List of usage examples for io.netty.handler.ssl SslProvider OPENSSL
SslProvider OPENSSL
To view the source code for io.netty.handler.ssl SslProvider OPENSSL.
Click Source Link
From source file:io.netty.example.http2.helloworld.client.Http2Client.java
License:Apache License
public static void main(String[] args) throws Exception { // Configure SSL. final SslContext sslCtx; if (SSL) {/*www . j ava 2 s . com*/ SslProvider provider = OpenSsl.isAlpnSupported() ? SslProvider.OPENSSL : SslProvider.JDK; sslCtx = SslContextBuilder.forClient().sslProvider(provider) /* NOTE: the cipher filter may not include all ciphers required by the HTTP/2 specification. * Please refer to the HTTP/2 specification for cipher requirements. */ .ciphers(Http2SecurityUtil.CIPHERS, SupportedCipherSuiteFilter.INSTANCE) .trustManager(InsecureTrustManagerFactory.INSTANCE) .applicationProtocolConfig(new ApplicationProtocolConfig(Protocol.ALPN, // NO_ADVERTISE is currently the only mode supported by both OpenSsl and JDK providers. SelectorFailureBehavior.NO_ADVERTISE, // ACCEPT is currently the only mode supported by both OpenSsl and JDK providers. SelectedListenerFailureBehavior.ACCEPT, ApplicationProtocolNames.HTTP_2, ApplicationProtocolNames.HTTP_1_1)) .build(); } else { sslCtx = null; } EventLoopGroup workerGroup = new NioEventLoopGroup(); Http2ClientInitializer initializer = new Http2ClientInitializer(sslCtx, Integer.MAX_VALUE); try { // Configure the client. Bootstrap b = new Bootstrap(); b.group(workerGroup); b.channel(NioSocketChannel.class); b.option(ChannelOption.SO_KEEPALIVE, true); b.remoteAddress(HOST, PORT); b.handler(initializer); // Start the client. Channel channel = b.connect().syncUninterruptibly().channel(); System.out.println("Connected to [" + HOST + ':' + PORT + ']'); // Wait for the HTTP/2 upgrade to occur. Http2SettingsHandler http2SettingsHandler = initializer.settingsHandler(); http2SettingsHandler.awaitSettings(5, TimeUnit.SECONDS); HttpResponseHandler responseHandler = initializer.responseHandler(); int streamId = 3; HttpScheme scheme = SSL ? HttpScheme.HTTPS : HttpScheme.HTTP; AsciiString hostName = new AsciiString(HOST + ':' + PORT); System.err.println("Sending request(s)..."); if (URL != null) { // Create a simple GET request. FullHttpRequest request = new DefaultFullHttpRequest(HTTP_1_1, GET, URL, Unpooled.EMPTY_BUFFER); request.headers().add(HttpHeaderNames.HOST, hostName); request.headers().add(HttpConversionUtil.ExtensionHeaderNames.SCHEME.text(), scheme.name()); request.headers().add(HttpHeaderNames.ACCEPT_ENCODING, HttpHeaderValues.GZIP); request.headers().add(HttpHeaderNames.ACCEPT_ENCODING, HttpHeaderValues.DEFLATE); responseHandler.put(streamId, channel.write(request), channel.newPromise()); streamId += 2; } if (URL2 != null) { // Create a simple POST request with a body. FullHttpRequest request = new DefaultFullHttpRequest(HTTP_1_1, POST, URL2, wrappedBuffer(URL2DATA.getBytes(CharsetUtil.UTF_8))); request.headers().add(HttpHeaderNames.HOST, hostName); request.headers().add(HttpConversionUtil.ExtensionHeaderNames.SCHEME.text(), scheme.name()); request.headers().add(HttpHeaderNames.ACCEPT_ENCODING, HttpHeaderValues.GZIP); request.headers().add(HttpHeaderNames.ACCEPT_ENCODING, HttpHeaderValues.DEFLATE); responseHandler.put(streamId, channel.write(request), channel.newPromise()); } channel.flush(); responseHandler.awaitResponses(5, TimeUnit.SECONDS); System.out.println("Finished HTTP/2 request(s)"); // Wait until the connection is closed. channel.close().syncUninterruptibly(); } finally { workerGroup.shutdownGracefully(); } }
