diff options
| author | Bug Magnet <marco.nikic@mullvad.net> | 2024-08-27 09:42:55 +0200 |
|---|---|---|
| committer | Bug Magnet <marco.nikic@mullvad.net> | 2024-08-27 09:42:55 +0200 |
| commit | 766f211e5fcf0a190384bb47f498785151e63ea2 (patch) | |
| tree | 2a79e03c1fb157c41ce9b090fc1b6fcf0fd058ca | |
| parent | 5a663eb4bafbe4f3773ce96b1e6072084bd9d0ec (diff) | |
| parent | 8ff7f7ca9dbbd892f5a3cfc747188c26bfa916bb (diff) | |
| download | mullvadvpn-766f211e5fcf0a190384bb47f498785151e63ea2.tar.xz mullvadvpn-766f211e5fcf0a190384bb47f498785151e63ea2.zip | |
Merge branch 'enable-nsallowsarbitraryloads-to-disable-ats-ios-730'
| -rw-r--r-- | ios/MullvadREST/ApiHandlers/SSLPinningURLSessionDelegate.swift | 28 | ||||
| -rw-r--r-- | ios/MullvadVPN/SceneDelegate.swift | 2 | ||||
| -rw-r--r-- | ios/MullvadVPN/Supporting Files/Info.plist | 33 |
3 files changed, 23 insertions, 40 deletions
diff --git a/ios/MullvadREST/ApiHandlers/SSLPinningURLSessionDelegate.swift b/ios/MullvadREST/ApiHandlers/SSLPinningURLSessionDelegate.swift index 6ab457fd49..2d0d1ca406 100644 --- a/ios/MullvadREST/ApiHandlers/SSLPinningURLSessionDelegate.swift +++ b/ios/MullvadREST/ApiHandlers/SSLPinningURLSessionDelegate.swift @@ -8,6 +8,7 @@ import Foundation import MullvadLogging +import Network import Security final class SSLPinningURLSessionDelegate: NSObject, URLSessionDelegate { @@ -29,17 +30,32 @@ final class SSLPinningURLSessionDelegate: NSObject, URLSessionDelegate { completionHandler: @escaping (URLSession.AuthChallengeDisposition, URLCredential?) -> Void ) { if challenge.protectionSpace.authenticationMethod == NSURLAuthenticationMethodServerTrust, - let serverTrust = challenge.protectionSpace.serverTrust, - verifyServerTrust(serverTrust) { - completionHandler(.useCredential, URLCredential(trust: serverTrust)) - } else { - completionHandler(.rejectProtectionSpace, nil) + let serverTrust = challenge.protectionSpace.serverTrust { + /// If a request is going through a local shadowsocks proxy, the host would be a localhost address,` + /// which would not appear in the list of valid host names in the root certificate. + /// The same goes for direct connections to the API, the host would be the IP address of the endpoint. + /// Certificates, cannot be signed for IP addresses, in such case, specify that the host name is `defaultAPIHostname` + var hostName = challenge.protectionSpace.host + let overridenHostnames = [ + "\(IPv4Address.loopback)", + "\(IPv6Address.loopback)", + "\(REST.defaultAPIEndpoint.ip)", + ] + if overridenHostnames.contains(hostName) { + hostName = sslHostname + } + + if verifyServerTrust(serverTrust, for: hostName) { + completionHandler(.useCredential, URLCredential(trust: serverTrust)) + return + } } + completionHandler(.rejectProtectionSpace, nil) } // MARK: - Private - private func verifyServerTrust(_ serverTrust: SecTrust) -> Bool { + private func verifyServerTrust(_ serverTrust: SecTrust, for sslHostname: String) -> Bool { var secResult: OSStatus // Set SSL policy diff --git a/ios/MullvadVPN/SceneDelegate.swift b/ios/MullvadVPN/SceneDelegate.swift index d70b631b37..618555f5fe 100644 --- a/ios/MullvadVPN/SceneDelegate.swift +++ b/ios/MullvadVPN/SceneDelegate.swift @@ -74,7 +74,7 @@ class SceneDelegate: UIResponder, UIWindowSceneDelegate, SettingsMigrationUIHand accountsProxy: appDelegate.accountsProxy, outgoingConnectionService: OutgoingConnectionService( outgoingConnectionProxy: OutgoingConnectionProxy( - urlSession: URLSession(configuration: .ephemeral), + urlSession: REST.makeURLSession(), hostname: ApplicationConfiguration.hostName ) ), diff --git a/ios/MullvadVPN/Supporting Files/Info.plist b/ios/MullvadVPN/Supporting Files/Info.plist index 48854dc4c3..14af71cdc7 100644 --- a/ios/MullvadVPN/Supporting Files/Info.plist +++ b/ios/MullvadVPN/Supporting Files/Info.plist @@ -44,39 +44,6 @@ <dict> <key>NSAllowsArbitraryLoads</key> <true/> - <key>NSExceptionDomains</key> - <dict> - <key>185.217.116.129</key> - <dict> - <key>NSExceptionAllowsInsecureHTTPLoads</key> - <true/> - </dict> - <key>127.0.0.1</key> - <dict> - <key>NSExceptionAllowsInsecureHTTPLoads</key> - <true/> - </dict> - <key>45.83.223.196</key> - <dict> - <key>NSExceptionAllowsInsecureHTTPLoads</key> - <true/> - </dict> - </dict> - <key>NSPinnedDomains</key> - <dict> - <key>am.i.mullvad.net</key> - <dict> - <key>NSIncludesSubdomains</key> - <true/> - <key>NSPinnedCAIdentities</key> - <array> - <dict> - <key>SPKI-SHA256-BASE64</key> - <string>C5+lpZ7tcVwmwQIMcRtPbsQtWLABXhQzejna0wHFr8M=</string> - </dict> - </array> - </dict> - </dict> </dict> <key>NSUserActivityTypes</key> <array> |