的Android在OKHttp

Question

啓用TLSv1.2工作我用OKHttp我的項目。我想爲我的服務呼叫啓用TLSv1.2。任何機構都可以告訴我如何啓用它。

Answer 1

據我所知OKHttp不包括自己的SSL/TLS庫，因此它只是使用由Android提供的標準的SSLSocket。

什麼都支持TLS版本（和啓用）取決於所使用的Android版本。 在某些電話上支持TLS 1.2，但默認情況下未啓用。在這種情況下，您可以通過實現自定義包裝器SSLSocketFactory來啓用它，該包裝器在內部使用默認的SSLSocketFactory，並在創建的每個套接字上調用setEnabledProtocols(new String{"TLS1.2"})。

Answer 2

見OkHttp的HTTPS documentation。

ConnectionSpec spec = new ConnectionSpec.Builder(ConnectionSpec.MODERN_TLS) 
    .tlsVersions(TlsVersion.TLS_1_2) 
    .cipherSuites( 
    CipherSuite.TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256, 
    CipherSuite.TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256, 
    CipherSuite.TLS_DHE_RSA_WITH_AES_128_GCM_SHA256) 
    .build(); 
OkHttpClient client = ... 
client.setConnectionSpecs(Collections.singletonList(spec)); 

Answer 3

這是基本相同的答案above，但我覺得自己像一個代碼示例將是誰比誰這裏的土地和不加快速度航行的java的SSL景觀有用。

什麼最終結束了我的工作是基於此報告的問題：https://github.com/mattleibow/square-bindings/issues/1
從這個要點https://gist.github.com/mattleibow/c8abfa323db094b820cc

注意這些代碼示例是用C＃/ Xamarin但也很容易被轉換爲Java。

internal class CompleteSSLSocketFactory : SSLSocketFactory 
{ 
    private readonly SSLSocketFactory innerFactory; 

    public CompleteSSLSocketFactory (SSLSocketFactory innerFactory) 
    { 
     this.innerFactory = innerFactory; 
    } 

    public override string[] GetDefaultCipherSuites() 
    { 
     return innerFactory.GetDefaultCipherSuites(); 
    } 

    public override string[] GetSupportedCipherSuites() 
    { 
     return innerFactory.GetSupportedCipherSuites(); 
    } 

    public override Socket CreateSocket() 
    { 
     return MakeSocketSafe (innerFactory.CreateSocket()); 
    } 

    public override Socket CreateSocket (Socket s, string host, int port, bool autoClose) 
    { 
     return MakeSocketSafe (innerFactory.CreateSocket (s, host, port, autoClose)); 
    } 

    public override Socket CreateSocket (string host, int port) 
    { 
     return MakeSocketSafe (innerFactory.CreateSocket (host, port)); 
    } 

    public override Socket CreateSocket (string host, int port, InetAddress localHost, int localPort) 
    { 
     return MakeSocketSafe (innerFactory.CreateSocket (host, port, localHost, localPort)); 
    } 

    public override Socket CreateSocket (InetAddress host, int port) 
    { 
     return MakeSocketSafe (innerFactory.CreateSocket (host, port)); 
    } 

    public override Socket CreateSocket (InetAddress address, int port, InetAddress localAddress, int localPort) 
    { 
     return MakeSocketSafe (innerFactory.CreateSocket (address, port, localAddress, localPort)); 
    } 

    private Socket MakeSocketSafe (Socket socket) 
    { 
     var sslSocket = socket as SSLSocket; 
     if (sslSocket != null) { 
      // enable all supported protocols for this socket 
      sslSocket.SetEnabledProtocols (sslSocket.GetSupportedProtocols()); 
      sslSocket.SetEnabledCipherSuites (sslSocket.GetSupportedCipherSuites()); 
     } 
     return socket; 
    } 
} 

，然後調用它像：

// this.client is an OkHttpClient 
if (Android.OS.Build.VERSION.SdkInt < BuildVersionCodes.Lollipop) { 
    this.client.SetSslSocketFactory(new CompleteSSLSocketFactory(HttpsURLConnection.DefaultSSLSocketFactory)); 
} 

