LICENSE file that
+ * accompanied this code).
+ *
+ * You should have received a copy of the GNU General Public License version
+ * 2 along with this work; if not, write to the Free Software Foundation,
+ * Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.
+ *
+ * Please contact Oracle, 500 Oracle Parkway, Redwood Shores, CA 94065 USA
+ * or visit www.oracle.com if you need additional information or have any
+ * questions.
+ */
+
+package javax.net.ssl;
+
+/**
+ * Standard constants definitions
+ *
+ * @since 1.8
+ */
+public final class StandardConstants {
+
+    // Suppress default constructor for noninstantiability
+    private StandardConstants() {
+        throw new AssertionError(
+            "No javax.net.ssl.StandardConstants instances for you!");
+    }
+
+    /**
+     * The "host_name" type representing of a DNS hostname
+     * (see {@link SNIHostName}) in a Server Name Indication (SNI) extension.
+     * <P>
+     * The SNI extension is a feature that extends the SSL/TLS protocols to
+     * indicate what server name the client is attempting to connect to during
+     * handshaking.  See section 3, "Server Name Indication", of <A
+     * HREF="http://www.ietf.org/rfc/rfc6066.txt">TLS Extensions (RFC 6066)</A>.
+     * <P>
+     * The value of this constant is {@value}.
+     *
+     * @see SNIServerName
+     * @see SNIHostName
+     */
+    public static final int SNI_HOST_NAME = 0x00;
+}

src/java.base/share/classes/javax/net/ssl/TrustManager.java

@@ -0,0 +1,43 @@
+/*
+ * Copyright (c) 1999, 2003, Oracle and/or its affiliates. All rights reserved.
+ * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
+ *
+ * This code is free software; you can redistribute it and/or modify it
+ * under the terms of the GNU General Public License version 2 only, as
+ * published by the Free Software Foundation.  Oracle designates this
+ * particular file as subject to the "Classpath" exception as provided
+ * by Oracle in the LICENSE file that accompanied this code.
+ *
+ * This code is distributed in the hope that it will be useful, but WITHOUT
+ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
+ * FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License
+ * version 2 for more details (a copy is included in the LICENSE file that
+ * accompanied this code).
+ *
+ * You should have received a copy of the GNU General Public License version
+ * 2 along with this work; if not, write to the Free Software Foundation,
+ * Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.
+ *
+ * Please contact Oracle, 500 Oracle Parkway, Redwood Shores, CA 94065 USA
+ * or visit www.oracle.com if you need additional information or have any
+ * questions.
+ */
+
+package javax.net.ssl;
+
+/**
+ * This is the base interface for JSSE trust managers.
+ * <P>
+ * <code>TrustManager</code>s are responsible for managing the trust material
+ * that is used when making trust decisions, and for deciding whether
+ * credentials presented by a peer should be accepted.
+ * <P>
+ * <code>TrustManager</code>s are created by either
+ * using a <code>TrustManagerFactory</code>,
+ * or by implementing one of the <code>TrustManager</code> subclasses.
+ *
+ * @see TrustManagerFactory
+ * @since 1.4
+ */
+public interface TrustManager {
+}

