安全保障：非公开网络环境下基于Netty框架不使用SSL证书实现WebSocket数据加密传输

2023-11-11 12:14:38

1、简介

WebSocket是一种双向通信协议，允许客户端和服务器进行全双工通信，并在双方之间建立一个持续的连接。WebSocket在许多应用场景中都有着广泛的使用，例如即时消息、在线游戏和金融交易等。

在WebSocket通信中，数据通常是通过HTTP协议传输的。为了保证数据的安全性和可靠性，通常会使用SSL证书对数据进行加密。但是，在某些情况下，服务器可能运行在专网环境中，无法访问互联网。在这种情况下，就无法使用SSL证书来加密数据。

2、实现方式

为了在不使用SSL证书的情况下实现WebSocket数据加密传输，我们可以使用Netty框架提供的加密功能。Netty是一个高性能的网络通信框架，它提供了丰富的加密功能，可以帮助我们轻松实现WebSocket数据加密传输。

3、服务端主要代码

import io.netty.bootstrap.ServerBootstrap;
import io.netty.channel.Channel;
import io.netty.channel.ChannelFuture;
import io.netty.channel.ChannelInitializer;
import io.netty.channel.ChannelOption;
import io.netty.channel.ChannelPipeline;
import io.netty.channel.EventLoopGroup;
import io.netty.channel.nio.NioEventLoopGroup;
import io.netty.channel.socket.SocketChannel;
import io.netty.channel.socket.nio.NioServerSocketChannel;
import io.netty.handler.codec.http.HttpObjectAggregator;
import io.netty.handler.codec.http.HttpServerCodec;
import io.netty.handler.codec.http.websocketx.WebSocketServerProtocolHandler;
import io.netty.handler.ssl.SslContext;
import io.netty.handler.ssl.util.SelfSignedCertificate;

public class WebSocketServer {

    private final int port;

    public WebSocketServer(int port) {
        this.port = port;
    }

    public void run() throws Exception {
        EventLoopGroup bossGroup = new NioEventLoopGroup();
        EventLoopGroup workerGroup = new NioEventLoopGroup();
        try {
            SelfSignedCertificate cert = new SelfSignedCertificate();
            SslContext sslCtx = SslContext.newServerContext(cert.certificate(), cert.privateKey());

            ServerBootstrap b = new ServerBootstrap();
            b.group(bossGroup, workerGroup)
             .channel(NioServerSocketChannel.class)
             .option(ChannelOption.SO_BACKLOG, 1024)
             .childHandler(new ChannelInitializer<SocketChannel>() {
                 @Override
                 public void initChannel(SocketChannel ch) throws Exception {
                     ChannelPipeline pipeline = ch.pipeline();
                     pipeline.addLast(sslCtx.newHandler(ch.alloc()));
                     pipeline.addLast(new HttpServerCodec());
                     pipeline.addLast(new HttpObjectAggregator(65536));
                     pipeline.addLast(new WebSocketServerProtocolHandler("/websocket"));
                     pipeline.addLast(new WebSocketServerHandler());
                 }
             });

            ChannelFuture f = b.bind(port).sync();

            System.out.println("WebSocket server started at port " + port);

            f.channel().closeFuture().sync();
        } finally {
            bossGroup.shutdownGracefully();
            workerGroup.shutdownGracefully();
        }
    }

    public static void main(String[] args) throws Exception {
        new WebSocketServer(8080).run();
    }
}

4、客户端主要代码

import io.netty.bootstrap.Bootstrap;
import io.netty.channel.Channel;
import io.netty.channel.ChannelFuture;
import io.netty.channel.ChannelInitializer;
import io.netty.channel.ChannelOption;
import io.netty.channel.ChannelPipeline;
import io.netty.channel.EventLoopGroup;
import io.netty.channel.nio.NioEventLoopGroup;
import io.netty.channel.socket.SocketChannel;
import io.netty.channel.socket.nio.NioSocketChannel;
import io.netty.handler.codec.http.DefaultHttpHeaders;
import io.netty.handler.codec.http.HttpClientCodec;
import io.netty.handler.codec.http.HttpObjectAggregator;
import io.netty.handler.codec.http.websocketx.WebSocketClientHandshakerFactory;
import io.netty.handler.codec.http.websocketx.WebSocketVersion;
import io.netty.handler.ssl.SslContext;
import io.netty.handler.ssl.util.InsecureTrustManagerFactory;

public class WebSocketClient {

    private final String host;
    private final int port;

    public WebSocketClient(String host, int port) {
        this.host = host;
        this.port = port;
    }

    public void run() throws Exception {
        EventLoopGroup group = new NioEventLoopGroup();
        try {
            SslContext sslCtx = SslContext.newClientContext(InsecureTrustManagerFactory.INSTANCE);

            Bootstrap b = new Bootstrap();
            b.group(group)
             .channel(NioSocketChannel.class)
             .option(ChannelOption.SO_KEEPALIVE, true)
             .handler(new ChannelInitializer<SocketChannel>() {
                 @Override
                 public void initChannel(SocketChannel ch) throws Exception {
                     ChannelPipeline pipeline = ch.pipeline();
                     pipeline.addLast(sslCtx.newHandler(ch.alloc()));
                     pipeline.addLast(new HttpClientCodec());
                     pipeline.addLast(new HttpObjectAggregator(65536));
                     pipeline.addLast(WebSocketClientHandshakerFactory.newHandshaker(
                             new DefaultHttpHeaders(),
                             WebSocketVersion.V13,
                             "/websocket",
                             true,
                             new DefaultHttpHeaders()));
                     pipeline.addLast(new WebSocketClientHandler());
                 }
             });

            ChannelFuture f = b.connect(host, port).sync();

            Channel channel = f.channel();

            System.out.println("WebSocket client connected to " + host + ":" + port);

            channel.closeFuture().sync();
        } finally {
            group.shutdownGracefully();
        }
    }

    public static void main(String[] args) throws Exception {
        new WebSocketClient("localhost", 8080).run();
    }
}