evie/AFNetworking
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Merge branch 'master' into invalid-ssl

Browse source
This commit is contained in:
Kevin Harwood 2013-04-08 09:52:42 -05:00
commit e6807f4176
1 changed files with 100 additions and 67 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

63
AFNetworking/AFURLConnectionOperation.m
View file

@ -553,36 +553,69 @@ willSendRequestForAuthenticationChallenge:(NSURLAuthenticationChallenge *)challe
{ {
if ([challenge.protectionSpace.authenticationMethod isEqualToString:NSURLAuthenticationMethodServerTrust]) { if ([challenge.protectionSpace.authenticationMethod isEqualToString:NSURLAuthenticationMethodServerTrust]) {
SecTrustRef serverTrust = challenge.protectionSpace.serverTrust; SecTrustRef serverTrust = challenge.protectionSpace.serverTrust;
SecPolicyRef policy = SecPolicyCreateBasicX509();
CFIndex certificateCount = SecTrustGetCertificateCount(serverTrust);
NSMutableArray *trustChain = [NSMutableArray arrayWithCapacity:certificateCount];
for (CFIndex i = 0; i < certificateCount; i++) {
SecCertificateRef certificate = SecTrustGetCertificateAtIndex(serverTrust, i);
if (self.SSLPinningMode == AFSSLPinningModeCertificate) {
[trustChain addObject:(__bridge_transfer NSData *)SecCertificateCopyData(certificate)];
} else if (self.SSLPinningMode == AFSSLPinningModePublicKey) {
SecCertificateRef someCertificates[] = {certificate};
CFArrayRef certificates = CFArrayCreate(NULL, (const void **)someCertificates, 1, NULL);
SecTrustRef trust = NULL;
OSStatus status = SecTrustCreateWithCertificates(certificates, policy, &trust);
NSAssert(status == noErr, @"SecTrustCreateWithCertificates error: %ld", (long int)status);
SecTrustResultType result;
status = SecTrustEvaluate(trust, &result);
NSAssert(status == noErr, @"SecTrustEvaluate error: %ld", (long int)status);
[trustChain addObject:(__bridge_transfer id)SecTrustCopyPublicKey(trust)];
CFRelease(trust);
CFRelease(certificates);
}
}
CFRelease(policy);
switch (self.SSLPinningMode) { switch (self.SSLPinningMode) {
case AFSSLPinningModePublicKey: { case AFSSLPinningModePublicKey: {
id publicKey = (__bridge_transfer id)SecTrustCopyPublicKey(serverTrust); for (id publicKey in trustChain) {
if ([[self.class pinnedPublicKeys] containsObject:publicKey]) {
if ([[self.class pinnedPublicKeys] containsObject:publicKey]) { NSURLCredential *credential = [NSURLCredential credentialForTrust:serverTrust];
NSURLCredential *credential = [NSURLCredential credentialForTrust:serverTrust]; [[challenge sender] useCredential:credential forAuthenticationChallenge:challenge];
[[challenge sender] useCredential:credential forAuthenticationChallenge:challenge]; return;
} else { }
[[challenge sender] cancelAuthenticationChallenge:challenge];
} }
[[challenge sender] cancelAuthenticationChallenge:challenge];
break; break;
} }
case AFSSLPinningModeCertificate: { case AFSSLPinningModeCertificate: {
SecCertificateRef serverCertificate = SecTrustGetCertificateAtIndex(serverTrust, 0); for (id serverCertificateData in trustChain) {
NSData *serverCertificateData = (__bridge_transfer NSData *)SecCertificateCopyData(serverCertificate); if ([[self.class pinnedCertificates] containsObject:serverCertificateData]) {
NSURLCredential *credential = [NSURLCredential credentialForTrust:serverTrust];
if ([[[self class] pinnedCertificates] containsObject:serverCertificateData]) { [[challenge sender] useCredential:credential forAuthenticationChallenge:challenge];
NSURLCredential *credential = [NSURLCredential credentialForTrust:serverTrust]; return;
[[challenge sender] useCredential:credential forAuthenticationChallenge:challenge]; }
} else {
[[challenge sender] cancelAuthenticationChallenge:challenge];
} }
[[challenge sender] cancelAuthenticationChallenge:challenge];
break; break;
} }
case AFSSLPinningModeNone: { case AFSSLPinningModeNone: {
if(self.allowInvalidSSLCertificate == YES){ if(self.allowInvalidSSLCertificate == YES){
NSURLCredential *credential = [NSURLCredential credentialForTrust:serverTrust]; NSURLCredential *credential = [NSURLCredential credentialForTrust:serverTrust];
[[challenge sender] useCredential:credential forAuthenticationChallenge:challenge]; [[challenge sender] useCredential:credential forAuthenticationChallenge:challenge];
} else {
[[challenge sender] cancelAuthenticationChallenge:challenge];
} }
else { else {
SecTrustResultType result = 0; SecTrustResultType result = 0;