[转载]基于ssl加密通信的rmi应用实现

原文地址：基于ssl加密通信的rmi应用实现 作者： chunyv

• 生产策略文件：java.policy内容如下：
  

  grant{         permission   java.security.AllPermission;   };

• 接口定义
  

  import java.rmi.Remote; import java.rmi.RemoteException; public interface MyRMI extends Remote {  String execute() throws RemoteException;; }

• 自定义本地SocketFactory
  

  import java.io.FileInputStream; import java.io.Serializable; import java.net.Socket; import java.rmi.server.RMIClientSocketFactory; import java.security.KeyStore; import javax.net.ssl.KeyManagerFactory; import javax.net.ssl.SSLContext; import javax.net.ssl.SSLSocket; import javax.net.ssl.TrustManagerFactory; public class RMISSLClientSocketFactory implements RMIClientSocketFactory,   Serializable {    String server_crt = null;  String client_crt = null;  String password = null;    public RMISSLClientSocketFactory(String server_crt, String client_crt,    String password)  {   this.server_crt = server_crt;   this.client_crt = client_crt;   this.password = password;  }    public Socket createSocket(String host, int port) {   try {    SSLContext ctx = SSLContext.getInstance("SSL");    KeyManagerFactory kmf = KeyManagerFactory.getInstance("SunX509");    TrustManagerFactory tmf = TrustManagerFactory      .getInstance("SunX509");    KeyStore ks = KeyStore.getInstance("JKS");    KeyStore tks = KeyStore.getInstance("JKS");    ks.load(new FileInputStream(this.client_crt), this.password      .toCharArray());    tks.load(new FileInputStream(this.server_crt), this.password      .toCharArray());    kmf.init(ks, "123456".toCharArray());    tmf.init(tks);    ctx.init(kmf.getKeyManagers(), tmf.getTrustManagers(), null);    SSLSocket socket = (SSLSocket) ctx.getSocketFactory().createSocket(      host, port);    return socket;   } catch (Exception err) {    err.printStackTrace();   }   return null;  }  public int hashCode() {   return getClass().hashCode();  }  public boolean equals(Object obj) {   if (obj == this) {    return true;   } else if (obj == null || getClass() != obj.getClass()) {    return false;   }   return true;  } }

• 自定义远程SocketFactory
  

  import java.io.FileInputStream; import java.io.IOException; import java.net.ServerSocket; import java.rmi.server.RMIServerSocketFactory; import java.security.KeyStore; import javax.net.ssl.KeyManagerFactory; import javax.net.ssl.SSLContext; import javax.net.ssl.SSLServerSocket; import javax.net.ssl.SSLServerSocketFactory; import javax.net.ssl.TrustManagerFactory; public class RMISSLServerSocketFactory implements RMIServerSocketFactory {  private SSLServerSocketFactory ssf = null;  public RMISSLServerSocketFactory(String server_crt, String client_crt,    String password) throws Exception {   try {    SSLContext ctx = SSLContext.getInstance("SSL");    KeyManagerFactory kmf = KeyManagerFactory.getInstance("SunX509");    TrustManagerFactory tmf = TrustManagerFactory      .getInstance("SunX509");    KeyStore ks = KeyStore.getInstance("JKS");    KeyStore tks = KeyStore.getInstance("JKS");    ks.load(new FileInputStream(server_crt), password.toCharArray());    tks.load(new FileInputStream(client_crt), password.toCharArray());    kmf.init(ks, password.toCharArray());    tmf.init(tks);    ctx.init(kmf.getKeyManagers(), tmf.getTrustManagers(), null);    ssf = ctx.getServerSocketFactory();       } catch (Exception err) {    err.printStackTrace();   }  }  public ServerSocket createServerSocket(int port) throws IOException {   SSLServerSocket mysslsocket = (SSLServerSocket)ssf.createServerSocket(port);      mysslsocket.setNeedClientAuth(true);      return mysslsocket;  }  public int hashCode() {   return getClass().hashCode();  }  public boolean equals(Object obj) {   if (obj == this) {    return true;   } else if (obj == null || getClass() != obj.getClass()) {    return false;   }   return true;  } }

