|
|
@@ -57,68 +57,30 @@ static SecTrustRef AFUTADNNetServerTrust() {
|
|
|
return AFUTTrustChainForCertsInDirectory(serverCertDirectoryPath);
|
|
|
}
|
|
|
|
|
|
-//static SecTrustRef AFUTGoogleComServerTrustPath1() {
|
|
|
-// NSString *bundlePath = [[NSBundle bundleForClass:[AFSecurityPolicyTests class]] resourcePath];
|
|
|
-// NSString *serverCertDirectoryPath = [bundlePath stringByAppendingPathComponent:@"GoogleComServerTrustChainPath1"];
|
|
|
-//
|
|
|
-// return AFUTTrustChainForCertsInDirectory(serverCertDirectoryPath);
|
|
|
-//}
|
|
|
-//
|
|
|
-//static SecTrustRef AFUTGoogleComServerTrustPath2() {
|
|
|
-// NSString *bundlePath = [[NSBundle bundleForClass:[AFSecurityPolicyTests class]] resourcePath];
|
|
|
-// NSString *serverCertDirectoryPath = [bundlePath stringByAppendingPathComponent:@"GoogleComServerTrustChainPath2"];
|
|
|
-//
|
|
|
-// return AFUTTrustChainForCertsInDirectory(serverCertDirectoryPath);
|
|
|
-//}
|
|
|
-
|
|
|
static SecCertificateRef AFUTHTTPBinOrgCertificate() {
|
|
|
- NSString *certPath = [[NSBundle bundleForClass:[AFSecurityPolicyTests class]] pathForResource:@"httpbinorg_01192017" ofType:@"cer"];
|
|
|
- NSCAssert(certPath != nil, @"Path for certificate should not be nil");
|
|
|
- NSData *certData = [NSData dataWithContentsOfFile:certPath];
|
|
|
-
|
|
|
- return SecCertificateCreateWithData(NULL, (__bridge CFDataRef)(certData));
|
|
|
-}
|
|
|
-
|
|
|
-static SecCertificateRef AFUTCOMODORSADomainValidationSecureServerCertificate() {
|
|
|
- NSString *certPath = [[NSBundle bundleForClass:[AFSecurityPolicyTests class]] pathForResource:@"COMODO_RSA_Domain_Validation_Secure_Server_CA" ofType:@"cer"];
|
|
|
+ NSString *certPath = [[NSBundle bundleForClass:[AFSecurityPolicyTests class]] pathForResource:@"httpbinorg_08132017" ofType:@"cer"];
|
|
|
NSCAssert(certPath != nil, @"Path for certificate should not be nil");
|
|
|
NSData *certData = [NSData dataWithContentsOfFile:certPath];
|
|
|
|
|
|
return SecCertificateCreateWithData(NULL, (__bridge CFDataRef)(certData));
|
|
|
}
|
|
|
|
|
|
-static SecCertificateRef AFUTCOMODORSACertificate() {
|
|
|
- NSString *certPath = [[NSBundle bundleForClass:[AFSecurityPolicyTests class]] pathForResource:@"COMODO_RSA_Certification_Authority" ofType:@"cer"];
|
|
|
+static SecCertificateRef AFUTLetsEncryptAuthorityCertificate() {
|
|
|
+ NSString *certPath = [[NSBundle bundleForClass:NSClassFromString(@"AFSecurityPolicyTests")] pathForResource:@"Let's Encrypt Authority X3" ofType:@"cer"];
|
|
|
NSCAssert(certPath != nil, @"Path for certificate should not be nil");
|
|
|
NSData *certData = [NSData dataWithContentsOfFile:certPath];
|
|
|
-
|
|
|
+
|
|
|
return SecCertificateCreateWithData(NULL, (__bridge CFDataRef)(certData));
|
|
|
}
|
|
|
|
|
|
-static SecCertificateRef AFUTAddTrustExternalRootCertificate() {
|
|
|
- NSString *certPath = [[NSBundle bundleForClass:[AFSecurityPolicyTests class]] pathForResource:@"AddTrust_External_CA_Root" ofType:@"cer"];
|
|
|
+static SecCertificateRef AFUTDSTRootCertificate() {
|
|
|
