Java SSLConfig类代码示例

import org.jivesoftware.openfire.net.SSLConfig; //导入依赖的package包/类
private SSLContext createSSLContext(String host) {
    try {
        SSLContext context = SSLContext.getInstance("SSL");
        context.init(
                null,
                new TrustManager[]{new ClearspaceX509TrustManager(host, manager.getProperties(), SSLConfig.gets2sTrustStore())},
                null);
        return context;
    } catch (Exception e) {
        Log.error(e.getMessage(), e);
        throw new HttpClientError(e.toString());
    }
}
 

import org.jivesoftware.openfire.net.SSLConfig; //导入依赖的package包/类
private void createClientSSLListeners() {
    // Start clients SSL unless it's been disabled.
    if (isClientSSLListenerEnabled()) {
        int port = getClientSSLListenerPort();
        String algorithm = JiveGlobals.getProperty("xmpp.socket.ssl.algorithm");
        if ("".equals(algorithm) || algorithm == null) {
            algorithm = "TLS";
        }
        try {
            // Create SocketAcceptor with correct number of processors
            sslSocketAcceptor = buildSocketAcceptor();
            // Customize Executor that will be used by processors to process incoming stanzas
            int eventThreads = JiveGlobals.getIntProperty("xmpp.client_ssl.processing.threads", 16);
            ExecutorFilter executorFilter = new ExecutorFilter();
            ThreadPoolExecutor eventExecutor = (ThreadPoolExecutor)executorFilter.getExecutor();
            final ThreadFactory originalThreadFactory = eventExecutor.getThreadFactory();
            ThreadFactory newThreadFactory = new ThreadFactory()
            {
                private final AtomicInteger threadId = new AtomicInteger( 0 );

                public Thread newThread( Runnable runnable )
                {
                    Thread t = originalThreadFactory.newThread( runnable );
                    t.setName("Old SSL executor thread - " + threadId.incrementAndGet() );
                    t.setDaemon( true );
                    return t;
                }
            };
            eventExecutor.setThreadFactory( newThreadFactory );
            eventExecutor.setCorePoolSize(eventThreads + 1);
            eventExecutor.setMaximumPoolSize(eventThreads + 1);
            eventExecutor.setKeepAliveTime(60, TimeUnit.SECONDS);

            sslSocketAcceptor.getDefaultConfig().setThreadModel(ThreadModel.MANUAL);
            // Add the XMPP codec filter
            sslSocketAcceptor.getFilterChain().addFirst("xmpp", new ProtocolCodecFilter(new XMPPCodecFactory()));
            sslSocketAcceptor.getFilterChain().addFirst("threadModel", executorFilter);
            // Kill sessions whose outgoing queues keep growing and fail to send traffic
            sslSocketAcceptor.getFilterChain().addAfter("xmpp", "outCap", new StalledSessionsFilter());

            // Add the SSL filter now since sockets are "borned" encrypted in the old ssl method
            SSLContext sslContext = SSLContext.getInstance(algorithm);
            KeyManagerFactory keyFactory = KeyManagerFactory.getInstance(KeyManagerFactory.getDefaultAlgorithm());
            keyFactory.init(SSLConfig.getKeyStore(), SSLConfig.getKeyPassword().toCharArray());
            TrustManagerFactory trustFactory = TrustManagerFactory.getInstance(TrustManagerFactory.getDefaultAlgorithm());
            trustFactory.init(SSLConfig.getc2sTrustStore());

            sslContext.init(keyFactory.getKeyManagers(),
                    trustFactory.getTrustManagers(),
                    new java.security.SecureRandom());

            SSLFilter sslFilter = new SSLFilter(sslContext);
            if (JiveGlobals.getProperty("xmpp.client.cert.policy","disabled").equals("needed")) {
                sslFilter.setNeedClientAuth(true);
            }
            else if(JiveGlobals.getProperty("xmpp.client.cert.policy","disabled").equals("wanted")) {
                sslFilter.setWantClientAuth(true);
            }
            sslSocketAcceptor.getFilterChain().addFirst("tls", sslFilter);