• 远程服务
  

  import java.rmi.RMISecurityManager; import java.rmi.registry.LocateRegistry; import java.rmi.registry.Registry; import java.rmi.server.RemoteServer; import java.rmi.server.UnicastRemoteObject; public class RMIServer extends UnicastRemoteObject implements MyRMI {  private static final int PORT = 8080;  public RMIServer() throws Exception {   super(PORT, new RMISSLClientSocketFactory("server.keystore",     "client.keystore", "123456"),     new RMISSLServerSocketFactory("server.keystore",       "client.keystore", "123456"));  }  public static void main(String args[]) {   if (System.getSecurityManager() == null) {    System.setSecurityManager(new RMISecurityManager());   }   try {    Registry registry = LocateRegistry.createRegistry(PORT,      new RMISSLClientSocketFactory("server.keystore",        "client.keystore", "123456"),      new RMISSLServerSocketFactory("server.keystore",        "client.keystore", "123456"));    RMIServer obj = new RMIServer();    registry.bind("HelloWorld", obj);    System.out.println("HelloWorld bound in registry");   } catch (Exception err) {    err.printStackTrace();   }  }  public String execute() {   String clientaddr = null;   try {    clientaddr = RemoteServer.getClientHost();    System.out.println("connect from " + clientaddr);    return "hello client " + clientaddr;   } catch (Exception err) {    err.printStackTrace();   }   return "hello client ";  } }

• 本地服务
  

  import java.rmi.registry.LocateRegistry; import java.rmi.registry.Registry; public class RMIClient {  private static final int PORT = 8080;  public static void main(String args[]) {   try {    Registry registry = LocateRegistry.getRegistry("10.1.1.52", PORT,      new RMISSLClientSocketFactory("server.keystore",        "client.keystore", "123456"));    MyRMI myrmi = (MyRMI) registry.lookup("HelloWorld");    System.out.println(myrmi.execute());   } catch (Exception e) {    e.printStackTrace();   }  } }

• 运行结果
  

  远程： HelloWorld bound in registry connect from 10.1.1.235 本地： hello client 10.1.1.235

• 1、操作方式
  一、生产key
  Server需要：
  1）KeyStore: 其中保存服务端的私钥
  2）Trust KeyStore:其中保存客户端的授权证书
  同样，Client需要：
  1）KeyStore：其中保存客户端的私钥
  2）Trust KeyStore：其中保存服务端的授权证书
   
  在这里我还是推荐使用Java自带的keytool命令，去生成这样信息文件。当然目前非常流行的开源的生成SSL证书的还有OpenSSL。OpenSSL用C语言编写，跨系统。但是我们可能在以后的过程中用java程序生成证书的方便性考虑，还是用JDK自带的keytool。
  
  
  1）生成服务端私钥，并且导入到服务端KeyStore文件中
  keytool -genkey -alias serverkey -keystore kserver.keystore
  过程中，分别需要填写，根据需求自己设置就行
  keystore密码：123456 
  名字和姓氏：jin
  组织单位名称：none
  组织名称：none
  城市或区域名称：BJ
  州或省份名称：BJ
  国家代码：CN
  serverkey私钥的密码，不填写和keystore的密码一致。这里千万注意，直接回车就行了，不用修改密码。否则在后面的程序中以及无法直接应用这个私钥，会报错。
   
   
  就可以生成kserver.keystore文件 
  server.keystore是给服务端用的，其中保存着自己的私钥
  
  
  2）根据私钥，导出服务端证书
  keytool -export -alias serverkey -keystore kserver.keystore -file server.crt
  server.crt就是服务端的证书
  
  
  3）将服务端证书，导入到客户端的Trust KeyStore中
  keytool -import -alias serverkey -file server.crt -keystore tclient.keystore
  tclient.keystore是给客户端用的，其中保存着受信任的证书
  
  
  采用同样的方法，生成客户端的私钥，客户端的证书，并且导入到服务端的Trust KeyStore中
  1）keytool -genkey -alias clientkey -keystore kclient.keystore
  2）keytool -export -alias clientkey -keystore kclient.keystore -file client.crt
  3）keytool -import -alias clientkey -file client.crt -keystore tserver.keystore
  
  
  如此一来，生成的文件分成两组
  服务端保存：kserver.keystore tserver.keystore
  客户端保存：kclient.keystore  tclient.kyestore
  
  
  2、书写java.policy文件
  
  
  3、在cmd中执行，如下：
  E:\workspace\studyDemo\bin\javaWebRmi>java -classpath E:/workspace/studyDemo/bin
   -Djava.security.manager -Djava.security.policy=E:/workspace/studyDemo/java.poli
  cy javaWebRmi.RMIServer