使用Android WebViewClient啓用特定的SSL協議

Question

我的應用程序使用WebViewClient與服務器建立SSL連接。 服務器被配置爲只接受TLSv1.1及以上協議。

1）如何檢查哪些SSL協議是a）支持的和b）默認情況下在設備上使用Android WebViewClient時啓用。
2）如何爲我的應用程序中使用的Android WebViewClient實例啓用特定的SSL協議。

在運行Android 4.3， WebViewClient投用描述onReceivedError回調 「無法執行SSL握手」 測試設備之一
鉻日誌如下：
01-29 15：58：00.073 5486 5525W¯¯chromium_net ：external/chromium/net/http/http_stream_factory_impl_job.cc：865：[0129/155800：警告：http_stream_factory_impl_job.cc（865）]回退到SSLv3，因爲主機是TLS不能容忍的：10.209.126.125:443 01-29 15:58 ：00.083 5486 5525 E chromium_net：external/chromium/net/socket/ssl_client_socket_openssl.cc：792：[0129/155800：錯誤：ssl_client_socket_openssl.cc（792）]握手失敗;返回0，SSL錯誤代碼5，net_error -107

我的應用程序還使用HttpClient和HttpsUrlConnection類來建立SSL連接。在使用這些類時，我能夠使用SSLSocket API來啓用特定的協議。 http://developer.android.com/reference/javax/net/ssl/SSLSocket.html#setEnabledProtocols(java.lang.String[])

我需要對WebViewClient執行相同的操作。

Answer 1

如果您的應用正在使用，或者您願意使用Google Play服務，則可以通過安裝Provider，在較舊的手機上使用較新的安全功能。它很容易安裝，只有一行（加上異常處理等）。如果您尚未擁有它，您還需要將Google Play服務添加到您的Gradle文件中。 ProviderInstaller包含在-base包中。

try { 
    ProviderInstaller.installIfNeeded(this); 
} catch (GooglePlayServicesRepairableException e) { 
    // Fix it 
} catch (GooglePlayServicesNotAvailableException e) { 
    // Skip it 
} 

有關完整的示例，請參閱Google的"Updating Your Security Provider to Protect Against SSL Exploits"。

Answer 2

根據文檔，不可能在WebView中支持TLS 1.0在Android < 4.3。對於Android 4.4，它默認是禁用的。

檢查這張圖在不同的瀏覽器支持TLS 1.0：https://en.wikipedia.org/wiki/Transport_Layer_Security#Web_browsers

Answer 3

其實，我設法使它工作，但你需要爲okHttp庫。 試試這個，當你設置瀏覽器活動：

WebViewClient client = new WebViewClient() { 
     private OkHttpClient okHttp = new OkHttpClient.Builder().build(); 

     @Override 
     public WebResourceResponse shouldInterceptRequest(WebView view, String url) { 
      Request okHttpRequest = new Request.Builder().url(url).build(); 
      try { 
       Response response = okHttp.newCall(okHttpRequest).execute(); 
       return new WebResourceResponse(response.header("Content-Type", "plain/text"), response.header("Content-Encoding", "deflate"), response.body().byteStream()); 
      } catch (IOException e) { 
       e.printStackTrace(); 
      } 
      return null; 
     } 
    }; 
    webView.setWebViewClient(client); 

此外，你需要經典的信託經理機械臂，SSL套接字工廠及其實施中的應用程序類：

public class TrustManagerManipulator implements X509TrustManager { 


    private static TrustManager[] trustManagers; 
    private static final X509Certificate[] acceptedIssuers = new X509Certificate[] {}; 

    public boolean isClientTrusted(X509Certificate[] chain) { 
     return true; 
    } 

    public boolean isServerTrusted(X509Certificate[] chain) { 
     return true; 
    } 

    public static void allowAllSSL() 
    { 

     HttpsURLConnection.setDefaultHostnameVerifier(new HostnameVerifier() { 
      public boolean verify(String hostname, SSLSession session) { 
       return true; 
      } 
     }); 
     SSLContext context = null; 
     if (trustManagers == null) { 
      trustManagers = new TrustManager[] { new TrustManagerManipulator() }; 
     } 
     try { 
      context = SSLContext.getInstance("TLS"); 
      context.init(null, trustManagers, new SecureRandom()); 
     } catch (NoSuchAlgorithmException e) { 
      e.printStackTrace(); 
     } catch (KeyManagementException e) { 
      e.printStackTrace(); 
     } 
     HttpsURLConnection.setDefaultSSLSocketFactory(context 
       .getSocketFactory()); 
    } 

    public void checkClientTrusted(X509Certificate[] chain, String authType) 
      throws CertificateException { 
    } 

    public void checkServerTrusted(X509Certificate[] chain, String authType) 
      throws CertificateException { 
    } 

    public X509Certificate[] getAcceptedIssuers() { 
     return acceptedIssuers; 
    } 
} 

SSL套接字工廠：

public class TLSSocketFactory extends SSLSocketFactory { 

    private SSLSocketFactory internalSSLSocketFactory; 

    public TLSSocketFactory() throws KeyManagementException, NoSuchAlgorithmException { 
     SSLContext context = SSLContext.getInstance("TLS"); 
     TrustManager[] managers = new TrustManager[] { new TrustManagerManipulator() }; 
     context.init(null, managers, new SecureRandom()); 
     internalSSLSocketFactory = context.getSocketFactory(); 
    } 

    @Override 
    public String[] getDefaultCipherSuites() { 
     return internalSSLSocketFactory.getDefaultCipherSuites(); 
    } 

    @Override 
    public String[] getSupportedCipherSuites() { 
     return internalSSLSocketFactory.getSupportedCipherSuites(); 
    } 

    @Override 
    public Socket createSocket(Socket s, String host, int port, boolean autoClose) throws IOException { 
     return enableTLSOnSocket(internalSSLSocketFactory.createSocket(s, host, port, autoClose)); 
    } 

    @Override 
    public Socket createSocket(String host, int port) throws IOException, UnknownHostException { 
     return enableTLSOnSocket(internalSSLSocketFactory.createSocket(host, port)); 
    } 

    @Override 
    public Socket createSocket(String host, int port, InetAddress localHost, int localPort) throws IOException, UnknownHostException { 
     return enableTLSOnSocket(internalSSLSocketFactory.createSocket(host, port, localHost, localPort)); 
    } 

    @Override 
    public Socket createSocket(InetAddress host, int port) throws IOException { 
     return enableTLSOnSocket(internalSSLSocketFactory.createSocket(host, port)); 
    } 

    @Override 
    public Socket createSocket(InetAddress address, int port, InetAddress localAddress, int localPort) throws IOException { 
     return enableTLSOnSocket(internalSSLSocketFactory.createSocket(address, port, localAddress, localPort)); 
    } 

    private Socket enableTLSOnSocket(Socket socket) { 
     if(socket != null && (socket instanceof SSLSocket)) { 
      ((SSLSocket)socket).setEnabledProtocols(new String[] {"TLSv1.1", "TLSv1.2"}); 
     } 
     return socket; 
    } 
} 

App類：

public class App extends Application { 
    private static App appInstance; 

    @Override 
    public void onCreate() { 
     super.onCreate(); 

     setupSSLconnections(); 
    } 

    private void setupSSLconnections() { 
     try { 
      HttpsURLConnection.setDefaultSSLSocketFactory(new TLSSocketFactory()); 
     } catch (KeyManagementException | NoSuchAlgorithmException e) { 
      e.printStackTrace(); 
     } 
    } 
}