From source file:io.netty.example.ocsp.OcspClientExample.java
License:Apache License
public static void main(String[] args) throws Exception { if (!OpenSsl.isAvailable()) { throw new IllegalStateException("OpenSSL is not available!"); }//from ww w . j a v a2 s. c o m if (!OpenSsl.isOcspSupported()) { throw new IllegalStateException("OCSP is not supported!"); } // Using Wikipedia as an example. I'd rather use Netty's own website // but the server (Cloudflare) doesn't support OCSP stapling. A few // other examples could be Microsoft or Squarespace. Use OpenSSL's // CLI client to assess if a server supports OCSP stapling. E.g.: // // openssl s_client -tlsextdebug -status -connect www.squarespace.com:443 // String host = "www.wikipedia.org"; ReferenceCountedOpenSslContext context = (ReferenceCountedOpenSslContext) SslContextBuilder.forClient() .sslProvider(SslProvider.OPENSSL).enableOcsp(true).build(); try { EventLoopGroup group = new NioEventLoopGroup(); try { Promise<FullHttpResponse> promise = group.next().newPromise(); Bootstrap bootstrap = new Bootstrap().channel(NioSocketChannel.class).group(group) .option(ChannelOption.CONNECT_TIMEOUT_MILLIS, 5 * 1000) .handler(newClientHandler(context, host, promise)); Channel channel = bootstrap.connect(host, 443).syncUninterruptibly().channel(); try { FullHttpResponse response = promise.get(); ReferenceCountUtil.release(response); } finally { channel.close(); } } finally { group.shutdownGracefully(); } } finally { context.release(); } }
From source file:io.netty.example.ocsp.OcspServerExample.java
License:Apache License
public static void main(String[] args) throws Exception { // We assume there's a private key. PrivateKey privateKey = null; // Step 1: Load the certificate chain for netty.io. We'll need the certificate // and the issuer's certificate and we don't need any of the intermediate certs. // The array is assumed to be a certain order to keep things simple. X509Certificate[] keyCertChain = parseCertificates(OcspServerExample.class, "netty_io_chain.pem"); X509Certificate certificate = keyCertChain[0]; X509Certificate issuer = keyCertChain[keyCertChain.length - 1]; // Step 2: We need the URL of the CA's OCSP responder server. It's somewhere encoded // into the certificate! Notice that it's an HTTP URL. URI uri = OcspUtils.ocspUri(certificate); System.out.println("OCSP Responder URI: " + uri); if (uri == null) { throw new IllegalStateException("The CA/certificate doesn't have an OCSP responder"); }/* www .j a v a2 s.com*/ // Step 3: Construct the OCSP request OCSPReq request = new OcspRequestBuilder().certificate(certificate).issuer(issuer).build(); // Step 4: Do the request to the CA's OCSP responder OCSPResp response = OcspUtils.request(uri, request, 5L, TimeUnit.SECONDS); if (response.getStatus() != OCSPResponseStatus.SUCCESSFUL) { throw new IllegalStateException("response-status=" + response.getStatus()); } // Step 5: Is my certificate any good or has the CA revoked it? BasicOCSPResp basicResponse = (BasicOCSPResp) response.getResponseObject(); SingleResp first = basicResponse.getResponses()[0]; CertificateStatus status = first.getCertStatus(); System.out.println("Status: " + (status == CertificateStatus.GOOD ? "Good" : status)); System.out.println("This Update: " + first.getThisUpdate()); System.out.println("Next Update: " + first.getNextUpdate()); if (status != null) { throw new IllegalStateException("certificate-status=" + status); } BigInteger certSerial = certificate.getSerialNumber(); BigInteger ocspSerial = first.getCertID().getSerialNumber(); if (!certSerial.equals(ocspSerial)) { throw new IllegalStateException("Bad Serials=" + certSerial + " vs. " + ocspSerial); } // Step 6: Cache the OCSP response and use it as long as it's not // expired. The exact semantics are beyond the scope of this example. if (!OpenSsl.isAvailable()) { throw new IllegalStateException("OpenSSL is not available!"); } if (!OpenSsl.isOcspSupported()) { throw new IllegalStateException("OCSP is not supported!"); } if (privateKey == null) { throw new IllegalStateException( "Because we don't have a PrivateKey we can't continue past this point."); } ReferenceCountedOpenSslContext context = (ReferenceCountedOpenSslContext) SslContextBuilder .forServer(privateKey, keyCertChain).sslProvider(SslProvider.OPENSSL).enableOcsp(true).build(); try { ServerBootstrap bootstrap = new ServerBootstrap().childHandler(newServerHandler(context, response)); // so on and so forth... } finally { context.release(); } }
From source file:io.spikex.core.util.connection.KeyStoreHelper.java
License:Apache License
public SslContext buildOpenSslClientContext(final boolean clientAuth) throws IOException { SslContext ctx;/* www.j a v a 2s. co m*/ if (clientAuth) { ctx = SslContextBuilder.forClient().sslProvider(SslProvider.OPENSSL) .trustManager(getTrustCertChainPath().toAbsolutePath().normalize().toFile()) .keyManager(getClientCertPath().toAbsolutePath().normalize().toFile(), getClientKeyPath().toAbsolutePath().normalize().toFile()) .build(); } else { ctx = SslContextBuilder.forClient().sslProvider(SslProvider.OPENSSL) .trustManager(getTrustCertChainPath().toAbsolutePath().normalize().toFile()).build(); } return ctx; }
From source file:io.vertx.core.net.impl.SSLHelper.java
License:Open Source License
private SslContext createContext(VertxInternal vertx) { try {/*from www . j ava 2s.c o m*/ KeyManagerFactory keyMgrFactory = getKeyMgrFactory(vertx); TrustManagerFactory trustMgrFactory = getTrustMgrFactory(vertx); SslContextBuilder builder; if (client) { builder = SslContextBuilder.forClient(); if (keyMgrFactory != null) { builder.keyManager(keyMgrFactory); } } else { if (keyMgrFactory == null) { throw new VertxException("Key/certificate is mandatory for SSL"); } builder = SslContextBuilder.forServer(keyMgrFactory); } Collection<String> cipherSuites = enabledCipherSuites; if (openSsl) { builder.sslProvider(SslProvider.OPENSSL); if (cipherSuites == null || cipherSuites.isEmpty()) { cipherSuites = OpenSsl.availableOpenSslCipherSuites(); } } else { builder.sslProvider(SslProvider.JDK); if (cipherSuites == null || cipherSuites.isEmpty()) { cipherSuites = DEFAULT_JDK_CIPHER_SUITE; } } if (trustMgrFactory != null) { builder.trustManager(trustMgrFactory); } if (cipherSuites != null && cipherSuites.size() > 0) { builder.ciphers(cipherSuites); } if (useAlpn && applicationProtocols != null && applicationProtocols.size() > 0) { builder.applicationProtocolConfig(new ApplicationProtocolConfig( ApplicationProtocolConfig.Protocol.ALPN, ApplicationProtocolConfig.SelectorFailureBehavior.NO_ADVERTISE, ApplicationProtocolConfig.SelectedListenerFailureBehavior.ACCEPT, applicationProtocols .stream().map(PROTOCOL_NAME_MAPPING::get).collect(Collectors.toList()))); } return builder.build(); } catch (Exception e) { throw new VertxException(e); } }
