A TLS based security library built to interact with sdl_ios and provide TLS certificate authentication and encryption / decryption
License: BSD 3-Clause "New" or "Revised" License
Add ability to cancel an ongoing request for a certificate.
We should encrypt data being saved to disk and decrypt certificate data being retrieved.
Change how the certificate manager parses the response JSON to get the certificate data so it works out-of-the-box with the SDL Policy Server.
Once SHAID has been setup to return certificates, update the README with SHAID JSON formatting.
After updating the SSL library in v2.0.1, there are some deprecated method calls. These should be updated.
n/a
n/a
n/a
n/a
Investigate changing out the OpenSSL dependency for the SecureTransport API https://developer.apple.com/documentation/security/secure_transport?language=objc
Almost all of the header files are devoid of documentation as well as most of the private methods. As a result it can be extremely difficult to decipher what the code is trying to do.
There are many things that can go wrong during downloading and verifying the certificate. It would be extremely useful to have a logger class for printing debug statements to the console that can be easily customized.
Actual: LICENSE file includes "Copyright (c) 2016, Ford Motor Company All rights reserved." and "Neither the name of Ford Motor Company nor the names..."
Expected: LICENSE file should include "Copyright (c) 2017, SmartDeviceLink Consortium, Inc. All rights reserved." and "Neither the name of SmartDeviceLink Consortium, Inc. nor the names..."
Add a README to this project:
appID is downloaded from a URL.availableMakes in the SDLSecurityManager class should match the vehicleMakes returned in the RegisterAppInterface response..pfx. A PFX file contains a public certificate and a private key.appID. This is done in the _SDLCertificateManager class. It is expected that the:
SDLTLSIssuer in the SDLPrivateSecurityConstants class should match the certificate issuer name.SDLTLSCertPassword in the SDLPrivateSecurityConstants class should match the password used to generate the mobile certificate..a), which means the contents of library hidden from the developer.let encryptionManager = SDLEncryptionConfiguration(securityManagers: [SDLSecurityManager.self])If a static framework is built, you need to delete the framework before you can build another.
SDLSecurityStatic schemeA new build is available for the developer
PhaseSriptError due to having a file with the same name
The OpenSSL dependency installed in the library does not seem to work as expected. When the security library is installed in a project over 40+ errors are thrown while compiling. Either:
The only way I could fix the errors was by installing the OpenSSL-Universal library via Cocoapods (https://cocoapods.org/pods/OpenSSL-Universal ) to my project.
We currently use deprecated ASL logging. Since we bumped our min version to iOS 10, we should switch to OSLog.
n/a
n/a
Importing the dynamic framework doesn't work properly, resulting in build errors.
The app builds
The app does not build
License file should be updated from "Copyright (c) 2017 SmartDeviceLink Consortium, Inc." to "Copyright (c) 2017 - 2020 SmartDeviceLink Consortium, Inc."
For consistency, the availableMakes property should be moved to the SDLPrivateSecurityConstants class.
The README should be updated to reflect this change.
Add markdown file containing list of third party libraries information used within repo.
The umbrella header for the dynamic framework, SDLSecurity.h references a class that does not exist: SDLTLSSecurityManager. Also, SDLSecurityType.h should not be in the umbrella header because it is not a public class. A custom module.modulemap file should be created to use the SDLSecurityType protocol.
If the request for certificate data returns json formatted differently from the expected json format, parsing the json should not crash the app.
SDLCertificateManager.mIf parsing the response for the certificate data fails, an error should be returned explaining that the response data is not in the correct format.
The security library crashes.
Investigate using a while loop to read decrypted data from the OpenSSL server. Currently only one attempt is made to read the decrypted data, which means:
The OpenSSL library included in the library for developer convenience does not compile on Xcode 12 due to the OpenSSL library files libcrypto.a and libssl.a not being built for the i368 architectures.
The build succeeds
The build fails due to issues with the OpenSSL library
We should update the example certificate details in SDLPrivateSecurityConstants to be more generic.
Revert back to OpenSSL 1.1.1l stable version for header files after noticing bug when replacing deprecated methods in SDLTLSEngine
Change the expected response key from Certificate to certificate.
The expected json response:
{
"meta": {
"request_id": "23e6f9dd-20fe-4e6d-b8d5-9777d7cda8c0",
"code": 200,
"message": null
},
"data": {
"certificate": "..."
}
}
If a SSL_ERROR_SSL error is returned during a read/write action it means that a non-recoverable, fatal error in the SSL library occurred.
The OpenSSL documentation says:
If this error occurs then no further I/O operations should be performed on the connection and SSL_shutdown() must not be called.
