Copied SSLSocketFactory from the HttpCore module
git-svn-id: https://svn.apache.org/repos/asf/jakarta/httpcomponents/trunk/http-client@358347 13f79535-47bb-0310-9956-ffa450edef68
This commit is contained in:
Oleg Kalnichevski
parent
03f4fd7d85
commit
d5076feb53
|
|
@ -0,0 +1,285 @@
|
|||
/*
|
||||
* $HeadURL$
|
||||
* $Revision$
|
||||
* $Date$
|
||||
*
|
||||
* ====================================================================
|
||||
*
|
||||
* Copyright 2002-2004 The Apache Software Foundation
|
||||
*
|
||||
* Licensed under the Apache License, Version 2.0 (the "License");
|
||||
* you may not use this file except in compliance with the License.
|
||||
* You may obtain a copy of the License at
|
||||
*
|
||||
* http://www.apache.org/licenses/LICENSE-2.0
|
||||
*
|
||||
* Unless required by applicable law or agreed to in writing, software
|
||||
* distributed under the License is distributed on an "AS IS" BASIS,
|
||||
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
||||
* See the License for the specific language governing permissions and
|
||||
* limitations under the License.
|
||||
* ====================================================================
|
||||
*
|
||||
* This software consists of voluntary contributions made by many
|
||||
* individuals on behalf of the Apache Software Foundation. For more
|
||||
* information on the Apache Software Foundation, please see
|
||||
* <http://www.apache.org/>.
|
||||
*
|
||||
*/
|
||||
|
||||
package org.apache.http.impl.io;
|
||||
|
||||
import java.io.IOException;
|
||||
import java.net.InetAddress;
|
||||
import java.net.InetSocketAddress;
|
||||
import java.net.Socket;
|
||||
import java.net.UnknownHostException;
|
||||
import java.security.KeyManagementException;
|
||||
import java.security.KeyStore;
|
||||
import java.security.KeyStoreException;
|
||||
import java.security.NoSuchAlgorithmException;
|
||||
import java.security.SecureRandom;
|
||||
import java.security.UnrecoverableKeyException;
|
||||
|
||||
import javax.net.SocketFactory;
|
||||
import javax.net.ssl.KeyManager;
|
||||
import javax.net.ssl.KeyManagerFactory;
|
||||
import javax.net.ssl.SSLContext;
|
||||
import javax.net.ssl.TrustManager;
|
||||
import javax.net.ssl.TrustManagerFactory;
|
||||
|
||||
import org.apache.http.ConnectTimeoutException;
|
||||
import org.apache.http.io.SecureSocketFactory;
|
||||
import org.apache.http.params.HttpConnectionParams;
|
||||
import org.apache.http.params.HttpParams;
|
||||
|
||||
/**
|
||||
* <p>
|
||||
* SSLProtocolSocketFactory can be used to validate the identity of the HTTPS
|
||||
* server against a list of trusted certificates and to authenticate to the HTTPS
|
||||
* server using a private key.
|
||||
* </p>
|
||||
*
|
||||
* <p>
|
||||
* SSLProtocolSocketFactory will enable server authentication when supplied with
|
||||
* a {@link KeyStore truststore} file containg one or several trusted certificates.
|
||||
* The client secure socket will reject the connection during the SSL session handshake
|
||||
* if the target HTTPS server attempts to authenticate itself with a non-trusted
|
||||
* certificate.
|
||||
* </p>
|
||||
*
|
||||
* <p>
|
||||
* Use JDK keytool utility to import a trusted certificate and generate a truststore file:
|
||||
* <pre>
|
||||
* keytool -import -alias "my server cert" -file server.crt -keystore my.truststore
|
||||
* </pre>
|
||||
* </p>
|
||||
*
|
||||
* <p>
|
||||
* SSLProtocolSocketFactory will enable client authentication when supplied with
|
||||
* a {@link KeyStore keystore} file containg a private key/public certificate pair.
|
||||
* The client secure socket will use the private key to authenticate itself to the target
|
||||
* HTTPS server during the SSL session handshake if requested to do so by the server.
