| OLD | NEW |
| 1 // Copyright (c) 2012, the Dart project authors. Please see the AUTHORS file | 1 // Copyright (c) 2012, the Dart project authors. Please see the AUTHORS file |
| 2 // for details. All rights reserved. Use of this source code is governed by a | 2 // for details. All rights reserved. Use of this source code is governed by a |
| 3 // BSD-style license that can be found in the LICENSE file. | 3 // BSD-style license that can be found in the LICENSE file. |
| 4 | 4 |
| 5 #if !defined(DART_IO_DISABLED) && !defined(DART_IO_SECURE_SOCKET_DISABLED) | 5 #if !defined(DART_IO_DISABLED) && !defined(DART_IO_SECURE_SOCKET_DISABLED) |
| 6 | 6 |
| 7 #include "platform/globals.h" | 7 #include "platform/globals.h" |
| 8 #if defined(TARGET_OS_ANDROID) || defined(TARGET_OS_LINUX) || \ | 8 #if defined(HOST_OS_ANDROID) || defined(HOST_OS_LINUX) || \ |
| 9 defined(TARGET_OS_WINDOWS) || defined(TARGET_OS_FUCHSIA) | 9 defined(HOST_OS_WINDOWS) || defined(HOST_OS_FUCHSIA) |
| 10 | 10 |
| 11 #include "bin/secure_socket.h" | 11 #include "bin/secure_socket.h" |
| 12 #include "bin/secure_socket_boringssl.h" | 12 #include "bin/secure_socket_boringssl.h" |
| 13 | 13 |
| 14 #include <errno.h> | 14 #include <errno.h> |
| 15 #include <fcntl.h> | 15 #include <fcntl.h> |
| 16 #include <stdarg.h> | 16 #include <stdarg.h> |
| 17 #include <stdio.h> | 17 #include <stdio.h> |
| 18 #include <string.h> | 18 #include <string.h> |
| 19 #include <sys/stat.h> | 19 #include <sys/stat.h> |
| (...skipping 845 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... |
| 865 if (commandline_root_certs_file != NULL) { | 865 if (commandline_root_certs_file != NULL) { |
| 866 LoadRootCertFile(context, commandline_root_certs_file); | 866 LoadRootCertFile(context, commandline_root_certs_file); |
| 867 return; | 867 return; |
| 868 } | 868 } |
| 869 | 869 |
| 870 if (commandline_root_certs_cache != NULL) { | 870 if (commandline_root_certs_cache != NULL) { |
| 871 LoadRootCertCache(context, commandline_root_certs_cache); | 871 LoadRootCertCache(context, commandline_root_certs_cache); |
| 872 return; | 872 return; |
| 873 } | 873 } |
| 874 | 874 |
| 875 #if defined(TARGET_OS_ANDROID) | 875 #if defined(HOST_OS_ANDROID) |
| 876 // On Android, we don't compile in the trusted root certificates. Insead, | 876 // On Android, we don't compile in the trusted root certificates. Insead, |
| 877 // we use the directory of trusted certificates already present on the device. | 877 // we use the directory of trusted certificates already present on the device. |
| 878 // This saves ~240KB from the size of the binary. This has the drawback that | 878 // This saves ~240KB from the size of the binary. This has the drawback that |
| 879 // SSL_do_handshake will synchronously hit the filesystem looking for root | 879 // SSL_do_handshake will synchronously hit the filesystem looking for root |
| 880 // certs during its trust evaluation. We call SSL_do_handshake directly from | 880 // certs during its trust evaluation. We call SSL_do_handshake directly from |
| 881 // the Dart thread so that Dart code can be invoked from the "bad certificate" | 881 // the Dart thread so that Dart code can be invoked from the "bad certificate" |
| 882 // callback called by SSL_do_handshake. | 882 // callback called by SSL_do_handshake. |
