該文章閱讀的AFNetworking的版本為3.2.0。
AFSecurityPolicy這個類是用於驗證HTTPS請求的證書是否正確。
1.介面
1.1.列舉
typedef NS_ENUM(NSUInteger, AFSSLPinningMode) {
AFSSLPinningModeNone,
AFSSLPinningModePublicKey,
AFSSLPinningModeCertificate,
};
複製程式碼這個列舉定義了伺服器證書驗證模式：
AFSSLPinningModeNone 不使用證書驗證伺服器
AFSSLPinningModePublicKey 使用證書中的公鑰驗證伺服器
AFSSLPinningModeCertificate 使用證書驗證伺服器
1.2.屬性
/**
伺服器證書驗證模式，預設是不驗證
*/
@property (readonly, nonatomic, assign) AFSSLPinningMode SSLPinningMode;
/**
驗證伺服器的證書的集合，預設情況下，AFNetworking會搜尋工程中所有.cer的證書檔案，但不會將某個證書作為預設。如果想建立AFSecurityPolicy物件，就先呼叫certificatesInBundle方法載入證書，然後呼叫policyWithPinningMode:withPinnedCertificates方法建立物件
*/
@property (nonatomic, strong, nullable) NSSet <NSData *> *pinnedCertificates;
/**
是否信任無效或者過期的證書，預設為否
*/
@property (nonatomic, assign) BOOL allowInvalidCertificates;
/**
是否驗證證書中的域名，預設為是
*/
@property (nonatomic, assign) BOOL validatesDomainName;
複製程式碼1.3.方法
/**
用這個方法查詢包含在指定包中的所有的證書
*/
+ (NSSet <NSData *> *)certificatesInBundle:(NSBundle *)bundle;
/**
例項化工廠方法，預設的配置包括不允許無效或者過期證書、驗證域名、不驗證證書和證書中公鑰
*/
+ (instancetype)defaultPolicy;
/**
指定證書驗證模式的例項化工廠方法
*/
+ (instancetype)policyWithPinningMode:(AFSSLPinningMode)pinningMode;
/**
指定證書驗證模式和證書的例項化工廠方法
*/
+ (instancetype)policyWithPinningMode:(AFSSLPinningMode)pinningMode withPinnedCertificates:(NSSet <NSData *> *)pinnedCertificates;
/**
驗證是否信任伺服器
*/
- (BOOL)evaluateServerTrust:(SecTrustRef)serverTrust
forDomain:(nullable NSString *)domain;
複製程式碼2.實現
2.1.私有靜態方法
這個方法是將key轉為NSData型別
#if !TARGET_OS_IOS && !TARGET_OS_WATCH && !TARGET_OS_TV
static NSData * AFSecKeyGetData(SecKeyRef key) {
CFDataRef data = NULL;
__Require_noErr_Quiet(SecItemExport(key, kSecFormatUnknown, kSecItemPemArmour, NULL, &data), _out);
return (__bridge_transfer NSData *)data;
_out:
if (data) {
CFRelease(data);
}
return nil;
}
#endif
複製程式碼這個方法是判斷兩個key是否相等
static BOOL AFSecKeyIsEqualToKey(SecKeyRef key1, SecKeyRef key2) {
#if TARGET_OS_IOS || TARGET_OS_WATCH || TARGET_OS_TV
return [(__bridge id)key1 isEqual:(__bridge id)key2];
#else
return [AFSecKeyGetData(key1) isEqual:AFSecKeyGetData(key2)];
#endif
}
複製程式碼這個方法是用來從證書中取出公鑰
static id AFPublicKeyForCertificate(NSData *certificate) {
id allowedPublicKey = nil;
SecCertificateRef allowedCertificate;
SecPolicyRef policy = nil;
SecTrustRef allowedTrust = nil;
SecTrustResultType result;
allowedCertificate = SecCertificateCreateWithData(NULL, (__bridge CFDataRef)certificate);
__Require_Quiet(allowedCertificate != NULL, _out);
policy = SecPolicyCreateBasicX509();
__Require_noErr_Quiet(SecTrustCreateWithCertificates(allowedCertificate, policy, &allowedTrust), _out);
__Require_noErr_Quiet(SecTrustEvaluate(allowedTrust, &result), _out);
allowedPublicKey = (__bridge_transfer id)SecTrustCopyPublicKey(allowedTrust);
_out:
if (allowedTrust) {
