netty整合ssl实现双向加密通信

水深无声 2023-10-12 14:18 19阅读 0赞

本期我们使用JDK自带的keytool.exe工具生成以jks为后缀的java密钥库文件。（关于证书和秘钥的学习不了解的话还请先百度学习）

生成服务端密钥

keytool -genkey -keystore server_ks.jks -storepass server_password -keyalg RSA -keypass server_password

生成服务端证书

keytool -export -keystore server_ks.jks -storepass server_password -file server.cer

生成客户端密钥

keytool -genkey -keystore client_ks.jks -storepass client_password -keyalg RSA -keypass client_password

生成客户端证书

keytool -export -keystore client_ks.jks -storepass client_password -file client.cer

将server端证书添加到serverTrust\_ks.jks文件中

keytool -import -keystore serverTrust_ks.jks -storepass client -file server.cer

将client端证书添加到clientTrust\_ks.jks文件中

keytool -import -keystore clientTrust_ks.jks -storepass server -file client.cer

综上所述，通俗的说，其加密通信的本质是证书之间校验的通讯（既服务器端需要保存客户端的证书，客户端需要保存服务器端的证书。当客服端需要向服务器端发送数据时，需要携带服务器端的证书才能实现通信）

下面是使用netty来做客户端与服务器端通信的demo

导入netty依赖

<dependencies>
            <dependency>
                <groupId>org.springframework</groupId>
                <artifactId>spring-beans</artifactId>
            </dependency>
            <dependency>
                <groupId>com.alibaba</groupId>
                <artifactId>fastjson</artifactId>
                <version>1.2.79</version>
            </dependency>
            <dependency>
                <groupId>org.projectlombok</groupId>
                <artifactId>lombok</artifactId>
                <version>1.18.22</version>
                <scope>provided</scope>
            </dependency>
            <dependency>
                <groupId>org.slf4j</groupId>
                <artifactId>slf4j-api</artifactId>
                <version>1.7.25</version>
            </dependency>
            <dependency>
                <groupId>ch.qos.logback</groupId>
                <artifactId>logback-classic</artifactId>
                <version>1.2.3</version>
            </dependency>
            <dependency>
                <groupId>io.netty</groupId>
                <artifactId>netty-all</artifactId>
                <version>4.1.66.Final</version>
            </dependency>
            
            <dependency>
                <groupId>com.google.protobuf</groupId>
                <artifactId>protobuf-java</artifactId>
                <version>3.14.0</version>
            </dependency>
            <dependency>
                <groupId>com.dyuproject.protostuff</groupId>
                <artifactId>protostuff-api</artifactId>
                <version>1.1.6</version>
            </dependency>
            <dependency>
                <groupId>com.dyuproject.protostuff</groupId>
                <artifactId>protostuff-core</artifactId>
                <version>1.1.6</version>
            </dependency>
            <dependency>
                <groupId>com.dyuproject.protostuff</groupId>
                <artifactId>protostuff-runtime</artifactId>
                <version>1.1.6</version>
            </dependency>
        </dependencies>

核心方法createSSLContext

public static SSLContext createSSLContext(String keyStorePath, String keyStorePass, String trustStorePath, String trustStorePass)  {
            SSLContext sslContext = null;
            try{
                KeyStore keyStore = KeyStore.getInstance("JKS");
                try (InputStream keyStoreInput = new FileInputStream(keyStorePath)) {
                    keyStore.load(keyStoreInput, keyStorePass.toCharArray());
                }
    
                KeyManagerFactory keyManagerFactory = KeyManagerFactory.getInstance(KeyManagerFactory.getDefaultAlgorithm());
                keyManagerFactory.init(keyStore, keyStorePass.toCharArray());
    
                KeyStore trustStore = KeyStore.getInstance("JKS");
                try (InputStream trustStoreInput = new FileInputStream(trustStorePath)) {
                    trustStore.load(trustStoreInput, trustStorePass.toCharArray());
                }
    
