Changeset 249684 in webkit


Ignore:
Timestamp:
Sep 9, 2019, 6:39:18 PM (6 years ago)
Author:
achristensen@apple.com
Message:

Disable TLS 1.0 and 1.1 in WebSockets
​https://bugs.webkit.org/show_bug.cgi?id=201573

Reviewed by Youenn Fablet.

Source/WebCore:

This expands on what I started in r249019 when I disabled legacy TLS for our use of NSURLSession.
Since our WebSocket implementation uses a different network interface, disable legacy TLS for them, too.
I use the same temporary default to re-enable legacy TLS. I also add a unit test for both WebSockets and NSURLSession use.

  • platform/network/cf/SocketStreamHandleImpl.h:
  • platform/network/cf/SocketStreamHandleImplCFNet.cpp:

(WebCore::Function<bool):
(WebCore::SocketStreamHandleImpl::setLegacyTLSEnabledCheck):
(WebCore::SocketStreamHandleImpl::createStreams):

Source/WebCore/PAL:

  • pal/spi/cf/CFNetworkSPI.h:

Source/WebKit:

  • NetworkProcess/NetworkProcessCreationParameters.cpp:

(WebKit::NetworkProcessCreationParameters::encode const):
(WebKit::NetworkProcessCreationParameters::decode):

  • NetworkProcess/NetworkProcessCreationParameters.h:
  • NetworkProcess/cocoa/NetworkProcessCocoa.mm:

(WebKit::NetworkProcess::platformInitializeNetworkProcessCocoa):

  • UIProcess/API/Cocoa/WKProcessPool.mm:

(-[WKProcessPool _allowAnyTLSCertificateForWebSocketTesting]):

  • UIProcess/API/Cocoa/WKProcessPoolPrivate.h:
  • UIProcess/Cocoa/WebProcessPoolCocoa.mm:

(WebKit::WebProcessPool::platformInitializeNetworkProcess):

Source/WebKitLegacy/mac:

  • WebView/WebView.mm:

(-[WebView _commonInitializationWithFrameName:groupName:]):

Tools:

  • TestWebKitAPI/SourcesCocoa.txt:
  • TestWebKitAPI/TCPServer.cpp:

(sk_CRYPTO_BUFFER_num):
(sk_CRYPTO_BUFFER_value):
(TestWebKitAPI::deleter<CRYPTO_BUFFER>::operator()):
(TestWebKitAPI::TCPServer::TCPServer):
(TestWebKitAPI::TCPServer::listenForConnections):
(TestWebKitAPI::deleter<X509>::operator()): Deleted.
(TestWebKitAPI::deleter<uint8_t::operator()): Deleted.

  • TestWebKitAPI/TCPServer.h:
  • TestWebKitAPI/TestWebKitAPI.xcodeproj/project.pbxproj:
  • TestWebKitAPI/Tests/WebKitCocoa/TLSDeprecation.mm: Added.

(-[WebSocketDelegate waitForMessage]):
(-[WebSocketDelegate webView:runJavaScriptAlertPanelWithMessage:initiatedByFrame:completionHandler:]):
(TestWebKitAPI::TEST):

  • TestWebKitAPI/cocoa/TestNavigationDelegate.h:
  • TestWebKitAPI/cocoa/TestNavigationDelegate.mm:

(-[TestNavigationDelegate webView:didReceiveAuthenticationChallenge:completionHandler:]):
(-[TestNavigationDelegate waitForDidFailProvisionalNavigation]):

Location:
trunk
Files:
1 added
21 edited

Legend:

Unmodified
Added
Removed

  • TabularUnified trunk/Source/WebCore/ChangeLog

    r249664 r249684  
     12019-09-09  Alex Christensen  <achristensen@webkit.org>
     2
     3        Disable TLS 1.0 and 1.1 in WebSockets
     4        https://bugs.webkit.org/show_bug.cgi?id=201573
     5
     6        Reviewed by Youenn Fablet.
     7
     8        This expands on what I started in r249019 when I disabled legacy TLS for our use of NSURLSession.
     9        Since our WebSocket implementation uses a different network interface, disable legacy TLS for them, too.
     10        I use the same temporary default to re-enable legacy TLS.  I also add a unit test for both WebSockets and NSURLSession use.
     11
     12        * platform/network/cf/SocketStreamHandleImpl.h:
     13        * platform/network/cf/SocketStreamHandleImplCFNet.cpp:
     14        (WebCore::Function<bool):
     15        (WebCore::SocketStreamHandleImpl::setLegacyTLSEnabledCheck):
     16        (WebCore::SocketStreamHandleImpl::createStreams):
     17
    1182019-09-09  Saam Barati  <sbarati@apple.com>
    219