這爲我工作，在API測試19

Answer 4

原來我的解決方案是非常相似的Ken的（除Java之外）。我發現它here雖然不得不作出一些小的改變，使其工作。希望這個作品'開箱即用'爲他人。

public class TLSSocketFactoryCompat extends SSLSocketFactory { 

private SSLSocketFactory internalSSLSocketFactory; 

public TLSSocketFactoryCompat() throws KeyManagementException, NoSuchAlgorithmException { 
    SSLContext context = SSLContext.getInstance("TLS"); 
    context.init(null, null, null); 
    internalSSLSocketFactory = context.getSocketFactory(); 
} 

public TLSSocketFactoryCompat(TrustManager[] tm) throws KeyManagementException, NoSuchAlgorithmException { 
    SSLContext context = SSLContext.getInstance("TLS"); 
    context.init(null, tm, new java.security.SecureRandom()); 
    internalSSLSocketFactory = context.getSocketFactory(); 
} 

@Override 
public String[] getDefaultCipherSuites() { 
    return internalSSLSocketFactory.getDefaultCipherSuites(); 
} 

@Override 
public String[] getSupportedCipherSuites() { 
    return internalSSLSocketFactory.getSupportedCipherSuites(); 
} 

@Override 
public Socket createSocket() throws IOException { 
    return enableTLSOnSocket(internalSSLSocketFactory.createSocket()); 
} 

@Override 
public Socket createSocket(Socket s, String host, int port, boolean autoClose) throws IOException { 
    return enableTLSOnSocket(internalSSLSocketFactory.createSocket(s, host, port, autoClose)); 
} 

@Override 
public Socket createSocket(String host, int port) throws IOException, UnknownHostException { 
    return enableTLSOnSocket(internalSSLSocketFactory.createSocket(host, port)); 
} 

@Override 
public Socket createSocket(String host, int port, InetAddress localHost, int localPort) throws IOException, UnknownHostException { 
    return enableTLSOnSocket(internalSSLSocketFactory.createSocket(host, port, localHost, localPort)); 
} 

@Override 
public Socket createSocket(InetAddress host, int port) throws IOException { 
    return enableTLSOnSocket(internalSSLSocketFactory.createSocket(host, port)); 
} 

@Override 
public Socket createSocket(InetAddress address, int port, InetAddress localAddress, int localPort) throws IOException { 
    return enableTLSOnSocket(internalSSLSocketFactory.createSocket(address, port, localAddress, localPort)); 
} 

private Socket enableTLSOnSocket(Socket socket) { 
    if(socket != null && (socket instanceof SSLSocket)) { 
     //Create list of supported protocols 
     ArrayList<String> supportedProtocols = new ArrayList<>(); 
     for (String protocol : ((SSLSocket)socket).getEnabledProtocols()) { 

      //Log.d("TLSSocketFactory", "Supported protocol:" + protocol); 
      //Only add TLS protocols (don't want ot support older SSL versions) 
      if (protocol.toUpperCase().contains("TLS")) { 
       supportedProtocols.add(protocol); 
      } 
     } 
     //Force add TLSv1.1 and 1.2 if not already added 
     if (!supportedProtocols.contains("TLSv1.1")) { 
      supportedProtocols.add("TLSv1.1"); 
     } 
     if (!supportedProtocols.contains("TLSv1.2")) { 
      supportedProtocols.add("TLSv1.2"); 
     } 

     String[] protocolArray = supportedProtocols.toArray(new String[supportedProtocols.size()]); 
     /*for (int i = 0; i < protocolArray.length; i++) { 
      Log.d("TLSSocketFactory", "protocolArray[" + i + "]" + protocolArray[i]); 
     }*/ 

     //enable protocols in our list 
     ((SSLSocket)socket).setEnabledProtocols(protocolArray); 
    } 
    return socket; 
} 

}

用法：

OkHttpClient httpClient = new OkHttpClient(); 
    //Add Custom SSL Socket Factory which adds TLS 1.1 and 1.2 support for Android 4.1-4.4 
    try { 
     httpClient.setSslSocketFactory(new TLSSocketFactoryCompat()); 
    } catch (KeyManagementException e) { 
     e.printStackTrace(); 
    } catch (NoSuchAlgorithmException e) { 
     e.printStackTrace(); 
    } 

Answer 5

檢查我的代碼！工作完美！

private void checkTls() { 
    if (android.os.Build.VERSION.SDK_INT < 21) { 
     try { 
      ProviderInstaller.installIfNeededAsync(this, new ProviderInstaller.ProviderInstallListener() { 
       @Override 
       public void onProviderInstalled() { 
       } 

       @Override 
       public void onProviderInstallFailed(int i, Intent intent) { 
       } 
      }); 
     } catch (Exception e) { 
      finish(); 
      e.printStackTrace(); 
     } 
    } 
}