        }
        catch (Exception e) {
            System.err.println("Error starting SSL XMPP listener on port " + port + ": " +
                    e.getMessage());
            Log.error(LocaleUtils.getLocalizedString("admin.error.ssl"), e);
        }
    }
}
 

import org.jivesoftware.openfire.net.SSLConfig; //导入依赖的package包/类
private void createSSLConnector(int securePort) {
    httpsConnector = null;
    try {
        if (securePort > 0 && CertificateManager.isRSACertificate(SSLConfig.getKeyStore(), "*")) {
            if (!CertificateManager.isRSACertificate(SSLConfig.getKeyStore(),
                    XMPPServer.getInstance().getServerInfo().getXMPPDomain())) {
                Log.warn("HTTP binding: Using RSA certificates but they are not valid for " +
                        "the hosted domain");
            }

            JiveSslConnector sslConnector = new JiveSslConnector();
            sslConnector.setHost(getBindInterface());
            sslConnector.setPort(securePort);

            sslConnector.setTrustPassword(SSLConfig.getc2sTrustPassword());
            sslConnector.setTruststoreType(SSLConfig.getStoreType());
            sslConnector.setTruststore(SSLConfig.getc2sTruststoreLocation());

            // Set policy for checking client certificates
            String certPol = JiveGlobals.getProperty("xmpp.client.cert.policy", "disabled");
            if(certPol.equals("needed")) {                    
                sslConnector.setNeedClientAuth(true);
                sslConnector.setWantClientAuth(true);
            } else if(certPol.equals("wanted")) {
                sslConnector.setNeedClientAuth(false);
                sslConnector.setWantClientAuth(true);
            } else {
                sslConnector.setNeedClientAuth(false);
                sslConnector.setWantClientAuth(false);
            }
            
            sslConnector.setKeyPassword(SSLConfig.getKeyPassword());
            sslConnector.setKeystoreType(SSLConfig.getStoreType());
            sslConnector.setKeystore(SSLConfig.getKeystoreLocation());
            httpsConnector = sslConnector;
        }
    }
    catch (Exception e) {
        Log.error("Error creating SSL connector for Http bind", e);
    }
}
 

import org.jivesoftware.openfire.net.SSLConfig; //导入依赖的package包/类
@Override
protected SSLContext createSSLContext() throws Exception {
    return SSLConfig.getc2sSSLContext();
}
 

import org.jivesoftware.openfire.net.SSLConfig; //导入依赖的package包/类
@Override
protected SSLContext createSSLContext() throws Exception {
    return SSLConfig.getSSLContext();
}
 

import org.jivesoftware.openfire.net.SSLConfig; //导入依赖的package包/类
public void startTLS(boolean clientMode, String remoteServer, ClientAuth authentication) throws Exception {
    boolean c2s = (remoteServer == null);
    KeyStore ksKeys = SSLConfig.getKeyStore();
    String keypass = SSLConfig.getKeyPassword();

    KeyStore ksTrust = (c2s ? SSLConfig.getc2sTrustStore() : SSLConfig.gets2sTrustStore() );
    String trustpass = (c2s ? SSLConfig.getc2sTrustPassword() : SSLConfig.gets2sTrustPassword() );
    if (c2s)  Log.debug("NIOConnection: startTLS: using c2s");
    else Log.debug("NIOConnection: startTLS: using s2s");
    // KeyManager's decide which key material to use.
    KeyManager[] km = SSLJiveKeyManagerFactory.getKeyManagers(ksKeys, keypass);

    // TrustManager's decide whether to allow connections.
    TrustManager[] tm = SSLJiveTrustManagerFactory.getTrustManagers(ksTrust, trustpass);

    if (clientMode || authentication == ClientAuth.needed || authentication == ClientAuth.wanted) {
        // We might need to verify a certificate from our peer, so get different TrustManager[]'s
        if(c2s) {
            // Check if we can trust certificates presented by the client
            tm = new TrustManager[]{new ClientTrustManager(ksTrust)};
        } else {
            // Check if we can trust certificates presented by the server
            tm = new TrustManager[]{new ServerTrustManager(remoteServer, ksTrust, this)};
        }
    }