src/java.base/share/classes/javax/net/ssl/TrustManagerFactory.java

@@ -0,0 +1,315 @@
+/*
+ * Copyright (c) 1999, 2017, Oracle and/or its affiliates. All rights reserved.
+ * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
+ *
+ * This code is free software; you can redistribute it and/or modify it
+ * under the terms of the GNU General Public License version 2 only, as
+ * published by the Free Software Foundation.  Oracle designates this
+ * particular file as subject to the "Classpath" exception as provided
+ * by Oracle in the LICENSE file that accompanied this code.
+ *
+ * This code is distributed in the hope that it will be useful, but WITHOUT
+ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
+ * FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License
+ * version 2 for more details (a copy is included in the LICENSE file that
+ * accompanied this code).
+ *
+ * You should have received a copy of the GNU General Public License version
+ * 2 along with this work; if not, write to the Free Software Foundation,
+ * Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.
+ *
+ * Please contact Oracle, 500 Oracle Parkway, Redwood Shores, CA 94065 USA
+ * or visit www.oracle.com if you need additional information or have any
+ * questions.
+ */
+
+package javax.net.ssl;
+
+import java.security.Security;
+import java.security.*;
+import java.util.Objects;
+
+import sun.security.jca.GetInstance;
+
+/**
+ * This class acts as a factory for trust managers based on a
+ * source of trust material. Each trust manager manages a specific
+ * type of trust material for use by secure sockets. The trust
+ * material is based on a KeyStore and/or provider-specific sources.
+ *
+ * <p> Every implementation of the Java platform is required to support the
+ * following standard {@code TrustManagerFactory} algorithm:
+ * <ul>
+ * <li>{@code PKIX}</li>
+ * </ul>
+ * This algorithm is described in the <a href=
+ * "{@docRoot}/../specs/security/standard-names.html#trustmanagerfactory-algorithms">
+ * TrustManagerFactory section</a> of the
+ * Java Security Standard Algorithm Names Specification.
+ * Consult the release documentation for your implementation to see if any
+ * other algorithms are supported.
+ *
+ * @since 1.4
+ * @see TrustManager
+ */
+public class TrustManagerFactory {
+    // The provider
+    private Provider provider;
+
+    // The provider implementation (delegate)
+    private TrustManagerFactorySpi factorySpi;
+
+    // The name of the trust management algorithm.
+    private String algorithm;
+
+    /**
+     * Obtains the default TrustManagerFactory algorithm name.
+     *
+     * <p>The default TrustManager can be changed at runtime by setting
+     * the value of the {@code ssl.TrustManagerFactory.algorithm}
+     * security property to the desired algorithm name.
+     *
+     * @see java.security.Security security properties
+     * @return the default algorithm name as specified by the
+     * {@code ssl.TrustManagerFactory.algorithm} security property, or an
+     * implementation-specific default if no such property exists.
+     */
+    public static final String getDefaultAlgorithm() {
+        String type;
+        type = AccessController.doPrivileged(new PrivilegedAction<>() {
+            @Override
+            public String run() {
+                return Security.getProperty(
+                    "ssl.TrustManagerFactory.algorithm");
+            }
+        });
+        if (type == null) {
+            type = "SunX509";
+        }
+        return type;
+    }
+
+    /**
+     * Creates a TrustManagerFactory object.
+     *
+     * @param factorySpi the delegate
+     * @param provider the provider
+     * @param algorithm the algorithm
+     */
+    protected TrustManagerFactory(TrustManagerFactorySpi factorySpi,
+            Provider provider, String algorithm) {
+        this.factorySpi = factorySpi;
+        this.provider = provider;
+        this.algorithm = algorithm;
+    }
+
+    /**
+     * Returns the algorithm name of this <code>TrustManagerFactory</code>
+     * object.
+     *
+     * <p>This is the same name that was specified in one of the
+     * <code>getInstance</code> calls that created this
+     * <code>TrustManagerFactory</code> object.
+     *
+     * @return the algorithm name of this <code>TrustManagerFactory</code>
+     *          object
+     */
+    public final String getAlgorithm() {
+        return this.algorithm;
+    }
+
+    /**
+     * Returns a <code>TrustManagerFactory</code> object that acts as a
+     * factory for trust managers.
+     *
+     * <p> This method traverses the list of registered security Providers,
+     * starting with the most preferred Provider.
+     * A new TrustManagerFactory object encapsulating the
+     * TrustManagerFactorySpi implementation from the first
+     * Provider that supports the specified algorithm is returned.
+     *
+     * <p> Note that the list of registered providers may be retrieved via
+     * the {@link Security#getProviders() Security.getProviders()} method.
+     *
+     * @implNote
+     * The JDK Reference Implementation additionally uses the
+     * {@code jdk.security.provider.preferred}
+     * {@link Security#getProperty(String) Security} property to determine
+     * the preferred provider order for the specified algorithm. This
+     * may be different than the order of providers returned by
+     * {@link Security#getProviders() Security.getProviders()}.
+     *
+     * @param algorithm the standard name of the requested trust management
+     *          algorithm.  See the <a href=
+     *          "{@docRoot}/../specs/security/standard-names.html">
+     *          Java Security Standard Algorithm Names</a> document
+     *          for information about standard algorithm names.
+     *
+     * @return the new {@code TrustManagerFactory} object
+     *
+     * @throws NoSuchAlgorithmException if no {@code Provider} supports a
+     *         {@code TrustManagerFactorySpi} implementation for the
+     *         specified algorithm
+     *
+     * @throws NullPointerException if {@code algorithm} is {@code null}
+     *
+     * @see java.security.Provider
+     */
+    public static final TrustManagerFactory getInstance(String algorithm)
+            throws NoSuchAlgorithmException {
+        Objects.requireNonNull(algorithm, "null algorithm name");