| 883 const char* android_cacerts = "/system/etc/security/cacerts"; | 883 const char* android_cacerts = "/system/etc/security/cacerts"; |
| 884 LoadRootCertCache(context, android_cacerts); | 884 LoadRootCertCache(context, android_cacerts); |
| 885 return; | 885 return; |
| 886 #elif defined(TARGET_OS_LINUX) | 886 #elif defined(HOST_OS_LINUX) |
| 887 // On Linux, we use the compiled-in trusted certs as a last resort. First, | 887 // On Linux, we use the compiled-in trusted certs as a last resort. First, |
| 888 // we try to find the trusted certs in various standard locations. A good | 888 // we try to find the trusted certs in various standard locations. A good |
| 889 // discussion of the complexities of this endeavor can be found here: | 889 // discussion of the complexities of this endeavor can be found here: |
| 890 // | 890 // |
| 891 // https://www.happyassassin.net/2015/01/12/a-note-about-ssltls-trusted-certif
icate-stores-and-platforms/ | 891 // https://www.happyassassin.net/2015/01/12/a-note-about-ssltls-trusted-certif
icate-stores-and-platforms/ |
| 892 const char* bundle = "/etc/pki/tls/certs/ca-bundle.crt"; | 892 const char* bundle = "/etc/pki/tls/certs/ca-bundle.crt"; |
| 893 const char* cachedir = "/etc/ssl/certs"; | 893 const char* cachedir = "/etc/ssl/certs"; |
| 894 if (File::Exists(bundle)) { | 894 if (File::Exists(bundle)) { |
| 895 LoadRootCertFile(context, bundle); | 895 LoadRootCertFile(context, bundle); |
| 896 return; | 896 return; |
| 897 } | 897 } |
| 898 | 898 |
| 899 if (Directory::Exists(cachedir) == Directory::EXISTS) { | 899 if (Directory::Exists(cachedir) == Directory::EXISTS) { |
| 900 LoadRootCertCache(context, cachedir); | 900 LoadRootCertCache(context, cachedir); |
| 901 return; | 901 return; |
| 902 } | 902 } |
| 903 #endif // defined(TARGET_OS_ANDROID) | 903 #endif // defined(HOST_OS_ANDROID) |
| 904 | 904 |
| 905 // Fall back on the compiled-in certs if the standard locations don't exist, | 905 // Fall back on the compiled-in certs if the standard locations don't exist, |
| 906 // or we aren't on Linux. | 906 // or we aren't on Linux. |
| 907 if (SSL_LOG_STATUS) { | 907 if (SSL_LOG_STATUS) { |
| 908 Log::Print("Trusting compiled-in roots\n"); | 908 Log::Print("Trusting compiled-in roots\n"); |
| 909 } | 909 } |
| 910 AddCompiledInCerts(context); | 910 AddCompiledInCerts(context); |
| 911 } | 911 } |
| 912 | 912 |
| 913 | 913 |
| (...skipping 878 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... |
| 1792 Log::Print("WriteEncrypted BIO_read wrote %d bytes\n", | 1792 Log::Print("WriteEncrypted BIO_read wrote %d bytes\n", |
| 1793 bytes_processed); | 1793 bytes_processed); |
| 1794 } | 1794 } |
| 1795 } | 1795 } |
| 1796 return bytes_processed; | 1796 return bytes_processed; |
| 1797 } | 1797 } |
| 1798 | 1798 |
| 1799 } // namespace bin | 1799 } // namespace bin |
| 1800 } // namespace dart | 1800 } // namespace dart |
| 1801 | 1801 |
| 1802 #endif // defined(TARGET_OS_LINUX) | 1802 #endif // defined(HOST_OS_LINUX) |
| 1803 | 1803 |
| 1804 #endif // !defined(DART_IO_DISABLED) && | 1804 #endif // !defined(DART_IO_DISABLED) && |
| 1805 // !defined(DART_IO_SECURE_SOCKET_DISABLED) | 1805 // !defined(DART_IO_SECURE_SOCKET_DISABLED) |
| OLD | NEW |