crypto/x509: possible crash on macOS 10.13 (in SecTrustEvaluateWithError)
#52112
Labels
FrozenDueToAge
WaitingForInfo
Issue is not actionable because of missing required information, which needs to be provided.
Comments
|
I started on a patch to fallback to diff --git a/src/crypto/x509/internal/macos/security.go b/src/crypto/x509/internal/macos/security.go
index ef64bda49f..0523c77ab8 100644
--- a/src/crypto/x509/internal/macos/security.go
+++ b/src/crypto/x509/internal/macos/security.go
@@ -75,6 +75,7 @@ var SecPolicyOid = StringToCFString("SecPolicyOid")
var SecPolicyAppleSSL = StringToCFString("1.2.840.113635.100.1.3") // defined by POLICYMACRO
var ErrNoTrustSettings = errors.New("no trust settings found")
+var ErrAPIUnavailable = errors.New("api not available")
const errSecNoTrustSettings = -25263
@@ -165,13 +166,13 @@ func x509_SecTrustSetVerifyDate_trampoline()
//go:cgo_import_dynamic x509_SecTrustEvaluate SecTrustEvaluate "/System/Library/Frameworks/Security.framework/Versions/A/Security"
-func SecTrustEvaluate(trustObj CFRef) (CFRef, error) {
- var result CFRef
+func SecTrustEvaluate(trustObj CFRef) (SecTrustResultType, error) {
+ var result SecTrustResultType = SecTrustResultInvalid
ret := syscall(abi.FuncPCABI0(x509_SecTrustEvaluate_trampoline), uintptr(trustObj), uintptr(unsafe.Pointer(&result)), 0, 0, 0, 0)
if int32(ret) != 0 {
return 0, OSStatus{"SecTrustEvaluate", int32(ret)}
}
- return CFRef(result), nil
+ return result, nil
}
func x509_SecTrustEvaluate_trampoline()
@@ -191,6 +192,9 @@ func x509_SecTrustGetResult_trampoline()
//go:cgo_import_dynamic x509_SecTrustEvaluateWithError SecTrustEvaluateWithError "/System/Library/Frameworks/Security.framework/Versions/A/Security"
func SecTrustEvaluateWithError(trustObj CFRef) error {
+ if true /* xxx: detect macOS 10.14+ */ {
+ return ErrAPIUnavailable
+ }
var errRef CFRef
ret := syscall(abi.FuncPCABI0(x509_SecTrustEvaluateWithError_trampoline), uintptr(trustObj), uintptr(unsafe.Pointer(&errRef)), 0, 0, 0, 0)
if int32(ret) != 1 {
diff --git a/src/crypto/x509/root_darwin.go b/src/crypto/x509/root_darwin.go
index 1ef9c0f71e..7168c28cf0 100644
--- a/src/crypto/x509/root_darwin.go
+++ b/src/crypto/x509/root_darwin.go
@@ -50,7 +50,14 @@ func (c *Certificate) systemVerify(opts *VerifyOptions) (chains [][]*Certificate
// using TLS or OCSP for that.
if err := macOS.SecTrustEvaluateWithError(trustObj); err != nil {
- return nil, err
+ if err != macOS.ErrAPIUnavailable {
+ return nil, err
+ }
+ if result, err := macOS.SecTrustEvaluate(trustObj); err != nil {
+ return nil, err
+ } else if result != macOS.SecTrustResultProceed && result != macOS.SecTrustResultUnspecified {
+ return nil, errors.New("verification failed")
+ }
}
chain := [][]*Certificate{{}} |
cherrymui
added
the
WaitingForInfo
|
Could you (or find someone) confirm if this fails on macOS 10.13? Thanks. |
|
I guess the docs are wrong. |
|
So it sounds like the program should work without failure? If so, we can close the issue. Thanks. |
|
Thanks. I am maintaining a fork of golang that adds back support for older macOS versions. If anyone has advice on how best to detect the availability of this function, or simply to detect macOS version inside golang, I would appreciate it. EDIT: for posterity fancybits/go@6432f14...989d1b1 |
Sign up for free
to subscribe to this conversation on GitHub.
Already have an account?
Sign in.
What version of Go are you using (
go version)?Does this issue reproduce with the latest release?
Yes.
What operating system and processor architecture are you using (
go env)?Tested on macOS 10.11 (which I know is not supported).
But I believe it will also trigger on macOS 10.13, but it would be helpful if someone could confirm one way or the other.
What did you do?
Make a https request
What did you see instead?
This seems to be related to CL353132 (feb024f, #46287) which added calls to
SecTrustEvaluateWithErrorAccording to https://developer.apple.com/documentation/security/2980705-sectrustevaluatewitherror,
SecTrustEvaluateWithErroris only available inmacOS 10.14+cc #23011
The text was updated successfully, but these errors were encountered: