Java SSLException类代码示例

import javax.net.ssl.SSLException; //导入依赖的package包/类
@Test public void connectionsAreNotReusedIfSslSocketFactoryChanges() throws Exception {
  enableHttps();
  server.enqueue(new MockResponse());
  server.enqueue(new MockResponse());

  Request request = new Request.Builder()
      .url(server.url("/"))
      .build();

  Response response = client.newCall(request).execute();
  response.body().close();

  // This client shares a connection pool but has a different SSL socket factory.
  SslClient sslClient2 = new SslClient.Builder().build();
  OkHttpClient anotherClient = client.newBuilder()
      .sslSocketFactory(sslClient2.socketFactory, sslClient2.trustManager)
      .build();

  // This client fails to connect because the new SSL socket factory refuses.
  try {
    anotherClient.newCall(request).execute();
    fail();
  } catch (SSLException expected) {
  }
}
 

import javax.net.ssl.SSLException; //导入依赖的package包/类
/**
 * Construct a {@code CertStatusReqItemV2} object from encoded bytes
 *
 * @param requestBytes the encoded bytes for the {@code CertStatusReqItemV2}
 *
 * @throws IOException if any decoding errors take place
 * @throws IllegalArgumentException if the parsed reqType value is not a
 *      supported status request type.
 */
CertStatusReqItemV2(byte[] reqItemBytes) throws IOException {
    ByteBuffer reqBuf = ByteBuffer.wrap(reqItemBytes);
    statReqType = StatusRequestType.get(reqBuf.get());
    int requestLength = Short.toUnsignedInt(reqBuf.getShort());

    if (requestLength == reqBuf.remaining()) {
        byte[] statReqBytes = new byte[requestLength];
        reqBuf.get(statReqBytes);
        if (statReqType == StatusRequestType.OCSP ||
                statReqType == StatusRequestType.OCSP_MULTI) {
            request = new OCSPStatusRequest(statReqBytes);
        } else {
            request = new UnknownStatusRequest(statReqBytes);
        }
    } else {
        throw new SSLException("Incorrect request_length: " +
                "Expected " + reqBuf.remaining() + ", got " +
                requestLength);
    }
}
 

import javax.net.ssl.SSLException; //导入依赖的package包/类
private SslContext buildSslCtx() {
  SslProvider provider = OpenSsl.isAlpnSupported() ? SslProvider.OPENSSL : SslProvider.JDK;
  try {
    return SslContextBuilder.forClient()
        .sslProvider(provider)
        .ciphers(Http2SecurityUtil.CIPHERS, SupportedCipherSuiteFilter.INSTANCE)
        .trustManager(InsecureTrustManagerFactory.INSTANCE)
        // TODO(JR): Make a seperate Handler Class for http2 as opposed to autoneg
        //        .applicationProtocolConfig(new ApplicationProtocolConfig(
        //          ApplicationProtocolConfig.Protocol.ALPN,
        //          // NO_ADVERTISE is currently the only mode supported by both OpenSsl and JDK providers.
        //          ApplicationProtocolConfig.SelectorFailureBehavior.NO_ADVERTISE,
        //          // ACCEPT is currently the only mode supported by both OpenSsl and JDK providers.
        //          ApplicationProtocolConfig.SelectedListenerFailureBehavior.ACCEPT,
        //          ApplicationProtocolNames.HTTP_2,
        //          ApplicationProtocolNames.HTTP_1_1))
        .build();
  } catch (SSLException e) {
    e.printStackTrace();
  }

  return null;
}
 

import javax.net.ssl.SSLException; //导入依赖的package包/类
/**
 * PROT command.
 * <ul>
 * <li>C - Clear</li>
 * <li>S - Safe(SSL protocol only)</li>
 * <li>E - Confidential(SSL protocol only)</li>
 * <li>P - Private</li>
 * </ul>
 * <b>N.B.</b> the method calls
 *  {@link #setSocketFactory(javax.net.SocketFactory)} and
 *  {@link #setServerSocketFactory(javax.net.ServerSocketFactory)}
 *
 * @param prot Data Channel Protection Level, if {@code null}, use {@link #DEFAULT_PROT}.
 * @throws javax.net.ssl.SSLException If the server reply code does not equal  {@code 200}.
 * @throws java.io.IOException If an I/O error occurs while sending
 * the command.
 */
public void execPROT(String prot) throws SSLException, IOException {
    if (prot == null) {
        prot = DEFAULT_PROT;
    }
    if (!checkPROTValue(prot)) {
        throw new IllegalArgumentException();
    }
    if (FTPReply.COMMAND_OK != sendCommand(CMD_PROT, prot)) {
        throw new SSLException(getReplyString());
    }
    if (DEFAULT_PROT.equals(prot)) {
        setSocketFactory(null);
        setServerSocketFactory(null);
    } else {
        setSocketFactory(new FTPSSocketFactory(context));
        setServerSocketFactory(new FTPSServerSocketFactory(context));
        initSslContext();
    }
}
 

