Changeset 5957

Timestamp:

Mar 25, 2019 1:33:12 AM (5 years ago)

Author:

ming

Message:

Fixed #2185: Darwin (Mac OS & iOS) native SSL backend

Location:

pjproject/trunk

Files:

• aconfigure (modified) (3 diffs)
• aconfigure.ac (modified) (3 diffs)
• pjlib/build/Makefile (modified) (1 diff)
• pjlib/build/cacert.der (added)
• pjlib/build/privkey.p12 (added)
• pjlib/src/pj/ssl_sock_darwin.c (added)
• pjlib/src/pjlib-test/ssl_sock.c (modified) (2 diffs)

pjproject/trunk/aconfigure

@@ -1543 +1543 @@
   --with-ipp-arch=ARCH    Specify the Intel IPP ARCH suffix, e.g. "64" or
                           "em64t. Default is blank for IA32"
-  --with-ssl=DIR          Specify alternate SSL library prefix. This option
+  --with-ssl=SSL_BACKEND/DIR
+                          Specify alternate SSL library prefix or SSL
+                          native-backend. You can specify "darwin" as the
+                          native iOS/MacOS backend using Security framework,
+                          or you can specify an alternate SSL library prefix
+                          directory. If a directory is specified, this option
                           will try to find OpenSSL first, then if not found,
                           GnuTLS. To skip OpenSSL finding, use --with-gnutls
@@ -7952 +7957 @@
 else
 
-                if test "x$with_ssl" != "xno" -a "x$with_ssl" != "x"; then
+                if test "x$with_ssl" = "xdarwin"; then
+                    SAVED_LIBS="$LIBS"
+                    LIBS="-framework Security"
+                    cat confdefs.h - <<_ACEOF >conftest.$ac_ext
+/* end confdefs.h.  */
+
+int
+main ()
+{
+
+  ;
+  return 0;
+}
+_ACEOF
+if ac_fn_c_try_link "$LINENO"; then :
+  ac_ssl_backend=darwin
+fi
+rm -f core conftest.err conftest.$ac_objext \
+    conftest$ac_exeext conftest.$ac_ext
+                    LIBS="$SAVED_LIBS"
+                    if test "x$ac_ssl_backend" = "xdarwin"; then
+                        $as_echo "#define PJ_HAS_SSL_SOCK 1" >>confdefs.h
+
+                        $as_echo "#define PJ_SSL_SOCK_IMP PJ_SSL_SOCK_IMP_DARWIN" >>confdefs.h
+
+                        LIBS="$LIBS -framework Security"
+                        ac_ssl_backend="darwin"
+                        { $as_echo "$as_me:${as_lineno-$LINENO}: result: Checking if Security framework for Darwin SSL is available... yes" >&5
+$as_echo "Checking if Security framework for Darwin SSL is available... yes" >&6; }
+                    else
+                        { $as_echo "$as_me:${as_lineno-$LINENO}: result: Checking if Security framework for Darwin SSL is available... no" >&5
+$as_echo "Checking if Security framework for Darwin SSL is available... no" >&6; }
+                    fi
+                fi
+
+                if test "x$ac_ssl_backend" = "x" -a "x$with_ssl" != "xno" -a "x$with_ssl" != "x"; then
                     CFLAGS="$CFLAGS -I$with_ssl/include"
                     CPPFLAGS="$CPPFLAGS -I$with_ssl/include"
@@ -7960 +8000 @@
                 fi
 
-                if test "x$with_gnutls" = "xno"; then
+                if test "x$ac_ssl_backend" = "x" -a "x$with_gnutls" = "xno"; then
 
