Skip to content

Commit 080aa56

Browse files
ADKasterADKaster
committed
RequestServer+LibTLS: Allow applications to specify multiple root certs
1 parent 49467c6 commit 080aa56

File tree

8 files changed

+41
-26
lines changed

8 files changed

+41
-26
lines changed

‎Ladybird/Android/src/main/cpp/RequestServerService.cpp

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -21,13 +21,13 @@
2121
#include <RequestServer/HttpsProtocol.h>
2222

2323
// FIXME: Share b/w RequestServer and WebSocket
24-
ErrorOr<String> find_certificates(StringView serenity_resource_root)
24+
ErrorOr<ByteString> find_certificates(StringView serenity_resource_root)
2525
{
26-
auto cert_path = TRY(String::formatted("{}/res/ladybird/cacert.pem", serenity_resource_root));
26+
auto cert_path = ByteString::formatted("{}/res/ladybird/cacert.pem", serenity_resource_root);
2727
if (!FileSystem::exists(cert_path)) {
2828
auto app_dir = LexicalPath::dirname(TRY(Core::System::current_executable_path()));
2929

30-
cert_path = TRY(String::formatted("{}/cacert.pem", LexicalPath(app_dir).parent()));
30+
cert_path = ByteString::formatted("{}/cacert.pem", LexicalPath(app_dir).parent());
3131
if (!FileSystem::exists(cert_path))
3232
return Error::from_string_view("Don't know how to load certs!"sv);
3333
}
@@ -37,7 +37,7 @@ ErrorOr<String> find_certificates(StringView serenity_resource_root)
3737
ErrorOr<int> service_main(int ipc_socket, int fd_passing_socket)
3838
{
3939
// Ensure the certificates are read out here.
40-
DefaultRootCACertificates::set_default_certificate_path(TRY(find_certificates(s_serenity_resource_root)));
40+
DefaultRootCACertificates::set_default_certificate_paths(Vector { TRY(find_certificates(s_serenity_resource_root)) });
4141
[[maybe_unused]] auto& certs = DefaultRootCACertificates::the();
4242

4343
Core::EventLoop event_loop;

‎Ladybird/Android/src/main/cpp/WebSocketService.cpp

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -17,13 +17,13 @@
1717
#include <WebSocket/ConnectionFromClient.h>
1818

1919
// FIXME: Share b/w RequestServer and WebSocket
20-
ErrorOr<String> find_certificates(StringView serenity_resource_root)
20+
ErrorOr<ByteString> find_certificates(StringView serenity_resource_root)
2121
{
22-
auto cert_path = TRY(String::formatted("{}/res/ladybird/cacert.pem", serenity_resource_root));
22+
auto cert_path = ByteString::formatted("{}/res/ladybird/cacert.pem", serenity_resource_root);
2323
if (!FileSystem::exists(cert_path)) {
2424
auto app_dir = LexicalPath::dirname(TRY(Core::System::current_executable_path()));
2525

26-
cert_path = TRY(String::formatted("{}/cacert.pem", LexicalPath(app_dir).parent()));
26+
cert_path = ByteString::formatted("{}/cacert.pem", LexicalPath(app_dir).parent());
2727
if (!FileSystem::exists(cert_path))
2828
return Error::from_string_view("Don't know how to load certs!"sv);
2929
}
@@ -33,7 +33,7 @@ ErrorOr<String> find_certificates(StringView serenity_resource_root)
3333
ErrorOr<int> service_main(int ipc_socket, int fd_passing_socket)
3434
{
3535
// Ensure the certificates are read out here.
36-
DefaultRootCACertificates::set_default_certificate_path(TRY(find_certificates(s_serenity_resource_root)));
36+
DefaultRootCACertificates::set_default_certificate_paths(Vector { TRY(find_certificates(s_serenity_resource_root)) });
3737
[[maybe_unused]] auto& certs = DefaultRootCACertificates::the();
3838

3939
Core::EventLoop event_loop;

‎Ladybird/RequestServer/main.cpp

Lines changed: 8 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -21,13 +21,13 @@
2121
#include <RequestServer/HttpsProtocol.h>
2222

2323
// FIXME: Share b/w RequestServer and WebSocket
24-
ErrorOr<String> find_certificates(StringView serenity_resource_root)
24+
ErrorOr<ByteString> find_certificates(StringView serenity_resource_root)
2525
{
26-
auto cert_path = TRY(String::formatted("{}/res/ladybird/cacert.pem", serenity_resource_root));
26+
auto cert_path = ByteString::formatted("{}/res/ladybird/cacert.pem", serenity_resource_root);
2727
if (!FileSystem::exists(cert_path)) {
2828
auto app_dir = LexicalPath::dirname(TRY(Core::System::current_executable_path()));
2929

