Commit Graph

35 Commits

Author SHA1 Message Date
Ryan Macnak 53733077b2 Revert "[standalone] Remove the fallback root certificates."
This reverts commit 039aef728a.

Reason for revert: b/515601247

Original change's description:
> [standalone] Remove the fallback root certificates.
>
> The discovery of the system root certificates is more robust after 2142d8e148.
>
> TEST=ci
> Change-Id: I8215cb92f98e620b82f21261c13e061a2b488b5d
> Reviewed-on: https://dart-review.googlesource.com/c/sdk/+/433923
> Reviewed-by: Slava Egorov <vegorov@google.com>
> Commit-Queue: Ryan Macnak <rmacnak@google.com>

TEST=ci
Change-Id: Ib07de221ff1160461d930f7165a7cd8179b4e3f3
Reviewed-on: https://dart-review.googlesource.com/c/sdk/+/506100
Commit-Queue: Ryan Macnak <rmacnak@google.com>
Reviewed-by: Samuel Rawlins <srawlins@google.com>
2026-05-26 07:49:52 -07:00
Ryan Macnak 039aef728a [standalone] Remove the fallback root certificates.
The discovery of the system root certificates is more robust after 2142d8e148.

TEST=ci
Change-Id: I8215cb92f98e620b82f21261c13e061a2b488b5d
Reviewed-on: https://dart-review.googlesource.com/c/sdk/+/433923
Reviewed-by: Slava Egorov <vegorov@google.com>
Commit-Queue: Ryan Macnak <rmacnak@google.com>
2026-05-19 11:20:48 -07:00
Slava Egorov dec87b98f0 [io] Provide dart::bin::SetupDartIoLibrary
Instead of requiring embedder to initialize dart:io by bits and pieces
by invoking various hooks and setting fields provide a structured C++
API for preparing dart:io for execution.

TEST=ci

CoreLibraryReviewExempt: VM specific changes only
Change-Id: I66e95c0a451d384b4f7582d1df059e506a6a6964
Reviewed-on: https://dart-review.googlesource.com/c/sdk/+/454062
Reviewed-by: Ryan Macnak <rmacnak@google.com>
Commit-Queue: Slava Egorov <vegorov@google.com>
2025-10-14 13:15:21 -07:00
Brian Quinlan 496b3e65f3 Support setting the minimum acceptable TLS version.
Change-Id: I24775461fb690abdd0a47c5b4e23776c9fe5bfe0
Bug: https://github.com/dart-lang/sdk/issues/54901
Tested: TLS traffic verified in Wireshark, exception behavior verified with a Python test server, property changes verified by unit test
CoreLibraryReviewExempt: dart:io only
Reviewed-on: https://dart-review.googlesource.com/c/sdk/+/365664
Reviewed-by: Brian Quinlan <bquinlan@google.com>
Commit-Queue: Brian Quinlan <bquinlan@google.com>
Reviewed-by: Lasse Nielsen <lrn@google.com>
2024-07-01 21:00:00 +00:00
Alexander Aprelev 34484719ca [io/ssl] Better error message when security context private key is missing.
Fixes https://github.com/dart-lang/sdk/issues/54719
TEST=standalone/io/security_context_no_private_key_test.dart

