RMI, RMI over SSL, RMI-IIOP, RMI-IIOP over SSL
Index:
分布式系统（比如W/S应用）要求应用能够跨网络通信，应需而生了各种方法。
a) 最基础的当然是Socket，Server创建一个ServerSocket在某个Port上监听，Client应用通过指定Server Host和Port创建ClientSocket与Server端建立通信，达到远程通信、传送数据的目的。Socket通信没有应用层支持，要求Client和Server自己定义通信的协议（或者说规则更好理解）来编/解码通信内容，确保双方能够理解对方在说什么。
b) 为便利应用层程序开发对Socket通信进行封装就出现了
远程过程调用RPC（Remote Procedure Call），程序员不用再去解析从Socket来的字节流，只需要传递参数调用远程函数接口，就像调用本地函数一样，同样能得到想要的返回值。由RPC系统负责参数和返回值的序列化和网络传输，但底层通信原理应该还是Socket。RPC是基于C的，也就是结构化程序设计的，所以是调用远程服务器export出来的函数接口。
c) 对Java来说就是远程方法调用RMI（Remote Method Invocation），虽然叫方法调用但我们知道Java是面向对象的，所以RMI也是面向对象的。通过RMI，Client应用可以拿到远程对象的引用（Stub），通过这个引用调用远程对象的方法，并且可以通过这些方法返回其他远程对象的引用，从而Java世界的远程通信变得异常容易。当然，RMI的通信基础也是Socket，只是由RMI系统封装了作为参数和返回值的对象的序列化，也封装了连接建立的过程。
d) 以上abc都是对程序员说的，对用户来说网络都是被应用封装的，用户感知的应该是功能和业务。上午刚听了个云计算的Session，个人觉得这个对用户影响不大，不管服务来自一个Server还是一朵云，用户是不知道的也不需要关心。对应用层程序员来说好像影响也不大，对IT运维的兄弟们估计有不小影响吧。
Q：远程对象的引用，也就是所谓的Stub是可以传递的吗？
A：是的，Stub中包含有建立连接和呼叫所需的所有信息（Server的hostname/IP，port），可以把Stub传给其他Client（文件等方式），其他Client获得引用后同样可以发起Romote Method Call
Q：Client如何拿到远程对象的引用？
A：可以想象网络中应该有一个Client和Server都知道的注册中心（Registry），Server将远程对象（Remote Object）在Registry注册，即与某个表示“名字”的字符串绑定，而Client就按“名字”在Registry中查找并获得远程对象的引用，感觉来讲就是一个Naming Service。Java自带的注册服务器叫rmiregistry。
注意：RMI Registry只允许本地的Java App绑定对象，换句话说不允许远程注册到RMI Registry。但聪明的人早就找到了work-around，可以向Registry注册一个服务对象，提供一个Remote方法，比如叫proxyBind，接受远程对象的引用(Stub)做参数，功能是绑定这个Stub到本地Registry。这样远程App就可以调用这个接口来绑定想绑定的对象了。
e.g.
a) 定义远程接口。远程对象的类必须直接或间接实现至少一个远程接口。
|
//接口2
package net.gy.java.rmi;
import java.rmi.AlreadyBoundException;
import java.rmi.Remote;
import java.rmi.RemoteException;
public
interface ProxyBinderInterface
extends Remote {
public
void proxyBind(String label, Remote stub)
throws RemoteException, AlreadyBoundException;
}
b) 实现远程接口、构造远程对象、启动Registry、在Registry中注册远程对象
package net.gy.java.rmi;
import java.rmi.AlreadyBoundException;
import java.rmi.Remote;
import java.rmi.RemoteException;
import java.rmi.registry.LocateRegistry;
import java.rmi.registry.Registry;
import java.rmi.server.UnicastRemoteObject;
//实现远程接口 -- 远程对象类1
public
class RMIServer
implements RMIRemoteInterface {
public
static
final String PROXY_BINDER
=
"PROXY_BINDER";
public
static
final String HOST
=
"solaris330";
public
static
final
int RMI_PORT
=
2222;
public RMIServer() {}
@Override
public String sayHi() {
return
"Hello World!";
}
@Override
public String sayHello(String str)
throws RemoteException {
return
"Hi "
+ str;
}
public
static
void main(String args[]) {
try {
int port
= (args.length
<
1)
? RMI_PORT
: Integer.valueOf(args[
0]);
RMIServer obj
=
new RMIServer();
RMIRemoteInterface stub
= (RMIRemoteInterface) UnicastRemoteObject
.exportObject(obj,
0);
// Bind the remote object's stub in the registry
// RMI registry not allow remote hosts to bind
// Registry registry = LocateRegistry.getRegistry(HOST, port);
/*
*启动Registry，也可以命令行启动Java自带的rmiregistry，默认端口是1099
*可以在启动时指定端口，e.g. rmiregistry 2222&
*/
Registry registry
= LocateRegistry.createRegistry(port);
registry.bind(
"newHello", stub);
// 继承UnicastRemoteObject的远程对象可以直接绑定，不用显式生成stub;
registry.bind(PROXY_BINDER, obj.
