private static SNIServerName chooseSni(Collection<SNIMatcher> matchers,
        List<SNIServerName> sniNames) {
    if (sniNames != null && !sniNames.isEmpty()) {
        for (SNIMatcher matcher : matchers) {
            int matcherType = matcher.getType();
            for (SNIServerName sniName : sniNames) {
                if (sniName.getType() == matcherType) {
                    if (matcher.matches(sniName)) {
                        return sniName;
                    }

                    // no duplicated entry in the server names list.
                    break;
                }
            }
        }
    }

    return null;
}
 

@SuppressWarnings("unchecked")
static boolean checkSniHostnameMatch(Collection<?> matchers, String hostname) {
    if (matchers != null && !matchers.isEmpty()) {
        SNIHostName name = new SNIHostName(hostname);
        Iterator<SNIMatcher> matcherIt = (Iterator<SNIMatcher>) matchers.iterator();
        while (matcherIt.hasNext()) {
            SNIMatcher matcher = matcherIt.next();
            // type 0 is for hostname
            if (matcher.getType() == 0 && matcher.matches(name)) {
                return true;
            }
        }
        return false;
    }
    return true;
}
 

private static SNIServerName chooseSni(Collection<SNIMatcher> matchers,
        List<SNIServerName> sniNames) {
    if (sniNames != null && !sniNames.isEmpty()) {
        for (SNIMatcher matcher : matchers) {
            int matcherType = matcher.getType();
            for (SNIServerName sniName : sniNames) {
                if (sniName.getType() == matcherType) {
                    if (matcher.matches(sniName)) {
                        return sniName;
                    }

                    // no duplicated entry in the server names list.
                    break;
                }
            }
        }
    }

    return null;
}
 

/**
 * Returns server ssl engine.
 *
 * @param context - SSLContext to get SSLEngine from.
 * @param useSNI  - flag used to enable or disable using SNI extension.
 *                Needed for Kerberos.
 */
public static SSLEngine getServerSSLEngine(
        SSLContext context, boolean useSNI) {

    SSLEngine serverEngine = context.createSSLEngine();
    serverEngine.setUseClientMode(false);
    if (useSNI) {
        SNIMatcher matcher = SNIHostName.createSNIMatcher(SNI_PATTERN);
        List<SNIMatcher> matchers = new ArrayList<>();
        matchers.add(matcher);
        SSLParameters params = serverEngine.getSSLParameters();
        params.setSNIMatchers(matchers);
        serverEngine.setSSLParameters(params);
    }
    return serverEngine;
}
 

SSLConfiguration(SSLContextImpl sslContext, boolean isClientMode) {

        // Configurations with SSLParameters, default values.
        this.userSpecifiedAlgorithmConstraints =
                SSLAlgorithmConstraints.DEFAULT;
        this.enabledProtocols =
                sslContext.getDefaultProtocolVersions(!isClientMode);
        this.enabledCipherSuites =
                sslContext.getDefaultCipherSuites(!isClientMode);
        this.clientAuthType = ClientAuthType.CLIENT_AUTH_NONE;

        this.identificationProtocol = null;
        this.serverNames = Collections.<SNIServerName>emptyList();
        this.sniMatchers = Collections.<SNIMatcher>emptyList();
        this.preferLocalCipherSuites = false;

        this.applicationProtocols = new String[0];
        this.enableRetransmissions = sslContext.isDTLS();
        this.maximumPacketSize = 0;         // please reset it explicitly later

        this.maximumProtocolVersion = ProtocolVersion.NONE;
        for (ProtocolVersion pv : enabledProtocols) {
            if (pv.compareTo(maximumProtocolVersion) > 0) {
                this.maximumProtocolVersion = pv;
            }
        }

        // Configurations per SSLSocket or SSLEngine instance.
        this.isClientMode = isClientMode;
        this.enableSessionCreation = true;
        this.socketAPSelector = null;
        this.engineAPSelector = null;

        this.handshakeListeners = null;
        this.noSniExtension = false;
        this.noSniMatcher = false;
    }
 

boolean isMatched(Collection<SNIMatcher> matchers) {
    if (sniMap != null && !sniMap.isEmpty()) {
        for (SNIMatcher matcher : matchers) {
            SNIServerName sniName = sniMap.get(matcher.getType());
            if (sniName != null && (!matcher.matches(sniName))) {
                return false;
            }
        }
    }

    return true;
}
 

/**
 * Applies SSLParameters to newly accepted connections.
 */
@Override
synchronized public void setSSLParameters(SSLParameters params) {
    super.setSSLParameters(params);

