blob: bc2ee7ef38909f625e0ec06b012c705edba0c6f3 [file] [log] [blame] [edit]
// Copyright (c) 2017, the Dart project authors. Please see the AUTHORS file
// for details. All rights reserved. Use of this source code is governed by a
// BSD-style license that can be found in the LICENSE file.
#if !defined(DART_IO_SECURE_SOCKET_DISABLED)
#include "platform/globals.h"
#if defined(DART_HOST_OS_WINDOWS)
#include "bin/security_context.h"
#include <openssl/bio.h>
#include <openssl/ssl.h>
#include <openssl/x509.h>
#include <wincrypt.h>
#include "bin/directory.h"
#include "bin/file.h"
#include "bin/secure_socket_filter.h"
#include "bin/secure_socket_utils.h"
#include "platform/syslog.h"
#ifndef DART_TARGET_OS_WINDOWS_UWP
#pragma comment(lib, "crypt32.lib")
#endif
namespace dart {
namespace bin {
// The security context won't necessarily use the compiled-in root certificates,
// but since there is no way to update the size of the allocation after creating
// the weak persistent handle, we assume that it will. Note that when the
// root certs aren't compiled in, |root_certificates_pem_length| is 0.
const intptr_t SSLCertContext::kApproximateSize =
sizeof(SSLCertContext) + root_certificates_pem_length;
static void PrintSSLErr(const char* str) {
int error = ERR_get_error();
char error_string[SecureSocketUtils::SSL_ERROR_MESSAGE_BUFFER_SIZE];
ERR_error_string_n(error, error_string,
SecureSocketUtils::SSL_ERROR_MESSAGE_BUFFER_SIZE);
Syslog::PrintErr("%s %s\n", str, error_string);
}
#ifndef DART_TARGET_OS_WINDOWS_UWP
static bool AddCertificatesFromNamedSystemStore(const wchar_t* name,
DWORD store_type,
X509_STORE* store) {
ASSERT(store_type == CERT_SYSTEM_STORE_CURRENT_USER ||
store_type == CERT_SYSTEM_STORE_LOCAL_MACHINE);
if (SSL_LOG_STATUS) {
Syslog::Print("AddCertificatesFromNamedSystemStore %ls type: %s\n", name,
store_type == CERT_SYSTEM_STORE_CURRENT_USER
? "Current User"
: "Local Machine");
}
HCERTSTORE cert_store =
CertOpenStore(CERT_STORE_PROV_SYSTEM,
0, // the encoding type is not needed
NULL, // use the default HCRYPTPROV
store_type | CERT_STORE_READONLY_FLAG, name);
if (cert_store == nullptr) {
if (SSL_LOG_STATUS) {
DWORD error = GetLastError();
Syslog::PrintErr(
"Failed to open Windows root store %ls type %d due to %d\n", name,
store_type, error);
}
return false;
}
// Iterating through all certificates in the store. A nullptr is required to
// start iteration.
PCCERT_CONTEXT cert_context = nullptr;
do {
cert_context = CertEnumCertificatesInStore(cert_store, cert_context);
if (cert_context == nullptr) {
// reach the end of store.
break;
}
BIO* root_cert_bio =
BIO_new_mem_buf(const_cast<unsigned char*>(cert_context->pbCertEncoded),
cert_context->cbCertEncoded);
// `root_cert` has to be initialized to nullptr, otherwise, it will be
// considered as an existing X509 and cause segmentation fault.
X509* root_cert = nullptr;
if (d2i_X509_bio(root_cert_bio, &root_cert) == nullptr) {
if (SSL_LOG_STATUS) {
PrintSSLErr("Fail to read certificate");
}
BIO_free(root_cert_bio);
continue;
}
BIO_free(root_cert_bio);
if (SSL_LOG_STATUS) {
auto s_name = X509_get_subject_name(root_cert);
auto s_issuer_name = X509_get_issuer_name(root_cert);
auto serial_number = X509_get_serialNumber(root_cert);
BIGNUM* bn = ASN1_INTEGER_to_BN(serial_number, nullptr);
char* hex = BN_bn2hex(bn);
Syslog::Print("Considering root certificate serial: %s subject name: ",
hex);
OPENSSL_free(hex);
X509_NAME_print_ex_fp(stdout, s_name, 4, 0);
Syslog::Print(" issuer:");
X509_NAME_print_ex_fp(stdout, s_issuer_name, 4, 0);
Syslog::Print("\n");
}
if (!SecureSocketUtils::IsCurrentTimeInsideCertValidDateRange(root_cert)) {
if (SSL_LOG_STATUS) {
Syslog::Print("...certificate is outside of its valid date range\n");
}
X509_free(root_cert);
continue;
}
int status = X509_STORE_add_cert(store, root_cert);
// Always free the certificate after use.
