|
|
|
|
@ -2,37 +2,51 @@ package com.github.catvod.net; |
|
|
|
|
|
|
|
|
|
import android.annotation.SuppressLint; |
|
|
|
|
|
|
|
|
|
import org.conscrypt.Conscrypt; |
|
|
|
|
|
|
|
|
|
import java.io.IOException; |
|
|
|
|
import java.net.InetAddress; |
|
|
|
|
import java.net.Socket; |
|
|
|
|
import java.security.Provider; |
|
|
|
|
import java.security.Security; |
|
|
|
|
import java.security.cert.X509Certificate; |
|
|
|
|
import java.util.Arrays; |
|
|
|
|
import java.util.HashSet; |
|
|
|
|
import java.util.LinkedList; |
|
|
|
|
import java.util.List; |
|
|
|
|
|
|
|
|
|
import javax.net.ssl.HostnameVerifier; |
|
|
|
|
import javax.net.ssl.HttpsURLConnection; |
|
|
|
|
import javax.net.ssl.SSLContext; |
|
|
|
|
import javax.net.ssl.SSLSocket; |
|
|
|
|
import javax.net.ssl.SSLSocketFactory; |
|
|
|
|
import javax.net.ssl.TrustManager; |
|
|
|
|
import javax.net.ssl.X509TrustManager; |
|
|
|
|
|
|
|
|
|
public class SSLCompat extends SSLSocketFactory { |
|
|
|
|
|
|
|
|
|
public static final HostnameVerifier VERIFIER = (hostname, session) -> true; |
|
|
|
|
|
|
|
|
|
private static String[] cipherSuites; |
|
|
|
|
private static String[] protocols; |
|
|
|
|
private SSLSocketFactory factory; |
|
|
|
|
|
|
|
|
|
static { |
|
|
|
|
try { |
|
|
|
|
SSLSocket socket = (SSLSocket) SSLSocketFactory.getDefault().createSocket(); |
|
|
|
|
List<String> protocols = new LinkedList<>(); |
|
|
|
|
for (String protocol : socket.getSupportedProtocols()) if (!protocol.toUpperCase().contains("SSL")) protocols.add(protocol); |
|
|
|
|
SSLCompat.protocols = protocols.toArray(new String[protocols.size()]); |
|
|
|
|
List<String> allowedCiphers = Arrays.asList("TLS_RSA_WITH_AES_256_GCM_SHA384", "TLS_RSA_WITH_AES_128_GCM_SHA256", "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256", "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256", "TLS_ECHDE_RSA_WITH_AES_128_GCM_SHA256", "TLS_RSA_WITH_3DES_EDE_CBC_SHA", "TLS_RSA_WITH_AES_128_CBC_SHA", "TLS_RSA_WITH_AES_256_CBC_SHA", "TLS_ECDHE_ECDSA_WITH_3DES_EDE_CBC_SHA", "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA", "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA"); |
|
|
|
|
List<String> availableCiphers = Arrays.asList(socket.getSupportedCipherSuites()); |
|
|
|
|
HashSet<String> preferredCiphers = new HashSet<>(allowedCiphers); |
|
|
|
|
preferredCiphers.retainAll(availableCiphers); |
|
|
|
|
preferredCiphers.addAll(new HashSet<>(Arrays.asList(socket.getEnabledCipherSuites()))); |
|
|
|
|
SSLCompat.cipherSuites = preferredCiphers.toArray(new String[preferredCiphers.size()]); |
|
|
|
|
} catch (IOException e) { |
|
|
|
|
e.printStackTrace(); |
|
|
|
|
} |
|
|
|
|
} |
|
|
|
|
|
|
|
|
|
public SSLCompat() { |
|
|
|
|
try { |
|
|
|
|
Provider provider = Conscrypt.newProvider(); |
|
|
|
|
Security.insertProviderAt(provider, 1); |
|
|
|
|
SSLContext context = SSLContext.getInstance("TLS", provider); |
|
|
|
|
context.init(null, new TrustManager[]{TM}, null); |
|
|
|
|
factory = context.getSocketFactory(); |
|
|
|
|
HttpsURLConnection.setDefaultSSLSocketFactory(factory); |
|
|
|
|
SSLContext context = SSLContext.getInstance("TLS"); |
|
|
|
|
context.init(null, new X509TrustManager[]{TM}, null); |
|
|
|
|
HttpsURLConnection.setDefaultSSLSocketFactory(factory = context.getSocketFactory()); |
|
|
|
|
} catch (Exception e) { |
