查看本类的 API文档回源码主页

   /*
    * Copyright 2014 The Netty Project
    *
    * The Netty Project licenses this file to you under the Apache License,
    * version 2.0 (the "License"); you may not use this file except in compliance
    * with the License. You may obtain a copy of the License at:
    *
    *   https://www.apache.org/licenses/LICENSE-2.0
    *
   * Unless required by applicable law or agreed to in writing, software
   * distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
   * WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the
   * License for the specific language governing permissions and limitations
   * under the License.
   */
  
  package io.netty.handler.ssl;
  
  import java.security.KeyStore;
  import java.security.Provider;
  import javax.net.ssl.KeyManager;
  import javax.net.ssl.KeyManagerFactory;
  import javax.net.ssl.SSLContext;
  import javax.net.ssl.SSLException;
  import javax.net.ssl.SSLSessionContext;
  import javax.net.ssl.TrustManager;
  import javax.net.ssl.TrustManagerFactory;
  import java.io.File;
  import java.security.PrivateKey;
  import java.security.cert.X509Certificate;
  
  /**
   * A client-side {@link SslContext} which uses JDK's SSL/TLS implementation.
   *
   * @deprecated Use {@link SslContextBuilder} to create {@link JdkSslContext} instances and only
   * use {@link JdkSslContext} in your code.
   */
  @Deprecated
  public final class JdkSslClientContext extends JdkSslContext {
  
      /**
       * Creates a new instance.
       *
       * @deprecated use {@link SslContextBuilder}
       */
      @Deprecated
      public JdkSslClientContext() throws SSLException {
          this(null, null);
      }
  
      /**
       * Creates a new instance.
       *
       * @param certChainFile an X.509 certificate chain file in PEM format.
       *                      {@code null} to use the system default
       * @deprecated use {@link SslContextBuilder}
       */
      @Deprecated
      public JdkSslClientContext(File certChainFile) throws SSLException {
          this(certChainFile, null);
      }
  
      /**
       * Creates a new instance.
       *
       * @param trustManagerFactory the {@link TrustManagerFactory} that provides the {@link TrustManager}s
       *                            that verifies the certificates sent from servers.
       *                            {@code null} to use the default.
       * @deprecated use {@link SslContextBuilder}
       */
      @Deprecated
      public JdkSslClientContext(TrustManagerFactory trustManagerFactory) throws SSLException {
          this(null, trustManagerFactory);
      }
  
      /**
       * Creates a new instance.
       *
       * @param certChainFile an X.509 certificate chain file in PEM format.
       *                      {@code null} to use the system default
       * @param trustManagerFactory the {@link TrustManagerFactory} that provides the {@link TrustManager}s
       *                            that verifies the certificates sent from servers.
       *                            {@code null} to use the default.
       * @deprecated use {@link SslContextBuilder}
       */
      @Deprecated
      public JdkSslClientContext(File certChainFile, TrustManagerFactory trustManagerFactory) throws SSLException {
          this(certChainFile, trustManagerFactory, null, IdentityCipherSuiteFilter.INSTANCE,
                  JdkDefaultApplicationProtocolNegotiator.INSTANCE, 0, 0);
      }
  
      /**
       * Creates a new instance.
       *
       * @param certChainFile an X.509 certificate chain file in PEM format.
       *                      {@code null} to use the system default
       * @param trustManagerFactory the {@link TrustManagerFactory} that provides the {@link TrustManager}s
       *                            that verifies the certificates sent from servers.
       *                            {@code null} to use the default.
      * @param ciphers the cipher suites to enable, in the order of preference.
      *                {@code null} to use the default cipher suites.
      * @param nextProtocols the application layer protocols to accept, in the order of preference.
      *                      {@code null} to disable TLS NPN/ALPN extension.
      * @param sessionCacheSize the size of the cache used for storing SSL session objects.
      *                         {@code 0} to use the default value.
      * @param sessionTimeout the timeout for the cached SSL session objects, in seconds.
      *                       {@code 0} to use the default value.
      * @deprecated use {@link SslContextBuilder}
      */
     @Deprecated
     public JdkSslClientContext(
             File certChainFile, TrustManagerFactory trustManagerFactory,
             Iterable<String> ciphers, Iterable<String> nextProtocols,
             long sessionCacheSize, long sessionTimeout) throws SSLException {
         this(certChainFile, trustManagerFactory, ciphers, IdentityCipherSuiteFilter.INSTANCE,
              toNegotiator(toApplicationProtocolConfig(nextProtocols), false), sessionCacheSize, sessionTimeout);
     }
 