Change-Id: I6619b845a9cad8913efc00fc4f012bd87b27796a
Reviewed-on: https://dart-review.googlesource.com/c/sdk/+/348720
Commit-Queue: Alexander Aprelev <aam@google.com>
Reviewed-by: Siva Annamalai <asiva@google.com>
2024-01-26 20:49:09 +00:00
Ryan Macnak b68351fbc3 [vm] Update NULL to nullptr in runtime/bin.
TEST=build
Change-Id: Ie3be570c274b0275a995a0f54b5e6ccdfc77ccd3
Reviewed-on: https://dart-review.googlesource.com/c/sdk/+/292287
Commit-Queue: Ryan Macnak <rmacnak@google.com>
Reviewed-by: Brian Quinlan <bquinlan@google.com>
2023-04-12 01:11:05 +00:00
Brian Quinlan c286b76c2d Allow sockets to enable TLS renegotiation.
TESTED=unit + manually tested user issue.
Bug: https://github.com/dart-lang/sdk/issues/47841
Change-Id: Iad13899135fd34f15abba3a499132d88e7f597dc
Reviewed-on: https://dart-review.googlesource.com/c/sdk/+/234821
Reviewed-by: Alexander Aprelev <aam@google.com>
Commit-Queue: Brian Quinlan <bquinlan@google.com>
2022-03-31 06:40:51 +00:00
Brian Quinlan 917ae52f70 Add the ability to log TLS keys.
TEST=unit tests
Bug: https://github.com/dart-lang/sdk/issues/47838
Change-Id: I8a64e8623022215cae261eadb25b22deb9f3d910
Reviewed-on: https://dart-review.googlesource.com/c/sdk/+/231330
Reviewed-by: Alexander Aprelev <aam@google.com>
Commit-Queue: Brian Quinlan <bquinlan@google.com>
2022-02-17 21:39:31 +00:00
Ahmed Ashour d041cf0478 Remove extra the, be and of
Fixes #https://github.com/dart-lang/sdk/issues/47504

TEST=No tests needed, only comments affected.

Change-Id: Ie096307b5ce314d328fea6780f396aaa226ad3b0
Reviewed-on: https://dart-review.googlesource.com/c/sdk/+/216182
Reviewed-by: Lasse R.H. Nielsen <lrn@google.com>
Commit-Queue: Lasse R.H. Nielsen <lrn@google.com>
2021-10-20 09:29:01 +00:00
David Benjamin 3d73ae1c22 Replace old M_ASN1_* macros with their functions
M_ASN1_* is an old quirk from a very very old OpenSSL. They're just
wrappers over identically-named functions at this point.

Bug: none
TEST=ci
Change-Id: I1a204d6c1cca62861d7f11bf3c7adfa24bd47e59
Reviewed-on: https://dart-review.googlesource.com/c/sdk/+/217040
Reviewed-by: Alexander Aprelev <aam@google.com>
Commit-Queue: Alexander Aprelev <aam@google.com>
Auto-Submit: David Benjamin <davidben@google.com>
2021-10-18 14:48:39 +00:00
Loganaden Velvindron 8062c4cc67 Switch to TLS 1.2 as minimum requirement
According to https://tools.ietf.org/id/draft-ietf-tls-oldversions-deprecate-06.txt

TEST=Not applicable, config change.

Closes https://github.com/dart-lang/sdk/pull/41135
https://github.com/dart-lang/sdk/pull/41135

GitOrigin-RevId: e1dc037c1e22996b2085e3d16427525c033bdc01
Change-Id: Ic8340eee7fa26846302727672ca7989ce1e93c99
Reviewed-on: https://dart-review.googlesource.com/c/sdk/+/140481
Commit-Queue: Michael Thomsen <mit@google.com>
Reviewed-by: Siva Annamalai <asiva@google.com>
2021-10-04 09:51:38 +00:00
David Benjamin e8e0a39464 Estimate the overhead of an X509 object without sizeof
To unblock optimizations in hopes of reducing the overhead, we're
planning to make X509 opaque in BoringSSL. This aligns with upstream
OpenSSL, which has made most of these structs opaque.

Instead, use an estimate. The sizeof-based estimate was undercounting
the overhead anyway because there are many structures underneath X509,
some of which are already opaque. I just rounded sizeof(X509) +
sizeof(X509_CINF) up.

(Even this is likely still undercounting it because X509 objects are
very malloc-heavy and duplicate large chunks of the certificate. They're
not a very efficient representation and can't be made efficient without
first hiding the structs. In Chrome, we stopped using them altogether
and just retain the byte string, parsing as needed.)

TEST=ci

Change-Id: Icdc729ceba7eadf002bec5e080fc3e0adf7c4b56
Reviewed-on: https://dart-review.googlesource.com/c/sdk/+/209920
Reviewed-by: Alexander Aprelev <aam@google.com>
Commit-Queue: Alexander Aprelev <aam@google.com>
Auto-Submit: David Benjamin <davidben@google.com>
2021-08-11 16:41:41 +00:00
Alexander Aprelev bc2cf88bac [io/ssl] Add an option to bypass trusting system cert roots.
Fixes https://github.com/dart-lang/sdk/issues/45912

TEST=manually remove root certificate for pub.dev, confirm that dart is not able to establish https connection in default configuration to pub.dev, confirm that it can connect with the flag.

