1berry/qtbase
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

SecureTransport: use memory-only PKCS12 import on macOS >= 15

Browse Source 
Our workaround with a temporary keychain is not working anymore.
Startring from macOS 15 Security framework supports a new option:
kSecImportToMemoryOnly. Setting it to kCFBooleanTrue allows us to
import PCKS12 without accessing 'login' keychain and thus avoiding
blocking system-alerts requesting keychain access.

Pick-to: 6.8
Fixes: QTBUG-128579
Change-Id: Ic86460b05dbee07194b146cefc45df6a478946b1
Reviewed-by: Tor Arne Vestbø <tor.arne.vestbo@qt.io>
This commit is contained in:
Timur Pocheptsov 2024-09-23 14:50:22 +02:00
parent 5d028371bd
commit 15817e7d29
1 changed files with 24 additions and 9 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

33
src/plugins/tls/securetransport/qtls_st.cpp
View File

@ -817,17 +817,32 @@ bool TlsCryptographSecureTransport::setSessionCertificate(QString &errorDescript
const void *values[2] = { password };
CFIndex nKeys = 1;
#ifdef Q_OS_MACOS
bool envOk = false;
const int env = qEnvironmentVariableIntValue("QT_SSL_USE_TEMPORARY_KEYCHAIN", &envOk);
if (envOk && env) {
static const EphemeralSecKeychain temporaryKeychain;
if (temporaryKeychain.keychain) {
nKeys = 2;
keys[1] = kSecImportExportKeychain;
values[1] = temporaryKeychain.keychain;
#if QT_MACOS_IOS_PLATFORM_SDK_EQUAL_OR_ABOVE(150000, 180000)
// Starting from macOS 15 our temporary keychain is ignored.
// We have to use kSecImportToMemoryOnly/kCFBooleanTrue key/value
// instead. This key is "memory" but looks like Security framework
// does not compare strings, but pointers instead, so we need an actual
// key/constant.
if (__builtin_available(macOS 15, *)) {
nKeys = 2;
keys[1] = kSecImportToMemoryOnly;
values[1] = kCFBooleanTrue;
} else {
#else
{
#endif
bool envOk = false;
const int env = qEnvironmentVariableIntValue("QT_SSL_USE_TEMPORARY_KEYCHAIN", &envOk);
if (envOk && env) {
static const EphemeralSecKeychain temporaryKeychain;
if (temporaryKeychain.keychain) {
nKeys = 2;
keys[1] = kSecImportExportKeychain;
values[1] = temporaryKeychain.keychain;
}
}
}
#endif
#endif // Q_OS_MACOS
QCFType<CFDictionaryRef> options = CFDictionaryCreate(nullptr, keys, values, nKeys,
nullptr, nullptr);
QCFType<CFArrayRef> items;