Java SSLSocketFactory.createSocket方法代码示例

import javax.net.ssl.SSLSocketFactory; //导入方法依赖的package包/类
private void upgradeToTls(Socket socket) throws KeyStoreException, IOException, NoSuchAlgorithmException,
        CertificateException, UnrecoverableKeyException, KeyManagementException {

    KeyStore keyStore = keyStoreProvider.getKeyStore();

    String defaultAlgorithm = KeyManagerFactory.getDefaultAlgorithm();
    KeyManagerFactory keyManagerFactory = KeyManagerFactory.getInstance(defaultAlgorithm);
    keyManagerFactory.init(keyStore, keyStoreProvider.getPassword());

    SSLContext sslContext = SSLContext.getInstance("TLS");
    sslContext.init(keyManagerFactory.getKeyManagers(), null, null);
    SSLSocketFactory sslSocketFactory = sslContext.getSocketFactory();

    SSLSocket sslSocket = (SSLSocket) sslSocketFactory.createSocket(
            socket, socket.getInetAddress().getHostAddress(), socket.getPort(), true);
    sslSocket.setUseClientMode(false);
    sslSocket.startHandshake();

    input = Okio.buffer(Okio.source(sslSocket.getInputStream()));
    output = Okio.buffer(Okio.sink(sslSocket.getOutputStream()));
}
 

import javax.net.ssl.SSLSocketFactory; //导入方法依赖的package包/类
/**
 * <p>Creates a server socket that accepts SSL connections
 * configured according to this factory's SSL socket configuration
 * parameters.</p>
 */
public ServerSocket createServerSocket(int port) throws IOException {
    final SSLSocketFactory sslSocketFactory =
            context == null ?
                getDefaultSSLSocketFactory() : context.getSocketFactory();
    return new ServerSocket(port) {
        public Socket accept() throws IOException {
            Socket socket = super.accept();
            SSLSocket sslSocket = (SSLSocket) sslSocketFactory.createSocket(
                    socket, socket.getInetAddress().getHostName(),
                    socket.getPort(), true);
            sslSocket.setUseClientMode(false);
            if (enabledCipherSuites != null) {
                sslSocket.setEnabledCipherSuites(enabledCipherSuites);
            }
            if (enabledProtocols != null) {
                sslSocket.setEnabledProtocols(enabledProtocols);
            }
            sslSocket.setNeedClientAuth(needClientAuth);
            return sslSocket;
        }
    };
}
 

import javax.net.ssl.SSLSocketFactory; //导入方法依赖的package包/类
/**
 * @param host the host
 * @param port the port
 * 
 * @return array with all server-side certificates obtained from direct socket connection
 */
public static synchronized Certificate[] getCertificatesFromSocket( String host, String port ) {

    TrustManager[] trustAllCerts = new TrustManager[]{ new DefaultTrustManager() {} };

    try {
        SSLContext sslContext = SSLContext.getInstance("TLS");
        sslContext.init(null, trustAllCerts, new java.security.SecureRandom());
        final SSLSocketFactory sslSocketFactory = sslContext.getSocketFactory();

        SSLSocket sslSocket = (SSLSocket) sslSocketFactory.createSocket(host, Integer.valueOf(port));
        sslSocket.startHandshake();
        return sslSocket.getSession().getPeerCertificates();
    } catch (Exception e) {
        throw new RuntimeException("Could not get certificate of secure socket to " + host + ":" + port + ".!", e);
    }
}
 

import javax.net.ssl.SSLSocketFactory; //导入方法依赖的package包/类
@Override
public Socket accept() throws IOException {
    final SSLSocketFactory sslSocketFactory =
            context == null ?
                getDefaultSSLSocketFactory() : context.getSocketFactory();
    Socket socket = super.accept();
    SSLSocket sslSocket = (SSLSocket) sslSocketFactory.createSocket(
            socket, socket.getInetAddress().getHostName(),
            socket.getPort(), true);
    sslSocket.setUseClientMode(false);
    if (enabledCipherSuites != null) {
        sslSocket.setEnabledCipherSuites(enabledCipherSuites);
    }
    if (enabledProtocols != null) {
        sslSocket.setEnabledProtocols(enabledProtocols);
    }
    sslSocket.setNeedClientAuth(needClientAuth);
    return sslSocket;
}
 

import javax.net.ssl.SSLSocketFactory; //导入方法依赖的package包/类
void doClientSide() throws Exception {

