ch10.html
来自「java2高级编程」· HTML 代码 · 共 745 行 · 第 1/4 页
HTML
745 行
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0//EN"><HTML><HEAD><META HTTP-EQUIV="Content-Type" CONTENT="text/html; charset=ISO-8859-1"><META HTTP-EQUIV="Content-Style-Type" CONTENT="text/css"><META NAME="GENERATOR" CONTENT="Adobe FrameMaker 6.0/HTML Export Filter"><LINK REL="STYLESHEET" HREF="CH10.css" CHARSET="ISO-8859-1" TYPE="text/css"><TITLE> Covered in this Chapter</TITLE></HEAD><BODY BGCOLOR="#ffffff"><P CLASS="CT"><A NAME="pgfId-1087399"></A>10</P><P CLASS="CT"><A NAME="pgfId-1087401"></A><A NAME="42284"></A>Signed Applets and Security Managers</P><P CLASS="Body"><A NAME="pgfId-1087402"></A>This chapter concludes the book with security topics you should find useful--signing applets and writing a security manager. The examples do not relate directly to the auction house, but are simple and targeted to illustrate these concepts.</P><DIV><H4 CLASS="A"><A NAME="pgfId-1087403"></A>Covered in this Chapter</H4><UL><LI CLASS="BL"><A NAME="pgfId-1087404"></A>Signed Applets (page 305)</LI><LI CLASS="BL"><A NAME="pgfId-1087405"></A>Writing a Security Manager (page 311)</LI></UL></DIV><DIV><H4 CLASS="A"><A NAME="pgfId-1087407"></A><A NAME="77954"></A>Signed Applets</H4><P CLASS="Body"><A NAME="pgfId-1087412"></A><A NAME="marker-1087408"></A><A NAME="marker-1087409"></A><A NAME="marker-1087410"></A><A NAME="marker-1087411"></A>A policy file can be defined to require a signature on all applets or applications that attempt to run with the policy file. The signature is a way to verify that the applet or application is from a reliable source and can be trusted to run with the permissions granted in the policy file. </P><P CLASS="Body"><A NAME="pgfId-1087413"></A>If a policy file requires a signature, an applet or application can get the access granted by the policy file only if it has the correct signature. If the applet or application has the wrong signature or no signature, it will not get access to the file. </P><P CLASS="Body"><A NAME="pgfId-1087414"></A>This section walks through an example of signing an applet, verifying the signature, and running the applet with a policy file. </P><DIV><H5 CLASS="B"><A NAME="pgfId-1087415"></A>Signed Applet Example</H5><P CLASS="Body"><A NAME="pgfId-1087418"></A><A NAME="marker-1087416"></A><A NAME="marker-1087417"></A>The policy file granting access can be set up to require or not require a signature. If a signature is required, the applet has to be bundled into a JAR file before it can be signed. This example shows you how to sign and grant permission to an applet so it can create <EM CLASS="CODE">demo.ini</EM> in the user's home directory when it executes in <EM CLASS="CODE">Applet Viewer</EM> (Figure 10.1). </P><DIV><H6 CLASS="FC"><A NAME="pgfId-1087422"></A>Figure 10.1 Signed applet</H6><DIV><IMG SRC="CH10-1.gif"></DIV><P CLASS="Body"><A NAME="pgfId-1087423"></A>The following files are used in the example. You can copy them to or create them in your working directory. </P><P CLASS="Body"><A NAME="pgfId-1087424"></A><EM CLASS="Bold">SignedAppletDemo. </EM>The <EM CLASS="CODE">SignedAppletDemo</EM>.java source file contains the applet code.</P><PRE CLASS="CODE"><A NAME="pgfId-1087428"></A><A NAME="marker-1087425"></A><A NAME="marker-1087426"></A><A NAME="marker-1087427"></A>//File: @(#)SignedAppletDemo.java</PRE><PRE CLASS="CODE"><A NAME="pgfId-1087429"></A>//(#)author: Satya Dodda</PRE><PRE CLASS="CODE"><A NAME="pgfId-1087430"></A>import java.applet.Applet;</PRE><PRE CLASS="CODE"><A NAME="pgfId-1087431"></A>import java.awt.Graphics;</PRE><PRE CLASS="CODE"><A NAME="pgfId-1087432"></A>import java.io.*;</PRE><PRE CLASS="CODE"><A NAME="pgfId-1087433"></A>import java.awt.Color;</PRE><PRE CLASS="CODE"><A NAME="pgfId-1087434"></A>public class SignedAppletDemo extends Applet {</PRE><PRE CLASS="CODE"><A NAME="pgfId-1087435"></A> public String test() {</PRE><PRE CLASS="CODE"><A NAME="pgfId-1087436"></A> setBackground(Color.white);</PRE><PRE CLASS="CODE"><A NAME="pgfId-1087437"></A> String fileName = System.getProperty("user.home") + System.getProperty("file.separator") + "demo.ini";</PRE><PRE CLASS="CODE"><A NAME="pgfId-1087438"></A> String msg = "This message was written by a signed applet!!!\n";</PRE><PRE CLASS="CODE"><A NAME="pgfId-1087439"></A> String s ;</PRE><PRE CLASS="CODE"><A NAME="pgfId-1087440"></A> try {</PRE><PRE CLASS="CODE"><A NAME="pgfId-1087441"></A> FileWriter fos = new FileWriter(fileName);</PRE><PRE CLASS="CODE"><A NAME="pgfId-1087442"></A> fos.write(msg, 0, msg.length());</PRE><PRE CLASS="CODE"><A NAME="pgfId-1087443"></A> fos.close();</PRE><PRE CLASS="CODE"><A NAME="pgfId-1087444"></A> s = new String("Successfully created file :" + fileName);</PRE><PRE CLASS="CODE"><A NAME="pgfId-1087445"></A> } catch (Exception e) {</PRE><PRE CLASS="CODE"><A NAME="pgfId-1087446"></A> System.out.println("Exception e = " + e);</PRE><PRE CLASS="CODE"><A NAME="pgfId-1087447"></A> e.printStackTrace();</PRE><PRE CLASS="CODE"><A NAME="pgfId-1087448"></A> s = new String("Unable to create file : " + fileName);</PRE><PRE CLASS="CODE"><A NAME="pgfId-1087449"></A> }</PRE><PRE CLASS="CODE"><A NAME="pgfId-1087450"></A> return s;</PRE><PRE CLASS="CODE"><A NAME="pgfId-1087451"></A> } </PRE><PRE CLASS="CODE"><A NAME="pgfId-1087452"></A> public void paint(Graphics g) {</PRE><PRE CLASS="CODE"><A NAME="pgfId-1087453"></A> g.setColor(Color.blue);</PRE><PRE CLASS="CODE"><A NAME="pgfId-1087454"></A> g.drawString("Signed Applet Demo", 120, 50);</PRE><PRE CLASS="CODE"><A NAME="pgfId-1087455"></A> g.setColor(Color.magenta);</PRE><PRE CLASS="CODE"><A NAME="pgfId-1087456"></A> g.drawString(test(), 50, 100);</PRE><PRE CLASS="CODE"><A NAME="pgfId-1087457"></A> }</PRE><PRE CLASS="CODE"><A NAME="pgfId-1087458"></A>}</PRE><P CLASS="Body"><A NAME="pgfId-1087459"></A><EM CLASS="Bold">Policy File. </EM>The <EM CLASS="CODE">Write.jp</EM> policy file grants access to the user's home directory.</P><PRE CLASS="CODE"><A NAME="pgfId-1087460"></A>/* AUTOMATICALLY GENERATED ON Mon Sep 14 09:55:03 PDT 1998*/</PRE><PRE CLASS="CODE"><A NAME="pgfId-1087461"></A>/* DO NOT EDIT */</PRE><PRE CLASS="CODE"><A NAME="pgfId-1087462"></A> </PRE><PRE CLASS="CODE"><A NAME="pgfId-1087463"></A>keystore "raystore";</PRE><PRE CLASS="CODE"><A NAME="pgfId-1087464"></A> </PRE><PRE CLASS="CODE"><A NAME="pgfId-1087465"></A>grant signedBy "susan" {</PRE><PRE CLASS="CODE"><A NAME="pgfId-1087466"></A> permission java.util.PropertyPermission "user.home", "read";</PRE><PRE CLASS="CODE"><A NAME="pgfId-1087467"></A> permission java.io.FilePermission "${user.home}/newfile", "write";</PRE><PRE CLASS="CODE"><A NAME="pgfId-1087468"></A>};</PRE><P CLASS="Body"><A NAME="pgfId-1087469"></A><EM CLASS="Bold">HTML file. </EM>The <EM CLASS="CODE">SignedApplet.html</EM> file has the applet tag that loads the SignedAppletDemo applet.