1 /*
2 *
3 * Copyright 2018 gRPC authors.
4 *
5 * Licensed under the Apache License, Version 2.0 (the "License");
6 * you may not use this file except in compliance with the License.
7 * You may obtain a copy of the License at
8 *
9 * http://www.apache.org/licenses/LICENSE-2.0
10 *
11 * Unless required by applicable law or agreed to in writing, software
12 * distributed under the License is distributed on an "AS IS" BASIS,
13 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
14 * See the License for the specific language governing permissions and
15 * limitations under the License.
16 *
17 */
18
19 #include <grpc/support/port_platform.h>
20
21 #include <grpc/slice_buffer.h>
22 #include "src/core/lib/security/security_connector/load_system_roots_linux.h"
23
24 #if defined(GPR_LINUX) || defined(GPR_ANDROID)
25
26 #include "src/core/lib/security/security_connector/load_system_roots.h"
27
28 #include <dirent.h>
29 #include <fcntl.h>
30 #include <stdbool.h>
31 #include <string.h>
32 #include <sys/param.h>
33 #include <sys/stat.h>
34 #include <sys/types.h>
35 #include <unistd.h>
36
37 #include "absl/container/inlined_vector.h"
38
39 #include <grpc/support/alloc.h>
40 #include <grpc/support/log.h>
41 #include <grpc/support/string_util.h>
42
43 #include "src/core/lib/gpr/string.h"
44 #include "src/core/lib/gpr/useful.h"
45 #include "src/core/lib/gprpp/global_config.h"
46 #include "src/core/lib/iomgr/load_file.h"
47
48 GPR_GLOBAL_CONFIG_DEFINE_STRING(grpc_system_ssl_roots_dir, "",
49 "Custom directory to SSL Roots");
50
51 namespace grpc_core {
52 namespace {
53
54 const char* kLinuxCertFiles[] = {
55 "/etc/ssl/certs/ca-certificates.crt", "/etc/pki/tls/certs/ca-bundle.crt",
56 "/etc/ssl/ca-bundle.pem", "/etc/pki/tls/cacert.pem",
57 "/etc/pki/ca-trust/extracted/pem/tls-ca-bundle.pem"};
58 const char* kLinuxCertDirectories[] = {
59 "/etc/ssl/certs", "/system/etc/security/cacerts", "/usr/local/share/certs",
60 "/etc/pki/tls/certs", "/etc/openssl/certs"};
61
GetSystemRootCerts()62 grpc_slice GetSystemRootCerts() {
63 grpc_slice valid_bundle_slice = grpc_empty_slice();
64 size_t num_cert_files_ = GPR_ARRAY_SIZE(kLinuxCertFiles);
65 for (size_t i = 0; i < num_cert_files_; i++) {
66 grpc_error* error =
67 grpc_load_file(kLinuxCertFiles[i], 1, &valid_bundle_slice);
68 if (error == GRPC_ERROR_NONE) {
69 return valid_bundle_slice;
70 } else {
71 GRPC_ERROR_UNREF(error);
72 }
73 }
74 return grpc_empty_slice();
75 }
76
77 } // namespace
78
GetAbsoluteFilePath(const char * valid_file_dir,const char * file_entry_name,char * path_buffer)79 void GetAbsoluteFilePath(const char* valid_file_dir,
80 const char* file_entry_name, char* path_buffer) {
81 if (valid_file_dir != nullptr && file_entry_name != nullptr) {
82 int path_len = snprintf(path_buffer, MAXPATHLEN, "%s/%s", valid_file_dir,
83 file_entry_name);
84 if (path_len == 0) {
85 gpr_log(GPR_ERROR, "failed to get absolute path for file: %s",
86 file_entry_name);
87 }
88 }
89 }
90
CreateRootCertsBundle(const char * certs_directory)91 grpc_slice CreateRootCertsBundle(const char* certs_directory) {
92 grpc_slice bundle_slice = grpc_empty_slice();
93 if (certs_directory == nullptr) {
94 return bundle_slice;
95 }
96 DIR* ca_directory = opendir(certs_directory);
97 if (ca_directory == nullptr) {
98 return bundle_slice;
99 }
100 struct FileData {
101 char path[MAXPATHLEN];
102 off_t size;
103 };
104 absl::InlinedVector<FileData, 2> roots_filenames;
105 size_t total_bundle_size = 0;
106 struct dirent* directory_entry;
107 while ((directory_entry = readdir(ca_directory)) != nullptr) {
108 struct stat dir_entry_stat;
109 const char* file_entry_name = directory_entry->d_name;
110 FileData file_data;
111 GetAbsoluteFilePath(certs_directory, file_entry_name, file_data.path);
112 int stat_return = stat(file_data.path, &dir_entry_stat);
113 if (stat_return == -1 || !S_ISREG(dir_entry_stat.st_mode)) {
114 // no subdirectories.
115 if (stat_return == -1) {
116 gpr_log(GPR_ERROR, "failed to get status for file: %s", file_data.path);
117 }
118 continue;
119 }
120 file_data.size = dir_entry_stat.st_size;
121 total_bundle_size += file_data.size;
122 roots_filenames.push_back(file_data);
123 }
124 closedir(ca_directory);
125 char* bundle_string = static_cast<char*>(gpr_zalloc(total_bundle_size + 1));
126 size_t bytes_read = 0;
127 for (size_t i = 0; i < roots_filenames.size(); i++) {
128 int file_descriptor = open(roots_filenames[i].path, O_RDONLY);
129 if (file_descriptor != -1) {
130 // Read file into bundle.
131 size_t cert_file_size = roots_filenames[i].size;
132 int read_ret =
133 read(file_descriptor, bundle_string + bytes_read, cert_file_size);
134 if (read_ret != -1) {
135 bytes_read += read_ret;
136 } else {
137 gpr_log(GPR_ERROR, "failed to read file: %s", roots_filenames[i].path);
138 }
139 }
140 }
141 bundle_slice = grpc_slice_new(bundle_string, bytes_read, gpr_free);
142 return bundle_slice;
143 }
144
LoadSystemRootCerts()145 grpc_slice LoadSystemRootCerts() {
146 grpc_slice result = grpc_empty_slice();
147 // Prioritize user-specified custom directory if flag is set.
148 grpc_core::UniquePtr<char> custom_dir =
149 GPR_GLOBAL_CONFIG_GET(grpc_system_ssl_roots_dir);
150 if (strlen(custom_dir.get()) > 0) {
151 result = CreateRootCertsBundle(custom_dir.get());
152 }
153 // If the custom directory is empty/invalid/not specified, fallback to
154 // distribution-specific directory.
155 if (GRPC_SLICE_IS_EMPTY(result)) {
156 result = GetSystemRootCerts();
157 }
158 if (GRPC_SLICE_IS_EMPTY(result)) {
159 for (size_t i = 0; i < GPR_ARRAY_SIZE(kLinuxCertDirectories); i++) {
160 result = CreateRootCertsBundle(kLinuxCertDirectories[i]);
161 if (!GRPC_SLICE_IS_EMPTY(result)) {
162 break;
163 }
164 }
165 }
166 return result;
167 }
168
169 } // namespace grpc_core
170
171 #endif /* GPR_LINUX || GPR_ANDROID */
172