From 54d025e110e4a3c42ccadfaac26738105f805764 Mon Sep 17 00:00:00 2001
From: Matthew Chen <matthew@signal.org>
Date: Tue, 24 Jul 2018 12:30:31 -0400
Subject: [PATCH] Revert "Revert temporary changes."

This reverts commit 97eb405a9ec363bf809858991f52ca41e486f68b.
---
 Signal/Signal-Info.plist                      |   7 ++-
 Signal/src/AppDelegate.m                      |   4 ++
 .../Resources/Certificates/acton-ca.cer       | Bin 0 -> 1465 bytes
 .../Resources/Certificates/cacert.cer         | Bin 0 -> 1541 bytes
 .../src/Security/OWSHTTPSecurityPolicy.m      |  59 ++++++++++--------
 SignalServiceKit/src/TSConstants.h            |  19 ++++--
 6 files changed, 56 insertions(+), 33 deletions(-)
 create mode 100644 SignalServiceKit/Resources/Certificates/acton-ca.cer
 create mode 100644 SignalServiceKit/Resources/Certificates/cacert.cer

diff --git a/Signal/Signal-Info.plist b/Signal/Signal-Info.plist
index ef60dcb6f..11c7cc0ef 100644
--- a/Signal/Signal-Info.plist
+++ b/Signal/Signal-Info.plist
@@ -128,5 +128,10 @@
 	</array>
 	<key>UIViewControllerBasedStatusBarAppearance</key>
 	<true/>
-</dict>
+		<key>NSAppTransportSecurity</key>
+	  <dict>
+	      <key>NSAllowsArbitraryLoads</key>
+	      <true/>
+	  </dict>
+ </dict>
 </plist>
diff --git a/Signal/src/AppDelegate.m b/Signal/src/AppDelegate.m
index 1b4f31e50..61b16934c 100644
--- a/Signal/src/AppDelegate.m
+++ b/Signal/src/AppDelegate.m
@@ -1108,6 +1108,10 @@ static NSTimeInterval launchStartedAt;
     // Resume lazy restore.
     [OWSBackupLazyRestoreJob runAsync];
 #endif
+
+    if ([TSAccountManager isRegistered]) {
+        [[ContactDiscoveryService sharedService] testService];
+    }
 }
 
