org.eclipse.jetty.util.ssl

Class SslContextFactory

java.lang.Object

org.eclipse.jetty.util.component.AbstractLifeCycle

org.eclipse.jetty.util.ssl.SslContextFactory

All Implemented Interfaces:

LifeCycle

public class SslContextFactory
extends AbstractLifeCycle

SslContextFactory is used to configure SSL connectors as well as HttpClient. It holds all SSL parameters and creates SSL context based on these parameters to be used by the SSL connectors.

Nested Class Summary

Nested classes/interfaces inherited from class org.eclipse.jetty.util.component.AbstractLifeCycle

AbstractLifeCycle.AbstractLifeCycleListener

Nested classes/interfaces inherited from interface org.eclipse.jetty.util.component.LifeCycle

LifeCycle.Listener

Field Summary

Fields

Modifier and Type	Field and Description
static String	DEFAULT_KEYMANAGERFACTORY_ALGORITHM
static String	DEFAULT_TRUSTMANAGERFACTORY_ALGORITHM
static String	KEYPASSWORD_PROPERTY String name of key password property.
static String	PASSWORD_PROPERTY String name of keystore password property.
static TrustManager[]	TRUST_ALL_CERTS

Fields inherited from class org.eclipse.jetty.util.component.AbstractLifeCycle

FAILED, RUNNING, STARTED, STARTING, STOPPED, STOPPING

Constructor Summary

Constructors

Constructor and Description
SslContextFactory() Construct an instance of SslContextFactory Default constructor for use in XmlConfiguration files
SslContextFactory(boolean trustAll) Construct an instance of SslContextFactory Default constructor for use in XmlConfiguration files
SslContextFactory(String keyStorePath) Construct an instance of SslContextFactory

