0.10.6

Sources/Shared/Security/CertificateTrustEvaluator.swift

@@ -0,0 +1,24 @@
+import Foundation
+import Security
+
+enum CertificateTrustEvaluator {
+    /// Evaluates the peer as a TLS server for the XMPP service domain.
+    ///
+    /// Martin 3.2.4's legacy SocketConnector creates an SSL client-certificate
+    /// policy in its default path. Luma supplies the correct server policy
+    /// without weakening hostname or certificate-chain validation.
+    static func evaluateServerTrust(_ trust: SecTrust, expectedDomain: String) -> Bool {
+        let policy = SecPolicyCreateSSL(true, expectedDomain as CFString)
+        guard SecTrustSetPolicies(trust, policy) == errSecSuccess else {
+            return false
+        }
+
+        var evaluationError: CFError?
+        let trusted = SecTrustEvaluateWithError(trust, &evaluationError)
+        if !trusted, let evaluationError {
+            let description = CFErrorCopyDescription(evaluationError) as String
+            print("Luma TLS trust failed for \(expectedDomain): \(description)")
+        }
+        return trusted
+    }
+}