SSL 통신과 관련되어 좋은 정보가 있어서 소개한다.
c언어를 이용하여 SSL 통신을 java로 컨버팅한것이다. HTTPClient를 이용하면 굉장히 쉽게 사용할 수 있다.
c언어 공부용으로 발췌함~^^
출처
서버(serv.c)
/* serv.cpp - Minimal ssleay server for Unix 30.9.1996, Sampo Kellomaki <sampo@iki.fi> */ /* mangled to work with SSLeay-0.9.0b and OpenSSL 0.9.2b Simplified to be even more minimal 12/98 - 4/99 Wade Scholine <wades@mail.cybg.com> */ #include <stdio.h> #include <unistd.h> #include <stdlib.h> #include <memory.h> #include <errno.h> #include <sys/types.h> #include <sys/socket.h> #include <netinet/in.h> #include <arpa/inet.h> #include <netdb.h> #include <openssl/rsa.h> /* SSLeay stuff */ #include <openssl/crypto.h> #include <openssl/x509.h> #include <openssl/pem.h> #include <openssl/ssl.h> #include <openssl/err.h> /* define HOME to be dir for key and cert files... */ #define HOME "./" /* Make these what you want for cert & key files */ #define CERTF HOME "server-req.pem" #define KEYF HOME "server-key.pem" #define CHK_NULL(x) if ((x)==NULL) exit (1) #define CHK_ERR(err,s) if ((err)==-1) { perror(s); exit(1); } #define CHK_SSL(err) if ((err)==-1) { ERR_print_errors_fp(stderr); exit(2); } void main () { int err; int listen_sd; int sd; struct sockaddr_in sa_serv; struct sockaddr_in sa_cli; size_t client_len; SSL_CTX* ctx; SSL* ssl; X509* client_cert; char* str; char buf [4096]; SSL_METHOD *meth; /* SSL preliminaries. We keep the certificate and key with the context. */ SSL_load_error_strings(); SSLeay_add_ssl_algorithms(); meth = TLSv1_server_method(); // create a new SSL_CTX object as framework for TLS/SSL enabled functions ctx = SSL_CTX_new (meth); if (!ctx) { ERR_print_errors_fp(stderr); exit(2); } if (SSL_CTX_use_certificate_file(ctx, CERTF, SSL_FILETYPE_PEM) <= 0) { ERR_print_errors_fp(stderr); exit(3); } if (SSL_CTX_use_PrivateKey_file(ctx, KEYF, SSL_FILETYPE_PEM) <= 0) { ERR_print_errors_fp(stderr); exit(4); } if (!SSL_CTX_check_private_key(ctx)) { fprintf(stderr,"Private key does not match the certificate public key\n"); exit(5); } /* Prepare TCP socket for receiving connections */ // Create Internet Socket and Fill sockaddr_in listen_sd = socket (AF_INET, SOCK_STREAM, 0); CHK_ERR(listen_sd, "socket"); memset (&sa_serv, '\0', sizeof(sa_serv)); sa_serv.sin_family = AF_INET; sa_serv.sin_addr.s_addr = INADDR_ANY; sa_serv.sin_port = htons (1111); /* Server Port number */ // Bind err = bind(listen_sd, (struct sockaddr*) &sa_serv, sizeof (sa_serv)); CHK_ERR(err, "bind"); // Listening err = listen (listen_sd, 5); CHK_ERR(err, "listen"); // Accept client_len = sizeof(sa_cli); sd = accept (listen_sd, (struct sockaddr*) &sa_cli, &client_len); CHK_ERR(sd, "accept"); // Close Listening socket close (listen_sd); // Connected-client info. printf ("Connection from %lx, port %d\n", sa_cli.sin_addr.s_addr, sa_cli.sin_port); // TCP connection is ready. Do server side SSL. // create a new SSL structure for a connection ssl = SSL_new (ctx); CHK_NULL(ssl); // connect the SSL object with a file descriptor SSL_set_fd (ssl, sd); err = SSL_accept (ssl); CHK_SSL(err); // Get the cipher - opt printf ("SSL connection using %s\n", SSL_get_cipher (ssl)); // Get client's certificate (note: beware of dynamic allocation) - opt client_cert = SSL_get_peer_certificate (ssl); if (client_cert != NULL) { printf ("Client certificate:\n"); str = X509_NAME_oneline (X509_get_subject_name (client_cert), 0, 0); CHK_NULL(str); printf ("\t subject: %s\n", str); free (str); str = X509_NAME_oneline (X509_get_issuer_name (client_cert), 0, 0); CHK_NULL(str); printf ("\t issuer: %s\n", str); free (str); /* We could do all sorts of certificate verification stuff here before deallocating the certificate. */ X509_free (client_cert); } else { printf ("Client does not have certificate.\n"); } // DATA EXCHANGE - Receive message and send reply. err = SSL_read (ssl, buf, sizeof(buf) - 1); CHK_SSL(err); buf[err] = '\0'; printf ("Got %d chars:'%s'\n", err, buf); err = SSL_write (ssl, "I hear you.", strlen("I hear you.")); CHK_SSL(err); /* Clean up. */ close (sd); SSL_free (ssl); SSL_CTX_free (ctx); }
