Record Class SnmpMcpServer.ServerConfiguration.TlsConfig

java.lang.Object
java.lang.Record
org.snmp4j.mcp.SnmpMcpServer.ServerConfiguration.TlsConfig
Record Components:
trustCa - The distinguished name (DN) of the Certificate Authority that is accepted as issuer of the peer certificate chain, for example "CN=ca,OU=snmp4j,O=SNMP4J.org,C=DE". If not set, the peer certificate is validated by certification path validation against the trustStore only.
peerId - The subject distinguished name (DN) that the peer (server) certificate must have to be accepted, for example "CN=agent,OU=snmp4j,O=SNMP4J.org,C=DE".
localId - The certificate alias in keyStore that identifies this SNMP command generator towards the (D)TLS server. It is used as localCertificateAlias unless localCertificateAlias is set explicitly.
tlsVersion - The TLS protocol versions to be offered during handshake, as a comma separated list in descending preference (e.g. "TLSv1.3,TLSv1.2"). Applies to tls: addresses; default is TLSTM.DEFAULT_TLSTM_PROTOCOLS.
keyStore - The file path of the key store holding the private key and certificate of this command generator.
keyStorePassword - The password used to access the key store.
trustStore - The file path of the trust store holding the trusted (CA) certificates.
trustStorePassword - The password used to access the trust store.
peerHostId - The identity the peer has to prove with its certificate, independently of the securityName. It corresponds to snmpTlstmAddrServerIdentity of RFC 6353 §5.3.1 and is matched against the dNSName and iPAddress subject alternative names of the server certificate, where the left-most label of a dNSName may be a wildcard. If not set, the securityName is used as expected identity.
securityName - The tmSecurityName of the (D)TLS target. If not set, the securityName of the SNMPv3 configuration is used.
securityLevel - The security level of the (D)TLS target (noAuthNoPriv, authNoPriv or authPriv). Defaults to the securityLevel of the SNMPv3 configuration and, if that is not set either, to authPriv as required by RFC 5953 §3.1.
serverFingerprint - The hexadecimal fingerprint of the server certificate to pin, optionally colon delimited. When set, the server certificate is accepted if it matches this fingerprint, without certification path validation.
clientFingerprint - The hexadecimal fingerprint of the local (client) certificate to present, optionally colon delimited.
dtlsVersion - The DTLS protocol versions to be offered during handshake, as a comma separated list (e.g. "DTLSv1.2"). Applies to dtls: addresses; default is DTLSTM.DEFAULT_DTLSTM_PROTOCOLS.
localCertificateAlias - The alias that selects a single certification chain from keyStore for authenticating this command generator. Defaults to localId.
endpointIdentificationAlgorithm - The JSSE endpoint identification algorithm applied to the client mode SSL engine, "HTTPS" by default. Set it to an empty string to disable JSSE endpoint identification, which is needed for fingerprint pinned targets whose certificates carry no matching subject alternative name.
crlURI - The URI of an X.509 certificate revocation list (CRL) to be consulted during certification path validation.
revocationCheckOptions - The names of the PKIXRevocationChecker.Option constants (e.g. ["PREFER_CRLS", "ONLY_END_ENTITY", "NO_FALLBACK"]) that configure PKIX revocation checking. An empty list activates revocation checking with the SNMP4J defaults; if the property is absent, no revocation checker is installed.
maxFragmentSize - The maximum (D)TLS fragment size as defined by RFC 6066 §4.
maxInboundMessageSize - The maximum size of an inbound SNMP message in bytes.
dtlsHandshakeTimeout - The DTLS handshake timeout in milliseconds (DTLSTM.DEFAULT_HANDSHAKE_TIMEOUT by default).
dtlsConnectionTimeout - The time in milliseconds after which an idle DTLS connection is closed (DTLSTM.DEFAULT_CONNECTION_TIMEOUT by default).
localEngineID - The local SNMP engine ID of this command generator as a hexadecimal string. It is used as the engine ID of the Transport Security Model (TSM, RFC 5591) that (D)TLS targets require. A random engine ID is generated when not configured.
tsmUsePrefix - The snmpTsmConfigurationUsePrefix flag of RFC 5591 §5.
Enclosing class:
SnmpMcpServer.ServerConfiguration
public static record SnmpMcpServer.ServerConfiguration.TlsConfig(String trustCa, String peerId, String localId, String tlsVersion, String keyStore, String keyStorePassword, String trustStore, String trustStorePassword, String peerHostId, String securityName, String securityLevel, String serverFingerprint, String clientFingerprint, String dtlsVersion, String localCertificateAlias, String endpointIdentificationAlgorithm, String crlURI, List<String> revocationCheckOptions, Integer maxFragmentSize, Integer maxInboundMessageSize, Integer dtlsHandshakeTimeout, Long dtlsConnectionTimeout, String localEngineID, Boolean tsmUsePrefix) extends Record
A record representing the configuration for (D)TLS (Datagram Transport Layer Security) as defined by RFC 6353 (TLSTM) and RFC 7296/RFC 5953 (DTLSTM). It carries both the parameters of the TLSTM/DTLSTM transport mapping (key and trust material, protocol versions, revocation checking) and the parameters of the TlsX509CertifiedTarget that is created for a tls: or dtls: target address (security name, certificate fingerprints, expected server identity).