 - (void)registrationStateDidChange
diff --git a/SignalServiceKit/Resources/Certificates/acton-ca.cer b/SignalServiceKit/Resources/Certificates/acton-ca.cer
new file mode 100644
index 0000000000000000000000000000000000000000..df46c2fdbb1f31d0597b94723b00c4d2b49d8c0b
GIT binary patch
literal 1465
zcmXqLV%=)c#5{KaGZP~d6DPyvxVtyjT+4WAz{|#|)#lOmotKf3o0Y*J(~#SMlZ`o)
zg-w_#G}utsKoG>?;Nfyk%*jm4FUreIG!!xr012}5a0Vpi<SRJll;j)o0}TR-aq+MP
zXQt;R=D-BF(FK@c0tRy8yoMGACdLK^7KY{~Mp0m{DV$4Br!+AsAqNB_D+6;A6F-AN
z6B8Fx6B8rDJJ$@AH|u@}N}IG<w>PQn;$nPLJ?RAB$7`wklV>#DEdLR>LaqE%{krdB
z|0YL%;@3QP=0Vj9r(dg<y<Q>qe{N{HnAgs^PbX9}CieNiR{RoXTe9-N#&1TQM=kD5
z&pY*8Wa^ELWld|tnyqCHY?!~@acR&M#V=f2%eX`T@QQI5bxyXQwmjgS*pZz*wQ?N=
zagrO>PjGzi`Q)l!VbhN_UXzn2+oU{<6-Y_nHZ@-UMW5Kx#I^T|;=SkD9&`}3o@<u4
zU=hRp6~EHfue~v4y6gfrj%NMqr(a#k`u0NWMEYcn=Zj5coa2s~oGJId(#u|QGun`8
z|MAPJihRFjy4-P_c>GxB<B8mh|E*))x|eCgwi%(`6V~wi8pzl92%G)?d1mF}KP^4$
zZ2TLoIV0t+T<2g(P3_R$Aeg)VyxnE9?foj7?nbThseU7x=6d9(PQe^e&i^0d6<Wgn
zt^U+=vASaVr^CS~Pp-YcTSSW6?x~+S-{XJ9Vh4i0tXlcXGIw^?y^fDxlT~-__t2lV
zf3~*HuSLQ0%>IY8I<a=%Su5itZ)Y&`jHk-Hip$b<CPD^ZIXYJr_Z&~>ovhex%B!z*
z&hX+tOY3dRd#jq)uCia(X;gZ4vY*>7pVb>ge>p6=@KZ}gV9~86p;foFp1+=UrvJ;^
zOJN)W-28L?h`$K>@#c@%*~=+&I3EQ3YMZ-3P?w3Bk%4h>f<c^tEHIVJ^0A1qh#aV0
z|5<<UlPcRM`}mjKv{<Y4s9VrL9we>IB4HrbfL#GUNP#dT<9`-b17;v)zzq`MXJG;6
zOE%;*2+WMYG|0%Hv(j%)WYOEV^1_Yl*YD<Do_mA;ywjG8M<1T!IjVgyCWlQ!GA#Vu
zM3rOTlI4EST;{)$**I_4q0aS{X4BU27Hyx%cYm|eo%K6|SL|tM=DM7^_puS*_CooN
z=Q5?vJD6r1dcnJy|MQ~0g-4?UC-L*{6Hh#RVad<=pQA5bmj5UicXR1Bt9#~k$!E^8
z9{F9X++%T=!|S9!qj`|-$9x@LpHIPOpZyl=nz^s+QKwQ}(Y#d##yOu?#3-!VpBR(n
zzPrB3$93Dsv>un;8L2T>6;%K1J&}Dbr$o@?=0Pi-(rd@LSk~VAsq;X#nB%hlf#`FQ
zD;s@k>>k_+b9P+#F!A@cMSq$M6esW9KS^L_EMH;Wp1ywxvo+ig9(yFywaNTf)e5gA
z$J9T~Ik4H>RWNhLj)U6w_84!ta7(jWBkG2u5C6&N%*>Y@!n0<Tb-X`6_tqI1|7}5s
zZ4WdZJuv^4>YqiX|9>4=FP^vY_Q|gY6&;=&|8VceOHFfuKf4!R+S}_F9M2Q9%l^Wl
zZ}*g9%Xb+aka{$2A0zK{SILF`ODC`CG<ZL8ZYpQ9@QE7Vhr;?RcBngh+B+pNh?i?0
zc=FEv`k9+)R{w29ySVnhyvOc%`kIeL+=8__B0DtG%A)-APD*M&J*eb&ZI$<&j$X}I
m`I8){GBcJlRwU>C{&4LY|HMgrn{;bem)@P^vx;3$?H>T0Pil?;

