fix(mobile): mtls on native clients

[mertalev]

Description

This PR updates the iOS native client to use mTLS and centralizes SSL configuration to import into the native keystore on both platforms, with changes being reflected in the existing session. Additionally, it makes user-installed certificates trusted on Android. It does not try to respect the "allow self-signed certificates" option as it complicates the code, is dangerous, unnecessary given the network security config change and was not working correctly anyway due to a reactivity issue. It still works for the Dart client, but will not do anything once everything is moved to native.

This code is extracted and adapted from a branch that also changes all requests to use these native clients; in the interest of making this a more incremental process and landing a fix for users sooner, it's best to first fix the native client as it's used today. The changes here were largely tested on that branch, but some changes were made to make it play nicely with the current Dart client setup.

Tested importing and removing the client cert on iOS and Android, logging in and viewing assets, as well as the added migration via upgrading from 2.4.1.

[mertalev]

cc @jfly, this PR doesn't move everything to native just yet, but it's basically all of the platform-side changes

[jfly]

Awesome! Is this worth test driving? IIUC, not yet, because there are still dart/flutter network stack calls?

[mertalev]

Awesome! Is this worth test driving? IIUC, not yet, because there are still dart/flutter network stack calls?

Nope, this one still won't work if you're on Android and rely on it trusting a user CA cert. Let me see if I can rebase my other branch on this one, which would be the complete version.

[mertalev]

Awesome! Is this worth test driving? IIUC, not yet, because there are still dart/flutter network stack calls?

feat/use-native-clients has the full client changes. I did some basic testing with it on both platforms by browsing and (foreground) uploading, but I haven't tested how it handles background tasks and websockets haven't been updated to use the native clients yet.

[jfly]

I had a heck of a time compiling the imimch mobile app for android. Probably a me problem:

$ flutter build apk --target-platform android-arm,android-arm64 --split-per-abi
...

FAILURE: Build failed with an exception.

* What went wrong:
A problem occurred configuring project ':jni'.
> com.android.builder.sdk.InstallFailedException: Failed to install the following SDK components:
      ndk;27.0.12077973 NDK (Side by side) 27.0.12077973
\

Not sure why we're trying to install version 27 of the ndk when this project is using v28. A hallucination machine claimed this could be due to a dependency needing v27 of the ndk. I have basically 0 experience with android/flutter dev, so I don't know how to judge that. I added this to the top of mobile/android/build.gradle and was able to get things to build:

subprojects {
    afterEvaluate { project ->
        if (project.hasProperty('android')) {
            project.android.ndkVersion = "28.2.13676358"
        }
    }
}

Supposedly, this causes us to ignore any ndk version constraints in our deps. Probably a bad idea. I mention this on the off chance it affects my testing at all.

I have a build now, I'll load it up on my phone and give it a shot!

[jfly]

feat/use-native-clients crashes for me:

Error in runInIsolateGentle  for remote-sync

ApiException 400: Exception occurred: GET /server/version (Inner exception: Exception in Java code called through JNI: java.lang.ClassNotFoundException: Didn't find class "okhttp3/Request$Builder" on path: DexPathList[[zip file "/data/app/~~dkdVhObR5ZU8_yJg7zDMVw==/app.alextran.immich-p_AqrBsmJqmA4jq7eP34xg==/base.apk"],nativeLibraryDirectories=[/data/app/~~dkdVhObR5ZU8_yJg7zDMVw==/app.alextran.immich-p_AqrBsmJqmA4jq7eP34xg==/lib/arm64, /data/app/~~dkdVhObR5ZU8_yJg7zDMVw==/app.alextran.immich-p_AqrBsmJqmA4jq7eP34xg==/base.apk!/lib/arm64-v8a, /system/lib64, /system_ext/lib64]]

java.lang.ClassNotFoundException: Didn't find class "okhttp3/Request$Builder" on path: DexPathList[[zip file "/data/app/~~dkdVhObR5ZU8_yJg7zDMVw==/app.alextran.immich-p_AqrBsmJqmA4jq7eP34xg==/base.apk"],nativeLibraryDirectories=[/data/app/~~dkdVhObR5ZU8_yJg7zDMVw==/app.alextran.immich-p_AqrBsmJqmA4jq7eP34xg==/lib/arm64, /data/app/~~dkdVhObR5ZU8_yJg7zDMVw==/app.alextran.immich-p_AqrBsmJqmA4jq7eP34xg==/base.apk!/lib/arm64-v8a, /system/lib64, /system_ext/lib64]]
	at dalvik.system.BaseDexClassLoader.findClass(BaseDexClassLoader.java:259)
	at java.lang.ClassLoader.loadClass(ClassLoader.java:642)
	at java.lang.ClassLoader.loadClass(ClassLoader.java:578)

)

#0      Jni.throwException (package:jni/src/jni.dart:195)
#1      _check (package:jni/src/accessors.dart:17)
#2      JniClassLookupResultMethods.checkedClassRef (package:jni/src/accessors.dart:110)
#3      Jni.findClass (package:jni/src/jni.dart:181)
#4      new JClass.forName (package:jni/src/jclass.dart:17)
#5      Request$Builder._class (package:ok_http/src/jni/bindings.dart:52)
#6      new Request$Builder (package:ok_http/src/jni/bindings.dart)
#7      OkHttpClient.send (package:ok_http/src/ok_http_client.dart:431)
<asynchronous suspension>
#8      BaseClient._sendUnstreamed (package:http/src/base_client.dart:93)
<asynchronous suspension>
#9      ApiClient.invokeAPI (package:openapi/api_client.dart:101)
<asynchronous suspension>
#10     ServerApi.getServerVersion (package:openapi/api/server_api.dart:381)
<asynchronous suspension>
#11     SyncStreamService.sync (package:immich_mobile/domain/services/sync_stream.service.dart:65)
<asynchronous suspension>
#12     runInIsolateGentle.<anonymous closure>.<anonymous closure> (package:immich_mobile/utils/isolate.dart:56)
<asynchronous suspension>
#13     runInIsolateGentle.<anonymous closure> (package:immich_mobile/utils/isolate.dart:36)
<asynchronous suspension>
#14     WorkerImpl._anotherIsolate.<anonymous closure> (package:worker_manager/src/worker/worker_io.dart:106)
<asynchronous suspension>

[mertalev]

Well that's odd! As a sanity check, could you run flutter clean cache? Also, is this a debug build or a release build?

[mertalev]

@jfly I found and fixed the reason for the crash and made PR #25942 now that the other changes have been merged.