Fixed SSL CA chain on iOS and tvOS - #1331
Conversation
380e6cb to
3c97548
Compare
There was a problem hiding this comment.
Trying https requesting into https://jsonplaceholder.typicode.com/users on Funkin
All of onData, onBytes, and onStatus callbacks are working fine
|
Post request at https://jsonplaceholder.typicode.com/posts works as well! |
|
This pr fixed the issue for me, thanks! Hope it's merged soon |
2c40c91 to
91de865
Compare
91de865 to
caa098e
Compare
|
Theres been a typo that happend in this commit since this is how it was before that happend which made it so the certificate was never check properly, i hope its fine to add this one line change here... |
tobil4sk
left a comment
tobil4sk
left a comment
There was a problem hiding this comment.
The typo fix looks correct. Everything else looks reasonable too now (though I can't test it).
TechnikTil
left a comment
TechnikTil
left a comment
There was a problem hiding this comment.
latest changes work for me on iOS 26.3.1!
will do testing on tvOS once i figure out where my Apple TV is…
|
@Simn could you get a look at this pr? it fixes a major issue on |
|
@MAJigsaw77 should I re-test? |
| } | ||
|
|
||
| CFDataRef derData = CFDataCreate(NULL, crt->raw.p, crt->raw.len); | ||
| if (!derData) return 0; |
There was a problem hiding this comment.
The windows verify_callback returns MBEDTLS_ERR_X509_FATAL_ERROR in cases like this. Shouldn't we do the same here?
| CFRelease(trust); | ||
| if (err) CFRelease(err); | ||
|
|
||
| if (trusted) *flags = 0; |
There was a problem hiding this comment.
Similarly on windows we set *flags |= MBEDTLS_X509_BADCERT_OTHER; if we could not verify the certificate, I think we should do the same here if trusted is false. Otherwise, I think the current code can accept invalid certificates.
| CFRelease(secCert); | ||
|
|
||
| CFErrorRef err = NULL; | ||
| bool trusted = SecTrustEvaluateWithError(trust, &err); |
There was a problem hiding this comment.
This warning shows when compiling this code:
/Users/runner/haxelib/hxcpp/git/src/hx/libs/ssl/SSL.cpp:427:17: warning: 'SecTrustEvaluateWithError' is only available on iOS 12.0 or newer [-Wunguarded-availability-new]
427 | bool trusted = SecTrustEvaluateWithError(trust, &err);
| ^~~~~~~~~~~~~~~~~~~~~~~~~
/Applications/Xcode_26.3.app/Contents/Developer/Platforms/iPhoneOS.platform/Developer/SDKs/iPhoneOS26.2.sdk/System/Library/Frameworks/Security.framework/Headers/SecTrust.h:426:1: note: 'SecTrustEvaluateWithError' has been marked as being introduced in iOS 12.0 here, but the deployment target is iOS 10.0.0
426 | SecTrustEvaluateWithError(SecTrustRef trust, CFErrorRef _Nullable * _Nullable CF_RETURNS_RETAINED error)
| ^
/Users/runner/haxelib/hxcpp/git/src/hx/libs/ssl/SSL.cpp:427:17: note: enclose 'SecTrustEvaluateWithError' in a __builtin_available check to silence this warning
427 | bool trusted = SecTrustEvaluateWithError(trust, &err);
| ^~~~~~~~~~~~~~~~~~~~~~~~~
428 | CFRelease(trust);
429 | if (err) CFRelease(err);
430 |
431 | if (trusted) *flags = 0;
| We should add the suggested check
6 participants
This pr has been originally done FunkinCrew#11 but since this is a pretty important fix for
hxcppi thought why not do it here aswell, it fixes #570 by properly setting theSSL CAchain oniOSandtvOS.