普通Netty中沒有密碼套件

Question

我一直在嘗試在服務器和客戶端之間使用Java上的Netty進行相互身份驗證。

我已經通過以下幾個示例使用java keytool生成了證書。 我嘗試在客戶端和服務器中手動設置密碼套件。 我可以使代碼正常工作的唯一方法是關閉客戶端身份驗證。

ssl調試輸出未提供任何結論性信息。 如果有人可以給我一些指導以解決我的問題，那將對我有很大幫助。

客戶代碼：

@Override public void initChannel(SocketChannel ch) throws Exception {
    ChannelPipeline pipeline = ch.pipeline();

    String password = "blablabla";

    KeyStore ks = KeyStore.getInstance("JKS");
    InputStream readStream = getClass().getResourceAsStream("clientCert.jks");
    ks.load(readStream,
            password.toCharArray());

    TrustManagerFactory tmFactory = TrustManagerFactory.getInstance(TrustManagerFactory
            .getDefaultAlgorithm());
    tmFactory.init(ks);

    KeyManagerFactory kmf = KeyManagerFactory.getInstance(KeyManagerFactory.getDefaultAlgorithm());
    kmf.init(ks, password.toCharArray());

    SSLContext sslContext = SSLContext.getInstance("TLS");
    sslContext.init(kmf.getKeyManagers(), tmFactory.getTrustManagers(), null);

    SSLEngine sslEngine = sslContext.createSSLEngine();
    sslEngine.setUseClientMode(true);

    sslEngine.setEnabledProtocols(sslEngine.getSupportedProtocols());
    sslEngine.setEnabledCipherSuites(new String[]{"TLS_RSA_WITH_AES_128_CBC_SHA"});
    sslEngine.setEnableSessionCreation(true);

    pipeline.addFirst("SSL", new SslHandler(sslEngine));

    pipeline.addLast(new ProtobufVarint32FrameDecoder());
    pipeline.addLast(new ProtobufDecoder(Messaging.BaseMessage.getDefaultInstance()));
    pipeline.addLast(new ProtobufVarint32LengthFieldPrepender());
    pipeline.addLast(new ProtobufEncoder());

    // and then business logic.
    pipeline.addLast(new ServerHandlerCorrelator());
}

服務器代碼：

@Override public void initChannel(SocketChannel ch) throws Exception {
    ChannelPipeline pipeline = ch.pipeline();

    String password = "blablabla";

    KeyStore ks = KeyStore.getInstance("JKS");
    // Use nettyserver.jks do client side authentication
    InputStream readStream = getClass().getResourceAsStream("serverCert.jks");
    ks.load(readStream,
            password.toCharArray());

    TrustManagerFactory tmFactory = TrustManagerFactory.getInstance(TrustManagerFactory
            .getDefaultAlgorithm());
    tmFactory.init(ks);

    KeyManagerFactory kmf = KeyManagerFactory.getInstance(KeyManagerFactory.getDefaultAlgorithm());
    kmf.init(ks, password.toCharArray());

    SSLContext sslContext = SSLContext.getInstance("TLS");
    sslContext.init(kmf.getKeyManagers(), tmFactory.getTrustManagers(), null);

    SSLEngine sslEngine = sslContext.createSSLEngine();
    sslEngine.setUseClientMode(false);
    sslEngine.setNeedClientAuth(true);
    sslEngine.setEnabledProtocols(sslEngine.getSupportedProtocols());
    sslEngine.setEnabledCipherSuites(new String[]{"TLS_RSA_WITH_AES_128_CBC_SHA"});
    sslEngine.setEnableSessionCreation(true);

    // Add SSL handler into pipeline
    pipeline.addFirst("SSL", new SslHandler(sslEngine));

    // Add protobuf handler into pipeline
    pipeline.addLast(new ProtobufVarint32FrameDecoder());
    pipeline.addLast(new ProtobufDecoder(Messaging.BaseMessage.getDefaultInstance()));
    pipeline.addLast(new ProtobufVarint32LengthFieldPrepender());
    pipeline.addLast(new ProtobufEncoder());

