AFNetworking 3.0 源码解读（二）之 AFSecurityPolicy

1 AFHTTPRequestOperationManager *manager = [AFHTTPRequestOperationManager manager]; 
2 
3 AFSecurityPolicy *securityPolicy = [[AFSecurityPolicy alloc] init]; 
4 [securityPolicy setAllowInvalidCertificates:NO]; 
5 [securityPolicy setSSLPinningMode:AFSSLPinningModeCertificate]; 
6 [securityPolicy setValidatesDomainName:YES];
7 [securityPolicy setValidatesCertificateChain:NO]; 
8 
9 manager.securityPolicy = securityPolicy;

 1 // 在证书中获取公钥
 2 static id AFPublicKeyForCertificate(NSData *certificate) {
 3     id allowedPublicKey = nil;
 4     SecCertificateRef allowedCertificate;
 5     SecCertificateRef allowedCertificates[1];
 6     CFArrayRef tempCertificates = nil;
 7     SecPolicyRef policy = nil;
 8     SecTrustRef allowedTrust = nil;
 9     SecTrustResultType result;
10 
11     // 1. 根据二进制的certificate生成SecCertificateRef类型的证书
12     // NSData *certificate 通过CoreFoundation (__bridge CFDataRef)转换成 CFDataRef
13     // 看下边的这个方法就可以知道需要传递参数的类型
14     /* 
15      SecCertificateRef SecCertificateCreateWithData(CFAllocatorRef __nullable allocator,
16      CFDataRef data) __OSX_AVAILABLE_STARTING(__MAC_10_6, __IPHONE_2_0);
17      */
18     allowedCertificate = SecCertificateCreateWithData(NULL, (__bridge CFDataRef)certificate);
19     
20     // 2.如果allowedCertificate为空，则执行标记_out后边的代码
21     __Require_Quiet(allowedCertificate != NULL, _out);
22 
23     // 3.给allowedCertificates赋值
24     allowedCertificates[0] = allowedCertificate;
25     
26     // 4.新建CFArra： tempCertificates
27     tempCertificates = CFArrayCreate(NULL, (const void **)allowedCertificates, 1, NULL);
28 
29     // 5. 新建policy为X.509
30     policy = SecPolicyCreateBasicX509();
31     
32     // 6.创建SecTrustRef对象，如果出错就跳到_out标记处
33     __Require_noErr_Quiet(SecTrustCreateWithCertificates(tempCertificates, policy, &allowedTrust), _out);
34     // 7.校验证书的过程，这个不是异步的。
35     __Require_noErr_Quiet(SecTrustEvaluate(allowedTrust, &result), _out);
36 
37     // 8.在SecTrustRef对象中取出公钥
38     allowedPublicKey = (__bridge_transfer id)SecTrustCopyPublicKey(allowedTrust);
39 
40 _out:
41     if (allowedTrust) {
42         CFRelease(allowedTrust);
43     }
44 
45     if (policy) {
46         CFRelease(policy);
47     }
48 
49     if (tempCertificates) {
50         CFRelease(tempCertificates);
51     }
52 
53     if (allowedCertificate) {
54         CFRelease(allowedCertificate);
55     }
56 
57     return allowedPublicKey;
58 }

