Allows adding trusted certs on iOS.

runtime/bin/secure_socket_ios.cc

 // Copyright (c) 2016, the Dart project authors.  Please see the AUTHORS file
 // for details. All rights reserved. Use of this source code is governed by a
 // BSD-style license that can be found in the LICENSE file.
 
 #if !defined(DART_IO_DISABLED) && !defined(DART_IO_SECURE_SOCKET_DISABLED)
 
 #include "platform/globals.h"
 #if TARGET_OS_IOS
 
 #include "bin/secure_socket.h"
@@ skipping 25 matching lines @@
 
 // Return the error from the containing function if handle is an error handle.
 #define RETURN_IF_ERROR(handle)                                                \
   {                                                                            \
     Dart_Handle __handle = handle;                                             \
     if (Dart_IsError((__handle))) {                                            \
       return __handle;                                                         \
     }                                                                          \
   }
 
-// We need to access this private API function to create a SecIdentityRef
-// without writing a custom keychain to the filesystem. This is the approach
-// taken in WebKit:
-// https://webkit.googlesource.com/WebKit/+/master/Source/WebKit2/Shared/cf/ArgumentCodersCF.cpp
-extern "C" {
-SecIdentityRef SecIdentityCreate(CFAllocatorRef allocator,
-                                 SecCertificateRef certificate,
-                                 SecKeyRef private_key);
-}
-
 namespace dart {
 namespace bin {
 
 static const int kSSLFilterNativeFieldIndex = 0;
 static const int kSecurityContextNativeFieldIndex = 0;
 static const int kX509NativeFieldIndex = 0;
 
 static const bool SSL_LOG_STATUS = false;
 static const bool SSL_LOG_DATA = false;
 static const int SSL_ERROR_MESSAGE_BUFFER_SIZE = 1000;
 
 // SSLCertContext wraps the certificates needed for a SecureTransport
 // connection. Fields are protected by the mutex_ field, and may only be set
 // once. This is to allow access by both the Dart thread and the IOService
 // thread. Setters return false if the field was already set.
 class SSLCertContext {
  public:
   SSLCertContext() :
       mutex_(new Mutex()),
+      trusted_certs_(NULL),
       trust_builtin_(false) {}
 
   ~SSLCertContext() {
     delete mutex_;
+    if (trusted_certs_ != NULL) {
+      CFRelease(trusted_certs_);
+    }
+  }
+
+  CFMutableArrayRef trusted_certs() {
+    MutexLocker m(mutex_);
+    return trusted_certs_;
+  }
+  void add_trusted_cert(SecCertificateRef trusted_cert) {
+    // Takes ownership of trusted_cert.
+    MutexLocker m(mutex_);
+    if (trusted_certs_ == NULL) {
+      trusted_certs_ = CFArrayCreateMutable(NULL, 0, &kCFTypeArrayCallBacks);
+    }
+    CFArrayAppendValue(trusted_certs_, trusted_cert);
+    CFRelease(trusted_cert);  // trusted_cert is retained by the array.
   }
 
   bool trust_builtin() {
     MutexLocker m(mutex_);
     return trust_builtin_;
   }
   void set_trust_builtin(bool trust_builtin) {
     MutexLocker m(mutex_);
     trust_builtin_ = trust_builtin;
   }
 
  private:
   // The context is accessed both by Dart code and the IOService. This mutex
   // protects all fields.
   Mutex* mutex_;
+  CFMutableArrayRef trusted_certs_;
   bool trust_builtin_;
 
   DISALLOW_COPY_AND_ASSIGN(SSLCertContext);
 };
 
 // Handle an error reported from the SecureTransport library.
 static void ThrowIOException(OSStatus status,
                              const char* exception_type,
                              const char* message) {
   TextBuffer status_message(SSL_ERROR_MESSAGE_BUFFER_SIZE);
@@ skipping 277 matching lines @@
 
 void FUNCTION_NAME(SecurityContext_UsePrivateKeyBytes)(
     Dart_NativeArguments args) {
   Dart_ThrowException(DartUtils::NewDartUnsupportedError(
       "SecurityContext.usePrivateKeyBytes is not yet implemented."));
 }
 
 
 void FUNCTION_NAME(SecurityContext_SetTrustedCertificatesBytes)(
     Dart_NativeArguments args) {
-  Dart_ThrowException(DartUtils::NewDartUnsupportedError(
-      "SecurityContext.setTrustedCertificatesBytes is not yet implemented."));
+  SSLCertContext* context = GetSecurityContext(args);
+
+  OSStatus status = noErr;
+  SecCertificateRef cert = NULL;
+  {
+    ScopedMemBuffer buffer(ThrowIfError(Dart_GetNativeArgument(args, 1)));
+    CFDataRef cfdata = CFDataCreateWithBytesNoCopy(
+        NULL, buffer.get(), buffer.length(), kCFAllocatorNull);
+    cert = SecCertificateCreateWithData(NULL, cfdata);
+    CFRelease(cfdata);
+  }
+
+  // Add the certs to the context.
+  if (cert != NULL) {
+    context->add_trusted_cert(cert);
+  } else {
+    status = errSSLBadCert;
+  }
+  CheckStatus(status, "TlsException", "Failure in setTrustedCertificatesBytes");
 }
 
 
 void FUNCTION_NAME(SecurityContext_AlpnSupported)(Dart_NativeArguments args) {
   Dart_SetReturnValue(args, Dart_NewBoolean(false));
 }
 
 
 void FUNCTION_NAME(SecurityContext_TrustBuiltinRoots)(
     Dart_NativeArguments args) {
@@ skipping 488 matching lines @@
       // A client certificate was requested, but not required, and wasn't sent.
       return noErr;
     }
     if (SSL_LOG_STATUS) {
       Log::Print("Handshake error from SSLCopyPeerTrust(): %ld.\n",
           static_cast<intptr_t>(status));
     }
     return status;
   }
 
-  CFArrayRef trusted_certs =
-      CFArrayCreate(NULL, NULL, 0, &kCFTypeArrayCallBacks);
+  CFArrayRef trusted_certs = NULL;
+  if (cert_context_->trusted_certs() != NULL) {
+    trusted_certs = CFArrayCreateCopy(NULL, cert_context_->trusted_certs());
+  } else {
+    trusted_certs = CFArrayCreate(NULL, NULL, 0, &kCFTypeArrayCallBacks);
+  }
 
   status = SecTrustSetAnchorCertificates(peer_trust, trusted_certs);
   if (status != noErr) {
     if (SSL_LOG_STATUS) {
       Log::Print("Handshake error from SecTrustSetAnchorCertificates: %ld\n",
           static_cast<intptr_t>(status));
     }
     CFRelease(trusted_certs);
     CFRelease(peer_trust);
     return status;
@@ skipping 388 matching lines @@
   *bytes_processed = static_cast<intptr_t>(bytes);
   return status;
 }
 
 }  // namespace bin
 }  // namespace dart
 
 #endif  // TARGET_OS_IOS
 
 #endif  // !defined(DART_IO_SECURE_SOCKET_DISABLED)