import javax.net.ssl.SSLException; //导入依赖的package包/类
/**
 * Send an FTP command.
 * A successful CCC (Clear Command Channel) command causes the underlying {@link javax.net.ssl.SSLSocket}
 * instance to be assigned to a plain {@link java.net.Socket}
 * @param command The FTP command.
 * @return server reply.
 * @throws java.io.IOException If an I/O error occurs while sending the command.
 * @throws javax.net.ssl.SSLException if a CCC command fails
 * @see FTP#sendCommand(String)
 */
// Would like to remove this method, but that will break any existing clients that are using CCC
@Override
public int sendCommand(String command, String args) throws IOException {
    int repCode = super.sendCommand(command, args);
    /* If CCC is issued, restore socket i/o streams to unsecured versions */
    if (CMD_CCC.equals(command)) {
        if (FTPReply.COMMAND_OK == repCode) {
            _socket_.close();
            _socket_ = plainSocket;
            _controlInput_ = new BufferedReader(
                new InputStreamReader(
                    _socket_ .getInputStream(), getControlEncoding()));
            _controlOutput_ = new BufferedWriter(
                new OutputStreamWriter(
                    _socket_.getOutputStream(), getControlEncoding()));
        } else {
            throw new SSLException(getReplyString());
        }
    }
    return repCode;
}
 

import javax.net.ssl.SSLException; //导入依赖的package包/类
/**
 * (Re)starts SSL session for the specified <tt>session</tt> if not started yet.
 * Please note that SSL session is automatically started by default, and therefore
 * you don't need to call this method unless you've used TLS closure.
 *
 * @return <tt>true</tt> if the SSL session has been started, <tt>false</tt> if already started.
 * @throws SSLException if failed to start the SSL session
 */
public boolean startSsl(IoSession session) throws SSLException {
    SslHandler handler = getSslSessionHandler(session);
    boolean started;
    synchronized (handler) {
        if (handler.isOutboundDone()) {
            NextFilter nextFilter = (NextFilter) session.getAttribute(NEXT_FILTER);
            handler.destroy();
            handler.init();
            handler.handshake(nextFilter);
            started = true;
        } else {
            started = false;
        }
    }

    handler.flushScheduledEvents();
    return started;
}
 

import javax.net.ssl.SSLException; //导入依赖的package包/类
/**
 * Executed just before the filter is added into the chain, we do :
 * <ul>
 * <li>check that we don't have a SSL filter already present
 * <li>we update the next filter
 * <li>we create the SSL handler helper class
 * <li>and we store it into the session's Attributes
 * </ul>
 */
@Override
public void onPreAdd(IoFilterChain parent, String name, NextFilter nextFilter) throws SSLException {
    // Check that we don't have a SSL filter already present in the chain
    if (parent.contains(SslFilter.class)) {
        String msg = "Only one SSL filter is permitted in a chain.";
        LOGGER.error(msg);
        throw new IllegalStateException(msg);
    }

    LOGGER.debug("Adding the SSL Filter {} to the chain", name);

    IoSession session = parent.getSession();
    session.setAttribute(NEXT_FILTER, nextFilter);

    // Create a SSL handler and start handshake.
    SslHandler handler = new SslHandler(this, session);
    handler.init();
    session.setAttribute(SSL_HANDLER, handler);
}
 

import javax.net.ssl.SSLException; //导入依赖的package包/类
@Override
public boolean retryRequest(IOException exception, int executionCount, HttpContext context) {

    if (executionCount >= 3) {// 如果已经重试了3次，就放弃
        return false;
    }

    if (exception instanceof NoHttpResponseException) {// 如果服务器丢掉了连接，那么就重试
        return true;
    }

    if (exception instanceof SSLHandshakeException) {// 不要重试SSL握手异常
        return false;
    }

    if (exception instanceof InterruptedIOException) {// 超时
        return true;
    }

    if (exception instanceof UnknownHostException) {// 目标服务器不可达
        return false;
    }

    if (exception instanceof ConnectTimeoutException) {// 连接被拒绝
        return false;
    }

    if (exception instanceof SSLException) {// ssl握手异常
        return false;
    }

    HttpClientContext clientContext = HttpClientContext.adapt(context);
    HttpRequest request = clientContext.getRequest();