                TrustManagerFactory trustManagerFactory = TrustManagerFactory.getInstance(TrustManagerFactory.getDefaultAlgorithm());
                trustManagerFactory.init(trustStore);
    
                sslContext = SSLContext.getInstance("TLS");
                sslContext.init(keyManagerFactory.getKeyManagers(), trustManagerFactory.getTrustManagers(), null);
            }catch (Exception e){
                throw new RuntimeException();
            }
            return sslContext;
        }

keyStorePath：存放server_ks.jks/client_ks.jks的路径

keyStorePass：server_ks.jks/client_ks.jks设置的密码

trustStorePath：存放clientTrust_ks.jks/serverTrust_ks.jks的路径

trustStorePass：clientTrust_ks.jks/serverTrust_ks.jks设置的密码

服务器端代码

import io.netty.bootstrap.ServerBootstrap;
    import io.netty.channel.*;
    import io.netty.channel.nio.NioEventLoopGroup;
    import io.netty.channel.socket.SocketChannel;
    import io.netty.channel.socket.nio.NioServerSocketChannel;
    import io.netty.handler.ssl.SslHandler;
    import io.netty.handler.timeout.IdleStateHandler;
    import lombok.NonNull;
    import lombok.RequiredArgsConstructor;
    import lombok.extern.slf4j.Slf4j;
    import org.springframework.beans.factory.annotation.Value;
    import javax.annotation.PreDestroy;
    import javax.net.ssl.KeyManagerFactory;
    import javax.net.ssl.SSLContext;
    import javax.net.ssl.SSLEngine;
    import javax.net.ssl.TrustManagerFactory;
    import java.io.FileInputStream;
    import java.io.InputStream;
    import java.security.*;
    import java.util.concurrent.TimeUnit;
    
    
    @Slf4j
    @RequiredArgsConstructor()
    public class DeviceNettyServer extends Thread{
        @Value("${custom.keyStore.path}")
        private String keyStorePath;
        @Value("${custom.trustStore.path}")
        private String trustStorePath;
        @Value("${custom.keyStore.password}")
        private String keyStorePass;
        @Value("${custom.trustStore.password}")
        private String trustStorePass;
        private ServerBootstrap serverBootstrap;
        private EventLoopGroup boosGroup;
        private EventLoopGroup workerGroup;
        @NonNull
        private int port;
    
    //    @PostConstruct
        public void init() {
            //一个线程组处理连接，10个线程组处理客户端业务
            boosGroup = new NioEventLoopGroup(1);
            workerGroup = new NioEventLoopGroup(10);
            serverBootstrap = new ServerBootstrap();
            serverBootstrap.group(boosGroup, workerGroup);
            serverBootstrap.channel(NioServerSocketChannel.class);
            serverBootstrap.option(ChannelOption.SO_BACKLOG, 128);
            serverBootstrap.childOption(ChannelOption.SO_KEEPALIVE, true);
            serverBootstrap.childHandler(new ChannelInitializer<SocketChannel>() {
                @Override
                protected void initChannel(SocketChannel ch) {
                    SSLContext sslContext = DeviceNettyServer.createSSLContext(keyStorePath,keyStorePass,trustStorePath,trustStorePass);
                    SSLEngine engine = sslContext.createSSLEngine();
                    engine.setUseClientMode(false);
                    engine.setNeedClientAuth(true);
                    ch.pipeline().addLast(new SslHandler(engine));
                    //rpc请求处理---定义你自己的处理器
                    ch.pipeline().addLast(new RpcServerHandler());
                }
            });
            log.debug("初始化DeviceNettyServer");
        }
    
        /**
         * 启动服务
         *
         **/
        @Override
        public void run() {
            try {
                ChannelFuture future = serverBootstrap.bind(port).sync();
                log.debug("启动服务:{}", port);
                future.channel().closeFuture().sync();
            } catch (InterruptedException e) {
                e.printStackTrace();
                log.error("", e);
            }
        }
    