     /**
      * Creates a new instance.
      *
      * @param certChainFile an X.509 certificate chain file in PEM format.
      *                      {@code null} to use the system default
      * @param trustManagerFactory the {@link TrustManagerFactory} that provides the {@link TrustManager}s
      *                            that verifies the certificates sent from servers.
      *                            {@code null} to use the default.
      * @param ciphers the cipher suites to enable, in the order of preference.
      *                {@code null} to use the default cipher suites.
      * @param cipherFilter a filter to apply over the supplied list of ciphers
      * @param apn Provides a means to configure parameters related to application protocol negotiation.
      * @param sessionCacheSize the size of the cache used for storing SSL session objects.
      *                         {@code 0} to use the default value.
      * @param sessionTimeout the timeout for the cached SSL session objects, in seconds.
      *                       {@code 0} to use the default value.
      * @deprecated use {@link SslContextBuilder}
      */
     @Deprecated
     public JdkSslClientContext(
             File certChainFile, TrustManagerFactory trustManagerFactory,
             Iterable<String> ciphers, CipherSuiteFilter cipherFilter, ApplicationProtocolConfig apn,
             long sessionCacheSize, long sessionTimeout) throws SSLException {
         this(certChainFile, trustManagerFactory, ciphers, cipherFilter,
                 toNegotiator(apn, false), sessionCacheSize, sessionTimeout);
     }
 
     /**
      * Creates a new instance.
      *
      * @param certChainFile an X.509 certificate chain file in PEM format.
      *                      {@code null} to use the system default
      * @param trustManagerFactory the {@link TrustManagerFactory} that provides the {@link TrustManager}s
      *                            that verifies the certificates sent from servers.
      *                            {@code null} to use the default.
      * @param ciphers the cipher suites to enable, in the order of preference.
      *                {@code null} to use the default cipher suites.
      * @param cipherFilter a filter to apply over the supplied list of ciphers
      * @param apn Application Protocol Negotiator object.
      * @param sessionCacheSize the size of the cache used for storing SSL session objects.
      *                         {@code 0} to use the default value.
      * @param sessionTimeout the timeout for the cached SSL session objects, in seconds.
      *                       {@code 0} to use the default value.
      * @deprecated use {@link SslContextBuilder}
      */
     @Deprecated
     public JdkSslClientContext(
             File certChainFile, TrustManagerFactory trustManagerFactory,
             Iterable<String> ciphers, CipherSuiteFilter cipherFilter, JdkApplicationProtocolNegotiator apn,
             long sessionCacheSize, long sessionTimeout) throws SSLException {
         this(null, certChainFile, trustManagerFactory, ciphers, cipherFilter, apn, sessionCacheSize, sessionTimeout);
     }
 
     JdkSslClientContext(Provider provider,
                         File trustCertCollectionFile, TrustManagerFactory trustManagerFactory,
                         Iterable<String> ciphers, CipherSuiteFilter cipherFilter, JdkApplicationProtocolNegotiator apn,
                         long sessionCacheSize, long sessionTimeout) throws SSLException {
         super(newSSLContext(provider, toX509CertificatesInternal(trustCertCollectionFile),
                 trustManagerFactory, null, null,
                 null, null, sessionCacheSize, sessionTimeout, KeyStore.getDefaultType()), true,
                 ciphers, cipherFilter, apn, ClientAuth.NONE, null, false);
     }
 