                     { $as_echo "$as_me:${as_lineno-$LINENO}: result: checking for OpenSSL installations.." >&5

pjproject/trunk/aconfigure.ac

@@ -1542 +1542 @@
 dnl # SSL alt prefix
 AC_ARG_WITH(ssl,
-    AS_HELP_STRING([--with-ssl=DIR],
-                   [Specify alternate SSL library prefix. This option will try
-                    to find OpenSSL first, then if not found, GnuTLS. To skip
-                    OpenSSL finding, use --with-gnutls option instead.]),
+    AS_HELP_STRING([--with-ssl=SSL_BACKEND/DIR],
+                   [Specify alternate SSL library prefix or SSL native-backend.
+                    You can specify "darwin" as the native iOS/MacOS backend
+                    using Security framework, or you can specify an alternate
+                    SSL library prefix directory. If a directory
+                    is specified, this option will try to find OpenSSL first,
+                    then if not found, GnuTLS. To skip OpenSSL finding, use
+                    --with-gnutls option instead.]),
     [],
     [with_ssl=no]
@@ -1578 +1582 @@
               ],
               [
-                if test "x$with_ssl" != "xno" -a "x$with_ssl" != "x"; then
+                if test "x$with_ssl" = "xdarwin"; then
+                    SAVED_LIBS="$LIBS"
+                    LIBS="-framework Security"
+                    AC_LINK_IFELSE([AC_LANG_PROGRAM([[]], [])],
+                                   [ac_ssl_backend=darwin],)
+                    LIBS="$SAVED_LIBS"
+                    if test "x$ac_ssl_backend" = "xdarwin"; then
+                        AC_DEFINE(PJ_HAS_SSL_SOCK, 1)
+                        AC_DEFINE(PJ_SSL_SOCK_IMP, PJ_SSL_SOCK_IMP_DARWIN)
+                        LIBS="$LIBS -framework Security"
+                        ac_ssl_backend="darwin"
+                        AC_MSG_RESULT([Checking if Security framework for Darwin SSL is available... yes])
+                    else
+                        AC_MSG_RESULT([Checking if Security framework for Darwin SSL is available... no])
+                    fi
+                fi
+                
+                if test "x$ac_ssl_backend" = "x" -a "x$with_ssl" != "xno" -a "x$with_ssl" != "x"; then
                     CFLAGS="$CFLAGS -I$with_ssl/include"
                     CPPFLAGS="$CPPFLAGS -I$with_ssl/include"
@@ -1585 +1606 @@
                 fi
 
-                if test "x$with_gnutls" = "xno"; then
+                if test "x$ac_ssl_backend" = "x" -a "x$with_gnutls" = "xno"; then
 
                     AC_MSG_RESULT([checking for OpenSSL installations..])

pjproject/trunk/pjlib/build/Makefile

@@ -37 +37 @@
         rbtree.o sock_common.o sock_qos_common.o \
         ssl_sock_common.o ssl_sock_ossl.o ssl_sock_gtls.o ssl_sock_dump.o \
-        string.o timer.o types.o
+        ssl_sock_darwin.o string.o timer.o types.o
 export PJLIB_CFLAGS += $(_CFLAGS)
 export PJLIB_CXXFLAGS += $(_CXXFLAGS)

pjproject/trunk/pjlib/src/pjlib-test/ssl_sock.c

@@ -23 +23 @@
 
 #define CERT_DIR                    "../build/"
-#define CERT_CA_FILE                CERT_DIR "cacert.pem"
+#if (PJ_SSL_SOCK_IMP == PJ_SSL_SOCK_IMP_DARWIN)
+/* If we use Darwin SSL, use the cert in DER format. */
+#   define CERT_CA_FILE             CERT_DIR "cacert.der"
+#else
+#   define CERT_CA_FILE             CERT_DIR "cacert.pem"
+#endif
 #define CERT_FILE                   CERT_DIR "cacert.pem"
 #define CERT_PRIVKEY_FILE           CERT_DIR "privkey.pem"
@@ -888 +893 @@
         pj_str_t privkey_pass = pj_str(CERT_PRIVKEY_PASS);
 
+#if (PJ_SSL_SOCK_IMP == PJ_SSL_SOCK_IMP_DARWIN)
+        PJ_LOG(3, ("", "Darwin SSL requires the private key to be "
+                       "inside the Keychain. So double click on "
+                       "the file pjlib/build/privkey.p12 to "
+                       "place it in the Keychain. "
+                       "The password is \"pjsip\"."));
+#endif
+
 #if (defined(TEST_LOAD_FROM_FILES) && TEST_LOAD_FROM_FILES==1)
         status = pj_ssl_cert_load_from_files(pool, &ca_file, &cert_file,