利用mina框架进行ssl双向认证链接

再上一篇中我已将创建好了证书,现在开始进行测试创建的证书有没有用,先创建一个maven项目目录结构如下

我们这里是进行的双向测试,如果想进行单项测试,也就是服务器端不验证客户端的身份(关于ssl的原理可以自行百度了解)等会再说,改一个配置就行.
先引入pom文件:

<project xmlns="http://maven.apache.org/POM/4.0.0" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
    xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/maven-v4_0_0.xsd">
    <modelVersion>4.0.0modelVersion>
    <groupId>minaDemogroupId>
    <artifactId>minaDemoartifactId>
    <version>0.0.1-SNAPSHOTversion>



    
    <repositories>

        <repository>
            <id>officalid>
            <name>Maven Repository Switchboardname>
            <url>http://repo1.maven.org/maven2url>
            <snapshots>
                <enabled>falseenabled>
            snapshots>
        repository>

        <repository>
            <id>jbossid>
            <name>jboss repositoryname>
            <url>http://repository.jboss.com/maven2/url>
            <snapshots>
                <enabled>falseenabled>
            snapshots>
        repository>

        <repository>
            <id>openqa-releasesid>
            <name>Openqa Release Repositoryname>
            <url>http://nexus.openqa.org/content/repositories/releasesurl>
        repository>
    repositories>


    <dependencies>

        <dependency>
            <groupId>org.apache.minagroupId>
            <artifactId>mina-coreartifactId>
            <version>2.0.0-RC1version>
        dependency>
        <dependency>
            <groupId>org.apache.minagroupId>
            <artifactId>mina-integration-beansartifactId>
            <version>2.0.0-RC1version>
        dependency>

        <dependency>
            <groupId>org.slf4jgroupId>
            <artifactId>slf4j-log4j12artifactId>
            <version>1.5.2version>
        dependency>

        <dependency>
            <groupId>org.springframeworkgroupId>
            <artifactId>springartifactId>
            <version>2.5.6version>
        dependency>

        <dependency>
            <groupId>commons-langgroupId>
            <artifactId>commons-langartifactId>
            <version>2.4version>
        dependency>

    dependencies>

project>

1 开始搞服务端的配置
server端通过spring配置进行启动 所以先看配置吧 serverContext.xml

<beans>

  <bean class="org.springframework.beans.factory.config.CustomEditorConfigurer">
    <property name="customEditors">
      <map>
        <entry key="java.net.SocketAddress">
          <bean class="org.apache.mina.integration.beans.InetSocketAddressEditor" />
        entry>
      map>
    property>
  bean>

  
  <bean id="serverHandler" class="com.sundoctor.mina.example3.ssl.server.TLSServerHandler" />

  
  <bean id="keystoreFactory" class="org.apache.mina.filter.ssl.KeyStoreFactory">
    <property name="password" value="123456"/>
    <property name="dataUrl" value="classpath:com/sundoctor/mina/example3/ssl/server.jks"/>
  bean>
  <bean id="keyStore" factory-bean="keystoreFactory" factory-method="newInstance"/> 

  <bean id="truststoreFactory" class="org.apache.mina.filter.ssl.KeyStoreFactory">
    <property name="password" value="123456"/>
    <property name="dataUrl" value="classpath:com/sundoctor/mina/example3/ssl/server.jks"/>
  bean>
  <bean id="trustStore" factory-bean="truststoreFactory" factory-method="newInstance"/>  

  
  <bean id="sslContextFactory"  class="org.apache.mina.filter.ssl.SslContextFactory">
    <property name="protocol" value="TLS"/>    
    <property name="keyManagerFactoryAlgorithm" value="SunX509"/>
    <property name="keyManagerFactoryKeyStore"><ref local="keyStore"/>property>
    <property name="keyManagerFactoryKeyStorePassword" value="123456"/> 

    <property name="trustManagerFactoryAlgorithm" value="SunX509"/>
    <property name="trustManagerFactoryKeyStore"><ref local="trustStore"/>property>    
  bean>
  <bean id="sslContext" factory-bean="sslContextFactory" factory-method="newInstance"/>