From source file:jmeter.plugins.http2.sampler.NettyHttp2Client.java
License:Apache License
private SslContext getSslContext() { SslContext sslCtx = null;//from www .j a va 2s.com final SslProvider provider = OpenSsl.isAlpnSupported() ? SslProvider.OPENSSL : SslProvider.JDK; try { sslCtx = SslContextBuilder.forClient().sslProvider(provider) .ciphers(Http2SecurityUtil.CIPHERS, SupportedCipherSuiteFilter.INSTANCE) .trustManager(InsecureTrustManagerFactory.INSTANCE) .applicationProtocolConfig( new ApplicationProtocolConfig(Protocol.ALPN, SelectorFailureBehavior.NO_ADVERTISE, SelectedListenerFailureBehavior.ACCEPT, ApplicationProtocolNames.HTTP_2)) .build(); } catch (SSLException exception) { return null; } return sslCtx; }
From source file:majordodo.network.netty.NettyChannelAcceptor.java
License:Apache License
public void start() throws Exception { boolean useOpenSSL = NetworkUtils.isOpenSslAvailable(); if (ssl) {//from w ww . jav a2s . c om if (sslCertFile == null) { LOGGER.log(Level.SEVERE, "start SSL with self-signed auto-generated certificate, useOpenSSL:" + useOpenSSL); if (sslCiphers != null) { LOGGER.log(Level.SEVERE, "required sslCiphers " + sslCiphers); } SelfSignedCertificate ssc = new SelfSignedCertificate(); try { sslCtx = SslContextBuilder.forServer(ssc.certificate(), ssc.privateKey()) .sslProvider(useOpenSSL ? SslProvider.OPENSSL : SslProvider.JDK).ciphers(sslCiphers) .build(); } finally { ssc.delete(); } } else { LOGGER.log(Level.SEVERE, "start SSL with certificate " + sslCertFile.getAbsolutePath() + " chain file " + sslCertChainFile.getAbsolutePath() + " , useOpenSSL:" + useOpenSSL); if (sslCiphers != null) { LOGGER.log(Level.SEVERE, "required sslCiphers " + sslCiphers); } sslCtx = SslContextBuilder.forServer(sslCertChainFile, sslCertFile, sslCertPassword) .sslProvider(useOpenSSL ? SslProvider.OPENSSL : SslProvider.JDK).ciphers(sslCiphers) .build(); } } if (NetworkUtils.isEnableEpollNative()) { bossGroup = new EpollEventLoopGroup(workerThreads); workerGroup = new EpollEventLoopGroup(workerThreads); LOGGER.log(Level.INFO, "Using netty-native-epoll network type"); } else { bossGroup = new NioEventLoopGroup(workerThreads); workerGroup = new NioEventLoopGroup(workerThreads); } ServerBootstrap b = new ServerBootstrap(); b.group(bossGroup, workerGroup).channel( NetworkUtils.isEnableEpollNative() ? EpollServerSocketChannel.class : NioServerSocketChannel.class) .childHandler(new ChannelInitializer<SocketChannel>() { @Override public void initChannel(SocketChannel ch) throws Exception { NettyChannel session = new NettyChannel("client", ch, callbackExecutor, null); if (acceptor != null) { acceptor.createConnection(session); } // ch.pipeline().addLast(new LoggingHandler()); // Add SSL handler first to encrypt and decrypt everything. if (ssl) { ch.pipeline().addLast(sslCtx.newHandler(ch.alloc())); } ch.pipeline().addLast("lengthprepender", new LengthFieldPrepender(4)); ch.pipeline().addLast("lengthbaseddecoder", new LengthFieldBasedFrameDecoder(Integer.MAX_VALUE, 0, 4, 0, 4)); // ch.pipeline().addLast("messageencoder", new DodoMessageEncoder()); ch.pipeline().addLast("messagedecoder", new DodoMessageDecoder()); ch.pipeline().addLast(new InboundMessageHandler(session)); } }).option(ChannelOption.SO_BACKLOG, 128).childOption(ChannelOption.SO_KEEPALIVE, true); ChannelFuture f = b.bind(host, port).sync(); // (7) this.channel = f.channel(); }
