[unitytls] User facing certificate callbacks contain now certificates from system store

Author: AndreasReich

mcs/class/System/Mono.UnityTls/UnityTlsProvider.cs

@@ -41,6 +41,13 @@ internal override MNS.MobileAuthenticatedStream CreateSslStream (
 			return new UnityTlsStream (innerStream, leaveInnerStreamOpen, sslStream, settings, this);
 		}
 
+		static UnityTls.unitytls_x509verify_result x509verify_callback(void* userData, UnityTls.unitytls_x509_ref cert, UnityTls.unitytls_x509verify_result result, UnityTls.unitytls_errorstate* errorState)
+		{
+			if (userData != null)
+				UnityTls.NativeInterface.unitytls_x509list_append ((UnityTls.unitytls_x509list*)userData, cert, errorState);
+			return result;
+		}
+
 		internal override bool ValidateCertificate (
 			MNS.ChainValidationHelper validator, string targetHost, bool serverMode,
 			X509CertificateCollection certificates, bool wantsChain, ref X509Chain chain,
@@ -82,6 +89,8 @@ internal override bool ValidateCertificate (
 			// convert cert to native or extract from unityTlsChainImpl.
 			var result = UnityTls.unitytls_x509verify_result.UNITYTLS_X509VERIFY_NOT_DONE;
 			UnityTls.unitytls_x509list* certificatesNative = null;
+			UnityTls.unitytls_x509list* finalCertificateChainNative = 
+				chain == null ? null : UnityTls.NativeInterface.unitytls_x509list_create (&errorState);
 			try
 			{
 				// Things the validator provides that we might want to make use of here:
@@ -111,22 +120,36 @@ internal override bool ValidateCertificate (
 						var trustCAnativeRef = UnityTls.NativeInterface.unitytls_x509list_get_ref (trustCAnative, &errorState);
 
 						fixed (byte* targetHostUtf8Ptr = targetHostUtf8) {
-							result = UnityTls.NativeInterface.unitytls_x509verify_explicit_ca (certificatesNativeRef, trustCAnativeRef, targetHostUtf8Ptr, (size_t)targetHostUtf8.Length, null, null, &errorState);
+							result = UnityTls.NativeInterface.unitytls_x509verify_explicit_ca (
+								certificatesNativeRef, trustCAnativeRef, targetHostUtf8Ptr, (size_t)targetHostUtf8.Length, x509verify_callback, finalCertificateChainNative, &errorState);
 						}
 					}
 					finally {
 						UnityTls.NativeInterface.unitytls_x509list_free (trustCAnative);
 					}
 				} else {
 					fixed (byte* targetHostUtf8Ptr = targetHostUtf8) {
-						result = UnityTls.NativeInterface.unitytls_x509verify_default_ca (certificatesNativeRef, targetHostUtf8Ptr, (size_t)targetHostUtf8.Length, null, null, &errorState);
+						result = UnityTls.NativeInterface.unitytls_x509verify_default_ca (
+							certificatesNativeRef, targetHostUtf8Ptr, (size_t)targetHostUtf8.Length, x509verify_callback, finalCertificateChainNative, &errorState);
 					}
 				}
 			}
+			catch {
+				UnityTls.NativeInterface.unitytls_x509list_free (finalCertificateChainNative);
+				throw;
+			}
 			finally	{
 				UnityTls.NativeInterface.unitytls_x509list_free (certificatesNative);
 			}
 
+			if (finalCertificateChainNative != null) {
+				chain?.Dispose();
+				chain = new X509Chain(new X509ChainImplUnityTls(
+					UnityTls.NativeInterface.unitytls_x509list_get_ref (finalCertificateChainNative, &errorState),
+					reverseOrder: true // the verify callback starts with the root and ends with the leaf. That's the opposite of chain ordering.
+				));
+			}
+
 			errors = UnityTlsConversions.VerifyResultToPolicyErrror(result);
 			// There should be a status per certificate, but once again we're following closely the BTLS implementation
 			// https://github.com/mono/mono/blob/1553889bc54f87060158febca7e6b8b9910975f8/mcs/class/System/Mono.Btls/MonoBtlsProvider.cs#L180

mcs/class/System/Mono.UnityTls/X509ChainImplUnityTls.cs

@@ -17,11 +17,13 @@ class X509ChainImplUnityTls : X509ChainImpl
 		private UnityTls.unitytls_x509list_ref nativeCertificateChain;
 		private X509ChainPolicy policy = new X509ChainPolicy ();
 		private List<X509ChainStatus> chainStatusList;
+		private bool reverseOrder;
 
-		internal X509ChainImplUnityTls (UnityTls.unitytls_x509list_ref nativeCertificateChain)
+		internal X509ChainImplUnityTls (UnityTls.unitytls_x509list_ref nativeCertificateChain, bool reverseOrder = false)
 		{
 			this.elements = null;
 			this.nativeCertificateChain = nativeCertificateChain;
+			this.reverseOrder = reverseOrder;
 		}
 
 		public override bool IsValid {
@@ -57,6 +59,13 @@ public override X509ChainElementCollection ChainElements {
 					}
 				}
 
+				if (reverseOrder) {
+					var reversed = new X509ChainElementCollection ();
+					for (int i=elements.Count - 1; i>=0; --i)
+						reversed.Add(elements[i].Certificate);
+					elements = reversed;
+				}
+
 				return elements;
 			}
 		}