CFRelease(allowedTrust);
}
if (policy) {
CFRelease(policy);
}
if (allowedCertificate) {
CFRelease(allowedCertificate);
}
return allowedPublicKey;
}
複製程式碼這個方法是判斷伺服器是否可以信任
static BOOL AFServerTrustIsValid(SecTrustRef serverTrust) {
BOOL isValid = NO;
SecTrustResultType result;
__Require_noErr_Quiet(SecTrustEvaluate(serverTrust, &result), _out);
isValid = (result == kSecTrustResultUnspecified || result == kSecTrustResultProceed);
_out:
return isValid;
}
複製程式碼這個方法是用來獲得伺服器返回的所有的證書
static NSArray * AFCertificateTrustChainForServerTrust(SecTrustRef serverTrust) {
CFIndex certificateCount = SecTrustGetCertificateCount(serverTrust);
NSMutableArray *trustChain = [NSMutableArray arrayWithCapacity:(NSUInteger)certificateCount];
for (CFIndex i = 0; i < certificateCount; i++) {
SecCertificateRef certificate = SecTrustGetCertificateAtIndex(serverTrust, i);
[trustChain addObject:(__bridge_transfer NSData *)SecCertificateCopyData(certificate)];
}
return [NSArray arrayWithArray:trustChain];
}
複製程式碼這個方法是用來獲得伺服器返回的所有的證書中的公鑰
static NSArray * AFPublicKeyTrustChainForServerTrust(SecTrustRef serverTrust) {
SecPolicyRef policy = SecPolicyCreateBasicX509();
CFIndex certificateCount = SecTrustGetCertificateCount(serverTrust);
NSMutableArray *trustChain = [NSMutableArray arrayWithCapacity:(NSUInteger)certificateCount];
for (CFIndex i = 0; i < certificateCount; i++) {
SecCertificateRef certificate = SecTrustGetCertificateAtIndex(serverTrust, i);
SecCertificateRef someCertificates[] = {certificate};
CFArrayRef certificates = CFArrayCreate(NULL, (const void **)someCertificates, 1, NULL);
SecTrustRef trust;
__Require_noErr_Quiet(SecTrustCreateWithCertificates(certificates, policy, &trust), _out);
SecTrustResultType result;
__Require_noErr_Quiet(SecTrustEvaluate(trust, &result), _out);
[trustChain addObject:(__bridge_transfer id)SecTrustCopyPublicKey(trust)];
_out:
if (trust) {
CFRelease(trust);
}
if (certificates) {
CFRelease(certificates);
}
continue;
}
CFRelease(policy);
return [NSArray arrayWithArray:trustChain];
}
複製程式碼這裡面頻繁使用了兩個巨集：__Require_Quiet和__Require_noErr_Quiet，我們來看一下他們的定義:
#ifndef __Require_Quiet
#define __Require_Quiet(assertion, exceptionLabel) \
do \
{ \
if ( __builtin_expect(!(assertion), 0) ) \
{ \
goto exceptionLabel; \
} \
} while ( 0 )
#endif
複製程式碼可以看出__Require_Quiet這個巨集的作用是當斷言為假時，跳轉並執行標記之後的程式碼
#ifndef __Require_noErr_Quiet
#define __Require_noErr_Quiet(errorCode, exceptionLabel) \
do \
{ \
if ( __builtin_expect(0 != (errorCode), 0) ) \
{ \
goto exceptionLabel; \
} \
} while ( 0 )
#endif
複製程式碼可以看出__Require_noErr_Quiet這個巨集的作用是當斷言為真時，跳轉並執行標記之後的程式碼
2.2.類擴充套件
/**
儲存伺服器證書驗證模式
*/
@property (readwrite, nonatomic, assign) AFSSLPinningMode SSLPinningMode;
/**
儲存證書中的公鑰的集合
*/
@property (readwrite, nonatomic, strong) NSSet *pinnedPublicKeys;