  • TabularUnified trunk/Source/WebCore/PAL/ChangeLog

    r249343 r249684  
     12019-09-09  Alex Christensen  <achristensen@webkit.org>
     2
     3        Disable TLS 1.0 and 1.1 in WebSockets
     4        https://bugs.webkit.org/show_bug.cgi?id=201573
     5
     6        Reviewed by Youenn Fablet.
     7
     8        * pal/spi/cf/CFNetworkSPI.h:
     9
    1102019-08-30  Alex Christensen  <achristensen@webkit.org>
    211

  • TabularUnified trunk/Source/WebCore/PAL/pal/spi/cf/CFNetworkSPI.h

    r249343 r249684  
    5656WTF_EXTERN_C_END
    5757
    58 #endif
     58#else // PLATFORM(WIN)
     59#include <CFNetwork/CFSocketStreamPriv.h>
     60#endif // PLATFORM(WIN)
    5961
    6062// FIXME: Remove the defined(__OBJC__)-guard once we fix <rdar://problem/19033610>.
    … …  
    283285extern const CFStringRef _kCFURLConnectionPropertyShouldSniff;
    284286extern const CFStringRef _kCFURLStorageSessionIsPrivate;
     287extern const CFStringRef kCFStreamSocketSecurityLevelTLSv1_2;
    285288
    286289#if HAVE(CFNETWORK_WITH_CONTENT_ENCODING_SNIFFING_OVERRIDE)

  • TabularUnified trunk/Source/WebCore/platform/network/cf/SocketStreamHandleImpl.h

    r240117 r249684  
    5151
    5252    virtual ~SocketStreamHandleImpl();
     53
     54    WEBCORE_EXPORT static void setLegacyTLSEnabled(bool);
    5355
    5456    WEBCORE_EXPORT void platformSend(const uint8_t* data, size_t length, Function<void(bool)>&&) final;

  • TabularUnified trunk/Source/WebCore/platform/network/cf/SocketStreamHandleImplCFNet.cpp

    r241244 r249684  
    306306}
    307307
     308static bool gLegacyTLSEnabled = false;
     309
     310void SocketStreamHandleImpl::setLegacyTLSEnabled(bool enabled)
     311{
     312    gLegacyTLSEnabled = enabled;
     313}
     314
    308315void SocketStreamHandleImpl::createStreams()
    309316{
    … …  
    328335        CFWriteStreamSetProperty(writeStream, kCFStreamPropertySourceApplication, m_auditData.sourceApplicationAuditData.get());
    329336    }
    330    
    331337#endif
    332338
    … …  
    356362    if (shouldUseSSL()) {
    357363        CFBooleanRef validateCertificateChain = DeprecatedGlobalSettings::allowsAnySSLCertificate() ? kCFBooleanFalse : kCFBooleanTrue;
    358         const void* keys[] = { kCFStreamSSLPeerName, kCFStreamSSLLevel, kCFStreamSSLValidatesCertificateChain };
    359         const void* values[] = { host.get(), kCFStreamSocketSecurityLevelNegotiatedSSL, validateCertificateChain };
     364        const void* keys[] = {
     365            kCFStreamSSLPeerName,
     366            kCFStreamSSLLevel,
     367            kCFStreamSSLValidatesCertificateChain
     368        };
     369        const void* values[] = {
     370            host.get(),
     371#if PLATFORM(COCOA)
     372            gLegacyTLSEnabled ? kCFStreamSocketSecurityLevelNegotiatedSSL : kCFStreamSocketSecurityLevelTLSv1_2,
     373#else
     374            kCFStreamSocketSecurityLevelNegotiatedSSL,
     375#endif
     376            validateCertificateChain
     377        };
    360378        RetainPtr<CFDictionaryRef> settings = adoptCF(CFDictionaryCreate(0, keys, values, WTF_ARRAY_LENGTH(keys), &kCFTypeDictionaryKeyCallBacks, &kCFTypeDictionaryValueCallBacks));
    361379        CFReadStreamSetProperty(m_readStream.get(), kCFStreamPropertySSLSettings, settings.get());