From source file:majordodo.network.netty.NettyConnector.java
License:Apache License
public NettyChannel connect() throws Exception { boolean useOpenSSL = NetworkUtils.isOpenSslAvailable(); if (ssl) {/*from w w w . j av a 2 s. c om*/ if (sslUnsecure) { this.sslCtx = SslContextBuilder.forClient() .sslProvider(useOpenSSL ? SslProvider.OPENSSL : SslProvider.JDK) .trustManager(InsecureTrustManagerFactory.INSTANCE).build(); } else { this.sslCtx = SslContextBuilder.forClient() .sslProvider(useOpenSSL ? SslProvider.OPENSSL : SslProvider.JDK).build(); } } if (NetworkUtils.isEnableEpollNative()) { group = new EpollEventLoopGroup(); } else { group = new NioEventLoopGroup(); } LOG.log(Level.INFO, "Trying to connect to broker at " + host + ":" + port + " ssl:" + ssl + ", sslUnsecure:" + sslUnsecure + " openSsl:" + useOpenSSL); Bootstrap b = new Bootstrap(); b.group(group) .channel(NetworkUtils.isEnableEpollNative() ? EpollSocketChannel.class : NioSocketChannel.class) .option(ChannelOption.TCP_NODELAY, true).handler(new ChannelInitializer<SocketChannel>() { @Override public void initChannel(SocketChannel ch) throws Exception { channel = new NettyChannel(host + ":" + port, ch, callbackExecutor, NettyConnector.this); channel.setMessagesReceiver(receiver); channel.setRemoteHost(host); if (ssl) { ch.pipeline().addLast(sslCtx.newHandler(ch.alloc(), host, port)); } ch.pipeline().addLast("lengthprepender", new LengthFieldPrepender(4)); ch.pipeline().addLast("lengthbaseddecoder", new LengthFieldBasedFrameDecoder(Integer.MAX_VALUE, 0, 4, 0, 4)); // ch.pipeline().addLast("messageencoder", new DodoMessageEncoder()); ch.pipeline().addLast("messagedecoder", new DodoMessageDecoder()); ch.pipeline().addLast(new InboundMessageHandler(channel)); } }); ChannelFuture f = b.connect(host, port).sync(); socketchannel = f.channel(); return channel; }
From source file:me.netty.http.HttpServer.java
License:Apache License
public void start() throws Exception { //?// ww w . j a v a2 s .c o m serverContext.initContext(); // Configure SSL. final SslContext sslCtx; if (SSL) { SslProvider provider = OpenSsl.isAlpnSupported() ? SslProvider.OPENSSL : SslProvider.JDK; SelfSignedCertificate ssc = new SelfSignedCertificate(); sslCtx = SslContextBuilder.forServer(ssc.certificate(), ssc.privateKey()).sslProvider(provider) /* NOTE: the cipher filter may not include all ciphers required by the HTTP/2 specification. * Please refer to the HTTP/2 specification for cipher requirements. */ .ciphers(Http2SecurityUtil.CIPHERS, SupportedCipherSuiteFilter.INSTANCE) .applicationProtocolConfig(new ApplicationProtocolConfig(Protocol.ALPN, // NO_ADVERTISE is currently the only mode supported by both OpenSsl and JDK providers. SelectorFailureBehavior.NO_ADVERTISE, // ACCEPT is currently the only mode supported by both OpenSsl and JDK providers. SelectedListenerFailureBehavior.ACCEPT, ApplicationProtocolNames.HTTP_2, ApplicationProtocolNames.HTTP_1_1)) .build(); } else { sslCtx = null; } // Configure the http2Orhttp. //CPU??workwork? // ????? int threads = Runtime.getRuntime().availableProcessors() * 2; EventLoopGroup bossGroup = new