|
|
|
|
e.printStackTrace(); |
|
|
|
|
} |
|
|
|
|
@ -40,51 +54,57 @@ public class SSLCompat extends SSLSocketFactory { |
|
|
|
|
|
|
|
|
|
@Override |
|
|
|
|
public String[] getDefaultCipherSuites() { |
|
|
|
|
return factory.getDefaultCipherSuites(); |
|
|
|
|
return cipherSuites; |
|
|
|
|
} |
|
|
|
|
|
|
|
|
|
@Override |
|
|
|
|
public String[] getSupportedCipherSuites() { |
|
|
|
|
return factory.getSupportedCipherSuites(); |
|
|
|
|
} |
|
|
|
|
|
|
|
|
|
@Override |
|
|
|
|
public Socket createSocket() throws IOException { |
|
|
|
|
return enableTLSOnSocket(factory.createSocket()); |
|
|
|
|
return cipherSuites; |
|
|
|
|
} |
|
|
|
|
|
|
|
|
|
@Override |
|
|
|
|
public Socket createSocket(Socket s, String host, int port, boolean autoClose) throws IOException { |
|
|
|
|
return enableTLSOnSocket(factory.createSocket(s, host, port, autoClose)); |
|
|
|
|
Socket ssl = factory.createSocket(s, host, port, autoClose); |
|
|
|
|
if (ssl instanceof SSLSocket) upgradeTLS((SSLSocket) ssl); |
|
|
|
|
return ssl; |
|
|
|
|
} |
|
|
|
|
|
|
|
|
|
@Override |
|
|
|
|
public Socket createSocket(String host, int port) throws IOException { |
|
|
|
|
return enableTLSOnSocket(factory.createSocket(host, port)); |
|
|
|
|
Socket ssl = factory.createSocket(host, port); |
|
|
|
|
if (ssl instanceof SSLSocket) upgradeTLS((SSLSocket) ssl); |
|
|
|
|
return ssl; |
|
|
|
|
} |
|
|
|
|
|
|
|
|
|
@Override |
|
|
|
|
public Socket createSocket(String host, int port, InetAddress localHost, int localPort) throws IOException { |
|
|
|
|
return enableTLSOnSocket(factory.createSocket(host, port, localHost, localPort)); |
|
|
|
|
Socket ssl = factory.createSocket(host, port, localHost, localPort); |
|
|
|
|
if (ssl instanceof SSLSocket) upgradeTLS((SSLSocket) ssl); |
|
|
|
|
return ssl; |
|
|
|
|
} |
|
|
|
|
|
|
|
|
|
@Override |
|
|
|
|
public Socket createSocket(InetAddress host, int port) throws IOException { |
|
|
|
|
return enableTLSOnSocket(factory.createSocket(host, port)); |
|
|
|
|
Socket ssl = factory.createSocket(host, port); |
|
|
|
|
if (ssl instanceof SSLSocket) upgradeTLS((SSLSocket) ssl); |
|
|
|
|
return ssl; |
|
|
|
|
} |
|
|
|
|
|
|
|
|
|
@Override |
|
|
|
|
public Socket createSocket(InetAddress address, int port, InetAddress localAddress, int localPort) throws IOException { |
|
|
|
|
return enableTLSOnSocket(factory.createSocket(address, port, localAddress, localPort)); |
|
|
|
|
Socket ssl = factory.createSocket(address, port, localAddress, localPort); |
|
|
|
|
if (ssl instanceof SSLSocket) upgradeTLS((SSLSocket) ssl); |
|
|
|
|
return ssl; |
|
|
|
|
} |
|
|
|
|
|
|
|
|
|
private Socket enableTLSOnSocket(Socket socket) { |
|
|
|
|
if (socket instanceof SSLSocket) ((SSLSocket) socket).setEnabledProtocols(new String[]{"TLSv1.2", "TLSv1.3"}); |
|
|
|
|
return socket; |
|
|
|
|
private void upgradeTLS(SSLSocket ssl) { |
|
|
|
|
if (protocols != null) ssl.setEnabledProtocols(protocols); |
|
|
|
|
if (cipherSuites != null) ssl.setEnabledCipherSuites(cipherSuites); |
|
|
|
|
} |
|
|
|
|
|
|
|
|
|
@SuppressLint({"TrustAllX509TrustManager", "CustomX509TrustManager"}) |
|
|
|
|
public static final X509TrustManager TM = new X509TrustManager() { |
|
|
|
|
|
|
|
|
|
@Override |
|
|
|
|
public void checkClientTrusted(X509Certificate[] chain, String authType) { |
|
|
|
|
} |
|
|
|
|
|