    SSLContext tlsContext = SSLContext.getInstance("TLS");

    tlsContext.init(km, tm, null);

    SSLFilter filter = new SSLFilter(tlsContext);
    filter.setUseClientMode(clientMode);
    if (authentication == ClientAuth.needed) {
        filter.setNeedClientAuth(true);
    }
    else if (authentication == ClientAuth.wanted) {
        // Just indicate that we would like to authenticate the client but if client
        // certificates are self-signed or have no certificate chain then we are still
        // good
        filter.setWantClientAuth(true);
    }
    // TODO Temporary workaround (placing SSLFilter before ExecutorFilter) to avoid deadlock. Waiting for
    // MINA devs feedback
    ioSession.getFilterChain().addBefore("org.apache.mina.common.ExecutorThreadModel", "tls", filter);
    //ioSession.getFilterChain().addAfter("org.apache.mina.common.ExecutorThreadModel", "tls", filter);
    ioSession.setAttribute(SSLFilter.DISABLE_ENCRYPTION_ONCE, Boolean.TRUE);
    if (!clientMode) {
        // Indicate the client that the server is ready to negotiate TLS
        deliverRawText("<proceed xmlns=\"urn:ietf:params:xml:ns:xmpp-tls\"/>");
    }
}
 

import org.jivesoftware.openfire.net.SSLConfig; //导入依赖的package包/类
private void createClientSSLListeners() {
    // Start clients SSL unless it's been disabled.
    if (isClientSSLListenerEnabled()) {
        int port = getClientSSLListenerPort();
        String algorithm = JiveGlobals.getProperty("xmpp.socket.ssl.algorithm", "TLS");
        try {
            // Create SocketAcceptor with correct number of processors
            sslSocketAcceptor = buildSocketAcceptor("client_ssl");
            // Customize Executor that will be used by processors to process incoming stanzas
            int eventThreads = JiveGlobals.getIntProperty("xmpp.client_ssl.processing.threads", 16);
            ExecutorFilter executorFilter = new ExecutorFilter();
            ThreadPoolExecutor eventExecutor = (ThreadPoolExecutor)executorFilter.getExecutor();
            final ThreadFactory originalThreadFactory = eventExecutor.getThreadFactory();
            ThreadFactory newThreadFactory = new ThreadFactory()
            {
                private final AtomicInteger threadId = new AtomicInteger( 0 );

                public Thread newThread( Runnable runnable )
                {
                    Thread t = originalThreadFactory.newThread( runnable );
                    t.setName("Old SSL executor thread - " + threadId.incrementAndGet() );
                    t.setDaemon( true );
                    return t;
                }
            };
            eventExecutor.setThreadFactory( newThreadFactory );
            eventExecutor.setCorePoolSize(eventThreads + 1);
            eventExecutor.setMaximumPoolSize(eventThreads + 1);
            eventExecutor.setKeepAliveTime(60, TimeUnit.SECONDS);

            sslSocketAcceptor.getDefaultConfig().setThreadModel(ThreadModel.MANUAL);
            // Add the XMPP codec filter
            sslSocketAcceptor.getFilterChain().addFirst("xmpp", new ProtocolCodecFilter(new XMPPCodecFactory()));
            sslSocketAcceptor.getFilterChain().addFirst("threadModel", executorFilter);
            // Kill sessions whose outgoing queues keep growing and fail to send traffic
            sslSocketAcceptor.getFilterChain().addAfter("xmpp", "outCap", new StalledSessionsFilter());

