diff --git a/frameworks/ets/ani/net_ssl/BUILD.gn b/frameworks/ets/ani/net_ssl/BUILD.gn index 0d61c603fbc0970e5bed290ba791c53f1b9705d8..231614daf9da8a221e5e72e1c5b0ee43c549b1e2 100644 --- a/frameworks/ets/ani/net_ssl/BUILD.gn +++ b/frameworks/ets/ani/net_ssl/BUILD.gn @@ -32,6 +32,7 @@ ohos_static_library("network_security_ani_static") { include_dirs = [ "include", "${target_gen_dir}/src", + "$NETSTACK_DIR/frameworks/native/net_ssl/include", ] sources = [ "src/cxx/network_security_ani.cpp" ] sources += get_target_outputs(":network_security_ani_cxx") diff --git a/frameworks/ets/ani/net_ssl/ets/@ohos.net.networkSecurity.d.ets b/frameworks/ets/ani/net_ssl/ets/@ohos.net.networkSecurity.d.ets index 7aa4c99da1c6642e319f568aa75448351d7fb1d0..76f710f33fb1a0ea51ede0cfbd537cb037b54d95 100644 --- a/frameworks/ets/ani/net_ssl/ets/@ohos.net.networkSecurity.d.ets +++ b/frameworks/ets/ani/net_ssl/ets/@ohos.net.networkSecurity.d.ets @@ -34,7 +34,7 @@ export default namespace networkSecurity { export function certVerification(cert: CertBlob, caCert?: CertBlob): Promise { return new Promise((resolve, reject) => { taskpool.execute((): int => { - return certVerificationSync(cert, caCert); + return certVerificationAsync(cert, caCert); }).then((content: NullishType) => { resolve(content as int); }, (err: Error): void => { @@ -43,14 +43,11 @@ export default namespace networkSecurity { }); } + export native function certVerificationAsync(cert: CertBlob, caCert?: CertBlob): int; + export native function certVerificationSync(cert: CertBlob, caCert?: CertBlob): int; export native function isCleartextPermitted(): boolean; export native function isCleartextPermittedByHostName(hostName: string): boolean; } - -function main() { - let w = networkSecurity.isCleartextPermitted(); - console.log(w); -} diff --git a/frameworks/ets/ani/net_ssl/include/network_security_ani.h b/frameworks/ets/ani/net_ssl/include/network_security_ani.h index ef054d2a6d84085ffcbf178ad0484f86f6e27cba..bc943064689ee978ef5abccfbef0a6bf238469f5 100644 --- a/frameworks/ets/ani/net_ssl/include/network_security_ani.h +++ b/frameworks/ets/ani/net_ssl/include/network_security_ani.h @@ -18,7 +18,7 @@ #include #include - +#include "cxx.h" #include "net_conn_client.h" #include "net_ssl.h" @@ -39,6 +39,7 @@ inline int32_t IsCleartextPermittedByHostName(std::string const &hostName, bool uint32_t NetStackVerifyCertificationCa(const CertBlob &cert, const CertBlob &caCert); uint32_t NetStackVerifyCertification(const CertBlob &cert); +rust::String GetErrorCodeAndMessage(int32_t &errorCode); } // namespace NetStackAni } // namespace OHOS diff --git a/frameworks/ets/ani/net_ssl/src/cxx/network_security_ani.cpp b/frameworks/ets/ani/net_ssl/src/cxx/network_security_ani.cpp index 3dcea585e3d541340dcc2ad0443203e4c3ce9384..d6217ec6dfa783af4208d2a20d62f2fda2c0574d 100644 --- a/frameworks/ets/ani/net_ssl/src/cxx/network_security_ani.cpp +++ b/frameworks/ets/ani/net_ssl/src/cxx/network_security_ani.cpp @@ -17,10 +17,63 @@ #include "net_ssl.h" #include "wrapper.rs.h" +#include "net_ssl_verify_cert.h" namespace OHOS { namespace NetStackAni { +static const std::map SSL_ERR_MAP = { + {NetStack::Ssl::SslErrorCode::SSL_NONE_ERR, "Verify success."}, + {NetStack::Ssl::SslErrorCode::SSL_X509_V_ERR_UNSPECIFIED, "Unspecified error."}, + {NetStack::Ssl::SslErrorCode::SSL_X509_V_ERR_UNABLE_TO_GET_ISSUER_CERT, + "Unable to get issuer certificate."}, + {NetStack::Ssl::SslErrorCode::SSL_X509_V_ERR_UNABLE_TO_GET_CRL, + "Unable to get certificate revocation list (CRL)."}, + {NetStack::Ssl::SslErrorCode::SSL_X509_V_ERR_UNABLE_TO_DECRYPT_CERT_SIGNATURE, + "Unable to decrypt certificate signature."}, + {NetStack::Ssl::SslErrorCode::SSL_X509_V_ERR_UNABLE_TO_DECRYPT_CRL_SIGNATURE, + "Unable to decrypt CRL signature."}, + {NetStack::Ssl::SslErrorCode::SSL_X509_V_ERR_UNABLE_TO_DECODE_ISSUER_PUBLIC_KEY, + "Unable to decode issuer public key."}, + {NetStack::Ssl::SslErrorCode::SSL_X509_V_ERR_CERT_SIGNATURE_FAILURE, "Certificate signature failure."}, + {NetStack::Ssl::SslErrorCode::SSL_X509_V_ERR_CRL_SIGNATURE_FAILURE, "CRL signature failure."}, + {NetStack::Ssl::SslErrorCode::SSL_X509_V_ERR_CERT_NOT_YET_VALID, "Certificate is not yet valid."}, + {NetStack::Ssl::SslErrorCode::SSL_X509_V_ERR_CERT_HAS_EXPIRED, "Certificate has expired."