        /*
         * Wait for server to get started.
         */
        while (!serverReady) {
            Thread.sleep(50);
        }

        SSLSocketFactory sslsf =
            (SSLSocketFactory) SSLSocketFactory.getDefault();
        SSLSocket sslSocket = (SSLSocket)
            sslsf.createSocket("localhost", serverPort);

        // enable TLSv1.1 only
        sslSocket.setEnabledProtocols(new String[] {"TLSv1.1"});

        InputStream sslIS = sslSocket.getInputStream();
        OutputStream sslOS = sslSocket.getOutputStream();

        sslOS.write('B');
        sslOS.flush();
        sslIS.read();

        sslSocket.close();
    }
 

import javax.net.ssl.SSLSocketFactory; //导入方法依赖的package包/类
/**
 * @see SecureProtocolSocketFactory#createSocket(java.lang.String,int,java.net.InetAddress,int)
 */
public Socket createSocket(String host, int port, 
                           InetAddress clientHost, int clientPort)
    throws IOException, UnknownHostException {
    SSLSocketFactory sf = (SSLSocketFactory) SSLSocketFactory.getDefault();
    SSLSocket sslSocket = (SSLSocket) sf.createSocket(host, port, 
                                                      clientHost, 
                                                      clientPort);
    verifyHostname(sslSocket);

    return sslSocket;
}
 

import javax.net.ssl.SSLSocketFactory; //导入方法依赖的package包/类
private void processHandshakeFailure(Socket raw) throws Exception {
  SSLContext context = SSLContext.getInstance("TLS");
  context.init(null, new TrustManager[] {UNTRUSTED_TRUST_MANAGER}, new SecureRandom());
  SSLSocketFactory sslSocketFactory = context.getSocketFactory();
  SSLSocket socket = (SSLSocket) sslSocketFactory.createSocket(
      raw, raw.getInetAddress().getHostAddress(), raw.getPort(), true);
  try {
    socket.startHandshake(); // we're testing a handshake failure
    throw new AssertionError();
  } catch (IOException expected) {
  }
  socket.close();
}
 

import javax.net.ssl.SSLSocketFactory; //导入方法依赖的package包/类
static SSLClient init(String host, int port, String cipherSuiteFilter,
        String sniHostName) throws NoSuchAlgorithmException, IOException {
    SSLContext sslContext = SSLContext.getDefault();
    SSLSocketFactory ssf = (SSLSocketFactory) sslContext.getSocketFactory();
    SSLSocket socket = (SSLSocket) ssf.createSocket(host, port);
    SSLParameters params = new SSLParameters();

    if (cipherSuiteFilter != null) {
        String[] cipherSuites = UnboundSSLUtils.filterStringArray(
                ssf.getSupportedCipherSuites(), cipherSuiteFilter);
        System.out.println("Client: enabled cipher suites: "
                + Arrays.toString(cipherSuites));
        params.setCipherSuites(cipherSuites);
    }

    if (sniHostName != null) {
        System.out.println("Client: set SNI hostname: " + sniHostName);
        SNIHostName serverName = new SNIHostName(sniHostName);
        List<SNIServerName> serverNames = new ArrayList<>();
        serverNames.add(serverName);
        params.setServerNames(serverNames);
    }

    socket.setSSLParameters(params);

    return new SSLClient(socket);
}
 

import javax.net.ssl.SSLSocketFactory; //导入方法依赖的package包/类
static SSLClient init(int port, String ciphersuite)
        throws NoSuchAlgorithmException, IOException {
    SSLContext context = SSLContext.getDefault();
    SSLSocketFactory ssf = (SSLSocketFactory)
            context.getSocketFactory();
    SSLSocket socket = (SSLSocket) ssf.createSocket("localhost", port);

    if (ciphersuite != null) {
        System.out.println("Client: enable cipher suite: "
                + ciphersuite);
        socket.setEnabledCipherSuites(new String[] { ciphersuite });
    }

    return new SSLClient(socket);
}
 

import javax.net.ssl.SSLSocketFactory; //导入方法依赖的package包/类
public static void wrapXmppTalk(OpenFireTalk xmppTalk) {
	try {
		Socket socket = xmppTalk.getSocket();
		SSLContext sslContext = getSslContext();
		InetSocketAddress remoteAddress = (InetSocketAddress) socket.getRemoteSocketAddress();
		SSLSocketFactory sf = sslContext.getSocketFactory();
		SSLSocket s = (SSLSocket) (sf.createSocket(socket, remoteAddress.getHostName(), socket.getPort(), true));
		s.setUseClientMode(true);
		s.startHandshake();
		xmppTalk.setSocket(s);
	} catch (Exception e) {
		e.printStackTrace();
	}
}
 

