Avatar billede fredand Forsker
11. april 2005 - 15:59 Der er 6 kommentarer og
1 løsning

How to use XML-RPC with SSL

Hello!

I'm playing around with XML-RPC package from org.apache.xmlrpc. I mange to create a server with a client with out SSL, but when I try to add SSL to it, it crashes.

First i create a keystore like:
keytool -genkey -alias testkeys -keystore testkeys -keypass password -dname "cn=Fredrik_Andersson" -storepass password

I do not know if I need to create any certificates or something, if I do please tell me how.

The code for this looks like below.

So if you got any solution please let me know.

Best regards
Fredrik

Server:
import java.io.*;
import org.apache.xmlrpc.secure.*;

public class PrimeTimeSecureServer
{
    public PrimeTimeSecureServer()
    {
        try
        {
            SecureWebServer secureWebServer = new SecureWebServer(7777);
            secureWebServer.addHandler("prime_time_handler", new PrimeTimeHandler());
        secureWebServer.start();
        }
        catch (Exception e)
        {
            e.printStackTrace();
        }
    }

    public static void main(String[] args)
    {
        PrimeTimeSecureServer primeTimeSecureServer = new PrimeTimeSecureServer();
    }
}

Client handler:
import java.util.*;
import org.apache.xmlrpc.*;

public class PrimeTimeHandler implements AuthenticatedXmlRpcHandler
{
    public Object execute(String methodName, Vector parameters, String user, String password) throws Exception
    {
        System.out.println(methodName);
        if (methodName.equals("prime_time_handler.getPrimeTime"))
        {
                return getPrimeTime((String) parameters.elementAt(0));
        }
        else
        {
                throw new Exception("No such method!");
        }
    }

    public String getPrimeTime(String password)
    {
        if(password.equals("give_me_prime_time"))
        {
            Calendar rightNow = Calendar.getInstance();
            return "Prime time is: " + rightNow.getTime().toString();
        }
        else
        {
            return "WRONG PASSWORD";
        }
    }
}

Client:
import org.apache.xmlrpc.secure.*;
import java.util.*;

public class PrimeTimeSecureClient
{
    public PrimeTimeSecureClient()
    {
        try
        {
            SecureXmlRpcClient secureXmlRpcClient = new SecureXmlRpcClient("https://localhost:7777/");
            //secureXmlRpcClient.setBasicAuthentication("frean", "password");

            Vector params = new Vector();
            params.addElement("give_me_prime_time");

            String answer = (String)secureXmlRpcClient.execute("prime_time_handler.getPrimeTime", params);
            System.out.println(answer);
        }
        catch (Exception e)
        {
            e.printStackTrace();
        }
    }

    public static void main(String[] args)
    {
        PrimeTimeSecureClient primeTimeSecureClient = new PrimeTimeSecureClient();
    }
}
Avatar billede fredand Forsker
11. april 2005 - 16:03 #1
I forgot the mention the message from the server:
javax.net.ssl.SSLHandshakeException: Received fatal alert: certificate_unknown

And the message from the client:
java.io.IOException: sun.security.validator.ValidatorException: PKIX path buildi
ng failed: sun.security.provider.certpath.SunCertPathBuilderException: unable to
find valid certification path to requested target

Any ideas?
Avatar billede arne_v Ekspert
11. april 2005 - 16:41 #2
Try:

        SSLContext sslctx = SSLContext.getInstance("SSL");
        sslctx.init(null, new X509TrustManager[] { new MyTrustManager() }, null);
        HttpsURLConnection.setDefaultSSLSocketFactory(sslctx.getSocketFactory());
        //HttpsURLConnection.setDefaultHostnameVerifier(new MyHostnameVerifier());

where:

class MyTrustManager implements X509TrustManager
{
    public void checkClientTrusted(X509Certificate[] chain, String authType) {
    }
    public void checkServerTrusted(X509Certificate[] chain, String authType) {
    }
    public X509Certificate[] getAcceptedIssuers() {
        return null;
    }
}

//class MyHostnameVerifier implements HostnameVerifier {
//  public boolean verify(String urlHostName, SSLSession session) {
//      return true;
//  }
//}
Avatar billede fredand Forsker
11. april 2005 - 19:59 #3
Hello!
Arne thanks for your very informative comment!
As always you solved the problem!

But I have two question for you that I hope you got time to answer:

1) Why did I have to do this? (I needed to create one TrustManager and one HostnameVerifier like you mentioned)


My HostnameVerifier now got this method:

public boolean verify(String urlHostName, SSLSession session)
{
if(urlHostName.equals(session.getPeerHost()))
{
        return true;
    }
    else
    {
        System.out.println(urlHostName + " and " +session.getPeerHost());
        return false;
    }
}

2) Do you see anything bad with this like it is less secure?

Also, give a svar so I can reward you as well.

Best regards
FRedrik
Avatar billede arne_v Ekspert
11. april 2005 - 20:33 #4
re 1)

When you use your browser to connect via HTTPS to a site an unknown certificate
you get a popup "do you want to trust this certificate for this session ?".

An arbitrary java program can do such a popup because it could easily run in the
background.

So instead you put in some code to "clock OK" on your behalf.
Avatar billede arne_v Ekspert
11. april 2005 - 20:34 #5
re 2)

Exactly same risks as by clicking OK in the browser.

You can just return trur without checking anything or you can
actually do some checkes.

What is best depends on the context the app is being used in.
Avatar billede arne_v Ekspert
11. april 2005 - 20:34 #6
svar
Avatar billede fredand Forsker
12. april 2005 - 08:26 #7
Hmm!
Ahaa!
..ok..
I think I get it!
Thanks a lot!
Best regards!
Fredrik
Avatar billede Ny bruger Nybegynder

Din løsning...

Tilladte BB-code-tags: [b]fed[/b] [i]kursiv[/i] [u]understreget[/u] Web- og emailadresser omdannes automatisk til links. Der sættes "nofollow" på alle links.

Loading billede Opret Preview
Kategori
Kurser inden for grundlæggende programmering

Log ind eller opret profil

Hov!

For at kunne deltage på Computerworld Eksperten skal du være logget ind.

Det er heldigvis nemt at oprette en bruger: Det tager to minutter og du kan vælge at bruge enten e-mail, Facebook eller Google som login.

Du kan også logge ind via nedenstående tjenester