  • TabularUnified trunk/Source/WebKit/ChangeLog

    r249681 r249684  
     12019-09-09  Alex Christensen  <achristensen@webkit.org>
     2
     3        Disable TLS 1.0 and 1.1 in WebSockets
     4        https://bugs.webkit.org/show_bug.cgi?id=201573
     5
     6        Reviewed by Youenn Fablet.
     7
     8        * NetworkProcess/NetworkProcessCreationParameters.cpp:
     9        (WebKit::NetworkProcessCreationParameters::encode const):
     10        (WebKit::NetworkProcessCreationParameters::decode):
     11        * NetworkProcess/NetworkProcessCreationParameters.h:
     12        * NetworkProcess/cocoa/NetworkProcessCocoa.mm:
     13        (WebKit::NetworkProcess::platformInitializeNetworkProcessCocoa):
     14        * UIProcess/API/Cocoa/WKProcessPool.mm:
     15        (-[WKProcessPool _allowAnyTLSCertificateForWebSocketTesting]):
     16        * UIProcess/API/Cocoa/WKProcessPoolPrivate.h:
     17        * UIProcess/Cocoa/WebProcessPoolCocoa.mm:
     18        (WebKit::WebProcessPool::platformInitializeNetworkProcess):
     19
    1202019-09-09  Tim Horton  <timothy_horton@apple.com>
    221

  • TabularUnified trunk/Source/WebKit/NetworkProcess/NetworkProcessCreationParameters.cpp

    r246763 r249684  
    9494    encoder << hstsStorageDirectory;
    9595    encoder << hstsStorageDirectoryExtensionHandle;
     96    encoder << enableLegacyTLS;
    9697}
    9798
    … …  
    229230        return false;
    230231   
     232    if (!decoder.decode(result.enableLegacyTLS))
     233        return false;
     234
    231235    return true;
    232236}

  • TabularUnified trunk/Source/WebKit/NetworkProcess/NetworkProcessCreationParameters.h

    r246807 r249684  
    112112    String hstsStorageDirectory;
    113113    SandboxExtension::Handle hstsStorageDirectoryExtensionHandle;
     114    bool enableLegacyTLS { false };
    114115};
    115116

  • TabularUnified trunk/Source/WebKit/NetworkProcess/cocoa/NetworkProcessCocoa.mm

    r248846 r249684  
    4040#import <WebCore/SecurityOrigin.h>
    4141#import <WebCore/SecurityOriginData.h>
     42#import <WebCore/SocketStreamHandleImpl.h>
    4243#import <pal/spi/cf/CFNetworkSPI.h>
    4344#import <wtf/BlockPtr.h>
    … …  
    7071void NetworkProcess::platformInitializeNetworkProcessCocoa(const NetworkProcessCreationParameters& parameters)
    7172{
     73    WebCore::SocketStreamHandleImpl::setLegacyTLSEnabled(parameters.enableLegacyTLS);
     74
    7275    WebCore::setApplicationBundleIdentifier(parameters.uiProcessBundleIdentifier);
    7376    WebCore::setApplicationSDKVersion(parameters.uiProcessSDKVersion);

  • TabularUnified trunk/Source/WebKit/UIProcess/API/Cocoa/WKProcessPool.mm

    r249671 r249684  
    648648}
    649649
     650- (void)_allowAnyTLSCertificateForWebSocketTesting
     651{
     652    _processPool->setAllowsAnySSLCertificateForWebSocket(true);
     653}
     654
    650655@end

  • TabularUnified trunk/Source/WebKit/UIProcess/API/Cocoa/WKProcessPoolPrivate.h

    r249671 r249684  
    124124- (BOOL)_networkProcessHasEntitlementForTesting:(NSString *)entitlement WK_API_AVAILABLE(macos(10.14.4), ios(12.2));
    125125- (void)_clearPermanentCredentialsForProtectionSpace:(NSURLProtectionSpace *)protectionSpace WK_API_AVAILABLE(macos(WK_MAC_TBA), ios(WK_IOS_TBA));
     126- (void)_allowAnyTLSCertificateForWebSocketTesting WK_API_AVAILABLE(macos(WK_MAC_TBA), ios(WK_IOS_TBA));
    126127
    127128@property (nonatomic, getter=_isCookieStoragePartitioningEnabled, setter=_setCookieStoragePartitioningEnabled:) BOOL _cookieStoragePartitioningEnabled WK_API_DEPRECATED("Partitioned cookies are no longer supported", macos(10.12.3, 10.14.4), ios(10.3, 12.2));

  • TabularUnified trunk/Source/WebKit/UIProcess/Cocoa/WebProcessPoolCocoa.mm

    r249589 r249684  
    282282    }
    283283
    284     parameters.defaultDataStoreParameters.networkSessionParameters.enableLegacyTLS = [defaults boolForKey:@"WebKitEnableLegacyTLS"];
     284    parameters.enableLegacyTLS = [defaults boolForKey:@"WebKitEnableLegacyTLS"];
     285    parameters.defaultDataStoreParameters.networkSessionParameters.enableLegacyTLS = parameters.enableLegacyTLS;
    285286
    286287    parameters.networkATSContext = adoptCF(_CFNetworkCopyATSContext());