|
||||
* The target HTTPS server will in its turn verify the certificate presented by the client
|
||||
* in order to establish client's authenticity
|
||||
* </p>
|
||||
*
|
||||
* <p>
|
||||
* Use the following sequence of actions to generate a keystore file
|
||||
* </p>
|
||||
* <ul>
|
||||
* <li>
|
||||
* <p>
|
||||
* Use JDK keytool utility to generate a new key
|
||||
* <pre>keytool -genkey -v -alias "my client key" -validity 365 -keystore my.keystore</pre>
|
||||
* For simplicity use the same password for the key as that of the keystore
|
||||
* </p>
|
||||
* </li>
|
||||
* <li>
|
||||
* <p>
|
||||
* Issue a certificate signing request (CSR)
|
||||
* <pre>keytool -certreq -alias "my client key" -file mycertreq.csr -keystore my.keystore</pre>
|
||||
* </p>
|
||||
* </li>
|
||||
* <li>
|
||||
* <p>
|
||||
* Send the certificate request to the trusted Certificate Authority for signature.
|
||||
* One may choose to act as her own CA and sign the certificate request using a PKI
|
||||
* tool, such as OpenSSL.
|
||||
* </p>
|
||||
* </li>
|
||||
* <li>
|
||||
* <p>
|
||||
* Import the trusted CA root certificate
|
||||
* <pre>keytool -import -alias "my trusted ca" -file caroot.crt -keystore my.keystore</pre>
|
||||
* </p>
|
||||
* </li>
|
||||
* <li>
|
||||
* <p>
|
||||
* Import the PKCS#7 file containg the complete certificate chain
|
||||
* <pre>keytool -import -alias "my client key" -file mycert.p7 -keystore my.keystore</pre>
|
||||
* </p>
|
||||
* </li>
|
||||
* <li>
|
||||
* <p>
|
||||
* Verify the content the resultant keystore file
|
||||
* <pre>keytool -list -v -keystore my.keystore</pre>
|
||||
* </p>
|
||||
* </li>
|
||||
* </ul>
|
||||
* @author <a href="mailto:oleg at ural.ru">Oleg Kalnichevski</a>
|
||||
*/
|
||||
|
||||
public class SSLSocketFactory implements SecureSocketFactory {
|
||||
|
||||
public static final String TLS = "TLS";
|
||||
public static final String SSL = "SSL";
|
||||
public static final String SSLV2 = "SSLv2";
|
||||
|
||||
/**
|
||||
* The factory singleton.
|
||||
*/
|
||||
private static final SSLSocketFactory DEFAULT_FACTORY = new SSLSocketFactory();
|
||||
|
||||
/**
|
||||
* Gets an singleton instance of the SSLProtocolSocketFactory.
|
||||
* @return a SSLProtocolSocketFactory
|
||||
*/
|
||||
public static SSLSocketFactory getSocketFactory() {
|
||||
return DEFAULT_FACTORY;
|
||||
}
|
||||
|
||||
private final SSLContext sslcontext;
|
||||
private final SocketFactory socketfactory;
|
||||
|
||||
public SSLSocketFactory(
|
||||
String algorithm,
|
||||
final KeyStore keystore,
|
||||
final String keystorePassword,
|
||||
final KeyStore truststore,
|
||||
final SecureRandom random)
|
||||
throws NoSuchAlgorithmException, KeyManagementException, KeyStoreException, UnrecoverableKeyException
|
||||
{
|
||||
super();
|
||||
if (algorithm == null) {
|
||||
algorithm = TLS;
|
||||
}
|
||||
KeyManager[] keymanagers = null;
|
||||
if (keystore != null) {
|
||||
keymanagers = createKeyManagers(keystore, keystorePassword);
|
||||
}
|
||||
TrustManager[] trustmanagers = null;
|
||||
if (truststore != null) {
|
||||
trustmanagers = createTrustManagers(keystore);
|
||||
}
|
||||
this.sslcontext = SSLContext.getInstance(algorithm);
|
||||
this.sslcontext.init(keymanagers, trustmanagers, random);
|
||||
this.socketfactory = this.sslcontext.getSocketFactory();
|
||||
}
|
||||
|
||||
public SSLSocketFactory(
|
||||
final KeyStore keystore,
|
||||
final String keystorePassword,
|
||||
final KeyStore truststore)
|
||||
throws NoSuchAlgorithmException, KeyManagementException, KeyStoreException, UnrecoverableKeyException
|
||||
{
|
||||
this(TLS, keystore, keystorePassword, truststore, null);
|
||||
}
|
||||
|
||||
