Add API to install trusted CA certs in the open source build - #427
Open
ResakaGit wants to merge 1 commit into
Open
Add API to install trusted CA certs in the open source build#427ResakaGit wants to merge 1 commit into
ResakaGit wants to merge 1 commit into
Conversation
In the open source build there was no way to install a root of trust: CertStore_AddCertFromBase64 had no callers, the cert store only ever contained the hardcoded Valve root CA key, and with that key defined, dynamically added self-signed certs were always rejected. So the verification path could never succeed for certs issued by anybody else, and manually-issued certs (issue ValveSoftware#237) were unusable. Add GameNetworkingSockets_AddTrustedCert, which accepts a PEM-like blob or the raw base64 body of one, and installs a cert in the trust store. Certs installed this way are marked as explicitly trusted by the app and may act as self-signed trusted roots, coexisting with the hardcoded root CA key, which remains trusted. Certs that arrive any other way are rejected exactly as before, so the hardcoded-root invariant is unchanged for certs the app didn't vouch for. The same function installs intermediate certs. (The wire format doesn't carry the chain, so the verifying side needs the whole chain in its store.) Also add GameNetworkingSockets_SetAppID. Certificates are authorized for particular app IDs and both ends check certs against their own app ID, but in the open source build there was no way to set it, so it was always 0 and those checks could never pass. Resurrect test_pki, which was added in 0da061c but never hooked up to the build. Its checked-in certs were signed by a root key that does not match the current hardcoded key, so the corpus could not be revived; the test now generates its PKI at runtime instead, which also removes the frozen timestamps. Hook it up to CI on all platforms. This is the first part of issue ValveSoftware#237. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
In the open source build there is no way to install a root of trust: CertStore_AddCertFromBase64 has no callers, the cert store only ever contains the hardcoded Valve root CA key, and with that key defined, dynamically added self-signed certs are always rejected. So certificate verification can never succeed for certs issued by anybody else, and manually-issued certs (#237) are unusable end to end, no matter what the certtool produces.
This adds two global functions to the open source API surface (no changes to the frozen interfaces, the config enum, or the wire format):
It also resurrects test_pki, which was added in 0da061c but never hooked up to the build. The checked-in certs were signed by a root key that does not match the current hardcoded key, so the old corpus could not be revived; the test now generates its PKI at runtime (self-signed root, intermediates, chain intersection, revocation, and the new app-trust provenance behavior, both positive and negative), and is wired into CI on all platforms. Verified locally on Windows (MSVC 2022): test_pki and test_connection suite-quick both pass.
This is the first part of #237, following the plan outlined there in 2022: certtool support for specifying the cert identity and for emitting the private key alongside the cert (which SetCertificate already accepts, closing #384) would come as a follow-up PR. I posted a few design questions on the issue.
🤖 Generated with Claude Code