    // the super implementation does not handle the following parameters
    identificationProtocol = params.getEndpointIdentificationAlgorithm();
    algorithmConstraints = params.getAlgorithmConstraints();
    preferLocalCipherSuites = params.getUseCipherSuitesOrder();
    Collection<SNIMatcher> matchers = params.getSNIMatchers();
    if (matchers != null) {
        sniMatchers = params.getSNIMatchers();
    }
}
 

static SSLEchoServer init(String cipherSuiteFilter,
        String sniPattern) throws NoSuchAlgorithmException, IOException {
    SSLContext context = SSLContext.getDefault();
    SSLServerSocketFactory ssf =
            (SSLServerSocketFactory) context.getServerSocketFactory();
    SSLServerSocket ssocket =
            (SSLServerSocket) ssf.createServerSocket(0);

    // specify enabled cipher suites
    if (cipherSuiteFilter != null) {
        String[] ciphersuites = UnboundSSLUtils.filterStringArray(
                ssf.getSupportedCipherSuites(), cipherSuiteFilter);
        System.out.println("Server: enabled cipher suites: "
                + Arrays.toString(ciphersuites));
        ssocket.setEnabledCipherSuites(ciphersuites);
    }

    // specify SNI matcher pattern
    if (sniPattern != null) {
        System.out.println("Server: set SNI matcher: " + sniPattern);
        SNIMatcher matcher = SNIHostName.createSNIMatcher(sniPattern);
        List<SNIMatcher> matchers = new ArrayList<>();
        matchers.add(matcher);
        SSLParameters params = ssocket.getSSLParameters();
        params.setSNIMatchers(matchers);
        ssocket.setSSLParameters(params);
    }

    return new SSLEchoServer(ssocket);
}
 

static void setSNIMatcher(SSLParameters parameters) {
    SNIMatcher matcher = new SNIMatcher(0) {
        @Override
        public boolean matches(SNIServerName sniServerName) {
            return false;
        }
    };
    parameters.setSNIMatchers(Collections.singleton(matcher));
}
 

boolean isMatched(Collection<SNIMatcher> matchers) {
    if (sniMap != null && !sniMap.isEmpty()) {
        for (SNIMatcher matcher : matchers) {
            SNIServerName sniName = sniMap.get(matcher.getType());
            if (sniName != null && (!matcher.matches(sniName))) {
                return false;
            }
        }
    }

    return true;
}
 

/**
 * Applies SSLParameters to newly accepted connections.
 */
@Override
synchronized public void setSSLParameters(SSLParameters params) {
    super.setSSLParameters(params);

    // the super implementation does not handle the following parameters
    identificationProtocol = params.getEndpointIdentificationAlgorithm();
    algorithmConstraints = params.getAlgorithmConstraints();
    preferLocalCipherSuites = params.getUseCipherSuitesOrder();
    Collection<SNIMatcher> matchers = params.getSNIMatchers();
    if (matchers != null) {
        sniMatchers = params.getSNIMatchers();
    }
}
 

static SSLEchoServer init(String cipherSuiteFilter,
        String sniPattern) throws NoSuchAlgorithmException, IOException {
    SSLContext context = SSLContext.getDefault();
    SSLServerSocketFactory ssf =
            (SSLServerSocketFactory) context.getServerSocketFactory();
    SSLServerSocket ssocket =
            (SSLServerSocket) ssf.createServerSocket(0);

    // specify enabled cipher suites
    if (cipherSuiteFilter != null) {
        String[] ciphersuites = UnboundSSLUtils.filterStringArray(
                ssf.getSupportedCipherSuites(), cipherSuiteFilter);
        System.out.println("Server: enabled cipher suites: "
                + Arrays.toString(ciphersuites));
        ssocket.setEnabledCipherSuites(ciphersuites);
    }

