From 5e92fdbbbee9c75377c4e961ae2ca1c644bf0577 Mon Sep 17 00:00:00 2001
From: Frederic Jacobs <github@fredericjacobs.com>
Date: Thu, 29 Jan 2015 22:28:31 -1000
Subject: [PATCH] Pinning upstream cert.

---
 Podfile                                       |   2 +-
 Podfile.lock                                  |  10 +++++-----
 Pods                                          |   2 +-
 Signal/Certificates/textsecure.cer            | Bin 1050 -> 1011 bytes
 .../network/http/RPServerRequestsManager.m    |   2 +-
 .../textsecure/Network/API/TSNetworkManager.m |   4 +++-
 6 files changed, 11 insertions(+), 9 deletions(-)

diff --git a/Podfile b/Podfile
index 49b5d52aa..ea2982f3c 100644
--- a/Podfile
+++ b/Podfile
@@ -4,7 +4,7 @@ inhibit_all_warnings!
 
 link_with ["Signal", "SignalTests"]
 
-pod 'SocketRocket',               :git => 'https://github.com/square/SocketRocket.git', :commit => '954750c018'
+pod 'SocketRocket',               :git => 'https://github.com/FredericJacobs/SocketRocket.git', :commit => '73d8a19'
 pod 'OpenSSL',		          '~> 1.0.200'
 pod 'libPhoneNumber-iOS',         '~> 0.7'
 pod 'AxolotlKit',                 '~> 0.5'
diff --git a/Podfile.lock b/Podfile.lock
index a72a290e9..6578bd0b4 100644
--- a/Podfile.lock
+++ b/Podfile.lock
@@ -73,7 +73,7 @@ DEPENDENCIES:
   - OpenSSL (~> 1.0.200)
   - PastelogKit (~> 1.2)
   - SCWaveformView
-  - SocketRocket (from `https://github.com/square/SocketRocket.git`, commit `954750c018`)
+  - SocketRocket (from `https://github.com/FredericJacobs/SocketRocket.git`, commit `73d8a19`)
   - SSKeychain
   - TwistedOakCollapsingFutures (~> 1.0)
   - UICKeyChainStore (from `Podspecs/UICKeyChainStore.podspec`)
@@ -87,8 +87,8 @@ EXTERNAL SOURCES:
     :branch: JSignalQ
     :git: https://github.com/WhisperSystems/JSQMessagesViewController
   SocketRocket:
-    :commit: 954750c018
-    :git: https://github.com/square/SocketRocket.git
+    :commit: 73d8a19
+    :git: https://github.com/FredericJacobs/SocketRocket.git
   UICKeyChainStore:
     :podspec: Podspecs/UICKeyChainStore.podspec
 
@@ -100,8 +100,8 @@ CHECKOUT OPTIONS:
     :commit: 26fb5cbcf4a2bf15b6f384d29028b15a5e1a62f5
     :git: https://github.com/WhisperSystems/JSQMessagesViewController
   SocketRocket:
-    :commit: 954750c018
-    :git: https://github.com/square/SocketRocket.git
+    :commit: 73d8a19
+    :git: https://github.com/FredericJacobs/SocketRocket.git
 
 SPEC CHECKSUMS:
   25519: 601ffb5d258aa33d642062d6fa4096db210e02e7
diff --git a/Pods b/Pods
index a824d242d..cf26bdeb6 160000
--- a/Pods
+++ b/Pods
@@ -1 +1 @@
-Subproject commit a824d242dc20309948cd9a0396c3f1265473986e
+Subproject commit cf26bdeb6884a541de1b72146d01b96a217cc8c9
diff --git a/Signal/Certificates/textsecure.cer b/Signal/Certificates/textsecure.cer
index 6ba9981967a317ab3dd9084ce91fbe395245703f..ed2f4fd6c302d96a2606dadd9a149186b0d0130f 100644
GIT binary patch
delta 643
zcmV-}0(||N2=fORFoFZ`FoFWtpaTK{0s;vDiMlPTO62omkrAdDGcq+YGBG$aHCh)9
zGBYqUGBYwVF*q|dT9F`;lVkxPf5Ay$X*eK57f86PXLyVS<Vke~rMH&41y4XI+Apeu
z^#IPr<+W-1-#(8z-Y$Z!tx69O=?8v<!!=xw0^}7k40?|3_RU2?i9ok`gsoka()ga~
zSFHOe`hv8d#{vTZ$80KMG;36l37Ko%4Q+66BmkjN#e-VF0P?2JLHU`ge{u)<=XBRg
zpY$N}&@P7ypTU+d1DG~;9|rOZC^HDQW>d6A?s3?l#6Ufn@-Mt_0};DkF4bVb8NElF
z)xO*-51@j?jp=}X#2>i~KSQ1Od<%-p=hrAlW3g^xTI6D<WHR-Xtf~M>TsV!sy}hT2
z2}e};aHw45kJR)WFQuNG70`zQ0|5X5qfjtTFdYU1RUHll76g;=0v40z0wI441_M<c
z69fe?0|5d5FbxI?Duzgg_YDC71qA>Df&l>lejdId3!bLXyU7CWQ7fZvJT}uXLwo)+
zD2!3@AA|Q?@n5=_(fPRpt4dEfPKk_+XRJL}5AhY5G}=v8If&?9%Kp^Mlb(IOsVwI`
zs>`n<hv#TSq4l_PmVb+18$y4r6UK&2K-7Z>qjG<<Wrh5uSZ609yQcWLvVGNaz_=4x
zz=^JdzwE7R+onw+tDrj1UNl)XQYz9$>_hn0LSFuXc)G?pC$i6z61OdE%qDjE5Q0OQ
z8}c8@az_QA=?S{3A%$p;CojYl;I_5LXQ$vXmqnt?JscwtvtU5_9Y-U7GoT|b1IPzu
d_E=(udk?fVz||sDcQLqH#CR5%C9=e?0@WYx93=n%