+        GetInstance.Instance instance = GetInstance.getInstance
+                ("TrustManagerFactory", TrustManagerFactorySpi.class,
+                algorithm);
+        return new TrustManagerFactory((TrustManagerFactorySpi)instance.impl,
+                instance.provider, algorithm);
+    }
+
+    /**
+     * Returns a <code>TrustManagerFactory</code> object that acts as a
+     * factory for trust managers.
+     *
+     * <p> A new KeyManagerFactory object encapsulating the
+     * KeyManagerFactorySpi implementation from the specified provider
+     * is returned.  The specified provider must be registered
+     * in the security provider list.
+     *
+     * <p> Note that the list of registered providers may be retrieved via
+     * the {@link Security#getProviders() Security.getProviders()} method.
+     *
+     * @param algorithm the standard name of the requested trust management
+     *          algorithm.  See the <a href=
+     *          "{@docRoot}/../specs/security/standard-names.html">
+     *          Java Security Standard Algorithm Names</a> document
+     *          for information about standard algorithm names.
+     *
+     * @param provider the name of the provider.
+     *
+     * @return the new {@code TrustManagerFactory} object
+     *
+     * @throws IllegalArgumentException if the provider name is
+     *         {@code null} or empty
+     *
+     * @throws NoSuchAlgorithmException if a {@code TrustManagerFactorySpi}
+     *         implementation for the specified algorithm is not
+     *         available from the specified provider
+     *
+     * @throws NoSuchProviderException if the specified provider is not
+     *         registered in the security provider list
+     *
+     * @throws NullPointerException if {@code algorithm} is {@code null}
+     *
+     * @see java.security.Provider
+     */
+    public static final TrustManagerFactory getInstance(String algorithm,
+            String provider) throws NoSuchAlgorithmException,
+            NoSuchProviderException {
+        Objects.requireNonNull(algorithm, "null algorithm name");
+        GetInstance.Instance instance = GetInstance.getInstance
+                ("TrustManagerFactory", TrustManagerFactorySpi.class,
+                algorithm, provider);
+        return new TrustManagerFactory((TrustManagerFactorySpi)instance.impl,
+                instance.provider, algorithm);
+    }
+
+    /**
+     * Returns a <code>TrustManagerFactory</code> object that acts as a
+     * factory for trust managers.
+     *
+     * <p> A new TrustManagerFactory object encapsulating the
+     * TrustManagerFactorySpi implementation from the specified Provider
+     * object is returned.  Note that the specified Provider object
+     * does not have to be registered in the provider list.
+     *
+     * @param algorithm the standard name of the requested trust management
+     *          algorithm.  See the <a href=
+     *          "{@docRoot}/../specs/security/standard-names.html">
+     *          Java Security Standard Algorithm Names</a> document
+     *          for information about standard algorithm names.
+     *
+     * @param provider an instance of the provider.
+     *
+     * @return the new {@code TrustManagerFactory} object
+     *
+     * @throws IllegalArgumentException if the provider is {@code null}
+     *
+     * @throws NoSuchAlgorithmException if a {@code TrustManagerFactorySpi}
+     *         implementation for the specified algorithm is not available
+     *         from the specified {@code Provider} object
+     *
+     * @throws NullPointerException if {@code algorithm} is {@code null}
+     *
+     * @see java.security.Provider
+     */
+    public static final TrustManagerFactory getInstance(String algorithm,
+            Provider provider) throws NoSuchAlgorithmException {
+        Objects.requireNonNull(algorithm, "null algorithm name");
+        GetInstance.Instance instance = GetInstance.getInstance
+                ("TrustManagerFactory", TrustManagerFactorySpi.class,
+                algorithm, provider);
+        return new TrustManagerFactory((TrustManagerFactorySpi)instance.impl,
+                instance.provider, algorithm);
+    }
+
+    /**
+     * Returns the provider of this <code>TrustManagerFactory</code> object.
+     *
+     * @return the provider of this <code>TrustManagerFactory</code> object
+     */
+    public final Provider getProvider() {
+        return this.provider;
+    }
+
+
+    /**
+     * Initializes this factory with a source of certificate
+     * authorities and related trust material.
+     * <P>
+     * The provider typically uses a KeyStore as a basis for making
+     * trust decisions.
+     * <P>
+     * For more flexible initialization, please see
+     * {@link #init(ManagerFactoryParameters)}.
+     *
+     * @param ks the key store, or null
+     * @throws KeyStoreException if this operation fails
+     */
+    public final void init(KeyStore ks) throws KeyStoreException {
+        factorySpi.engineInit(ks);
+    }
+
+
+    /**
+     * Initializes this factory with a source of provider-specific
+     * trust material.
+     * <P>
+     * In some cases, initialization parameters other than a keystore
+     * may be needed by a provider.  Users of that particular provider
+     * are expected to pass an implementation of the appropriate
+     * <CODE>ManagerFactoryParameters</CODE> as defined by the
+     * provider.  The provider can then call the specified methods in
+     * the <CODE>ManagerFactoryParameters</CODE> implementation to obtain the
+     * needed information.
+     *
+     * @param spec an implementation of a provider-specific parameter
+     *          specification
+     * @throws InvalidAlgorithmParameterException if an error is
+     *          encountered
+     */
+    public final void init(ManagerFactoryParameters spec) throws
+            InvalidAlgorithmParameterException {
+        factorySpi.engineInit(spec);
+    }
+
+
+    /**
+     * Returns one trust manager for each type of trust material.
+     *
+     * @throws IllegalStateException if the factory is not initialized.
+     *
+     * @return the trust managers
+     */
+    public final TrustManager[] getTrustManagers() {
+        return factorySpi.engineGetTrustManagers();
+    }
+}

