Java SslContext类代码示例

import io.netty.handler.ssl.SslContext; //导入依赖的package包/类
@Override
protected void initChannel(SocketChannel ch) throws Exception {
    if (enableTLS) {
        File tlsCert = new File(serviceConfig.getTlsCertificateFilePath());
        File tlsKey = new File(serviceConfig.getTlsKeyFilePath());
        SslContextBuilder builder = SslContextBuilder.forServer(tlsCert, tlsKey);
        if (serviceConfig.isTlsAllowInsecureConnection()) {
            builder.trustManager(InsecureTrustManagerFactory.INSTANCE);
        } else {
            if (serviceConfig.getTlsTrustCertsFilePath().isEmpty()) {
                // Use system default
                builder.trustManager((File) null);
            } else {
                File trustCertCollection = new File(serviceConfig.getTlsTrustCertsFilePath());
                builder.trustManager(trustCertCollection);
            }
        }
        SslContext sslCtx = builder.clientAuth(ClientAuth.OPTIONAL).build();
        ch.pipeline().addLast(TLS_HANDLER, sslCtx.newHandler(ch.alloc()));
    }
    ch.pipeline().addLast("frameDecoder", new LengthFieldBasedFrameDecoder(PulsarDecoder.MaxFrameSize, 0, 4, 0, 4));
    ch.pipeline().addLast("handler", new ServerConnection(discoveryService));
}
 

import io.netty.handler.ssl.SslContext; //导入依赖的package包/类
protected ChannelHandler setupWSChannel(SslContext sslCtx, Configuration conf, DataStore datastore) {
    return new ChannelInitializer<SocketChannel>() {

        @Override
        protected void initChannel(SocketChannel ch) throws Exception {
            ch.pipeline().addLast("ssl", sslCtx.newHandler(ch.alloc()));
            ch.pipeline().addLast("httpServer", new HttpServerCodec());
            ch.pipeline().addLast("aggregator", new HttpObjectAggregator(8192));
            ch.pipeline().addLast("sessionExtractor", new WebSocketHttpCookieHandler(config));
            ch.pipeline().addLast("idle-handler", new IdleStateHandler(conf.getWebsocket().getTimeout(), 0, 0));
            ch.pipeline().addLast("ws-protocol", new WebSocketServerProtocolHandler(WS_PATH, null, true));
            ch.pipeline().addLast("wsDecoder", new WebSocketRequestDecoder(datastore, config));
            ch.pipeline().addLast("error", new WSExceptionHandler());
        }
    };

}
 

import io.netty.handler.ssl.SslContext; //导入依赖的package包/类
public void start(String ip, int port) throws Exception {
	// Configure SSL.
	final SslContext sslCtx;
	if (SSL) {
		sslCtx = SslContextBuilder.forClient().trustManager(InsecureTrustManagerFactory.INSTANCE).build();
	} else {
		sslCtx = null;
	}
	EventLoopGroup group = new NioEventLoopGroup();
	try {
		Bootstrap b = new Bootstrap();
		b.group(group).channel(NioSocketChannel.class).handler(new FileClientInitializer(sslCtx));
		Channel ch = b.connect(ip, port).sync().channel();
		ConfigurationContext.propMap.putIfAbsent(SOCKET_CHANNEL, ch);			
	}catch(Exception e){
		e.printStackTrace();
	}
}
 

import io.netty.handler.ssl.SslContext; //导入依赖的package包/类
ConnectionFactory(
        EventLoopGroup group,
        MessageFraming messageFraming,
        MessageEncoding messageEncoding,
        Optional<Supplier<SslContext>> sslContextSupplier,
        DriftNettyClientConfig clientConfig)
{
    this.group = requireNonNull(group, "group is null");
    this.messageFraming = requireNonNull(messageFraming, "messageFraming is null");
    this.messageEncoding = requireNonNull(messageEncoding, "messageEncoding is null");
    this.sslContextSupplier = requireNonNull(sslContextSupplier, "sslContextSupplier is null");

    requireNonNull(clientConfig, "clientConfig is null");
    this.connectTimeout = clientConfig.getConnectTimeout();
    this.requestTimeout = clientConfig.getRequestTimeout();
    this.socksProxy = Optional.ofNullable(clientConfig.getSocksProxy());
}
 

import io.netty.handler.ssl.SslContext; //导入依赖的package包/类
@Override
public boolean load() {
    final SslContext previous = reference.get();
    try {
        final SslContext context = loader.get();
        if (context == null) {
            return finishLoadWithReloadState(ReloadState.FAILED, null);
        }