Currently the library does not handle this error at all.
If the security manager setup fails for any reason we pass back a rather unhelpful error:
Error Domain=com.sdl.security Code=7 "(null)". The error code should be made human readable so developers know what went wrong even if they do not have access to the error codes.
In runHandshakeWithClientData of SDLTLSEngine.m if dataToSend is empty; one of the errors below has probably occurred. In this case nil should be return and error should not be nil.
| error code | bytes | description |
|---|---|---|
| ERROR_SUCCESS | 0x00 | Internal SecuirtyManger value |
| ERROR_INVALID_QUERY_SIZE | 0x01 | wrong size of query data |
| ERROR_INVALID_QUERY_ID | 0x02 | unknown query id |
| ERROR_NOT_SUPPORTED | 0x03 | SDL does not support encryption |
| ERROR_SERVICE_ALREADY_PROTECTED | 0x04 | got request to protect a service that was protected before |
| ERROR_SERVICE_NOT_PROTECTED | 0x05 | got handshake or encrypted data for not protected service |
| ERROR_DECRYPTION_FAILED | 0x06 | decryption failed |
| ERROR_ENCRYPTION_FAILED | 0x07 | encryption failed |
| INVALID_CERT | 0x08 | handshake failed because certificate is invalid |
| EXPIRED_CERT | 0x09 | handshake failed because certificate is expired |
| ERROR_HANDSHAKE_FAILED | 0x10 | In case of all other handshake errors |
| ERROR_INTERNAL | 0xFF | internal error |
| ERROR_UNKNOWN_INTERNAL_ERROR | 0xFE | error value for testing |
| ERROR_SSL_INVALID_DATA | 0xF0 | SSL invalid data |
Error should be sent to SDL iOS which should call sdl_serverSecurityFailedMessageWithClientMessageHeader
Infinite loop occur between SDL iOS and SDL Core because error isn't handled
When building and running the SDLSecurityStatic target a warning error is thrown but the build still succeeds.
This error should be fixed because it looks like the build failed even though it has succeeded.
The warning:
/xcodebuild:-1: SDK "iphoneos2.4" cannot be located.
See this link. It should either be put into the caches sub-directory (so that it won't be saved to iCloud, but it may get cleared if device storage is very low. Or it should be in the Application Support directory, which will be backed up to iCloud but won't be cleared if device storage is low.
Check that certificates can be downloaded from a URL, parsed, and saved correctly. The following situations should be handled:
The OpenSSL license in DEPENDENCIES.md and third_party.md should be updated. The OpenSSL dependency was update to v1.1.1 in PR #19.
OpenSSL restricts the amount of plaintext bytes that will be sent in any one SSL/TLS record. By default its value is SSL3_RT_MAX_PLAIN_LENGTH (16384 bytes). If the size of the data to be encrypted is larger than SSL3_RT_MAX_PLAIN_LENGTH, then the write will fail will the error message dtls message too big. This is an issue with encrypting video frame data which can be larger than the max allowed size.
Instead of performing one SSL_write, the code needs to be updated to use a while loop to write chunks of data no larger than SSL3_RT_MAX_PLAIN_LENGTH to the sslConnection.
Video should stream as expected.
Video may not stream or frames may be dropped due to the size of the video frame data.
Currently there are three constants for the certificate URLs: CertDevURL, CertQAURL, CertProdURL, but CertQAURL is the only one being used.
Either only one url should be used, or the project should be configured to use a different URL based on whether a debug or release build is being created.
A .podspec file was added to the library so it can be installed as a dependency via CocoaPods. However it seems to have no purpose since the installed files can not be utilized. It should be removed or, if it does have a purpose, more information on how to use it should be added to the README.
React
A declarative, efficient, and flexible JavaScript library for building user interfaces.
🖖 Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.
Typescript
TypeScript is a superset of JavaScript that compiles to clean JavaScript output.
An Open Source Machine Learning Framework for Everyone
Django
The Web framework for perfectionists with deadlines.
Laravel
A PHP framework for web artisans
Bring data to life with SVG, Canvas and HTML. 📊📈🎉
JavaScript (JS) is a lightweight interpreted programming language with first-class functions.
Some thing interesting about web. New door for the world.
A server is a program made to process requests and deliver data to clients.
Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.
Some thing interesting about visualization, use data art
Some thing interesting about game, make everyone happy.
Facebook
We are working to build community through open source technology. NB: members must have two-factor auth.
Microsoft
Open source projects and samples from Microsoft.
Google
Google ❤️ Open Source for everyone.
Alibaba
Alibaba Open Source for everyone
D3
Data-Driven Documents codes.
Tencent
China tencent open source team.