Skip to content
体验新版
项目
组织
正在加载...
登录
切换导航
打开侧边栏
white49
Alamofire
提交
3ba55168
A
Alamofire
项目概览
white49
/
Alamofire
与 Fork 源项目一致
从无法访问的项目Fork
通知
1
Star
0
Fork
0
代码
文件
提交
分支
Tags
贡献者
分支图
Diff
Issue
0
列表
看板
标记
里程碑
合并请求
0
Wiki
0
Wiki
分析
仓库
DevOps
项目成员
Pages
A
Alamofire
项目概览
项目概览
详情
发布
仓库
仓库
文件
提交
分支
标签
贡献者
分支图
比较
Issue
0
Issue
0
列表
看板
标记
里程碑
合并请求
0
合并请求
0
Pages
分析
分析
仓库分析
DevOps
Wiki
0
Wiki
成员
成员
收起侧边栏
关闭侧边栏
动态
分支图
创建新Issue
提交
Issue看板
体验新版 GitCode,发现更多精彩内容 >>
提交
3ba55168
编写于
7月 19, 2015
作者:
C
Christian Noon
浏览文件
操作
浏览文件
下载
电子邮件补丁
差异文件
Refactored `allowInvalidCertificates` to `validateCertificateChain` for public key pinning.
上级
5a0c11b3
变更
3
隐藏空白更改
内联
并排
Showing
3 changed file
with
53 addition
and
54 deletion
+53
-54
Source/ServerTrustPolicy.swift
Source/ServerTrustPolicy.swift
+4
-5
Tests/ServerTrustPolicyTests.swift
Tests/ServerTrustPolicyTests.swift
+41
-41
Tests/TLSEvaluationTests.swift
Tests/TLSEvaluationTests.swift
+8
-8
未找到文件。
Source/ServerTrustPolicy.swift
浏览文件 @
3ba55168
...
...
@@ -31,8 +31,7 @@ public class ServerTrustPolicyManager {
self
.
policies
=
policies
}
// TODO: DocStrings
public
func
serverTrustPolicyForHost
(
host
:
String
)
->
ServerTrustPolicy
?
{
func
serverTrustPolicyForHost
(
host
:
String
)
->
ServerTrustPolicy
?
{
return
self
.
policies
[
host
]
}
}
...
...
@@ -60,7 +59,7 @@ extension NSURLSession {
public
enum
ServerTrustPolicy
{
case
PerformDefaultEvaluation
(
validateHost
:
Bool
)
case
PinCertificates
(
certificates
:
[
SecCertificate
],
validateHost
:
Bool
)
case
PinPublicKeys
(
publicKeys
:
[
SecKey
],
validate
Host
:
Bool
,
allowInvalidCertificates
:
Bool
)
case
PinPublicKeys
(
publicKeys
:
[
SecKey
],
validate
CertificateChain
:
Bool
,
validateHost
:
Bool
)
case
DisableEvaluation
case
CustomEvaluation
((
serverTrust
:
SecTrust
,
host
:
String
)
->
Bool
)
...
...
@@ -115,10 +114,10 @@ public enum ServerTrustPolicy {
SecTrustSetAnchorCertificatesOnly
(
serverTrust
,
1
)
serverTrustIsValid
=
trustIsValid
(
serverTrust
)
case
let
.
PinPublicKeys
(
pinnedPublicKeys
,
validate
Host
,
allowInvalidCertificates
):
case
let
.
PinPublicKeys
(
pinnedPublicKeys
,
validate
CertificateChain
,
validateHost
):
var
certificateChainEvaluationPassed
=
true
if
!
allowInvalidCertificates
{
if
validateCertificateChain
{
let
policy
=
validateHost
?
SecPolicyCreateSSL
(
1
,
host
as
CFString
)
:
SecPolicyCreateBasicX509
()
SecTrustSetPolicies
(
serverTrust
,
[
policy
.
takeRetainedValue
()])
...
...
Tests/ServerTrustPolicyTests.swift
浏览文件 @
3ba55168
...
...
@@ -780,7 +780,7 @@ class ServerTrustPolicyPinCertificatesTestCase: ServerTrustPolicyTestCase {
class
ServerTrustPolicyPinPublicKeysTestCase
:
ServerTrustPolicyTestCase
{
// MARK:
Require Valid Certificate Chain Without Host Validation
// MARK:
Validate Certificate Chain Without Validating Host
func
testThatPinningLeafKeyPassesEvaluationWithoutHostValidation
()
{
// Given
...
