Support SSL Sync Configuration #5507

elle-j · 2023-02-27T07:36:31Z

What, How & Why?

When opening a synced realm, users can provide an SSL configuration containing either:

(A) A callback function used to accept or reject the server's "SSL" (TLS) certificate.
(B) A path to a trust certificate to hand off the validation.
(C) Choose not to validate the server's certificate (intended for non-production use).

Examples:

// (A) Custom validation.
const ssl: SSLConfiguration = {
  validate: true, // (Default)
  validateCertificates: (verifyObject: SSLVerifyObject) => {
    
    // Inspect the SSLVerifyObject and validate certificate..

    // Accept server's certificate:
    return true;

    // Or reject it:
    // return false;
  },
};

// (B) Hand off the validation.
const ssl: SSLConfiguration = {
  validate: true,
  certificatePath: "path/to/trust/certificate",
};

// (C) Do not validate.
const ssl: SSLConfiguration = {
  validate: false,
};

const realm = await Realm.open({
  schema: [MySchema],
  sync: {
    ssl,
    // ...
  },
});

This closes #5485.

☑️ ToDos

📝 Changelog entry
🚦 Tests (Located in PR 5694)

elle-j · 2023-02-27T07:46:56Z

packages/bindgen/src/realm_js_helpers.h

+    static auto make_ssl_verify_callback(std::function<bool(const std::string& server_address, int server_port,
+                                         std::string_view pem_data, int preverify_ok, int depth)> callback) {
+        return [callback = std::move(callback)](const std::string& server_address, uint16_t server_port,
+                                                const char* pem_data, size_t pem_size, int preverify_ok, int depth) {
+            return callback(server_address, server_port, { pem_data, pem_size }, preverify_ok, depth);
+        };
+    }


[line 269] Take the JS-wrapped version of the callback as the argument. This callback will (when invoked) call the user-provided callback for validating certificates.

[line 271] Return the CPP (Core-friendly) version of the callback (stored in the binding).

[line 273] When the CPP callback is invoked, invoke the JS-wrapped callback and return its result.

elle-j · 2023-02-27T07:54:25Z

packages/realm/src/app-services/SyncConfiguration.ts

    ...parseClientResetConfig(clientReset, onError),
  };
 }

+/** @internal */


On second thought, don't think this annotation is necessary since the function is not exported. (Ps. there are several non-exported functions in this file using this annotation already.)

packages/bindgen/spec.yml

takameyer

LGTM. Would be great to see some tests, but I think that's not so straightforward. I assume you have tested this manually?

elle-j · 2023-04-04T07:04:00Z

@takameyer, you can look at the separate PR for the tests. We decided to split up the PRs as with the Jira issues (v12 and final v12). All tests pass in my Docker container.

elle-j · 2023-04-05T17:18:27Z

packages/bindgen/src/realm_js_helpers.h

+    static auto make_ssl_verify_callback(std::function<bool(const std::string& server_address, int server_port,
+                                                            std::string_view pem_data, int preverify_ok, int depth)>
+                                             callback)
+    {
+        return [callback = std::move(callback)](const std::string& server_address, uint16_t server_port,
+                                                const char* pem_data, size_t pem_size, int preverify_ok, int depth) {
+            return callback(server_address, server_port, std::string_view(pem_data, pem_size), preverify_ok, depth);
+        };
+    }


[signature]: Take the JS-wrapped version of the callback as the argument. This callback will (when invoked) call the user-provided callback for validating certificates.

[1st return]: Return the CPP (Core-friendly) version of the callback (stored in the binding).

[2nd return]: When the CPP callback is invoked, invoke the JS-wrapped callback and return its result.

takameyer · 2023-04-06T11:42:43Z

Getting the following error when building locally and on the darwin arm64 build job in GitHub Actions:

clang: error: unable to execute command: Segmentation fault: 11
clang: error: clang frontend command failed due to signal (use -v to see invocation)
Apple clang version 14.0.3 (clang-1403.0.22.14.1)
Target: arm64-apple-darwin22.3.0
Thread model: posix
InstalledDir: /Applications/Xcode.app/Contents/Developer/Toolchains/XcodeDefault.xctoolchain/usr/bin
clang: note: diagnostic msg: 
********************

