Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Extend macOS implementation of SqueakSSL plugin to support setting a certificate on the SSL session context #816

Merged
merged 2 commits into from
Jun 28, 2024
Merged

Extend macOS implementation of SqueakSSL plugin to support setting a certificate on the SSL session context #816

Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
539aedd
Fixed bug in ‘sqAcceptSSL’ in ‘sqMacSSL.c’ which, after setting the s…
Rinzwind Jun 15, 2024
28670bc
Made ‘sqSetupSSL’ in ‘sqMacSSL.c’ handle the ‘CERTNAME’ property havi…
Rinzwind Jun 16, 2024
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
36 changes: 35 additions & 1 deletion extracted/plugins/SqueakSSL/src/osx/sqMacSSL.c
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -206,6 +206,40 @@ OSStatus sqSetupSSL(sqSSL* ssl, int isServer)
}
}

if (ssl->certName) {
CFStringRef certName = CFStringCreateWithCString(kCFAllocatorDefault, ssl->certName, kCFStringEncodingASCII);
if (certName == NULL)
return SQSSL_GENERIC_ERROR;
CFMutableDictionaryRef query = CFDictionaryCreateMutable(kCFAllocatorDefault, 0, &kCFTypeDictionaryKeyCallBacks, &kCFTypeDictionaryValueCallBacks);
if (query == NULL) {
CFRelease(certName);
return SQSSL_GENERIC_ERROR;
}
CFDictionarySetValue(query, kSecMatchLimit, kSecMatchLimitOne);
CFDictionarySetValue(query, kSecReturnRef, kCFBooleanTrue);
CFDictionarySetValue(query, kSecClass, kSecClassIdentity);
CFDictionarySetValue(query, kSecMatchSubjectWholeString, certName);
CFDictionarySetValue(query, kSecMatchValidOnDate, kCFNull);
CFRelease(certName);
SecIdentityRef identity;
status = SecItemCopyMatching(query, (CFTypeRef*) &identity);
CFRelease(query);
if (status != noErr) {
logStatus(status, status == errSecItemNotFound ? "SecItemCopyMatching had no results" : "SecItemCopyMatching failed");
return status;
}
CFArrayRef certs = CFArrayCreate(kCFAllocatorDefault, (const void **)&identity, 1, &kCFTypeArrayCallBacks);
CFRelease(identity);
if (certs == NULL)
return SQSSL_GENERIC_ERROR;
status = SSLSetCertificate(ssl->ctx, certs);
CFRelease(certs);
if (status != noErr) {
logStatus(status, "SSLSetCertificate failed");
return status;
}
}

return status;
}

Expand Down Expand Up @@ -626,7 +660,7 @@ sqInt sqAcceptSSL(sqInt handle, char* srcBuf, sqInt srcLen, char* dstBuf,
}
/* We are connected. Verify the cert. */
ssl->state = SQSSL_CONNECTED;
return SQSSL_OK;
return ssl->outLen;
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Naive question: does this not break anything ? ^^

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Not that I know of.

Doing the following may help clarify this change: using the new version of the SqueakSSL plugin, put (#result -> result) inspect before the assignment of false to connecting in #accept on ZdcSecureSocketStream, then try my snippet for setting up a ZnSecureServer.

Assuming it works and you get a ZnResponse with status 200, you should also have gotten a value for result greater than 0, so there was a send of #flushEncryptedBytes:startingAt:count: in the last iteration of the #whileFalse: loop. Without the change, result would have been 0, meaning those bytes got lost.

}

/* sqEncryptSSL: Encrypt data for SSL transmission.
Expand Down