src/java.base/share/classes/javax/net/ssl/TrustManagerFactorySpi.java

@@ -0,0 +1,82 @@
+/*
+ * Copyright (c) 1999, 2008, Oracle and/or its affiliates. All rights reserved.
+ * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
+ *
+ * This code is free software; you can redistribute it and/or modify it
+ * under the terms of the GNU General Public License version 2 only, as
+ * published by the Free Software Foundation.  Oracle designates this
+ * particular file as subject to the "Classpath" exception as provided
+ * by Oracle in the LICENSE file that accompanied this code.
+ *
+ * This code is distributed in the hope that it will be useful, but WITHOUT
+ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
+ * FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License
+ * version 2 for more details (a copy is included in the LICENSE file that
+ * accompanied this code).
+ *
+ * You should have received a copy of the GNU General Public License version
+ * 2 along with this work; if not, write to the Free Software Foundation,
+ * Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.
+ *
+ * Please contact Oracle, 500 Oracle Parkway, Redwood Shores, CA 94065 USA
+ * or visit www.oracle.com if you need additional information or have any
+ * questions.
+ */
+
+package javax.net.ssl;
+
+import java.security.*;
+
+/**
+ * This class defines the <i>Service Provider Interface</i> (<b>SPI</b>)
+ * for the <code>TrustManagerFactory</code> class.
+ *
+ * <p> All the abstract methods in this class must be implemented by each
+ * cryptographic service provider who wishes to supply the implementation
+ * of a particular trust manager factory.
+ *
+ * @since 1.4
+ * @see TrustManagerFactory
+ * @see TrustManager
+ */
+public abstract class TrustManagerFactorySpi {
+    /**
+     * Initializes this factory with a source of certificate
+     * authorities and related trust material.
+     *
+     * @param ks the key store or null
+     * @throws KeyStoreException if this operation fails
+     * @see TrustManagerFactory#init(KeyStore)
+     */
+    protected abstract void engineInit(KeyStore ks) throws KeyStoreException;
+
+    /**
+     * Initializes this factory with a source of provider-specific
+     * key material.
+     * <P>
+     * In some cases, initialization parameters other than a keystore
+     * may be needed by a provider.  Users of that
+     * particular provider are expected to pass an implementation of
+     * the appropriate <CODE>ManagerFactoryParameters</CODE> as
+     * defined by the provider.  The provider can then call the
+     * specified methods in the <CODE>ManagerFactoryParameters</CODE>
+     * implementation to obtain the needed information.
+     *
+     * @param spec an implementation of a provider-specific parameter
+     *          specification
+     * @throws InvalidAlgorithmParameterException if there is problem
+     *          with the parameters
+     * @see TrustManagerFactory#init(ManagerFactoryParameters spec)
+     */
+    protected abstract void engineInit(ManagerFactoryParameters spec)
+        throws InvalidAlgorithmParameterException;
+
+    /**
+     * Returns one trust manager for each type of trust material.
+     *
+     * @throws IllegalStateException if the factory is not initialized.
+     *
+     * @return the trust managers
+     */
+    protected abstract TrustManager[] engineGetTrustManagers();
+}

src/java.base/share/classes/javax/net/ssl/X509ExtendedKeyManager.java

@@ -0,0 +1,95 @@
+/*
+ * Copyright (c) 2004, Oracle and/or its affiliates. All rights reserved.
+ * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
+ *
+ * This code is free software; you can redistribute it and/or modify it
+ * under the terms of the GNU General Public License version 2 only, as
+ * published by the Free Software Foundation.  Oracle designates this
+ * particular file as subject to the "Classpath" exception as provided
+ * by Oracle in the LICENSE file that accompanied this code.
+ *
+ * This code is distributed in the hope that it will be useful, but WITHOUT
+ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
+ * FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License
+ * version 2 for more details (a copy is included in the LICENSE file that
+ * accompanied this code).
+ *
+ * You should have received a copy of the GNU General Public License version
+ * 2 along with this work; if not, write to the Free Software Foundation,
+ * Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.
+ *
+ * Please contact Oracle, 500 Oracle Parkway, Redwood Shores, CA 94065 USA
+ * or visit www.oracle.com if you need additional information or have any
+ * questions.
+ */
+
+package javax.net.ssl;
+
+import java.security.Principal;
+
+/**
+ * Abstract class that provides for extension of the X509KeyManager
+ * interface.
+ * <P>
+ * Methods in this class should be overriden to provide actual
+ * implementations.
+ *
+ * @since 1.5
+ * @author Brad R. Wetmore
+ */
+public abstract class X509ExtendedKeyManager implements X509KeyManager {
+
+    /**
+     * Constructor used by subclasses only.
+     */
+    protected X509ExtendedKeyManager() {
+    }
+
+    /**
+     * Choose an alias to authenticate the client side of an
+     * <code>SSLEngine</code> connection given the public key type
+     * and the list of certificate issuer authorities recognized by
+     * the peer (if any).
+     * <P>
+     * The default implementation returns null.
+     *
+     * @param keyType the key algorithm type name(s), ordered
+     *          with the most-preferred key type first.
+     * @param issuers the list of acceptable CA issuer subject names
+     *          or null if it does not matter which issuers are used.
+     * @param engine the <code>SSLEngine</code> to be used for this
+     *          connection.  This parameter can be null, which indicates
+     *          that implementations of this interface are free to
+     *          select an alias applicable to any engine.
+     * @return the alias name for the desired key, or null if there
+     *          are no matches.
+     */
+    public String chooseEngineClientAlias(String[] keyType,
+            Principal[] issuers, SSLEngine engine) {
+        return null;
+    }
+
+    /**
+     * Choose an alias to authenticate the server side of an
+     * <code>SSLEngine</code> connection given the public key type
+     * and the list of certificate issuer authorities recognized by
+     * the peer (if any).
+     * <P>
+     * The default implementation returns null.
+     *
+     * @param keyType the key algorithm type name.
+     * @param issuers the list of acceptable CA issuer subject names
+     *          or null if it does not matter which issuers are used.
+     * @param engine the <code>SSLEngine</code> to be used for this
+     *          connection.  This parameter can be null, which indicates
+     *          that implementations of this interface are free to
+     *          select an alias applicable to any engine.
+     * @return the alias name for the desired key, or null if there
+     *          are no matches.
+     */
+    public String chooseEngineServerAlias(String keyType,
+            Principal[] issuers, SSLEngine engine) {
+        return null;
+    }
+
+}

