【Netty源码解读和权威指南】第38篇：Netty SSL TLS安全传输——HTTPS背后的Netty实现

上一篇【第37篇】Netty流量整形——优雅控制客户端发送速率
下一篇【第39篇】Netty内存泄漏检测机制源码解析——守护ByteBuf的"生死账本"

一、TLS握手流程

客户端 服务端 |------ClientHello----------->| (支持的加密套件) |<-----ServerHello------------| (选定加密套件+证书) |<-----Certificate-----------| (服务端证书) |<-----ServerHelloDone-------| (握手完成) |------ClientKeyExchange----->| (加密的预主密钥) |------ChangeCipherSpec------>| (切换加密模式) |------Finished-------------->| |<-----ChangeCipherSpec-------| |<-----Finished---------------| | | |<====加密通信开始==============>|

二、SslContext配置

// 服务端SSL配置SelfSignedCertificatecert=newSelfSignedCertificate();SslContextsslCtx=SslContextBuilder.forServer(cert.certificate(),cert.privateKey()).sslProvider(SslProvider.OPENSSL)// 优先使用OpenSSL.build();// 客户端SSL配置SslContextclientCtx=SslContextBuilder.forClient().trustManager(InsecureTrustManagerFactory.INSTANCE)// 仅测试用.build();

三、SslHandler集成

// 服务端Pipelinepipeline.addLast(sslCtx.newHandler(ch.alloc()));// SSL加解密pipeline.addLast(newHttpServerCodec());// HTTP编解码pipeline.addLast(newHttpServerHandler());// 业务逻辑// 客户端Pipelinepipeline.addLast(clientCtx.newHandler(ch.alloc(),host,port));pipeline.addLast(newHttpClientCodec());pipeline.addLast(newHttpClientHandler());

四、OpenSSL vs JDK SSL

启用OpenSSL：

// pom.xml<dependency><groupId>io.netty</groupId><artifactId>netty-tcnative-boringssl-static</artifactId></dependency>// 代码配置.sslProvider(SslProvider.OPENSSL)

五、完整HTTPS服务器

publicclassHttpsServer{publicstaticvoidmain(String[]args)throwsException{SelfSignedCertificatecert=newSelfSignedCertificate();SslContextsslCtx=SslContextBuilder.forServer(cert.certificate(),cert.privateKey()).build();EventLoopGroupboss=newNioEventLoopGroup(1);EventLoopGroupworker=newNioEventLoopGroup();try{newServerBootstrap().group(boss,worker).channel(NioServerSocketChannel.class).childHandler(newChannelInitializer<Channel>(){protectedvoidinitChannel(Channelch){ch.pipeline().addLast(sslCtx.newHandler(ch.alloc()));ch.pipeline().addLast(newHttpServerCodec());ch.pipeline().addLast(newHttpServerExpectContinueHandler());ch.pipeline().addLast(newSimpleChannelInboundHandler<HttpRequest>(){protectedvoidchannelRead0(ChannelHandlerContextctx,HttpRequestreq){Stringbody="Hello HTTPS!";FullHttpResponseresp=newDefaultFullHttpResponse(HTTP_1_1,OK,ctx.alloc().buffer().writeBytes(body.getBytes()));resp.headers().set(CONTENT_LENGTH,body.length());resp.headers().set(CONTENT_TYPE,"text/plain");ctx.writeAndFlush(resp);}});}}).bind(8443).sync().channel().closeFuture().sync();}finally{boss.shutdownGracefully();worker.shutdownGracefully();}}}

六、总结

上一篇【第37篇】Netty流量整形——优雅控制客户端发送速率
下一篇【第39篇】Netty内存泄漏检测机制源码解析——守护ByteBuf的"生死账本"