为什么Java中的SSL服务器套接字连接会阻塞，而非SSL服务器套接字则不会

考虑以下非SSL套接字服务器和客户端的代码，所有代码都在一个线程上：

import java.io.DataInputStream;
import java.io.IOException;
import java.io.OutputStream;
import java.net.ServerSocket;
import java.net.Socket;
public class ServerClient {
public static void main(String[] args) throws IOException {
ServerSocket ss = new ServerSocket(0); // open a random free port.
Socket c = new Socket(ss.getInetAddress(), ss.getLocalPort());
Socket s = ss.accept();
final byte[] bytes = "Hello World!".getBytes();
final OutputStream out = c.getOutputStream();
System.out.println("writing to stream");
out.write(bytes.length);
out.write(bytes);
System.out.println("reading from stream");
final DataInputStream in = new DataInputStream(s.getInputStream());
int len = in.read();
final byte[] b = new byte[len];
in.readFully(b);
System.out.println(new String(b));
c.close();
ss.close();
}
}

这会产生以下输出：

writing to stream
reading from stream
Hello World!

这个过程打开了一个服务器套接字-与一个客户端套接字连接。通过套接字传递数据，然后关闭。传递数据没有问题。

考虑使用SSL套接字来证明一点的版本：

import javax.net.ssl.SSLServerSocket;
import javax.net.ssl.SSLServerSocketFactory;
import javax.net.ssl.SSLSocket;
import javax.net.ssl.SSLSocketFactory;
import java.io.DataInputStream;
import java.io.IOException;
import java.io.OutputStream;
import java.net.Socket;
import java.util.logging.Logger;
public class SSLServerClient {
private static Logger log = Logger.getLogger("InfoLogging");
public static void main(String[] args) throws IOException {
System.setProperty("javax.net.ssl.keyStore", "/path/KeyStore.jks");
System.setProperty("javax.net.ssl.keyStorePassword", "password");
SSLServerSocketFactory sslserversocketfactory = (SSLServerSocketFactory) SSLServerSocketFactory.getDefault();
SSLServerSocket serverListeningSSLSocket = (SSLServerSocket) sslserversocketfactory.createServerSocket(4380);
log.info("Server started");
SSLSocketFactory sslSocketFactory=(SSLSocketFactory) SSLSocketFactory.getDefault();
SSLSocket clientSocket =  (SSLSocket) sslSocketFactory.createSocket(serverListeningSSLSocket.getInetAddress(),
serverListeningSSLSocket.getLocalPort());
SSLSocket serverCommsSSLSocket = (SSLSocket) serverListeningSSLSocket.accept();
log.info("new client");
final byte[] bytes = "Hello World!".getBytes();
final OutputStream out = clientSocket.getOutputStream();
System.out.println("writing to stream");
out.write(bytes.length);
out.write(bytes);
System.out.println("reading from stream");
final DataInputStream in = new DataInputStream(serverCommsSSLSocket.getInputStream());
int len = in.read();
final byte[] b = new byte[len];
in.readFully(b);
System.out.println(new String(b));
clientSocket.close();
serverCommsSSLSocket.close();
serverListeningSSLSocket.close();
}
}

这会产生以下输出：

Nov 21, 2018 10:23:51 PM com.gamble.ssl.SSLServerClient main INFO: Server started
Nov 21, 2018 10:23:52 PM com.gamble.ssl.SSLServerClient main INFO: new client
writing to stream

即它阻碍了服务器套接字的启动。

我的问题是：为什么Java中的SSL服务器套接字连接会阻塞，而非SSL服务器套接字则不会

"翻转为明文？"是什么意思？

以下是您正在做的：

创建SSL服务器套接字
创建连接到SSL服务器套接字的普通套接字
从客户端发送一些数据
正在读取服务器端的一些数据

现在，SSL套接字需要加密的数据传输。但是你没有发送的数据没有加密，所以它不是有效的SSL，它会抛出一个异常——正如它所说，"无法识别的SSL消息"，因为你没有发送有效的SSL消息，而"明文连接？"是关于可能出了什么问题的提示。

您必须在连接的两侧使用SSL，否则它们无法正确地相互通信。

这个问题的简单答案是：

因为SSL握手是异步的，非SSL套接字不必执行该步骤。

好的-原始SSL代码有两个问题：

没有TrustStore:

System.setProperty( "javax.net.ssl.trustStore", "/path/KeyStore.jks");

因为握手是同步的，所以必须在不同的线程上启动客户端。即：
```
(new Thread() {
public void run() {
// do stuff
}
}).start();
```

所以代码看起来像：

import javax.net.ssl.SSLServerSocket;
import javax.net.ssl.SSLServerSocketFactory;
import javax.net.ssl.SSLSocket;
import javax.net.ssl.SSLSocketFactory;
import java.io.DataInputStream;
import java.io.IOException;
import java.io.OutputStream;
import java.util.logging.Logger;
public class SSLServerClient {
public static void main(String[] args) throws IOException {
System.setProperty("javax.net.ssl.keyStore", "/path/KeyStore.jks");
System.setProperty( "javax.net.ssl.trustStore", "/path/KeyStore.jks");
System.setProperty("javax.net.ssl.keyStorePassword", "password");
SSLServerSocketFactory sslserversocketfactory = (SSLServerSocketFactory) SSLServerSocketFactory.getDefault();
SSLServerSocket serverListeningSSLSocket = (SSLServerSocket) sslserversocketfactory.createServerSocket(4380);
System.out.println("--server started");
SSLSocketFactory sslSocketFactory=(SSLSocketFactory) SSLSocketFactory.getDefault();
SSLSocket clientSocket =  (SSLSocket) sslSocketFactory.createSocket(serverListeningSSLSocket.getInetAddress(),
serverListeningSSLSocket.getLocalPort());
SSLSocket serverCommsSSLSocket = (SSLSocket) serverListeningSSLSocket.accept();
System.out.println("--new client");
final byte[] bytes = "--Hello World!".getBytes();
final OutputStream out = clientSocket.getOutputStream();
System.out.println("--Gotten output stream");
final DataInputStream in = new DataInputStream(serverCommsSSLSocket.getInputStream());
(new Thread() {
public void run() {
System.out.println("--reading from stream");
int len = 0;
try {
len = in.read();
final byte[] b = new byte[len];
in.readFully(b);
System.out.println(new String(b));
} catch (IOException e) {
e.printStackTrace();
}
}
}).start();

System.out.println("--writing to stream");
out.write(bytes.length);
System.out.println("--writing to stream - length");
out.write(bytes);
clientSocket.close();
serverCommsSSLSocket.close();
serverListeningSSLSocket.close();
}
}

输出看起来像

--server started
--new client
--Gotten output stream
--writing to stream
--reading from stream
--writing to stream - length
--Hello World!
Process finished with exit code 0

完成

(注意，我在输出中添加了前导--，以帮助读取SSL调试输出。

相关内容

最新更新

热门标签：