Slava Egorov
42164cc140
This reverts commit aa9201b76b.
Reason for revert: blocks G3 roll (b/192627187)
Original change's description:
> [vm] Prefix HOST_OS_* and TARGET_OS_* with DART_
>
> TargetConditionals.h for XCode 13 defines several
> TARGET_OS_* preprocessor symbols that confuse the
> Dart build. There is probably a more targeted fix
> for this, but renaming the symbols that Dart uses
> will also prevent this problem if more symbols
> are added to the platform headers in the future.
>
> See: https://github.com/dart-lang/sdk/issues/46499
>
> TEST=It builds.
> Change-Id: I3b33a03b4a9a14b76d55fe12f8cdefec4b3c3664
> Reviewed-on: https://dart-review.googlesource.com/c/sdk/+/205633
> Commit-Queue: Zach Anderson <zra@google.com>
> Reviewed-by: Siva Annamalai <asiva@google.com>
TBR=rmacnak@google.com,zra@google.com,asiva@google.com
Change-Id: Ib06ca418c7e9d3b4df62c72c033cd39f462f7667
No-Presubmit: true
No-Tree-Checks: true
No-Try: true
Reviewed-on: https://dart-review.googlesource.com/c/sdk/+/205790
Reviewed-by: Slava Egorov <vegorov@google.com>
Commit-Queue: Slava Egorov <vegorov@google.com>
89 lines
2.7 KiB
C++
89 lines
2.7 KiB
C++
// Copyright (c) 2017, the Dart project authors. Please see the AUTHORS file
|
|
// for details. All rights reserved. Use of this source code is governed by a
|
|
// BSD-style license that can be found in the LICENSE file.
|
|
|
|
#if !defined(DART_IO_SECURE_SOCKET_DISABLED)
|
|
|
|
#include "platform/globals.h"
|
|
#if defined(HOST_OS_LINUX)
|
|
|
|
#include "bin/security_context.h"
|
|
|
|
#include <openssl/bio.h>
|
|
#include <openssl/ssl.h>
|
|
#include <openssl/x509.h>
|
|
|
|
#include "bin/directory.h"
|
|
#include "bin/file.h"
|
|
#include "bin/secure_socket_filter.h"
|
|
#include "bin/secure_socket_utils.h"
|
|
#include "platform/syslog.h"
|
|
|
|
namespace dart {
|
|
namespace bin {
|
|
|
|
// The security context won't necessarily use the compiled-in root certificates,
|
|
// but since there is no way to update the size of the allocation after creating
|
|
// the weak persistent handle, we assume that it will. Note that when the
|
|
// root certs aren't compiled in, |root_certificates_pem_length| is 0.
|
|
const intptr_t SSLCertContext::kApproximateSize =
|
|
sizeof(SSLCertContext) + root_certificates_pem_length;
|
|
|
|
void SSLCertContext::TrustBuiltinRoots() {
|
|
// First, try to use locations specified on the command line.
|
|
if (root_certs_file() != NULL) {
|
|
LoadRootCertFile(root_certs_file());
|
|
return;
|
|
}
|
|
if (root_certs_cache() != NULL) {
|
|
LoadRootCertCache(root_certs_cache());
|
|
return;
|
|
}
|
|
|
|
if (bypass_trusting_system_roots()) {
|
|
if (SSL_LOG_STATUS) {
|
|
Syslog::Print("Bypass trusting Linux built-in roots\n");
|
|
}
|
|
} else {
|
|
// On Linux, we use the compiled-in trusted certs as a last resort. First,
|
|
// we try to find the trusted certs in various standard locations. A good
|
|
// discussion of the complexities of this endeavor can be found here:
|
|
//
|
|
// https://www.happyassassin.net/2015/01/12/a-note-about-ssltls-trusted-certificate-stores-and-platforms/
|
|
const char* bundle = "/etc/pki/tls/certs/ca-bundle.crt";
|
|
const char* cachedir = "/etc/ssl/certs";
|
|
if (File::Exists(NULL, bundle)) {
|
|
LoadRootCertFile(bundle);
|
|
return;
|
|
}
|
|
|
|
if (Directory::Exists(NULL, cachedir) == Directory::EXISTS) {
|
|
LoadRootCertCache(cachedir);
|
|
return;
|
|
}
|
|
}
|
|
|
|
// Fall back on the compiled-in certs if the standard locations don't exist,
|
|
// or we aren't on Linux.
|
|
if (SSL_LOG_STATUS) {
|
|
Syslog::Print("Trusting compiled-in roots\n");
|
|
}
|
|
AddCompiledInCerts();
|
|
}
|
|
|
|
void SSLCertContext::RegisterCallbacks(SSL* ssl) {
|
|
// No callbacks to register for implementations using BoringSSL's built-in
|
|
// verification mechanism.
|
|
}
|
|
|
|
TrustEvaluateHandlerFunc SSLCertContext::GetTrustEvaluateHandler() const {
|
|
return nullptr;
|
|
}
|
|
|
|
} // namespace bin
|
|
} // namespace dart
|
|
|
|
#endif // defined(HOST_OS_LINUX)
|
|
|
|
#endif // !defined(DART_IO_SECURE_SOCKET_DISABLED)
|