|
| 1 | +// Copyright 2020-2024 Tauri Programme within The Commons Conservancy |
| 2 | +// SPDX-License-Identifier: Apache-2.0 |
| 3 | +// SPDX-License-Identifier: MIT |
| 4 | + |
| 5 | +//! Authentication challenge handling for mTLS (mutual TLS) connections. |
| 6 | +
|
| 7 | +use objc2::runtime::AnyObject; |
| 8 | +use objc2::msg_send; |
| 9 | +use objc2::rc::Retained; |
| 10 | +use objc2::DeclaredClass; |
| 11 | +use objc2_foundation::{ |
| 12 | + NSData, NSString, |
| 13 | + NSURLAuthenticationChallenge, NSURLCredential, |
| 14 | + NSURLSessionAuthChallengeDisposition, |
| 15 | +}; |
| 16 | + |
| 17 | +use super::class::wry_navigation_delegate::WryNavigationDelegate; |
| 18 | + |
| 19 | +#[link(name = "Security", kind = "framework")] |
| 20 | +extern "C" { |
| 21 | + fn SecCertificateCreateWithData( |
| 22 | + allocator: *const std::ffi::c_void, |
| 23 | + data: *const AnyObject, |
| 24 | + ) -> *mut std::ffi::c_void; |
| 25 | + fn SecTrustSetAnchorCertificates( |
| 26 | + trust: *const std::ffi::c_void, |
| 27 | + anchors: *const AnyObject, |
| 28 | + ) -> i32; |
| 29 | + fn SecTrustSetAnchorCertificatesOnly( |
| 30 | + trust: *const std::ffi::c_void, |
| 31 | + only: bool, |
| 32 | + ) -> i32; |
| 33 | + fn SecTrustEvaluateWithError( |
| 34 | + trust: *const std::ffi::c_void, |
| 35 | + error: *mut *mut std::ffi::c_void, |
| 36 | + ) -> bool; |
| 37 | + fn SecPKCS12Import( |
| 38 | + pkcs12: *const AnyObject, |
| 39 | + options: *const AnyObject, |
| 40 | + items: *mut *mut AnyObject, |
| 41 | + ) -> i32; |
| 42 | +} |
| 43 | + |
| 44 | +pub(crate) fn did_receive_authentication_challenge( |
| 45 | + delegate: &WryNavigationDelegate, |
| 46 | + challenge: &NSURLAuthenticationChallenge, |
| 47 | + handler: &block2::Block< |
| 48 | + dyn Fn(NSURLSessionAuthChallengeDisposition, *mut NSURLCredential), |
| 49 | + >, |
| 50 | +) { |
| 51 | + unsafe { |
| 52 | + let protection_space = challenge.protectionSpace(); |
| 53 | + let auth_method = protection_space.authenticationMethod(); |
| 54 | + |
| 55 | + let server_trust_method = NSString::from_str("NSURLAuthenticationMethodServerTrust"); |
| 56 | + let client_cert_method = NSString::from_str("NSURLAuthenticationMethodClientCertificate"); |
| 57 | + |
| 58 | + // Server trust challenge: pin CA cert if provided |
| 59 | + if auth_method.isEqualToString(&server_trust_method) { |
| 60 | + if let Some(ref ca_der) = delegate.ivars().trusted_ca_certificate { |
| 61 | + let ns_data = NSData::with_bytes(ca_der); |
| 62 | + let ca_cert = SecCertificateCreateWithData( |
| 63 | + std::ptr::null(), |
| 64 | + Retained::as_ptr(&ns_data) as *const AnyObject, |
| 65 | + ); |
| 66 | + |
| 67 | + if !ca_cert.is_null() { |
| 68 | + let server_trust: *const std::ffi::c_void = |
| 69 | + msg_send![&*protection_space, serverTrust]; |
| 70 | + if !server_trust.is_null() { |
| 71 | + let cert_obj = ca_cert as *mut AnyObject; |
| 72 | + let array: Retained<AnyObject> = msg_send![ |
| 73 | + objc2::runtime::AnyClass::get(c"NSArray").unwrap(), |
| 74 | + arrayWithObject: cert_obj |
| 75 | + ]; |
| 76 | + SecTrustSetAnchorCertificates( |
| 77 | + server_trust, |
| 78 | + Retained::as_ptr(&array) as *const AnyObject, |
| 79 | + ); |
| 80 | + SecTrustSetAnchorCertificatesOnly(server_trust, true); |
| 81 | + |
| 82 | + let mut error: *mut std::ffi::c_void = std::ptr::null_mut(); |
| 83 | + if SecTrustEvaluateWithError(server_trust, &mut error) { |
| 84 | + let credential: *mut NSURLCredential = msg_send![ |
