【android安全】之使用ssl验证保护网络数据传输安全。

SSL pinning 限定受信SSL的范围。

https协议验证服务器身份的方式通常有三种，一是根据浏览器或者说操作系统（Android）自带的证书链；二是使用自签名证书；三是自签名证书加上SSL Pinning特性。第一种需要到知名证书机构购买证书，需要一定预算。第二种多见于内网使用。第三种在是安全性最高的，但是需要浏览器插件或客户端使用了SSL Pinning特性。

Android应用程序在使用https协议时也使用类似的3种方式验证服务器身份，分别是系统证书库、自带证书库、自带证书库 + SSL Pinning特性。

所以SSL Pinning，即SSL证书绑定，是验证服务器身份的一种方式，是在https协议建立通信时增加的代码逻辑，它通过自己的方式验证服务器身份，然后决定通信是否继续下去。它唯一指定了服务器的身份，所以安全性较高。

一、先介绍一种使用服务器证书pin码验证方式的安全传输(本方式在apk不被篡改后重编译的情况下安全，上篇文章讲了如何防止apk被篡改的方法)，步骤如下：


1，获取服务器的证书pin码。

2，将pin码复制到android app的代码里面。可写在Const类里面，例如：

package com.test;

public final class Const {

public static final String[] SSL_PINS={"f30012bbc18c231ac1a44b788e410ce754182513","bb0012bbc18c231ac1a44b788e410ce754182513"};

}

3，app进行网络访问时进行pin码验证。可使用如下工具类，调用时传入自己服务器的pin码集即可（该工具类依赖AndroidPinning库https://github.com/moxie0/AndroidPinning）：

package com.test;

import java.io.BufferedReader;
import java.io.ByteArrayOutputStream;
import java.io.DataOutputStream;
import java.io.File;
import java.io.FileInputStream;
import java.io.InputStream;
import java.io.InputStreamReader;
import java.net.URL;
import java.util.ArrayList;
import java.util.Iterator;
import java.util.List;
import java.util.Map;
import java.util.Map.Entry;
import java.util.UUID;

import javax.net.ssl.HttpsURLConnection;

import org.apache.http.HttpResponse;
import org.apache.http.HttpStatus;
import org.apache.http.HttpVersion;
import org.apache.http.client.HttpClient;
import org.apache.http.client.entity.UrlEncodedFormEntity;
import org.apache.http.client.methods.HttpGet;
import org.apache.http.client.methods.HttpPost;
import org.apache.http.conn.ClientConnectionManager;
import org.apache.http.conn.scheme.PlainSocketFactory;
import org.apache.http.conn.scheme.Scheme;
import org.apache.http.conn.scheme.SchemeRegistry;
import org.apache.http.impl.client.DefaultHttpClient;
import org.apache.http.impl.conn.tsccm.ThreadSafeClientConnManager;
import org.apache.http.message.BasicNameValuePair;
import org.apache.http.params.BasicHttpParams;
import org.apache.http.params.HttpConnectionParams;
import org.apache.http.params.HttpParams;
import org.apache.http.params.HttpProtocolParams;
import org.apache.http.protocol.HTTP;
import org.apache.http.util.EntityUtils;
import org.thoughtcrime.ssl.pinning.PinningSSLSocketFactory;
import org.thoughtcrime.ssl.pinning.util.PinningHelper;

import android.content.Context;

public class SSLHttpUtil {

private final static int CONNET_TIMEOUT = 10 * 1000;
private final static int READ_TIMEOUT = 10 * 1000;
private final static String ENCODING = "GBK";

/**
*
* @param urlString
* @param params
* @param files
* @param pins
*            服务器各个证书的pin码集合。
* @param context
* @return
*/
public static String post(String urlString, Map<String, String> params,
Map<String, File> files, String[] pins, Context context) {
HttpsURLConnection conn = null;
DataOutputStream outStream = null;
try {
String BOUNDARY = UUID.randomUUID().toString();
String PREFIX = "--", LINEND = "\r\n";
String MULTIPART_FROM_DATA = "multipart/form-data";
URL url = new URL(urlString);