}, + {NetStack::Ssl::SslErrorCode::SSL_X509_V_ERR_CRL_NOT_YET_VALID, "CRL is not yet valid."}, + {NetStack::Ssl::SslErrorCode::SSL_X509_V_ERR_CRL_HAS_EXPIRED, "CRL has expired."}, + {NetStack::Ssl::SslErrorCode::SSL_X509_V_ERR_CERT_REVOKED, "Certificate has been revoked."}, + {NetStack::Ssl::SslErrorCode::SSL_X509_V_ERR_INVALID_CA, "Invalid certificate authority (CA)."}, + {NetStack::Ssl::SslErrorCode::SSL_X509_V_ERR_CERT_UNTRUSTED, "Certificate is untrusted."}, + {NetStack::Ssl::SslErrorCode::SSL_X509_V_ERR_DEPTH_ZERO_SELF_SIGNED_CERT, "self-signed certificate."}, + {NetStack::Ssl::SslErrorCode::SSL_X509_V_ERR_INVALID_CALL, "invalid certificate verification context."} +}; + +static std::string GetErrorMessage(int32_t errorCode) +{ + auto pos = SSL_ERR_MAP.find(errorCode); + if (pos != SSL_ERR_MAP.end()) { + return pos->second; + } + return SSL_ERR_MAP.at(NetStack::Ssl::SslErrorCode::SSL_X509_V_ERR_CERT_UNTRUSTED); +} + +static int32_t GetErrorCode(int32_t errorCode) +{ + const auto &errorCodeSet = NetStack::Ssl::SslErrorCodeSetSinceAPI12; + + if (errorCodeSet.find(errorCode) == errorCodeSet.end()) { + errorCode = NetStack::Ssl::SSL_X509_V_ERR_UNSPECIFIED; + } + return errorCode; +} + +rust::String GetErrorCodeAndMessage(int32_t &errorCode) +{ + int originCode = errorCode; + errorCode = GetErrorCode(originCode); + return rust::string(GetErrorMessage(originCode)); +} + uint32_t NetStackVerifyCertificationCa(const CertBlob &cert, const CertBlob &caCert) { std::string a; diff --git a/frameworks/ets/ani/net_ssl/src/lib.rs b/frameworks/ets/ani/net_ssl/src/lib.rs index 82ef4a53e839881e7a7df247d20ac307a1809dc1..095fcf4ae3b728b81a7a7aa8571ede7555926861 100644 --- a/frameworks/ets/ani/net_ssl/src/lib.rs +++ b/frameworks/ets/ani/net_ssl/src/lib.rs @@ -20,6 +20,7 @@ ani_rs::ani_constructor! { [ "isCleartextPermitted" : security::is_cleartext_permitted , "isCleartextPermittedByHostName" : security::is_cleartext_permitted_by_host_name , - "certVerificationSync" : security::cert_verification + "certVerificationAsync" : security::cert_verification_async, + "certVerificationSync" : security::cert_verification_sync ] } diff --git a/frameworks/ets/ani/net_ssl/src/security.rs b/frameworks/ets/ani/net_ssl/src/security.rs index 970bcfc90e7cc98c67854f5d99ebbae0ff8a0a05..4fa9cfbc09007d6f0b6ffed5f0381917d231ed20 100644 --- a/frameworks/ets/ani/net_ssl/src/security.rs +++ b/frameworks/ets/ani/net_ssl/src/security.rs @@ -13,7 +13,10 @@ use ani_rs::business_error::BusinessError; -use crate::{bridge::CertBlob, wrapper::NetworkSecurityClient}; +use crate::{ + bridge::CertBlob, + wrapper::{convert_to_business_error, NetworkSecurityClient}, +}; #[ani_rs::native] pub fn is_cleartext_permitted() -> Result { @@ -40,6 +43,24 @@ pub fn is_cleartext_permitted_by_host_name(host_name: String) -> Result) -> Result { - Ok(NetworkSecurityClient::cert_verification(cert, ca_cert)) +pub fn cert_verification_async( + cert: CertBlob, + ca_cert: Option, +) -> Result { + let mut res = NetworkSecurityClient::cert_verification(cert, ca_cert); + if res == 0 { + Ok(res) + } else { + Err(convert_to_business_error(&mut res)) + } +} + +#[ani_rs::native] +pub fn cert_verification_sync( + cert: CertBlob, + ca_cert: Option, +) -> Result { + let mut res = NetworkSecurityClient::cert_verification(cert, ca_cert); + let _ = convert_to_business_error(&mut res); + Ok(res) } diff --git a/frameworks/ets/ani/net_ssl/src/wrapper.rs b/frameworks/ets/ani/net_ssl/src/wrapper.rs index 65449708a62b6ad27d8131a4f7a8fdf4d69268dd..259ddefed308452a2aff3de612fd707bbc32ac1f 100644 --- a/frameworks/ets/ani/net_ssl/src/wrapper.rs +++ b/frameworks/ets/ani/net_ssl/src/wrapper.rs @@ -11,6 +11,7 @@ // See the License for the specific language governing permissions and // limitations under the License. +use ani_rs::business_error::BusinessError; use cxx::let_cxx_string; use crate::bridge::{self, CertBlob}; @@ -97,5 +98,12 @@ mod ffi { fn NetStackVerifyCertification(cert: &CertBlob) -> u32; + fn GetErrorCodeAndMessage(error_code: &mut i32) -> String; + } } + +pub fn convert_to_business_error(code: &mut i32) -> BusinessError { + let error_msg = crate::wrapper::ffi::GetErrorCodeAndMessage(code); + BusinessError::new(*code, error_msg) +}