+ NSString *certPath = [[NSBundle bundleForClass:NSClassFromString(@"AFSecurityPolicyTests")] pathForResource:@"DST Root CA X3" ofType:@"cer"];
|
|
|
NSCAssert(certPath != nil, @"Path for certificate should not be nil");
|
|
|
NSData *certData = [NSData dataWithContentsOfFile:certPath];
|
|
|
-
|
|
|
+
|
|
|
return SecCertificateCreateWithData(NULL, (__bridge CFDataRef)(certData));
|
|
|
}
|
|
|
|
|
|
-//static SecCertificateRef AFUTGoogleComEquifaxSecureCARootCertificate() {
|
|
|
-// NSString *certPath = [[NSBundle bundleForClass:[AFSecurityPolicyTests class]] pathForResource:@"Equifax_Secure_Certificate_Authority_Root" ofType:@"cer"];
|
|
|
-// NSCAssert(certPath != nil, @"Path for certificate should not be nil");
|
|
|
-// NSData *certData = [NSData dataWithContentsOfFile:certPath];
|
|
|
-//
|
|
|
-// return SecCertificateCreateWithData(NULL, (__bridge CFDataRef)(certData));
|
|
|
-//}
|
|
|
-//
|
|
|
-//static SecCertificateRef AFUTGoogleComGeoTrustGlobalCARootCertificate() {
|
|
|
-// NSString *certPath = [[NSBundle bundleForClass:[AFSecurityPolicyTests class]] pathForResource:@"GeoTrust_Global_CA_Root" ofType:@"cer"];
|
|
|
-// NSCAssert(certPath != nil, @"Path for certificate should not be nil");
|
|
|
-// NSData *certData = [NSData dataWithContentsOfFile:certPath];
|
|
|
-//
|
|
|
-// return SecCertificateCreateWithData(NULL, (__bridge CFDataRef)(certData));
|
|
|
-//}
|
|
|
-
|
|
|
static SecCertificateRef AFUTSelfSignedCertificateWithoutDomain() {
|
|
|
NSString *certPath = [[NSBundle bundleForClass:[AFSecurityPolicyTests class]] pathForResource:@"NoDomains" ofType:@"cer"];
|
|
|
NSCAssert(certPath != nil, @"Path for certificate should not be nil");
|
|
|
@@ -239,58 +201,48 @@ static SecTrustRef AFUTTrustWithCertificate(SecCertificateRef certificate) {
|
|
|
XCTAssertTrue([policy evaluateServerTrust:AFUTHTTPBinOrgServerTrust() forDomain:nil], @"Policy should allow server trust");
|
|
|
}
|
|
|
|
|
|
-- (void)testPolicyWithPublicKeyPinningAllowsHTTPBinOrgServerTrustWithHTTPBinOrgIntermediate1CertificatePinned {
|
|
|
+- (void)testPolicyWithPublicKeyPinningAllowsHTTPBinOrgServerTrustWithHTTPBinOrgIntermediateCertificatePinned {
|
|
|
AFSecurityPolicy *policy = [AFSecurityPolicy policyWithPinningMode:AFSSLPinningModePublicKey];
|
|
|
-
|
|
|
- SecCertificateRef certificate = AFUTCOMODORSADomainValidationSecureServerCertificate();
|
|
|
- policy.pinnedCertificates = [NSSet setWithObject:(__bridge_transfer id)SecCertificateCopyData(certificate)];
|
|
|
- XCTAssertTrue([policy evaluateServerTrust:AFUTHTTPBinOrgServerTrust() forDomain:nil], @"Policy should allow server trust");
|
|
|
-}
|
|
|
-
|
|
|
-- (void)testPolicyWithPublicKeyPinningAllowsHTTPBinOrgServerTrustWithHTTPBinOrgIntermediate2CertificatePinned {
|
|
|
- AFSecurityPolicy *policy = [AFSecurityPolicy policyWithPinningMode:AFSSLPinningModePublicKey];
|
|
|
-
|
|
|
- SecCertificateRef certificate = AFUTCOMODORSACertificate();
|
|
|
+
|
|
|
+ SecCertificateRef certificate = AFUTLetsEncryptAuthorityCertificate();
|
|
|
policy.pinnedCertificates = [NSSet setWithObject:(__bridge_transfer id)SecCertificateCopyData(certificate)];
|
|
|
