Java OpenSsl类代码示例

import io.netty.handler.ssl.OpenSsl; //导入依赖的package包/类
private static SslProvider provider(NetworkSslConfig cfg) {
    switch (cfg.getProvider()) {
        case AUTO: {
            return OpenSsl.isAvailable() ? SslProvider.OPENSSL : SslProvider.JDK;
        }
        case JDK: {
            return SslProvider.JDK;
        }
        case OPEN_SSL: {
            return SslProvider.OPENSSL;
        }
        default: {
            throw new IllegalArgumentException("Unexpected SSL provider: " + cfg.getProvider());
        }
    }
}
 

import io.netty.handler.ssl.OpenSsl; //导入依赖的package包/类
private synchronized static SslContext createSslContext() throws SSLException {
  if (sslBuilder == null) {
    sslBuilder = GrpcSslContexts.forClient().ciphers(null);
    // gRPC uses tcnative / OpenSsl by default, if it's available. It defaults to alpn-boot
    // if tcnative is not in the classpath.
    if (OpenSsl.isAvailable()) {
      LOG.info(
          "SslContext: gRPC is using the OpenSSL provider (tcnactive jar - Open Ssl version: {})",
          OpenSsl.versionString());
    } else {
      if (isJettyAlpnConfigured()) {
        // gRPC uses jetty ALPN as a backup to tcnative.
        LOG.info("SslContext: gRPC is using the JDK provider (alpn-boot jar)");
      } else {
        LOG.info("SslContext: gRPC cannot be configured.  Neither OpenSsl nor Alpn are available.");
      }
    }
  }
  return sslBuilder.build();
}
 

import io.netty.handler.ssl.OpenSsl; //导入依赖的package包/类
@Override
public List<String> get() {
    List<String> ciphers;
    if (OpenSsl.isAvailable()) {
        // TODO: consider switching to the list of all available ciphers using OpenSsl.availableCipherSuites()
        ciphers = getBuiltInCipherList();
    } else {
        ciphers = getEnabledJdkCipherSuites();

        if (ciphers.isEmpty()) {
            // could not retrieve the list of enabled ciphers from the JDK SSLContext, so use the hard-coded list
            ciphers = getBuiltInCipherList();
        }
    }

    return ciphers;
}
 

import io.netty.handler.ssl.OpenSsl; //导入依赖的package包/类
/**
 * Creates a new SslContext object.
 *
 * @param cfg the cfg
 * @return the ssl context
 */
private synchronized SslContext createServerSslContext(IConfig cfg){
	SslContext ctx = null;
	try{
			SslProvider provider = OpenSsl.isAlpnSupported() ? SslProvider.OPENSSL : SslProvider.JDK;
			
			if(provider.equals(SslProvider.OPENSSL)){
				cfg.print("Using OpenSSL for network encryption.");
			}
			
			ctx = SslContextBuilder
					.forServer(new File(cfg.getCertFile()), new File(cfg.getKeyFile()), cfg.getKeyPassword())
					.sslProvider(provider)
					.build();
			
	}catch(Exception e){
		LOG.log(Level.SEVERE, null, e);
	}

	return ctx;
}
 

import io.netty.handler.ssl.OpenSsl; //导入依赖的package包/类
private SslContext getSslContext() {
    SslContext sslCtx = null;

    final SslProvider provider = OpenSsl.isAlpnSupported() ? SslProvider.OPENSSL : SslProvider.JDK;

    try {
        sslCtx = SslContextBuilder.forClient()
            .sslProvider(provider)
            .ciphers(Http2SecurityUtil.CIPHERS, SupportedCipherSuiteFilter.INSTANCE)
            .trustManager(InsecureTrustManagerFactory.INSTANCE)
            .applicationProtocolConfig(new ApplicationProtocolConfig(
                Protocol.ALPN,
                SelectorFailureBehavior.NO_ADVERTISE,
                SelectedListenerFailureBehavior.ACCEPT,
                ApplicationProtocolNames.HTTP_2))
            .build();
    } catch(SSLException exception) {
        return null;
    }