new ProxyBinder());
System.err.println(
"Server ready");
}
catch (Exception e) {
System.err.println(
"Server exception: "
+ e.toString());
e.printStackTrace();
}
}
//实现远程接口 -- 远程对象类2
class ProxyBinder
extends UnicastRemoteObject
implements ProxyBinderInterface {
private
static
final
long serialVersionUID
=
-
2373753944757892323L;
protected ProxyBinder()
throws RemoteException {
super();
}
/**
*注册远程对象到本地Registry
*/
@Override
public
void proxyBind(String label, Remote stub)
throws RemoteException, AlreadyBoundException{
Registry registry
= LocateRegistry.getRegistry(HOST, RMI_PORT);
registry.bind(label, stub);
}
}
}
//另一个Server实现，RMI调用远程对象ProxyBinder的方法注册远程对象到Registry
package net.gy.java.rmi;
import java.rmi.RemoteException;
import java.rmi.registry.LocateRegistry;
import java.rmi.registry.Registry;
import java.rmi.server.UnicastRemoteObject;
public
class RemoteRMIServer
implements RMIRemoteInterface {
public
static
final String HOST
=
"solaris330";
public
static
final
int RMI_PORT
=
2222;
public RemoteRMIServer() {}
@Override
public String sayHi() {
return
"Hello World!";
}
@Override
public String sayHello(String str)
throws RemoteException {
return
"Hi "
+ str;
}
public
static
void main(String args[]) {
try {
int port
= (args.length
<
1)
? RMI_PORT
: Integer.valueOf(args[
0]);
RemoteRMIServer obj
=
new RemoteRMIServer();
RMIRemoteInterface stub
= (RMIRemoteInterface) UnicastRemoteObject
.exportObject(obj,
0);
//找到Registry，并从中查找得到ProxyBinder的引用
Registry registry
= LocateRegistry.getRegistry(HOST, port);
ProxyBinderInterface proxyBinder
= (ProxyBinderInterface)registry.lookup(RMIServer.PROXY_BINDER);
//通过ProxyBinder注册stub到远程Registry
proxyBinder.proxyBind(
"remoteServer", stub);
System.err.println(
"Remote Server ready");
}
catch (Exception e) {
System.err.println(
"Server exception: "
+ e.toString());
e.printStackTrace();
}
}
}
c)Client端应用
package net.gy.java.rmi;
import java.io.FileInputStream;
import java.io.FileOutputStream;
import java.io.ObjectInputStream;
import java.io.ObjectOutputStream;
import java.rmi.registry.LocateRegistry;
import java.rmi.registry.Registry;
public
class RMIClient {
public
static
void main(String[] args) {
if (args.length
<
1) {
System.err.println(
"Usage: RMIClient [port]");
System.exit(
1);
}
String host
= args[
0];
int port
= RMIServer.RMI_PORT;
if (args.length
==
2) {
port
= Integer.valueOf(args[
1]);
}
try {
Registry registry
= LocateRegistry.getRegistry(host, port);
RMIRemoteInterface stub
= (RMIRemoteInterface) registry.lookup(
"remoteServer");
FileOutputStream fos
=
new FileOutputStream(
"c:\\t.tmp");
ObjectOutputStream oos
=
new ObjectOutputStream(fos);
oos.writeObject(stub);
oos.close();
String response
= stub.sayHi();
System.out.println(
"sayHi: "
+ response);
System.out.println(
"sayHello: "
+ stub.sayHello(
"Java world"));
}
catch (Exception e) {
System.err.println(
"Client exception: "
+ e.toString());
e.printStackTrace();
}
}
public
static
void main2(String[] args) {
try {
FileInputStream fis
=
new FileInputStream(
"c:\\t.tmp");
ObjectInputStream ois