    // Add custom handler
    pipeline.addLast(new ServerHandler());
}

服務器SSL日志：

trigger seeding of SecureRandom
done seeding SecureRandom
Using SSLEngineImpl.
Allow unsafe renegotiation: false
Allow legacy hello messages: true
Is initial handshake: true
Is secure renegotiation: false
Ignoring disabled protocol: SSLv3
%% No cached client session
*** ClientHello, TLSv1.2
RandomCookie:  GMT: 1479318961 bytes = { 32, 234, 91, 96, 106, 19, 244, 166, 143, 174, 72, 157, 75, 108, 113, 168, 230, 206, 9, 133, 102, 255,     246, 237, 100, 250, 62, 211 }
Session ID:  {}
Cipher Suites: [TLS_RSA_WITH_AES_128_CBC_SHA]
Compression Methods:  { 0 }
Extension signature_algorithms, signature_algorithms: SHA512withECDSA, SHA512withRSA, SHA384withECDSA, SHA384withRSA, SHA256withECDSA,     SHA256withRSA, SHA256withDSA, SHA224withECDSA, SHA224withRSA, SHA224withDSA, SHA1withECDSA, SHA1withRSA, SHA1withDSA
Extension renegotiation_info, renegotiated_connection: <empty>
***
[write] MD5 and SHA1 hashes:  len = 84
0000: 01 00 00 50 03 03 58 2D   9E B1 20 EA 5B 60 6A 13  ...P..X-.. .[`j.
0010: F4 A6 8F AE 48 9D 4B 6C   71 A8 E6 CE 09 85 66 FF  ....H.Klq.....f.
0020: F6 ED 64 FA 3E D3 00 00   02 00 2F 01 00 00 25 00  ..d.>...../...%.
0030: 0D 00 1C 00 1A 06 03 06   01 05 03 05 01 04 03 04  ................
0040: 01 04 02 03 03 03 01 03   02 02 03 02 01 02 02 FF  ................
0050: 01 00 01 00                                        ....
nioEventLoopGroup-2-1, WRITE: TLSv1.2 Handshake, length = 84
[write] MD5 and SHA1 hashes:  len = 47
0000: 01 03 03 00 06 00 00 00   20 00 00 2F 00 00 FF 58  ........ ../...X
0010: 2D 9E B1 20 EA 5B 60 6A   13 F4 A6 8F AE 48 9D 4B  -.. .[`j.....H.K
0020: 6C 71 A8 E6 CE 09 85 66   FF F6 ED 64 FA 3E D3     lq.....f...d.>.
nioEventLoopGroup-2-1, WRITE: SSLv2 client hello message, length = 47
[Raw write]: length = 49
0000: 80 2F 01 03 03 00 06 00   00 00 20 00 00 2F 00 00  ./........ ../..
0010: FF 58 2D 9E B1 20 EA 5B   60 6A 13 F4 A6 8F AE 48  .X-.. .[`j.....H
0020: 9D 4B 6C 71 A8 E6 CE 09   85 66 FF F6 ED 64 FA 3E  .Klq.....f...d.>
0030: D3                                                 .
6539 [nioEventLoopGroup-2-1] DEBUG one.ppdrforensics.server.comms.ServerHandlerCorrelator  - NETTY Connected to Correlator
nioEventLoopGroup-2-1, called closeOutbound()
nioEventLoopGroup-2-1, closeOutboundInternal()
nioEventLoopGroup-2-1, SEND TLSv1.2 ALERT:  warning, description = close_notify
nioEventLoopGroup-2-1, WRITE: TLSv1.2 Alert, length = 2
nioEventLoopGroup-2-1, called closeInbound()
nioEventLoopGroup-2-1, fatal error: 80: Inbound closed before receiving peer's close_notify: possible truncation attack?
javax.net.ssl.SSLException: Inbound closed before receiving peer's close_notify: possible truncation attack?
nioEventLoopGroup-2-1, SEND TLSv1.2 ALERT:  fatal, description = internal_error
nioEventLoopGroup-2-1, Exception sending alert: java.io.IOException: writer side was already closed.