 1 - (BOOL)evaluateServerTrust:(SecTrustRef)serverTrust
 2                   forDomain:(NSString *)domain
 3 {
 4     if (domain && self.allowInvalidCertificates && self.validatesDomainName && (self.SSLPinningMode == AFSSLPinningModeNone || [self.pinnedCertificates count] == 0)) {
 5         // https://developer.apple.com/library/mac/documentation/NetworkingInternet/Conceptual/NetworkingTopics/Articles/OverridingSSLChainValidationCorrectly.html
 6         //  According to the docs, you should only trust your provided certs for evaluation.
 7         //  Pinned certificates are added to the trust. Without pinned certificates,
 8         //  there is nothing to evaluate against.
 9         //
10         //  From Apple Docs:
11         //          "Do not implicitly trust self-signed certificates as anchors (kSecTrustOptionImplicitAnchors).
12         //           Instead, add your own (self-signed) CA certificate to the list of trusted anchors."
13         NSLog(@"In order to validate a domain name for self signed certificates, you MUST use pinning.");
14         return NO;
15     }
16 
17     NSMutableArray *policies = [NSMutableArray array];
18     if (self.validatesDomainName) {
19         [policies addObject:(__bridge_transfer id)SecPolicyCreateSSL(true, (__bridge CFStringRef)domain)];
20     } else {
21         [policies addObject:(__bridge_transfer id)SecPolicyCreateBasicX509()];
22     }
23 
24     SecTrustSetPolicies(serverTrust, (__bridge CFArrayRef)policies);
25 
26     // AFSSLPinningModeNone 不校验证书，
27     if (self.SSLPinningMode == AFSSLPinningModeNone) {
28         return self.allowInvalidCertificates || AFServerTrustIsValid(serverTrust);
29     } else if (!AFServerTrustIsValid(serverTrust) && !self.allowInvalidCertificates) {
30         return NO;
31     }
32 
33     
34     // 代码能够走到这里说明两点
35     // 1.通过了根证书的验证
36     // 2.allowInvalidCertificates = YES
37     
38     switch (self.SSLPinningMode) {
39         case AFSSLPinningModeNone:
40         default:
41             return NO;
42         case AFSSLPinningModeCertificate: { // 全部校验
43             NSMutableArray *pinnedCertificates = [NSMutableArray array];
44             for (NSData *certificateData in self.pinnedCertificates) {
45                 [pinnedCertificates addObject:(__bridge_transfer id)SecCertificateCreateWithData(NULL, (__bridge CFDataRef)certificateData)];
46             }
47             
48             // 把本地的证书设为根证书，即服务器应该信任的证书
49             SecTrustSetAnchorCertificates(serverTrust, (__bridge CFArrayRef)pinnedCertificates);
50 
51             // 校验能够信任
52             if (!AFServerTrustIsValid(serverTrust)) {
53                 return NO;
54             }
55 
56             // obtain the chain after being validated, which *should* contain the pinned certificate in the last position (if it's the Root CA)
57             NSArray *serverCertificates = AFCertificateTrustChainForServerTrust(serverTrust);
58             
59             //  判断本地证书和服务器证书是否相同
60             for (NSData *trustChainCertificate in [serverCertificates reverseObjectEnumerator]) {
61                 if ([self.pinnedCertificates containsObject:trustChainCertificate]) {
62                     return YES;
63                 }
64             }
65             
66             return NO;
67         }
68         case AFSSLPinningModePublicKey: {
69             NSUInteger trustedPublicKeyCount = 0;
70             NSArray *publicKeys = AFPublicKeyTrustChainForServerTrust(serverTrust);
71 
72             // 找到相同的公钥就通过
73             for (id trustChainPublicKey in publicKeys) {
74                 for (id pinnedPublicKey in self.pinnedPublicKeys) {
75                     if (AFSecKeyIsEqualToKey((__bridge SecKeyRef)trustChainPublicKey, (__bridge SecKeyRef)pinnedPublicKey)) {
76                         trustedPublicKeyCount += 1;
77                     }
78                 }
79             }
80             return trustedPublicKeyCount > 0;
81         }
82     }
83     
84     return NO;
85 }

 1 #pragma mark - NSKeyValueObserving
 2 
 3 + (NSSet *)keyPathsForValuesAffectingPinnedPublicKeys {
 4     return [NSSet setWithObject:@"pinnedCertificates"];
 5 }
 6 
 7 #pragma mark - NSSecureCoding
 8 
 9 + (BOOL)supportsSecureCoding {
10     return YES;
11 }
12 
13 - (instancetype)initWithCoder:(NSCoder *)decoder {
14 
15     self = [self init];
16     if (!self) {
17         return nil;
18     }
19 
20     self.SSLPinningMode = [[decoder decodeObjectOfClass:[NSNumber class] forKey:NSStringFromSelector(@selector(SSLPinningMode))] unsignedIntegerValue];
21     self.allowInvalidCertificates = [decoder decodeBoolForKey:NSStringFromSelector(@selector(allowInvalidCertificates))];
22     self.validatesDomainName = [decoder decodeBoolForKey:NSStringFromSelector(@selector(validatesDomainName))];
23     self.pinnedCertificates = [decoder decodeObjectOfClass:[NSArray class] forKey:NSStringFromSelector(@selector(pinnedCertificates))];
24 
25     return self;
26 }
27 
28 - (void)encodeWithCoder:(NSCoder *)coder {
29     [coder encodeObject:[NSNumber numberWithUnsignedInteger:self.SSLPinningMode] forKey:NSStringFromSelector(@selector(SSLPinningMode))];
30     [coder encodeBool:self.allowInvalidCertificates forKey:NSStringFromSelector(@selector(allowInvalidCertificates))];
31     [coder encodeBool:self.validatesDomainName forKey:NSStringFromSelector(@selector(validatesDomainName))];
32     [coder encodeObject:self.pinnedCertificates forKey:NSStringFromSelector(@selector(pinnedCertificates))];
33 }
34 
35 #pragma mark - NSCopying
36 
37 - (instancetype)copyWithZone:(NSZone *)zone {
38     AFSecurityPolicy *securityPolicy = [[[self class] allocWithZone:zone] init];
39     securityPolicy.SSLPinningMode = self.SSLPinningMode;
40     securityPolicy.allowInvalidCertificates = self.allowInvalidCertificates;
41     securityPolicy.validatesDomainName = self.validatesDomainName;
42     securityPolicy.pinnedCertificates = [self.pinnedCertificates copyWithZone:zone];
43 
44     return securityPolicy;
45 }