...
@@ -789,8 +789,8 @@ class ServerTrustPolicyPinPublicKeysTestCase: ServerTrustPolicyTestCase {
let
publicKeys
=
[
TestPublicKeys
.
LeafValidDNSName
]
let
serverTrustPolicy
=
ServerTrustPolicy
.
PinPublicKeys
(
publicKeys
:
publicKeys
,
validate
Host
:
fals
e
,
allowInvalidCertificates
:
false
validate
CertificateChain
:
tru
e
,
validateHost
:
false
)
// When
...
...
@@ -808,8 +808,8 @@ class ServerTrustPolicyPinPublicKeysTestCase: ServerTrustPolicyTestCase {
let
publicKeys
=
[
TestPublicKeys
.
IntermediateCA2
]
let
serverTrustPolicy
=
ServerTrustPolicy
.
PinPublicKeys
(
publicKeys
:
publicKeys
,
validate
Host
:
fals
e
,
allowInvalidCertificates
:
false
validate
CertificateChain
:
tru
e
,
validateHost
:
false
)
// When
...
...
@@ -827,8 +827,8 @@ class ServerTrustPolicyPinPublicKeysTestCase: ServerTrustPolicyTestCase {
let
publicKeys
=
[
TestPublicKeys
.
RootCA
]
let
serverTrustPolicy
=
ServerTrustPolicy
.
PinPublicKeys
(
publicKeys
:
publicKeys
,
validate
Host
:
fals
e
,
allowInvalidCertificates
:
false
validate
CertificateChain
:
tru
e
,
validateHost
:
false
)
// When
...
...
@@ -846,8 +846,8 @@ class ServerTrustPolicyPinPublicKeysTestCase: ServerTrustPolicyTestCase {
let
publicKeys
=
[
TestPublicKeys
.
LeafSignedByCA2
]
let
serverTrustPolicy
=
ServerTrustPolicy
.
PinPublicKeys
(
publicKeys
:
publicKeys
,
validate
Host
:
fals
e
,
allowInvalidCertificates
:
false
validate
CertificateChain
:
tru
e
,
validateHost
:
false
)
// When
...
...
@@ -865,8 +865,8 @@ class ServerTrustPolicyPinPublicKeysTestCase: ServerTrustPolicyTestCase {
let
publicKeys
=
[
TestPublicKeys
.
LeafSignedByCA1
,
TestPublicKeys
.
IntermediateCA1
,
TestPublicKeys
.
LeafValidDNSName
]
let
serverTrustPolicy
=
ServerTrustPolicy
.
PinPublicKeys
(
publicKeys
:
publicKeys
,
validate
Host
:
fals
e
,
allowInvalidCertificates
:
false
validate
CertificateChain
:
tru
e
,
validateHost
:
false
)
// When
...
...
@@ -877,7 +877,7 @@ class ServerTrustPolicyPinPublicKeysTestCase: ServerTrustPolicyTestCase {
XCTAssertTrue
(
serverTrustIsValid
,
"server trust should pass evaluation"
)
}
// MARK:
Require Valid Certificate Chain With Host Validation
// MARK:
Validate Certificate Chain and Host
func
testThatPinningLeafKeyPassesEvaluationWithHostValidation
()
{
// Given
...
...
@@ -886,8 +886,8 @@ class ServerTrustPolicyPinPublicKeysTestCase: ServerTrustPolicyTestCase {
let
publicKeys
=
[
TestPublicKeys
.
LeafValidDNSName
]
let
serverTrustPolicy
=
ServerTrustPolicy
.
PinPublicKeys
(
publicKeys
:
publicKeys
,
validate
Host
:
true
,
allowInvalidCertificates
:
fals
e
validate
CertificateChain
:
true
,
validateHost
:
tru
e
)
// When
...
...
@@ -905,8 +905,8 @@ class ServerTrustPolicyPinPublicKeysTestCase: ServerTrustPolicyTestCase {
let
publicKeys
=
[
TestPublicKeys
.
IntermediateCA2
]
let
serverTrustPolicy
=
ServerTrustPolicy
.
