iOS-Network-Https

2017-03-26 本文已影响31人枫枫大世界

参考文章：
http://www.ruanyifeng.com/blog/2014/02/ssl_tls.html
http://www.ruanyifeng.com/blog/2014/09/illustration-ssl.html
http://www.jianshu.com/p/20d5fb4cd76d
双向验证：
http://blog.csdn.net/codingfire/article/details/53419521
http://m.ithao123.cn/content-10472230.html
OpenSSL:
https://www.openssl.org/docs/man1.0.2/
http://shjia.blog.51cto.com/2476475/1427138

通篇看完觉得一张图解释Https很🐂。

注意：

证书和服务器需要满足Requirements for Connecting Using ATS的条件。

保证1满足。

NSURLConnection-两种方式实现 - 客户端验证服务器

其他的如NSURLSession 调用方式和位置不同，原理一样

- (void)connection:(NSURLConnection *)connection willSendRequestForAuthenticationChallenge:(NSURLAuthenticationChallenge *)challenge {
    NSLog(@"authenticatemethod:%@",challenge.protectionSpace.authenticationMethod);
    BOOL userJustCheckCertificateSame = NO;
    {
        if ([challenge.protectionSpace.authenticationMethod isEqualToString:NSURLAuthenticationMethodServerTrust]) {
        NSMutableArray *certificates = [NSMutableArray array];
        NSData*caCert =[NSData dataWithContentsOfFile:[[NSBundle mainBundle] pathForResource:@"new_cacert" ofType:@"cer"]];
        NSData*serverCert =[NSData dataWithContentsOfFile:[[NSBundle mainBundle] pathForResource:@"new_server" ofType:@"cer"]];
        if (userJustCheckCertificateSame) {
            [certificates addObject:caCert];
            [certificates addObject:serverCert];
            [self serverTrustjustCheckCertificateSame:challenge pinCertificates:certificates];
        }else{
            SecCertificateRef caCertRef = SecCertificateCreateWithData(NULL, (__bridge CFDataRef)caCert);
            SecCertificateRef serverCertRef = SecCertificateCreateWithData(NULL, (__bridge CFDataRef)serverCert);
            [certificates addObject:(__bridge_transfer id)caCertRef];
            [certificates addObject:(__bridge_transfer id)serverCertRef];
            [self serverTrustSystemMethod:challenge pinCertificates:certificates];
        }
            
        }else if ([challenge.protectionSpace.authenticationMethod isEqualToString:NSURLAuthenticationMethodClientCertificate]) {
            //暂时不做client 验证
            [challenge.sender continueWithoutCredentialForAuthenticationChallenge:challenge];
//            NSData*certData =[NSData dataWithContentsOfFile:[[NSBundle mainBundle] pathForResource:@"old_client" ofType:@"cer"]];
//            [self addCertToKeychain:certData];
//            NSURLCredential *credential = [self getClientCertFromKeychain];
//            [[challenge sender] useCredential:credential forAuthenticationChallenge:challenge];
        }else{
            [challenge.sender continueWithoutCredentialForAuthenticationChallenge:challenge];
        }
    }
}

// 如果server 返回的证书链 里面有一个在local 证书集合里面，即可认为合法
- (void)serverTrustjustCheckCertificateSame:(NSURLAuthenticationChallenge *)challenge pinCertificates:(NSMutableArray *)pinCertificates{
    SecTrustRef serverTrust = challenge.protectionSpace.serverTrust;
    if ([self localCaInServerChainList:serverTrust pinCertificates:pinCertificates]) {
        NSURLCredential *cred = [NSURLCredential credentialForTrust:serverTrust];
        [challenge.sender useCredential:cred forAuthenticationChallenge:challenge];
    }else{
        [challenge.sender cancelAuthenticationChallenge:challenge];
    }
}

- (BOOL)localCaInServerChainList:(SecTrustRef)serverTrust pinCertificates:(NSMutableArray *)pinCertificates{
    CFIndex certificateCount = SecTrustGetCertificateCount(serverTrust);
    for (CFIndex i = 0; i < certificateCount; i++) {
        SecCertificateRef certificate = SecTrustGetCertificateAtIndex(serverTrust, i);
        NSData *trustChainCertificate = (__bridge_transfer NSData *)SecCertificateCopyData(certificate);
        if ([pinCertificates containsObject:trustChainCertificate]) {
            return YES;
        }
    }
    return NO;
}

// 调用系统方法
- (void)serverTrustSystemMethod:(NSURLAuthenticationChallenge *)challenge pinCertificates:(NSMutableArray *)pinCertificates{
    //1)获取trust object
    SecTrustRef trust = challenge.protectionSpace.serverTrust;
    SecTrustResultType result;
    
    NSMutableArray *policies = [NSMutableArray array];
    // BasicX509 不验证域名是否相同（我们用的IP）
    SecPolicyRef policy = SecPolicyCreateBasicX509();
    [policies addObject:(__bridge_transfer id)policy];
    SecTrustSetPolicies(trust, (__bridge CFArrayRef)policies);
    
    //注意：添加自己的证书作为可信列表
    SecTrustSetAnchorCertificates(trust, (__bridge CFArrayRef)pinCertificates);
    
    //禁用系统可信列表
    //SecTrustSetAnchorCertificatesOnly(trust, false);
    
    //2)SecTrustEvaluate会查找前面SecTrustSetAnchorCertificates设置的证书或者系统默认提供的证书，对trust进行验证
    OSStatus status = SecTrustEvaluate(trust, &result);
    if (status == errSecSuccess &&
        (result == kSecTrustResultProceed ||
         result == kSecTrustResultUnspecified))
    {
        //3)验证成功，生成NSURLCredential凭证cred，告知challenge的sender使用这个凭证来继续连接
        NSURLCredential *cred = [NSURLCredential credentialForTrust:trust];
        [challenge.sender useCredential:cred forAuthenticationChallenge:challenge];
    } else {
        //5)验证失败，取消这次验证流程
        [challenge.sender cancelAuthenticationChallenge:challenge];
    }
}

NSURLConnection -服务器验证客户端

iOS-Network-Https

猜你喜欢

热点阅读