    // specify SNI matcher pattern
    if (sniPattern != null) {
        System.out.println("Server: set SNI matcher: " + sniPattern);
        SNIMatcher matcher = SNIHostName.createSNIMatcher(sniPattern);
        List<SNIMatcher> matchers = new ArrayList<>();
        matchers.add(matcher);
        SSLParameters params = ssocket.getSSLParameters();
        params.setSNIMatchers(matchers);
        ssocket.setSSLParameters(params);
    }

    return new SSLEchoServer(ssocket);
}
 

boolean isMatched(Collection<SNIMatcher> matchers) {
    if (sniMap != null && !sniMap.isEmpty()) {
        for (SNIMatcher matcher : matchers) {
            SNIServerName sniName = sniMap.get(matcher.getType());
            if (sniName != null && (!matcher.matches(sniName))) {
                return false;
            }
        }
    }

    return true;
}
 

/**
 * Applies SSLParameters to newly accepted connections.
 */
@Override
synchronized public void setSSLParameters(SSLParameters params) {
    super.setSSLParameters(params);

    // the super implementation does not handle the following parameters
    identificationProtocol = params.getEndpointIdentificationAlgorithm();
    algorithmConstraints = params.getAlgorithmConstraints();
    preferLocalCipherSuites = params.getUseCipherSuitesOrder();
    Collection<SNIMatcher> matchers = params.getSNIMatchers();
    if (matchers != null) {
        sniMatchers = params.getSNIMatchers();
    }
}
 

boolean isMatched(Collection<SNIMatcher> matchers) {
    if (sniMap != null && !sniMap.isEmpty()) {
        for (SNIMatcher matcher : matchers) {
            SNIServerName sniName = sniMap.get(matcher.getType());
            if (sniName != null && (!matcher.matches(sniName))) {
                return false;
            }
        }
    }

    return true;
}
 

/**
 * Applies SSLParameters to newly accepted connections.
 */
@Override
synchronized public void setSSLParameters(SSLParameters params) {
    super.setSSLParameters(params);

    // the super implementation does not handle the following parameters
    identificationProtocol = params.getEndpointIdentificationAlgorithm();
    algorithmConstraints = params.getAlgorithmConstraints();
    preferLocalCipherSuites = params.getUseCipherSuitesOrder();
    Collection<SNIMatcher> matchers = params.getSNIMatchers();
    if (matchers != null) {
        sniMatchers = params.getSNIMatchers();
    }
    applicationProtocols = params.getApplicationProtocols();
}
 

static SSLEchoServer init(String cipherSuiteFilter,
        String sniPattern) throws NoSuchAlgorithmException, IOException {
    SSLContext context = SSLContext.getDefault();
    SSLServerSocketFactory ssf =
            (SSLServerSocketFactory) context.getServerSocketFactory();
    SSLServerSocket ssocket =
            (SSLServerSocket) ssf.createServerSocket(0);

    // specify enabled cipher suites
    if (cipherSuiteFilter != null) {
        String[] ciphersuites = UnboundSSLUtils.filterStringArray(
                ssf.getSupportedCipherSuites(), cipherSuiteFilter);
        System.out.println("Server: enabled cipher suites: "
                + Arrays.toString(ciphersuites));
        ssocket.setEnabledCipherSuites(ciphersuites);
    }

    // specify SNI matcher pattern
    if (sniPattern != null) {
        System.out.println("Server: set SNI matcher: " + sniPattern);
        SNIMatcher matcher = SNIHostName.createSNIMatcher(sniPattern);
        List<SNIMatcher> matchers = new ArrayList<>();
        matchers.add(matcher);
        SSLParameters params = ssocket.getSSLParameters();
        params.setSNIMatchers(matchers);
        ssocket.setSSLParameters(params);
    }

    return new SSLEchoServer(ssocket);
}
 

boolean isMatched(Collection<SNIMatcher> matchers) {
    if (sniMap != null && !sniMap.isEmpty()) {
        for (SNIMatcher matcher : matchers) {
            SNIServerName sniName = sniMap.get(matcher.getType());
            if (sniName != null && (!matcher.matches(sniName))) {
                return false;
            }
        }
    }

    return true;
}
 

/**
 * Applies SSLParameters to newly accepted connections.
 */
@Override
synchronized public void setSSLParameters(SSLParameters params) {
    super.setSSLParameters(params);