PinPublicKeys
(
publicKeys
:
publicKeys
,
validate
Host
:
true
,
allowInvalidCertificates
:
fals
e
validate
CertificateChain
:
true
,
validateHost
:
tru
e
)
// When
...
...
@@ -924,8 +924,8 @@ class ServerTrustPolicyPinPublicKeysTestCase: ServerTrustPolicyTestCase {
let
publicKeys
=
[
TestPublicKeys
.
RootCA
]
let
serverTrustPolicy
=
ServerTrustPolicy
.
PinPublicKeys
(
publicKeys
:
publicKeys
,
validate
Host
:
true
,
allowInvalidCertificates
:
fals
e
validate
CertificateChain
:
true
,
validateHost
:
tru
e
)
// When
...
...
@@ -943,8 +943,8 @@ class ServerTrustPolicyPinPublicKeysTestCase: ServerTrustPolicyTestCase {
let
publicKeys
=
[
TestPublicKeys
.
LeafSignedByCA2
]
let
serverTrustPolicy
=
ServerTrustPolicy
.
PinPublicKeys
(
publicKeys
:
publicKeys
,
validate
Host
:
true
,
allowInvalidCertificates
:
fals
e
validate
CertificateChain
:
true
,
validateHost
:
tru
e
)
// When
...
...
@@ -962,8 +962,8 @@ class ServerTrustPolicyPinPublicKeysTestCase: ServerTrustPolicyTestCase {
let
publicKeys
=
[
TestPublicKeys
.
LeafSignedByCA1
,
TestPublicKeys
.
IntermediateCA1
,
TestPublicKeys
.
LeafValidDNSName
]
let
serverTrustPolicy
=
ServerTrustPolicy
.
PinPublicKeys
(
publicKeys
:
publicKeys
,
validate
Host
:
true
,
allowInvalidCertificates
:
fals
e
validate
CertificateChain
:
true
,
validateHost
:
tru
e
)
// When
...
...
@@ -974,17 +974,17 @@ class ServerTrustPolicyPinPublicKeysTestCase: ServerTrustPolicyTestCase {
XCTAssertTrue
(
serverTrustIsValid
,
"server trust should pass evaluation"
)
}
// MARK:
Allow Invalid Certificate Chain
// MARK:
Do NOT Validate Certificate Chain or Host
func
testThatPinningLeafKeyW
hileAllowingInvalidCertificates
PassesEvaluationWithMissingIntermediateCertificate
()
{
func
testThatPinningLeafKeyW
ithoutCertificateChainValidation
PassesEvaluationWithMissingIntermediateCertificate
()
{
// Given
let
host
=
"test.alamofire.org"
let
serverTrust
=
TestTrusts
.
LeafValidDNSNameMissingIntermediate
.
trust
let
publicKeys
=
[
TestPublicKeys
.
LeafValidDNSName
]
let
serverTrustPolicy
=
ServerTrustPolicy
.
PinPublicKeys
(
publicKeys
:
publicKeys
,
validate
Host
:
false
,
allowInvalidCertificates
:
tru
e
validate
CertificateChain
:
false
,
validateHost
:
fals
e
)
// When
...
...
@@ -995,15 +995,15 @@ class ServerTrustPolicyPinPublicKeysTestCase: ServerTrustPolicyTestCase {
XCTAssertTrue
(
serverTrustIsValid
,
"server trust should pass evaluation"
)
}
func
testThatPinningRootKeyW
hileAllowingInvalidCertificates
FailsEvaluationWithMissingIntermediateCertificate
()
{
func
testThatPinningRootKeyW
ithoutCertificateChainValidation
FailsEvaluationWithMissingIntermediateCertificate
()
{
// Given
let
host
=
"test.alamofire.org"
let
serverTrust
=
TestTrusts
.
LeafValidDNSNameMissingIntermediate
.
trust
let
publicKeys
=
[
TestPublicKeys
.
RootCA
]
let
serverTrustPolicy
=
ServerTrustPolicy
.
PinPublicKeys
(
publicKeys
:
publicKeys
,
validate
Host
:
false
,
allowInvalidCertificates
:
tru
e
validate
CertificateChain
:
false
,
validateHost
:
fals
e
)
// When
...
...