src/java.base/share/classes/javax/net/ssl/X509ExtendedTrustManager.java

@@ -0,0 +1,235 @@
+/*
+ * Copyright (c) 2010, 2015, Oracle and/or its affiliates. All rights reserved.
+ * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
+ *
+ * This code is free software; you can redistribute it and/or modify it
+ * under the terms of the GNU General Public License version 2 only, as
+ * published by the Free Software Foundation.  Oracle designates this
+ * particular file as subject to the "Classpath" exception as provided
+ * by Oracle in the LICENSE file that accompanied this code.
+ *
+ * This code is distributed in the hope that it will be useful, but WITHOUT
+ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
+ * FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License
+ * version 2 for more details (a copy is included in the LICENSE file that
+ * accompanied this code).
+ *
+ * You should have received a copy of the GNU General Public License version
+ * 2 along with this work; if not, write to the Free Software Foundation,
+ * Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.
+ *
+ * Please contact Oracle, 500 Oracle Parkway, Redwood Shores, CA 94065 USA
+ * or visit www.oracle.com if you need additional information or have any
+ * questions.
+ */
+
+package javax.net.ssl;
+
+import java.net.Socket;
+import javax.net.ssl.X509TrustManager;
+
+import java.security.cert.X509Certificate;
+import java.security.cert.CertificateException;
+
+/**
+ * Extensions to the {@code X509TrustManager} interface to support
+ * SSL/TLS/DTLS connection sensitive trust management.
+ * <p>
+ * To prevent man-in-the-middle attacks, hostname checks can be done
+ * to verify that the hostname in an end-entity certificate matches the
+ * targeted hostname.  TLS/DTLS does not require such checks, but some
+ * protocols over TLS/DTLS (such as HTTPS) do.  In earlier versions of the
+ * JDK, the certificate chain checks were done at the SSL/TLS/DTLS layer,
+ * and the hostname verification checks were done at the layer over TLS/DTLS.
+ * This class allows for the checking to be done during a single call to
+ * this class.
+ * <p>
+ * RFC 2830 defines the server identification specification for the "LDAPS"
+ * algorithm. RFC 2818 defines both the server identification and the
+ * client identification specification for the "HTTPS" algorithm.
+ *
+ * @see X509TrustManager
+ * @see HostnameVerifier
+ *
+ * @since 1.7
+ */
+public abstract class X509ExtendedTrustManager implements X509TrustManager {
+    /**
+     * Given the partial or complete certificate chain provided by the
+     * peer, build and validate the certificate path based on the
+     * authentication type and ssl parameters.
+     * <p>
+     * The authentication type is determined by the actual certificate
+     * used. For instance, if RSAPublicKey is used, the authType
+     * should be "RSA". Checking is case-sensitive.
+     * <p>
+     * If the {@code socket} parameter is an instance of
+     * {@link javax.net.ssl.SSLSocket}, and the endpoint identification
+     * algorithm of the {@code SSLParameters} is non-empty, to prevent
+     * man-in-the-middle attacks, the address that the {@code socket}
+     * connected to should be checked against the peer's identity presented
+     * in the end-entity X509 certificate, as specified in the endpoint
+     * identification algorithm.
+     * <p>
+     * If the {@code socket} parameter is an instance of
+     * {@link javax.net.ssl.SSLSocket}, and the algorithm constraints of the
+     * {@code SSLParameters} is non-null, for every certificate in the
+     * certification path, fields such as subject public key, the signature
+     * algorithm, key usage, extended key usage, etc. need to conform to the
+     * algorithm constraints in place on this socket.
+     *
+     * @param chain the peer certificate chain
+     * @param authType the key exchange algorithm used
+     * @param socket the socket used for this connection. This parameter
+     *        can be null, which indicates that implementations need not check
+     *        the ssl parameters
+     * @throws IllegalArgumentException if null or zero-length array is passed
+     *        in for the {@code chain} parameter or if null or zero-length
+     *        string is passed in for the {@code authType} parameter
+     * @throws CertificateException if the certificate chain is not trusted
+     *        by this TrustManager
+     *
+     * @see SSLParameters#getEndpointIdentificationAlgorithm
+     * @see SSLParameters#setEndpointIdentificationAlgorithm(String)
+     * @see SSLParameters#getAlgorithmConstraints
+     * @see SSLParameters#setAlgorithmConstraints(AlgorithmConstraints)
+     */
+    public abstract void checkClientTrusted(X509Certificate[] chain,
+            String authType, Socket socket) throws CertificateException;
+
+    /**
+     * Given the partial or complete certificate chain provided by the
+     * peer, build and validate the certificate path based on the
+     * authentication type and ssl parameters.
+     * <p>
+     * The authentication type is the key exchange algorithm portion
+     * of the cipher suites represented as a String, such as "RSA",
+     * "DHE_DSS". Note: for some exportable cipher suites, the key
+     * exchange algorithm is determined at run time during the
+     * handshake. For instance, for TLS_RSA_EXPORT_WITH_RC4_40_MD5,
+     * the authType should be RSA_EXPORT when an ephemeral RSA key is
+     * used for the key exchange, and RSA when the key from the server
+     * certificate is used. Checking is case-sensitive.
+     * <p>
+     * If the {@code socket} parameter is an instance of
+     * {@link javax.net.ssl.SSLSocket}, and the endpoint identification
+     * algorithm of the {@code SSLParameters} is non-empty, to prevent
+     * man-in-the-middle attacks, the address that the {@code socket}
+     * connected to should be checked against the peer's identity presented
+     * in the end-entity X509 certificate, as specified in the endpoint
+     * identification algorithm.
+     * <p>
+     * If the {@code socket} parameter is an instance of
+     * {@link javax.net.ssl.SSLSocket}, and the algorithm constraints of the