        if (Objects.equals(previous, context)) {
            return finishLoadWithReloadState(ReloadState.NO_CHANGE, null);
        }

        reference.set(context);
        return finishLoadWithReloadState(ReloadState.RELOADED, null);
    } catch (final Exception e) {
        LOGGER.error("Failed to load SslContext.", e);
    }

    return finishLoadWithReloadState(ReloadState.FAILED, null);
}
 

import io.netty.handler.ssl.SslContext; //导入依赖的package包/类
@Test
public void get() throws Exception {
    final SslContextReloader reloader = new SslContextReloader(() -> null);

    assertFalse(reloader.load());
    assertEquals(ReloadState.FAILED, reloader.getReloadState());
    assertNull(reloader.getDataVersion());

    final SslContext context = reloader.get();
    assertNotNull(context);

    expectNullPointerException(context::isClient);
    expectNullPointerException(context::cipherSuites);
    expectNullPointerException(context::sessionCacheSize);
    expectNullPointerException(context::sessionTimeout);
    expectNullPointerException(context::applicationProtocolNegotiator);
    expectNullPointerException(context::sessionContext);
    expectNullPointerException(() -> context.newEngine(ByteBufAllocator.DEFAULT));
    expectNullPointerException(() -> context.newEngine(ByteBufAllocator.DEFAULT, "localhost", 1234));
}
 

import io.netty.handler.ssl.SslContext; //导入依赖的package包/类
public ImapClient(ImapClientConfiguration configuration,
                  Channel channel,
                  SslContext sslContext,
                  EventExecutorGroup promiseExecutor,
                  String clientName) {
  this.logger = LogUtils.loggerWithName(ImapClient.class, clientName);
  this.configuration = configuration;
  this.channel = channel;
  this.sslContext = sslContext;
  this.promiseExecutor = promiseExecutor;
  this.clientState = new ImapClientState(clientName, promiseExecutor);
  this.codec = new ImapCodec(clientState);
  this.pendingWriteQueue = new ConcurrentLinkedQueue<>();
  this.connectionShutdown = new AtomicBoolean(false);
  this.connectionClosed = new AtomicBoolean(false);
  this.capabilities = new AtomicReference<>(null);

  configureChannel();
}
 

import io.netty.handler.ssl.SslContext; //导入依赖的package包/类
static ClientHttpRequestFactory usingNetty(ClientOptions options)
		throws IOException, GeneralSecurityException {

	SslContext sslContext = new JdkSslContext(SSLContext.getDefault(), true, ClientAuth.REQUIRE);

	final Netty4ClientHttpRequestFactory requestFactory = new Netty4ClientHttpRequestFactory();
	requestFactory.setSslContext(sslContext);

	if (options.getConnectionTimeout() != null) {
		requestFactory.setConnectTimeout(options.getConnectionTimeout());
	}
	if (options.getReadTimeout() != null) {
		requestFactory.setReadTimeout(options.getReadTimeout());
	}

	return requestFactory;
}
 

import io.netty.handler.ssl.SslContext; //导入依赖的package包/类
/**
 * Create ssl context for the host
 */
public SslContext createSSlContext(String host, boolean useH2) {
    String finalHost = Networks.wildcardHost(host);
    lock.readLock().lock();
    try {
        return sslContextCache.computeIfAbsent(host + ":" + useH2, key -> {
            try {
                return getNettySslContextInner(finalHost, useH2);
            } catch (Exception e) {
                throw new SSLContextException(e);
            }
        });
    } finally {
        lock.readLock().unlock();
    }
}
 

import io.netty.handler.ssl.SslContext; //导入依赖的package包/类
private static SslContext newNettyClientContext(
        io.netty.handler.ssl.SslProvider sslProvider, boolean useAlpn) {
    try {
        TestKeyStore server = TestKeyStore.getServer();
        SslContextBuilder ctx =
                SslContextBuilder.forClient()
                        .sslProvider(sslProvider)
                        .trustManager((X509Certificate[]) server.getPrivateKey("RSA", "RSA")
                                              .getCertificateChain());
        if (useAlpn) {
            ctx.applicationProtocolConfig(OpenJdkEngineFactoryConfig.NETTY_ALPN_CONFIG);
        }
        return ctx.build();
    } catch (SSLException e) {
        throw new RuntimeException(e);
    }
}
 