| 85 | + objc2::runtime::AnyClass::get(c"NSURLCredential").unwrap(), |
| 86 | + credentialForTrust: server_trust |
| 87 | + ]; |
| 88 | + handler.call(( |
| 89 | + NSURLSessionAuthChallengeDisposition::UseCredential, |
| 90 | + credential, |
| 91 | + )); |
| 92 | + return; |
| 93 | + } |
| 94 | + } |
| 95 | + } |
| 96 | + } |
| 97 | + |
| 98 | + // Fallback: accept server trust from system store |
| 99 | + let server_trust: *const std::ffi::c_void = |
| 100 | + msg_send![&*protection_space, serverTrust]; |
| 101 | + if !server_trust.is_null() { |
| 102 | + let credential: *mut NSURLCredential = msg_send![ |
| 103 | + objc2::runtime::AnyClass::get(c"NSURLCredential").unwrap(), |
| 104 | + credentialForTrust: server_trust |
| 105 | + ]; |
| 106 | + handler.call(( |
| 107 | + NSURLSessionAuthChallengeDisposition::UseCredential, |
| 108 | + credential, |
| 109 | + )); |
| 110 | + } else { |
| 111 | + handler.call(( |
| 112 | + NSURLSessionAuthChallengeDisposition::PerformDefaultHandling, |
| 113 | + std::ptr::null_mut(), |
| 114 | + )); |
| 115 | + } |
| 116 | + return; |
| 117 | + } |
| 118 | + |
| 119 | + // Client certificate challenge: extract identity from PKCS#12 data |
| 120 | + if auth_method.isEqualToString(&client_cert_method) { |
| 121 | + if let Some(ref p12_data) = delegate.ivars().client_certificate_p12 { |
| 122 | + let password = delegate |
| 123 | + .ivars() |
| 124 | + .client_certificate_password |
| 125 | + .as_deref() |
| 126 | + .unwrap_or(""); |
| 127 | + let ns_data = NSData::with_bytes(p12_data); |
| 128 | + let ns_password = NSString::from_str(password); |
| 129 | + |
| 130 | + // kSecImportExportPassphrase = "passphrase" |
| 131 | + let passphrase_key = NSString::from_str("passphrase"); |
| 132 | + let options: Retained<AnyObject> = msg_send![ |
| 133 | + objc2::runtime::AnyClass::get(c"NSDictionary").unwrap(), |
| 134 | + dictionaryWithObject: &*ns_password, |
| 135 | + forKey: &*passphrase_key |
| 136 | + ]; |
| 137 | + |
| 138 | + let mut items: *mut AnyObject = std::ptr::null_mut(); |
| 139 | + let status = SecPKCS12Import( |
| 140 | + Retained::as_ptr(&ns_data) as *const AnyObject, |
| 141 | + Retained::as_ptr(&options) as *const AnyObject, |
| 142 | + &mut items, |
| 143 | + ); |
| 144 | + |
| 145 | + if status == 0 && !items.is_null() { |
| 146 | + let count: usize = msg_send![items, count]; |
| 147 | + if count > 0 { |
| 148 | + let first: *mut AnyObject = msg_send![items, objectAtIndex: 0usize]; |
| 149 | + // kSecImportItemIdentity = "identity" |
| 150 | + let identity_key = NSString::from_str("identity"); |
| 151 | + let identity: *mut std::ffi::c_void = |
| 152 | + msg_send![first, objectForKey: &*identity_key]; |
| 153 | + |
| 154 | + if !identity.is_null() { |
| 155 | + let credential: *mut NSURLCredential = msg_send![ |
| 156 | + objc2::runtime::AnyClass::get(c"NSURLCredential").unwrap(), |
| 157 | + credentialWithIdentity: identity, |
| 158 | + certificates: std::ptr::null::<AnyObject>(), |
| 159 | + persistence: 0isize // NSURLCredentialPersistenceNone |
| 160 | + ]; |
| 161 | + handler.call(( |
| 162 | + NSURLSessionAuthChallengeDisposition::UseCredential, |
| 163 | + credential, |
| 164 | + )); |
| 165 | + return; |
| 166 | + } |
| 167 | + } |
| 168 | + } |
| 169 | + } |
| 170 | + } |
| 171 | + |
| 172 | + // Default handling for all other challenges |
| 173 | + handler.call(( |
| 174 | + NSURLSessionAuthChallengeDisposition::PerformDefaultHandling, |
| 175 | + std::ptr::null_mut(), |
| 176 | + )); |
| 177 | + } |
| 178 | +} |
0 commit comments