SSL 固定与 Android 上的 Volley 网络库

Question

我想在凌空网络库中使用 SSL 固定。有没有办法用凌空实现 SSL 固定？凌空是否为安全改进提供这种支持？

Answer 1

我只是按照这里描述的方式实现了它：http://blog.ostorlab.co/2016/05/ssl-pinning-in-android-networking.html

以下是凌空实现所需的代码：

CertificateFactory cf = CertificateFactory.getInstance("X.509");
// Generate the certificate using the certificate file under res/raw/cert.cer
InputStream caInput = new BufferedInputStream(getResources().openRawResource(R.raw.cert));
Certificate ca = cf.generateCertificate(caInput);
caInput.close();
// Create a KeyStore containing our trusted CAs
String keyStoreType = KeyStore.getDefaultType();
KeyStore trusted = KeyStore.getInstance(keyStoreType);
trusted.load(null, null);
trusted.setCertificateEntry("ca", ca);
// Create a TrustManager that trusts the CAs in our KeyStore
String tmfAlgorithm = TrustManagerFactory.getDefaultAlgorithm();
TrustManagerFactory tmf = TrustManagerFactory.getInstance(tmfAlgorithm);
tmf.init(trusted);
// Create an SSLContext that uses our TrustManager
SSLContext context = SSLContext.getInstance("TLS");
context.init(null, tmf.getTrustManagers(), null);
SSLSocketFactory sf = context.getSocketFactory();
mRequestQueue = Volley.newRequestQueue(mCtx.getApplicationContext(), new HurlStack(null, sf));

似乎有效！

Answer 2

我刚刚为我正在从事的一个项目研究了同样的事情。但是，我所处的位置可能与您不同。

我正在使用带有OKHttp网络堆栈（https://gist.github.com/JakeWharton/5616899）的Volley：

将这些添加到您的 Gradle 构建中：1

compile "com.squareup.okhttp:okhttp:2.7.5"
compile "com.squareup.okhttp:okhttp-urlconnection:2.7.5"

添加一个 OKHttpStack 类;

public class OKHttpStack extends HurlStack {
    private final OkUrlFactory okUrlFactory;
    public OKHttpStack() {
        this(new OkUrlFactory( 
            new OkHttpClient.Builder()
                    .certificatePinner(
                        new CertificatePinner.Builder()
                            .add("example.com", "sha256/afwiKY3RxoMmLkuRW1l7QsPZTJPwDS2pdDROQjXw8ig=") //This is the cert
                            .build())
                    .build();
        ));
    }
    public OKHttpStack(OkUrlFactory okUrlFactory) {
        if (okUrlFactory == null) {
            throw new NullPointerException("Client must not be null.");
        }
        this.okUrlFactory = okUrlFactory;
    }
    @Override
    protected HttpURLConnection createConnection(URL url) throws IOException {
        return okUrlFactory.open(url);
    }
}

然后创建 RequestQueue 时，执行以下操作：

Network network = new BasicNetwork(new OKHttpStack());
File cacheDir = new File(context.getCacheDir(), "volley");
int threads = 4;
mRequestQueue = new RequestQueue(new DiskBasedCache(cacheDir), network, threads);

请注意，我还没有对此进行测试，我们目前正在考虑固定。

祝你好运！加夫

引用：

https://gist.github.com/JakeWharton/5616899https://github.com/square/okhttp/blob/master/samples/guide/src/main/java/okhttp3/recipes/CertificatePinning.java

Answer 3

可以使用公钥固定而不是证书固定：

使用凌空库固定公钥

Answer 4

我正在实现同样的事情。我找到了一篇博客文章，希望对您有所帮助

http://ogrelab.ikratko.com/using-android-volley-with-self-signed-certificate/

Answer 5

您可以使用

network_security_config.xml，更多信息：https://developer.android.com/training/articles/security-config