     /**
      * Creates a new instance.
      * @param trustCertCollectionFile an X.509 certificate collection file in PEM format.
      *                      {@code null} to use the system default
      * @param trustManagerFactory the {@link TrustManagerFactory} that provides the {@link TrustManager}s
      *                            that verifies the certificates sent from servers.
      *                            {@code null} to use the default or the results of parsing
      *                            {@code trustCertCollectionFile}
      * @param keyCertChainFile an X.509 certificate chain file in PEM format.
      *                      This provides the public key for mutual authentication.
      *                      {@code null} to use the system default
      * @param keyFile a PKCS#8 private key file in PEM format.
      *                      This provides the private key for mutual authentication.
      *                      {@code null} for no mutual authentication.
      * @param keyPassword the password of the {@code keyFile}.
      *                    {@code null} if it's not password-protected.
      *                    Ignored if {@code keyFile} is {@code null}.
      * @param keyManagerFactory the {@link KeyManagerFactory} that provides the {@link KeyManager}s
      *                          that is used to encrypt data being sent to servers.
      *                          {@code null} to use the default or the results of parsing
      *                          {@code keyCertChainFile} and {@code keyFile}.
      * @param ciphers the cipher suites to enable, in the order of preference.
      *                {@code null} to use the default cipher suites.
      * @param cipherFilter a filter to apply over the supplied list of ciphers
      * @param apn Provides a means to configure parameters related to application protocol negotiation.
      * @param sessionCacheSize the size of the cache used for storing SSL session objects.
      *                         {@code 0} to use the default value.
      * @param sessionTimeout the timeout for the cached SSL session objects, in seconds.
      *                       {@code 0} to use the default value.
      * @deprecated use {@link SslContextBuilder}
      */
     @Deprecated
     public JdkSslClientContext(File trustCertCollectionFile, TrustManagerFactory trustManagerFactory,
             File keyCertChainFile, File keyFile, String keyPassword, KeyManagerFactory keyManagerFactory,
             Iterable<String> ciphers, CipherSuiteFilter cipherFilter, ApplicationProtocolConfig apn,
             long sessionCacheSize, long sessionTimeout) throws SSLException {
         this(trustCertCollectionFile, trustManagerFactory, keyCertChainFile, keyFile, keyPassword, keyManagerFactory,
                 ciphers, cipherFilter, toNegotiator(apn, false), sessionCacheSize, sessionTimeout);
     }
 
     /**
      * Creates a new instance.
      * @param trustCertCollectionFile an X.509 certificate collection file in PEM format.
      *                      {@code null} to use the system default
      * @param trustManagerFactory the {@link TrustManagerFactory} that provides the {@link TrustManager}s
      *                            that verifies the certificates sent from servers.
      *                            {@code null} to use the default or the results of parsing
      *                            {@code trustCertCollectionFile}
      * @param keyCertChainFile an X.509 certificate chain file in PEM format.
      *                      This provides the public key for mutual authentication.
      *                      {@code null} to use the system default
      * @param keyFile a PKCS#8 private key file in PEM format.
      *                      This provides the private key for mutual authentication.
      *                      {@code null} for no mutual authentication.
      * @param keyPassword the password of the {@code keyFile}.
      *                    {@code null} if it's not password-protected.
      *                    Ignored if {@code keyFile} is {@code null}.
      * @param keyManagerFactory the {@link KeyManagerFactory} that provides the {@link KeyManager}s
      *                          that is used to encrypt data being sent to servers.
      *                          {@code null} to use the default or the results of parsing
      *                          {@code keyCertChainFile} and {@code keyFile}.
      * @param ciphers the cipher suites to enable, in the order of preference.
      *                {@code null} to use the default cipher suites.
      * @param cipherFilter a filter to apply over the supplied list of ciphers
      * @param apn Application Protocol Negotiator object.
      * @param sessionCacheSize the size of the cache used for storing SSL session objects.
      *                         {@code 0} to use the default value.
      * @param sessionTimeout the timeout for the cached SSL session objects, in seconds.
      *                       {@code 0} to use the default value.
      * @deprecated use {@link SslContextBuilder}
      */
     @Deprecated
     public JdkSslClientContext(File trustCertCollectionFile, TrustManagerFactory trustManagerFactory,
             File keyCertChainFile, File keyFile, String keyPassword, KeyManagerFactory keyManagerFactory,
             Iterable<String> ciphers, CipherSuiteFilter cipherFilter, JdkApplicationProtocolNegotiator apn,
             long sessionCacheSize, long sessionTimeout) throws SSLException {
         super(newSSLContext(null, toX509CertificatesInternal(
                 trustCertCollectionFile), trustManagerFactory,
                 toX509CertificatesInternal(keyCertChainFile), toPrivateKeyInternal(keyFile, keyPassword),
                 keyPassword, keyManagerFactory, sessionCacheSize, sessionTimeout, KeyStore.getDefaultType()), true,
                 ciphers, cipherFilter, apn, ClientAuth.NONE, null, false);
     }
 
