Jersey框架三：Jersey对HTTPS的支持

Jersey系列文章：

Jersey框架一：Jersey RESTful WebService框架简介

Jersey框架二：Jersey对JSON的支持

Jersey框架三：Jersey对HTTPS的支持

证书的生成过程这里就不介绍了，请参照：Java网络编程二：Java Secure(SSL/TLS) Socket实现 中的证书部分

代码结构如下：

Maven配置文件：

<project xmlns="http://maven.apache.org/POM/4.0.0"   
        xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"   
        xsi:schemaLocation="http://maven.apache.org/POM/4.0.0   
                http://maven.apache.org/xsd/maven-4.0.0.xsd">  
    <modelVersion>4.0.0</modelVersion>  
    <groupId>JERSEY</groupId>  
    <artifactId>JERSEY</artifactId>  
    <version>1.0</version>  
    <dependencies>          
        <dependency>  
            <groupId>com.sun.jersey</groupId>  
            <artifactId>jersey-client</artifactId>  
            <version>1.18</version>  
        </dependency>  
        <dependency>  
            <groupId>com.sun.jersey</groupId>  
            <artifactId>jersey-grizzly2</artifactId>  
            <version>1.18</version>  
        </dependency>  
        <dependency>  
            <groupId>com.sun.jersey</groupId>  
            <artifactId>jersey-json</artifactId>  
            <version>1.18</version>  
        </dependency>  
        <dependency>  
            <groupId>org.glassfish.jersey.media</groupId>  
            <artifactId>jersey-media-json-jackson</artifactId>  
            <version>2.15</version>  
        </dependency>  
    </dependencies>  
</project>  

Person类是基本的JAXB：

package com.sean;  
  
import java.util.List;  
  
import javax.xml.bind.annotation.XmlRootElement;  
  
@XmlRootElement  
public class Person {  
    private String name;  
    private List<String> addresses;  
      
    public Person(){}  
      
    public String getName() {  
        return name;  
    }  
      
    public void setName(String name) {  
        this.name = name;  
    }  
      
    public List<String> getAddresses() {  
        return addresses;  
    }  
      
    public void setAddresses(List<String> addresses) {  
        this.addresses = addresses;  
    }  
}  

客户端代码：

package com.sean;  
  
import java.net.URI;  
  
import javax.net.ssl.SSLContext;  
import javax.ws.rs.core.MediaType;  
import javax.ws.rs.core.UriBuilder;  
  
import org.glassfish.jersey.SslConfigurator;  
  
import com.sun.jersey.api.client.Client;  
import com.sun.jersey.api.client.ClientResponse;  
import com.sun.jersey.api.client.WebResource;  
import com.sun.jersey.api.client.config.ClientConfig;  
import com.sun.jersey.api.client.config.DefaultClientConfig;  
import com.sun.jersey.client.urlconnection.HTTPSProperties;  
  
public class SSLClient {  
    public static void main(String[] args) {  
        int authType =  
                Integer.valueOf(Config.getConfig().getProperty("authority")).intValue();  
          
        SslConfigurator sslConfig = SslConfigurator.newInstance();  
        if(authType == 1){  
            sslConfig.trustStoreFile(Config.getConfig().getProperty("clientTrustCer"))  
                    .trustStorePassword(Config.getConfig().getProperty("clientTrustCerPwd"));  
        }else if(authType == 2){  
            sslConfig.keyStoreFile(Config.getConfig().getProperty("clientCer"))  
                    .keyStorePassword(Config.getConfig().getProperty("clientCerPwd"))  
                    .keyPassword(Config.getConfig().getProperty("clientKeyPwd"))  
                    .trustStoreFile(Config.getConfig().getProperty("clientTrustCer"))  
                    .trustStorePassword(Config.getConfig().getProperty("clientTrustCerPwd"));  
        }  
        sslConfig.securityProtocol(Config.getConfig().getProperty("protocol"));  
        SSLContext sslContext = sslConfig.createSSLContext();  
          
        ClientConfig cc = new DefaultClientConfig();  
        cc.getProperties().put(HTTPSProperties.PROPERTY_HTTPS_PROPERTIES,   
                new HTTPSProperties(new MyHostnameVerifier(), sslContext));  
        Client client = Client.create(cc);  
          
        URI uri = UriBuilder.fromUri("https://127.0.0.1/queryAddress").port(10000).build();  
        WebResource resource = client.resource(uri);  
          
