OLD | NEW |
1 // Copyright (c) 2012, the Dart project authors. Please see the AUTHORS file | 1 // Copyright (c) 2012, the Dart project authors. Please see the AUTHORS file |
2 // for details. All rights reserved. Use of this source code is governed by a | 2 // for details. All rights reserved. Use of this source code is governed by a |
3 // BSD-style license that can be found in the LICENSE file. | 3 // BSD-style license that can be found in the LICENSE file. |
4 | 4 |
5 #if !defined(DART_IO_DISABLED) && !defined(DART_IO_SECURE_SOCKET_DISABLED) | 5 #if !defined(DART_IO_DISABLED) && !defined(DART_IO_SECURE_SOCKET_DISABLED) |
6 | 6 |
7 #include "platform/globals.h" | 7 #include "platform/globals.h" |
8 #if defined(TARGET_OS_ANDROID) || defined(TARGET_OS_LINUX) || \ | 8 #if defined(HOST_OS_ANDROID) || defined(HOST_OS_LINUX) || \ |
9 defined(TARGET_OS_WINDOWS) || defined(TARGET_OS_FUCHSIA) | 9 defined(HOST_OS_WINDOWS) || defined(HOST_OS_FUCHSIA) |
10 | 10 |
11 #include "bin/secure_socket.h" | 11 #include "bin/secure_socket.h" |
12 #include "bin/secure_socket_boringssl.h" | 12 #include "bin/secure_socket_boringssl.h" |
13 | 13 |
14 #include <errno.h> | 14 #include <errno.h> |
15 #include <fcntl.h> | 15 #include <fcntl.h> |
16 #include <stdarg.h> | 16 #include <stdarg.h> |
17 #include <stdio.h> | 17 #include <stdio.h> |
18 #include <string.h> | 18 #include <string.h> |
19 #include <sys/stat.h> | 19 #include <sys/stat.h> |
(...skipping 845 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... |
865 if (commandline_root_certs_file != NULL) { | 865 if (commandline_root_certs_file != NULL) { |
866 LoadRootCertFile(context, commandline_root_certs_file); | 866 LoadRootCertFile(context, commandline_root_certs_file); |
867 return; | 867 return; |
868 } | 868 } |
869 | 869 |
870 if (commandline_root_certs_cache != NULL) { | 870 if (commandline_root_certs_cache != NULL) { |
871 LoadRootCertCache(context, commandline_root_certs_cache); | 871 LoadRootCertCache(context, commandline_root_certs_cache); |
872 return; | 872 return; |
873 } | 873 } |
874 | 874 |
875 #if defined(TARGET_OS_ANDROID) | 875 #if defined(HOST_OS_ANDROID) |
876 // On Android, we don't compile in the trusted root certificates. Insead, | 876 // On Android, we don't compile in the trusted root certificates. Insead, |
877 // we use the directory of trusted certificates already present on the device. | 877 // we use the directory of trusted certificates already present on the device. |
878 // This saves ~240KB from the size of the binary. This has the drawback that | 878 // This saves ~240KB from the size of the binary. This has the drawback that |
879 // SSL_do_handshake will synchronously hit the filesystem looking for root | 879 // SSL_do_handshake will synchronously hit the filesystem looking for root |
880 // certs during its trust evaluation. We call SSL_do_handshake directly from | 880 // certs during its trust evaluation. We call SSL_do_handshake directly from |
881 // the Dart thread so that Dart code can be invoked from the "bad certificate" | 881 // the Dart thread so that Dart code can be invoked from the "bad certificate" |
882 // callback called by SSL_do_handshake. | 882 // callback called by SSL_do_handshake. |
883 const char* android_cacerts = "/system/etc/security/cacerts"; | 883 const char* android_cacerts = "/system/etc/security/cacerts"; |
884 LoadRootCertCache(context, android_cacerts); | 884 LoadRootCertCache(context, android_cacerts); |
885 return; | 885 return; |
886 #elif defined(TARGET_OS_LINUX) | 886 #elif defined(HOST_OS_LINUX) |
887 // On Linux, we use the compiled-in trusted certs as a last resort. First, | 887 // On Linux, we use the compiled-in trusted certs as a last resort. First, |
888 // we try to find the trusted certs in various standard locations. A good | 888 // we try to find the trusted certs in various standard locations. A good |
889 // discussion of the complexities of this endeavor can be found here: | 889 // discussion of the complexities of this endeavor can be found here: |
890 // | 890 // |
891 // https://www.happyassassin.net/2015/01/12/a-note-about-ssltls-trusted-certif
icate-stores-and-platforms/ | 891 // https://www.happyassassin.net/2015/01/12/a-note-about-ssltls-trusted-certif
icate-stores-and-platforms/ |
892 const char* bundle = "/etc/pki/tls/certs/ca-bundle.crt"; | 892 const char* bundle = "/etc/pki/tls/certs/ca-bundle.crt"; |
893 const char* cachedir = "/etc/ssl/certs"; | 893 const char* cachedir = "/etc/ssl/certs"; |
894 if (File::Exists(bundle)) { | 894 if (File::Exists(bundle)) { |
895 LoadRootCertFile(context, bundle); | 895 LoadRootCertFile(context, bundle); |
896 return; | 896 return; |
897 } | 897 } |
898 | 898 |
899 if (Directory::Exists(cachedir) == Directory::EXISTS) { | 899 if (Directory::Exists(cachedir) == Directory::EXISTS) { |
900 LoadRootCertCache(context, cachedir); | 900 LoadRootCertCache(context, cachedir); |
901 return; | 901 return; |
902 } | 902 } |
903 #endif // defined(TARGET_OS_ANDROID) | 903 #endif // defined(HOST_OS_ANDROID) |
904 | 904 |
905 // Fall back on the compiled-in certs if the standard locations don't exist, | 905 // Fall back on the compiled-in certs if the standard locations don't exist, |
906 // or we aren't on Linux. | 906 // or we aren't on Linux. |
907 if (SSL_LOG_STATUS) { | 907 if (SSL_LOG_STATUS) { |
908 Log::Print("Trusting compiled-in roots\n"); | 908 Log::Print("Trusting compiled-in roots\n"); |
909 } | 909 } |
910 AddCompiledInCerts(context); | 910 AddCompiledInCerts(context); |
911 } | 911 } |
912 | 912 |
913 | 913 |
(...skipping 878 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... |
1792 Log::Print("WriteEncrypted BIO_read wrote %d bytes\n", | 1792 Log::Print("WriteEncrypted BIO_read wrote %d bytes\n", |
1793 bytes_processed); | 1793 bytes_processed); |
1794 } | 1794 } |
1795 } | 1795 } |
1796 return bytes_processed; | 1796 return bytes_processed; |
1797 } | 1797 } |
1798 | 1798 |
1799 } // namespace bin | 1799 } // namespace bin |
1800 } // namespace dart | 1800 } // namespace dart |
1801 | 1801 |
1802 #endif // defined(TARGET_OS_LINUX) | 1802 #endif // defined(HOST_OS_LINUX) |
1803 | 1803 |
1804 #endif // !defined(DART_IO_DISABLED) && | 1804 #endif // !defined(DART_IO_DISABLED) && |
1805 // !defined(DART_IO_SECURE_SOCKET_DISABLED) | 1805 // !defined(DART_IO_SECURE_SOCKET_DISABLED) |
OLD | NEW |