import javax.net.ssl.SSLSocketFactory; //导入方法依赖的package包/类
/**
 * Create an SSL client socket using the IOR-encoded
 * security characteristics.
 * Setting want/need client auth on a client socket has no effect so all we can do is use the right host, port, ciphers
 *
 * @param host     The target host name.
 * @param port     The target connection port.
 *
 * @return An appropriately configured client SSLSocket.
 * @exception IOException if ssl socket can't be obtained and configured.
 */
private Socket createSSLSocket(String host, int port, int requires, int supports) throws IOException {
    SSLSocketFactory factory = getSocketFactory();
    SSLSocket socket = (SSLSocket) factory.createSocket(host, port);

    socket.setSoTimeout(SOCKET_TIMEOUT_MS);

    // get a set of cipher suites appropriate for this connections requirements.
    // We request this for each connection, since the outgoing IOR's requirements may be different from
    // our server listener requirements.
    String[] iorSuites = SSLCipherSuiteDatabase.getCipherSuites(requires, supports, factory.getSupportedCipherSuites());
    socket.setEnabledCipherSuites(iorSuites);
    if (log.isDebugEnabled()) {
        log.debug("Created SSL socket to " + host + ":" + port);
        log.debug("    cipher suites:");

        for (int i = 0; i < iorSuites.length; i++) {
            log.debug("    " + iorSuites[i]);
        }
        socket.addHandshakeCompletedListener(new HandshakeCompletedListener() {

            public void handshakeCompleted(HandshakeCompletedEvent handshakeCompletedEvent) {
                Certificate[] certs = handshakeCompletedEvent.getLocalCertificates();
                if (certs != null) {
                    log.debug("handshake returned local certs count: " + certs.length);
                    for (int i = 0; i < certs.length; i++) {
                        Certificate cert = certs[i];
                        log.debug("cert: " + cert.toString());
                    }
                } else {
                    log.debug("handshake returned no local certs");
                }
            }
        });
    }
    return socket;
}
 

import javax.net.ssl.SSLSocketFactory; //导入方法依赖的package包/类
/**
 * Creates a secure socket to communicate with Expedia.
 *
 * @return String - html response from Expedia
 */
private String getHtmlResponse(String path) {

    try {
        // connect with host -Expedia
        SSLSocketFactory factory = (SSLSocketFactory) SSLSocketFactory.getDefault();
        Socket socket = factory.createSocket(HOST, PORT);

        // send a request to the server through output stream
        PrintWriter pw = new PrintWriter(new OutputStreamWriter(socket.getOutputStream()), true);
        String requestString = getRequest(path);
        pw.println(requestString);

        // use input stream to read server's response
        BufferedReader in = new BufferedReader(new InputStreamReader(socket.getInputStream()));
        StringBuilder sb = new StringBuilder();

        String str;
        while ((str = in.readLine()) != null) {
            sb.append(str);
        }

        if (sb.toString().startsWith("HTTP/1.1 301 Moved")) {
            Pattern p = Pattern.compile(".*?https://www.expedia.com([^\\s:]*):\\s");
            Matcher m = p.matcher(sb.toString());
            if (m.find()) {
                String newPath = m.group(1).replaceAll("Server", "");
                return getHtmlResponse(newPath);
            }
            else {
                return "";
            }
        }
        else if (sb.toString().startsWith("HTTP/1.1 404 Not Found")) {
            return "";
        }

        // take the body part
        return sb.substring(sb.indexOf("<body"));
    }
    catch (IOException e) {
        System.out.println(e);
    }

    return "";
}
 

import javax.net.ssl.SSLSocketFactory; //导入方法依赖的package包/类
SBListener doClientSide() throws Exception {

        /*
         * Wait for server to get started.
         */
        while (!serverReady) {
            Thread.sleep(50);
        }

        SSLSocketFactory sslsf =
            (SSLSocketFactory) SSLSocketFactory.getDefault();

        try {
                SSLSocket sslSocket = (SSLSocket)
                    sslsf.createSocket("localhost", serverPort);
                InputStream sslIS = sslSocket.getInputStream();
                OutputStream sslOS = sslSocket.getOutputStream();

            sslOS.write(280);
            sslOS.flush();
            sslIS.read();

            sslOS.close();
            sslIS.close();