複製程式碼2.3.實現
+ (NSSet *)certificatesInBundle:(NSBundle *)bundle {
// 獲取包中所有字尾為.cer的檔案路徑
NSArray *paths = [bundle pathsForResourcesOfType:@"cer" inDirectory:@"."];
// 遍歷檔案路徑並將其對應的檔案轉換為NSData型別資料
NSMutableSet *certificates = [NSMutableSet setWithCapacity:[paths count]];
for (NSString *path in paths) {
NSData *certificateData = [NSData dataWithContentsOfFile:path];
[certificates addObject:certificateData];
}
// 返回轉換為二進位制的證書的集合
return [NSSet setWithSet:certificates];
}
+ (NSSet *)defaultPinnedCertificates {
// 獲取預設證書列表
static NSSet *_defaultPinnedCertificates = nil;
static dispatch_once_t onceToken;
dispatch_once(&onceToken, ^{
NSBundle *bundle = [NSBundle bundleForClass:[self class]];
_defaultPinnedCertificates = [self certificatesInBundle:bundle];
});
return _defaultPinnedCertificates;
}
+ (instancetype)defaultPolicy {
// 按照預設例項化物件
AFSecurityPolicy *securityPolicy = [[self alloc] init];
securityPolicy.SSLPinningMode = AFSSLPinningModeNone;
return securityPolicy;
}
+ (instancetype)policyWithPinningMode:(AFSSLPinningMode)pinningMode {
// 呼叫全能例項化方法
return [self policyWithPinningMode:pinningMode withPinnedCertificates:[self defaultPinnedCertificates]];
}
+ (instancetype)policyWithPinningMode:(AFSSLPinningMode)pinningMode withPinnedCertificates:(NSSet *)pinnedCertificates {
// 例項化物件並設定屬性
AFSecurityPolicy *securityPolicy = [[self alloc] init];
securityPolicy.SSLPinningMode = pinningMode;
[securityPolicy setPinnedCertificates:pinnedCertificates];
return securityPolicy;
}
- (instancetype)init {
self = [super init];
if (!self) {
return nil;
}
// 驗證證書中的域名
self.validatesDomainName = YES;
return self;
}
- (void)setPinnedCertificates:(NSSet *)pinnedCertificates {
_pinnedCertificates = pinnedCertificates;
// 如果設定了證書，就取出證書中的公鑰並儲存
if (self.pinnedCertificates) {
NSMutableSet *mutablePinnedPublicKeys = [NSMutableSet setWithCapacity:[self.pinnedCertificates count]];
for (NSData *certificate in self.pinnedCertificates) {
id publicKey = AFPublicKeyForCertificate(certificate);
if (!publicKey) {
continue;
}
[mutablePinnedPublicKeys addObject:publicKey];
}
self.pinnedPublicKeys = [NSSet setWithSet:mutablePinnedPublicKeys];
} else {
self.pinnedPublicKeys = nil;
}
}
- (BOOL)evaluateServerTrust:(SecTrustRef)serverTrust
forDomain:(NSString *)domain
{
// 當使用自建證書驗證域名時，必須使用AFSSLPinningModePublicKey或者AFSSLPinningModeCertificate進行驗證
if (domain && self.allowInvalidCertificates && self.validatesDomainName && (self.SSLPinningMode == AFSSLPinningModeNone || [self.pinnedCertificates count] == 0)) {
// https://developer.apple.com/library/mac/documentation/NetworkingInternet/Conceptual/NetworkingTopics/Articles/OverridingSSLChainValidationCorrectly.html
// According to the docs, you should only trust your provided certs for evaluation.