PLEASE ATTACH THE FOLLOWING FILES TO THE BUG REPORT:
Preprocessed source(s) and associated run script(s) are located at:
clang: note: diagnostic msg: /var/folders/r7/nrrb917s7859md1_13pxplwm0000gp/T/node_init-5555d2.cpp
clang: note: diagnostic msg: /var/folders/r7/nrrb917s7859md1_13pxplwm0000gp/T/node_init-5555d2.sh
clang: note: diagnostic msg: Crash backtrace is located in
clang: note: diagnostic msg: /Users/andrew.meyer/Library/Logs/DiagnosticReports/clang_<YYYY-MM-DD-HHMMSS>_<hostname>.crash
clang: note: diagnostic msg: (choose the .crash file that corresponds to your crash)
clang: note: diagnostic msg: 

********************

This is not appearing on main. Unsure what could be causing that 🤷

takameyer

We need to fix the build issues before this is merged.

kneth · 2023-04-12T09:09:19Z

packages/bindgen/spec.yml

+        type: bool
+        default: true
+      ssl_trust_certificate_path: util::Optional<std::string>
+      ssl_verify_callback: Nullable<SSLVerifyCallback>


Should it be off_thread?

It is. See line 642.

Not sure if it can be marked as off_thread here.

As this is the SSLVerifyCallback:

SSLVerifyCallback: cppName: std::function<SyncConfig::SSLVerifyCallback>

And having ssl_verify_callback as:

SyncConfig: fields: # ... ssl_verify_callback: Nullable<SSLVerifyCallback>

It's unsure how/if it should be applied. These are 2 examples of other how other methods use it:

should_compact_on_launch_function: 'Nullable<std::function<(total_bytes: uint64_t, used_bytes: uint64_t) off_thread -> bool>>' error_handler: 'Nullable<std::function<(session: SharedSyncSession, error: SyncError) off_thread -> void>>'

We do however need it for our helper make_ssl_verify_callback:

classes: Helpers: staticMethods: # ... make_ssl_verify_callback: '(callback: (server_address: const std::string&, server_port: int, pem_data: std::string_view, preverify_ok: int, depth: int) off_thread -> bool) -> SSLVerifyCallback'

But @RedBeard0531 could chime in here 🙂

packages/realm/src/app-services/SyncConfiguration.ts

kraenhansen · 2023-04-17T14:54:37Z

packages/realm/src/app-services/SyncSession.ts

@@ -286,11 +286,22 @@ export class SyncSession {
  // TODO: Figure out a way to avoid passing a mocked app instance when constructing the User.
  get config(): SyncConfiguration {
    const user = new User(this.internal.user, mockApp);
-    const { partitionValue, flxSyncRequested, customHttpHeaders } = this.internal.config;
+    const { partitionValue, flxSyncRequested, customHttpHeaders, clientValidateSsl, sslTrustCertificatePath } =


Does the clientValidateSsl and sslTrustCertificatePath have sane defaults when coming from core? (i.e. not just an empty string or something).

This will be whatever the user has provided as their validate (binding: clientValidateSsl) and certificatePath (binding: sslTrustCertificatePath).

export type SSLConfiguration = { validate?: boolean; certificatePath?: string; // ... };

If you don't provide a value for certificatePath, the value can be undefined as in this test. validate defaults to true.

* main: Added note in docs for change listeners (#5749) Update CHANGELOG entry (#5751) Use `SchemaParseError` for invalid schemas (#5722) Improving Electron tests (#5738) Support SSL Sync Configuration (#5507) # Conflicts: # CHANGELOG.md

cla-bot bot added the cla: yes label Feb 27, 2023

elle-j commented Feb 27, 2023

View reviewed changes

kraenhansen force-pushed the bindgen branch from 899cac3 to 7e2beeb Compare March 1, 2023 11:05

Base automatically changed from bindgen to master March 3, 2023 14:05

elle-j force-pushed the lj/bindgen/ssl-sync-config branch from dc2da79 to 9ca326b Compare March 17, 2023 15:05

elle-j mentioned this pull request Apr 3, 2023

Add SSL sync config tests #5694

Merged

1 task

elle-j marked this pull request as ready for review April 3, 2023 19:15

elle-j requested review from RedBeard0531, takameyer, kneth, kraenhansen and papafe April 3, 2023 19:16

takameyer reviewed Apr 4, 2023

View reviewed changes

packages/bindgen/spec.yml Show resolved Hide resolved

takameyer approved these changes Apr 4, 2023

View reviewed changes

elle-j added 14 commits April 5, 2023 17:33

Add SSL sync config types to bindgen.

aa450dd

Remove unnecessary comments.

ce25b5c

Add SSL sync config types to SDK.

