是否可以将普通套接字更改为 SSLSocket? [英] Is it possible to change plain socket to SSLSocket?

问题描述

有一个普通的套接字服务器监听端口 12345;

There is a plain socket server listening on port 12345;

ServerSocket s = new ServerSocket(12345);

我想知道的是:

1. 如果客户端发送一个http请求，服务器直接处理请求，
2. 如果客户端发送一个 https 请求，服务器将客户端套接字更改为 SSLSocket?

1. If the client send a http request, the server handle the request directly,
2. If the client send a https request, the server change client socket to SSLSocket?

谢谢

推荐答案

是否可以更换普通的socket到 SSLSocket?

Is it possible to change plain socket to SSLSocket?

是的，是的.在服务器端，以下工作:

Yes, it is. On the server side, the following works:

ServerSocketFactory ssf = ServerSocketFactory.getDefault();
ServerSocket serverSocket = ssf.createServerSocket(12345);

// I've initialised an sslContext with a keystore, as you normally would.
Socket socket = serverSocket.accept();
SSLSocketFactory sslSf = sslContext.getSocketFactory();
// The host name doesn't really matter, since we're turning it into a server socket
// (No need to match the host name to the certificate on this side).
SSLSocket sslSocket = (SSLSocket) sslSf.createSocket(socket, null,
    socket.getPort(), false);
sslSocket.setUseClientMode(false);

// Use the sslSocket InputStream/OutputStream as usual.

SSLSocketFactory.createSocket(Socket, ...) 默认会将现有的 Socket 转换为客户端模式的 SSLSocket.由于握手仅在您开始使用 I/O 流进行读/写时才开始，因此仍然需要使用 setUseClientMode(false) 更改模式.

SSLSocketFactory.createSocket(Socket, ...) will by default convert the existing Socket into a client-mode SSLSocket. Since the handshake only starts when you start reading/writing with the I/O streams, it's still time to change the mode using setUseClientMode(false).

关于剩下的问题:

我想知道的是可能:

• 如果客户端发送http请求，服务器处理请求直接，
• 如果客户端发送https请求，服务器改变客户端套接字到 SSLSocket?

再说一次，是的，这是可能的.它有时被称为端口统一"，它是 在 Grizzly 中实施，因此 Glassfish.

Again, yes, it's possible. It's sometimes referred to as "port unification" and it's implemented in Grizzly and thus Glassfish.

之所以有效，是因为 HTTP 和 TLS(HTTPS 的工作原理)都是客户端应该首先进行通信的协议.因此，服务器可以检测客户端最初发送的是 TLS ClientHello 消息(在这种情况下它应该尝试继续进行 TLS 握手)还是普通的 HTTP 请求(例如 GET/HTTP/1.1...).

It works because both HTTP and TLS (upon which HTTPS works) are protocols where the client is expected to talk first. Therefore, the server can detect whether what the client initially sends is a TLS ClientHello message (in which case it should try to proceed with the TLS handshake) or a plain HTTP request (e.g. GET / HTTP/1.1...).

我怀疑使用 SSLEngine 进行端口统一更容易"，否则，可能很难在普通套接字上实现预读，您仍然可以通过 <代码>SSLSocketFactory.createSocket(Socket, ...).

I suspect port unification is "easier" to do using SSLEngine, otherwise, it might be hard to implement a read-ahead on a plain socket, which you would still be able to convert via SSLSocketFactory.createSocket(Socket, ...).

请注意，这仍然很不寻常.

Note that this is still rather unusual, though.

这篇关于是否可以将普通套接字更改为 SSLSocket?的文章就介绍到这了，希望我们推荐的答案对大家有所帮助，也希望大家多多支持IT屋！