XCTAssertTrue([policy evaluateServerTrust:AFUTHTTPBinOrgServerTrust() forDomain:nil], @"Policy should allow server trust");
|
|
|
}
|
|
|
|
|
|
- (void)testPolicyWithPublicKeyPinningAllowsHTTPBinOrgServerTrustWithHTTPBinOrgRootCertificatePinned {
|
|
|
AFSecurityPolicy *policy = [AFSecurityPolicy policyWithPinningMode:AFSSLPinningModePublicKey];
|
|
|
-
|
|
|
- SecCertificateRef certificate = AFUTAddTrustExternalRootCertificate();
|
|
|
+
|
|
|
+ SecCertificateRef certificate = AFUTDSTRootCertificate();
|
|
|
policy.pinnedCertificates = [NSSet setWithObject:(__bridge_transfer id)SecCertificateCopyData(certificate)];
|
|
|
XCTAssertTrue([policy evaluateServerTrust:AFUTHTTPBinOrgServerTrust() forDomain:nil], @"Policy should allow server trust");
|
|
|
}
|
|
|
|
|
|
- (void)testPolicyWithPublicKeyPinningAllowsHTTPBinOrgServerTrustWithEntireCertificateChainPinned {
|
|
|
AFSecurityPolicy *policy = [AFSecurityPolicy policyWithPinningMode:AFSSLPinningModePublicKey];
|
|
|
-
|
|
|
+
|
|
|
SecCertificateRef httpBinCertificate = AFUTHTTPBinOrgCertificate();
|
|
|
- SecCertificateRef intermedaite1Certificate = AFUTCOMODORSADomainValidationSecureServerCertificate();
|
|
|
- SecCertificateRef intermedaite2Certificate = AFUTCOMODORSACertificate();
|
|
|
- SecCertificateRef rootCertificate = AFUTAddTrustExternalRootCertificate();
|
|
|
+ SecCertificateRef intermediateCertificate = AFUTLetsEncryptAuthorityCertificate();
|
|
|
+ SecCertificateRef rootCertificate = AFUTDSTRootCertificate();
|
|
|
[policy setPinnedCertificates:[NSSet setWithObjects:(__bridge_transfer NSData *)SecCertificateCopyData(httpBinCertificate),
|
|
|
- (__bridge_transfer NSData *)SecCertificateCopyData(intermedaite1Certificate),
|
|
|
- (__bridge_transfer NSData *)SecCertificateCopyData(intermedaite2Certificate),
|
|
|
- (__bridge_transfer NSData *)SecCertificateCopyData(rootCertificate), nil]];
|
|
|
+ (__bridge_transfer NSData *)SecCertificateCopyData(intermediateCertificate),
|
|
|
+ (__bridge_transfer NSData *)SecCertificateCopyData(rootCertificate), nil]];
|
|
|
XCTAssertTrue([policy evaluateServerTrust:AFUTHTTPBinOrgServerTrust() forDomain:nil], @"Policy should allow HTTPBinOrg server trust because at least one of the pinned certificates is valid");
|
|
|
-
|
|
|
+
|
|
|
}
|
|
|
|
|
|
- (void)testPolicyWithPublicKeyPinningAllowsHTTPBirnOrgServerTrustWithHTTPbinOrgPinnedCertificateAndAdditionalPinnedCertificates {
|
|
|
AFSecurityPolicy *policy = [AFSecurityPolicy policyWithPinningMode:AFSSLPinningModePublicKey];
|
|
|
-
|
|
|
+
|
|
|
SecCertificateRef httpBinCertificate = AFUTHTTPBinOrgCertificate();
|
|
|
SecCertificateRef selfSignedCertificate = AFUTSelfSignedCertificateWithCommonNameDomain();
|
|
|
[policy setPinnedCertificates:[NSSet setWithObjects:(__bridge_transfer NSData *)SecCertificateCopyData(httpBinCertificate),
|
|
|
- (__bridge_transfer NSData *)SecCertificateCopyData(selfSignedCertificate), nil]];
|
|
|
+ (__bridge_transfer NSData *)SecCertificateCopyData(selfSignedCertificate), nil]];
|
|
|