  

  <bean id="executorFilter" class="org.apache.mina.filter.executor.ExecutorFilter"/>

  <bean id="mdcInjectionFilter" class="org.apache.mina.filter.logging.MdcInjectionFilter">
      <constructor-arg value="remoteAddress"/>
  bean>

  <bean id="codecFilter" class="org.apache.mina.filter.codec.ProtocolCodecFilter">
    <constructor-arg>
      <bean class="org.apache.mina.filter.codec.textline.TextLineCodecFactory" />
    constructor-arg>
  bean>

  <bean id="loggingFilter" class="org.apache.mina.filter.logging.LoggingFilter" />

  <bean id="sslFilter" class="org.apache.mina.filter.ssl.SslFilter">
    <constructor-arg ref="sslContext"/>
    
     <property name="useClientMode" value="false"/>
    
    <property name="needClientAuth" value="true"/>
    
    <property name="wantClientAuth" value="false"/>
  bean>


  
  <bean id="sslFilterChainBuilder" class="org.apache.mina.core.filterchain.DefaultIoFilterChainBuilder">
    <property name="filters">
      <map>
        <entry key="executor" value-ref="executorFilter"/>
        <entry key="mdcInjectionFilter" value-ref="mdcInjectionFilter"/>
        <entry key="sslFilter" value-ref="sslFilter"/>
        <entry key="codecFilter" value-ref="codecFilter"/>
        <entry key="loggingFilter" value-ref="loggingFilter"/>
      map>
    property>
  bean>

  
  <bean id="ioAcceptorWithSSL" class="org.apache.mina.transport.socket.nio.NioSocketAcceptor" init-method="bind" destroy-method="unbind">
    <property name="defaultLocalAddress" value="127.0.0.1:50003" />
    <property name="handler" ref="serverHandler" />
    <property name="reuseAddress" value="true" />
    <property name="filterChainBuilder" ref="sslFilterChainBuilder" />
  bean>
beans>

服务端启动代码:TLSServerSpring.java:

package com.sundoctor.mina.example3.ssl.server;

import org.slf4j.Logger;
import org.slf4j.LoggerFactory;
import org.springframework.context.support.ClassPathXmlApplicationContext;
import org.springframework.context.ConfigurableApplicationContext;

public class TLSServerSpring {

    private static final Logger logger = LoggerFactory.getLogger(TLSServerSpring.class);

    public static void main(String[] args) throws Exception {

        getApplicationContext();
        logger.debug("Listening ...");
    }

    public static ConfigurableApplicationContext getApplicationContext() {
        return new ClassPathXmlApplicationContext("com/sundoctor/mina/example3/ssl/server/serverContext.xml");
    }
}

然后就是服务端的具体业务处理类:TLSServerHandler.java 此类继承了IoHandlerAdapter 具体的业务逻辑写在这里面:

package com.sundoctor.mina.example3.ssl.server;

import org.apache.mina.core.service.IoHandlerAdapter;
import org.apache.mina.core.session.IdleStatus;
import org.apache.mina.core.session.IoSession;
import org.slf4j.Logger;
import org.slf4j.LoggerFactory;

public class TLSServerHandler extends IoHandlerAdapter {

    private static final Logger logger = LoggerFactory.getLogger(TLSServerHandler.class);

    public void sessionCreated(IoSession session) throws Exception {
        logger.debug("[NIO Server]>> sessionCreated");
    }

    public void sessionOpened(IoSession session) throws Exception {
        logger.debug("[NIO Server]>> sessionOpened");
         System.out.println("incoming client:"+session.getRemoteAddress());  

    }

    public void sessionClosed(IoSession session) throws Exception {
        logger.debug("[NIO Server]>> sessionClosed");
    }

    public void sessionIdle(IoSession session, IdleStatus status) throws Exception {
        logger.debug("[NIO Server]>> sessionIdle");
    }

    public void exceptionCaught(IoSession session, Throwable cause) throws Exception {
        logger.debug("[NIO Server]>> exceptionCaught :");
        cause.printStackTrace();
    }

    public void messageReceived(IoSession session, Object message) throws Exception {
        logger.debug("[NIO Server]>> messageReceived");
        logger.debug("[NIO Server Received]>> : {}", (String) message);
        session.write("安全链接已建立!证书验证通过，已经收到消息，over！");
    }

    public void messageSent(IoSession session, Object message) throws Exception {
        logger.debug("[NIO Server]>> messageSent");
        logger.debug("[NIO Server messageSent]>> : {}", (String) message);
    }
}

2 开始配置客户端:
clientContext.xml配置如下:

<beans>

   <bean id="clientHandler" class="com.sundoctor.mina.example3.ssl.client.TLSClientHandler" />  

  
  <bean id="keystoreFactory" class="org.apache.mina.filter.ssl.KeyStoreFactory">
    <property name="password" value="123456"/>
    <property name="dataUrl" value="classpath:com/sundoctor/mina/example3/ssl/client.jks"/>
  bean>
  <bean id="keyStore" factory-bean="keystoreFactory" factory-method="newInstance"/>  

  <bean id="truststoreFactory" class="org.apache.mina.filter.ssl.KeyStoreFactory">
    <property name="password" value="123456"/>
    <property name="dataUrl" value="classpath:com/sundoctor/mina/example3/ssl/client.jks"/>
  bean>
  <bean id="trustStore" factory-bean="truststoreFactory" factory-method="newInstance"/>  

  
  <bean id="sslContextFactory"  class="org.apache.mina.filter.ssl.SslContextFactory">
    <property name="protocol" value="TLS"/>    
    <property name="keyManagerFactoryAlgorithm" value="SunX509"/>
    <property name="keyManagerFactoryKeyStore"><ref local="keyStore"/>property>
    <property name="keyManagerFactoryKeyStorePassword" value="123456"/>    
    <property name="trustManagerFactoryAlgorithm" value="SunX509"/>
    <property name="trustManagerFactoryKeyStore"><ref local="trustStore"/>property>  
  bean>
  <bean id="sslContext" factory-bean="sslContextFactory" factory-method="newInstance"/>    

  
  <bean id="executorFilter" class="org.apache.mina.filter.executor.ExecutorFilter">
     <constructor-arg>
        <bean class="java.util.concurrent.Executors" factory-method="newCachedThreadPool"/> 
     constructor-arg>
  bean>  

  <bean id="mdcInjectionFilter" class="org.apache.mina.filter.logging.MdcInjectionFilter">
      <constructor-arg value="remoteAddress"/>
  bean>  

  <bean id="codecFilter" class="org.apache.mina.filter.codec.ProtocolCodecFilter">
    <constructor-arg>
      <bean class="org.apache.mina.filter.codec.textline.TextLineCodecFactory" />
    constructor-arg>
  bean>

  <bean id="loggingFilter" class="org.apache.mina.filter.logging.LoggingFilter" />

  <bean id="sslFilter" class="org.apache.mina.filter.ssl.SslFilter">
    <constructor-arg ref="sslContext"/>
    <-- 此项必须设置为true代表的客户端 -->
    <property name="useClientMode" value="true"/>
  bean>  

  
  <bean id="sslFilterChainBuilder" class="org.apache.mina.core.filterchain.DefaultIoFilterChainBuilder">
    <property name="filters">
      <map>
        <entry key="executor" value-ref="executorFilter"/>
        <entry key="mdcInjectionFilter" value-ref="mdcInjectionFilter"/>
        <entry key="sslFilter" value-ref="sslFilter"/>
        <entry key="codecFilter" value-ref="codecFilter"/>
        <entry key="loggingFilter" value-ref="loggingFilter"/>
      map>
    property>
  bean> 