    return sslCtx;
}
 

import io.netty.handler.ssl.OpenSsl; //导入依赖的package包/类
private void logOpenSSLInfos() {
    if (OpenSsl.isAvailable()) {
        log.info("Open SSL " + OpenSsl.versionString() + " ("+OpenSsl.version()+") available");
        
        if(OpenSsl.version() < 0x10002000L) {
            log.warn("Outdated OpenSSL version detected. You should update to 1.0.2k or later. Currently installed: "+OpenSsl.versionString());
        }

        if(!OpenSsl.supportsHostnameValidation()) {
            log.warn("Your OpenSSL version "+OpenSsl.versionString()+" does not support hostname verification. You should update to 1.0.2k or later.");
        }

        log.debug("Open SSL available ciphers " + OpenSsl.availableOpenSslCipherSuites());
    } else {
        log.info("Open SSL not available (this is not an error, we simply fallback to built-in JDK SSL) because of " + OpenSsl.unavailabilityCause());
    }
}
 

import io.netty.handler.ssl.OpenSsl; //导入依赖的package包/类
@Test
public void testAvailCiphersOpenSSL() throws Exception {
    Assume.assumeTrue(OpenSsl.isAvailable());

    // Set<String> openSSLAvailCiphers = new
    // HashSet<>(OpenSsl.availableCipherSuites());
    // System.out.println("OpenSSL available ciphers: "+openSSLAvailCiphers);
    // ECDHE-RSA-AES256-SHA, ECDH-ECDSA-AES256-SHA, DH-DSS-DES-CBC-SHA,
    // ADH-AES256-SHA256, ADH-CAMELLIA128-SHA

    final Set<String> openSSLSecureCiphers = new HashSet<>();
    for (final String secure : SSLConfigConstants.getSecureSSLCiphers(Settings.EMPTY, false)) {
        if (OpenSsl.isCipherSuiteAvailable(secure)) {
            openSSLSecureCiphers.add(secure);
        }
    }

    System.out.println("OpenSSL secure ciphers: " + openSSLSecureCiphers);
    Assert.assertTrue(openSSLSecureCiphers.size() > 0);
}
 

import io.netty.handler.ssl.OpenSsl; //导入依赖的package包/类
@Parameters(name = "{index}: serverEngine = {0}, clientEngine = {1}")
public static Collection<Object[]> data() throws Exception {
    List<SslContext> serverContexts = new ArrayList<SslContext>();
    serverContexts.add(new JdkSslServerContext(CERT_FILE, KEY_FILE));

    List<SslContext> clientContexts = new ArrayList<SslContext>();
    clientContexts.add(new JdkSslClientContext(CERT_FILE));

    boolean hasOpenSsl = OpenSsl.isAvailable();
    if (hasOpenSsl) {
        serverContexts.add(new OpenSslServerContext(CERT_FILE, KEY_FILE));
        clientContexts.add(new OpenSslClientContext(CERT_FILE));
    } else {
        logger.warn("OpenSSL is unavailable and thus will not be tested.", OpenSsl.unavailabilityCause());
    }

    List<Object[]> params = new ArrayList<Object[]>();
    for (SslContext sc: serverContexts) {
        for (SslContext cc: clientContexts) {
            params.add(new Object[] { sc, cc });
        }
    }
    return params;
}
 

import io.netty.handler.ssl.OpenSsl; //导入依赖的package包/类
public SslContext getSslContext() throws UnRetriableException{


        try {

            File certificateChainFile = getCertificateChainFile();
            File certificateKeyFile = getCertificateKeyFile();
            String keyPassword = getKeyPassword();

            SslProvider sslProvider;
            if(OpenSsl.isAvailable()) {
                sslProvider  = SslProvider.OPENSSL;
            }else{
                sslProvider  = SslProvider.JDK;
            }

            return SslContext.newServerContext(sslProvider, certificateChainFile, certificateKeyFile, keyPassword  );