            // Add the SSL filter now since sockets are "borned" encrypted in the old ssl method
            SSLContext sslContext = SSLContext.getInstance(algorithm);
            KeyManagerFactory keyFactory = KeyManagerFactory.getInstance(KeyManagerFactory.getDefaultAlgorithm());
            keyFactory.init(SSLConfig.getKeyStore(), SSLConfig.getKeyPassword().toCharArray());
            TrustManagerFactory trustFactory = TrustManagerFactory.getInstance(TrustManagerFactory.getDefaultAlgorithm());
            trustFactory.init(SSLConfig.getc2sTrustStore());

            sslContext.init(keyFactory.getKeyManagers(),
                    trustFactory.getTrustManagers(),
                    new java.security.SecureRandom());

            SSLFilter sslFilter = new SSLFilter(sslContext);
            if (JiveGlobals.getProperty("xmpp.client.cert.policy","disabled").equals("needed")) {
                sslFilter.setNeedClientAuth(true);
            }
            else if(JiveGlobals.getProperty("xmpp.client.cert.policy","disabled").equals("wanted")) {
                sslFilter.setWantClientAuth(true);
            }
            sslSocketAcceptor.getFilterChain().addFirst("tls", sslFilter);

        }
        catch (Exception e) {
            System.err.println("Error starting SSL XMPP listener on port " + port + ": " +
                    e.getMessage());
            Log.error(LocaleUtils.getLocalizedString("admin.error.ssl"), e);
        }
    }
}
 

import org.jivesoftware.openfire.net.SSLConfig; //导入依赖的package包/类
private void createSSLConnector(int securePort) {
    httpsConnector = null;
    try {
        if (securePort > 0 && CertificateManager.isRSACertificate(SSLConfig.getKeyStore(), "*")) {
            if (!CertificateManager.isRSACertificate(SSLConfig.getKeyStore(),
                    XMPPServer.getInstance().getServerInfo().getXMPPDomain())) {
                Log.warn("HTTP binding: Using RSA certificates but they are not valid for " +
                        "the hosted domain");
            }

            final SslContextFactory sslContextFactory = new SslContextFactory(SSLConfig.getKeystoreLocation());
            sslContextFactory.setTrustStorePassword(SSLConfig.getc2sTrustPassword());
            sslContextFactory.setTrustStoreType(SSLConfig.getStoreType());
            sslContextFactory.setTrustStore(SSLConfig.getc2sTruststoreLocation());
            sslContextFactory.setKeyStorePassword(SSLConfig.getKeyPassword());
            sslContextFactory.setKeyStoreType(SSLConfig.getStoreType());

            // Set policy for checking client certificates
            String certPol = JiveGlobals.getProperty("xmpp.client.cert.policy", "disabled");
            if(certPol.equals("needed")) {                    
            	sslContextFactory.setNeedClientAuth(true);
            	sslContextFactory.setWantClientAuth(true);
            } else if(certPol.equals("wanted")) {
            	sslContextFactory.setNeedClientAuth(false);
            	sslContextFactory.setWantClientAuth(true);
            } else {
            	sslContextFactory.setNeedClientAuth(false);
            	sslContextFactory.setWantClientAuth(false);
            }
            
            final SslSelectChannelConnector sslConnector = new SslSelectChannelConnector(sslContextFactory);
            sslConnector.setHost(getBindInterface());
            sslConnector.setPort(securePort);
            configureProxiedConnector(sslConnector);
            httpsConnector = sslConnector;
        }
    }
    catch (Exception e) {
        Log.error("Error creating SSL connector for Http bind", e);
    }
}
 

import org.jivesoftware.openfire.net.SSLConfig; //导入依赖的package包/类
public void startTLS(boolean clientMode, String remoteServer, ClientAuth authentication) throws Exception {
    boolean c2s = (remoteServer == null);
    KeyStore ksKeys = SSLConfig.getKeyStore();
    String keypass = SSLConfig.getKeyPassword();

    KeyStore ksTrust = (c2s ? SSLConfig.getc2sTrustStore() : SSLConfig.gets2sTrustStore() );
    String trustpass = (c2s ? SSLConfig.getc2sTrustPassword() : SSLConfig.gets2sTrustPassword() );
    if (c2s)  Log.debug("NIOConnection: startTLS: using c2s");
    else Log.debug("NIOConnection: startTLS: using s2s");
    // KeyManager's decide which key material to use.
    KeyManager[] km = SSLJiveKeyManagerFactory.getKeyManagers(ksKeys, keypass);