  • TabularUnified trunk/Source/WebKitLegacy/mac/ChangeLog

    r249575 r249684  
     12019-09-09  Alex Christensen  <achristensen@webkit.org>
     2
     3        Disable TLS 1.0 and 1.1 in WebSockets
     4        https://bugs.webkit.org/show_bug.cgi?id=201573
     5
     6        Reviewed by Youenn Fablet.
     7
     8        * WebView/WebView.mm:
     9        (-[WebView _commonInitializationWithFrameName:groupName:]):
     10
    1112019-09-06  Alex Christensen  <achristensen@webkit.org>
    212

  • TabularUnified trunk/Source/WebKitLegacy/mac/WebView/WebView.mm

    r249575 r249684  
    206206#import <WebCore/ShouldTreatAsContinuingLoad.h>
    207207#import <WebCore/SocketProvider.h>
     208#import <WebCore/SocketStreamHandleImpl.h>
    208209#import <WebCore/StringUtilities.h>
    209210#import <WebCore/StyleProperties.h>
    … …  
    14201421            DeprecatedGlobalSettings::setShouldManageAudioSessionCategory(true);
    14211422#endif
     1423       
     1424        if ([[NSUserDefaults standardUserDefaults] boolForKey:@"WebKitEnableLegacyTLS"])
     1425            SocketStreamHandleImpl::setLegacyTLSEnabled(true);
    14221426
    14231427        didOneTimeInitialization = true;

  • TabularUnified trunk/Tools/ChangeLog

    r249683 r249684  
     12019-09-09  Alex Christensen  <achristensen@webkit.org>
     2
     3        Disable TLS 1.0 and 1.1 in WebSockets
     4        https://bugs.webkit.org/show_bug.cgi?id=201573
     5
     6        Reviewed by Youenn Fablet.
     7
     8        * TestWebKitAPI/SourcesCocoa.txt:
     9        * TestWebKitAPI/TCPServer.cpp:
     10        (sk_CRYPTO_BUFFER_num):
     11        (sk_CRYPTO_BUFFER_value):
     12        (TestWebKitAPI::deleter<CRYPTO_BUFFER>::operator()):
     13        (TestWebKitAPI::TCPServer::TCPServer):
     14        (TestWebKitAPI::TCPServer::listenForConnections):
     15        (TestWebKitAPI::deleter<X509>::operator()): Deleted.
     16        (TestWebKitAPI::deleter<uint8_t::operator()): Deleted.
     17        * TestWebKitAPI/TCPServer.h:
     18        * TestWebKitAPI/TestWebKitAPI.xcodeproj/project.pbxproj:
     19        * TestWebKitAPI/Tests/WebKitCocoa/TLSDeprecation.mm: Added.
     20        (-[WebSocketDelegate waitForMessage]):
     21        (-[WebSocketDelegate webView:runJavaScriptAlertPanelWithMessage:initiatedByFrame:completionHandler:]):
     22        (TestWebKitAPI::TEST):
     23        * TestWebKitAPI/cocoa/TestNavigationDelegate.h:
     24        * TestWebKitAPI/cocoa/TestNavigationDelegate.mm:
     25        (-[TestNavigationDelegate webView:didReceiveAuthenticationChallenge:completionHandler:]):
     26        (-[TestNavigationDelegate waitForDidFailProvisionalNavigation]):
     27
    1282019-09-09  Fujii Hironori  <Hironori.Fujii@sony.com>
    229

  • TabularUnified trunk/Tools/TestWebKitAPI/SourcesCocoa.txt

    r247402 r249684  
    2929cocoa/TestProtocol.mm
    3030cocoa/TestWKWebView.mm
     31
     32Tests/WebKitCocoa/TLSDeprecation.mm