Method Summary

Methods

Modifier and Type	Method and Description
void	addExcludeCipherSuites(String... cipher)
void	addExcludeProtocols(String... protocol)
void	checkKeyStore() Check KeyStore Configuration.
protected void	checkNotStarted() Check if the lifecycle has been started and throw runtime exception
void	customize(SSLEngine sslEngine)
static int	deduceKeyLength(String cipherSuite) Given the name of a TLS/SSL cipher suite, return an int representing it effective stream cipher key strength.
protected void	doStart() Create the SSLContext object and start the lifecycle
protected void	doStop()
String	getCertAlias()
static X509Certificate[]	getCertChain(SSLSession sslSession)
String	getCrlPath()
String[]	getExcludeCipherSuites()
String[]	getExcludeProtocols()
String[]	getIncludeCipherSuites()
String[]	getIncludeProtocols()
protected KeyManager[]	getKeyManagers(KeyStore keyStore)
String	getKeyStorePath()
String	getKeyStoreProvider()
String	getKeyStoreType()
int	getMaxCertPathLength()
boolean	getNeedClientAuth()
String	getOcspResponderURL()
String	getProtocol()
String	getProvider()
String	getSecureRandomAlgorithm()
SSLContext	getSslContext()
String	getSslKeyManagerFactoryAlgorithm()
int	getSslSessionCacheSize() Get SSL session cache size.
int	getSslSessionTimeout() Get SSL session timeout.
String	getTrustManagerFactoryAlgorithm()
protected TrustManager[]	getTrustManagers(KeyStore trustStore, Collection<? extends CRL> crls)
String	getTrustStore()
String	getTrustStoreProvider()
String	getTrustStoreType()
boolean	getWantClientAuth()
boolean	isEnableCRLDP()
boolean	isEnableOCSP()
boolean	isRenegotiationAllowed()
boolean	isSessionCachingEnabled()
boolean	isTrustAll()
boolean	isValidateCerts()
boolean	isValidatePeerCerts()
protected Collection<? extends CRL>	loadCRL(String crlPath) Loads certificate revocation list (CRL) from a file.
protected KeyStore	loadKeyStore() Override this method to provide alternate way to load a keystore.
protected KeyStore	loadTrustStore() Override this method to provide alternate way to load a truststore.
SSLEngine	newSSLEngine() Factory method for "scratch" SSLEngines, usually only used for retrieving configuration information such as the application buffer size or the list of protocols/ciphers.
SSLEngine	newSSLEngine(InetSocketAddress address) Server-side only factory method for creating SSLEngines.
SSLEngine	newSSLEngine(String host, int port) General purpose factory method for creating SSLEngines, although creation of SSLEngines on the server-side should prefer newSSLEngine(InetSocketAddress).
SSLServerSocket	newSslServerSocket(String host, int port, int backlog)
SSLSocket	newSslSocket()
String[]	selectCipherSuites(String[] enabledCipherSuites, String[] supportedCipherSuites) Select cipher suites to be used by the connector based on configured inclusion and exclusion lists as well as enabled and supported cipher suite lists.
String[]	selectProtocols(String[] enabledProtocols, String[] supportedProtocols) Select protocols to be used by the connector based on configured inclusion and exclusion lists as well as enabled and supported protocols.
void	setCertAlias(String certAlias)
void	setCrlPath(String crlPath)
void	setEnableCRLDP(boolean enableCRLDP) Enables CRL Distribution Points Support
void	setEnableOCSP(boolean enableOCSP) Enables On-Line Certificate Status Protocol support
void	setEndpointIdentificationAlgorithm(String endpointIdentificationAlgorithm) When set to "HTTPS" hostname verification will be enabled
void	setExcludeCipherSuites(String... cipherSuites) You can either use the exact cipher suite name or a a regular expression.
void	setExcludeProtocols(String... protocols)
void	setIncludeCipherSuites(String... cipherSuites) You can either use the exact cipher suite name or a a regular expression.
void	setIncludeProtocols(String... protocols)
void	setKeyManagerPassword(String password)
void	setKeyStore(KeyStore keyStore) Set the key store.
void	setKeyStorePassword(String password)
void	setKeyStorePath(String keyStorePath)
void	setKeyStoreProvider(String keyStoreProvider)
void	setKeyStoreResource(Resource resource) Set the key store resource.
void	setKeyStoreType(String keyStoreType)
void	setMaxCertPathLength(int maxCertPathLength)
void	setNeedClientAuth(boolean needClientAuth)
void	setOcspResponderURL(String ocspResponderURL) Set the location of the OCSP Responder.
void	setProtocol(String protocol)
void	setProvider(String provider)
void	setRenegotiationAllowed(boolean renegotiationAllowed)
void	setSecureRandomAlgorithm(String algorithm)
void	setSessionCachingEnabled(boolean enableSessionCaching) Set the flag to enable SSL Session caching.
void	setSslContext(SSLContext sslContext)
void	setSslKeyManagerFactoryAlgorithm(String algorithm)
void	setSslSessionCacheSize(int sslSessionCacheSize) SEt SSL session cache size.
void	setSslSessionTimeout(int sslSessionTimeout) Set SSL session timeout.
void	setTrustAll(boolean trustAll)
void	setTrustManagerFactoryAlgorithm(String algorithm)
void	setTrustStore(KeyStore trustStore) Set the trust store.
void	setTrustStorePassword(String password)
void	setTrustStorePath(String trustStorePath)
void	setTrustStoreProvider(String trustStoreProvider)
void	setTrustStoreResource(Resource resource) Set the trust store resource.
void	setTrustStoreType(String trustStoreType)
void	setValidateCerts(boolean validateCerts)
void	setValidatePeerCerts(boolean validatePeerCerts)
void	setWantClientAuth(boolean wantClientAuth)
String	toString()

Methods inherited from class org.eclipse.jetty.util.component.AbstractLifeCycle

addLifeCycleListener, getState, getState, getStopTimeout, isFailed, isRunning, isStarted, isStarting, isStopped, isStopping, removeLifeCycleListener, setStopTimeout, start, stop

Methods inherited from class java.lang.Object

clone, equals, finalize, getClass, hashCode, notify, notifyAll, wait, wait, wait

Field Detail

TRUST_ALL_CERTS

public static final TrustManager[] TRUST_ALL_CERTS

DEFAULT_KEYMANAGERFACTORY_ALGORITHM

public static final String DEFAULT_KEYMANAGERFACTORY_ALGORITHM

DEFAULT_TRUSTMANAGERFACTORY_ALGORITHM

public static final String DEFAULT_TRUSTMANAGERFACTORY_ALGORITHM

KEYPASSWORD_PROPERTY

public static final String KEYPASSWORD_PROPERTY

String name of key password property.

See Also:

Constant Field Values

PASSWORD_PROPERTY

public static final String PASSWORD_PROPERTY

String name of keystore password property.

See Also:

Constant Field Values

Constructor Detail

SslContextFactory

public SslContextFactory()

Construct an instance of SslContextFactory Default constructor for use in XmlConfiguration files

SslContextFactory

public SslContextFactory(boolean trustAll)

Construct an instance of SslContextFactory Default constructor for use in XmlConfiguration files

Parameters:

trustAll - whether to blindly trust all certificates

See Also:

setTrustAll(boolean)

SslContextFactory

public SslContextFactory(String keyStorePath)

Construct an instance of SslContextFactory

Parameters:

keyStorePath - default keystore location

Method Detail

doStart

protected void doStart()
                throws Exception

Create the SSLContext object and start the lifecycle

Overrides:

doStart in class AbstractLifeCycle

Throws:

Exception

See Also:

AbstractLifeCycle.doStart()

doStop

protected void doStop()
               throws Exception

Overrides:

doStop in class AbstractLifeCycle

Throws:

Exception

getExcludeProtocols

public String[] getExcludeProtocols()

Returns:

The array of protocol names to exclude from SSLEngine.setEnabledProtocols(String[])

setExcludeProtocols

public void setExcludeProtocols(String... protocols)

Parameters:

protocols - The array of protocol names to exclude from SSLEngine.setEnabledProtocols(String[])

addExcludeProtocols

public void addExcludeProtocols(String... protocol)

Parameters:

protocol - Protocol names to add to SSLEngine.setEnabledProtocols(String[])

getIncludeProtocols

public String[] getIncludeProtocols()

Returns:

The array of protocol names to include in SSLEngine.setEnabledProtocols(String[])

setIncludeProtocols

public void setIncludeProtocols(String... protocols)

Parameters:

protocols - The array of protocol names to include in SSLEngine.setEnabledProtocols(String[])

getExcludeCipherSuites

public String[] getExcludeCipherSuites()

Returns:

The array of cipher suite names to exclude from SSLEngine.setEnabledCipherSuites(String[])

setExcludeCipherSuites

public void setExcludeCipherSuites(String... cipherSuites)

You can either use the exact cipher suite name or a a regular expression.

Parameters:

cipherSuites - The array of cipher suite names to exclude from SSLEngine.setEnabledCipherSuites(String[])

addExcludeCipherSuites

public void addExcludeCipherSuites(String... cipher)

Parameters:

cipher - Cipher names to add to SSLEngine.setEnabledCipherSuites(String[])

getIncludeCipherSuites

public String[] getIncludeCipherSuites()

Returns:

The array of cipher suite names to include in SSLEngine.setEnabledCipherSuites(String[])

setIncludeCipherSuites

public void setIncludeCipherSuites(String... cipherSuites)

You can either use the exact cipher suite name or a a regular expression.

Parameters:

cipherSuites - The array of cipher suite names to include in SSLEngine.setEnabledCipherSuites(String[])

getKeyStorePath

public String getKeyStorePath()

Returns:

The file or URL of the SSL Key store.

setKeyStorePath

public void setKeyStorePath(String keyStorePath)

Parameters:

keyStorePath - The file or URL of the SSL Key store.

getKeyStoreProvider

public String getKeyStoreProvider()

Returns:

The provider of the key store

setKeyStoreProvider

public void setKeyStoreProvider(String keyStoreProvider)

Parameters:

keyStoreProvider - The provider of the key store

getKeyStoreType

public String getKeyStoreType()

Returns:

The type of the key store (default "JKS")

setKeyStoreType

public void setKeyStoreType(String keyStoreType)

Parameters:

keyStoreType - The type of the key store (default "JKS")

getCertAlias

public String getCertAlias()

Returns:

Alias of SSL certificate for the connector

setCertAlias

public void setCertAlias(String certAlias)

Parameters:

certAlias - Alias of SSL certificate for the connector

getTrustStore

public String getTrustStore()

Returns:

The file name or URL of the trust store location

setTrustStorePath

public void setTrustStorePath(String trustStorePath)

Parameters:

trustStorePath - The file name or URL of the trust store location

getTrustStoreProvider

public String getTrustStoreProvider()

Returns:

The provider of the trust store

setTrustStoreProvider

public void setTrustStoreProvider(String trustStoreProvider)

Parameters:

trustStoreProvider - The provider of the trust store

getTrustStoreType

public String getTrustStoreType()

Returns:

The type of the trust store (default "JKS")

setTrustStoreType

public void setTrustStoreType(String trustStoreType)

Parameters:

trustStoreType - The type of the trust store (default "JKS")

getNeedClientAuth

public boolean getNeedClientAuth()

Returns:

True if SSL needs client authentication.

