Node / meshtastic / Meshtastic-Android / files / core / network / src / androidMain / kotlin / org / meshtastic / core / network / repository / MqttTlsTrust.android.kt

Displaying Raw • Download

T8b949e/*

* Copyright (c) 2026 Meshtastic LLC

*

* This program is free software: you can redistribute it and/or modify

* it under the terms of the GNU General Public License as published by

* the Free Software Foundation, either version 3 of the License, or

* (at your option) any later version.

*

* This program is distributed in the hope that it will be useful,

* but WITHOUT ANY WARRANTY; without even the implied warranty of

* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the

* GNU General Public License for more details.

*

* You should have received a copy of the GNU General Public License

* along with this program. If not, see <https://www.gnu.org/licenses/>.

*/

Tff7b72package T7ee787org.meshtastic.core.network.repository

Tff7b72import T7ee787co.touchlab.kermit.Logger

Tff7b72import T7ee787io.ktor.network.tls.TLSConfigBuilder

Tff7b72import T7ee787java.security.KeyStore

Tff7b72import T7ee787javax.net.ssl.TrustManagerFactory

Tff7b72import T7ee787javax.net.ssl.X509TrustManager

T8b949e/**

* `AndroidCAStore` exposes the system CAs *and* the CAs the user has installed from Settings. Anchoring MQTT on it

* reproduces what `<certificates src="system"/>` + `<certificates src="user"/>` used to give the whole app, but only

* for the MQTT socket.

*/

Tff7b72private Tff7b72const Tff7b72val Te6edf3ANDROID_CA_STORE Tff7b72= Ta5d6ff"Ta5d6ffAndroidCAStoreTa5d6ff"

Tff7b72actual Tff7b72fun Td2a8ffmqttTlsConfigTb4b4b4(Tb4b4b4)Tb4b4b4: Tb4b4b4(Te6edf3TLSConfigBuilderTb4b4b4.Tb4b4b4(Tb4b4b4) Tff7b72-Tff7b72> Tffa657UnitTb4b4b4)Tff7b72? Tb4b4b4{

Tff7b72val Te6edf3manager Tff7b72= Te6edf3userCaTrustManagerTb4b4b4(Tb4b4b4) Tff7b72?: Tff7b72return Tff7b72null

Tff7b72return Tb4b4b4{ Te6edf3trustManager Tff7b72= Te6edf3manager Tb4b4b4}

Tb4b4b4}

T8b949e/**

* Built through a [TrustManagerFactory] so the result is one `X509TrustManagerExtensions` can wrap — the transport

* needs that to reach the hostname-aware `checkServerTrusted(chain, authType, host)` overload the platform requires

* whenever `network_security_config.xml` carries any domain-specific config (ours does, for the localhost cleartext

* exemptions).

*

* Returning `null` on failure falls back to the platform default, which is the safe direction: a private-CA broker

* stops connecting, rather than trust silently widening.

*/

Tff7b72private Tff7b72fun Td2a8ffuserCaTrustManagerTb4b4b4(Tb4b4b4)Tb4b4b4: Te6edf3X509TrustManager? Tff7b72= Te6edf3runCatching Tb4b4b4{

Tff7b72val Te6edf3keyStore Tff7b72= Te6edf3KeyStoreTb4b4b4.Te6edf3getInstanceTb4b4b4(Te6edf3ANDROID_CA_STORETb4b4b4)Tb4b4b4.Te6edf3apply Tb4b4b4{ Te6edf3loadTb4b4b4(Tff7b72nullTb4b4b4) Tb4b4b4}

Te6edf3TrustManagerFactoryTb4b4b4.Te6edf3getInstanceTb4b4b4(Te6edf3TrustManagerFactoryTb4b4b4.Te6edf3getDefaultAlgorithmTb4b4b4(Tb4b4b4)Tb4b4b4)

Tb4b4b4.Te6edf3apply Tb4b4b4{ Tff7b72initTb4b4b4(Te6edf3keyStoreTb4b4b4) Tb4b4b4}

Tb4b4b4.Te6edf3trustManagers

Tb4b4b4.Te6edf3filterIsInstanceTff7b72<Te6edf3X509TrustManagerTff7b72>Tb4b4b4(Tb4b4b4)

Tb4b4b4.Te6edf3firstOrNullTb4b4b4(Tb4b4b4)

Tb4b4b4}

Tb4b4b4.Te6edf3onFailure Tb4b4b4{

Te6edf3LoggerTb4b4b4.Te6edf3wTb4b4b4(Te6edf3throwable Tff7b72= Tffa657itTb4b4b4) Tb4b4b4{ Ta5d6ff"Ta5d6ffCould not build the MQTT user-CA trust manager; using platform trustTa5d6ff" Tb4b4b4}

Tb4b4b4}

Tb4b4b4.Te6edf3getOrNullTb4b4b4(Tb4b4b4)