Add an patch against additional check config on native Android OkHttp

This seems to be used internally by some Android TLS connections - note
that this is OkHttp (v2 I think), but vendored into com.android and used
internally, not as a separate module.
This commit is contained in:
Tim Perry
2023-10-20 17:28:42 +02:00
parent 65ca2d4664
commit 48dee79145
2 changed files with 24 additions and 10 deletions
+24
View File
@@ -123,6 +123,30 @@ const PINNING_FIXES = {
}
],
// --- Native HostnameVerification override (n.b. Android contains its own vendored OkHttp v2!)
'com.android.okhttp.Address': [
{
methodName: '$init',
replacement: () => {
const OkHostnameVerifier = Java.use("com.android.okhttp.internal.tls.OkHostnameVerifier");
const defaultHostnameVerifier = OkHostnameVerifier.INSTANCE.value;
const CertPinner = Java.use("com.android.okhttp.CertificatePinner");
const defaultCertPinner = CertPinner.DEFAULT.value;
return function () {
// Override arguments, to swap any custom check params (widely used
// to add stricter rules to TLS verification) with the defaults instead:
arguments[5] = defaultHostnameVerifier;
arguments[6] = defaultCertPinner;
this.$init(...arguments);
}
}
}
],
// --- OkHttp v3
'okhttp3.CertificatePinner': [
-10
View File
@@ -65,16 +65,10 @@ Java.perform(function () {
// To do that, we effectively pattern match our way through all the
// related types to work out what's what:
console.log('checking chain types...');
const chainType = Java.use(method.argumentTypes[0].className);
const responseTypeName = method.returnType.className;
console.log('got chain response type', responseTypeName);
const matchedChain = matchOkHttpChain(chainType, responseTypeName);
console.log('matchedChain', matchedChain);
return !!matchedChain;
};
@@ -86,8 +80,6 @@ Java.perform(function () {
);
if (matchingMethods.length !== 1) return;
console.log('got chain proceed method');
const [proceedMethodName, proceedMethod] = matchingMethods[0];
if (proceedMethod.argumentTypes.length !== 1) return;
@@ -101,8 +93,6 @@ Java.perform(function () {
);
if (matchingFields.length !== 1) return;
console.log('got chain request field');
const [requestFieldName] = matchingFields[0];
return {