Netty SSL服务器和客户端

Question

似乎服务器拒绝了wireshark输出中的tls协商，但我从代码中看不出原因。它是基于工作的代码，只是它被否决了，因此我用新的API更新。代码是开始。需要使用真实的证书。有人知道为什么服务器发送tcp FIN，ack吗？

我有以下服务器代码：

    ServerBootstrap sbssl = new ServerBootstrap();
    bossGroupSsl = new NioEventLoopGroup(1);
    workerGroupSsl = new NioEventLoopGroup();
    sbssl.group(bossGroupSsl, workerGroupSsl).option(ChannelOption.SO_RCVBUF, 8192).handler(new LoggingHandler(LogLevel.DEBUG))
            .option(ChannelOption.RCVBUF_ALLOCATOR, new FixedRecvByteBufAllocator(8192))
            .channel(NioServerSocketChannel.class)
            .childHandler(new ChannelInitializer<SocketChannel>() {

                @Override
                protected void initChannel(SocketChannel ch) throws Exception {
                    ChannelPipeline cp = ch.pipeline();
                    SelfSignedCertificate cert = new SelfSignedCertificate();
                    SslContext cont2 = SslContextBuilder.forServer(cert.privateKey(), cert.certificate()).build();
                    SSLEngine engine = cont2.newEngine(ch.alloc());
                    cp.addLast("ssl", new SslHandler(engine));

        Bootstrap b = new Bootstrap();
        group = new NioEventLoopGroup();
        Log.d(RegisterAttemptSSL.class.getName(), "connecting");
        InetSocketAddress ria = new InetSocketAddress(toHostname, portDestination);
        b.group(group).channel(NioSocketChannel.class).option(ChannelOption.IP_TOS, 24)
                .remoteAddress(ria).handler(new ChannelInitializer<SocketChannel>() {
            @Override
            protected void initChannel(SocketChannel ch) throws Exception {
                SslContext cont2 = SslContextBuilder.forClient().trustManager(InsecureTrustManagerFactory.INSTANCE).build();
                SSLEngine engine = cont2.newEngine(ch.alloc(), toHostname, portDestination);
                engine.setEnabledProtocols(new String[] {"TLSv1.2"});
                ch.pipeline().addLast(new SslHandler(engine, false));

23 16.856111 sonymobi_7f:55:af intelcor_25:1d:fc ARP 42 10.1.10.100在84:c7:ea:7f:55:af

24 16.856198 10.1.10.203 10.1.10.100 TCP 74 506 1→4683[SYN,ACK]SEQ=0 ACK=1 Win=8192 LEN=0 MSS=1460 WS=256 SACK_PERM=1 TSVAL=46199014 TSECR=62567382

25 16.859326 10.1.10.100 10.1.10.203 TCP 66 468 3→5061[ACK]SEQ=1 ACK=1 Win=87808 LEN=0 TSVAL=62567385 TSECR=46199014

26 16.872274 10.1.10.100 10.1.10.203 TLSv1 179客户您好

27 16.964375 10.1.10.203 10.1.10.100 TCP 66 506 1→4683[FIN,ACK]SEQ=1 ACK=114 Win=66560 LEN=0 TSVAL=46199026 TSECR=62567387

在服务器端使用此代码，除了channelReadComplete beeing触发而下一个处理程序的channelRead0触发beeing之外，其他代码都可以工作。相同的处理程序用于常规tcp并且没有这种怪癖也能正常工作。在客户端有一个nullpointer，但业务逻辑不受影响。

    ServerBootstrap sbssl = new ServerBootstrap();
    bossGroupSsl = new NioEventLoopGroup(1);
    workerGroupSsl = new NioEventLoopGroup();
    sbssl.group(bossGroupSsl, workerGroupSsl).option(ChannelOption.SO_RCVBUF, 8192)
            .option(ChannelOption.RCVBUF_ALLOCATOR, new FixedRecvByteBufAllocator(8192))
            .channel(NioServerSocketChannel.class).handler(new LoggingHandler(LogLevel.DEBUG))
            .childHandler(new ChannelInitializer<SocketChannel>() {

                @Override
                protected void initChannel(SocketChannel ch) throws Exception {
                    ChannelPipeline cp = ch.pipeline();
                    SelfSignedCertificate cert = new SelfSignedCertificate();
                    SslContext cont = SslContext.newServerContext(cert.certificate(), cert.privateKey());
                    cp.addLast("ssl", cont.newHandler(ch.alloc()));

