Java SSLSession.getPeerHost方法代码示例

import javax.net.ssl.SSLSession; //导入方法依赖的package包/类
/**
 * Invalidates all SSL/TLS sessions in {@code sessionContext} associated with {@code remoteAddress}.
 *
 * @param sessionContext collection of SSL/TLS sessions to be (potentially) invalidated
 * @param remoteAddress  associated with sessions to invalidate
 */
private void clearSessionCache(final SSLSessionContext sessionContext, final InetSocketAddress remoteAddress) {
    final String hostName = remoteAddress.getHostName();
    final int port = remoteAddress.getPort();
    final Enumeration<byte[]> ids = sessionContext.getIds();

    if (ids == null) {
        return;
    }

    while (ids.hasMoreElements()) {
        final byte[] id = ids.nextElement();
        final SSLSession session = sessionContext.getSession(id);
        if (session != null && session.getPeerHost() != null && session.getPeerHost().equalsIgnoreCase(hostName)
                && session.getPeerPort() == port) {
            session.invalidate();
            if (LOG.isDebugEnabled()) {
                LOG.debug("Invalidated session " + session);
            }
        }
    }
}
 

import javax.net.ssl.SSLSession; //导入方法依赖的package包/类
@Override
public void checkClientTrusted(X509Certificate[] chain, String authType,
    SSLEngine engine) throws CertificateException {
  if (!option.isAuthPeer()) {
    return;
  }

  String ip = null;
  if (engine != null) {
    SSLSession session = engine.getHandshakeSession();
    ip = session.getPeerHost();
  }
  checkTrustedCustom(chain, ip);
  trustManager.checkClientTrusted(chain, authType, engine);
}
 

import javax.net.ssl.SSLSession; //导入方法依赖的package包/类
@Override
public void checkServerTrusted(X509Certificate[] chain, String authType,
    SSLEngine engine) throws CertificateException {
  if (!option.isAuthPeer()) {
    return;
  }

  String ip = null;
  if (engine != null) {
    SSLSession session = engine.getHandshakeSession();
    ip = session.getPeerHost();
  }
  checkTrustedCustom(chain, ip);
  trustManager.checkServerTrusted(chain, authType, engine);
}
 

import javax.net.ssl.SSLSession; //导入方法依赖的package包/类
/**
 * Verifies the peer's hostname using the configured {@link HostnameVerifier}.
 * 
 * @param socket the socket connected to the peer whose hostname is to be verified.
 * 
 * @throws SSLException if the hostname does not verify against the peer's certificate, 
 *          or if there is an error in performing the evaluation
 */
protected void verifyHostname(Socket socket) throws SSLException {
    if (hostnameVerifier == null) {
        return;
    }
    
    if (!(socket instanceof SSLSocket)) {
        return;
    }
    
    SSLSocket sslSocket = (SSLSocket) socket;
    
    try {
        SSLSession sslSession = sslSocket.getSession();
        String hostname = sslSession.getPeerHost();
        
        if (!hostnameVerifier.verify(hostname, sslSession)) {
            throw new SSLPeerUnverifiedException("SSL peer failed hostname validation for name: " + hostname);
        }
    } catch (SSLException e) {
        cleanUpFailedSocket(sslSocket);
        throw e;
    } catch (Throwable t) {
        // Make sure we close the socket on any kind of Exception, RuntimeException or Error.
        cleanUpFailedSocket(sslSocket);
        throw new SSLException("Error in hostname verification", t);
    }
}
 

import javax.net.ssl.SSLSession; //导入方法依赖的package包/类
private static void checkIdentity(SSLSession session,
        X509Certificate cert,
        String algorithm,
        boolean isClient,
        List<SNIServerName> sniNames) throws CertificateException {

    boolean identifiable = false;
    String peerHost = session.getPeerHost();
    if (isClient) {
        String hostname = getHostNameInSNI(sniNames);
        if (hostname != null) {
            try {
                checkIdentity(hostname, cert, algorithm);
                identifiable = true;
            } catch (CertificateException ce) {
                if (hostname.equalsIgnoreCase(peerHost)) {
                    throw ce;
                }

                // otherwisw, failover to check peer host
            }
        }
    }

    if (!identifiable) {
        checkIdentity(peerHost, cert, algorithm);
    }
}
 

import javax.net.ssl.SSLSession; //导入方法依赖的package包/类
private static HostnameVerifier getHostNameVerifier() {
    return new HostnameVerifier() {
        public boolean verify(String urlHostName, SSLSession session) {
            String peerHost = session.getPeerHost();
            if (!urlHostName.equalsIgnoreCase(peerHost)) {
                LOGGER.warn("Warning: URL host '" + urlHostName + "' is " +
                        "different to SSLSession host '" + peerHost + "'.");
            }
            return true;
        }
    };
}
 

import javax.net.ssl.SSLSession; //导入方法依赖的package包/类
private static void checkIdentity(SSLSession session,
        X509Certificate cert,
        String algorithm,
        boolean isClient,
        List<SNIServerName> sniNames,
        boolean chainsToPublicCA) throws CertificateException {

    boolean identifiable = false;
    String peerHost = session.getPeerHost();
    if (isClient) {
        String hostname = getHostNameInSNI(sniNames);
        if (hostname != null) {
            try {
                checkIdentity(hostname, cert, algorithm, chainsToPublicCA);
                identifiable = true;
            } catch (CertificateException ce) {
                if (hostname.equalsIgnoreCase(peerHost)) {
                    throw ce;
                }

                // otherwisw, failover to check peer host
            }
        }
    }

    if (!identifiable) {
        checkIdentity(peerHost, cert, algorithm, chainsToPublicCA);
    }
}
 

import javax.net.ssl.SSLSession; //导入方法依赖的package包/类
/**
 * Describe <code>verifyHostname</code> method here.
 *
 * @param socket a <code>SSLSocket</code> value
 * @exception SSLPeerUnverifiedException  If there are problems obtaining
 * the server certificates from the SSL session, or the server host name 
 * does not match with the "Common Name" in the server certificates 
 * SubjectDN.
 * @exception UnknownHostException  If we are not able to resolve
 * the SSL sessions returned server host name. 
 */
private void verifyHostname(SSLSocket socket) 
    throws SSLPeerUnverifiedException, UnknownHostException {
    if (! verifyHostname) 
        return;

    SSLSession session = socket.getSession();
    String hostname = session.getPeerHost();
    try {
        InetAddress addr = InetAddress.getByName(hostname);
    } catch (UnknownHostException uhe) {
        throw new UnknownHostException("Could not resolve SSL sessions "
                                       + "server hostname: " + hostname);
    }
    
    X509Certificate[] certs = session.getPeerCertificateChain();
    if (certs == null || certs.length == 0) 
        throw new SSLPeerUnverifiedException("No server certificates found!");
    
    //get the servers DN in its string representation
    String dn = certs[0].getSubjectDN().getName();

    //might be useful to print out all certificates we receive from the
    //server, in case one has to debug a problem with the installed certs.
    if (LOG.isDebugEnabled()) {
        LOG.debug("Server certificate chain:");
        for (int i = 0; i < certs.length; i++) {
            LOG.debug("X509Certificate[" + i + "]=" + certs[i]);
        }
    }
    //get the common name from the first cert
    String cn = getCN(dn);
    if (hostname.equalsIgnoreCase(cn)) {
        if (LOG.isDebugEnabled()) {
            LOG.debug("Target hostname valid: " + cn);
        }
    } else {
        throw new SSLPeerUnverifiedException(
            "HTTPS hostname invalid: expected '" + hostname + "', received '" + cn + "'");
    }
}