  • TabularUnified trunk/Tools/TestWebKitAPI/TCPServer.cpp

    r247733 r249684  
    3434
    3535#if HAVE(SSL)
     36
     37#define STACK_OF(type) struct stack_st_##type
     38
    3639extern "C" {
    3740
     41enum ssl_verify_result_t {
     42    ssl_verify_ok,
     43    ssl_verify_invalid,
     44    ssl_verify_retry,
     45};
     46
    3847struct BIO;
    39 struct X509;
     48struct CRYPTO_BUFFER;
    4049struct SSL_CTX;
    4150struct EVP_PKEY;
    4251struct SSL_METHOD;
    43 struct X509_STORE_CTX {
    44     void* unused;
    45     X509* cert;
    46 };
     52struct SSL_PRIVATE_KEY_METHOD;
     53struct _STACK;
     54struct CRYPTO_BUFFER_POOL;
    4755struct pem_password_cb;
    4856int BIO_free(BIO*);
    4957int SSL_free(SSL*);
    50 int X509_free(X509*);
    5158int SSL_CTX_free(SSL_CTX*);
    5259int EVP_PKEY_free(EVP_PKEY*);
    5360int SSL_library_init();
    54 const SSL_METHOD* SSLv23_server_method();
     61const SSL_METHOD* TLS_with_buffers_method();
    5562BIO* BIO_new_mem_buf(const void*, int);
    56 X509* PEM_read_bio_X509(BIO*, X509**, pem_password_cb*, void*);
    5763EVP_PKEY* PEM_read_bio_PrivateKey(BIO*, EVP_PKEY**, pem_password_cb*, void*);
    5864SSL_CTX* SSL_CTX_new(const SSL_METHOD*);
    59 const SSL_METHOD* SSLv23_server_method();
    60 int SSL_CTX_use_certificate(SSL_CTX*, X509*);
    61 int SSL_CTX_use_PrivateKey(SSL_CTX*, EVP_PKEY*);
    6265SSL* SSL_new(SSL_CTX*);
    6366int SSL_accept(SSL*);
    6467int SSL_set_fd(SSL*, int);
    65 void SSL_CTX_set_verify(SSL_CTX*, int, int (*)(int, X509_STORE_CTX*));
    66 void SSL_CTX_set_cert_verify_callback(SSL_CTX*, int (*)(X509_STORE_CTX*, void*), void*);
    6768int SSL_get_error(const SSL*, int);
     69void SSL_CTX_set_custom_verify(SSL_CTX*, int mode, enum ssl_verify_result_t (*callback)(SSL *ssl, uint8_t *out_alert));
    6870int SSL_read(SSL*, void*, int);
    6971int SSL_write(SSL*, const void*, int);
    70 int i2d_X509(X509*, unsigned char**);
     72const uint8_t* CRYPTO_BUFFER_data(const CRYPTO_BUFFER*);
     73size_t CRYPTO_BUFFER_len(const CRYPTO_BUFFER*);
    7174void OPENSSL_free(void*);
     75int SSL_CTX_set_chain_and_key(SSL_CTX*, CRYPTO_BUFFER *const *certs, size_t num_certs, EVP_PKEY*, const SSL_PRIVATE_KEY_METHOD*);
     76CRYPTO_BUFFER* CRYPTO_BUFFER_new(const uint8_t*, size_t, CRYPTO_BUFFER_POOL*);
     77void CRYPTO_BUFFER_free(CRYPTO_BUFFER*);
     78size_t sk_num(const _STACK*);
     79void* sk_value(const _STACK*, size_t);
     80const STACK_OF(CRYPTO_BUFFER) *SSL_get0_peer_certificates(const SSL*);
     81void SSL_CTX_set_max_proto_version(SSL_CTX*, uint16_t);
    7282#define SSL_VERIFY_PEER 0x01
    7383#define SSL_VERIFY_FAIL_IF_NO_PEER_CERT 0x02
    7484
    7585} // extern "C"
     86
     87inline size_t sk_CRYPTO_BUFFER_num(const STACK_OF(CRYPTO_BUFFER) *sk) { return sk_num((const _STACK *)sk); }
     88inline CRYPTO_BUFFER* sk_CRYPTO_BUFFER_value(const STACK_OF(CRYPTO_BUFFER) *sk, size_t i) { return (CRYPTO_BUFFER *)sk_value((const _STACK *)sk, i); }
    7689#endif // HAVE(SSL)
    7790
    … …  
    92105    }
    93106};
    94 template<> struct deleter<X509> {
    95     void operator()(X509* x509)
    96     {
    97         X509_free(x509);
    98     }
    99 };
    100107template<> struct deleter<SSL_CTX> {
    101108    void operator()(SSL_CTX* ctx)
    … …  
    110117    }
    111118};
    112 template<> struct deleter<uint8_t[]> {
    113     void operator()(uint8_t* buffer)
     119template<> struct deleter<CRYPTO_BUFFER> {
     120    void operator()(CRYPTO_BUFFER* buffer)
    114121    {
    115         OPENSSL_free(buffer);
    116     }
    117 };
     122        CRYPTO_BUFFER_free(buffer);
