Add support for cert-pinning on Windows and Mac. #702

chogorma · 2018-02-19T19:15:17Z

Pull request for the solution we ended up using from the first PR: #135

Again, this is a preliminary pull request to see if you guys are happy to add this to Casablanca.

Added a callback that will return the certificate_info with the cert chain to the consumer.

The certificate_info will contain:

The encoded data of each certificate in the chain up to the root certificate (if the OS can build the full chain).
The host name of the request.
The error code for the current status of the certificate chain.
The OS verified status of the chain.

Using this approach we leave the validation of the full certificate chain up to the consumer, so Casablanca does not have to support managing different types of certificate lists for the consumer to do cert-pinning.

The consumer can then use OpenSSL (Or whatever they want) to import the certificate chain and they will then decide on whether to accept or reject the connection.

Current changes are for Windows & Mac.

msftclas · 2018-02-19T19:15:28Z

All CLA requirements met.

reneme · 2018-02-28T10:12:00Z

Release/src/http/client/http_client_asio.cpp

+            };
+
+            return http::client::details::verify_cert_chain_platform_specific(verifyCtx, utility::conversions::to_utf8string(host), chainFunc);
+            }


code cosmetics: indentation of closing bracket

matra774 · 2018-02-27T08:19:05Z

Release/src/http/client/http_client_winhttp.cpp

                p_request_context->report_error(errorCode, build_error_msg(error_result));
                break;
            }
+            case WINHTTP_CALLBACK_STATUS_SENDING_REQUEST:
+            {


This status does not seem to be hit on our system (Windows 7). We get the following notifications:

WINHTTP_CALLBACK_STATUS_HANDLE_CREATED

WINHTTP_CALLBACK_STATUS_SENDREQUEST_COMPLETE

WINHTTP_CALLBACK_STATUS_HEADERS_AVAILABLE

WINHTTP_CALLBACK_STATUS_DATA_AVAILABLE

WINHTTP_CALLBACK_STATUS_READ_COMPLETE
....

Looks like the PR is missing a flag when calling WinHttpSetStatusCallback, we do have integration tests on our network manager but somehow i missed the flag when creating the diff from our repo.

Adding that that now.

…Callback and add two tests for cert-pinning windows.

reneme

Thanks a lot for this patch! I really like the API and I would love to have it upstream.

reneme · 2018-02-28T12:03:33Z

Release/include/cpprest/certificate_info.h

+    {
+        CertificateChain certificate_chain;
+        std::string host_name;
+        long certificate_error{ 0 };


How do I interpret this error code? I suppose it's platform dependent?
Please add some description in the comments.

Yes, the error code is platform dependent, we use it for debugging certificate issues.
Mac: https://developer.apple.com/documentation/security/sectrustresulttype
Windows: https://msdn.microsoft.com/en-us/library/windows/desktop/aa377590(v=vs.85).aspx

Will add a comment for that.

reneme · 2018-02-28T15:12:52Z

Release/src/http/client/http_client_asio.cpp

+            return false;
+        }
+
+        auto info = std::make_shared<certificate_info>(host, get_X509_cert_chain_encoded_data(verifyCtx));


This does currently not compile on Linux because get_X509_cert_chain_encoded_data() is not defined (due to some #ifdef). @chogorma Please refer to our PR to your private repository.

reneme · 2018-02-28T15:14:37Z

Release/src/http/client/http_client_asio.cpp

+        auto info = std::make_shared<certificate_info>(host, get_X509_cert_chain_encoded_data(verifyCtx));
+        info->verified = true;
+
+        return m_http_client->client_config().invoke_certificate_chain_callback(info);


On Linux this is called several times. I'm not exactly sure why, but I suppose it is due to the way OpenSSL handles certificate chains (cf. comments in this method). Do we need a similar workaround as for macOS and Android above?

Yes, you would need to do the same flow on Linux as per the macOS flow above.

The "is_end_certificate_in_chain" check above should allow the connection until we get the end certificate, once we get that, then we get the OS to build the full cert chain, only after that, then we do the cert-pinning.