XCTAssertTrue([policy evaluateServerTrust:AFUTHTTPBinOrgServerTrust() forDomain:nil], @"Policy should allow HTTPBinOrg server trust because at least one of the pinned certificates is valid");
|
|
|
}
|
|
|
|
|
|
- (void)testPolicyWithPublicKeyPinningAllowsHTTPBinOrgServerTrustWithHTTPBinOrgLeafCertificatePinnedAndValidDomainName {
|
|
|
AFSecurityPolicy *policy = [AFSecurityPolicy policyWithPinningMode:AFSSLPinningModePublicKey];
|
|
|
-
|
|
|
+
|
|
|
SecCertificateRef certificate = AFUTHTTPBinOrgCertificate();
|
|
|
policy.pinnedCertificates = [NSSet setWithObject:(__bridge_transfer id)SecCertificateCopyData(certificate)];
|
|
|
XCTAssertTrue([policy evaluateServerTrust:AFUTHTTPBinOrgServerTrust() forDomain:@"httpbin.org"], @"Policy should allow server trust");
|
|
|
@@ -361,96 +313,53 @@ static SecTrustRef AFUTTrustWithCertificate(SecCertificateRef certificate) {
|
|
|
XCTAssertTrue([policy evaluateServerTrust:AFUTHTTPBinOrgServerTrust() forDomain:nil], @"Policy should allow server trust");
|
|
|
}
|
|
|
|
|
|
-- (void)testPolicyWithCertificatePinningAllowsHTTPBinOrgServerTrustWithHTTPBinOrgIntermediate1CertificatePinned {
|
|
|
- AFSecurityPolicy *policy = [AFSecurityPolicy policyWithPinningMode:AFSSLPinningModeCertificate];
|
|
|
-
|
|
|
- SecCertificateRef certificate = AFUTCOMODORSADomainValidationSecureServerCertificate();
|
|
|
- policy.pinnedCertificates = [NSSet setWithObject:(__bridge_transfer id)SecCertificateCopyData(certificate)];
|
|
|
- XCTAssertTrue([policy evaluateServerTrust:AFUTHTTPBinOrgServerTrust() forDomain:nil], @"Policy should allow server trust");
|
|
|
-}
|
|
|
-
|
|
|
-- (void)testPolicyWithCertificatePinningAllowsHTTPBinOrgServerTrustWithHTTPBinOrgIntermediate2CertificatePinned {
|
|
|
+- (void)testPolicyWithCertificatePinningAllowsHTTPBinOrgServerTrustWithHTTPBinOrgIntermediateCertificatePinned {
|
|
|
AFSecurityPolicy *policy = [AFSecurityPolicy policyWithPinningMode:AFSSLPinningModeCertificate];
|
|
|
-
|
|
|
- SecCertificateRef certificate = AFUTCOMODORSACertificate();
|
|
|
+
|
|
|
+ SecCertificateRef certificate = AFUTLetsEncryptAuthorityCertificate();
|
|
|
policy.pinnedCertificates = [NSSet setWithObject:(__bridge_transfer id)SecCertificateCopyData(certificate)];
|
|
|
XCTAssertTrue([policy evaluateServerTrust:AFUTHTTPBinOrgServerTrust() forDomain:nil], @"Policy should allow server trust");
|
|
|
}
|
|
|
|
|
|
- (void)testPolicyWithCertificatePinningAllowsHTTPBinOrgServerTrustWithHTTPBinOrgRootCertificatePinned {
|
|
|
AFSecurityPolicy *policy = [AFSecurityPolicy policyWithPinningMode:AFSSLPinningModeCertificate];
|
|
|
-
|
|
|
- SecCertificateRef certificate = AFUTAddTrustExternalRootCertificate();
|
|
|
+
|
|
|
+ SecCertificateRef certificate = AFUTDSTRootCertificate();
|
|
|
policy.pinnedCertificates = [NSSet setWithObject:(__bridge_transfer id)SecCertificateCopyData(certificate)];
|
|
|
XCTAssertTrue([policy evaluateServerTrust:AFUTHTTPBinOrgServerTrust() forDomain:nil], @"Policy should allow server trust");
|
|
|
}
|
|
|
|
|
|
- (void)testPolicyWithCertificatePinningAllowsHTTPBinOrgServerTrustWithEntireCertificateChainPinned {
|
|
|
AFSecurityPolicy *policy = [AFSecurityPolicy policyWithPinningMode:AFSSLPinningModeCertificate];