클라이언트(cli.c)
/* cli.cpp - Minimal ssleay client for Unix 30.9.1996, Sampo Kellomaki <sampo@iki.fi> */ /* mangled to work with SSLeay-0.9.0b and OpenSSL 0.9.2b Simplified to be even more minimal 12/98 - 4/99 Wade Scholine <wades@mail.cybg.com> */ #include <stdio.h> #include <memory.h> #include <errno.h> #include <sys/types.h> #include <sys/socket.h> #include <netinet/in.h> #include <arpa/inet.h> #include <netdb.h> #include <unistd.h> #include <openssl/crypto.h> #include <openssl/x509.h> #include <openssl/pem.h> #include <openssl/ssl.h> #include <openssl/err.h> #define CHK_NULL(x) if ((x)==NULL) exit (1) #define CHK_ERR(err,s) if ((err)==-1) { perror(s); exit(1); } #define CHK_SSL(err) if ((err)==-1) { ERR_print_errors_fp(stderr); exit(2); } void print_x509(SSL *ssl) { char *ascii_cert; X509 *cert = SSL_get_peer_certificate(ssl); BIO *b; BUF_MEM *bptr; b = BIO_new(BIO_s_mem()); if(X509_print(b, cert) > 0) { BIO_get_mem_ptr(b, &bptr); ascii_cert = (char *)malloc(1 + bptr->length); memcpy(ascii_cert, bptr->data, bptr->length); } else { ascii_cert = (char *)malloc(1024); sprintf(ascii_cert, "This certificate has never been seen before and can't be shown\n"); } BIO_free(b); /* X.509 인증서 출력 */ printf("X.509:\n%s\n", ascii_cert); } void main (int argc, char **argv) { int err; int sd; struct sockaddr_in sa; SSL_CTX* ctx; SSL* ssl; X509* server_cert; char* str; char buf [4096]; char hello[80]; SSL_METHOD *meth; printf ("Message to send: "); fgets (hello, 80, stdin); SSLeay_add_ssl_algorithms(); //meth = SSLv2_client_method(); meth = TLSv1_client_method(); SSL_load_error_strings(); ctx = SSL_CTX_new (meth); CHK_NULL(ctx); CHK_SSL(err); /////////////////////////////////////////////////////////////////////////////////////// // Create a socket and connect to server using normal socket calls. sd = socket (AF_INET, SOCK_STREAM, 0); CHK_ERR(sd, "socket"); memset (&sa, '\0', sizeof(sa)); sa.sin_family = AF_INET; sa.sin_addr.s_addr = inet_addr ("203.247.40.139"); /* Server IP */ sa.sin_port = htons (atoi(argv[1])); /* Server Port number */ // Normal-connect err = connect(sd, (struct sockaddr*) &sa, sizeof(sa)); CHK_ERR(err, "connect"); // Now we have TCP conncetion. Start SSL negotiation. // create a new SSL structure for a connection ssl = SSL_new (ctx); CHK_NULL(ssl); // connect the SSL object with a file descriptor SSL_set_fd (ssl, sd); // initiate the TLS/SSL handshake with an TLS/SSL server err = SSL_connect (ssl); CHK_SSL(err); /* * Following two steps are optional and not required for * data exchange to be successful. */ printf ("SSL connection using %s\n", SSL_get_cipher (ssl)); // Get server's certificate (note: beware of dynamic allocation) - opt server_cert = SSL_get_peer_certificate (ssl); CHK_NULL(server_cert); print_x509(ssl); /* printf ("Server certificate:\n"); str = X509_NAME_oneline (X509_get_subject_name (server_cert),0,0); CHK_NULL(str); printf ("\t subject: %s\n", str); free (str); str = X509_NAME_oneline (X509_get_issuer_name (server_cert),0,0); CHK_NULL(str); printf ("\t issuer: %s\n", str); free (str); */ /* * We could do all sorts of certificate verification stuff here before * deallocating the certificate. */ X509_free (server_cert); /////////////////////////////////////////////////////////////////////////////////////// // DATA EXCHANGE - Send a message and receive a reply. //err = SSL_write (ssl, "Hello World!", strlen("Hello World!")); //CHK_SSL(err); err = SSL_write (ssl, hello, strlen(hello)); CHK_SSL(err); err = SSL_read (ssl, buf, sizeof(buf) - 1); CHK_SSL(err); buf[err] = '\0'; printf ("Got %d chars:'%s'\n", err, buf); // send SSL/TLS close_notify SSL_shutdown (ssl); /* Clean up. */ close (sd); SSL_free (ssl); SSL_CTX_free (ctx); }
서버의 개인키와 셀프 사인된 인증서 입니다. 그리고 인증서의 패스워드는 abcd 입니다.