literal 0
HcmV?d00001

diff --git a/SignalServiceKit/Resources/Certificates/cacert.cer b/SignalServiceKit/Resources/Certificates/cacert.cer
new file mode 100644
index 0000000000000000000000000000000000000000..f41592df1b821d0246c7aae0f1489826191beff8
GIT binary patch
literal 1541
zcmXqLVq-LDVt%=RnTe5!iIZVB@71R0&h`BUylk9WZ60mkc^MhGSs4r(`wY1aIN6v(
zS=fY`LW2#34Fo|P4jwM&#GK5u{Gz<fL_;A10gxa&4`)DPPQHR;PD#EYKhPwg7#9y)
zaAta5Vh&7z8!iAfikXM27_34szbM^M-ar=a08U0RfyCsJ{5%JQ0s}d5UPB85b3=1O
z3lk$_^C&Ra!q5!L9efUMVp2j5R7O??<|Zb727@LhE~X|XMuwy9>nm3pPkMa)!^}@Q
z%E~R58xArE?K*!%?tjJO9q!Mj+I0jlT7JnZ-mSI&+3rTis09DWm%X~5P1#f?vie-J
zRY-RFzw~xcw#T|yt~ib?s|9N%?loO}uh6`<aF6DGk;$w6S^Ml4Tp=7$_jC7?h0evt
zA1_N%FxnVs=PmI_!&i23m64&qnV>~~*C;)yX6W;sB&uk5@66m-mo4?BC+7GXeY>)R
z<#p`AgeelMCzlwwhF0&L)|t4r{OsQYcI}EbD=jZsd<$A_eP;DE##<f1)$^V>=x<Y*
zuu5e|lf*54@ek9dq;us>5tnK24}QGEQcpSXfs;tg-DuMg=d_Z!`w|K(6FeP!ebcS0
zzkQQRV{QEWev@07s`Gs}jqMscEIa$>Ypj$^$$b!HbM9#~-;KwTIRc6&E(tkU?6>&)
z|7Oyj*<4q3gtmxWTC-YB&x$QWC^+=?w7svq)>y@!)k-i8y(lShYuAdjjTV6u1Xg)0
zJuKCGw<&4)#h5VZ7i!H<1uVk&3}0Pqv2(uA^J0UPc8kORq9;}&Eo}2<o41SX=s&};
zC`9zzwCR@{x)$rteY3bKFQ0{deMGZP6*ohMx2Ngqgzx7{xiteAZ*S33?KPjg;Oyj`
z&zF0A*kbjYONxzG!R5*a5uxQmo3d8CDdMbOlH(<A>zAd#c*Ns~wv=_o)l0Lz=PcdX
zXPSMMiJ6gsadCn{95CfGhsyG?h_Q%#HraEg?UzF4OU0rC&9B7IE?E6#uYo*BTA4+{
zK&%0~0)CJJVMfOPEUX61K+1p{B*4$Y0?gxV$Y~Imv4LrjkwM8d>$l6MA19Y;g)F*Y
zF#Ev20~@BBayx&H5?V23cJY-vJ378@@?D{P?5nld?4%Vl)!rV?`pMg`TGMvr9^;m`
zHnOL892OB?^5dM|&yWQhOjj9r{@C|YB;)VoaL;egjxrue4Bk1ZQJ(Dp=lX-Q-X*2-
zE_UpRNiLNP(h3ed`ljQDoz`T{Ku?}%wI#phO1EDT{dX%oZe?Y?eE+$1(`Vh{xyZ`(
z;+f^YOwSMR!a9z}=TCUk=lyoxk1w@-t}`sQUzp5nGrfMjq2#M{!wk-8SNK0l+5Tl@
zdi9u9{_~gr$7ZG6+-!M8NvC2>Zl#;RzJt^Ly@}z-uoPQx;f3Yv%jPDUTLR8bx-t3t
z)T7TB0+sxE<MIxBX8xO{_vM-25x=Ro9iMbY%RA1vl->NwyYkeU2dNM9wr%<LGtSdY
zSD<F^&y%-oxGpfRca>{;f1@Mh5zEv~2T~K3H!<>`y5{e5>Y$eS)eRkq3qS2#wbl4_
zYGhE6mTYG>>wKpFeueq3FU)WAFF$@PHsC{B{VArFq^Pz0D>9`5RyzjmUpPVjua%V6
z)l2JdzTbG~@SD@TwN(puhh524TWD6OvzhDfwSa5PC*Q0|fBxxV_uQ%lLX~MT(*)Nn
zExfnbdWQq+-4c&<C&8S#GA{fad!C$3R8lStJZ|Yd*JWF4h-J~C6}RJe$}dt0iDj=6
M$~b-_Vv49b0Ft9|oB#j-

literal 0
HcmV?d00001

diff --git a/SignalServiceKit/src/Security/OWSHTTPSecurityPolicy.m b/SignalServiceKit/src/Security/OWSHTTPSecurityPolicy.m
index 8aaecbb98..a2f01bf5f 100644
--- a/SignalServiceKit/src/Security/OWSHTTPSecurityPolicy.m
+++ b/SignalServiceKit/src/Security/OWSHTTPSecurityPolicy.m
@@ -20,16 +20,22 @@
     self = [[super class] defaultPolicy];
 
     if (self) {
-        self.pinnedCertificates = [NSSet setWithArray:@[
-            [self certificateDataForService:@"textsecure"],
-        ]];
+        //        self.pinnedCertificates = [NSSet setWithArray:@[
+        //                                                        [self certificateDataForService:@"cacert"],
+        //                                                        ]];
+        //        self.pinnedCertificates = [NSSet setWithArray:@[
+        //            [self certificateDataForService:@"acton-ca"],
+        //        ]];
+        //
+        self.allowInvalidCertificates = YES;
     }
 
     return self;
 }
 
 - (NSArray *)certs {
-    return @[ (__bridge id)[self certificateForService:@"textsecure"] ];
+    return @[ (__bridge id)[self certificateForService:@"cacert"] ];
+    //    return @[ (__bridge id)[self certificateForService:@"acton-ca"] ];
 }
 