            SSLSession sslSession = sslSocket.getSession();
            System.out.printf(" sslSession: %s %n   %s%n", sslSession, sslSession.getClass());
            SBListener sbListener = new SBListener(sslSession);

            sslSession.putValue("x", sbListener);

            sslSession.invalidate();

            sslSocket.close();

            sslOS = null;
            sslIS = null;
            sslSession = null;
            sslSocket = null;
            Reference.reachabilityFence(sslOS);
            Reference.reachabilityFence(sslIS);
            Reference.reachabilityFence(sslSession);
            Reference.reachabilityFence(sslSocket);

            return sbListener;
        } catch (Exception ex) {
            ex.printStackTrace();
            throw ex;
        }
    }
 

import javax.net.ssl.SSLSocketFactory; //导入方法依赖的package包/类
private SSLSocket startHandshake(SSLSocketFactory factory)
    throws IOException {

    if (ldapConnection == null) {
        throw new IllegalStateException("LDAP connection has not been set."
            + " TLS requires an existing LDAP connection.");
    }

    if (factory != currentFactory) {
        // Create SSL socket layered over the existing connection
        sslSocket = (SSLSocket) factory.createSocket(ldapConnection.sock,
            ldapConnection.host, ldapConnection.port, false);
        currentFactory = factory;

        if (debug) {
            System.out.println("StartTLS: Created socket : " + sslSocket);
        }
    }

    if (suites != null) {
        sslSocket.setEnabledCipherSuites(suites);
        if (debug) {
            System.out.println("StartTLS: Enabled cipher suites");
        }
    }

    // Connection must be quite for handshake to proceed

    try {
        if (debug) {
            System.out.println(
                    "StartTLS: Calling sslSocket.startHandshake");
        }
        sslSocket.startHandshake();
        if (debug) {
            System.out.println(
                    "StartTLS: + Finished sslSocket.startHandshake");
        }

        // Replace original streams with the new SSL streams
        ldapConnection.replaceStreams(sslSocket.getInputStream(),
            sslSocket.getOutputStream());
        if (debug) {
            System.out.println("StartTLS: Replaced IO Streams");
        }

    } catch (IOException e) {
        if (debug) {
            System.out.println("StartTLS: Got IO error during handshake");
            e.printStackTrace();
        }

        sslSocket.close();
        isClosed = true;
        throw e;   // pass up exception
    }

    return sslSocket;
}
 

import javax.net.ssl.SSLSocketFactory; //导入方法依赖的package包/类
@Test
public void testRenegotiateFail() throws Exception {

    // If RFC5746 is supported, renegotiation will always work (and will
    // always be secure)
    if (TesterSupport.RFC_5746_SUPPORTED) {
        return;
    }

    Tomcat tomcat = getTomcatInstance();

    File appDir = new File(getBuildDirectory(), "webapps/examples");
    // app dir is relative to server home
    tomcat.addWebapp(null, "/examples", appDir.getAbsolutePath());

    TesterSupport.initSsl(tomcat);

    // Default - MITM attack prevented

    tomcat.start();
    SSLContext sslCtx = SSLContext.getInstance("TLS");
    sslCtx.init(null, TesterSupport.getTrustManagers(), null);
    SSLSocketFactory socketFactory = sslCtx.getSocketFactory();
    SSLSocket socket = (SSLSocket) socketFactory.createSocket("localhost", getPort());

    socket.addHandshakeCompletedListener(new HandshakeCompletedListener() {
        @Override
        public void handshakeCompleted(HandshakeCompletedEvent event) {
            handshakeDone = true;
        }
    });

    OutputStream os = socket.getOutputStream();
    os.write("GET /examples/servlets/servlet/HelloWorldExample HTTP/1.0\n".getBytes());
    os.flush();


    InputStream is = socket.getInputStream();

    // Make sure the NIO connector has read the request before the handshake
    Thread.sleep(100);

    socket.startHandshake();

    os = socket.getOutputStream();

    try {
        os.write("Host: localhost\n\n".getBytes());
    } catch (IOException ex) {
        ex.printStackTrace();
        fail("Re-negotiation failed");
    }
    Reader r = new InputStreamReader(is);
    BufferedReader br = new BufferedReader(r);
    String line = br.readLine();
    while (line != null) {
        // For testing System.out.println(line);
        line = br.readLine();
    }

    if (!handshakeDone) {
        // success - we timed-out without handshake
        return;
    }

    fail("Re-negotiation worked");
}