// Pinned certificates are added to the trust. Without pinned certificates,
// there is nothing to evaluate against.
//
// From Apple Docs:
// "Do not implicitly trust self-signed certificates as anchors (kSecTrustOptionImplicitAnchors).
// Instead, add your own (self-signed) CA certificate to the list of trusted anchors."
NSLog(@"In order to validate a domain name for self signed certificates, you MUST use pinning.");
return NO;
}
// 如果需要驗證域名就新增一個驗證域名的策略
NSMutableArray *policies = [NSMutableArray array];
if (self.validatesDomainName) {
[policies addObject:(__bridge_transfer id)SecPolicyCreateSSL(true, (__bridge CFStringRef)domain)];
} else {
[policies addObject:(__bridge_transfer id)SecPolicyCreateBasicX509()];
}
// 新增安全策略，為serverTrust設定驗證策略，即告訴客戶端如何驗證serverTrust
SecTrustSetPolicies(serverTrust, (__bridge CFArrayRef)policies);
// 如果驗證策略為不驗證
if (self.SSLPinningMode == AFSSLPinningModeNone) {
// 如果信任無效或者過期證書則直接通過驗證，否則根絕驗證證書情況返回
return self.allowInvalidCertificates || AFServerTrustIsValid(serverTrust);
// 如果驗證策略為驗證，但未驗證通過並且不信任無效或者過期證書，返回未通過
} else if (!AFServerTrustIsValid(serverTrust) && !self.allowInvalidCertificates) {
return NO;
}
/**
當程式碼走到這兒的時候代表：
1.有驗證策略
2.證書驗證通過
3.不信任無效或者過期證書
*/
switch (self.SSLPinningMode) {
// 如果沒有驗證策略不通過驗證
case AFSSLPinningModeNone:
default:
return NO;
// 如果驗證策略為驗證整個證書
case AFSSLPinningModeCertificate: {
// 遍歷本地的證書進行驗證
NSMutableArray *pinnedCertificates = [NSMutableArray array];
for (NSData *certificateData in self.pinnedCertificates) {
[pinnedCertificates addObject:(__bridge_transfer id)SecCertificateCreateWithData(NULL, (__bridge CFDataRef)certificateData)];
}
SecTrustSetAnchorCertificates(serverTrust, (__bridge CFArrayRef)pinnedCertificates);
// 如果驗證不通過就返回
if (!AFServerTrustIsValid(serverTrust)) {
return NO;
}
// 驗證本地證書和伺服器返回的證書是否相同，如果相同才通過驗證
// obtain the chain after being validated, which *should* contain the pinned certificate in the last position (if it is the Root CA)
NSArray *serverCertificates = AFCertificateTrustChainForServerTrust(serverTrust);
for (NSData *trustChainCertificate in [serverCertificates reverseObjectEnumerator]) {
if ([self.pinnedCertificates containsObject:trustChainCertificate]) {
return YES;
}
}
return NO;
}
// 如果驗證策略為驗證證書的公鑰
case AFSSLPinningModePublicKey: {
// 獲取伺服器返回的公鑰和本地的公鑰進行對比，只要有一個相同就通過驗證
NSUInteger trustedPublicKeyCount = 0;
NSArray *publicKeys = AFPublicKeyTrustChainForServerTrust(serverTrust);
for (id trustChainPublicKey in publicKeys) {
for (id pinnedPublicKey in self.pinnedPublicKeys) {
if (AFSecKeyIsEqualToKey((__bridge SecKeyRef)trustChainPublicKey, (__bridge SecKeyRef)pinnedPublicKey)) {
trustedPublicKeyCount += 1;
}
}
}
return trustedPublicKeyCount > 0;
}
}
return NO;
}
複製程式碼2.4.KVO