See Also:

SSLEngine.getNeedClientAuth()

setNeedClientAuth

public void setNeedClientAuth(boolean needClientAuth)

Parameters:

needClientAuth - True if SSL needs client authentication.

See Also:

SSLEngine.getNeedClientAuth()

getWantClientAuth

public boolean getWantClientAuth()

Returns:

True if SSL wants client authentication.

See Also:

SSLEngine.getWantClientAuth()

setWantClientAuth

public void setWantClientAuth(boolean wantClientAuth)

Parameters:

wantClientAuth - True if SSL wants client authentication.

See Also:

SSLEngine.getWantClientAuth()

isValidateCerts

public boolean isValidateCerts()

Returns:

true if SSL certificate has to be validated

setValidateCerts

public void setValidateCerts(boolean validateCerts)

Parameters:

validateCerts - true if SSL certificates have to be validated

isValidatePeerCerts

public boolean isValidatePeerCerts()

Returns:

true if SSL certificates of the peer have to be validated

setValidatePeerCerts

public void setValidatePeerCerts(boolean validatePeerCerts)

Parameters:

validatePeerCerts - true if SSL certificates of the peer have to be validated

setKeyStorePassword

public void setKeyStorePassword(String password)

Parameters:

password - The password for the key store

setKeyManagerPassword

public void setKeyManagerPassword(String password)

Parameters:

password - The password (if any) for the specific key within the key store

setTrustStorePassword

public void setTrustStorePassword(String password)

Parameters:

password - The password for the trust store

getProvider

public String getProvider()

Returns:

The SSL provider name, which if set is passed to SSLContext.getInstance(String, String)

setProvider

public void setProvider(String provider)

Parameters:

provider - The SSL provider name, which if set is passed to SSLContext.getInstance(String, String)

getProtocol

public String getProtocol()

Returns:

The SSL protocol (default "TLS") passed to SSLContext.getInstance(String, String)

setProtocol

public void setProtocol(String protocol)

Parameters:

protocol - The SSL protocol (default "TLS") passed to SSLContext.getInstance(String, String)

getSecureRandomAlgorithm

public String getSecureRandomAlgorithm()

Returns:

The algorithm name, which if set is passed to SecureRandom.getInstance(String) to obtain the SecureRandom instance passed to SSLContext.init(javax.net.ssl.KeyManager[], javax.net.ssl.TrustManager[], SecureRandom)

setSecureRandomAlgorithm

public void setSecureRandomAlgorithm(String algorithm)

Parameters:

algorithm - The algorithm name, which if set is passed to SecureRandom.getInstance(String) to obtain the SecureRandom instance passed to SSLContext.init(javax.net.ssl.KeyManager[], javax.net.ssl.TrustManager[], SecureRandom)

getSslKeyManagerFactoryAlgorithm

public String getSslKeyManagerFactoryAlgorithm()

Returns:

The algorithm name (default "SunX509") used by the KeyManagerFactory

setSslKeyManagerFactoryAlgorithm

public void setSslKeyManagerFactoryAlgorithm(String algorithm)

Parameters:

algorithm - The algorithm name (default "SunX509") used by the KeyManagerFactory

getTrustManagerFactoryAlgorithm

public String getTrustManagerFactoryAlgorithm()

Returns:

The algorithm name (default "SunX509") used by the TrustManagerFactory

isTrustAll

public boolean isTrustAll()

Returns:

True if all certificates should be trusted if there is no KeyStore or TrustStore

setTrustAll

public void setTrustAll(boolean trustAll)

Parameters:

trustAll - True if all certificates should be trusted if there is no KeyStore or TrustStore

setTrustManagerFactoryAlgorithm

public void setTrustManagerFactoryAlgorithm(String algorithm)

Parameters:

algorithm - The algorithm name (default "SunX509") used by the TrustManagerFactory Use the string "TrustAll" to install a trust manager that trusts all.