</P><P CLASS="Body"><A NAME="pgfId-1087470"></A><EM CLASS="Bold">How It Works. </EM>Usually an applet is bundled and signed by an intranet developer and handed off to the end user who verifies the signature and runs the applet. In this example, the intranet developer performs Steps 1 through 5 and Ray, the end user, performs Steps 6 through 8. But, to keep things simple for this example, all steps occur in the same working directory. </P><OL><LI CLASS="NLS"><A NAME="pgfId-1087471"></A>Compile the applet</LI><LI CLASS="NL"><A NAME="pgfId-1087472"></A>Create a JAR file</LI><LI CLASS="NL"><A NAME="pgfId-1087473"></A>Generate keys</LI><LI CLASS="NL"><A NAME="pgfId-1087474"></A>Sign the JAR file</LI><LI CLASS="NL"><A NAME="pgfId-1087475"></A>Export the public key certificate</LI><LI CLASS="NL"><A NAME="pgfId-1087476"></A>Import the certificate as a Trusted Certificate</LI><LI CLASS="NL"><A NAME="pgfId-1087477"></A>Create the policy file</LI><LI CLASS="NL"><A NAME="pgfId-1087478"></A>Run the applet</LI></OL></DIV></DIV><DIV><H5 CLASS="B"><A NAME="pgfId-1087479"></A><EM CLASS="A">I</EM>ntranet Developer</H5><P CLASS="Body"><A NAME="pgfId-1087480"></A>Susan, the intranet developer, bundles the applet executable in a JAR file, signs the JAR file, and exports the public key certificate. </P><P CLASS="Body"><A NAME="pgfId-1087481"></A><EM CLASS="Bold">1: Compile the Applet. </EM>In her working directory, Susan uses the <EM CLASS="CODE">javac</EM> command to compile the <EM CLASS="CODE">SignedAppletDemo</EM> class. The output from the <EM CLASS="CODE">javac</EM> command is the <EM CLASS="CODE">SignedAppletDemo.class</EM>. </P><PRE CLASS="CODE"><A NAME="pgfId-1087482"></A><EM CLASS="CODE">javac SignedAppletDemo.java</EM> </PRE><P CLASS="Body"><A NAME="pgfId-1087483"></A><EM CLASS="Bold">2: Make a JAR File. </EM>Susan then stores the compiled <EM CLASS="CODE">SignedAppletDemo.class</EM> file into a JAR file. The <EM CLASS="CODE">cvf</EM> option to the <EM CLASS="CODE">jar</EM> command creates a new archive (<EM CLASS="CODE">c</EM>), using verbose mode (<EM CLASS="CODE">v</EM>), and specifies the archive file name (<EM CLASS="CODE">f</EM>). The archive file name is <EM CLASS="CODE">SignedApplet.jar</EM>. </P><PRE CLASS="CODE"><A NAME="pgfId-1087484"></A><EM CLASS="CODE">jar cvf SignedApplet.jar SignedAppletDemo.class</EM> </PRE><P CLASS="Body"><A NAME="pgfId-1087487"></A><EM CLASS="Bold">3: Generate Keys. </EM><A NAME="marker-1087485"></A><A NAME="marker-1087486"></A>A JAR file is signed with the private key of the creator of the JAR file and the signature is verified by the recipient of the JAR file with the public key in the pair. The certificate is a statement from the owner of the private key that the public key in the pair has a particular value so the person using the public key can be assured the public key is authentic. Public and private keys must already exist in the keystore database before <EM CLASS="CODE">jarsigner</EM> can be used to sign or verify the signature on a JAR file. </P><P CLASS="Body"><A NAME="pgfId-1087491"></A><A NAME="marker-1087488"></A><A NAME="marker-1087489"></A>Susan creates a <A NAME="marker-1087490"></A>keystore database named <EM CLASS="CODE">compstore</EM> that has an entry for a newly generated public and private key pair with the public key in a certificate, by using the <EM CLASS="CODE">keytool</EM> command. In her working directory, Susan creates a <EM CLASS="CODE">⌨️ 快捷键说明
复制代码Ctrl + C
搜索代码Ctrl + F
全屏模式F11
增大字号Ctrl + =
减小字号Ctrl + -
显示快捷键?