     123    }
     124};
     125namespace ssl {
     126template <typename T> using unique_ptr = std::unique_ptr<T, deleter<T>>;
     127}
    118128#endif // HAVE(SSL)
    119129
    … …  
    125135
    126136#if HAVE(SSL)
    127 TCPServer::TCPServer(Protocol protocol, Function<void(SSL*)>&& secureConnectionHandler)
    128 {
    129     auto startSecureConnection = [secureConnectionHandler = WTFMove(secureConnectionHandler), protocol] (Socket socket) {
     137TCPServer::TCPServer(Protocol protocol, Function<void(SSL*)>&& secureConnectionHandler, Optional<uint16_t> maxTLSVersion)
     138{
     139    auto startSecureConnection = [secureConnectionHandler = WTFMove(secureConnectionHandler), protocol, maxTLSVersion] (Socket socket) {
    130140        SSL_library_init();
    131141
    132         std::unique_ptr<SSL_CTX, deleter<SSL_CTX>> ctx(SSL_CTX_new(SSLv23_server_method()));
     142        ssl::unique_ptr<SSL_CTX> ctx(SSL_CTX_new(TLS_with_buffers_method()));
    133143
    134144        // This is a test certificate from BoringSSL.
    135         char kCertPEM[] =
    136         "-----BEGIN CERTIFICATE-----\n"
    137         "MIICWDCCAcGgAwIBAgIJAPuwTC6rEJsMMA0GCSqGSIb3DQEBBQUAMEUxCzAJBgNV\n"
    138         "BAYTAkFVMRMwEQYDVQQIDApTb21lLVN0YXRlMSEwHwYDVQQKDBhJbnRlcm5ldCBX\n"
    139         "aWRnaXRzIFB0eSBMdGQwHhcNMTQwNDIzMjA1MDQwWhcNMTcwNDIyMjA1MDQwWjBF\n"
    140         "MQswCQYDVQQGEwJBVTETMBEGA1UECAwKU29tZS1TdGF0ZTEhMB8GA1UECgwYSW50\n"
    141         "ZXJuZXQgV2lkZ2l0cyBQdHkgTHRkMIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKB\n"
    142         "gQDYK8imMuRi/03z0K1Zi0WnvfFHvwlYeyK9Na6XJYaUoIDAtB92kWdGMdAQhLci\n"
    143         "HnAjkXLI6W15OoV3gA/ElRZ1xUpxTMhjP6PyY5wqT5r6y8FxbiiFKKAnHmUcrgfV\n"
    144         "W28tQ+0rkLGMryRtrukXOgXBv7gcrmU7G1jC2a7WqmeI8QIDAQABo1AwTjAdBgNV\n"
    145         "HQ4EFgQUi3XVrMsIvg4fZbf6Vr5sp3Xaha8wHwYDVR0jBBgwFoAUi3XVrMsIvg4f\n"
    146         "Zbf6Vr5sp3Xaha8wDAYDVR0TBAUwAwEB/zANBgkqhkiG9w0BAQUFAAOBgQA76Hht\n"
    147         "ldY9avcTGSwbwoiuIqv0jTL1fHFnzy3RHMLDh+Lpvolc5DSrSJHCP5WuK0eeJXhr\n"
    148         "T5oQpHL9z/cCDLAKCKRa4uV0fhEdOWBqyR9p8y5jJtye72t6CuFUV5iqcpF4BH4f\n"
    149         "j2VNHwsSrJwkD4QUGlUtH7vwnQmyCFxZMmWAJg==\n"
    150         "-----END CERTIFICATE-----\n";
    151 
    152         std::unique_ptr<BIO, deleter<BIO>> certBIO(BIO_new_mem_buf(kCertPEM, strlen(kCertPEM)));
    153         std::unique_ptr<X509, deleter<X509>> certX509(PEM_read_bio_X509(certBIO.get(), nullptr, nullptr, nullptr));
    154         ASSERT(certX509);
    155         SSL_CTX_use_certificate(ctx.get(), certX509.get());
    156 
    157         if (protocol == Protocol::HTTPSWithClientCertificateRequest) {
    158             SSL_CTX_set_verify(ctx.get(), SSL_VERIFY_PEER | SSL_VERIFY_FAIL_IF_NO_PEER_CERT, nullptr);
    159             SSL_CTX_set_cert_verify_callback(ctx.get(), [] (X509_STORE_CTX* store_ctx, void*) -> int {
    160                 uint8_t* bufferPointer = nullptr;
    161                 auto length = i2d_X509(store_ctx->cert, &bufferPointer);
    162                 std::unique_ptr<uint8_t[], deleter<uint8_t[]>> buffer(bufferPointer);
    163                 auto expectedCert = testCertificate();
    164                 EXPECT_EQ(static_cast<int>(expectedCert.size()), length);
    165                 for (int i = 0; i < length; ++i)
    166                     EXPECT_EQ(buffer.get()[i], expectedCert[i]);
    167                 return 1;
    168             }, nullptr);
    169         }
     145        String certPEM(
     146        "MIICWDCCAcGgAwIBAgIJAPuwTC6rEJsMMA0GCSqGSIb3DQEBBQUAMEUxCzAJBgNV"