@@ -1014,15 +1014,15 @@ class ServerTrustPolicyPinPublicKeysTestCase: ServerTrustPolicyTestCase {
XCTAssertFalse
(
serverTrustIsValid
,
"server trust should not pass evaluation"
)
}
func
testThatPinningLeafKeyW
hileAllowingInvalidCertificates
PassesEvaluationWithIncorrectIntermediateCertificate
()
{
func
testThatPinningLeafKeyW
ithoutCertificateChainValidation
PassesEvaluationWithIncorrectIntermediateCertificate
()
{
// Given
let
host
=
"test.alamofire.org"
let
serverTrust
=
TestTrusts
.
LeafValidDNSNameWithIncorrectIntermediate
.
trust
let
publicKeys
=
[
TestPublicKeys
.
LeafValidDNSName
]
let
serverTrustPolicy
=
ServerTrustPolicy
.
PinPublicKeys
(
publicKeys
:
publicKeys
,
validate
Host
:
false
,
allowInvalidCertificates
:
tru
e
validate
CertificateChain
:
false
,
validateHost
:
fals
e
)
// When
...
...
@@ -1033,15 +1033,15 @@ class ServerTrustPolicyPinPublicKeysTestCase: ServerTrustPolicyTestCase {
XCTAssertTrue
(
serverTrustIsValid
,
"server trust should pass evaluation"
)
}
func
testThatPinningLeafKeyW
hileAllowingInvalidCertificates
PassesEvaluationWithExpiredLeafCertificate
()
{
func
testThatPinningLeafKeyW
ithoutCertificateChainValidation
PassesEvaluationWithExpiredLeafCertificate
()
{
// Given
let
host
=
"test.alamofire.org"
let
serverTrust
=
TestTrusts
.
LeafExpired
.
trust
let
publicKeys
=
[
TestPublicKeys
.
LeafExpired
]
let
serverTrustPolicy
=
ServerTrustPolicy
.
PinPublicKeys
(
publicKeys
:
publicKeys
,
validate
Host
:
false
,
allowInvalidCertificates
:
tru
e
validate
CertificateChain
:
false
,
validateHost
:
fals
e
)
// When
...
...
@@ -1052,15 +1052,15 @@ class ServerTrustPolicyPinPublicKeysTestCase: ServerTrustPolicyTestCase {
XCTAssertTrue
(
serverTrustIsValid
,
"server trust should pass evaluation"
)
}
func
testThatPinningIntermediateKeyW
hileAllowingInvalidCertificates
PassesEvaluationWithExpiredLeafCertificate
()
{
func
testThatPinningIntermediateKeyW
ithoutCertificateChainValidation
PassesEvaluationWithExpiredLeafCertificate
()
{
// Given
let
host
=
"test.alamofire.org"
let
serverTrust
=
TestTrusts
.
LeafExpired
.
trust
let
publicKeys
=
[
TestPublicKeys
.
IntermediateCA2
]
let
serverTrustPolicy
=
ServerTrustPolicy
.
PinPublicKeys
(
publicKeys
:
publicKeys
,
validate
Host
:
false
,
allowInvalidCertificates
:
tru
e
validate
CertificateChain
:
false
,
validateHost
:
fals
e
)
// When
...
...
@@ -1071,15 +1071,15 @@ class ServerTrustPolicyPinPublicKeysTestCase: ServerTrustPolicyTestCase {
XCTAssertTrue
(
serverTrustIsValid
,
"server trust should pass evaluation"
)
}
func
testThatPinningRootKeyW
hileAllowingInvalidCertificates
PassesEvaluationWithExpiredLeafCertificate
()
{
func
testThatPinningRootKeyW
ithoutCertificateChainValidation
PassesEvaluationWithExpiredLeafCertificate
()
{
// Given
let
host
=
"test.alamofire.org"
let
serverTrust
=
TestTrusts
.
LeafExpired
.
trust
let
publicKeys
=
[
TestPublicKeys
.
RootCA
]
let
serverTrustPolicy
=
ServerTrustPolicy
.
PinPublicKeys
(
publicKeys
:
publicKeys
,
validate
Host
:
false
,
allowInvalidCertificates
:
tru
e
validate
CertificateChain
:
false
,
validateHost
:
fals
e
)
// When
...
...
Tests/TLSEvaluationTests.swift
浏览文件 @
3ba55168
...
...