|
|
|
-
|
|
|
+
|
|
|
SecCertificateRef httpBinCertificate = AFUTHTTPBinOrgCertificate();
|
|
|
- SecCertificateRef intermedaite1Certificate = AFUTCOMODORSADomainValidationSecureServerCertificate();
|
|
|
- SecCertificateRef intermedaite2Certificate = AFUTCOMODORSACertificate();
|
|
|
- SecCertificateRef rootCertificate = AFUTAddTrustExternalRootCertificate();
|
|
|
+ SecCertificateRef intermediateCertificate = AFUTLetsEncryptAuthorityCertificate();
|
|
|
+ SecCertificateRef rootCertificate = AFUTDSTRootCertificate();
|
|
|
[policy setPinnedCertificates:[NSSet setWithObjects:(__bridge_transfer NSData *)SecCertificateCopyData(httpBinCertificate),
|
|
|
- (__bridge_transfer NSData *)SecCertificateCopyData(intermedaite1Certificate),
|
|
|
- (__bridge_transfer NSData *)SecCertificateCopyData(intermedaite2Certificate),
|
|
|
- (__bridge_transfer NSData *)SecCertificateCopyData(rootCertificate), nil]];
|
|
|
+ (__bridge_transfer NSData *)SecCertificateCopyData(intermediateCertificate),
|
|
|
+ (__bridge_transfer NSData *)SecCertificateCopyData(rootCertificate), nil]];
|
|
|
XCTAssertTrue([policy evaluateServerTrust:AFUTHTTPBinOrgServerTrust() forDomain:nil], @"Policy should allow HTTPBinOrg server trust because at least one of the pinned certificates is valid");
|
|
|
-
|
|
|
+
|
|
|
}
|
|
|
|
|
|
- (void)testPolicyWithCertificatePinningAllowsHTTPBirnOrgServerTrustWithHTTPbinOrgPinnedCertificateAndAdditionalPinnedCertificates {
|
|
|
AFSecurityPolicy *policy = [AFSecurityPolicy policyWithPinningMode:AFSSLPinningModeCertificate];
|
|
|
-
|
|
|
+
|
|
|
SecCertificateRef httpBinCertificate = AFUTHTTPBinOrgCertificate();
|
|
|
SecCertificateRef selfSignedCertificate = AFUTSelfSignedCertificateWithCommonNameDomain();
|
|
|
[policy setPinnedCertificates:[NSSet setWithObjects:(__bridge_transfer NSData *)SecCertificateCopyData(httpBinCertificate),
|
|
|
- (__bridge_transfer NSData *)SecCertificateCopyData(selfSignedCertificate), nil]];
|
|
|
+ (__bridge_transfer NSData *)SecCertificateCopyData(selfSignedCertificate), nil]];
|
|
|
XCTAssertTrue([policy evaluateServerTrust:AFUTHTTPBinOrgServerTrust() forDomain:nil], @"Policy should allow HTTPBinOrg server trust because at least one of the pinned certificates is valid");
|
|
|
}
|
|
|
|
|
|
- (void)testPolicyWithCertificatePinningAllowsHTTPBinOrgServerTrustWithHTTPBinOrgLeafCertificatePinnedAndValidDomainName {
|
|
|
AFSecurityPolicy *policy = [AFSecurityPolicy policyWithPinningMode:AFSSLPinningModeCertificate];
|
|
|
-
|
|
|
+
|
|
|
SecCertificateRef certificate = AFUTHTTPBinOrgCertificate();
|
|
|
policy.pinnedCertificates = [NSSet setWithObject:(__bridge_transfer id)SecCertificateCopyData(certificate)];
|
|
|
XCTAssertTrue([policy evaluateServerTrust:AFUTHTTPBinOrgServerTrust() forDomain:@"httpbin.org"], @"Policy should allow server trust");
|
|
|
}
|
|
|
|
|
|
-//- (void)testPolicyWithCertificatePinningAllowsGoogleComServerTrustIncompleteChainWithRootCertificatePinnedAndValidDomainName {
|
|
|
-// //TODO THIS TEST HAS BEEN DISABLED UNTIL CERTS HAVE BEEN UPDATED.