    // the super implementation does not handle the following parameters
    identificationProtocol = params.getEndpointIdentificationAlgorithm();
    algorithmConstraints = params.getAlgorithmConstraints();
    preferLocalCipherSuites = params.getUseCipherSuitesOrder();
    Collection<SNIMatcher> matchers = params.getSNIMatchers();
    if (matchers != null) {
        sniMatchers = params.getSNIMatchers();
    }
}
 

static SSLEchoServer init(String cipherSuiteFilter,
        String sniPattern) throws NoSuchAlgorithmException, IOException {
    SSLContext context = SSLContext.getDefault();
    SSLServerSocketFactory ssf =
            (SSLServerSocketFactory) context.getServerSocketFactory();
    SSLServerSocket ssocket =
            (SSLServerSocket) ssf.createServerSocket(0);

    // specify enabled cipher suites
    if (cipherSuiteFilter != null) {
        String[] ciphersuites = UnboundSSLUtils.filterStringArray(
                ssf.getSupportedCipherSuites(), cipherSuiteFilter);
        System.out.println("Server: enabled cipher suites: "
                + Arrays.toString(ciphersuites));
        ssocket.setEnabledCipherSuites(ciphersuites);
    }

    // specify SNI matcher pattern
    if (sniPattern != null) {
        System.out.println("Server: set SNI matcher: " + sniPattern);
        SNIMatcher matcher = SNIHostName.createSNIMatcher(sniPattern);
        List<SNIMatcher> matchers = new ArrayList<>();
        matchers.add(matcher);
        SSLParameters params = ssocket.getSSLParameters();
        params.setSNIMatchers(matchers);
        ssocket.setSSLParameters(params);
    }

    return new SSLEchoServer(ssocket);
}
 

SSLConfiguration(SSLContextImpl sslContext, boolean isClientMode) {

        // Configurations with SSLParameters, default values.
        this.algorithmConstraints = SSLAlgorithmConstraints.DEFAULT;
        this.enabledProtocols =
                sslContext.getDefaultProtocolVersions(!isClientMode);
        this.enabledCipherSuites =
                sslContext.getDefaultCipherSuites(!isClientMode);
        this.clientAuthType = ClientAuthType.CLIENT_AUTH_NONE;

        this.identificationProtocol = null;
        this.serverNames = Collections.<SNIServerName>emptyList();
        this.sniMatchers = Collections.<SNIMatcher>emptyList();
        this.preferLocalCipherSuites = true;

        this.applicationProtocols = new String[0];
        this.enableRetransmissions = sslContext.isDTLS();
        this.maximumPacketSize = 0;         // please reset it explicitly later

        this.maximumProtocolVersion = ProtocolVersion.NONE;
        for (ProtocolVersion pv : enabledProtocols) {
            if (pv.compareTo(maximumProtocolVersion) > 0) {
                this.maximumProtocolVersion = pv;
            }
        }

        // Configurations per SSLSocket or SSLEngine instance.
        this.isClientMode = isClientMode;
        this.enableSessionCreation = true;
        this.socketAPSelector = null;
        this.engineAPSelector = null;

        this.handshakeListeners = null;
        this.noSniExtension = false;
        this.noSniMatcher = false;
    }
 

boolean isMatched(Collection<SNIMatcher> matchers) {
    if (sniMap != null && !sniMap.isEmpty()) {
        for (SNIMatcher matcher : matchers) {
            SNIServerName sniName = sniMap.get(matcher.getType());
            if (sniName != null && (!matcher.matches(sniName))) {
                return false;
            }
        }
    }

    return true;
}
 

/**
 * Applies SSLParameters to newly accepted connections.
 */
@Override
public synchronized void setSSLParameters(SSLParameters params) {
    super.setSSLParameters(params);

    // the super implementation does not handle the following parameters
    identificationProtocol = params.getEndpointIdentificationAlgorithm();
    algorithmConstraints = params.getAlgorithmConstraints();
    preferLocalCipherSuites = params.getUseCipherSuitesOrder();
    Collection<SNIMatcher> matchers = params.getSNIMatchers();
    if (matchers != null) {
        sniMatchers = params.getSNIMatchers();
    }
    applicationProtocols = params.getApplicationProtocols();
}
 

static SSLEchoServer init(String cipherSuiteFilter,
        String sniPattern) throws NoSuchAlgorithmException, IOException {
    SSLContext context = SSLContext.getDefault();
    SSLServerSocketFactory ssf =
            (SSLServerSocketFactory) context.getServerSocketFactory();
    SSLServerSocket ssocket =
            (SSLServerSocket) ssf.createServerSocket(0);