*server-key.pem
-----BEGIN RSA PRIVATE KEY----- Proc-Type: 4,ENCRYPTED DEK-Info: DES-EDE3-CBC,AA26BA50E01C1524 oXXeC9GyPwvJxVyqRXROLXp5Ew5n/gS6+vpDXXSIsuE8RIk17Mtx1NpOGWxmQ/hd L9zAvDniOoavTyKyVI0VZx13A1RzptaSP1CqEBeQUlT5DU3IFhwdj8BRXfpaWrve NnCZiyvr5CNgSLg0pVvcUhI9CmQtj94bLN6KATbZ/FyQZTSkrN6kh1jBwHd04RvZ 2YvxtuzevtxvLLHOvxCxocIYnPWJzViEyuKbz/co3ywZibFXrqu2Xpgrk3lHN21M ZXWPeVJ2DzAIWMhqjpOX98w0hLHvZHVWpiO09avH/wzR7YbCKZpwFZUdjcUuzETZ OzJO3p97mf9D64KbAOmq7h6Pme8pkT/io8Qe24XyaV0C7ca67t3J3NSBVmyPNgEP MsfTctk98FfKmOXD7fm1y5k4YZ7weDuDRs09KNFxn6sm94Q5ssQmaAPNCVZTpGSW p6/sDb1dU8/2lTFFU67tquwR679h2AouF/Ea0Sa2l0o8HfcAS8YJxp77+W2qB9Zt ymkSJlvX7s5qt4oBryTOyDKVFzmzksjJHaar7tRJ00fTh+AICxxQvfzUE82oH49R +07clHW7DCh4FMevvflSujfIChVIwvwg2Vr1b63QIp8tlZ0BiPAZH8TV6cPDROVQ 5dWDQlcOrvfNsC1qI17kvn/N4ZzKyvdB4cEZh6xMH8UfFJ+qpNhJ1gwJFe9XI11z 90hSa9lsFqBBw2sGmnN9QxKC1UpdvjoZV1VTBEqGWYDR4S1lx575gm77nF9XcJAr pW7Fs9qKLWi7trWQxI0ncKQ6DGuGbh/ctebgchKe/kIA/4E0nQjTcg== -----END RSA PRIVATE KEY-----
*server-req.pem
-----BEGIN CERTIFICATE----- MIIDYjCCAsugAwIBAgIBADANBgkqhkiG9w0BAQQFADCBgzELMAkGA1UEBhMCQVUx EzARBgNVBAgTClNvbWUtU3RhdGUxDDAKBgNVBAcTA0ZvbzENMAsGA1UEChMETGFu ZDEMMAoGA1UECxMDRm9vMRYwFAYDVQQDEw1zbmFmdS5taXQuZWR1MRwwGgYJKoZI hvcNAQkBFg1mdWJvYkBtaXQuZWR1MB4XDTAwMTExMzAyMjgxMVoXDTAwMTIxMzAy MjgxMVowgYMxCzAJBgNVBAYTAkFVMRMwEQYDVQQIEwpTb21lLVN0YXRlMQwwCgYD VQQHEwNGb28xDTALBgNVBAoTBExhbmQxDDAKBgNVBAsTA0ZvbzEWMBQGA1UEAxMN c25hZnUubWl0LmVkdTEcMBoGCSqGSIb3DQEJARYNZnVib2JAbWl0LmVkdTCBnzAN BgkqhkiG9w0BAQEFAAOBjQAwgYkCgYEAtvnaO7XYscdlXoTwql5uHa5Vx1ecKZOc pSAqGQx4LnMGbRvnb+m2OxUZ3xFc8V1a2eKlUyTKoo0bebTeS5/BLBik47TjfUlw /P1hLYhIFZNb+o/g3ZeWG/9QZYs0favV+0iAoqpy/scHwHZg2Vnpjivsit543s+x uuWuD4fpUIsCAwEAAaOB4zCB4DAdBgNVHQ4EFgQUTkDDGu1osvRIZY/LlZdmRbAs rM0wgbAGA1UdIwSBqDCBpYAUTkDDGu1osvRIZY/LlZdmRbAsrM2hgYmkgYYwgYMx CzAJBgNVBAYTAkFVMRMwEQYDVQQIEwpTb21lLVN0YXRlMQwwCgYDVQQHEwNGb28x DTALBgNVBAoTBExhbmQxDDAKBgNVBAsTA0ZvbzEWMBQGA1UEAxMNc25hZnUubWl0 LmVkdTEcMBoGCSqGSIb3DQEJARYNZnVib2JAbWl0LmVkdYIBADAMBgNVHRMEBTAD AQH/MA0GCSqGSIb3DQEBBAUAA4GBAEmPUSEShK6tHGdwPUvwYwp7cR0mwRNi3peB vu5nqwjCnCFaQaUdBfh/18kT5uEpGB48A/6BImov36Aiq9cq6dVNGQkVI0y/FJ0J 28zSYrRHXGOS5qMoWRaqCabuYbDUsx/bvCr21ET948jMawdd8nq+3ungEQzlIZtO oWcmJYad -----END CERTIFICATE-----