30-
cert_path = TRY(String::formatted("{}/cacert.pem", LexicalPath(app_dir).parent()));
30+
cert_path = ByteString::formatted("{}/cacert.pem", LexicalPath(app_dir).parent());
3131
if (!FileSystem::exists(cert_path))
3232
return Error::from_string_view("Don't know how to load certs!"sv);
3333
}
@@ -40,14 +40,18 @@ ErrorOr<int> serenity_main(Main::Arguments arguments)
4040

4141
int fd_passing_socket { -1 };
4242
StringView serenity_resource_root;
43+
Vector<ByteString> certificates;
4344

4445
Core::ArgsParser args_parser;
4546
args_parser.add_option(fd_passing_socket, "File descriptor of the fd passing socket", "fd-passing-socket", 'c', "fd-passing-socket");
47+
args_parser.add_option(certificates, "Path to a certificate file", "certificate", 'C', "certificate");
4648
args_parser.add_option(serenity_resource_root, "Absolute path to directory for serenity resources", "serenity-resource-root", 'r', "serenity-resource-root");
4749
args_parser.parse(arguments);
4850

4951
// Ensure the certificates are read out here.
50-
DefaultRootCACertificates::set_default_certificate_path(TRY(find_certificates(serenity_resource_root)));
52+
if (certificates.is_empty())
53+
certificates.append(TRY(find_certificates(serenity_resource_root)));
54+
DefaultRootCACertificates::set_default_certificate_paths(certificates.span());
5155
[[maybe_unused]] auto& certs = DefaultRootCACertificates::the();
5256

5357
Core::EventLoop event_loop;

‎Ladybird/WebSocket/main.cpp

Lines changed: 8 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -17,13 +17,13 @@
1717
#include <WebSocket/ConnectionFromClient.h>
1818

1919
// FIXME: Share b/w RequestServer and WebSocket
20-
ErrorOr<String> find_certificates(StringView serenity_resource_root)
20+
ErrorOr<ByteString> find_certificates(StringView serenity_resource_root)
2121
{
22-
auto cert_path = TRY(String::formatted("{}/res/ladybird/cacert.pem", serenity_resource_root));
22+
auto cert_path = ByteString::formatted("{}/res/ladybird/cacert.pem", serenity_resource_root);
2323
if (!FileSystem::exists(cert_path)) {
2424
auto app_dir = LexicalPath::dirname(TRY(Core::System::current_executable_path()));
2525

26-
cert_path = TRY(String::formatted("{}/cacert.pem", LexicalPath(app_dir).parent()));
26+
cert_path = ByteString::formatted("{}/cacert.pem", LexicalPath(app_dir).parent());
2727
if (!FileSystem::exists(cert_path))
2828
return Error::from_string_view("Don't know how to load certs!"sv);
2929
}
@@ -36,14 +36,18 @@ ErrorOr<int> serenity_main(Main::Arguments arguments)
3636

3737
int fd_passing_socket { -1 };
3838
StringView serenity_resource_root;
39+
Vector<ByteString> certificates;
3940

4041
Core::ArgsParser args_parser;
4142
args_parser.add_option(fd_passing_socket, "File descriptor of the fd passing socket", "fd-passing-socket", 'c', "fd-passing-socket");
43+
args_parser.add_option(certificates, "Path to a certificate file", "certificate", 'C', "certificate");
4244
args_parser.add_option(serenity_resource_root, "Absolute path to directory for serenity resources", "serenity-resource-root", 'r', "serenity-resource-root");
4345
args_parser.parse(arguments);
4446

4547
// Ensure the certificates are read out here.
46-
DefaultRootCACertificates::set_default_certificate_path(TRY(find_certificates(serenity_resource_root)));
48+
if (certificates.is_empty())
49+
certificates.append(TRY(find_certificates(serenity_resource_root)));
50+
DefaultRootCACertificates::set_default_certificate_paths(certificates.span());
4751
[[maybe_unused]] auto& certs = DefaultRootCACertificates::the();
4852

4953
Core::EventLoop event_loop;

‎Userland/Libraries/LibTLS/Certificate.h

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -292,11 +292,11 @@ class DefaultRootCACertificates {
292292
Vector<Certificate> const& certificates() const { return m_ca_certificates; }
293293