     JdkSslClientContext(Provider sslContextProvider,
                         X509Certificate[] trustCertCollection, TrustManagerFactory trustManagerFactory,
                         X509Certificate[] keyCertChain, PrivateKey key, String keyPassword,
                         KeyManagerFactory keyManagerFactory, Iterable<String> ciphers, CipherSuiteFilter cipherFilter,
                         ApplicationProtocolConfig apn, String[] protocols, long sessionCacheSize, long sessionTimeout,
                         String keyStoreType)
             throws SSLException {
         super(newSSLContext(sslContextProvider, trustCertCollection, trustManagerFactory,
                             keyCertChain, key, keyPassword, keyManagerFactory, sessionCacheSize,
                             sessionTimeout, keyStoreType),
                 true, ciphers, cipherFilter, toNegotiator(apn, false), ClientAuth.NONE, protocols, false);
     }
 
     private static SSLContext newSSLContext(Provider sslContextProvider,
                                             X509Certificate[] trustCertCollection,
                                             TrustManagerFactory trustManagerFactory, X509Certificate[] keyCertChain,
                                             PrivateKey key, String keyPassword, KeyManagerFactory keyManagerFactory,
                                             long sessionCacheSize, long sessionTimeout,
                                             String keyStore) throws SSLException {
         try {
             if (trustCertCollection != null) {
                 trustManagerFactory = buildTrustManagerFactory(trustCertCollection, trustManagerFactory, keyStore);
             }
             if (keyCertChain != null) {
                 keyManagerFactory = buildKeyManagerFactory(keyCertChain, null,
                         key, keyPassword, keyManagerFactory, keyStore);
             }
             SSLContext ctx = sslContextProvider == null ? SSLContext.getInstance(PROTOCOL)
                 : SSLContext.getInstance(PROTOCOL, sslContextProvider);
             ctx.init(keyManagerFactory == null ? null : keyManagerFactory.getKeyManagers(),
                      trustManagerFactory == null ? null : trustManagerFactory.getTrustManagers(),
                      null);
 
             SSLSessionContext sessCtx = ctx.getClientSessionContext();
             if (sessionCacheSize > 0) {
                 sessCtx.setSessionCacheSize((int) Math.min(sessionCacheSize, Integer.MAX_VALUE));
             }
             if (sessionTimeout > 0) {
                 sessCtx.setSessionTimeout((int) Math.min(sessionTimeout, Integer.MAX_VALUE));
             }
             return ctx;
         } catch (Exception e) {
             if (e instanceof SSLException) {
                 throw (SSLException) e;
             }
             throw new SSLException("failed to initialize the client-side SSL context", e);
         }
     }
 }