conn = PinningHelper
.getPinnedHttpsURLConnection(context, pins, url);
conn.setReadTimeout(READ_TIMEOUT);
conn.setConnectTimeout(CONNET_TIMEOUT);
conn.setDoInput(true);
conn.setDoOutput(true);
conn.setUseCaches(false);
conn.setRequestMethod("POST");
conn.setRequestProperty("connection", "keep-alive");
conn.setRequestProperty("Charsert", "UTF-8");
conn.setRequestProperty("Content-Type", MULTIPART_FROM_DATA
+ ";boundary=" + BOUNDARY);
//
outStream = new DataOutputStream(conn.getOutputStream());
if (params != null) {
// 棣栧厛缁勬嫾鏂囨湰绫诲瀷鐨勫弬锟�?
StringBuilder sb = new StringBuilder();
for (Map.Entry<String, String> entry : params.entrySet()) {
sb.append(PREFIX);
sb.append(BOUNDARY);
sb.append(LINEND);
sb.append("Content-Disposition: form-data; name=\""
+ entry.getKey() + "\"" + LINEND);
sb.append("Content-Type: text/plain; charset=" + ENCODING
+ LINEND);
sb.append("Content-Transfer-Encoding: 8bit" + LINEND);
sb.append(LINEND);
sb.append(entry.getValue());
sb.append(LINEND);
}

outStream.write(sb.toString().getBytes());
}
// 鍙戯拷?锟芥枃浠舵暟锟�?
if (files != null) {
for (Map.Entry<String, File> file : files.entrySet()) {
StringBuilder sb1 = new StringBuilder();
sb1.append(PREFIX);
sb1.append(BOUNDARY);
sb1.append(LINEND);
sb1.append("Content-Disposition: form-data; name=\""
+ file.getKey() + "\"; filename=\""
+ file.getValue().getName() + "\"" + LINEND);
sb1.append("Content-Type: application/octet-stream; charset="
+ ENCODING + LINEND);
sb1.append(LINEND);
outStream.write(sb1.toString().getBytes());

InputStream is = new FileInputStream(file.getValue());
byte[] buffer = new byte[1024];
int len = 0;
while ((len = is.read(buffer)) != -1) {
outStream.write(buffer, 0, len);
}
is.close();
outStream.write(LINEND.getBytes());
}
}
// 璇锋眰缁撴潫鏍囧織
byte[] end_data = (PREFIX + BOUNDARY + PREFIX + LINEND).getBytes();
outStream.write(end_data);
outStream.flush();
String sb2 = null;
if (conn.getResponseCode() == HttpStatus.SC_OK) {
InputStream in = conn.getInputStream();
sb2 = readStreamToString(in);

}

return sb2;
} catch (Exception e) {
e.printStackTrace();
return null;
} finally {

try {
outStream.close();
conn.disconnect();
} catch (Exception e) {
// ignore.
e.printStackTrace();
}
}

}

private static String readStreamToString(InputStream inStream) {
ByteArrayOutputStream outStream = null;
try {
outStream = new ByteArrayOutputStream();
byte[] buffer = new byte[1024];
int len = 0;
while ((len = inStream.read(buffer)) != -1) {
outStream.write(buffer, 0, len);
}
inStream.close();
outStream.flush();
String ret = outStream.toString();
outStream.close();
return ret;
} catch (Exception e) {
try {
inStream.close();
outStream.close();
} catch (Exception e1) {
// TODO Auto-generated catch block
e1.printStackTrace();
}
return null;
}
}

/**
*
* @param url
* @param params
* @param context
* @param pins
*            服务器各个证书的pin码集合。
* @return
*/
public static String get(String url, Map<String, String> params,
Context context, String[] pins) {
try {
String realUrl = generateUrl(url, params);
HttpClient client = getNewHttpClient(context, pins);
HttpGet getMethod = new HttpGet(realUrl);
HttpResponse response = client.execute(getMethod);
if (response.getStatusLine().getStatusCode() == HttpStatus.SC_OK) {
StringBuilder builder = new StringBuilder();
BufferedReader reader = new BufferedReader(
new InputStreamReader(response.getEntity().getContent()));
for (String s = reader.readLine(); s != null; s = reader
.readLine()) {
builder.append(s);
}
String result = builder.toString();
return result;
}
} catch (Exception e) {
e.printStackTrace();
}
return null;
}