    // TrustManager's decide whether to allow connections.
    TrustManager[] tm = SSLJiveTrustManagerFactory.getTrustManagers(ksTrust, trustpass);

    if (clientMode || authentication == ClientAuth.needed || authentication == ClientAuth.wanted) {
        // We might need to verify a certificate from our peer, so get different TrustManager[]'s
        if(c2s) {
            // Check if we can trust certificates presented by the client
            tm = new TrustManager[]{new ClientTrustManager(ksTrust)};
        } else {
            // Check if we can trust certificates presented by the server
            tm = new TrustManager[]{new ServerTrustManager(remoteServer, ksTrust, this)};
        }
    }

    String algorithm = JiveGlobals.getProperty("xmpp.socket.ssl.algorithm", "TLS");
    SSLContext tlsContext = SSLContext.getInstance(algorithm);

    tlsContext.init(km, tm, null);

    SSLFilter filter = new SSLFilter(tlsContext);
    filter.setUseClientMode(clientMode);
    if (authentication == ClientAuth.needed) {
        filter.setNeedClientAuth(true);
    }
    else if (authentication == ClientAuth.wanted) {
        // Just indicate that we would like to authenticate the client but if client
        // certificates are self-signed or have no certificate chain then we are still
        // good
        filter.setWantClientAuth(true);
    }
    // TODO Temporary workaround (placing SSLFilter before ExecutorFilter) to avoid deadlock. Waiting for
    // MINA devs feedback
    ioSession.getFilterChain().addBefore("org.apache.mina.common.ExecutorThreadModel", "tls", filter);
    //ioSession.getFilterChain().addAfter("org.apache.mina.common.ExecutorThreadModel", "tls", filter);
    ioSession.setAttribute(SSLFilter.DISABLE_ENCRYPTION_ONCE, Boolean.TRUE);
    if (!clientMode) {
        // Indicate the client that the server is ready to negotiate TLS
        deliverRawText("<proceed xmlns=\"urn:ietf:params:xml:ns:xmpp-tls\"/>");
    }
}
 

import org.jivesoftware.openfire.net.SSLConfig; //导入依赖的package包/类
private void createClientSSLListeners() {
    // Start clients SSL unless it's been disabled.
    if (isClientSSLListenerEnabled()) {
        int port = getClientSSLListenerPort();
        String algorithm = JiveGlobals.getProperty("xmpp.socket.ssl.algorithm", "TLS");
        try {
            // Create SocketAcceptor with correct number of processors
            sslSocketAcceptor = buildSocketAcceptor();
            // Customize Executor that will be used by processors to process incoming stanzas
            int eventThreads = JiveGlobals.getIntProperty("xmpp.client_ssl.processing.threads", 16);
            ExecutorFilter executorFilter = new ExecutorFilter();
            ThreadPoolExecutor eventExecutor = (ThreadPoolExecutor)executorFilter.getExecutor();
            final ThreadFactory originalThreadFactory = eventExecutor.getThreadFactory();
            ThreadFactory newThreadFactory = new ThreadFactory()
            {
                private final AtomicInteger threadId = new AtomicInteger( 0 );

                public Thread newThread( Runnable runnable )
                {
                    Thread t = originalThreadFactory.newThread( runnable );
                    t.setName("Old SSL executor thread - " + threadId.incrementAndGet() );
                    t.setDaemon( true );
                    return t;
                }
            };
            eventExecutor.setThreadFactory( newThreadFactory );
            eventExecutor.setCorePoolSize(eventThreads + 1);
            eventExecutor.setMaximumPoolSize(eventThreads + 1);
            eventExecutor.setKeepAliveTime(60, TimeUnit.SECONDS);

            sslSocketAcceptor.getDefaultConfig().setThreadModel(ThreadModel.MANUAL);
            // Add the XMPP codec filter
            sslSocketAcceptor.getFilterChain().addFirst("xmpp", new ProtocolCodecFilter(new XMPPCodecFactory()));
            sslSocketAcceptor.getFilterChain().addFirst("threadModel", executorFilter);
            // Kill sessions whose outgoing queues keep growing and fail to send traffic
            sslSocketAcceptor.getFilterChain().addAfter("xmpp", "outCap", new StalledSessionsFilter());