+     *  {@code SSLParameters} is non-null, for every certificate in the
+     * certification path, fields such as subject public key, the signature
+     * algorithm, key usage, extended key usage, etc. need to conform to the
+     * algorithm constraints in place on this socket.
+     *
+     * @param chain the peer certificate chain
+     * @param authType the key exchange algorithm used
+     * @param socket the socket used for this connection. This parameter
+     *        can be null, which indicates that implementations need not check
+     *        the ssl parameters
+     * @throws IllegalArgumentException if null or zero-length array is passed
+     *        in for the {@code chain} parameter or if null or zero-length
+     *        string is passed in for the {@code authType} parameter
+     * @throws CertificateException if the certificate chain is not trusted
+     *        by this TrustManager
+     *
+     * @see SSLParameters#getEndpointIdentificationAlgorithm
+     * @see SSLParameters#setEndpointIdentificationAlgorithm(String)
+     * @see SSLParameters#getAlgorithmConstraints
+     * @see SSLParameters#setAlgorithmConstraints(AlgorithmConstraints)
+     */
+    public abstract void checkServerTrusted(X509Certificate[] chain,
+        String authType, Socket socket) throws CertificateException;
+
+    /**
+     * Given the partial or complete certificate chain provided by the
+     * peer, build and validate the certificate path based on the
+     * authentication type and ssl parameters.
+     * <p>
+     * The authentication type is determined by the actual certificate
+     * used. For instance, if RSAPublicKey is used, the authType
+     * should be "RSA". Checking is case-sensitive.
+     * <p>
+     * If the {@code engine} parameter is available, and the endpoint
+     * identification algorithm of the {@code SSLParameters} is
+     * non-empty, to prevent man-in-the-middle attacks, the address that
+     * the {@code engine} connected to should be checked against
+     * the peer's identity presented in the end-entity X509 certificate,
+     * as specified in the endpoint identification algorithm.
+     * <p>
+     * If the {@code engine} parameter is available, and the algorithm
+     * constraints of the {@code SSLParameters} is non-null, for every
+     * certificate in the certification path, fields such as subject public
+     * key, the signature algorithm, key usage, extended key usage, etc.
+     * need to conform to the algorithm constraints in place on this engine.
+     *
+     * @param chain the peer certificate chain
+     * @param authType the key exchange algorithm used
+     * @param engine the engine used for this connection. This parameter
+     *        can be null, which indicates that implementations need not check
+     *        the ssl parameters
+     * @throws IllegalArgumentException if null or zero-length array is passed
+     *        in for the {@code chain} parameter or if null or zero-length
+     *        string is passed in for the {@code authType} parameter
+     * @throws CertificateException if the certificate chain is not trusted
+     *        by this TrustManager
+     *
+     * @see SSLParameters#getEndpointIdentificationAlgorithm
+     * @see SSLParameters#setEndpointIdentificationAlgorithm(String)
+     * @see SSLParameters#getAlgorithmConstraints
+     * @see SSLParameters#setAlgorithmConstraints(AlgorithmConstraints)
+     */
+    public abstract void checkClientTrusted(X509Certificate[] chain,
+        String authType, SSLEngine engine) throws CertificateException;
+
+    /**
+     * Given the partial or complete certificate chain provided by the
+     * peer, build and validate the certificate path based on the
+     * authentication type and ssl parameters.
+     * <p>
+     * The authentication type is the key exchange algorithm portion
+     * of the cipher suites represented as a String, such as "RSA",
+     * "DHE_DSS". Note: for some exportable cipher suites, the key
+     * exchange algorithm is determined at run time during the
+     * handshake. For instance, for TLS_RSA_EXPORT_WITH_RC4_40_MD5,
+     * the authType should be RSA_EXPORT when an ephemeral RSA key is
+     * used for the key exchange, and RSA when the key from the server
+     * certificate is used. Checking is case-sensitive.
+     * <p>
+     * If the {@code engine} parameter is available, and the endpoint
+     * identification algorithm of the {@code SSLParameters} is
+     * non-empty, to prevent man-in-the-middle attacks, the address that
+     * the {@code engine} connected to should be checked against
+     * the peer's identity presented in the end-entity X509 certificate,
+     * as specified in the endpoint identification algorithm.
+     * <p>
+     * If the {@code engine} parameter is available, and the algorithm
+     * constraints of the {@code SSLParameters} is non-null, for every
+     * certificate in the certification path, fields such as subject public
+     * key, the signature algorithm, key usage, extended key usage, etc.
+     * need to conform to the algorithm constraints in place on this engine.
+     *
+     * @param chain the peer certificate chain
+     * @param authType the key exchange algorithm used
+     * @param engine the engine used for this connection. This parameter
+     *        can be null, which indicates that implementations need not check
+     *        the ssl parameters
+     * @throws IllegalArgumentException if null or zero-length array is passed
+     *        in for the {@code chain} parameter or if null or zero-length
+     *        string is passed in for the {@code authType} parameter
+     * @throws CertificateException if the certificate chain is not trusted
+     *        by this TrustManager
+     *
+     * @see SSLParameters#getEndpointIdentificationAlgorithm
+     * @see SSLParameters#setEndpointIdentificationAlgorithm(String)
+     * @see SSLParameters#getAlgorithmConstraints
+     * @see SSLParameters#setAlgorithmConstraints(AlgorithmConstraints)
+     */
+    public abstract void checkServerTrusted(X509Certificate[] chain,
+        String authType, SSLEngine engine) throws CertificateException;
+
+}

