OkHttp attempts to balance two competing concerns:
- Connectivity to as many hosts as possible. That includes advanced hosts that run the latest versions of boringssl and less out of date hosts running older versions of OpenSSL.
- Security of the connection. This includes verification of the remote webserver with certificates and the privacy of data exchanged with strong ciphers.
OkHttp試圖平衡下面兩者之間的矛盾關(guān)系:
- 盡可能多的主機連接.這包括運行最新版本先進的boringssl主機和運行舊版本過時的OpenSSL主機.
- 連接安全.這包括遠程網(wǎng)絡(luò)服務(wù)器證書的驗證和用很強的密碼交換數(shù)據(jù)的隱私.
When negotiating a connection to an HTTPS server, OkHttp needs to know which TLS versions and cipher suites to offer. A client that wants to maximize connectivity would include obsolete TLS versions and weak-by-design cipher suites. A strict client that wants to maximize security would be limited to only the latest TLS version and strongest cipher suites.
當(dāng)判斷一個連接到HTTPS服務(wù)器的連接,OkHttp需要知道是哪個TLS版本和提供的密碼組合.客戶端想要最大化連接將包括過時的TLS版本和很弱的密碼套件.一個嚴(yán)謹(jǐn)?shù)目蛻粝Ｍ畲蠡踩珜H限于最新的TLS版本和最強的密碼組合.
Specific security vs. connectivity decisions are implemented by ConnectionSpec. OkHttp includes three built-in connection specs:
-
MODERN_TLSis a secure configuration that connects to modern HTTPS servers. -
COMPATIBLE_TLSis a secure configuration that connects to secure–but not current–HTTPS servers. -
CLEARTEXTis an insecure configuration that is used forhttp://URLs.
特定的安全與決定連接是由ConnectionSpec實現(xiàn).OkHttp包含三個內(nèi)置的連接標(biāo)準(zhǔn):
-
MODERN_TLS是一個安全的配置,連接到現(xiàn)有服務(wù)器. -
COMPATIBLE_TLS是一個安全的配置,連接到安全的但不是現(xiàn)有服務(wù)器. -
CLEARTEXT是一個不安全的配置, 用于 http:// 的URLs.
By default, OkHttp will attempt a MODERN_TLS connection, and fall back to COMPATIBLE_TLS connection if the modern configuration fails.
默認(rèn)情況下,OkHttp將嘗試 MODERN_TLS 連接,如果現(xiàn)有配置失敗則回退至 COMPATIBLE_TLS 連接.
The TLS versions and cipher suites in each spec can change with each release. For example, in OkHttp 2.2 we dropped support for SSL 3.0 in response to the POODLE attack. And in OkHttp 2.3 we dropped support for RC4. As with your desktop web browser, staying up-to-date with OkHttp is the best way to stay secure.
TLS版本和密碼組合在每個規(guī)格下可以改變每個版本.例如,OkHttp 2.2我們?yōu)?POODLE 攻擊向下兼容支持SSL3.0;我們在OkHttp 2.3向下兼容支持 RC4.與桌面瀏覽器相同,保持安全最好的辦法是保持OkHttp是最新的.
You can build your own connection spec with a custom set of TLS versions and cipher suites. For example, this configuration is limited to three highly-regarded cipher suites. Its drawback is that it requires Android 5.0+ and a similarly current webserver.
你也可以建立自己的連接規(guī)范帶有一套定制的TLS版本和密碼套件.例如,這個配置僅限于三個主要的密碼組合.它的缺點是它需要Android 5.0+和相似的現(xiàn)有網(wǎng)絡(luò)服務(wù)器.
ConnectionSpec spec = new ConnectionSpec.Builder(ConnectionSpec.MODERN_TLS)
.tlsVersions(TlsVersion.TLS_1_2)
.cipherSuites(
CipherSuite.TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,
CipherSuite.TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,
CipherSuite.TLS_DHE_RSA_WITH_AES_128_GCM_SHA256)
.build();
OkHttpClient client = new OkHttpClient.Builder()
.connectionSpecs(Collections.singletonList(spec))
.build();
Certificate Pinning 證書鎖定
By default, OkHttp trusts the certificate authorities of the host platform. This strategy maximizes connectivity, but it is subject to certificate authority attacks such as the 2011 DigiNotar attack. It also assumes your HTTPS servers’ certificates are signed by a certificate authority.
默認(rèn)情況下,OkHttp信任主機平臺的認(rèn)證中心.這一策略最大化連接,但受制于2011 DigiNotar attack等認(rèn)證授權(quán)攻擊.它還假定HTTPS服務(wù)器的證書已經(jīng)被認(rèn)證中心簽約.
Use CertificatePinner to constrain which certificate authorities are trusted. Certificate pinning increases security, but limits your server team’s abilities to update their TLS certificates. Do not use certificate pinning without the blessing of your server’s TLS administrator!
使用 CertificatePinner 約束所信任的認(rèn)證中心.證書鎖定將增加安全性,但受制于服務(wù)器團隊的能力來更新他們的TLS證書.不要在沒有通知使用你的服務(wù)器的TLS管理員的情況下使用證書鎖定!
public CertificatePinning() {
client = new OkHttpClient.Builder()
.certificatePinner(new CertificatePinner.Builder()
.add("publicobject.com", "sha1/DmxUShsZuNiqPQsX2Oi9uv2sCnw=")
.add("publicobject.com", "sha1/SXxoaOSEzPC6BgGmxAt/EAcsajw=")
.add("publicobject.com", "sha1/blhOM3W9V/bVQhsWAcLYwPU6n24=")
.add("publicobject.com", "sha1/T5x9IXmcrQ7YuQxXnxoCmeeQ84c=")
.build())
.build();
}
public void run() throws Exception {
Request request = new Request.Builder()
.url("https://publicobject.com/robots.txt")
.build();
Response response = client.newCall(request).execute();
if (!response.isSuccessful()) throw new IOException("Unexpected code " + response);
for (Certificate certificate : response.handshake().peerCertificates()) {
System.out.println(CertificatePinner.pin(certificate));
}
}
Customizing Trusted Certificates 定制被信任的證書
The full code sample shows how to replace the host platform’s certificate authorities with your own set. As above, do not use custom certificates without the blessing of your server’s TLS administrator!
完整的代碼示例展示了如何用你自己的設(shè)置替換主機平臺的認(rèn)證中心.不要在沒有通知使用你的服務(wù)器的TLS管理員的情況下定制證書!
private final OkHttpClient client;
public CustomTrust() {
SSLContext sslContext = sslContextForTrustedCertificates(trustedCertificatesInputStream());
client = new OkHttpClient.Builder()
.sslSocketFactory(sslContext.getSocketFactory())
.build();
}
public void run() throws Exception {
Request request = new Request.Builder()
.url("https://publicobject.com/helloworld.txt")
.build();
Response response = client.newCall(request).execute();
System.out.println(response.body().string());
}
private InputStream trustedCertificatesInputStream() {
... // Full source omitted. See sample.
// 詳細代碼請看官方sample,點擊標(biāo)題鏈接進入
}
public SSLContext sslContextForTrustedCertificates(InputStream in) {
... // Full source omitted. See sample.
}
對OkHttp感興趣的朋友可以看一看Okhttp-wiki系列,可以幫助你理解Okhttp的使用方法及原理:
