From e62a4b02e5f74a45beb3f26f57cf44c0389364aa Mon Sep 17 00:00:00 2001 From: Sergey Kazmin <43613813+yerseg@users.noreply.github.com> Date: Tue, 4 Apr 2023 17:12:15 +0300 Subject: [PATCH] fix (#1525) Co-authored-by: Sergey Kazmin --- CMakeLists.txt | 10 +++++++++- httplib.h | 10 +++++----- meson.build | 6 +++++- meson_options.txt | 1 + test/Makefile | 2 +- 5 files changed, 21 insertions(+), 8 deletions(-) diff --git a/CMakeLists.txt b/CMakeLists.txt index c98daf5edc..668abb7d22 100644 --- a/CMakeLists.txt +++ b/CMakeLists.txt @@ -6,6 +6,7 @@ * HTTPLIB_REQUIRE_OPENSSL (default off) * HTTPLIB_REQUIRE_ZLIB (default off) * HTTPLIB_USE_BROTLI_IF_AVAILABLE (default on) + * HTTPLIB_USE_CERTS_FROM_MACOSX_KEYCHAIN (default on) * HTTPLIB_REQUIRE_BROTLI (default off) * HTTPLIB_COMPILE (default off) * HTTPLIB_TEST (default off) @@ -43,6 +44,7 @@ * HTTPLIB_IS_USING_OPENSSL - a bool for if OpenSSL support is enabled. * HTTPLIB_IS_USING_ZLIB - a bool for if ZLIB support is enabled. * HTTPLIB_IS_USING_BROTLI - a bool for if Brotli support is enabled. + * HTTPLIB_IS_USING_CERTS_FROM_MACOSX_KEYCHAIN - a bool for if support of loading system certs from the Apple Keychain is enabled. * HTTPLIB_IS_COMPILED - a bool for if the library is compiled, or otherwise header-only. * HTTPLIB_INCLUDE_DIR - the root path to httplib's header (e.g. /usr/include). * HTTPLIB_LIBRARY - the full path to the library if compiled (e.g. /usr/lib/libhttplib.so). @@ -92,6 +94,7 @@ endif() option(HTTPLIB_TEST "Enables testing and builds tests" OFF) option(HTTPLIB_REQUIRE_BROTLI "Requires Brotli to be found & linked, or fails build." OFF) option(HTTPLIB_USE_BROTLI_IF_AVAILABLE "Uses Brotli (if available) to enable Brotli decompression support." ON) +option(HTTPLIB_USE_CERTS_FROM_MACOSX_KEYCHAIN "Enable feature to load system certs from the Apple Keychain." ON) # Defaults to static library option(BUILD_SHARED_LIBS "Build the library as a shared library instead of static. Has no effect if using header-only." OFF) if (BUILD_SHARED_LIBS AND WIN32 AND HTTPLIB_COMPILE) @@ -137,6 +140,10 @@ if(Brotli_FOUND) set(HTTPLIB_IS_USING_BROTLI TRUE) endif() +if(HTTPLIB_USE_CERTS_FROM_MACOSX_KEYCHAIN) + set(HTTPLIB_IS_USING_CERTS_FROM_MACOSX_KEYCHAIN TRUE) +endif() + # Used for default, common dirs that the end-user can change (if needed) # like CMAKE_INSTALL_INCLUDEDIR or CMAKE_INSTALL_DATADIR include(GNUInstallDirs) @@ -207,7 +214,7 @@ target_link_libraries(${PROJECT_NAME} ${_INTERFACE_OR_PUBLIC} $<$:crypt32> $<$:cryptui> # Needed for API from MacOS Security framework - "$<$,$>:-framework CoreFoundation -framework Security>" + "$<$,$, $>:-framework CoreFoundation -framework Security>" # Can't put multiple targets in a single generator expression or it bugs out. $<$:Brotli::common> $<$:Brotli::encoder> @@ -222,6 +229,7 @@ target_compile_definitions(${PROJECT_NAME} ${_INTERFACE_OR_PUBLIC} $<$:CPPHTTPLIB_BROTLI_SUPPORT> $<$:CPPHTTPLIB_ZLIB_SUPPORT> $<$:CPPHTTPLIB_OPENSSL_SUPPORT> + $<$,$, $>:CPPHTTPLIB_USE_CERTS_FROM_MACOSX_KEYCHAIN> ) # CMake configuration files installation directory diff --git a/httplib.h b/httplib.h index d7c808c053..6da0a7299a 100644 --- a/httplib.h +++ b/httplib.h @@ -239,7 +239,7 @@ using socket_t = int; #pragma comment(lib, "crypt32.lib") #pragma comment(lib, "cryptui.lib") #endif -#elif defined(__APPLE__) +#elif defined(CPPHTTPLIB_USE_CERTS_FROM_MACOSX_KEYCHAIN) && defined(__APPLE__) #include #if TARGET_OS_OSX #include @@ -2668,7 +2668,7 @@ socket_t create_socket(const std::string &host, const std::string &ip, int port, auto sock = socket(hints.ai_family, hints.ai_socktype, hints.ai_protocol); if (sock != INVALID_SOCKET) { - sockaddr_un addr {}; + sockaddr_un addr{}; addr.sun_family = AF_UNIX; std::copy(host.begin(), host.end(), addr.sun_path); @@ -4513,7 +4513,7 @@ inline bool load_system_certs_on_windows(X509_STORE *store) { return result; } -#elif defined(__APPLE__) +#elif defined(CPPHTTPLIB_USE_CERTS_FROM_MACOSX_KEYCHAIN) && defined(__APPLE__) #if TARGET_OS_OSX template using CFObjectPtr = @@ -8064,9 +8064,9 @@ inline bool SSLClient::load_certs() { #ifdef _WIN32 loaded = detail::load_system_certs_on_windows(SSL_CTX_get_cert_store(ctx_)); -#elif defined(__APPLE__) +#elif defined(CPPHTTPLIB_USE_CERTS_FROM_MACOSX_KEYCHAIN) && defined(__APPLE__) #if TARGET_OS_OSX - loaded = detail::load_system_certs_on_macos(SSL_CTX_get_cert_store(ctx_)); + loaded = detail::load_system_certs_on_macos(SSL_CTX_get_cert_store(ctx_)); #endif // TARGET_OS_OSX #endif // _WIN32 if (!loaded) { SSL_CTX_set_default_verify_paths(ctx_); } diff --git a/meson.build b/meson.build index cc81eb1166..16362ad29a 100644 --- a/meson.build +++ b/meson.build @@ -35,7 +35,11 @@ if openssl_dep.found() deps += openssl_dep args += '-DCPPHTTPLIB_OPENSSL_SUPPORT' if host_machine.system() == 'darwin' - deps += dependency('appleframeworks', modules: ['CoreFoundation', 'Security']) + macosx_keychain_dep = dependency('appleframeworks', modules: ['CoreFoundation', 'Security'], required: get_option('cpp-httplib_macosx_keychain')) + if macosx_keychain_dep.found() + deps += macosx_keychain_dep + args += '-DCPPHTTPLIB_USE_CERTS_FROM_MACOSX_KEYCHAIN' + endif endif endif diff --git a/meson_options.txt b/meson_options.txt index d37c40db48..e15847d42f 100644 --- a/meson_options.txt +++ b/meson_options.txt @@ -5,5 +5,6 @@ option('cpp-httplib_openssl', type: 'feature', value: 'auto', description: 'Enable OpenSSL support') option('cpp-httplib_zlib', type: 'feature', value: 'auto', description: 'Enable zlib support') option('cpp-httplib_brotli', type: 'feature', value: 'auto', description: 'Enable Brotli support') +option('cpp-httplib_macosx_keychain', type: 'feature', value: 'auto', description: 'Enable loading certs from the Keychain on Apple devices') option('cpp-httplib_compile', type: 'boolean', value: false, description: 'Split the header into a compilable header & source file (requires python3)') option('cpp-httplib_test', type: 'boolean', value: false, description: 'Build tests') diff --git a/test/Makefile b/test/Makefile index cb7605c59c..9feae74c65 100644 --- a/test/Makefile +++ b/test/Makefile @@ -11,7 +11,7 @@ OPENSSL_SUPPORT = -DCPPHTTPLIB_OPENSSL_SUPPORT -I$(OPENSSL_DIR)/include -L$(OPEN ifneq ($(OS), Windows_NT) UNAME_S := $(shell uname -s) ifeq ($(UNAME_S), Darwin) - OPENSSL_SUPPORT += -framework CoreFoundation -framework Security + OPENSSL_SUPPORT += -DCPPHTTPLIB_USE_CERTS_FROM_MACOSX_KEYCHAIN -framework CoreFoundation -framework Security endif endif