src/java.base/share/classes/javax/net/ssl/X509KeyManager.java

@@ -0,0 +1,134 @@
+/*
+ * Copyright (c) 1999, 2016, Oracle and/or its affiliates. All rights reserved.
+ * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
+ *
+ * This code is free software; you can redistribute it and/or modify it
+ * under the terms of the GNU General Public License version 2 only, as
+ * published by the Free Software Foundation.  Oracle designates this
+ * particular file as subject to the "Classpath" exception as provided
+ * by Oracle in the LICENSE file that accompanied this code.
+ *
+ * This code is distributed in the hope that it will be useful, but WITHOUT
+ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
+ * FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License
+ * version 2 for more details (a copy is included in the LICENSE file that
+ * accompanied this code).
+ *
+ * You should have received a copy of the GNU General Public License version
+ * 2 along with this work; if not, write to the Free Software Foundation,
+ * Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.
+ *
+ * Please contact Oracle, 500 Oracle Parkway, Redwood Shores, CA 94065 USA
+ * or visit www.oracle.com if you need additional information or have any
+ * questions.
+ */
+
+package javax.net.ssl;
+
+import java.security.PrivateKey;
+import java.security.Principal;
+import java.security.cert.X509Certificate;
+import java.net.Socket;
+
+/**
+ * Instances of this interface manage which X509 certificate-based
+ * key pairs are used to authenticate the local side of a secure
+ * socket.
+ * <P>
+ * During secure socket negotiations, implementations
+ * call methods in this interface to:
+ * <UL>
+ * <LI> determine the set of aliases that are available for negotiations
+ *      based on the criteria presented,
+ * <LI> select the <i> best alias</i> based on
+ *      the criteria presented, and
+ * <LI> obtain the corresponding key material for given aliases.
+ * </UL>
+ * <P>
+ * Note: the X509ExtendedKeyManager should be used in favor of this
+ * class.
+ *
+ * @since 1.4
+ */
+public interface X509KeyManager extends KeyManager {
+    /**
+     * Get the matching aliases for authenticating the client side of a secure
+     * socket given the public key type and the list of
+     * certificate issuer authorities recognized by the peer (if any).
+     *
+     * @param keyType the key algorithm type name
+     * @param issuers the list of acceptable CA issuer subject names,
+     *          or null if it does not matter which issuers are used.
+     * @return an array of the matching alias names, or null if there
+     *          were no matches.
+     */
+    public String[] getClientAliases(String keyType, Principal[] issuers);
+
+    /**
+     * Choose an alias to authenticate the client side of a secure
+     * socket given the public key type and the list of
+     * certificate issuer authorities recognized by the peer (if any).
+     *
+     * @param keyType the key algorithm type name(s), ordered
+     *          with the most-preferred key type first.
+     * @param issuers the list of acceptable CA issuer subject names
+     *           or null if it does not matter which issuers are used.
+     * @param socket the socket to be used for this connection.  This
+     *          parameter can be null, which indicates that
+     *          implementations are free to select an alias applicable
+     *          to any socket.
+     * @return the alias name for the desired key, or null if there
+     *          are no matches.
+     */
+    public String chooseClientAlias(String[] keyType, Principal[] issuers,
+        Socket socket);
+
+    /**
+     * Get the matching aliases for authenticating the server side of a secure
+     * socket given the public key type and the list of
+     * certificate issuer authorities recognized by the peer (if any).
+     *
+     * @param keyType the key algorithm type name
+     * @param issuers the list of acceptable CA issuer subject names
+     *          or null if it does not matter which issuers are used.
+     * @return an array of the matching alias names, or null
+     *          if there were no matches.
+     */
+    public String[] getServerAliases(String keyType, Principal[] issuers);
+
+    /**
+     * Choose an alias to authenticate the server side of a secure
+     * socket given the public key type and the list of
+     * certificate issuer authorities recognized by the peer (if any).
+     *
+     * @param keyType the key algorithm type name.
+     * @param issuers the list of acceptable CA issuer subject names
+     *          or null if it does not matter which issuers are used.
+     * @param socket the socket to be used for this connection.  This
+     *          parameter can be null, which indicates that
+     *          implementations are free to select an alias applicable
+     *          to any socket.
+     * @return the alias name for the desired key, or null if there
+     *          are no matches.
+     */
+    public String chooseServerAlias(String keyType, Principal[] issuers,
+        Socket socket);
+
+    /**
+     * Returns the certificate chain associated with the given alias.
+     *
+     * @param alias the alias name
+     * @return the certificate chain (ordered with the user's certificate first
+     *          and the root certificate authority last), or null
+     *          if the alias can't be found.
+     */
+    public X509Certificate[] getCertificateChain(String alias);
+
+    /**
+     * Returns the key associated with the given alias.
+     *
+     * @param alias the alias name
+     * @return the requested key, or null if the alias can't be found.
+     */
+    public PrivateKey getPrivateKey(String alias);
+}