/**
*
* @param url
* @param params
* @param context
* @param pins
*            服务器各个证书的pin码集合。
* @return
*/
public
c2fc
static String post(String url, Map<String, String> params,
Context context, String[] pins) {
try {
HttpClient client = getNewHttpClient(context, pins);
HttpPost postMethod = new HttpPost(url);
List<BasicNameValuePair> pairs = new ArrayList<BasicNameValuePair>();
if (params != null && params.size() > 0) {
Iterator<Entry<String, String>> iterator = params.entrySet()
.iterator();
while (iterator.hasNext()) {
Entry<String, String> param = iterator.next();
String key = param.getKey();
String value = param.getValue();
BasicNameValuePair pair = new BasicNameValuePair(key, value);
pairs.add(pair);
}
postMethod
.setEntity(new UrlEncodedFormEntity(pairs, HTTP.UTF_8));
}
HttpResponse response = client.execute(postMethod);
if (response.getStatusLine().getStatusCode() == HttpStatus.SC_OK) {
return EntityUtils.toString(response.getEntity());
}
} catch (Exception e) {
e.printStackTrace();
}
return null;
}

/**
* 鑾峰彇HttpClient
*
* @return
*/
private static HttpClient getNewHttpClient(Context context, String[] pins) {
try {

HttpParams params = new BasicHttpParams();
HttpProtocolParams.setVersion(params, HttpVersion.HTTP_1_1);
HttpProtocolParams.setContentCharset(params, HTTP.UTF_8);
HttpConnectionParams.setConnectionTimeout(params, CONNET_TIMEOUT);
HttpConnectionParams.setSoTimeout(params, READ_TIMEOUT);

SchemeRegistry registry = new SchemeRegistry();
registry.register(new Scheme("http", PlainSocketFactory
.getSocketFactory(), 80));
registry.register(new Scheme("https", new PinningSSLSocketFactory(
context, pins, 0), 443));
ClientConnectionManager ccm = new ThreadSafeClientConnManager(
params, registry);
return new DefaultHttpClient(ccm, params);
} catch (Exception e) {
return new DefaultHttpClient();
}
}

private static String generateUrl(String url, Map<String, String> params) {
StringBuilder urlBuilder = new StringBuilder(url);
if (null != params) {
urlBuilder.append("?");
Iterator<Entry<String, String>> iterator = params.entrySet()
.iterator();
while (iterator.hasNext()) {
Entry<String, String> param = iterator.next();
String key = param.getKey();
String value = param.getValue();
urlBuilder.append(key).append('=').append(value);
if (iterator.hasNext()) {
urlBuilder.append('&');
}
}
}
return urlBuilder.toString();
}
}

备注：获取服务器证书pin码的方法：

package com.commonlib.utils;

import java.security.MessageDigest;
import java.security.NoSuchAlgorithmException;
import java.security.cert.CertificateException;
import java.security.cert.X509Certificate;

import javax.net.ssl.SSLContext;
import javax.net.ssl.SSLSocket;
import javax.net.ssl.SSLSocketFactory;
import javax.net.ssl.TrustManager;
import javax.net.ssl.X509TrustManager;

public class CalculatePins {

private MessageDigest digest;

public CalculatePins() throws NoSuchAlgorithmException {
digest = MessageDigest.getInstance("SHA1");
}

/**
* 打印服务器的证书公钥（即pin码）
* @param host
* @param port
* @throws Exception
*/
public void fetchPrintServerPinHashs(String host, int port)
throws Exception {
final SSLContext conext = SSLContext.getInstance("TLS");
PubKeyExtractingTrustManager tm = new PubKeyExtractingTrustManager();
conext.init(null, new TrustManager[] { tm }, null);
SSLSocketFactory fac = conext.getSocketFactory();

SSLSocket socket = (SSLSocket) fac.createSocket(host, port);

socket.setSoTimeout(10 * 1000);
socket.startHandshake();
socket.close();
}

private class PubKeyExtractingTrustManager implements X509TrustManager {

@Override
public void checkClientTrusted(X509Certificate[] chain, String authType)
throws CertificateException {
// TODO Auto-generated method stub

}

@Override
public void checkServerTrusted(X509Certificate[] chain, String authType)
throws CertificateException {
for (X509Certificate cert : chain) {
byte[] keyEncoded = cert.getPublicKey().getEncoded();
byte[] pin = digest.digest(keyEncoded);
String pinHex = bytesToHex(pin);
System.out.println(pinHex);

}

}

private String bytesToHex(byte[] bytes) {
final char[] hexArray = "0123456789ABCDEF".toCharArray();
char[] hexChars = new char[bytes.length * 2];
for (int j = 0; j < bytes.length; j++) {
int v = bytes[j] & 0xFF;
hexChars[j * 2] = hexArray[v >>> 4];
hexChars[j * 2 + 1] = hexArray[v & 0x0F];
}
return new String(hexChars);
}

@Override
public X509Certificate[] getAcceptedIssuers() {
// TODO Auto-generated method stub
return null;
}

}

}