     147        "BAYTAkFVMRMwEQYDVQQIDApTb21lLVN0YXRlMSEwHwYDVQQKDBhJbnRlcm5ldCBX"
     148        "aWRnaXRzIFB0eSBMdGQwHhcNMTQwNDIzMjA1MDQwWhcNMTcwNDIyMjA1MDQwWjBF"
     149        "MQswCQYDVQQGEwJBVTETMBEGA1UECAwKU29tZS1TdGF0ZTEhMB8GA1UECgwYSW50"
     150        "ZXJuZXQgV2lkZ2l0cyBQdHkgTHRkMIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKB"
     151        "gQDYK8imMuRi/03z0K1Zi0WnvfFHvwlYeyK9Na6XJYaUoIDAtB92kWdGMdAQhLci"
     152        "HnAjkXLI6W15OoV3gA/ElRZ1xUpxTMhjP6PyY5wqT5r6y8FxbiiFKKAnHmUcrgfV"
     153        "W28tQ+0rkLGMryRtrukXOgXBv7gcrmU7G1jC2a7WqmeI8QIDAQABo1AwTjAdBgNV"
     154        "HQ4EFgQUi3XVrMsIvg4fZbf6Vr5sp3Xaha8wHwYDVR0jBBgwFoAUi3XVrMsIvg4f"
     155        "Zbf6Vr5sp3Xaha8wDAYDVR0TBAUwAwEB/zANBgkqhkiG9w0BAQUFAAOBgQA76Hht"
     156        "ldY9avcTGSwbwoiuIqv0jTL1fHFnzy3RHMLDh+Lpvolc5DSrSJHCP5WuK0eeJXhr"
     157        "T5oQpHL9z/cCDLAKCKRa4uV0fhEdOWBqyR9p8y5jJtye72t6CuFUV5iqcpF4BH4f"
     158        "j2VNHwsSrJwkD4QUGlUtH7vwnQmyCFxZMmWAJg==");
     159        Vector<uint8_t> certDER;
     160        base64Decode(certPEM, certDER, WTF::Base64DecodeOptions::Base64Default);
     161        ssl::unique_ptr<CRYPTO_BUFFER> cert(CRYPTO_BUFFER_new(certDER.data(), certDER.size(), nullptr));
     162        ASSERT(cert);
    170163
    171164        // This is a test key from BoringSSL.
    … …  
    187180        "-----END RSA PRIVATE KEY-----\n";
    188181
    189         std::unique_ptr<BIO, deleter<BIO>> privateKeyBIO(BIO_new_mem_buf(kKeyPEM, strlen(kKeyPEM)));
    190         std::unique_ptr<EVP_PKEY, deleter<EVP_PKEY>> privateKey(PEM_read_bio_PrivateKey(privateKeyBIO.get(), nullptr, nullptr, nullptr));
     182        ssl::unique_ptr<BIO> privateKeyBIO(BIO_new_mem_buf(kKeyPEM, strlen(kKeyPEM)));
     183        ssl::unique_ptr<EVP_PKEY> privateKey(PEM_read_bio_PrivateKey(privateKeyBIO.get(), nullptr, nullptr, nullptr));
    191184        ASSERT(privateKey);
    192         SSL_CTX_use_PrivateKey(ctx.get(), privateKey.get());
    193 
    194         std::unique_ptr<SSL, deleter<SSL>> ssl(SSL_new(ctx.get()));
     185
     186        SSL_CTX_set_chain_and_key(ctx.get(), reinterpret_cast<CRYPTO_BUFFER *const *>(&cert), 1, privateKey.get(), nullptr);
     187
     188        if (protocol == Protocol::HTTPSWithClientCertificateRequest) {
     189            SSL_CTX_set_custom_verify(ctx.get(), SSL_VERIFY_PEER | SSL_VERIFY_FAIL_IF_NO_PEER_CERT, [] (SSL* ssl, uint8_t*) -> ssl_verify_result_t {
     190                auto chain = SSL_get0_peer_certificates(ssl);
     191                EXPECT_EQ(sk_CRYPTO_BUFFER_num(chain), 2u);
     192                auto cert = sk_CRYPTO_BUFFER_value(chain, 0);
     193                auto expectedCert = testCertificate();
     194                EXPECT_EQ(CRYPTO_BUFFER_len(cert), expectedCert.size());
     195                EXPECT_TRUE(!memcmp(CRYPTO_BUFFER_data(cert), expectedCert.data(), expectedCert.size()));
     196                return ssl_verify_ok;
     197            });
     198        }
     199
     200        if (maxTLSVersion)
     201            SSL_CTX_set_max_proto_version(ctx.get(), *maxTLSVersion);
     202
     203        ssl::unique_ptr<SSL> ssl(SSL_new(ctx.get()));
    195204        ASSERT(ssl);
    196205        SSL_set_fd(ssl.get(), socket);
    197206
    198207        auto acceptResult = SSL_accept(ssl.get());
    199         ASSERT_UNUSED(acceptResult, acceptResult > 0);
    200        
    201         secureConnectionHandler(ssl.get());
     208        secureConnectionHandler(acceptResult > 0 ? ssl.get() : nullptr);
    202209    };
    203210
    … …  
    240247            }));
    241248        }
     249        close(listeningSocket);
    242250    });
    243251}