Change-Id: I51af7994d7cd7371a17877844dc1bf39cd5e54ca
Reviewed-on: https://dart-review.googlesource.com/c/sdk/+/198442
Commit-Queue: Alexander Aprelev <aam@google.com>
Reviewed-by: Zach Anderson <zra@google.com>
2021-05-06 02:46:02 +00:00
Alexander Aprelev 340f78eab3 [vm/io] Add a test for nonblocking ssl certification evaluation.
This is follow-up to a6dafabb88.

Fixes https://github.com/dart-lang/sdk/issues/43674

Change-Id: I4da732ab08235a1f549d45c7fa5fb87db672e2aa
Reviewed-on: https://dart-review.googlesource.com/c/sdk/+/166701
Commit-Queue: Alexander Aprelev <aam@google.com>
Reviewed-by: Siva Annamalai <asiva@google.com>
2020-10-12 15:06:52 +00:00
Daco Harkes 202e32afeb [vm] Native API: Introduce Dart_FinalizableHandle
Introduces Dart_NewFinalizableHandle which does auto delete itself,
but does not allow accessing the weak referenced object.

Issue: https://github.com/dart-lang/sdk/issues/42312

Change-Id: I24ea732925122c453213c4fa3f629761c352f838
Cq-Include-Trybots:dart/try:vm-ffi-android-debug-arm-try,vm-ffi-android-debug-arm64-try,app-kernel-linux-debug-x64-try,vm-kernel-linux-debug-ia32-try,vm-kernel-win-debug-x64-try,vm-kernel-win-debug-ia32-try,vm-kernel-precomp-linux-debug-x64-try,vm-dartkb-linux-release-x64-abi-try,vm-kernel-precomp-android-release-arm64-try,vm-kernel-asan-linux-release-x64-try,vm-kernel-msan-linux-release-x64-try,vm-kernel-precomp-msan-linux-release-x64-try,vm-kernel-linux-release-simarm-try,vm-kernel-linux-release-simarm64-try,vm-kernel-precomp-android-release-arm_x64-try,vm-kernel-precomp-obfuscate-linux-release-x64-try,dart-sdk-linux-try,analyzer-analysis-server-linux-try,analyzer-linux-release-try,front-end-linux-release-x64-try,vm-kernel-precomp-win-release-x64-try,vm-kernel-mac-debug-x64-try,vm-precomp-ffi-qemu-linux-release-arm-try,vm-kernel-nnbd-linux-debug-x64-try,analyzer-nnbd-linux-release-try,front-end-nnbd-linux-release-x64-try
Reviewed-on: https://dart-review.googlesource.com/c/sdk/+/154695
Reviewed-by: Ryan Macnak <rmacnak@google.com>
Reviewed-by: Martin Kustermann <kustermann@google.com>
2020-07-23 11:30:39 +00:00
Ryan Macnak 635c47b1c9 Reland "Update BoringSSL to 4dfd5af70191b068aebe567b8e29ce108cee85ce."
This reverts commit 7eeaeade6b.

Change-Id: I6e2d9f5b3f9a43b70db321d15c81e568857f303e
Reviewed-on: https://dart-review.googlesource.com/c/sdk/+/122488
Reviewed-by: Alexander Aprelev <aam@google.com>
Reviewed-by: Jonas Termansen <sortie@google.com>
Commit-Queue: Ryan Macnak <rmacnak@google.com>
2019-10-23 18:08:16 +00:00
Siva Annamalai e1c409792c Revert "Reland "Update BoringSSL to 4dfd5af70191b068aebe567b8e29ce108cee85ce.""
This reverts commit 7eeaeade6b.

Reason for revert: This change requires some changes to he Flutter license script before it can be rolled into Flutter, Since changes on the Dart side are mounting up I am reverting this change so the roll can move forward and then we will reland this change with the right fixes to the license checking script.