  <bean id="ioConnectorWithSSL" class="org.apache.mina.transport.socket.nio.NioSocketConnector" scope="prototype" > 
    <property name="handler" ref="clientHandler" />  
    <property name="filterChainBuilder" ref="sslFilterChainBuilder" />
  bean> 

beans>

客户端业务处理类TLSClientHandler.java:

package com.sundoctor.mina.example3.ssl.client;

import org.apache.mina.core.service.IoHandlerAdapter;
import org.apache.mina.core.session.IdleStatus;
import org.apache.mina.core.session.IoSession;
import org.slf4j.Logger;
import org.slf4j.LoggerFactory;

public class TLSClientHandler extends IoHandlerAdapter {

    private static final Logger logger = LoggerFactory.getLogger(TLSClientHandler.class);

    public void sessionCreated(IoSession session) throws Exception {
        logger.debug("[NIO Client]>> sessionCreated");
    }

    public void sessionOpened(IoSession session) throws Exception {
        logger.debug("[NIO Client]>> sessionOpened");
    }

    public void sessionClosed(IoSession session) throws Exception {
        logger.debug("[NIO Client]>> sessionClosed");
    }

    public void sessionIdle(IoSession session, IdleStatus status) throws Exception {
        logger.debug("[NIO Client]>> sessionIdle");
    }

    public void exceptionCaught(IoSession session, Throwable cause) throws Exception {
        logger.debug("[NIO Client]>> exceptionCaught :");
        cause.printStackTrace();
    }

    public void messageReceived(IoSession session, Object message) throws Exception {
        logger.debug("[NIO Client]>> messageReceived");
        logger.debug("[NIO Client Received]>>{}", (String) message);
    }

    public void messageSent(IoSession session, Object message) throws Exception {
        logger.debug("[NIO Client]>> messageSent");
        logger.debug("[NIO Client messageSent]>> : {}", (String) message);
    }
}

然后就是客户端的启动代码TSLClientSpring.java:

package com.sundoctor.mina.example3.ssl.client;

import java.net.InetSocketAddress;
import java.nio.charset.Charset;

import org.apache.mina.core.future.ConnectFuture;
import org.apache.mina.core.session.IoSession;
import org.apache.mina.filter.codec.ProtocolCodecFilter;
import org.apache.mina.filter.codec.textline.TextLineCodecFactory;
import org.apache.mina.transport.socket.nio.NioSocketConnector;
import org.springframework.context.ApplicationContext;
import org.springframework.context.ConfigurableApplicationContext;
import org.springframework.context.support.ClassPathXmlApplicationContext;

public class TSLClientSpring {

    public static void main(String[] args) throws Exception {

        ApplicationContext context = getApplicationContext();
        NioSocketConnector ioConnectorWithSSL = (NioSocketConnector) context.getBean("ioConnectorWithSSL");

        // 创建连接
        ConnectFuture future = ioConnectorWithSSL.connect(new InetSocketAddress("192.168.2.125", 6008));
        // 等待连接创建完成
        future.awaitUninterruptibly();
        // 获取连接会话
        IoSession session = future.getSession();
        /*ioConnectorWithSSL.getFilterChain().addLast("codec",
                new ProtocolCodecFilter(new TextLineCodecFactory(Charset.forName("GBK"))));*/
        // 发送信息
        session.write("qqqq我是安全的吗?");
        // 等待连接断开
        session.getCloseFuture().awaitUninterruptibly();
        ioConnectorWithSSL.dispose();
    }

    public static ConfigurableApplicationContext getApplicationContext() {
        return new ClassPathXmlApplicationContext("com/sundoctor/mina/example3/ssl/client/clientContext.xml");
    }
}

注意看第一张我的截图,我的server.jks与client.jks放置的位置,可以看配置里面,配的有路径,这时候启动服务端,会出现这样的画面:

然后启动客户端去链接:

此时看到客户端发出去了一段话,这段话是我在客户端的启动类中写上去的,然后收到了一段话,这段话是服务端发来的.
我们可以看服务端是不是发了,点击切换按钮,就是右上那个我画圈的地方:

对吧,服务端发的,客户端收到了,客户端发的 服务端也受到了,那就是认证成功了呗,如果你把这两份jks换成不同的ca认证,那么就会报错握手失败也就是认证失败了