            // Add the SSL filter now since sockets are "borned" encrypted in the old ssl method
            SSLContext sslContext = SSLContext.getInstance(algorithm);
            KeyManagerFactory keyFactory = KeyManagerFactory.getInstance(KeyManagerFactory.getDefaultAlgorithm());
            keyFactory.init(SSLConfig.getKeyStore(), SSLConfig.getKeyPassword().toCharArray());
            TrustManagerFactory trustFactory = TrustManagerFactory.getInstance(TrustManagerFactory.getDefaultAlgorithm());
            trustFactory.init(SSLConfig.getc2sTrustStore());

            sslContext.init(keyFactory.getKeyManagers(),
                    trustFactory.getTrustManagers(),
                    new java.security.SecureRandom());

            SSLFilter sslFilter = new SSLFilter(sslContext);
            if (JiveGlobals.getProperty("xmpp.client.cert.policy","disabled").equals("needed")) {
                sslFilter.setNeedClientAuth(true);
            }
            else if(JiveGlobals.getProperty("xmpp.client.cert.policy","disabled").equals("wanted")) {
                sslFilter.setWantClientAuth(true);
            }
            sslSocketAcceptor.getFilterChain().addFirst("tls", sslFilter);

        }
        catch (Exception e) {
            System.err.println("Error starting SSL XMPP listener on port " + port + ": " +
                    e.getMessage());
            Log.error(LocaleUtils.getLocalizedString("admin.error.ssl"), e);
        }
    }
}
 

import org.jivesoftware.openfire.net.SSLConfig; //导入依赖的package包/类
private void createSSLConnector(int securePort) {
    httpsConnector = null;
    try {
        if (securePort > 0 && CertificateManager.isRSACertificate(SSLConfig.getKeyStore(), "*")) {
            if (!CertificateManager.isRSACertificate(SSLConfig.getKeyStore(),
                    XMPPServer.getInstance().getServerInfo().getXMPPDomain())) {
                Log.warn("HTTP binding: Using RSA certificates but they are not valid for " +
                        "the hosted domain");
            }

            final SslContextFactory sslContextFactory = new SslContextFactory(SSLConfig.getKeystoreLocation());
            sslContextFactory.setTrustStorePassword(SSLConfig.getc2sTrustPassword());
            sslContextFactory.setTrustStoreType(SSLConfig.getStoreType());
            sslContextFactory.setTrustStore(SSLConfig.getc2sTruststoreLocation());
            sslContextFactory.setKeyStorePassword(SSLConfig.getKeyPassword());
            sslContextFactory.setKeyStoreType(SSLConfig.getStoreType());

            // Set policy for checking client certificates
            String certPol = JiveGlobals.getProperty("xmpp.client.cert.policy", "disabled");
            if(certPol.equals("needed")) {                    
            	sslContextFactory.setNeedClientAuth(true);
            	sslContextFactory.setWantClientAuth(true);
            } else if(certPol.equals("wanted")) {
            	sslContextFactory.setNeedClientAuth(false);
            	sslContextFactory.setWantClientAuth(true);
            } else {
            	sslContextFactory.setNeedClientAuth(false);
            	sslContextFactory.setWantClientAuth(false);
            }
            
            final SslSelectChannelConnector sslConnector = new SslSelectChannelConnector(sslContextFactory);
            sslConnector.setHost(getBindInterface());
            sslConnector.setPort(securePort);
            
            httpsConnector = sslConnector;
        }
    }
    catch (Exception e) {
        Log.error("Error creating SSL connector for Http bind", e);
    }
}