+ (NSSet *)keyPathsForValuesAffectingPinnedPublicKeys {
return [NSSet setWithObject:@"pinnedCertificates"];
}
複製程式碼新增依賴鍵，使pinnedPublicKeys屬性依賴於pinnedCertificates屬性，當pinnedCertificates屬性值發生變化時，pinnedPublicKeys的觀察者也能得到通知
2.5.NSSecureCoding協議的實現
+ (BOOL)supportsSecureCoding {
return YES;
}
- (instancetype)initWithCoder:(NSCoder *)decoder {
self = [self init];
if (!self) {
return nil;
}
self.SSLPinningMode = [[decoder decodeObjectOfClass:[NSNumber class] forKey:NSStringFromSelector(@selector(SSLPinningMode))] unsignedIntegerValue];
self.allowInvalidCertificates = [decoder decodeBoolForKey:NSStringFromSelector(@selector(allowInvalidCertificates))];
self.validatesDomainName = [decoder decodeBoolForKey:NSStringFromSelector(@selector(validatesDomainName))];
self.pinnedCertificates = [decoder decodeObjectOfClass:[NSArray class] forKey:NSStringFromSelector(@selector(pinnedCertificates))];
return self;
}
- (void)encodeWithCoder:(NSCoder *)coder {
[coder encodeObject:[NSNumber numberWithUnsignedInteger:self.SSLPinningMode] forKey:NSStringFromSelector(@selector(SSLPinningMode))];
[coder encodeBool:self.allowInvalidCertificates forKey:NSStringFromSelector(@selector(allowInvalidCertificates))];
[coder encodeBool:self.validatesDomainName forKey:NSStringFromSelector(@selector(validatesDomainName))];
[coder encodeObject:self.pinnedCertificates forKey:NSStringFromSelector(@selector(pinnedCertificates))];
}
複製程式碼關於NSSecureCoding在AFNetworking原始碼閱讀（二）——從AFURLRequestSerialization入手的"4.1.2.4.7 NSSecureCoding協議方法的實現"中已經解釋過了，就不再複述
2.6.NSCopying協議的實現
- (instancetype)copyWithZone:(NSZone *)zone {
AFSecurityPolicy *securityPolicy = [[[self class] allocWithZone:zone] init];
securityPolicy.SSLPinningMode = self.SSLPinningMode;
securityPolicy.allowInvalidCertificates = self.allowInvalidCertificates;
securityPolicy.validatesDomainName = self.validatesDomainName;
securityPolicy.pinnedCertificates = [self.pinnedCertificates copyWithZone:zone];
return securityPolicy;
}
複製程式碼3.總結
因為對HTTP和SSL不是很瞭解，所以只做了一些大概功能的閱讀。想詳細瞭解的話還是得先認真學習HTTP和SSL相關知識。
原始碼閱讀系列：AFNetworking
原始碼閱讀：AFNetworking（二）——AFURLRequestSerialization
原始碼閱讀：AFNetworking（三）——AFURLResponseSerialization
原始碼閱讀：AFNetworking（四）——AFSecurityPolicy
原始碼閱讀：AFNetworking（五）——AFNetworkReachabilityManager
原始碼閱讀：AFNetworking（六）——AFURLSessionManager
原始碼閱讀：AFNetworking（七）——AFHTTPSessionManager
原始碼閱讀：AFNetworking（八）——AFAutoPurgingImageCache
原始碼閱讀：AFNetworking（九）——AFImageDownloader
原始碼閱讀：AFNetworking（十）——AFNetworkActivityIndicatorManager
原始碼閱讀：AFNetworking（十一）——UIActivityIndicatorView+AFNetworking
原始碼閱讀：AFNetworking（十二）——UIButton+AFNetworking
原始碼閱讀：AFNetworking（十三）——UIImageView+AFNetworking
原始碼閱讀：AFNetworking（十四）——UIProgressView+AFNetworking