        Person person = new Person();  
        person.setName("sean");  
          
        ClientResponse response = resource  
                .accept(MediaType.APPLICATION_XML)  
                .type(MediaType.APPLICATION_XML)  
                .post(ClientResponse.class, person);  
          
        String addresses = response.getEntity(String.class);  
        System.out.println(addresses);  
    }  
}  

SSL握手过程中，会对请求IP或请求域名进行校验，如果在证书信息中无法找到相关请求IP或请求域名则会报错（javax.NET.ssl.SSLHandshakeException: Java.security.cert.CertificateException: No subject alternative names present）

这里实现自己的校验逻辑（如果请求的IP为127.0.0.1或请求的域名为localhost，则直接通过校验）以覆盖默认逻辑

package com.sean;  
  
import javax.net.ssl.HostnameVerifier;  
import javax.net.ssl.SSLSession;  
  
public class MyHostnameVerifier implements HostnameVerifier {  
  
    @Override  
    public boolean verify(String hostname, SSLSession session) {  
        if("127.0.0.1".equals(hostname) || "localhost".equals(hostname) )  
            return true;  
        else  
            return false;  
    }  
}  

服务端代码：

package com.sean;  
   
import java.io.IOException;  
import java.net.URI;  
import java.util.ArrayList;  
import java.util.List;  
  
import javax.net.ssl.SSLContext;  
import javax.ws.rs.Consumes;  
import javax.ws.rs.POST;  
import javax.ws.rs.Path;  
import javax.ws.rs.Produces;  
import javax.ws.rs.core.MediaType;  
import javax.ws.rs.core.UriBuilder;  
  
import org.glassfish.grizzly.http.server.HttpHandler;  
import org.glassfish.grizzly.http.server.HttpServer;  
import org.glassfish.grizzly.ssl.SSLEngineConfigurator;  
import org.glassfish.jersey.SslConfigurator;  
  
import com.sun.jersey.api.container.ContainerFactory;  
import com.sun.jersey.api.container.grizzly2.GrizzlyServerFactory;  
import com.sun.jersey.api.core.PackagesResourceConfig;  
import com.sun.jersey.api.core.ResourceConfig;  
   
@Path("queryAddress")   
public class SSLServer {  
      
    @POST  
    @Consumes(MediaType.APPLICATION_XML)  
    @Produces(MediaType.APPLICATION_XML)  
    public Person queryAddress(String name) {  
        System.out.println(name);  
          
        Person person = new Person();  
        List<String> addresses = new ArrayList<String>();  
        addresses.add("address1");  
        addresses.add("address2");  
        person.setAddresses(addresses);  
        return person;  
    }  
      
    public static void main(String[] args) {  
        Integer authType =   
                Integer.valueOf(Config.getConfig().getProperty("authority")).intValue();  
          
        SslConfigurator sslConfig = SslConfigurator.newInstance();  
        if(authType == 1){  
            sslConfig.keyStoreFile(Config.getConfig().getProperty("serverCer"))  
                    .keyStorePassword(Config.getConfig().getProperty("serverCerPwd"))  
                    .keyPassword(Config.getConfig().getProperty("serverKeyPwd"));  
        }else if(authType == 2){  
            sslConfig.keyStoreFile(Config.getConfig().getProperty("serverCer"))  
                    .keyStorePassword(Config.getConfig().getProperty("serverCerPwd"))  
                    .keyPassword(Config.getConfig().getProperty("serverKeyPwd"))  
                    .trustStoreFile(Config.getConfig().getProperty("serverTrustCer"))  
                    .trustStorePassword(Config.getConfig().getProperty("serverTrustCerPwd"));  
        }  
        sslConfig.securityProtocol(Config.getConfig().getProperty("protocol"));  
        SSLContext sslContext = sslConfig.createSSLContext();  
          
        SSLEngineConfigurator sslEngineConfig = new SSLEngineConfigurator(sslContext);  
        //默认情况下是客户端模式，如果忘记修改模式  
        //会抛出异常  
        //javax.net.ssl.SSLProtocolException: Handshake message sequence violation, 1]  
        sslEngineConfig.setClientMode(false);  
        if(authType == 1)  
            sslEngineConfig.setWantClientAuth(true);  
        else if(authType == 2)  
            sslEngineConfig.setNeedClientAuth(true);  
              
        ResourceConfig rc = new PackagesResourceConfig("com.sean");  
        HttpHandler handler = ContainerFactory.createContainer(  
                HttpHandler.class, rc);  
          