Original change's description:
> Reland "Update BoringSSL to 4dfd5af70191b068aebe567b8e29ce108cee85ce."
> 
> Change-Id: I7bdc0f0d55af2ecced789f1aa8f37b804641eaf4
> Reviewed-on: https://dart-review.googlesource.com/c/sdk/+/121887
> Reviewed-by: Jonas Termansen <sortie@google.com>
> Commit-Queue: Ryan Macnak <rmacnak@google.com>

TBR=sortie@google.com,rmacnak@google.com

# Not skipping CQ checks because original CL landed > 1 day ago.

Change-Id: I548844e9d58559e6ed5796dff08f3ab0644c6dc2
Reviewed-on: https://dart-review.googlesource.com/c/sdk/+/122410
Reviewed-by: Siva Annamalai <asiva@google.com>
Commit-Queue: Siva Annamalai <asiva@google.com>
2019-10-22 05:54:53 +00:00
Ryan Macnak 7eeaeade6b Reland "Update BoringSSL to 4dfd5af70191b068aebe567b8e29ce108cee85ce."
Change-Id: I7bdc0f0d55af2ecced789f1aa8f37b804641eaf4
Reviewed-on: https://dart-review.googlesource.com/c/sdk/+/121887
Reviewed-by: Jonas Termansen <sortie@google.com>
Commit-Queue: Ryan Macnak <rmacnak@google.com>
2019-10-17 15:39:40 +00:00
Ryan Macnak 7305ae6c35 Revert "Update BoringSSL to 4dfd5af70191b068aebe567b8e29ce108cee85ce."
This reverts commit 93f1324449.

Reason for revert: asm build failure for ia32 mac (e.g., simarm)

Original change's description:
> Update BoringSSL to 4dfd5af70191b068aebe567b8e29ce108cee85ce.
> 
> Update usage of PKCS12_parse to PKCS12_get_key_and_certs, since the former changed behavior when the PKCS12 has no private key.
> 
> Change-Id: I040c1a17e2994ac66cf03ad1efa80e423136cdbd
> Reviewed-on: https://dart-review.googlesource.com/c/sdk/+/116828
> Reviewed-by: Jonas Termansen <sortie@google.com>
> Reviewed-by: Zach Anderson <zra@google.com>
> Commit-Queue: Ryan Macnak <rmacnak@google.com>

TBR=sortie@google.com,rmacnak@google.com,zra@google.com

Change-Id: I85e9c4e5bd457b72c7df4986a127c169329c178c
No-Presubmit: true
No-Tree-Checks: true
No-Try: true
Reviewed-on: https://dart-review.googlesource.com/c/sdk/+/117921
Reviewed-by: Ryan Macnak <rmacnak@google.com>
Commit-Queue: Ryan Macnak <rmacnak@google.com>
2019-09-18 21:38:18 +00:00
Ryan Macnak 93f1324449 Update BoringSSL to 4dfd5af70191b068aebe567b8e29ce108cee85ce.
Update usage of PKCS12_parse to PKCS12_get_key_and_certs, since the former changed behavior when the PKCS12 has no private key.

Change-Id: I040c1a17e2994ac66cf03ad1efa80e423136cdbd
Reviewed-on: https://dart-review.googlesource.com/c/sdk/+/116828
Reviewed-by: Jonas Termansen <sortie@google.com>
Reviewed-by: Zach Anderson <zra@google.com>
Commit-Queue: Ryan Macnak <rmacnak@google.com>
2019-09-18 20:02:10 +00:00
Martin Kustermann a64b06ec83 [gardening] Migrate most files to be implicit-bool-conversion free
Issue https://dart-review.googlesource.com/c/sdk/+/115701

Change-Id: Ib579f0bbc8d694aec74afd837217316a10baf910
Reviewed-on: https://dart-review.googlesource.com/c/sdk/+/115707
Commit-Queue: Martin Kustermann <kustermann@google.com>
Reviewed-by: Ryan Macnak <rmacnak@google.com>
Reviewed-by: Daco Harkes <dacoharkes@google.com>
2019-09-05 21:41:42 +00:00
Ryan Macnak d08c203e30 Add various missing argument checks to dart:io natives.
Avoid reflective access to mirrors creating invalid reflectees.