*컴파일
# gcc -o serv serv.c -lssl -lcrypto # gcc -o serv cli.c -lssl -lcrypto
*실행
# ./serv Enter PEM pass phrase: abcd # ./cli Message to send: hello!!
이번에는 자바 클라이언트 입니다.. 여기에서 에러가 나는데.. 봐주세요..^^;
*SunSSLSocketClient.java
import java.io.*; import java.net.*; import java.security.*; import javax.net.ssl.*; public class SunSSLSocketClient { private static final String HOST = "127.0.0.1"; private static final int PORT = 1111; private static String [] socketProtocolVersion = new String[] {"TLSv1"}; public static void main(String [] args) throws Exception { char [] passPhrase = "abcd1234".toCharArray(); KeyStore keystore = KeyStore.getInstance("JKS"); keystore.load(new FileInputStream(".keystore"), passPhrase); TrustManagerFactory tmf = TrustManagerFactory.getInstance("SunX509"); tmf.init(keystore); SSLContext context = SSLContext.getInstance("TLS"); TrustManager [] trustManagers = tmf.getTrustManagers(); context.init(null, trustManagers, null); SSLSocketFactory sf = context.getSocketFactory(); SSLSocket socket = (SSLSocket)sf.createSocket(HOST, PORT); socket.setEnabledProtocols(socketProtocolVersion); System.out.println(socket); PrintWriter pw = new PrintWriter(new BufferedWriter(new OutputStreamWriter(socket.getOutputStream())), true); BufferedReader br = new BufferedReader(new InputStreamReader(socket.getInputStream())); pw.println("Hello!!"); String fromServer = br.readLine(); System.out.println(fromServer); } }
책에보니까 보통 이렇게 하더라구요.. 이렇게 코드를 작성하고 keytool을 사용해서 키저장소를 만들었습니다..
# keytool -genkey -keystore .keystore
.....
자바 클라이언트 실행
# java SunSSLSocketClient
'web' 카테고리의 다른 글
외부 컨텐츠를 가져오는 법 (0) | 2007.09.28 |
---|---|
jsp에서 한글이 깨지는 현상 (0) | 2007.09.28 |
아파치 래퍼럴 (apache referal) (0) | 2007.09.27 |
외부싸이트에서 호출되는 것 확인하기 (0) | 2007.09.22 |
HTTPClient을 이용한 로그인 테스트 (0) | 2007.09.19 |