01-26 15:34:34.546 318 23-31856/noo tobiassenit.sipclient W/system.err:io.netty.handler.codec.decoderexception:java.lang.nullpointerexception:ssl==null 01-26 15:34:34.546 318 23-31856/noo tobiassenit.sipclient W/system.err:at io.netty.handler.codec.bytetomessageDecoder.calldecode（bytetomessageDecoder.java:459)01-26 codec.bytetomessageDecoder.channelRead(BytetomessageDecoder.java:265)01-26 15:34:34.546 318 23-31856/noo tobiassenit.sipclient W/system.err：at io.netty.channel.abstractChannelHandlerContext.invokeChannelRead(abstractChannelHandlerContext.java:362)01-26 15:34:34.546 318 23-31856/noo tobiassenit.sipclient W/system.err：at:34.546 318 23-31856/noo tobiassenit.sipclient w/system.err：at io.netty.channel.abstractChannelHandlerContext.fireChannelRead（abstractChannelHandlerContext.java：340）01-26 15:34:34.546 318 23-31856/NO.Tobiassenit.SipClient W/System.err:at io.netty.channel.defaultchannelpipeline.java:1359)01-26 15:34:34.547 318 23-31856/NO.Tobiassenit.SipClient W/System.err:at io.netty.channel.AbstractChannelHandlerContext.InvokeChannelRead（AbstractChannelHandlerContext.java:362)01-26 15:34:34.547 318 23-31856/在io.netty.channel.abstractChannelHandlerContext.invokeChannelRead(abstractChannelHandlerContext.java:348)01-26 15:34:34.547 318 23-31856/noo tobiassenit.sipclient W/system.err:at io.netty.channel.defaultChannelPipeline.firechannelRead(DefaultChannelPipeline.java:935)01-26 15:34:34.547 318 23-31856/noo tobiassenit.sipclient 141）01-26 15:34:34.547 318 23-31856/noo tobiassenit.sipclient w/system.err：at io.netty.channel.nio.nioeventloop.processSelectedKey（NioEventLoop.java：645）01-26 15:34:34.547 318 23-31856/noo tobiassenit.sipclient W/system.err:at io.netty.channel.nio.nioeventloop.processSelectedKeysOptimized（nioeventloop.java：580）01-26 15:34:34.547 318 23-31856/noo tobiassenit.sipclient W/system.err:at io.netty.channel.nio.nioeventloop.processelectedKeys（channel.nio.nioeventloop.run（nioeventloop.java：459）01-26 15:34:34.547 318 23-31856/noo tobiassenit.sipclient W/system.err:at io.netty.util.concurrent.singlethreadeventexecutor.java：858）01-26 15:34:34.547 318 23-31856/noo tobiassenit.sipclient W/system.err:at io.netty.util.concurrent.858/noo tobiassenit.sipclient w/system.err：at java.lang.thread.run（thread.java：764）01-26 15:34:34.547 318 23-31856/noo tobiassenit.sipclient w/system.err：by：java.lang.nullpointerexcept离子：ssl==null 01-26 15:34:34.547 318 23-31856/Noo Tobiassenit.SipClient W/System.err：at com.android.org.conscrypt.nativecrypto.ssl_pending_readable_bytes（原生html" target="_blank">方法）01-26 15:34:34.547 318 23-31856/noo Tobiassenit.sipClient W/System.err：at com.android.org.conscrypt.opensslengineimpl.pendingInboundClearTextBytes（err：at com.android.org.conscrypt.opensslengineimpl.unwrap(opensslengineimpl.java:679)01-26 15:34:34.547 318 23-31856/noo tobiassenit.sipclient w/system.err：at com.android.org.conscrypt.opensslengineimpl.unwrap(opensslengineimpl.java:679)01-26 15:34:34.34.5.47 318 23-31856/noo tobiassenit.sipclient W/system.err:at io.netty.handler.ssl.sslhandler$sslenginetype$3.unwrap（sslhandler.java：292）01-26 15:34:34.547 318 23-31856/noo tobiassenit.sipclient W/system.err：at io.netty.handler.ssl.sslhandler.unwrap(sslhandler.java:1248)01-26 15:34:34.547 318 23-31856/noo tobiassenit.sipclient W/system.err：at io.netty.handler.sslhandler.decode(sslhandler.java:1248)01-26 15:34:34.547 318 23-31856/noo tobiassenit.sipclient w/system.err：at 34:34.547 318 23-31856/no.tobiassenit.sipclient W/system.err：at io.netty.handler.codec.bytetomessageDecoder.decoderemovalentryProtection（bytetomessageDecoder.java:489)01-26 15:34:34.547 318 23-31856/no.tobiassenit.sipclient W/system.err：at io.netty.handler.codec.bytetomessageDecoder.bytetomessageDecoder.calldecode（

即使没有使用新的api，问题似乎还是会发生--仅仅激活类就足够了。所以这是有效的：即使没有使用新的api，问题似乎还是会发生--只要激活类就足够了。所以这是有效的：

                    SelfSignedCertificate cert = new SelfSignedCertificate();
                    SslContext cont = SslContext.newServerContext(cert.certificate(), cert.privateKey());
                    //SslContext cont2 = SslContextBuilder.forServer(cert.privateKey(), cert.certificate()).build();
                    //SSLEngine engine = cont2.newEngine(ch.alloc());
                    //engine.setUseClientMode(true);;
                    //cp.addFirst("ssl", new SslHandler(engine));
                    cp.addFirst("ssl", cont.newHandler(ch.alloc()));

而这不是（tcp fin、ack):

                    SelfSignedCertificate cert = new SelfSignedCertificate();
                    SslContext cont = SslContext.newServerContext(cert.certificate(), cert.privateKey());
                    SslContext cont2 = SslContextBuilder.forServer(cert.privateKey(), cert.certificate()).build();
                    SSLEngine engine = cont2.newEngine(ch.alloc());
                    //cp.addFirst("ssl", new SslHandler(engine));
                    cp.addFirst("ssl", cont.newHandler(ch.alloc()));

Answer 1

Netty 4.1.20.final解决了服务器不响应的问题。但是，ChannelComplete在服务器端被调用了几次，在客户端有一个nullpointer。这些都不会影响客户机-服务器进程的功能。