`CertificateVerifier.verifyCertificateChain` on Android can cause `NetworkOnMainThreadException`

Open
  • Is something wrong?
#256 5 comments 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

  • #259 by @FrankenApps — closed without merging

Assessment

Difficulty
4/5
Estimated time
3-5 days
Newbie friendliness
48/100
Issue type
Bug
Clarity
Mostly clear
Activity status
Active
Tech stack
android, kotlin, rust
Domain
mobile-dev, security

Research direction

Start with CertificateVerifier.kt at the linked verifyCertificateChain implementation around line 182, then trace how rustls-platform-verifier-android 0.2.0 invokes it. Reproduce the revocation-check path that raises NetworkOnMainThreadException and inspect how results return to the Rust library. Done means certificate verification no longer performs network work on Android's main thread and still reports its result correctly.

Written by the indexing model from the issue text.

Description

bug O-Android

After migrating to 0.2.0 for the rustls-platform-verifier-android dependency in our project and adapting our code to it, we realised sometimes the certification verification failed with some Revoked errors and then after a while it fixed itself.

What we consistently saw in the logs were NetworkOnMainThreadException whenever this happened. It turns out the request was done by Rust in a different thread, but then the verification is done in the main thread. As that code under the hood opens URL connections, the Android system interprets that as a 'no network requests on main thread' rule violation and the revocation checks fail.

Could this verification step can be moved to a coroutine or a different thread and provide the results via a callback to the Rust library to ensure it never runs in the main thread?

Dominant language
Rust
Stars
162
Forks
67
Avg merge
5d 14h
Merged PRs (30d)
2

Getting set up

This project ships no dev container, Dockerfile or contributing guide, so setting up is up to you: start from its README, and see our first-contribution guide for the general steps.

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

More from rustls/rustls-platform-verifier

All issues in rustls/rustls-platform-verifier

Similar issues

More Rust issues

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.