src/java.base/share/classes/javax/net/ssl/X509TrustManager.java

@@ -0,0 +1,95 @@
+/*
+ * Copyright (c) 1999, 2005, Oracle and/or its affiliates. All rights reserved.
+ * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
+ *
+ * This code is free software; you can redistribute it and/or modify it
+ * under the terms of the GNU General Public License version 2 only, as
+ * published by the Free Software Foundation.  Oracle designates this
+ * particular file as subject to the "Classpath" exception as provided
+ * by Oracle in the LICENSE file that accompanied this code.
+ *
+ * This code is distributed in the hope that it will be useful, but WITHOUT
+ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
+ * FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License
+ * version 2 for more details (a copy is included in the LICENSE file that
+ * accompanied this code).
+ *
+ * You should have received a copy of the GNU General Public License version
+ * 2 along with this work; if not, write to the Free Software Foundation,
+ * Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.
+ *
+ * Please contact Oracle, 500 Oracle Parkway, Redwood Shores, CA 94065 USA
+ * or visit www.oracle.com if you need additional information or have any
+ * questions.
+ */
+
+package javax.net.ssl;
+
+import java.security.cert.*;
+
+/**
+ * Instance of this interface manage which X509 certificates
+ * may be used to authenticate the remote side of a secure
+ * socket. Decisions may be based on trusted certificate
+ * authorities, certificate revocation lists, online
+ * status checking or other means.
+ *
+ * @since 1.4
+ */
+public interface X509TrustManager extends TrustManager {
+    /**
+     * Given the partial or complete certificate chain provided by the
+     * peer, build a certificate path to a trusted root and return if
+     * it can be validated and is trusted for client SSL
+     * authentication based on the authentication type.
+     * <p>
+     * The authentication type is determined by the actual certificate
+     * used. For instance, if RSAPublicKey is used, the authType
+     * should be "RSA". Checking is case-sensitive.
+     *
+     * @param chain the peer certificate chain
+     * @param authType the authentication type based on the client certificate
+     * @throws IllegalArgumentException if null or zero-length chain
+     *         is passed in for the chain parameter or if null or zero-length
+     *         string is passed in for the  authType parameter
+     * @throws CertificateException if the certificate chain is not trusted
+     *         by this TrustManager.
+     */
+    public void checkClientTrusted(X509Certificate[] chain, String authType)
+        throws CertificateException;
+
+    /**
+     * Given the partial or complete certificate chain provided by the
+     * peer, build a certificate path to a trusted root and return if
+     * it can be validated and is trusted for server SSL
+     * authentication based on the authentication type.
+     * <p>
+     * The authentication type is the key exchange algorithm portion
+     * of the cipher suites represented as a String, such as "RSA",
+     * "DHE_DSS". Note: for some exportable cipher suites, the key
+     * exchange algorithm is determined at run time during the
+     * handshake. For instance, for TLS_RSA_EXPORT_WITH_RC4_40_MD5,
+     * the authType should be RSA_EXPORT when an ephemeral RSA key is
+     * used for the key exchange, and RSA when the key from the server
+     * certificate is used. Checking is case-sensitive.
+     *
+     * @param chain the peer certificate chain
+     * @param authType the key exchange algorithm used
+     * @throws IllegalArgumentException if null or zero-length chain
+     *         is passed in for the chain parameter or if null or zero-length
+     *         string is passed in for the  authType parameter
+     * @throws CertificateException if the certificate chain is not trusted
+     *         by this TrustManager.
+     */
+    public void checkServerTrusted(X509Certificate[] chain, String authType)
+        throws CertificateException;
+
+    /**
+     * Return an array of certificate authority certificates
+     * which are trusted for authenticating peers.
+     *
+     * @return a non-null (possibly empty) array of acceptable
+     *          CA issuer certificates.
+     */
+    public X509Certificate[] getAcceptedIssuers();
+}

src/java.base/share/classes/javax/net/ssl/package-info.java

@@ -0,0 +1,41 @@
+/*
+ * Copyright (c) 1999, 2017, Oracle and/or its affiliates. All rights reserved.
+ * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
+ *
+ * This code is free software; you can redistribute it and/or modify it
+ * under the terms of the GNU General Public License version 2 only, as
+ * published by the Free Software Foundation.  Oracle designates this
+ * particular file as subject to the "Classpath" exception as provided
+ * by Oracle in the LICENSE file that accompanied this code.
+ *
+ * This code is distributed in the hope that it will be useful, but WITHOUT
+ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
+ * FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License
+ * version 2 for more details (a copy is included in the LICENSE file that
+ * accompanied this code).
+ *
+ * You should have received a copy of the GNU General Public License version
+ * 2 along with this work; if not, write to the Free Software Foundation,
+ * Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.
+ *
+ * Please contact Oracle, 500 Oracle Parkway, Redwood Shores, CA 94065 USA
+ * or visit www.oracle.com if you need additional information or have any
+ * questions.
+ */
+
+/**
+ * Provides classes for the secure socket package. Using the secure
+ * socket classes, you can communicate using SSL or a related security
+ * protocol to reliably detect any errors introduced into the network
+ * byte stream and to optionally encrypt the data and/or authenticate
+ * the communicating peers.
+ *
+ * <ul>
+ * <li><a href="{@docRoot}/../specs/security/standard-names.html">
+ * <b>Java&trade; Security Standard Algorithm Names Specification
+ * </b></a></li>
+ * </ul>
+ *
+ * @since 1.4
+ */
+package javax.net.ssl;