        URI uri = UriBuilder.fromUri("https://127.0.0.1/").port(10000).build();  
        try {  
            HttpServer server = GrizzlyServerFactory.createHttpServer(uri, handler, true,   
                    sslEngineConfig);  
            server.start();  
        } catch (IllegalArgumentException e) {  
            e.printStackTrace();  
        } catch (NullPointerException e) {  
            e.printStackTrace();  
        } catch (IOException e) {  
            e.printStackTrace();  
        }  
        try {  
            Thread.sleep(1000*1000);  
        } catch (InterruptedException e) {  
            e.printStackTrace();  
        }  
    }  
}  

配置文件类：

package com.sean;  
  
import java.io.File;  
import java.io.FileInputStream;  
import java.io.InputStream;  
import java.util.Properties;  
  
public class Config{  
    private static Properties config;  
      
    public static Properties getConfig(){  
        try{  
            if(null == config){  
                File configFile =   
                        new File("src/main/resources/config/config.properties");  
                if(configFile.exists() && configFile.isFile()  
                        && configFile.canRead()){  
                    InputStream input = new FileInputStream(configFile);  
                    config = new Properties();  
                    config.load(input);  
                }  
            }  
        }catch(Exception e){  
            //default set  
            config = new Properties();  
            config.setProperty("authority", String.valueOf(1));  
            config.setProperty("protocol", "SSL");  
            config.setProperty("serverCer", "src/main/resources/certificate/server.jks");  
            config.setProperty("serverCerPwd", "1234sp");  
            config.setProperty("serverKeyPwd", "1234kp");  
            config.setProperty("serverTrustCer", "src/main/resources/certificate/serverTrust.jks");  
            config.setProperty("serverTrustCerPwd", "1234sp");  
            config.setProperty("clientCer", "src/main/resources/certificate/client.jks");  
            config.setProperty("clientCerPwd", "1234sp");  
            config.setProperty("clientKeyPwd", "1234kp");  
            config.setProperty("clientTrustCer", "src/main/resources/certificate/clientTrust.jks");  
            config.setProperty("clientTrustCerPwd", "1234sp");  
        }  
        return config;  
    }  
}  

配置文件config.properties：

#1：单向认证，只有服务器端需证明其身份      
#2：双向认证，服务器端和客户端都需证明其身份  
authority=2  
#通信协议    
protocol=SSL  
#服务端证书信息    
serverCer=src/main/resources/certificate/server.jks  
#keystore的storepass    
serverCerPwd=1234sp  
#keystore的keypass    
serverKeyPwd=1234kp  
#服务端证书信息    
serverTrustCer=src/main/resources/certificate/serverTrust.jks  
serverTrustCerPwd=1234sp  
#客户端证书信息    
clientCer=src/main/resources/certificate/client.jks  
clientCerPwd=1234sp  
clientKeyPwd=1234kp  
clientTrustCer=src/main/resources/certificate/clientTrust.jks  
clientTrustCerPwd=1234sp  

服务端运行结果：

三月 03, 2015 3:30:54 下午 com.sun.jersey.api.core.PackagesResourceConfig init  
INFO: Scanning for root resource and provider classes in the packages:  
  com.sean  
三月 03, 2015 3:30:54 下午 com.sun.jersey.api.core.ScanningResourceConfig logClasses  
INFO: Root resource classes found:  
  class com.sean.SSLServer  
三月 03, 2015 3:30:54 下午 com.sun.jersey.api.core.ScanningResourceConfig init  
INFO: No provider classes found.  
三月 03, 2015 3:30:54 下午 com.sun.jersey.server.impl.application.WebApplicationImpl _initiate  
INFO: Initiating Jersey application, version 'Jersey: 1.18 11/22/2013 01:21 AM'  
三月 03, 2015 3:30:55 下午 org.glassfish.grizzly.http.server.NetworkListener start  
INFO: Started listener bound to [127.0.0.1:10000]  
三月 03, 2015 3:30:55 下午 org.glassfish.grizzly.http.server.HttpServer start  
INFO: [HttpServer] Started.  
<?xml version="1.0" encoding="UTF-8" standalone="yes"?><person><name>sean</name></person>  

客户端运行结果

<?xml version="1.0" encoding="UTF-8" standalone="yes"?><person><addresses>address1</addresses><addresses>address2</addresses></person>