        }catch (Exception e){
            log.error(" getSSLEngine : problems when trying to initiate secure protocals", e);
            throw new UnRetriableException(e);
        }
    }
 

import io.netty.handler.ssl.OpenSsl; //导入依赖的package包/类
/**
 * This method will provide netty ssl context which supports HTTP2 over TLS using
 * Application Layer Protocol Negotiation (ALPN)
 *
 * @return instance of {@link SslContext}
 * @throws SSLException if any error occurred during building SSL context.
 */
public SslContext createHttp2TLSContext() throws SSLException {

    // If listener configuration does not include cipher suites , default ciphers required by the HTTP/2
    // specification will be added.
    List<String> ciphers = sslConfig.getCipherSuites() != null && sslConfig.getCipherSuites().length > 0 ? Arrays
            .asList(sslConfig.getCipherSuites()) : Http2SecurityUtil.CIPHERS;
    SslProvider provider = OpenSsl.isAlpnSupported() ? SslProvider.OPENSSL : SslProvider.JDK;
    return SslContextBuilder.forServer(this.getKeyManagerFactory())
            .trustManager(this.getTrustStoreFactory())
            .sslProvider(provider)
            .ciphers(ciphers,
                    SupportedCipherSuiteFilter.INSTANCE)
            .clientAuth(needClientAuth ? ClientAuth.REQUIRE : ClientAuth.NONE)
            .applicationProtocolConfig(new ApplicationProtocolConfig(
                    ApplicationProtocolConfig.Protocol.ALPN,
                    // NO_ADVERTISE is currently the only mode supported by both OpenSsl and JDK providers.
                    ApplicationProtocolConfig.SelectorFailureBehavior.NO_ADVERTISE,
                    // ACCEPT is currently the only mode supported by both OpenSsl and JDK providers.
                    ApplicationProtocolConfig.SelectedListenerFailureBehavior.ACCEPT,
                    ApplicationProtocolNames.HTTP_2,
                    ApplicationProtocolNames.HTTP_1_1)).build();
}
 

import io.netty.handler.ssl.OpenSsl; //导入依赖的package包/类
static SslContext build(final Config conf) throws IOException, CertificateException {
  String tmpdir = conf.getString("application.tmpdir");
  boolean http2 = conf.getBoolean("server.http2.enabled");
  File keyStoreCert = toFile(conf.getString("ssl.keystore.cert"), tmpdir);
  File keyStoreKey = toFile(conf.getString("ssl.keystore.key"), tmpdir);
  String keyStorePass = conf.hasPath("ssl.keystore.password")
      ? conf.getString("ssl.keystore.password") : null;
  SslContextBuilder scb = SslContextBuilder.forServer(keyStoreCert, keyStoreKey, keyStorePass);
  if (conf.hasPath("ssl.trust.cert")) {
    scb.trustManager(toFile(conf.getString("ssl.trust.cert"), tmpdir))
       .clientAuth(ClientAuth.REQUIRE);
  }
  if (http2) {
    SslProvider provider = OpenSsl.isAlpnSupported() ? SslProvider.OPENSSL : SslProvider.JDK;
    return scb.sslProvider(provider)
        .ciphers(Http2SecurityUtil.CIPHERS, SupportedCipherSuiteFilter.INSTANCE)
        .applicationProtocolConfig(new ApplicationProtocolConfig(
            Protocol.ALPN,
            SelectorFailureBehavior.NO_ADVERTISE,
            SelectedListenerFailureBehavior.ACCEPT,
            Arrays.asList(ApplicationProtocolNames.HTTP_2, ApplicationProtocolNames.HTTP_1_1)))
        .build();
  }
  return scb.build();
}
 