delta 750
zcmV<K0ulZ52bu^GFoFaYFoFX9paTK{0s;aM1Cbb}95gUDFfcGMFfdvd4Kg$^G%z<X
zGcz|dGFmW!kdZ1Qk!3zFE-)+x162eA3?+1Bcyx1RV|8+6EpugZc4=c}E_Y~Yb8uyH
zb9r-gWo>gVZ*pgoX8|F9rcVI?YTL%_7(=Cp5B9|bJ}XM?I?_)0nR+SFa#WYdNsPXH
zfTr`yt3GA%58$7$+P<%eZf07}R)X<)1|p-i+Q!Z_l&lKkOwn$Mnw_njA#P;~49o}e
z`QE6wSl+lJ{F+fx1df{+fR;7&FDXB~_nx5?+>W!yf*ixF8E-3pp#jx$sneEgU}1f~
zGPRz6!*l}T!boW_-a+V0TSB`NTuU&XZ>M0)s02F@&PvQ82ClbKm7lB!G^Bq?gAOqv
zz>sQTaH8HvG3$9kPHl86Q9YXF*pKe^^%tz5D{VQxrQ|9h7<Zg)2Q!~kc2YCQX;Q!E
zaW_fP^n{G`U6`O__n86%0RRD`doX!02?hgI9TNlsFaR(t1_@w>NCAfULIDi~9~K=?
zaAj^&Q%oR7Wo~71VRU6=AVXzxbZKU3V_|e<FdYU1RUHll76cRr;1f`RIS()x+gwb>
zSLA@*@#UD4umU1~4F(A+hDe6@4FLfK1potr0RaHA1yF6r2gjX%Vd#!dTv%KA5`|-k
z1V;xb#;Y4wToKvxlqbcS|C{Bmu@zbpSl-hwe`sB~p2st;s=Pe_UEhIWkCOOPvpYWy
znzsc9h34w6*#%?u&boIcCe>_1R8#&spEeLtYM|;%i{~eQ`>5?R)zX_PG@q8}d+d`X
z!bfdfqZbO_(fytLWVr@hrDmHMY7^1fF-UduE}AN!>mMogj&aI+)oNe`l>nraPqWR-
zTVgpKxagIhRXOH>4cFDgb&J$G=lt-XM-1a+K<u+W0Z?ZNE^UO;Y`sh)EVT<1zH`If
g+*(nKCzs|G8(X=57P_A|W4TNEz2jzbVHI6<=*%KQ*8l(j

diff --git a/Signal/src/network/http/RPServerRequestsManager.m b/Signal/src/network/http/RPServerRequestsManager.m
index 61988fa6d..3b548d39b 100644
--- a/Signal/src/network/http/RPServerRequestsManager.m
+++ b/Signal/src/network/http/RPServerRequestsManager.m
@@ -36,7 +36,7 @@ MacrosSingletonImplemention
         NSURL *endPointURL = [NSURL URLWithString:[NSString stringWithFormat:@"https://%@:%hu", endpoint.hostname, endpoint.port]];
         NSURLSessionConfiguration *sessionConf = NSURLSessionConfiguration.defaultSessionConfiguration;
         self.operationManager = [[AFHTTPSessionManager alloc] initWithBaseURL:endPointURL sessionConfiguration:sessionConf];
-        self.operationManager.securityPolicy = [AFSecurityPolicy policyWithPinningMode:AFSSLPinningModeNone];
+        self.operationManager.securityPolicy = [AFSecurityPolicy policyWithPinningMode:AFSSLPinningModePublicKey];
         self.operationManager.securityPolicy.allowInvalidCertificates = YES;
         NSString *certPath = [NSBundle.mainBundle pathForResource:@"redphone" ofType:@"cer"];
         NSData *certData = [NSData dataWithContentsOfFile:certPath];
diff --git a/Signal/src/textsecure/Network/API/TSNetworkManager.m b/Signal/src/textsecure/Network/API/TSNetworkManager.m
index 3d686bada..e74e858a2 100644
--- a/Signal/src/textsecure/Network/API/TSNetworkManager.m
+++ b/Signal/src/textsecure/Network/API/TSNetworkManager.m
@@ -38,8 +38,10 @@
     if (self = [super init]) {
         NSURLSessionConfiguration *sessionConf = NSURLSessionConfiguration.ephemeralSessionConfiguration;
         self.operationManager = [[AFHTTPSessionManager alloc] initWithBaseURL:[[NSURL alloc] initWithString:textSecureServerURL] sessionConfiguration:sessionConf];
-        AFSecurityPolicy *policy = [AFSecurityPolicy policyWithPinningMode:AFSSLPinningModePublicKey];
+        AFSecurityPolicy *policy = [AFSecurityPolicy policyWithPinningMode:AFSSLPinningModeCertificate];
         policy.allowInvalidCertificates = YES;
+        policy.validatesDomainName = NO;
+        policy.validatesCertificateChain = NO;
         NSString *certPath = [NSBundle.mainBundle pathForResource:@"textsecure" ofType:@"cer"];
         NSData *certData = [NSData dataWithContentsOfFile:certPath];
         SecCertificateRef cert = SecCertificateCreateWithData(NULL, (__bridge CFDataRef)(certData));