upstream updates

Limelight/Crypto/CryptoManager.m

@@ -96,6 +96,7 @@ static NSData* p12 = nil;
     
     bio = BIO_new(BIO_s_mem());
     i2d_X509_bio(bio, x509);
+    X509_free(x509);
 
     BUF_MEM* mem;
     BIO_get_mem_ptr(bio, &mem);
@@ -222,6 +223,7 @@ static NSData* p12 = nil;
 + (NSData *)getSignatureFromCert:(NSData *)cert {
     BIO* bio = BIO_new_mem_buf([cert bytes], (int)[cert length]);
     X509* x509 = PEM_read_bio_X509(bio, NULL, NULL, NULL);
+    BIO_free(bio);
     
     if (!x509) {
         Log(LOG_E, @"Unable to parse certificate in memory!");

Limelight/Crypto/mkcert.c

@@ -63,21 +63,9 @@ void mkcert(X509 **x509p, EVP_PKEY **pkeyp, int bits, int serial, int years) {
 }
 
 struct CertKeyPair generateCertKeyPair(void) {
-    BIO *bio_err;
     X509 *x509 = NULL;
     EVP_PKEY *pkey = NULL;
     PKCS12 *p12 = NULL;
-    // OpenSSL3 has default algorithms that iOS refuses to load so we
-    // must load the legacy provider and override all the algorithms
-    // in this cert.
-
-    OSSL_PROVIDER *_legacy = OSSL_PROVIDER_try_load(NULL, "legacy", 1);
-
-    if (_legacy == NULL) {
-        printf("Failed to load Legacy provider\n");
-    }
-   
-    bio_err = BIO_new_fp(stderr, BIO_NOCLOSE);
     
     mkcert(&x509, &pkey, NUM_BITS, SERIAL, NUM_YEARS);
     
@@ -88,7 +76,7 @@ struct CertKeyPair generateCertKeyPair(void) {
                         x509,
                         NULL,
                         NID_pbe_WithSHA1And3_Key_TripleDES_CBC,
-                        NID_pbe_WithSHA1And40BitRC2_CBC,
+                        -1, // disable certificate encryption
                         2048,
                         -1, // disable the automatic MAC
                         0);
@@ -99,8 +87,6 @@ struct CertKeyPair generateCertKeyPair(void) {
         printf("Error generating a valid PKCS12 certificate.\n");
     }
     
-    BIO_free(bio_err);
-    
     return (CertKeyPair){x509, pkey, p12};
 }
 

Limelight/Network/HttpManager.m

@@ -23,20 +23,14 @@
 #define EXTRA_LONG_TIMEOUT_SEC 180
 
 @implementation HttpManager {
-    NSURLSession* _urlSession;
     NSString* _urlSafeHostName;
     NSString* _baseHTTPURL;
     NSString* _uniqueId;
     NSString* _deviceName;
     NSData* _serverCert;
-    NSMutableData* _respData;
-    NSData* _requestResp;
-    dispatch_semaphore_t _requestLock;
     
     TemporaryHost *_host; // May be nil
     NSString* _baseHTTPSURL;
-    
-    NSError* _error;
 }
 
 + (NSData*) fixXmlVersion:(NSData*) xmlData {
@@ -63,10 +57,6 @@
     _uniqueId = @"0123456789ABCDEF";
     _deviceName = deviceName;
     _serverCert = serverCert;
-    _requestLock = dispatch_semaphore_create(0);
-    _respData = [[NSMutableData alloc] init];
-    NSURLSessionConfiguration* config = [NSURLSessionConfiguration ephemeralSessionConfiguration];
-    _urlSession = [NSURLSession sessionWithConfiguration:config delegate:self delegateQueue:nil];
     
     NSString* address = [Utils addressPortStringToAddress:hostAddressPortString];
     unsigned short port = [Utils addressPortStringToPort:hostAddressPortString];
@@ -125,37 +115,40 @@
         
         return;
     }
-    
-    [_respData setLength:0];
-    _error = nil;
+
+    __block NSData* requestResp = nil;
+    __block NSError* respError = nil;
+    __block dispatch_semaphore_t requestLock = dispatch_semaphore_create(0);
     