import io.netty.handler.ssl.OpenSsl; //导入依赖的package包/类
@Override
protected AbstractServerImplBuilder<?> getServerBuilder() {
  // Starts the server with HTTPS.
  try {
    SslProvider sslProvider = SslContext.defaultServerProvider();
    if (sslProvider == SslProvider.OPENSSL && !OpenSsl.isAlpnSupported()) {
      // OkHttp only supports Jetty ALPN on OpenJDK. So if OpenSSL doesn't support ALPN, then we
      // are forced to use Jetty ALPN for Netty instead of OpenSSL.
      sslProvider = SslProvider.JDK;
    }
    SslContextBuilder contextBuilder = SslContextBuilder
        .forServer(TestUtils.loadCert("server1.pem"), TestUtils.loadCert("server1.key"));
    GrpcSslContexts.configure(contextBuilder, sslProvider);
    contextBuilder.ciphers(TestUtils.preferredTestCiphers(), SupportedCipherSuiteFilter.INSTANCE);
    return NettyServerBuilder.forPort(0)
        .flowControlWindow(65 * 1024)
        .maxMessageSize(AbstractInteropTest.MAX_MESSAGE_SIZE)
        .sslContext(contextBuilder.build());
  } catch (IOException ex) {
    throw new RuntimeException(ex);
  }
}
 

import io.netty.handler.ssl.OpenSsl; //导入依赖的package包/类
@Before
public void setUp() throws NoSuchAlgorithmException {
  executor = Executors.newSingleThreadScheduledExecutor();
  if (sslProvider == SslProvider.OPENSSL) {
    Assume.assumeTrue(OpenSsl.isAvailable());
  }
  if (sslProvider == SslProvider.JDK) {
    Assume.assumeTrue(Arrays.asList(
        SSLContext.getDefault().getSupportedSSLParameters().getCipherSuites())
        .contains("TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256"));
    try {
      GrpcSslContexts.configure(SslContextBuilder.forClient(), SslProvider.JDK);
    } catch (IllegalArgumentException ex) {
      Assume.assumeNoException("Jetty ALPN does not seem available", ex);
    }
  }
  clientContextBuilder = GrpcSslContexts.configure(SslContextBuilder.forClient(), sslProvider);
}
 

import io.netty.handler.ssl.OpenSsl; //导入依赖的package包/类
/**
 * Selects an SSL provider based on the availability of of an ALPN-capable native provider.
 *
 * @return an ALPN-capable native SSL provider if available, or else the JDK SSL provider
 */
public static SslProvider getSslProvider() {
    final SslProvider sslProvider;

    if (OpenSsl.isAvailable()) {
        if (OpenSsl.isAlpnSupported()) {
            log.info("Native SSL provider is available and supports ALPN; will use native provider.");
            sslProvider = SslProvider.OPENSSL_REFCNT;
        } else {
            log.info("Native SSL provider is available, but does not support ALPN; will use JDK SSL provider.");
            sslProvider = SslProvider.JDK;
        }
    } else {
        log.info("Native SSL provider not available; will use JDK SSL provider.");
        sslProvider = SslProvider.JDK;
    }

    return sslProvider;
}
 

import io.netty.handler.ssl.OpenSsl; //导入依赖的package包/类
public GrpcClientInitializer(ClientOptions pClientOptions,
    List<ClientInterceptor> clientInterceptosr, int pInitialCapacity, int pMaximumSize) {
  LOG.info("Rpc client initializer with initial capacity {} and maximum size {} for channel pool.",
      pInitialCapacity, pInitialCapacity);
  LOG.info("Global client options: \n'{}'.", pClientOptions);
  
  if (!isAlpnProviderEnabled()) {
    LOG.error(
        "Neither Jetty ALPN nor OpenSSL are available. "
        + "OpenSSL unavailability cause:\n{}",
        OpenSsl.unavailabilityCause().toString());
    throw new IllegalStateException("Neither Jetty ALPN nor OpenSSL via "
        + "netty-tcnative were properly configured.");
  }
  
  Preconditions
  .checkState(
      !AbstractNameResolverProvider.providers().isEmpty(),
      "No NameResolverProviders found via ServiceLoader, including for DNS. "
          + "This is probably due to a broken build. If using ProGuard, check your configuration");
  
  globalClientOptions = pClientOptions;
  
  channelPool = createChannelPool(globalClientOptions, clientInterceptosr, pInitialCapacity, pMaximumSize);
  
  ClientMetrics.counter(MetricLevel.Info, "Initializer.active").inc();
}