        /**
         * 释放线程池
         **/
        @PreDestroy
        public void destroy() {
            try {
                boosGroup.shutdownGracefully().sync();
                workerGroup.shutdownGracefully().sync();
            } catch (InterruptedException e) {
                e.printStackTrace();
            }
            log.debug("释放线程池资源");
        }
    
        public static SSLContext createSSLContext(String keyStorePath, String keyStorePass, String trustStorePath, String trustStorePass)  {
            SSLContext sslContext = null;
            try{
                KeyStore keyStore = KeyStore.getInstance("JKS");
                try (InputStream keyStoreInput = new FileInputStream(keyStorePath)) {
                    keyStore.load(keyStoreInput, keyStorePass.toCharArray());
                }
    
                KeyManagerFactory keyManagerFactory = KeyManagerFactory.getInstance(KeyManagerFactory.getDefaultAlgorithm());
                keyManagerFactory.init(keyStore, keyStorePass.toCharArray());
    
                KeyStore trustStore = KeyStore.getInstance("JKS");
                try (InputStream trustStoreInput = new FileInputStream(trustStorePath)) {
                    trustStore.load(trustStoreInput, trustStorePass.toCharArray());
                }
    
                TrustManagerFactory trustManagerFactory = TrustManagerFactory.getInstance(TrustManagerFactory.getDefaultAlgorithm());
                trustManagerFactory.init(trustStore);
    
                sslContext = SSLContext.getInstance("TLS");
                sslContext.init(keyManagerFactory.getKeyManagers(), trustManagerFactory.getTrustManagers(), null);
            }catch (Exception e){
                throw new RuntimeException();
            }
            return sslContext;
        }
    }

主方法

@SpringBootApplication
    public class nettyServer{
        public static void main(String[] args){
            SpringApplication.run(nettyServer.class,args);
        }
    }

然后编写一个springboot启动方法运行netty

/**
     * 启动nettyServer
     */
    @Component
    @Slf4j
    public class InitializeApplicationRunner implements ApplicationRunner {
    
        @Value("${custom.socket.port}")
        private Integer socketPort;
    
        @Autowired
        private DeviceNettyServer deviceNettyServer;
    
        @Bean(initMethod = "init", destroyMethod = "destroy")
        DeviceNettyServer deviceNettyServer() {
            DeviceNettyServer deviceNettyServer = new DeviceNettyServer(socketPort);
            return deviceNettyServer;
        }
    
        @Override
        public void run(ApplicationArguments args) {
            deviceNettyServer.start();
            log.info("启动nettyServer服务端完成");
        }
    }

客户端代码：

import io.netty.bootstrap.Bootstrap;
    import io.netty.channel.Channel;
    import io.netty.channel.ChannelFuture;
    import io.netty.channel.ChannelInitializer;
    import io.netty.channel.EventLoopGroup;
    import io.netty.channel.nio.NioEventLoopGroup;
    import io.netty.channel.socket.SocketChannel;
    import io.netty.channel.socket.nio.NioSocketChannel;
    import io.netty.handler.ssl.SslContext;
    import io.netty.handler.ssl.SslHandler;
    import io.netty.handler.timeout.IdleStateHandler;
    import lombok.extern.slf4j.Slf4j;
    import javax.net.ssl.KeyManagerFactory;
    import javax.net.ssl.SSLContext;
    import javax.net.ssl.SSLEngine;
    import javax.net.ssl.TrustManagerFactory;
    import java.io.FileInputStream;
    import java.io.InputStream;
    import java.net.ConnectException;
    import java.nio.channels.ClosedChannelException;
    import java.security.KeyStore;
    import java.util.concurrent.TimeUnit;
    