     Log(LOG_D, @"Making Request: %@", request);
-    [[_urlSession dataTaskWithRequest:request.request completionHandler:^(NSData * __nullable data, NSURLResponse * __nullable response, NSError * __nullable error) {
+    NSURLSession* urlSession = [NSURLSession sessionWithConfiguration:[NSURLSessionConfiguration ephemeralSessionConfiguration] delegate:self delegateQueue:nil];
+    [[urlSession dataTaskWithRequest:request.request completionHandler:^(NSData * __nullable data, NSURLResponse * __nullable response, NSError * __nullable error) {
         
         if (error != NULL) {
             Log(LOG_D, @"Connection error: %@", error);
-            self->_error = error;
+            respError = error;
         }
         else {
             Log(LOG_D, @"Received response: %@", response);
 
             if (data != NULL) {
                 Log(LOG_D, @"\n\nReceived data: %@\n\n", [[NSString alloc] initWithData:data encoding:NSUTF8StringEncoding]);
-                [self->_respData appendData:data];
-                if ([[NSString alloc] initWithData:self->_respData encoding:NSUTF8StringEncoding] != nil) {
-                    self->_requestResp = [HttpManager fixXmlVersion:self->_respData];
+                if ([[NSString alloc] initWithData:data encoding:NSUTF8StringEncoding] != nil) {
+                    requestResp = [HttpManager fixXmlVersion:data];
                 } else {
-                    self->_requestResp = self->_respData;
+                    requestResp = data;
                 }
             }
         }
         
-        dispatch_semaphore_signal(self->_requestLock);
+        dispatch_semaphore_signal(requestLock);
     }] resume];
-    dispatch_semaphore_wait(_requestLock, DISPATCH_TIME_FOREVER);
     
-    if (!_error && request.response) {
-        [request.response populateWithData:_requestResp];
+    dispatch_semaphore_wait(requestLock, DISPATCH_TIME_FOREVER);
+    [urlSession invalidateAndCancel];
+    
+    if (!respError && request.response) {
+        [request.response populateWithData:requestResp];
         
         // If the fallback error code was detected, issue the fallback request
         if (request.response.statusCode == request.fallbackError && request.fallbackRequest != NULL) {
@@ -166,7 +159,7 @@
             [self executeRequestSynchronously:request];
         }
     }
-    else if (_error && [_error code] == NSURLErrorServerCertificateUntrusted) {
+    else if (respError && [respError code] == NSURLErrorServerCertificateUntrusted) {
         // We must have a pinned cert for HTTPS. If we fail, it must be due to
         // a non-matching cert, not because we had no cert at all.
         assert(_serverCert != nil);
@@ -181,9 +174,9 @@
             [self executeRequestSynchronously:request];
         }
     }
-    else if (_error && request.response) {
-        request.response.statusCode = [_error code];
-        request.response.statusMessage = [_error localizedDescription];
+    else if (respError && request.response) {
+        request.response.statusCode = [respError code];
+        request.response.statusMessage = [respError localizedDescription];
     }
 }
 
@@ -326,7 +319,7 @@
     
     SecIdentityCopyCertificate(identity, &certificate);
     
-    return [[NSArray alloc] initWithObjects:(__bridge id)certificate, nil];
+    return [[NSArray alloc] initWithObjects:(__bridge_transfer id)certificate, nil];
 }
 
 // Returns the identity
@@ -338,13 +331,14 @@
     const void *keys[] = { kSecImportExportPassphrase };
     const void *values[] = { password };
     CFDictionaryRef options = CFDictionaryCreate(NULL, keys, values, 1, NULL, NULL);
-    CFArrayRef items = CFArrayCreate(NULL, 0, 0, NULL);
+    CFArrayRef items = nil;
     OSStatus securityError = SecPKCS12Import(p12Data, options, &items);
 
     if (securityError == errSecSuccess) {
         //Log(LOG_D, @"Success opening p12 certificate. Items: %ld", CFArrayGetCount(items));
         CFDictionaryRef identityDict = CFArrayGetValueAtIndex(items, 0);
-        identityApp = (SecIdentityRef)CFDictionaryGetValue(identityDict, kSecImportItemIdentity);
+        identityApp = (SecIdentityRef)CFRetain(CFDictionaryGetValue(identityDict, kSecImportItemIdentity));
+        CFRelease(items);
     } else {
         Log(LOG_E, @"Error opening Certificate.");
     }
@@ -398,6 +392,7 @@
         SecIdentityRef identity = [self getClientCertificate];
         NSArray* certArray = [self getCertificate:identity];
         NSURLCredential* newCredential = [NSURLCredential credentialWithIdentity:identity certificates:certArray persistence:NSURLCredentialPersistencePermanent];
+        CFRelease(identity);
         completionHandler(NSURLSessionAuthChallengeUseCredential, newCredential);
     }
     else

Limelight/Stream/Connection.m

@@ -254,6 +254,9 @@ int ArInit(int audioConfiguration, POPUS_MULTISTREAM_CONFIGURATION opusConfig, v
     // Start playback
     SDL_PauseAudioDevice(audioDevice, 0);
     
+    // Disable lowering volume of other audio streams (SDL sets AVAudioSessionCategoryOptionDuckOthers by default)
+    [[AVAudioSession sharedInstance] setCategory:AVAudioSessionCategoryPlayback withOptions:AVAudioSessionCategoryOptionMixWithOthers error:nil];
+    
     return 0;
 }