@@ -177,11 +177,11 @@ class TLSEvaluationExpiredLeafCertificateTestCase: BaseTestCase {
// MARK: Server Trust Policy - Public Key Pinning Tests
func
testThatExpiredCertificateRequestFailsWhenPinningLeafPublicKeyW
hileNotAllowingInvalidCertificates
()
{
func
testThatExpiredCertificateRequestFailsWhenPinningLeafPublicKeyW
ithCertificateChainValidation
()
{
// Given
let
publicKeys
=
[
TestPublicKeys
.
Leaf
]
let
policies
:
[
String
:
ServerTrustPolicy
]
=
[
self
.
host
:
.
PinPublicKeys
(
publicKeys
:
publicKeys
,
validate
Host
:
true
,
allowInvalidCertificates
:
fals
e
)
self
.
host
:
.
PinPublicKeys
(
publicKeys
:
publicKeys
,
validate
CertificateChain
:
true
,
validateHost
:
tru
e
)
]
let
manager
=
Manager
(
...
...
@@ -206,11 +206,11 @@ class TLSEvaluationExpiredLeafCertificateTestCase: BaseTestCase {
XCTAssertEqual
(
error
?
.
code
??
-
1
,
NSURLErrorCancelled
,
"error should be NSURLErrorCancelled"
)
}
func
testThatExpiredCertificateRequestSucceedsWhenPinningLeafPublicKey
AndAllowingInvalidCertificates
()
{
func
testThatExpiredCertificateRequestSucceedsWhenPinningLeafPublicKey
WithoutCertificateChainValidation
()
{
// Given
let
publicKeys
=
[
TestPublicKeys
.
Leaf
]
let
policies
:
[
String
:
ServerTrustPolicy
]
=
[
self
.
host
:
.
PinPublicKeys
(
publicKeys
:
publicKeys
,
validate
Host
:
true
,
allowInvalidCertificates
:
true
)
self
.
host
:
.
PinPublicKeys
(
publicKeys
:
publicKeys
,
validate
CertificateChain
:
false
,
validateHost
:
true
)
]
let
manager
=
Manager
(
...
...
@@ -234,11 +234,11 @@ class TLSEvaluationExpiredLeafCertificateTestCase: BaseTestCase {
XCTAssertNil
(
error
,
"error should be nil"
)
}
func
testThatExpiredCertificateRequestSucceedsWhenPinningIntermediateCAPublicKey
AndAllowingInvalidCertificates
()
{
func
testThatExpiredCertificateRequestSucceedsWhenPinningIntermediateCAPublicKey
WithoutCertificateChainValidation
()
{
// Given
let
publicKeys
=
[
TestPublicKeys
.
IntermediateCA
]
let
policies
:
[
String
:
ServerTrustPolicy
]
=
[
self
.
host
:
.
PinPublicKeys
(
publicKeys
:
publicKeys
,
validate
Host
:
true
,
allowInvalidCertificates
:
true
)
self
.
host
:
.
PinPublicKeys
(
publicKeys
:
publicKeys
,
validate
CertificateChain
:
false
,
validateHost
:
true
)
]
let
manager
=
Manager
(
...
...
@@ -262,11 +262,11 @@ class TLSEvaluationExpiredLeafCertificateTestCase: BaseTestCase {
XCTAssertNil
(
error
,
"error should be nil"
)
}
func
testThatExpiredCertificateRequestSucceedsWhenPinningRootCAPublicKey
AndAllowingInvalidCertificates
()
{
func
testThatExpiredCertificateRequestSucceedsWhenPinningRootCAPublicKey
WithoutCertificateChainValidation
()
{
// Given
let
publicKeys
=
[
TestPublicKeys
.
RootCA
]
let
policies
:
[
String
:
ServerTrustPolicy
]
=
[
self
.
host
:
.
PinPublicKeys
(
publicKeys
:
publicKeys
,
validate
Host
:
true
,
allowInvalidCertificates
:
true
)
self
.
host
:
.
PinPublicKeys
(
publicKeys
:
publicKeys
,
validate
CertificateChain
:
false
,
validateHost
:
true
)
]
let
manager
=
Manager
(
...
...
编辑
预览
Markdown
is supported
0%
请重试
或
添加新附件
.
添加附件
取消
You are about to add
0
people
to the discussion. Proceed with caution.
先完成此消息的编辑!
取消
想要评论请
注册
或
登录