如longilong所述,信任所有证书并不是最好的方法。实际上,在生产环境中这是非常糟糕的方法,因为它基本上使SSL失效,并使您容易受到
中间人攻击的攻击。
问题归结为
POODLE SSL3漏洞,该漏洞已导致一些(大多数?)服务提供商禁用其SSLv3支持。这对我们Android开发人员来说是个坏消息,因为HttpConnection在Build.VERSION.SDK_INT> = 9 && Build.VERSION.SDK_INT <= 20中默认使用SSLv3。
在
Android问题跟踪器中有一个问题,其中提供了更多信息和解决方案,包括提供一个自定义的SSLFactory,拒绝将SSLv3设置为唯一的回退协议,以下是该问题的代码。我对此解决方案不承担任何责任,但它是我们在Lollipop之前的所有版本中使用的方法。
private static class NoSSLv3SSLSocket extends DelegateSSLSocket {
private NoSSLv3SSLSocket(SSLSocket delegate) {
super(delegate);
String canonicalName = delegate.getClass().getCanonicalName();
if (!canonicalName.equals("org.apache.harmony.xnet.provider.jsse.OpenSSLSocketImpl")){
try {
Method msetUseSessionTickets = delegate.getClass().getMethod("setUseSessionTickets", boolean.class);
if (null != msetUseSessionTickets) {
msetUseSessionTickets.invoke(delegate, true);
}
} catch (NoSuchMethodException ignored) {
} catch (InvocationTargetException ignored) {
} catch (IllegalAccessException ignored) {
}
}
}
@Override
public void setEnabledProtocols(String[] protocols) {
if (protocols != null && protocols.length == 1 && "SSLv3".equals(protocols[0])) {
List<String> enabledProtocols = new ArrayList<String>(Arrays.asList(delegate.getEnabledProtocols()));
if (enabledProtocols.size() > 1) {
enabledProtocols.remove("SSLv3");
} else {
LogManager.getLogger().w("SSL stuck with protocol available for " + String.valueOf(enabledProtocols));
}
protocols = enabledProtocols.toArray(new String[enabledProtocols.size()]);
}
super.setEnabledProtocols(protocols);
}
}
private static class NoSSLv3Factory extends SSLSocketFactory {
private final SSLSocketFactory delegate;
private NoSSLv3Factory() {
this.delegate = HttpsURLConnection.getDefaultSSLSocketFactory();
}
@Override
public String[] getDefaultCipherSuites() {
return delegate.getDefaultCipherSuites();
}
@Override
public String[] getSupportedCipherSuites() {
return delegate.getSupportedCipherSuites();
}
private static Socket makeSocketSafe(Socket socket) {
if (socket instanceof SSLSocket) {
socket = new NoSSLv3SSLSocket((SSLSocket) socket);
}
return socket;
}
@Override
public Socket createSocket(Socket s, String host, int port, boolean autoClose) throws IOException {
return makeSocketSafe(delegate.createSocket(s, host, port, autoClose));
}
@Override
public Socket createSocket(String host, int port) throws IOException {
return makeSocketSafe(delegate.createSocket(host, port));
}
@Override
public Socket createSocket(String host, int port, InetAddress localHost, int localPort) throws IOException {
return makeSocketSafe(delegate.createSocket(host, port, localHost, localPort));
}
@Override
public Socket createSocket(InetAddress host, int port) throws IOException {
return makeSocketSafe(delegate.createSocket(host, port));
}
@Override
public Socket createSocket(InetAddress address, int port, InetAddress localAddress, int localPort) throws IOException {
return makeSocketSafe(delegate.createSocket(address, port, localAddress, localPort));
}
}
static {
HttpsURLConnection.setDefaultSSLSocketFactory(new NoSSLv3Factory());
}
SSLCertificateHandler.nuke()
- 请参见https://dev59.com/A2Ag5IYBdhLWcg3wOoxQ#23844716。 - ban-geoengineering