    @Slf4j
    public class DeviceNettyClient {
        private EventLoopGroup group;
        private Bootstrap bootstrap;
        private volatile Channel clientChannel;
        public void init() {
            //生成的client_ks.jks路径
            String keyStorePath = "";
            //生成的client_ks.jks密码
            String keyStorePass = "";
            //生成的serverTrust_ks.jks路径
            String trustStorePath = "";
            //生成的serverTrust_ks.jks密码
            String trustStorePass = "";
            group = new NioEventLoopGroup();
            bootstrap = new Bootstrap();
            bootstrap.group(group)
                    .channel(NioSocketChannel.class)
                    .handler(new ChannelInitializer<SocketChannel>() {
                        @Override
                        protected void initChannel(SocketChannel ch) {
                            SSLContext sslContext = DeviceNettyClient.createSSLContext(keyStorePath,keyStorePass,trustStorePath,trustStorePass);
                            SSLEngine engine = sslContext.createSSLEngine();
                            engine.setUseClientMode(true);
                            ch.pipeline().addLast(new SslHandler(engine));
                            //rpc请求处理-----定义你自己的处理器
                            ch.pipeline().addLast(new RpcClientHandler());
                        }
                    });
    
        }
    
        public void run(RpcAddress rpcAddress) {
            init();
            try {
                ChannelFuture cf = bootstrap.connect(rpcAddress.getHost(), rpcAddress.getPort());
                boolean notTimeout = cf.awaitUninterruptibly(20, TimeUnit.SECONDS);
                clientChannel = cf.channel();
                if (notTimeout){
                    if (clientChannel != null && clientChannel.isActive()){
                        log.info("客户端重新连接成功！！！ {} ，已经同服务端建立连接。。。", clientChannel.localAddress());
                        cf.channel().closeFuture().sync();
                    }else{
                        Throwable cause = cf.cause();
                        if (cause != null) {
                            exceptionHandler(cause);
                        }
                    }
                }
            } catch (InterruptedException e) {
                e.printStackTrace();
            }finally {
                destroy();
            }
    
        }
    
        private void exceptionHandler(Throwable cause) {
            if (cause instanceof ConnectException) {
                log.error("连接异常:{}", cause.getMessage());
            } else if (cause instanceof ClosedChannelException) {
                log.error("connect error:{}", "client has destroy");
            } else {
                log.error("connect error:", cause);
            }
        }
    
        public void destroy() {
            log.debug("线程池连接资源释放");
            try {
                group.shutdownGracefully().sync();
            } catch (InterruptedException e) {
                e.printStackTrace();
                log.error("", e);
            }
        }
    
        public static SSLContext createSSLContext(String keyStorePath, String keyStorePass, String trustStorePath, String trustStorePass)  {
            SSLContext sslContext = null;
            try{
                KeyStore keyStore = KeyStore.getInstance("JKS");
                try (InputStream keyStoreInput = new FileInputStream(keyStorePath)) {
                    keyStore.load(keyStoreInput, keyStorePass.toCharArray());
                }
    
                KeyManagerFactory keyManagerFactory = KeyManagerFactory.getInstance(KeyManagerFactory.getDefaultAlgorithm());
                keyManagerFactory.init(keyStore, keyStorePass.toCharArray());
    
                KeyStore trustStore = KeyStore.getInstance("JKS");
                try (InputStream trustStoreInput = new FileInputStream(trustStorePath)) {
                    trustStore.load(trustStoreInput, trustStorePass.toCharArray());
                }
    
                TrustManagerFactory trustManagerFactory = TrustManagerFactory.getInstance(TrustManagerFactory.getDefaultAlgorithm());
                trustManagerFactory.init(trustStore);
    
                sslContext = SSLContext.getInstance("TLS");
                sslContext.init(keyManagerFactory.getKeyManagers(), trustManagerFactory.getTrustManagers(), null);
            }catch (Exception e){
                throw new RuntimeException();
            }
            return sslContext;
        }
    }

实体类

@Data
    @NoArgsConstructor
    @AllArgsConstructor
    @EqualsAndHashCode
    public class RpcAddress {
        private String host;
        private Integer port;
    }

主程序

public class ClientApplication {
        public static void main(String[] args) {
            RpcAddress rpcAddress = new RpcAddress();
            //输入服务器的IP
            rpcAddress.setHost("");
            //绑定端口号
            rpcAddress.setPort();
            DeviceNettyClient deviceNettyClient = new DeviceNettyClient();
            deviceNettyClient.run(rpcAddress);
        }
    }

这样 ， 就可以实现基于netty整合ssl通信了。