    // specify enabled cipher suites
    if (cipherSuiteFilter != null) {
        String[] ciphersuites = UnboundSSLUtils.filterStringArray(
                ssf.getSupportedCipherSuites(), cipherSuiteFilter);
        System.out.println("Server: enabled cipher suites: "
                + Arrays.toString(ciphersuites));
        ssocket.setEnabledCipherSuites(ciphersuites);
    }

    // specify SNI matcher pattern
    if (sniPattern != null) {
        System.out.println("Server: set SNI matcher: " + sniPattern);
        SNIMatcher matcher = SNIHostName.createSNIMatcher(sniPattern);
        List<SNIMatcher> matchers = new ArrayList<>();
        matchers.add(matcher);
        SSLParameters params = ssocket.getSSLParameters();
        params.setSNIMatchers(matchers);
        ssocket.setSSLParameters(params);
    }

    return new SSLEchoServer(ssocket);
}
 

boolean isMatched(Collection<SNIMatcher> matchers) {
    if (sniMap != null && !sniMap.isEmpty()) {
        for (SNIMatcher matcher : matchers) {
            SNIServerName sniName = sniMap.get(matcher.getType());
            if (sniName != null && (!matcher.matches(sniName))) {
                return false;
            }
        }
    }

    return true;
}
 

/**
 * Applies SSLParameters to newly accepted connections.
 */
@Override
synchronized public void setSSLParameters(SSLParameters params) {
    super.setSSLParameters(params);

    // the super implementation does not handle the following parameters
    identificationProtocol = params.getEndpointIdentificationAlgorithm();
    algorithmConstraints = params.getAlgorithmConstraints();
    preferLocalCipherSuites = params.getUseCipherSuitesOrder();
    Collection<SNIMatcher> matchers = params.getSNIMatchers();
    if (matchers != null) {
        sniMatchers = params.getSNIMatchers();
    }
}
 

static SSLEchoServer init(String cipherSuiteFilter,
        String sniPattern) throws NoSuchAlgorithmException, IOException {
    SSLContext context = SSLContext.getDefault();
    SSLServerSocketFactory ssf =
            (SSLServerSocketFactory) context.getServerSocketFactory();
    SSLServerSocket ssocket =
            (SSLServerSocket) ssf.createServerSocket(0);

    // specify enabled cipher suites
    if (cipherSuiteFilter != null) {
        String[] ciphersuites = UnboundSSLUtils.filterStringArray(
                ssf.getSupportedCipherSuites(), cipherSuiteFilter);
        System.out.println("Server: enabled cipher suites: "
                + Arrays.toString(ciphersuites));
        ssocket.setEnabledCipherSuites(ciphersuites);
    }

    // specify SNI matcher pattern
    if (sniPattern != null) {
        System.out.println("Server: set SNI matcher: " + sniPattern);
        SNIMatcher matcher = SNIHostName.createSNIMatcher(sniPattern);
        List<SNIMatcher> matchers = new ArrayList<>();
        matchers.add(matcher);
        SSLParameters params = ssocket.getSSLParameters();
        params.setSNIMatchers(matchers);
        ssocket.setSSLParameters(params);
    }

    return new SSLEchoServer(ssocket);
}
 

boolean isMatched(Collection<SNIMatcher> matchers) {
    if (sniMap != null && !sniMap.isEmpty()) {
        for (SNIMatcher matcher : matchers) {
            SNIServerName sniName = sniMap.get(matcher.getType());
            if (sniName != null && (!matcher.matches(sniName))) {
                return false;
            }
        }
    }

    return true;
}
 

/**
 * Applies SSLParameters to newly accepted connections.
 */
@Override
synchronized public void setSSLParameters(SSLParameters params) {
    super.setSSLParameters(params);

    // the super implementation does not handle the following parameters
    identificationProtocol = params.getEndpointIdentificationAlgorithm();
    algorithmConstraints = params.getAlgorithmConstraints();
    preferLocalCipherSuites = params.getUseCipherSuitesOrder();
    Collection<SNIMatcher> matchers = params.getSNIMatchers();
    if (matchers != null) {
        sniMatchers = params.getSNIMatchers();
    }
}
 

boolean isMatched(Collection<SNIMatcher> matchers) {
    if (sniMap != null && !sniMap.isEmpty()) {
        for (SNIMatcher matcher : matchers) {
            SNIServerName sniName = sniMap.get(matcher.getType());
            if (sniName != null && (!matcher.matches(sniName))) {
                return false;
            }
        }
    }

    return true;
}