NioEventLoopGroup(threads); EventLoopGroup workerGroup = new NioEventLoopGroup(threads); try { ServerBootstrap b = new ServerBootstrap(); b.option(ChannelOption.SO_BACKLOG, 1024); b.group(bossGroup, workerGroup).channel(NioServerSocketChannel.class) .handler(new LoggingHandler(LogLevel.DEBUG)).childHandler(new Http2ServerInitializer(sslCtx)); Channel ch = b.bind(PORT).sync().channel(); logger.info("Open your HTTP/2-enabled web browser and navigate to " + (SSL ? "https" : "http") + "://127.0.0.1:" + PORT + '/'); ch.closeFuture().sync().addListener(new GenericFutureListener<Future<? super Void>>() { public void operationComplete(Future<? super Void> future) throws Exception { logger.info("service has shutdown"); } }); } finally { bossGroup.shutdownGracefully(); workerGroup.shutdownGracefully(); } }
From source file:netty.http2.ConcurrentHttp2Client.java
License:Apache License
public static void main(String[] args) throws Exception { // Configure SSL. final SslContext sslCtx; if (SSL) {//from w w w .ja v a 2 s . co m SslProvider provider = OpenSsl.isAlpnSupported() ? SslProvider.OPENSSL : SslProvider.JDK; sslCtx = SslContextBuilder.forClient().sslProvider(provider) /* NOTE: the cipher filter may not include all ciphers required by the HTTP/2 specification. * Please refer to the HTTP/2 specification for cipher requirements. */ .ciphers(Http2SecurityUtil.CIPHERS, SupportedCipherSuiteFilter.INSTANCE) .trustManager(InsecureTrustManagerFactory.INSTANCE) .applicationProtocolConfig(new ApplicationProtocolConfig(Protocol.ALPN, // NO_ADVERTISE is currently the only mode supported by both OpenSsl and JDK providers. SelectorFailureBehavior.NO_ADVERTISE, // ACCEPT is currently the only mode supported by both OpenSsl and JDK providers. SelectedListenerFailureBehavior.ACCEPT, ApplicationProtocolNames.HTTP_2, ApplicationProtocolNames.HTTP_1_1)) .build(); } else { sslCtx = null; } EventLoopGroup workerGroup = new NioEventLoopGroup(); ConcurrentHttp2ClientInitializer initializer = new ConcurrentHttp2ClientInitializer(); try { // Configure the client. Bootstrap bootstrap = new Bootstrap(); bootstrap.group(workerGroup); bootstrap.channel(NioSocketChannel.class); bootstrap.option(ChannelOption.SO_KEEPALIVE, true); bootstrap.remoteAddress(HOST, PORT); bootstrap.handler(initializer); // Start the client. Channel channel = bootstrap.connect().syncUninterruptibly().channel(); System.out.println("Connected to [" + HOST + ':' + PORT + ']'); HttpScheme scheme = SSL ? HttpScheme.HTTPS : HttpScheme.HTTP; AsciiString hostName = new AsciiString(HOST + ':' + PORT); System.err.println("Sending request(s)..."); if (URL != null) { // Create a simple GET request. for (int i = 0; i < 1; i++) { StreamRequest request = new StreamRequestBuilder(new URI(URL)).setMethod("GET") //.setMethod("POST") .setHeader(HttpHeaderNames.HOST.toString(), hostName.toString()) //.build(EntityStreams.emptyStream()); .build(EntityStreams .newEntityStream(new ByteStringWriter(ByteString.copy(new byte[0 * 1024])))); channel.writeAndFlush(request); System.err.println("Sent request #" + i); } } System.err.println("Finished HTTP/2 request(s)"); long start = System.currentTimeMillis(); // Wait until the connection is closed. channel.closeFuture().sync(); long end = System.currentTimeMillis(); System.err.println("Server Idled for: " + (end - start) + " milliseconds"); } finally { workerGroup.shutdownGracefully(); } }