isRenegotiationAllowed

public boolean isRenegotiationAllowed()

Returns:

whether TLS renegotiation is allowed (true by default)

setRenegotiationAllowed

public void setRenegotiationAllowed(boolean renegotiationAllowed)

Parameters:

renegotiationAllowed - whether TLS renegotiation is allowed

getCrlPath

public String getCrlPath()

Returns:

Path to file that contains Certificate Revocation List

setCrlPath

public void setCrlPath(String crlPath)

Parameters:

crlPath - Path to file that contains Certificate Revocation List

getMaxCertPathLength

public int getMaxCertPathLength()

Returns:

Maximum number of intermediate certificates in the certification path (-1 for unlimited)

setMaxCertPathLength

public void setMaxCertPathLength(int maxCertPathLength)

Parameters:

maxCertPathLength - maximum number of intermediate certificates in the certification path (-1 for unlimited)

getSslContext

public SSLContext getSslContext()

Returns:

The SSLContext

setSslContext

public void setSslContext(SSLContext sslContext)

Parameters:

sslContext - Set a preconfigured SSLContext

setEndpointIdentificationAlgorithm

public void setEndpointIdentificationAlgorithm(String endpointIdentificationAlgorithm)

When set to "HTTPS" hostname verification will be enabled

Parameters:

endpointIdentificationAlgorithm - Set the endpointIdentificationAlgorithm

loadKeyStore

protected KeyStore loadKeyStore()
                         throws Exception

Override this method to provide alternate way to load a keystore.

Returns:

the key store instance

Throws:

Exception - if the keystore cannot be loaded

loadTrustStore

protected KeyStore loadTrustStore()
                           throws Exception

Override this method to provide alternate way to load a truststore.

Returns:

the key store instance

Throws:

Exception - if the truststore cannot be loaded

loadCRL

protected Collection<? extends CRL> loadCRL(String crlPath)
                                     throws Exception

Loads certificate revocation list (CRL) from a file. Required for integrations to be able to override the mechanism used to load CRL in order to provide their own implementation.

Parameters:

crlPath - path of certificate revocation list file

Returns:

Collection of CRL's

Throws:

Exception - if the certificate revocation list cannot be loaded

getKeyManagers

protected KeyManager[] getKeyManagers(KeyStore keyStore)
                               throws Exception

Throws:

Exception

getTrustManagers

protected TrustManager[] getTrustManagers(KeyStore trustStore,
                              Collection<? extends CRL> crls)
                                   throws Exception

Throws:

Exception

checkKeyStore

public void checkKeyStore()

Check KeyStore Configuration. Ensures that if keystore has been configured but there's no truststore, that keystore is used as truststore.

Throws:

IllegalStateException - if SslContextFactory configuration can't be used.

selectProtocols

public String[] selectProtocols(String[] enabledProtocols,
                       String[] supportedProtocols)

Select protocols to be used by the connector based on configured inclusion and exclusion lists as well as enabled and supported protocols.

Parameters:

enabledProtocols - Array of enabled protocols

supportedProtocols - Array of supported protocols

Returns:

Array of protocols to enable

selectCipherSuites

public String[] selectCipherSuites(String[] enabledCipherSuites,
                          String[] supportedCipherSuites)

Select cipher suites to be used by the connector based on configured inclusion and exclusion lists as well as enabled and supported cipher suite lists.

Parameters:

enabledCipherSuites - Array of enabled cipher suites

supportedCipherSuites - Array of supported cipher suites

Returns:

Array of cipher suites to enable

checkNotStarted

protected void checkNotStarted()

Check if the lifecycle has been started and throw runtime exception

isEnableCRLDP

public boolean isEnableCRLDP()

Returns:

true if CRL Distribution Points support is enabled

setEnableCRLDP

public void setEnableCRLDP(boolean enableCRLDP)

Enables CRL Distribution Points Support

Parameters:

enableCRLDP - true - turn on, false - turns off

isEnableOCSP

public boolean isEnableOCSP()

Returns:

true if On-Line Certificate Status Protocol support is enabled

setEnableOCSP

public void setEnableOCSP(boolean enableOCSP)

Enables On-Line Certificate Status Protocol support

Parameters:

enableOCSP - true - turn on, false - turn off

getOcspResponderURL

public String getOcspResponderURL()

Returns:

Location of the OCSP Responder

setOcspResponderURL

public void setOcspResponderURL(String ocspResponderURL)

Set the location of the OCSP Responder.