    // 如果请求是幂等的，就再次尝试
    if (!(request instanceof HttpEntityEnclosingRequest)) {
        return true;
    }
    return false;
}
 

import javax.net.ssl.SSLException; //导入依赖的package包/类
private void handleSslException(SSLException e) throws CertificateValidationException, SSLException {
    if (e.getCause() instanceof CertificateException) {
        throw new CertificateValidationException(e.getMessage(), e);
    } else {
        throw e;
    }
}
 

import javax.net.ssl.SSLException; //导入依赖的package包/类
/**
   * performs the unwrap operation by unwrapping from {@link #inCrypt} to
   * {@link #inData}
*
   */
  private synchronized ByteBuffer unwrap() throws SSLException {
      int rem;
      do {
          rem = inData.remaining();
          readEngineResult = sslEngine.unwrap(inCrypt, inData);
      } while (readEngineResult.getStatus() == SSLEngineResult.Status.OK && (rem != inData.remaining() || sslEngine.getHandshakeStatus() == HandshakeStatus.NEED_UNWRAP));
      inData.flip();
      return inData;
  }
 

import javax.net.ssl.SSLException; //导入依赖的package包/类
@Test(expected = MessagingException.class)
public void whenTrustedSocketFactoryThrowsCertificateException_throwMessagingException() throws Exception {
    when(mockTrustedSocketFactory.createSocket(null, "server", 12345, null)).thenThrow(
            new SSLException(""));

    setSettingsForMockSocket();
    settings.setAuthType(AuthType.PLAIN);

    new Pop3Connection(settings, mockTrustedSocketFactory);
}
 

import javax.net.ssl.SSLException; //导入依赖的package包/类
@Override
public boolean verify(String host, SSLSession session) {
  try {
    Certificate[] certificates = session.getPeerCertificates();
    return verify(host, (X509Certificate) certificates[0]);
  } catch (SSLException e) {
    return false;
  }
}
 

import javax.net.ssl.SSLException; //导入依赖的package包/类
public boolean shouldRetry(Exception e, int currentRetryCount) {
    if (currentRetryCount >= maxRetryCount) {
        return false;
    }
    if (e instanceof ClientException) {
        if (((ClientException) e).isCanceledException()) {
            return false;
        }

        Exception localException = (Exception) e.getCause();
        if (localException instanceof InterruptedIOException
            && !(localException instanceof SocketTimeoutException)) {
            WCSLogUtil.e("[shouldRetry] - is interrupted!");
            return false;
        } else if (localException instanceof IllegalArgumentException) {
            return false;
        } else if (localException instanceof SSLException) {
            return false;
        }
        WCSLogUtil.d("shouldRetry - " + e.toString());
        e.getCause().printStackTrace();
        return true;
    } else if (e instanceof ServiceException) {
        ServiceException serviceException = (ServiceException) e;
        if (serviceException.getStatusCode() == 408 || (serviceException.getStatusCode() >= 500 &&
            serviceException.getStatusCode() != 579)) {
            return true;
        } else {
            return false;
        }
    } else {
        return false;
    }
}
 

import javax.net.ssl.SSLException; //导入依赖的package包/类
private SslContext buildServerSslContext() {
  try {
    InputStream certs = SslUtil.loadInputStreamCert("server.pem");
    InputStream keys = SslUtil.loadInputStreamCert("server_pkcs8.key");
    return GrpcSslContexts.configure(SslContextBuilder.forServer(certs, keys)).build();
  } catch (SSLException e) {
    throw new RpcFrameworkException(e);
  }
}
 

import javax.net.ssl.SSLException; //导入依赖的package包/类
/**
 * Read a CipherSuiteList from a HandshakeInStream in V3 ClientHello
 * format. Does not check if the listed ciphersuites are known or
 * supported.
 */
CipherSuiteList(HandshakeInStream in) throws IOException {
    byte[] bytes = in.getBytes16();
    if ((bytes.length & 1) != 0) {
        throw new SSLException("Invalid ClientHello message");
    }
    cipherSuites = new ArrayList<CipherSuite>(bytes.length >> 1);
    for (int i = 0; i < bytes.length; i += 2) {
        cipherSuites.add(CipherSuite.valueOf(bytes[i], bytes[i+1]));
    }
}