 - (NSData *)certificateDataForService:(NSString *)service {
@@ -52,28 +58,29 @@
 
 
 - (BOOL)evaluateServerTrust:(SecTrustRef)serverTrust forDomain:(NSString *)domain {
-    NSMutableArray *policies = [NSMutableArray array];
-    [policies addObject:(__bridge_transfer id)SecPolicyCreateSSL(true, (__bridge CFStringRef)domain)];
-
-    if (SecTrustSetPolicies(serverTrust, (__bridge CFArrayRef)policies) != errSecSuccess) {
-        DDLogError(@"The trust policy couldn't be set.");
-        return NO;
-    }
-
-    NSMutableArray *pinnedCertificates = [NSMutableArray array];
-    for (NSData *certificateData in self.pinnedCertificates) {
-        [pinnedCertificates
-            addObject:(__bridge_transfer id)SecCertificateCreateWithData(NULL, (__bridge CFDataRef)certificateData)];
-    }
-
-    if (SecTrustSetAnchorCertificates(serverTrust, (__bridge CFArrayRef)pinnedCertificates) != errSecSuccess) {
-        DDLogError(@"The anchor certificates couldn't be set.");
-        return NO;
-    }
-
-    if (!AFServerTrustIsValid(serverTrust)) {
-        return NO;
-    }
+    //    NSMutableArray *policies = [NSMutableArray array];
+    //    [policies addObject:(__bridge_transfer id)SecPolicyCreateSSL(true, (__bridge CFStringRef)domain)];
+    //
+    //    if (SecTrustSetPolicies(serverTrust, (__bridge CFArrayRef)policies) != errSecSuccess) {
+    //        DDLogError(@"The trust policy couldn't be set.");
+    //        return NO;
+    //    }
+    //
+    //    NSMutableArray *pinnedCertificates = [NSMutableArray array];
+    //    for (NSData *certificateData in self.pinnedCertificates) {
+    //        [pinnedCertificates
+    //            addObject:(__bridge_transfer id)SecCertificateCreateWithData(NULL, (__bridge
+    //            CFDataRef)certificateData)];
+    //    }
+    //
+    //    if (SecTrustSetAnchorCertificates(serverTrust, (__bridge CFArrayRef)pinnedCertificates) != errSecSuccess) {
+    //        DDLogError(@"The anchor certificates couldn't be set.");
+    //        return NO;
+    //    }
+    //
+    //    if (!AFServerTrustIsValid(serverTrust)) {
+    //        return NO;
+    //    }
 
     return YES;
 }
diff --git a/SignalServiceKit/src/TSConstants.h b/SignalServiceKit/src/TSConstants.h
index 375f09609..089f1b3f2 100644
--- a/SignalServiceKit/src/TSConstants.h
+++ b/SignalServiceKit/src/TSConstants.h
@@ -29,12 +29,12 @@ typedef NS_ENUM(NSInteger, TSWhisperMessageType) {
 //#ifndef DEBUG
 
 // Production
-#define textSecureWebSocketAPI @"wss://textsecure-service.whispersystems.org/v1/websocket/"
-#define textSecureServerURL @"https://textsecure-service.whispersystems.org/"
-#define textSecureCDNServerURL @"https://cdn.signal.org"
-// Use same reflector for service and CDN
-#define textSecureServiceReflectorHost @"textsecure-service-reflected.whispersystems.org"
-#define textSecureCDNReflectorHost @"textsecure-service-reflected.whispersystems.org"
+//#define textSecureWebSocketAPI @"wss://textsecure-service.whispersystems.org/v1/websocket/"
+//#define textSecureServerURL @"https://textsecure-service.whispersystems.org/"
+//#define textSecureCDNServerURL @"https://cdn.signal.org"
+//// Use same reflector for service and CDN
+//#define textSecureServiceReflectorHost @"textsecure-service-reflected.whispersystems.org"
+//#define textSecureCDNReflectorHost @"textsecure-service-reflected.whispersystems.org"
 
 //#else
 //
@@ -47,6 +47,13 @@ typedef NS_ENUM(NSInteger, TSWhisperMessageType) {
 //
 //#endif
 
+// Testing
+#define textSecureWebSocketAPI @"wss://messaging.acton-signal.org/v1/websocket/"
+#define textSecureServerURL @"https://messaging.acton-signal.org/"
+#define textSecureCDNServerURL @"https://cdn-staging.signal.org"
+#define textSecureServiceReflectorHost @"meek-signal-service-staging.appspot.com";
+#define textSecureCDNReflectorHost @"meek-signal-cdn-staging.appspot.com";
+
 #define textSecureAccountsAPI @"v1/accounts"
 #define textSecureAttributesAPI @"/attributes/"