All string parameters are optional; a null or blank value means "not configured" and leaves the corresponding SNMP4J default (which for the key and trust store falls back to the javax.net.ssl.* system properties) in place.

Since:
0.0.1
Version:
0.1.0
Author:
SNMP4J.org

  • Constructor Details

  • Method Details

    • toString

      public final String toString()
      Returns a string representation of this record class. The representation contains the name of the class, followed by the name and value of each of the record components.
      Specified by:
      toString in class Record
      Returns:
      a string representation of this object

    • hashCode

      public final int hashCode()
      Returns a hash code value for this object. The value is derived from the hash code of each of the record components.
      Specified by:
      hashCode in class Record
      Returns:
      a hash code value for this object

    • equals

      public final boolean equals(Object o)
      Indicates whether some other object is "equal to" this one. The objects are equal if the other object is of the same class and if all the record components are equal. All components in this record class are compared with Objects::equals(Object,Object).
      Specified by:
      equals in class Record
      Parameters:
      o - the object with which to compare
      Returns:
      true if this object is the same as the o argument; false otherwise.

    • trustCa

      public String trustCa()
      Returns the value of the trustCa record component.
      Returns:
      the value of the trustCa record component

    • peerId

      public String peerId()
      Returns the value of the peerId record component.
      Returns:
      the value of the peerId record component

    • localId

      public String localId()
      Returns the value of the localId record component.
      Returns:
      the value of the localId record component

    • tlsVersion

      public String tlsVersion()
      Returns the value of the tlsVersion record component.
      Returns:
      the value of the tlsVersion record component

    • keyStore

      public String keyStore()
      Returns the value of the keyStore record component.
      Returns:
      the value of the keyStore record component

    • keyStorePassword

      public String keyStorePassword()
      Returns the value of the keyStorePassword record component.
      Returns:
      the value of the keyStorePassword record component

    • trustStore

      public String trustStore()
      Returns the value of the trustStore record component.
      Returns:
      the value of the trustStore record component

    • trustStorePassword

      public String trustStorePassword()
      Returns the value of the trustStorePassword record component.
      Returns:
      the value of the trustStorePassword record component

    • peerHostId

      public String peerHostId()
      Returns the value of the peerHostId record component.
      Returns:
      the value of the peerHostId record component

    • securityName

      public String securityName()
      Returns the value of the securityName record component.
      Returns:
      the value of the securityName record component

    • securityLevel

      public String securityLevel()
      Returns the value of the securityLevel record component.
      Returns:
      the value of the securityLevel record component

    • serverFingerprint

      public String serverFingerprint()
      Returns the value of the serverFingerprint record component.
      Returns:
      the value of the serverFingerprint record component

    • clientFingerprint

      public String clientFingerprint()
      Returns the value of the clientFingerprint record component.
      Returns:
      the value of the clientFingerprint record component

    • dtlsVersion

      public String dtlsVersion()
      Returns the value of the dtlsVersion record component.
      Returns:
      the value of the dtlsVersion record component

    • localCertificateAlias

      public String localCertificateAlias()
      Returns the value of the localCertificateAlias record component.
      Returns:
      the value of the localCertificateAlias record component

    • endpointIdentificationAlgorithm

      public String endpointIdentificationAlgorithm()
      Returns the value of the endpointIdentificationAlgorithm record component.
      Returns:
      the value of the endpointIdentificationAlgorithm record component

    • crlURI

      public String crlURI()
      Returns the value of the crlURI record component.
      Returns:
      the value of the crlURI record component

    • revocationCheckOptions

      public List<String> revocationCheckOptions()
      Returns the value of the revocationCheckOptions record component.
      Returns:
      the value of the revocationCheckOptions record component

    • maxFragmentSize

      public Integer maxFragmentSize()
      Returns the value of the maxFragmentSize record component.
      Returns:
      the value of the maxFragmentSize record component

    • maxInboundMessageSize

      public Integer maxInboundMessageSize()
      Returns the value of the maxInboundMessageSize record component.
      Returns:
      the value of the maxInboundMessageSize record component

    • dtlsHandshakeTimeout

      public Integer dtlsHandshakeTimeout()
      Returns the value of the dtlsHandshakeTimeout record component.
      Returns:
      the value of the dtlsHandshakeTimeout record component

    • dtlsConnectionTimeout

      public Long dtlsConnectionTimeout()
      Returns the value of the dtlsConnectionTimeout record component.
      Returns:
      the value of the dtlsConnectionTimeout record component

    • localEngineID

      public String localEngineID()
      Returns the value of the localEngineID record component.
      Returns:
      the value of the localEngineID record component

    • tsmUsePrefix

      public Boolean tsmUsePrefix()
      Returns the value of the tsmUsePrefix record component.
      Returns:
      the value of the tsmUsePrefix record component