public SSLSocketFactory(final KeyStore keystore, final String keystorePassword)
|
||||
throws NoSuchAlgorithmException, KeyManagementException, KeyStoreException, UnrecoverableKeyException
|
||||
{
|
||||
this(TLS, keystore, keystorePassword, null, null);
|
||||
}
|
||||
|
||||
public SSLSocketFactory(final KeyStore truststore)
|
||||
throws NoSuchAlgorithmException, KeyManagementException, KeyStoreException, UnrecoverableKeyException
|
||||
{
|
||||
this(TLS, null, null, truststore, null);
|
||||
}
|
||||
|
||||
public SSLSocketFactory() {
|
||||
super();
|
||||
this.sslcontext = null;
|
||||
this.socketfactory = javax.net.ssl.SSLSocketFactory.getDefault();
|
||||
}
|
||||
|
||||
private static KeyManager[] createKeyManagers(final KeyStore keystore, final String password)
|
||||
throws KeyStoreException, NoSuchAlgorithmException, UnrecoverableKeyException {
|
||||
if (keystore == null) {
|
||||
throw new IllegalArgumentException("Keystore may not be null");
|
||||
}
|
||||
KeyManagerFactory kmfactory = KeyManagerFactory.getInstance(
|
||||
KeyManagerFactory.getDefaultAlgorithm());
|
||||
kmfactory.init(keystore, password != null ? password.toCharArray(): null);
|
||||
return kmfactory.getKeyManagers();
|
||||
}
|
||||
|
||||
private static TrustManager[] createTrustManagers(final KeyStore keystore)
|
||||
throws KeyStoreException, NoSuchAlgorithmException {
|
||||
if (keystore == null) {
|
||||
throw new IllegalArgumentException("Keystore may not be null");
|
||||
}
|
||||
TrustManagerFactory tmfactory = TrustManagerFactory.getInstance(
|
||||
TrustManagerFactory.getDefaultAlgorithm());
|
||||
tmfactory.init(keystore);
|
||||
return tmfactory.getTrustManagers();
|
||||
}
|
||||
|
||||
/**
|
||||
* Attempts to get a new socket connection to the given host within the given time limit.
|
||||
*
|
||||
* @param host the host name/IP
|
||||
* @param port the port on the host
|
||||
* @param localAddress the local host name/IP to bind the socket to
|
||||
* @param localPort the port on the local machine
|
||||
* @param params {@link HttpConnectionParams Http connection parameters}
|
||||
*
|
||||
* @return Socket a new socket
|
||||
*
|
||||
* @throws IOException if an I/O error occurs while creating the socket
|
||||
* @throws UnknownHostException if the IP address of the host cannot be
|
||||
* determined
|
||||
* @throws ConnectTimeoutException if socket cannot be connected within the
|
||||
* given time limit
|
||||
*
|
||||
* @since 3.0
|
||||
*/
|
||||
public Socket createSocket(
|
||||
final String host,
|
||||
final int port,
|
||||
final InetAddress localAddress,
|
||||
final int localPort,
|
||||
final HttpParams params
|
||||
) throws IOException, UnknownHostException, ConnectTimeoutException {
|
||||
if (params == null) {
|
||||
throw new IllegalArgumentException("Parameters may not be null");
|
||||
}
|
||||
Socket socket = this.socketfactory.createSocket();
|
||||
if (localAddress != null) {
|
||||
socket.bind(new InetSocketAddress(localAddress, localPort));
|
||||
}
|
||||
int timeout = HttpConnectionParams.getConnectionTimeout(params);
|
||||
socket.connect(new InetSocketAddress(host, port), timeout);
|
||||
return socket;
|
||||
}
|
||||
|
||||
/**
|
||||
* @see SecureProtocolSocketFactory#createSocket(java.net.Socket,java.lang.String,int,boolean)
|
||||
*/
|
||||
public Socket createSocket(
|
||||
Socket socket,
|
||||
String host,
|
||||
int port,
|
||||
boolean autoClose)
|
||||
throws IOException, UnknownHostException
|
||||
{
|
||||
return this.sslcontext.getSocketFactory().createSocket(
|
||||
socket,
|
||||
host,
|
||||
port,
|
||||
autoClose
|
||||
);
|
||||
}
|
||||
|
||||
}
|
||||
Loading…
Reference in New Issue