|
|
|
-// //Please see conversation here: https://github.com/AFNetworking/AFNetworking/pull/3159#issuecomment-178647437
|
|
|
-// //
|
|
|
-// // Fix certificate validation for servers providing incomplete chains (#3159) - test case
|
|
|
-// //
|
|
|
-// // google.com has two certification paths and both send incomplete certificate chains, i.e. don't include the Root CA
|
|
|
-// // (this can be validated in https://www.ssllabs.com/ssltest/analyze.html?d=google.com)
|
|
|
-// //
|
|
|
-// // The two certification paths are:
|
|
|
-// // - Path 1: *.google.com, Google Internet Authority G2 (with GeoTrust Global CA Root)
|
|
|
-// // - Path 2: *.google.com, Google Internet Authority G2, GeoTrust Global CA (cross signed) (with Equifax Secure CA Root)
|
|
|
-// //
|
|
|
-// // The common goal of using certificate pinning is to prevent MiTM (man-in-the-middle) attacks, so the Root CA's should be pinned to protect the entire chains.
|
|
|
-// // Since there's no Root CA being sent, when `-evaluateServerTrust:` invokes `AFCertificateTrustChainForServerTrust(serverTrust)`, the Root CA isn't present
|
|
|
-// // Therefore, even though `AFServerTrustIsValid(serverTrust)` succeeds, the next validation fails since no pinned certificate matches the `pinnedCertificates`.
|
|
|
-// // By fetching the `AFCertificateTrustChainForServerTrust(serverTrust)` *after* the `AFServerTrustIsValid(serverTrust)` validation, the complete chain is obtained and the Root CA's match.
|
|
|
-//
|
|
|
-// AFSecurityPolicy *policy = [AFSecurityPolicy policyWithPinningMode:AFSSLPinningModeCertificate];
|
|
|
-//
|
|
|
-// // certification path 1
|
|
|
-// SecCertificateRef certificate = AFUTGoogleComGeoTrustGlobalCARootCertificate();
|
|
|
-// policy.pinnedCertificates = [NSSet setWithObject:(__bridge_transfer id)SecCertificateCopyData(certificate)];
|
|
|
-//
|
|
|
-// XCTAssertTrue([policy evaluateServerTrust:AFUTGoogleComServerTrustPath1() forDomain:@"google.com"], @"Policy should allow server trust");
|
|
|
-//
|
|
|
-// // certification path 2
|
|
|
-// certificate = AFUTGoogleComEquifaxSecureCARootCertificate();
|
|
|
-// policy.pinnedCertificates = [NSSet setWithObject:(__bridge_transfer id)SecCertificateCopyData(certificate)];
|
|
|
-//
|
|
|
-// XCTAssertTrue([policy evaluateServerTrust:AFUTGoogleComServerTrustPath2() forDomain:@"google.com"], @"Policy should allow server trust");
|
|
|
-//}
|
|
|
-
|
|
|
#pragma mark Negative Server Trust Evaluation Tests
|
|
|
|
|
|
- (void)testPolicyWithCertificatePinningAndNoPinnedCertificatesDoesNotAllowHTTPBinOrgServerTrust {
|
|
|
@@ -494,11 +403,6 @@ static SecTrustRef AFUTTrustWithCertificate(SecCertificateRef certificate) {
|
|
|
XCTAssertTrue([policy evaluateServerTrust:AFUTHTTPBinOrgServerTrust() forDomain:@"invalid.org"], @"Policy should allow server trust because domain name validation is disabled");
|
|
|
}
|
|
|
|
|
|
-- (void)testThatPolicyWithDomainNameValidationAllowsServerTrustWithValidWildcardDomainName {
|
|
|
- AFSecurityPolicy *policy = [AFSecurityPolicy defaultPolicy];
|
|
|
- XCTAssertTrue([policy evaluateServerTrust:AFUTHTTPBinOrgServerTrust() forDomain:@"test.httpbin.org"], @"Policy should allow server trust");
|
|
|
-}
|
|
|
-
|
|
|
- (void)testThatPolicyWithDomainNameValidationAndSelfSignedCommonNameCertificateAllowsServerTrust {
|
|
|
AFSecurityPolicy *policy = [AFSecurityPolicy policyWithPinningMode:AFSSLPinningModePublicKey];
|
|
|
|
Jeff Kelley