=
new ObjectInputStream(fis);
RMIRemoteInterface stub
= (RMIRemoteInterface) ois.readObject();
String response
= stub.sayHi();
System.out.println(
"response: "
+ response);
}
catch(Exception e) {
System.err.println(
"Client exception: "
+ e.toString());
e.printStackTrace();
}
}
}
有两种情形需要考虑，一是从Registry查询获得Stub的过程需要Secured by SSL，另外就是拿到Stub后通过Stub进行远程方法调用时需要SSL。本质上这两种情形的需求是一样的，就是把原来的Socket编程Secure Socket。
接口：
LocateRegistry:
UnicastRemoteObject:
RMISocketFactory:
setSocketFactory
(
RMISocketFactory
fac)
java.rmi.server.RMIServerSocketFactory
java.rmi.server.RMIClientSocketFactory
注意：client socket factory的实现必须同时实现java.io.Serializable接口，这样这个socket factory才能被序列化并包含到Stub中
e.g.
package net.gy.java.rmi.ssl;
import java.io.IOException;
import java.net.ServerSocket;
import java.rmi.server.RMIServerSocketFactory;
import java.security.KeyManagementException;
import java.security.KeyStore;
import java.security.KeyStoreException;
import java.security.NoSuchAlgorithmException;
import java.security.UnrecoverableKeyException;
import java.security.cert.CertificateException;
import javax.net.ssl.KeyManagerFactory;
import javax.net.ssl.SSLContext;
import javax.net.ssl.SSLServerSocketFactory;
public
class MySSLRMIServerSocketFactory
implements RMIServerSocketFactory {
private SSLServerSocketFactory sf
= null;
public MySSLRMIServerSocketFactory() {
try {
sf
= getSSLServerSocketFactory();
}
catch (UnrecoverableKeyException e) {
// TODO Auto-generated catch block
e.printStackTrace();
}
catch (KeyManagementException e) {
// TODO Auto-generated catch block
e.printStackTrace();
}
catch (KeyStoreException e) {
// TODO Auto-generated catch block
e.printStackTrace();
}
catch (NoSuchAlgorithmException e) {
// TODO Auto-generated catch block
e.printStackTrace();
}
catch (CertificateException e) {
// TODO Auto-generated catch block
e.printStackTrace();
}
catch (IOException e) {
// TODO Auto-generated catch block
e.printStackTrace();
}
}
@Override
public ServerSocket createServerSocket(
int port)
throws IOException {
// TODO Auto-generated method stub
ServerSocket ss
= sf.createServerSocket(port);
return ss;
}
private SSLServerSocketFactory getSSLServerSocketFactory()
throws UnrecoverableKeyException, KeyStoreException,
NoSuchAlgorithmException, CertificateException, IOException,
KeyManagementException {
SSLServerSocketFactory ssf
= null;
KeyStore ks
= KeyStore.getInstance(
"JKS");
String keystoreFileName
=
"keystore4test";
String passwd
=
"xxxxxx";
ks.load(
this.getClass().getResourceAsStream(keystoreFileName),
passwd.toCharArray());
KeyManagerFactory kmf
= KeyManagerFactory.getInstance(
"SunX509");
kmf.init(ks, passwd.toCharArray());
SSLContext sslContext
= SSLContext.getInstance(
"TLS");
sslContext.init(kmf.getKeyManagers(), null, null);
ssf
= sslContext.getServerSocketFactory();
return ssf;
}
}
|
|
|
Wireshark检验SSL效果：
Pure RMI Senario:
RMI Over SSL Senario:
MISC:
debug ssl java programs by specifying argument: javax.net.debug=ssl
e.g. java -cp RMITest.jar -Djavax.net.debug=ssl net.gy.java.rmi.RMIServer