datatheorem / datatheorem/TrustKit-Android

React native SSL pinning works but PinningFailureReportBroadcastReceiver is not fired/called

Open
#93 3 comments 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

Dominant language
Java
Stars
604
Forks
90
Avg merge
1h 29m
Merged PRs (30d)
2

Description

Describe the bug
On React native after adding the network_security_config the requests are blocked when the PIN doesn't match which is fine but we are not able to get the broadcast of the PIN failure for reporting it to Crashlytics etc.

To Reproduce
Launch the app.
Connect to the service.
Network error is received and the API call fails.
No broadcast happens.

Expected behavior
The broadcast should be fired.

TrustKit configuration

implementation 'com.datatheorem.android.trustkit:trustkit:1.1.3'
<?xml version="1.0" encoding="utf-8"?>
<network-security-config>
    <domain-config cleartextTrafficPermitted="false">
        <domain includeSubdomains="true">xxxx.xxx-xxx-xxx.com</domain>
        <pin-set>
            <pin digest="SHA-256">fdsgfdw343wtrbvdfbggdfgd54545345353=</pin>
            <pin digest="SHA-256">fdsgfdw343wtrbvdfbggdfgd54545345353=</pin>
        </pin-set>
        <trustkit-config enforcePinning="true"></trustkit-config>
    </domain-config>
    <domain-config cleartextTrafficPermitted="false">
        <domain includeSubdomains="true">xxx-xxxx-xxx.xxx.xxxxx</domain>
        <pin-set>
            <pin digest="SHA-256">fdsgfdw343wtrbvdfbggdfgd54545345353==</pin>
            <pin digest="SHA-256">fdsgfdw343wtrbvdfbggdfgd54545345353==</pin>
        </pin-set>
        <trustkit-config enforcePinning="false"></trustkit-config>
    </domain-config>
    <domain-config cleartextTrafficPermitted="true">
        <domain includeSubdomains="true">10.0.2.2</domain>
        <domain includeSubdomains="true">localhost</domain>
    </domain-config>
</network-security-config>

App details:

  • App target SDK: 29
  • App language: React native, Android, Axios
  • Android version to reproduce the bug: Android 29 Emulator

Additional context
MainActivity.java

  private static final PinningFailureReportBroadcastReceiver pinningFailureReportBroadcastReceiver
          = new PinningFailureReportBroadcastReceiver();
  @Override
  protected void onCreate(Bundle savedInstanceState) {
    super.onCreate(savedInstanceState);
    TrustKit.initializeWithNetworkSecurityConfiguration(this);
    LocalBroadcastManager.getInstance(this)
            .registerReceiver(pinningFailureReportBroadcastReceiver, new IntentFilter(BackgroundReporter.REPORT_VALIDATION_EVENT));

  @Override
  protected void onDestroy() {
    LocalBroadcastManager.getInstance(getApplicationContext())
            .unregisterReceiver(pinningFailureReportBroadcastReceiver);
    super.onDestroy();
  }

And within MainActivity.java

  static class PinningFailureReportBroadcastReceiver extends BroadcastReceiver {
    @Override
    public void onReceive(Context context, Intent intent) {
      PinningFailureReport report = (PinningFailureReport) intent.getSerializableExtra(BackgroundReporter.EXTRA_REPORT);
      Log.v(TAG, "Received PinningFailureReport " + report.toString());
    }
  }

At this point, I am not sure whether TrustKit is doing the PIN rejection of is it the OS doing it by default.

Contributor guide

No contributing guide indexed for this repository

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Start with MainActivity.java and reproduce the failure on the Android 29 emulator using the provided network-security-config and TrustKit initialization. Trace whether the rejected connection reaches TrustKit reporting or is rejected by the OS, then verify that PinningFailureReportBroadcastReceiver receives the expected report through the registered LocalBroadcastManager receiver.

Written by the indexing model from the issue text.

Assessment

Tech stack
android, java, react-native
Domain
mobile-dev, security
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
35/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.