import io.netty.handler.ssl.SslContext; //导入依赖的package包/类
private ChannelInitializer<LocalChannel> getServerInitializer(
    PrivateKey privateKey,
    X509Certificate certificate,
    Lock serverLock,
    Exception serverException)
    throws Exception {
  SslContext sslContext = SslContextBuilder.forServer(privateKey, certificate).build();
  return new ChannelInitializer<LocalChannel>() {
    @Override
    protected void initChannel(LocalChannel ch) throws Exception {
      ch.pipeline()
          .addLast(
              sslContext.newHandler(ch.alloc()), new EchoHandler(serverLock, serverException));
    }
  };
}
 

import io.netty.handler.ssl.SslContext; //导入依赖的package包/类
private SslContext getNettySslContextInner(String host, boolean useH2) throws Exception {
        long start = System.currentTimeMillis();
        PrivateKeyAndCertChain keyAndCertChain = keyStoreGenerator.generateCertChain(host, Settings.certValidityDays);
        logger.debug("Create certificate for {}, cost {} ms", host, System.currentTimeMillis() - start);
        SslContextBuilder builder = SslContextBuilder
                .forServer(keyAndCertChain.getPrivateKey(), keyAndCertChain.getCertificateChain());
        if (useH2) {
//                .ciphers(Http2SecurityUtil.CIPHERS, SupportedCipherSuiteFilter.INSTANCE)
            builder.applicationProtocolConfig(new ApplicationProtocolConfig(
                    ApplicationProtocolConfig.Protocol.ALPN,
                    SelectorFailureBehavior.NO_ADVERTISE,
                    SelectedListenerFailureBehavior.ACCEPT,
                    ApplicationProtocolNames.HTTP_2,
                    ApplicationProtocolNames.HTTP_1_1));
        }
        return builder.build();
    }
 

import io.netty.handler.ssl.SslContext; //导入依赖的package包/类
@Test
public void initChannel_adds_sslCtx_handler_first_if_available_and_no_utility_handlers() throws SSLException {
    // given
    SslContext sslCtx = new JdkSslClientContext();
    HttpChannelInitializer hci = basicHttpChannelInitializer(sslCtx, 0, 100, false, mock(RequestValidator.class),
                                                             createRequestAndResponseFilterMock());

    // when
    hci.initChannel(socketChannelMock);

    // then
    ArgumentCaptor<ChannelHandler> channelHandlerArgumentCaptor = ArgumentCaptor.forClass(ChannelHandler.class);
    verify(channelPipelineMock, atLeastOnce()).addLast(anyString(), channelHandlerArgumentCaptor.capture());
    List<ChannelHandler> handlers = channelHandlerArgumentCaptor.getAllValues();
    assertThat(handlers.get(0), instanceOf(SslHandler.class));
}
 

import io.netty.handler.ssl.SslContext; //导入依赖的package包/类
private static SslContext getSSLContext() throws IOException, GeneralSecurityException {
    try {
        final String privateKeyFile = "keys/server.pkcs8.key";
        final String certificateFile = "keys/server.crt";
        final String rootCAFile = "keys/rootCA.pem";

        final PrivateKey privateKey = loadPrivateKey(privateKeyFile);
        final X509Certificate certificate = loadX509Cert(certificateFile);
        final X509Certificate rootCA = loadX509Cert(rootCAFile);

        return SslContextBuilder.forClient()
                .sslProvider(SslProvider.JDK)
                .trustManager(rootCA)
                .keyManager(privateKey, certificate)
                .build();

    } catch (IOException | GeneralSecurityException e) {
        LOGGER.warn("Failed to establish SSL Context");
        LOGGER.debug("Failed to establish SSL Context", e);
        throw e;
    }
}
 

import io.netty.handler.ssl.SslContext; //导入依赖的package包/类
public static void main(String[] args) throws Exception {
    SelfSignedCertificate ssc = new SelfSignedCertificate();
    SslContext sslCtx = SslContextBuilder.forServer(ssc.certificate(), ssc.privateKey())
        .build();

    EventLoopGroup bossGroup = new NioEventLoopGroup(1);
    EventLoopGroup workerGroup = new NioEventLoopGroup();
    try {
        ServerBootstrap b = new ServerBootstrap();
        b.group(bossGroup, workerGroup)
         .channel(NioServerSocketChannel.class)
         .handler(new LoggingHandler(LogLevel.INFO))
         .childHandler(new SecureChatServerInitializer(sslCtx));

        b.bind(PORT).sync().channel().closeFuture().sync();
    } finally {
        bossGroup.shutdownGracefully();
        workerGroup.shutdownGracefully();
    }
}