If you just wait for the end certificate and don't build the full chain from the OS, you will only have the certs from the SSL handshake, and more than likely that will not be the full chain.

reneme · 2018-02-28T15:18:57Z

Release/src/websockets/client/ws_client_wspp.cpp

+                    auto info = std::make_shared<http::client::certificate_info>(utility::conversions::to_utf8string(m_uri.host()), get_X509_cert_chain_encoded_data(verifyCtx));
+                    info->verified = true;
+
+                    return m_config.invoke_certificate_chain_callback(info);


Wild guess: I would expect that this would also be invoked more than once per connection on Linux as it seems to be duplicated code referred to my comment above.

Correct as the check "is_end_certificate_in_chain" isn't done on Linux.

FIX: Certificate Pinning Compilation on Linux

xqp · 2018-04-05T13:57:58Z

Thanks for this PR 👍
@chogorma can you look at our pr in your local repo? :)

linux: invoke the certificate chain callback only once

BillyONeal · 2019-06-13T01:57:46Z

We have had a number of requests for something like this -- we would be interested in adding such a feature, but unfortunately this one doesn't merge cleanly and appears to be incompatible with how we implemented Host: domain reassignment :(

Any chance you want to try to resolve the merges or should we close this?

BillyONeal · 2019-08-27T01:15:13Z

Given that this doesn't merge cleanly and is missing tests, I'm closing this for now. Anyone feel free to reopen with the conflicts fixed.

(We aren't normally a super stickler about tests being added for each new feature, but this one is security sensitive. Doing it as an "outside test" that pings a server, like we do for our badssl tests, is OK)

Add support for cert-pinning on Windows and Mac.

917ee0e

chogorma mentioned this pull request Feb 19, 2018

https: certificate pinning #314

Open

reneme reviewed Feb 28, 2018

View reviewed changes

matra774 reviewed Feb 28, 2018

View reviewed changes

chogorma and others added 3 commits February 28, 2018 13:18

Pass WINHTTP_CALLBACK_FLAG_SEND_REQUEST when setting WinHttpSetStatus…

fd17845

…Callback and add two tests for cert-pinning windows.

FIX: compile on linux

f875121

amend contributers file

9aa9ae5

reneme mentioned this pull request Feb 28, 2018

FIX: Certificate Pinning Compilation on Linux chogorma/cpprestsdk#1

Merged

reneme reviewed Feb 28, 2018

View reviewed changes

chogorma and others added 2 commits February 28, 2018 16:01

Merge pull request #1 from reneme/feature/cert_access

39c26e0

FIX: Certificate Pinning Compilation on Linux

linux: invoke the certificate chain callback only once

79c74d2

Merge pull request #2 from xqp/feature/use_tls_cert_check_callback_once

5d5dca0

linux: invoke the certificate chain callback only once

BillyONeal added the needs tests label Oct 18, 2018

BillyONeal closed this Aug 27, 2019

atbagga mentioned this pull request Oct 26, 2021

[Work in progress] Certificate pinning support #1659

Open

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Add support for cert-pinning on Windows and Mac. #702

Add support for cert-pinning on Windows and Mac. #702

chogorma commented Feb 19, 2018 •

edited

Loading

msftclas commented Feb 19, 2018 •

edited

Loading

reneme Feb 28, 2018

matra774 Feb 27, 2018

chogorma Feb 28, 2018

reneme left a comment

reneme Feb 28, 2018

chogorma Feb 28, 2018

reneme Feb 28, 2018

reneme Feb 28, 2018

chogorma Feb 28, 2018

reneme Feb 28, 2018

chogorma Feb 28, 2018

xqp commented Apr 5, 2018

BillyONeal commented Jun 13, 2019

BillyONeal commented Aug 27, 2019

Add support for cert-pinning on Windows and Mac. #702

Add support for cert-pinning on Windows and Mac. #702

Conversation

chogorma commented Feb 19, 2018 • edited Loading

msftclas commented Feb 19, 2018 • edited Loading

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

reneme left a comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

xqp commented Apr 5, 2018

BillyONeal commented Jun 13, 2019

BillyONeal commented Aug 27, 2019

chogorma commented Feb 19, 2018 •

edited

Loading

msftclas commented Feb 19, 2018 •

edited

Loading