00b0747

Export SSL types.

9959888

Validate ssl config object.

5f78584

Add SSL object to the returned SyncSession.config.

f84f68f

Setup tests.

910244c

Remove comments.

602c4df

Add tests.

c730566

Add test for Node environment due to 'crypto'.

5a10d4d

Move all SSL tests to Node environment.

502a652

Remove tests and add to separate PR.

f577ec3

Add CHANGELOG entry.

3d40dfd

Add docs to 'SSLConfiguration'.

875cb0b

Update CPP formatting.

a15ad76

elle-j force-pushed the lj/bindgen/ssl-sync-config branch from 893101c to a15ad76 Compare April 5, 2023 16:27

elle-j commented Apr 5, 2023

View reviewed changes

takameyer requested changes Apr 6, 2023

View reviewed changes

kneth reviewed Apr 12, 2023

View reviewed changes

kraenhansen reviewed Apr 17, 2023

View reviewed changes

packages/realm/src/app-services/SyncConfiguration.ts Show resolved Hide resolved

kraenhansen reviewed Apr 17, 2023

View reviewed changes

kraenhansen approved these changes Apr 17, 2023

View reviewed changes

elle-j added 2 commits April 18, 2023 17:02

Fix clang segfault.

7ce17ae

Fix cpp linting.

d2da0a5

elle-j merged commit 667d729 into main Apr 19, 2023

elle-j deleted the lj/bindgen/ssl-sync-config branch April 19, 2023 09:12

github-actions bot locked as resolved and limited conversation to collaborators Mar 15, 2024

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Support SSL Sync Configuration #5507

Support SSL Sync Configuration #5507

elle-j commented Feb 27, 2023 •

edited

Loading

elle-j Feb 27, 2023 •

edited

Loading

elle-j Feb 27, 2023 •

edited

Loading

takameyer left a comment

elle-j commented Apr 4, 2023 •

edited

Loading

elle-j Apr 5, 2023

takameyer commented Apr 6, 2023 •

edited

Loading

takameyer left a comment

kneth Apr 12, 2023

RedBeard0531 Apr 12, 2023

elle-j Apr 12, 2023 •

edited

Loading

kraenhansen Apr 17, 2023

elle-j Apr 17, 2023

Support SSL Sync Configuration #5507

Support SSL Sync Configuration #5507

Conversation

elle-j commented Feb 27, 2023 • edited Loading

What, How & Why?

☑️ ToDos

elle-j Feb 27, 2023 • edited Loading

Choose a reason for hiding this comment

elle-j Feb 27, 2023 • edited Loading

Choose a reason for hiding this comment

takameyer left a comment

Choose a reason for hiding this comment

elle-j commented Apr 4, 2023 • edited Loading

elle-j Apr 5, 2023

Choose a reason for hiding this comment

takameyer commented Apr 6, 2023 • edited Loading

takameyer left a comment

Choose a reason for hiding this comment

kneth Apr 12, 2023

Choose a reason for hiding this comment

RedBeard0531 Apr 12, 2023

Choose a reason for hiding this comment

elle-j Apr 12, 2023 • edited Loading

Choose a reason for hiding this comment

kraenhansen Apr 17, 2023

Choose a reason for hiding this comment

elle-j Apr 17, 2023

Choose a reason for hiding this comment

elle-j commented Feb 27, 2023 •

edited

Loading

elle-j Feb 27, 2023 •

edited

Loading

elle-j Feb 27, 2023 •

edited

Loading

elle-j commented Apr 4, 2023 •

edited

Loading

takameyer commented Apr 6, 2023 •

edited

Loading

elle-j Apr 12, 2023 •

edited

Loading