1// Copyright (c) 2017, the Dart project authors. Please see the AUTHORS file
2// for details. All rights reserved. Use of this source code is governed by a
3// BSD-style license that can be found in the LICENSE file.
4
5#if !defined(DART_IO_SECURE_SOCKET_DISABLED)
6
7#include "platform/globals.h"
8#if defined(HOST_OS_LINUX)
9
10#include "bin/security_context.h"
11
12#include <openssl/bio.h>
13#include <openssl/ssl.h>
14#include <openssl/x509.h>
15
16#include "bin/directory.h"
17#include "bin/file.h"
18#include "bin/secure_socket_filter.h"
19#include "bin/secure_socket_utils.h"
20#include "platform/syslog.h"
21
22namespace dart {
23namespace bin {
24
25// The security context won't necessarily use the compiled-in root certificates,
26// but since there is no way to update the size of the allocation after creating
27// the weak persistent handle, we assume that it will. Note that when the
28// root certs aren't compiled in, |root_certificates_pem_length| is 0.
29const intptr_t SSLCertContext::kApproximateSize =
30 sizeof(SSLCertContext) + root_certificates_pem_length;
31
32void SSLCertContext::TrustBuiltinRoots() {
33 // First, try to use locations specified on the command line.
34 if (root_certs_file() != NULL) {
35 LoadRootCertFile(root_certs_file());
36 return;
37 }
38 if (root_certs_cache() != NULL) {
39 LoadRootCertCache(root_certs_cache());
40 return;
41 }
42
43 // On Linux, we use the compiled-in trusted certs as a last resort. First,
44 // we try to find the trusted certs in various standard locations. A good
45 // discussion of the complexities of this endeavor can be found here:
46 //
47 // https://www.happyassassin.net/2015/01/12/a-note-about-ssltls-trusted-certificate-stores-and-platforms/
48 const char* bundle = "/etc/pki/tls/certs/ca-bundle.crt";
49 const char* cachedir = "/etc/ssl/certs";
50 if (File::Exists(NULL, bundle)) {
51 LoadRootCertFile(bundle);
52 return;
53 }
54
55 if (Directory::Exists(NULL, cachedir) == Directory::EXISTS) {
56 LoadRootCertCache(cachedir);
57 return;
58 }
59
60 // Fall back on the compiled-in certs if the standard locations don't exist,
61 // or we aren't on Linux.
62 if (SSL_LOG_STATUS) {
63 Syslog::Print("Trusting compiled-in roots\n");
64 }
65 AddCompiledInCerts();
66}
67
68void SSLCertContext::RegisterCallbacks(SSL* ssl) {
69 // No callbacks to register for implementations using BoringSSL's built-in
70 // verification mechanism.
71}
72
73} // namespace bin
74} // namespace dart
75
76#endif // defined(HOST_OS_LINUX)
77
78#endif // !defined(DART_IO_SECURE_SOCKET_DISABLED)
79