Change type checks in embedding API functions to return UnhandledExceptionErrors instead of APIErrors so they are catchable by Dart.

Fixes invocation_fuzz_test.

Bug: https://github.com/dart-lang/sdk/issues/15274
Bug: https://github.com/dart-lang/sdk/issues/23869
Bug: https://github.com/dart-lang/sdk/issues/37680
Change-Id: Ife3e3cb894c59620b0318e4e08947a3d1d45bab9
Reviewed-on: https://dart-review.googlesource.com/c/sdk/+/110620
Commit-Queue: Ryan Macnak <rmacnak@google.com>
Reviewed-by: Siva Annamalai <asiva@google.com>
2019-08-01 23:32:40 +00:00
Ryan Macnak 938d3be958 Revert "Add various missing argument checks to dart:io natives."
This reverts commit ba72890aa7.

Reason for revert: Crash in bytecode modes

Original change's description:
> Add various missing argument checks to dart:io natives.
> 
> Change type checks in embedding API functions to return UnhandledExceptionErrors instead of APIErrors so they are catchable by Dart.
> 
> Fixes invocation_fuzz_test.
> 
> Bug: https://github.com/dart-lang/sdk/issues/15274
> Bug: https://github.com/dart-lang/sdk/issues/23869
> Change-Id: Ia6103e7ffceda897e475c1a3ba534c2f4b910475
> Reviewed-on: https://dart-review.googlesource.com/c/sdk/+/110020
> Commit-Queue: Ryan Macnak <rmacnak@google.com>
> Reviewed-by: Siva Annamalai <asiva@google.com>

TBR=sortie@google.com,rmacnak@google.com,asiva@google.com

Change-Id: Ib52ec03caf4b177cd91bb1d366df51588bf23177
No-Presubmit: true
No-Tree-Checks: true
No-Try: true
Bug: https://github.com/dart-lang/sdk/issues/15274, https://github.com/dart-lang/sdk/issues/23869
Reviewed-on: https://dart-review.googlesource.com/c/sdk/+/110580
Reviewed-by: Ryan Macnak <rmacnak@google.com>
Commit-Queue: Ryan Macnak <rmacnak@google.com>
2019-07-25 19:18:23 +00:00
Ryan Macnak ba72890aa7 Add various missing argument checks to dart:io natives.
Change type checks in embedding API functions to return UnhandledExceptionErrors instead of APIErrors so they are catchable by Dart.

Fixes invocation_fuzz_test.

Bug: https://github.com/dart-lang/sdk/issues/15274
Bug: https://github.com/dart-lang/sdk/issues/23869
Change-Id: Ia6103e7ffceda897e475c1a3ba534c2f4b910475
Reviewed-on: https://dart-review.googlesource.com/c/sdk/+/110020
Commit-Queue: Ryan Macnak <rmacnak@google.com>
Reviewed-by: Siva Annamalai <asiva@google.com>
2019-07-25 16:40:04 +00:00
Ryan Macnak 971f4845d7 [build] Remove last platform -> vm and bin -> vm dependencies. Fix some ODR violations.
Change some static_libraries to source_sets to make ODR violations link-time errors.

This is needed to enable (stop suppressing) -fvisibility=hidden in Fuchsia product builds.

Change-Id: I699cec8d4b516beab9cebf9db0a522a7ff99e004
Reviewed-on: https://dart-review.googlesource.com/c/sdk/+/99822
Reviewed-by: Zach Anderson <zra@google.com>
Commit-Queue: Ryan Macnak <rmacnak@google.com>
2019-04-22 20:15:43 +00:00
Zach Anderson c26435f18f [dart:io] Add length check assert to x509 code
Change-Id: I42c29e43f34cceea90caa5b99c4249ddaabe968c
Reviewed-on: https://dart-review.googlesource.com/55763
Reviewed-by: Siva Annamalai <asiva@google.com>
Commit-Queue: Zach Anderson <zra@google.com>
2018-05-17 21:49:17 +00:00
Zach Anderson e7495e427c [dart:io] Adds X509Certificate.der and X509Certificate.pem
fixes #33115