Parameters:

ocspResponderURL - location of the OCSP Responder

setKeyStore

public void setKeyStore(KeyStore keyStore)

Set the key store.

Parameters:

keyStore - the key store to set

setTrustStore

public void setTrustStore(KeyStore trustStore)

Set the trust store.

Parameters:

trustStore - the trust store to set

setKeyStoreResource

public void setKeyStoreResource(Resource resource)

Set the key store resource.

Parameters:

resource - the key store resource to set

setTrustStoreResource

public void setTrustStoreResource(Resource resource)

Set the trust store resource.

Parameters:

resource - the trust store resource to set

isSessionCachingEnabled

public boolean isSessionCachingEnabled()

Returns:

true if SSL Session caching is enabled

setSessionCachingEnabled

public void setSessionCachingEnabled(boolean enableSessionCaching)

Set the flag to enable SSL Session caching.

Parameters:

enableSessionCaching - the value of the flag

getSslSessionCacheSize

public int getSslSessionCacheSize()

Get SSL session cache size.

Returns:

SSL session cache size

setSslSessionCacheSize

public void setSslSessionCacheSize(int sslSessionCacheSize)

SEt SSL session cache size.

Parameters:

sslSessionCacheSize - SSL session cache size to set

getSslSessionTimeout

public int getSslSessionTimeout()

Get SSL session timeout.

Returns:

SSL session timeout

setSslSessionTimeout

public void setSslSessionTimeout(int sslSessionTimeout)

Set SSL session timeout.

Parameters:

sslSessionTimeout - SSL session timeout to set

newSslServerSocket

public SSLServerSocket newSslServerSocket(String host,
                                 int port,
                                 int backlog)
                                   throws IOException

Throws:

IOException

newSslSocket

public SSLSocket newSslSocket()
                       throws IOException

Throws:

IOException

newSSLEngine

public SSLEngine newSSLEngine()

Factory method for "scratch" SSLEngines, usually only used for retrieving configuration information such as the application buffer size or the list of protocols/ciphers.

This method should not be used for creating SSLEngines that are used in actual socket communication.

Returns:

a new, "scratch" SSLEngine

newSSLEngine

public SSLEngine newSSLEngine(String host,
                     int port)

General purpose factory method for creating SSLEngines, although creation of SSLEngines on the server-side should prefer newSSLEngine(InetSocketAddress).

Parameters:

host - the remote host

port - the remote port

Returns:

a new SSLEngine

newSSLEngine

public SSLEngine newSSLEngine(InetSocketAddress address)

Server-side only factory method for creating SSLEngines.

If the given address is null, it is equivalent to newSSLEngine(), otherwise newSSLEngine(String, int) is called.

If getNeedClientAuth() is true, then the host name is passed to newSSLEngine(String, int), possibly incurring in a reverse DNS lookup, which takes time and may hang the selector (since this method is usually called by the selector thread).

Otherwise, the host address is passed to newSSLEngine(String, int) without DNS lookup penalties.

Clients that wish to create SSLEngine instances must use newSSLEngine(String, int).

Parameters:

address - the remote peer address

Returns:

a new SSLEngine

customize

public void customize(SSLEngine sslEngine)

getCertChain

public static X509Certificate[] getCertChain(SSLSession sslSession)

deduceKeyLength

public static int deduceKeyLength(String cipherSuite)

Given the name of a TLS/SSL cipher suite, return an int representing it effective stream cipher key strength. i.e. How much entropy material is in the key material being fed into the encryption routines.

This is based on the information on effective key lengths in RFC 2246 - The TLS Protocol Version 1.0, Appendix C. CipherSuite definitions:

                         Effective
     Cipher       Type    Key Bits

     NULL       * Stream     0
     IDEA_CBC     Block    128
     RC2_CBC_40 * Block     40
     RC4_40     * Stream    40
     RC4_128      Stream   128
     DES40_CBC  * Block     40
     DES_CBC      Block     56
     3DES_EDE_CBC Block    168
 

Parameters:

cipherSuite - String name of the TLS cipher suite.

Returns:

int indicating the effective key entropy bit-length.

toString

public String toString()

Overrides:

toString in class Object