Skip to content

domain name policy for WOLFSSL_APPLE_NATIVE_CERT_VALIDATION #8833

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
merged 4 commits into from
Jun 5, 2025
Merged

domain name policy for WOLFSSL_APPLE_NATIVE_CERT_VALIDATION #8833

Changes from all commits
Commits
Show all changes
4 commits
Select commit Hold shift + click to select a range
9864959
create policy for WOLFSSL_APPLE_NATIVE_CERT_VALIDATION, domain name
rlm2002 Jun 2, 2025
bc8eeea
prevent apple native cert validation from overriding error codes othe…
bigbrett Jun 4, 2025
0e2a3fd
add missing error trace macro
bigbrett Jun 4, 2025
89be92f
formatting
bigbrett Jun 5, 2025
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
29 changes: 23 additions & 6 deletions src/internal.c
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -213,7 +213,7 @@ int writeAeadAuthData(WOLFSSL* ssl, word16 sz, byte type, byte* additional,
#include <Security/SecCertificate.h>
#include <Security/SecTrust.h>
#include <Security/SecPolicy.h>
static int DoAppleNativeCertValidation(const WOLFSSL_BUFFER_INFO* certs,
static int DoAppleNativeCertValidation(WOLFSSL* ssl, const WOLFSSL_BUFFER_INFO* certs,
int totalCerts);
#endif /* #if defined(__APPLE__) && defined(WOLFSSL_SYS_CA_CERTS) */

Expand Down Expand Up @@ -16809,8 +16809,9 @@ int ProcessPeerCerts(WOLFSSL* ssl, byte* input, word32* inOutIdx,
/* If we can't validate the peer cert chain against the CAs loaded
* into wolfSSL, try to validate against the system certificates
* using Apple's native trust APIs */
if ((ret != 0) && (ssl->ctx->doAppleNativeCertValidationFlag)) {
if (DoAppleNativeCertValidation(args->certs,
if ((ret == WC_NO_ERR_TRACE(ASN_NO_SIGNER_E)) &&
(ssl->ctx->doAppleNativeCertValidationFlag)) {
if (DoAppleNativeCertValidation(ssl, args->certs,
args->totalCerts)) {
WOLFSSL_MSG("Apple native cert chain validation SUCCESS");
ret = 0;
Expand Down Expand Up @@ -42744,7 +42745,8 @@ static SecCertificateRef ConvertToSecCertificateRef(const byte* derCert,
* wolfSSL's built-in certificate validation mechanisms anymore. We instead
* must call into the Security Framework APIs to authenticate peer certificates
*/
static int DoAppleNativeCertValidation(const WOLFSSL_BUFFER_INFO* certs,
static int DoAppleNativeCertValidation(WOLFSSL* ssl,
const WOLFSSL_BUFFER_INFO* certs,
int totalCerts)
{
int i;
Expand All @@ -42753,7 +42755,8 @@ static int DoAppleNativeCertValidation(const WOLFSSL_BUFFER_INFO* certs,
CFMutableArrayRef certArray = NULL;
SecCertificateRef secCert = NULL;
SecTrustRef trust = NULL;
SecPolicyRef policy = NULL ;
SecPolicyRef policy = NULL;
CFStringRef hostname = NULL;

WOLFSSL_ENTER("DoAppleNativeCertValidation");

Expand Down Expand Up @@ -42782,7 +42785,18 @@ static int DoAppleNativeCertValidation(const WOLFSSL_BUFFER_INFO* certs,
}

/* Create trust object for SecCertifiate Ref */
policy = SecPolicyCreateSSL(true, NULL);
if (ssl->buffers.domainName.buffer &&
ssl->buffers.domainName.length > 0) {
/* Create policy with specified value to require host name match */
hostname = CFStringCreateWithCString(kCFAllocatorDefault,
(const char*)ssl->buffers.domainName.buffer,
kCFStringEncodingUTF8);
}
if (hostname != NULL) {
policy = SecPolicyCreateSSL(true, hostname);
} else {
policy = SecPolicyCreateSSL(true, NULL);
}
status = SecTrustCreateWithCertificates(certArray, policy, &trust);
if (status != errSecSuccess) {
WOLFSSL_MSG_EX("Error creating trust object, "
Expand Down Expand Up @@ -42813,6 +42827,9 @@ static int DoAppleNativeCertValidation(const WOLFSSL_BUFFER_INFO* certs,
if (policy) {
CFRelease(policy);
}
if (hostname) {
CFRelease(hostname);
}

WOLFSSL_LEAVE("DoAppleNativeCertValidation", ret);

Expand Down