Change-Id: I7ccf5998b23e936040fe65792824f09d3f494cf7
Reviewed-on: https://dart-review.googlesource.com/55505
Commit-Queue: Zach Anderson <zra@google.com>
Reviewed-by: Ben Konyi <bkonyi@google.com>
2018-05-17 16:20:06 +00:00
Zach Anderson c117aeea3b [dart:io] Check hostname when validating cert chains on MacOS
fixes #32936

Change-Id: Ic79ce7151cbeff1cf1d28908715c07c4e3b422d9
Reviewed-on: https://dart-review.googlesource.com/52342
Reviewed-by: Siva Annamalai <asiva@google.com>
Commit-Queue: Zach Anderson <zra@google.com>
2018-04-23 22:39:32 +00:00
Zachary Anderson d7845c6a6f [standalone] Clean up command line argument parsing
fixes #30534

Change-Id: I5e721e5d24de32f0cb85f7bd96890913cf788f81
Reviewed-on: https://dart-review.googlesource.com/4608
Commit-Queue: Zach Anderson <zra@google.com>
Reviewed-by: Vyacheslav Egorov <vegorov@google.com>
2017-09-11 18:58:39 +00:00
Zachary Anderson d0295c873c [dart:io] Namespaces for file IO
Fuchsia requires the ability to sandbox Isolates w.r.t. file IO.
When a new Isolate starts, Fuchsia will pass the Isolate an object
called a namespace. We can translate the namespace object into a
file descriptor suitable for passing to the *at() family of
POSIX file system calls. The file system calls will then
have visibility only into the specified namespace.

We also plumb Namespaces through on all the other platforms as well to
make the change easier to test and so that in the future we can
implement e.g. per-isolate cwds.

This change adds a new internal class to dart:io called _Namespace,
which is implemented in a patch file. See:

sdk/lib/io/namespace_impl.dart
runtime/bin/namespace_patch.dart

The embedder can set up a non-default namespace by calling
_Namespace._setupNamespace during Isolate setup.

Instances of _Namespace have a native field that holds a pointer
to a native Namespace object. See:

runtime/bin/namespace.h

Calls from e.g. file_impl.dart are now also passed a
_Namespace object. The implementations in e.g. file.cc and
file_linux.cc then extract the namespace, and use it to compute a
file descriptor and path suitable for passing to e.g. openat().

related US-313

R=asiva@google.com, rmacnak@google.com

Review-Url: https://codereview.chromium.org/3007703002 .
2017-08-30 09:34:36 -07:00
Zachary Anderson 747868f2b1 [dart:io] Remove DART_IO_DISABLED
This was only used by Dartium.

Review-Url: https://codereview.chromium.org/3009523002 .
2017-08-24 11:17:52 -07:00
Zachary Anderson 6cd8a79078 VM: Re-format to use at most one newline between functions
R=asiva@google.com

Review-Url: https://codereview.chromium.org/2974233002 .
2017-07-13 08:08:37 -07:00
Ben Konyi 4b6fa0d5fb Removed SecurityContext.alpnSupported, as ALPN is now supported on all platforms. Also updated CHANGELOG.md to announce its removal.
BUG=
R=zra@google.com

Review-Url: https://codereview.chromium.org/2926153004 .
2017-06-07 15:15:58 -07:00
Ben Konyi 0e164c043f Fixed memory leak in SetTrustedCertificates in SecurityContext
BUG=
R=zra@google.com

Review-Url: https://codereview.chromium.org/2923163004 .
2017-06-06 14:02:52 -07:00
Ben Konyi 644862bf96 Ported SecureSocket to use BoringSSL on OSX and iOS. This included registering a callback with BoringSSL using SSL_CTX_set_cert_verify_callback, which overrides the BoringSSL certificate verification process, in order to verify certificates against the system's root certificates and then proceed to let BoringSSL handle the rest of the SSL session. In addition, this change includes refactoring to share BoringSSL code that used on all platforms.
BUG=
R=zra@google.com

Review-Url: https://codereview.chromium.org/2903743002 .
2017-06-06 12:52:57 -07:00