客戶端SSL日志：

trigger seeding of SecureRandom
done seeding SecureRandom
Using SSLEngineImpl.
Allow unsafe renegotiation: false
Allow legacy hello messages: true
Is initial handshake: true
Is secure renegotiation: false
Ignoring disabled protocol: SSLv3
[Raw read]: length = 5
0000: 80 2F 01 03 03                                     ./...
[Raw read]: length = 44
0000: 00 06 00 00 00 20 00 00   2F 00 00 FF 58 2D 9E B1  ..... ../...X-..
0010: 20 EA 5B 60 6A 13 F4 A6   8F AE 48 9D 4B 6C 71 A8   .[`j.....H.Klq.
0020: E6 CE 09 85 66 FF F6 ED   64 FA 3E D3              ....f...d.>.
[read] MD5 and SHA1 hashes:  len = 3
0000: 01 03 03                                           ...
[read] MD5 and SHA1 hashes:  len = 44
0000: 00 06 00 00 00 20 00 00   2F 00 00 FF 58 2D 9E B1  ..... ../...X-..
0010: 20 EA 5B 60 6A 13 F4 A6   8F AE 48 9D 4B 6C 71 A8   .[`j.....H.Klq.
0020: E6 CE 09 85 66 FF F6 ED   64 FA 3E D3              ....f...d.>.
nioEventLoopGroup-3-1, READ:  SSL v2, contentType = Handshake, translated length = 47
*** ClientHello, TLSv1.2
RandomCookie:  GMT: 1479318961 bytes = { 32, 234, 91, 96, 106, 19, 244, 166, 143, 174, 72, 157, 75, 108, 113, 168, 230, 206, 9, 133, 102, 255,     246, 237, 100, 250, 62, 211 }
Session ID:  {}
Cipher Suites: [TLS_RSA_WITH_AES_128_CBC_SHA, TLS_EMPTY_RENEGOTIATION_INFO_SCSV]
Compression Methods:  { 0 }
***
%% Initialized:  [Session-1, SSL_NULL_WITH_NULL_NULL]
nioEventLoopGroup-3-1, fatal error: 40: no cipher suites in common
javax.net.ssl.SSLHandshakeException: no cipher suites in common
%% Invalidated:  [Session-1, SSL_NULL_WITH_NULL_NULL]
nioEventLoopGroup-3-1, SEND TLSv1.2 ALERT:  fatal, description = handshake_failure
nioEventLoopGroup-3-1, WRITE: TLSv1.2 Alert, length = 2
nioEventLoopGroup-3-1, fatal: engine already closed.  Rethrowing javax.net.ssl.SSLHandshakeException: no cipher suites in common
nioEventLoopGroup-3-1, called closeOutbound()
nioEventLoopGroup-3-1, closeOutboundInternal()
nioEventLoopGroup-3-1, called closeInbound()
nioEventLoopGroup-3-1, fatal: engine already closed.  Rethrowing javax.net.ssl.SSLException: Inbound closed before receiving peer's close_notify:     possible truncation attack?
0    [nioEventLoopGroup-3-1] ERROR one.ppdrforensics.correlator.comms.ServerHandler  - [exceptionCaught] Exception     javax.net.ssl.SSLHandshakeException: no cipher suites in common
nioEventLoopGroup-3-1, called closeOutbound()
nioEventLoopGroup-3-1, closeOutboundInternal()
nioEventLoopGroup-3-1, called closeInbound()
nioEventLoopGroup-3-1, closeInboundInternal()

Answer 1

您能否使用-Djavax.net.debug = ssl：all參數啟用進行調試？ 它將提供有關SSLhandshake的更多信息。 請查找客戶端和服務器證書的類型。 它們是DSA還是RSA證書？ 嘗試安全連接到服務器時，Java“沒有通用密碼套件”問題