X509_free(root_cert);
if (status == 0) {
int error = ERR_get_error();
if (ERR_GET_REASON(error) == X509_R_CERT_ALREADY_IN_HASH_TABLE) {
if (SSL_LOG_STATUS) {
Syslog::Print("...duplicate\n");
}
continue;
}
if (SSL_LOG_STATUS) {
PrintSSLErr("Failed to add certificate to x509 trust store");
}
CertFreeCertificateContext(cert_context);
CertCloseStore(cert_store, 0);
return false;
}
} while (cert_context != nullptr);
// It always returns non-zero.
CertFreeCertificateContext(cert_context);
if (!CertCloseStore(cert_store, 0)) {
if (SSL_LOG_STATUS) {
PrintSSLErr("Fail to close system root store");
}
return false;
}
return true;
}
static bool AddCertificatesFromSystemStore(DWORD store_type,
X509_STORE* store) {
if (!AddCertificatesFromNamedSystemStore(L"ROOT", store_type, store)) {
return false;
}
if (!AddCertificatesFromNamedSystemStore(L"CA", store_type, store)) {
return false;
}
if (!AddCertificatesFromNamedSystemStore(L"TRUST", store_type, store)) {
return false;
}
if (!AddCertificatesFromNamedSystemStore(L"MY", store_type, store)) {
return false;
}
return true;
}
#endif // ifdef DART_TARGET_OS_WINDOWS_UWP
// Add certificates from Windows trusted root store.
static bool AddCertificatesFromRootStore(X509_STORE* store) {
// The UWP platform doesn't support CertEnumCertificatesInStore hence
// this function cannot work when compiled in UWP mode.
#ifdef DART_TARGET_OS_WINDOWS_UWP
return false;
#else
if (!AddCertificatesFromSystemStore(CERT_SYSTEM_STORE_CURRENT_USER, store)) {
return false;
}
if (!AddCertificatesFromSystemStore(CERT_SYSTEM_STORE_LOCAL_MACHINE, store)) {
return false;
}
return true;
#endif // ifdef DART_TARGET_OS_WINDOWS_UWP
}
void SSLCertContext::TrustBuiltinRoots() {
// First, try to use locations specified on the command line.
if (root_certs_file() != nullptr) {
LoadRootCertFile(root_certs_file());
return;
}
if (root_certs_cache() != nullptr) {
LoadRootCertCache(root_certs_cache());
return;
}
if (bypass_trusting_system_roots()) {
if (SSL_LOG_STATUS) {
Syslog::Print("Bypass trusting Windows built-in roots\n");
}
} else {
if (SSL_LOG_STATUS) {
Syslog::Print("Trusting Windows built-in roots\n");
}
X509_STORE* store = SSL_CTX_get_cert_store(context());
if (AddCertificatesFromRootStore(store)) {
return;
}
}
// Reset store. SSL_CTX_set_cert_store will take ownership of store. A manual
// free is not needed.
SSL_CTX_set_cert_store(context(), X509_STORE_new());
// Fall back on the compiled-in certs if the standard locations don't exist,
// or fail to load certificates from Windows root store.
if (SSL_LOG_STATUS) {
Syslog::Print("Trusting compiled-in roots\n");
}
AddCompiledInCerts();
}
void SSLCertContext::RegisterCallbacks(SSL* ssl) {
// No callbacks to register for implementations using BoringSSL's built-in
// verification mechanism.
}
TrustEvaluateHandlerFunc SSLCertContext::GetTrustEvaluateHandler() const {
return nullptr;
}
} // namespace bin
} // namespace dart
#endif // defined(DART_HOST_OS_WINDOWS)
#endif // !defined(DART_IO_SECURE_SOCKET_DISABLED)