294294
static ErrorOr<Vector<Certificate>> parse_pem_root_certificate_authorities(ByteBuffer&);
295-
static ErrorOr<Vector<Certificate>> load_certificates(StringView custom_cert_path = {});
295+
static ErrorOr<Vector<Certificate>> load_certificates(Span<ByteString> custom_cert_paths = {});
296296

297297
static DefaultRootCACertificates& the();
298298

299-
static void set_default_certificate_path(String);
299+
static void set_default_certificate_paths(Span<ByteString> paths);
300300

301301
private:
302302
Vector<Certificate> m_ca_certificates;

‎Userland/Libraries/LibTLS/TLSv12.cpp

Lines changed: 13 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -547,16 +547,19 @@ Vector<Certificate> TLSv12::parse_pem_certificate(ReadonlyBytes certificate_pem_
547547
return { move(certificate) };
548548
}
549549

550-
static String s_default_ca_certificate_path;
550+
static Vector<ByteString> s_default_ca_certificate_paths;
551551

552-
void DefaultRootCACertificates::set_default_certificate_path(String path)
552+
void DefaultRootCACertificates::set_default_certificate_paths(Span<ByteString> paths)
553553
{
554-
s_default_ca_certificate_path = move(path);
554+
s_default_ca_certificate_paths.clear();
555+
s_default_ca_certificate_paths.ensure_capacity(paths.size());
556+
for (auto& path : paths)
557+
s_default_ca_certificate_paths.unchecked_append(path);
555558
}
556559

557560
DefaultRootCACertificates::DefaultRootCACertificates()
558561
{
559-
auto load_result = load_certificates(s_default_ca_certificate_path);
562+
auto load_result = load_certificates(s_default_ca_certificate_paths);
560563
if (load_result.is_error()) {
561564
dbgln("Failed to load CA Certificates: {}", load_result.error());
562565
return;
@@ -571,7 +574,7 @@ DefaultRootCACertificates& DefaultRootCACertificates::the()
571574
return s_the;
572575
}
573576

574-
ErrorOr<Vector<Certificate>> DefaultRootCACertificates::load_certificates(StringView custom_cert_path)
577+
ErrorOr<Vector<Certificate>> DefaultRootCACertificates::load_certificates(Span<ByteString> custom_cert_paths)
575578
{
576579
auto cacert_file_or_error = Core::File::open("/etc/cacert.pem"sv, Core::File::OpenMode::Read);
577580
ByteBuffer data;
@@ -588,9 +591,11 @@ ErrorOr<Vector<Certificate>> DefaultRootCACertificates::load_certificates(String
588591
TRY(data.try_append(TRY(user_cert_file->read_until_eof())));
589592
}
590593

591-
if (!custom_cert_path.is_empty() && FileSystem::exists(custom_cert_path)) {
592-
auto custom_cert_file = TRY(Core::File::open(custom_cert_path, Core::File::OpenMode::Read));
593-
TRY(data.try_append(TRY(custom_cert_file->read_until_eof())));
594+
for (auto& custom_cert_path : custom_cert_paths) {
595+
if (FileSystem::exists(custom_cert_path)) {
596+
auto custom_cert_file = TRY(Core::File::open(custom_cert_path, Core::File::OpenMode::Read));
597+
TRY(data.try_append(TRY(custom_cert_file->read_until_eof())));
598+
}
594599
}
595600

596601
return TRY(parse_pem_root_certificate_authorities(data));

‎Userland/Services/RequestServer/main.cpp

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -34,6 +34,7 @@ ErrorOr<int> serenity_main(Main::Arguments)
3434
TRY(Core::System::pledge("stdio inet accept unix rpath sendfd recvfd"));
3535

3636
// Ensure the certificates are read out here.
37+
// FIXME: Allow specifying extra certificates on the command line, or in other configuration.
3738
[[maybe_unused]] auto& certs = DefaultRootCACertificates::the();
3839

3940
Core::EventLoop event_loop;

‎Userland/Services/WebSocket/main.cpp

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -17,6 +17,7 @@ ErrorOr<int> serenity_main(Main::Arguments)
1717
TRY(Core::System::pledge("stdio inet unix rpath sendfd recvfd"));
1818

1919
// Ensure the certificates are read out here.
20+
// FIXME: Allow specifying extra certificates on the command line, or in other configuration.
2021
[[maybe_unused]] auto& certs = DefaultRootCACertificates::the();
2122

2223
Core::EventLoop event_loop;

0 commit comments

Comments
 (0)