  • TabularUnified trunk/Tools/TestWebKitAPI/TCPServer.h

    r246605 r249684  
    2828#include <thread>
    2929#include <wtf/Function.h>
     30#include <wtf/Optional.h>
    3031#include <wtf/Vector.h>
    3132
    … …  
    4748        HTTPS, HTTPSProxy, HTTPSWithClientCertificateRequest
    4849    };
    49     TCPServer(Protocol, Function<void(SSL*)>&&);
     50    TCPServer(Protocol, Function<void(SSL*)>&&, Optional<uint16_t> maxTLSVersion = WTF::nullopt);
    5051#endif // HAVE(SSL)
    5152    ~TCPServer();

  • TabularUnified trunk/Tools/TestWebKitAPI/TestWebKitAPI.xcodeproj/project.pbxproj

    r249589 r249684  
    18661866                5C6E27A6224EEBEA00128736 /* URLCanonicalization.mm */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.objcpp; path = URLCanonicalization.mm; sourceTree = "<group>"; };
    18671867                5C7148942123A40700FDE3C5 /* WKWebsiteDatastore.mm */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.objcpp; path = WKWebsiteDatastore.mm; sourceTree = "<group>"; };
     1868                5C73A81A2323059800DEA85A /* TLSDeprecation.mm */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.objcpp; path = TLSDeprecation.mm; sourceTree = "<group>"; };
    18681869                5C75715F221249BD00B9E5AC /* BundleRetainPagePlugIn.mm */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.objcpp; path = BundleRetainPagePlugIn.mm; sourceTree = "<group>"; };
    18691870                5C79640F1EB0269B0075D74C /* EventModifiers.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = EventModifiers.cpp; sourceTree = "<group>"; };
    … …  
    28742875                                5C16F8FB230C942B0074C4A8 /* TextSize.mm */,
    28752876                                C22FA32A228F8708009D7988 /* TextWidth.mm */,
     2877                                5C73A81A2323059800DEA85A /* TLSDeprecation.mm */,
    28762878                                5CB40B4D1F4B98BE007DC7B9 /* UIDelegate.mm */,
    28772879                                5C3A77A922F20B8A003827FF /* UploadDirectory.mm */,

  • TabularUnified trunk/Tools/TestWebKitAPI/cocoa/TestNavigationDelegate.h

    r244444 r249684  
    3838@property (nonatomic, copy) void (^renderingProgressDidChange)(WKWebView *, _WKRenderingProgressEvents);
    3939@property (nonatomic, copy) void (^webContentProcessDidTerminate)(WKWebView *);
     40@property (nonatomic, copy) void (^didReceiveAuthenticationChallenge)(WKWebView *, NSURLAuthenticationChallenge *, void (^)(NSURLSessionAuthChallengeDisposition, NSURLCredential *));
    4041
    4142- (void)waitForDidStartProvisionalNavigation;
    4243- (void)waitForDidFinishNavigation;
     44- (void)waitForDidFailProvisionalNavigation;
    4345
    4446@end

  • TabularUnified trunk/Tools/TestWebKitAPI/cocoa/TestNavigationDelegate.mm

    r244444 r249684  
    7676}
    7777
     78- (void)webView:(WKWebView *)webView didReceiveAuthenticationChallenge:(NSURLAuthenticationChallenge *)challenge completionHandler:(void (^)(NSURLSessionAuthChallengeDisposition, NSURLCredential *))completionHandler
     79{
     80    if (_didReceiveAuthenticationChallenge)
     81        _didReceiveAuthenticationChallenge(webView, challenge, completionHandler);
     82    else
     83        completionHandler(NSURLSessionAuthChallengePerformDefaultHandling, nil);
     84}
     85
    7886- (void)waitForDidStartProvisionalNavigation
    7987{
    … …  
    102110
    103111    self.didFinishNavigation = nil;
     112}
     113
     114- (void)waitForDidFailProvisionalNavigation
     115{
     116    EXPECT_FALSE(self.didFailProvisionalNavigation);
     117
     118    __block bool finished = false;
     119    self.didFailProvisionalNavigation = ^(WKWebView *, WKNavigation *, NSError *) {
     120        finished = true;
     121    };
     122
     123    TestWebKitAPI::Util::run(&finished);
     124
     125    self.didFailProvisionalNavigation = nil;
    104126}
    105127
Note: See TracChangeset for help on using the changeset viewer.