diff --git a/Libraries/LibTLS/CMakeLists.txt b/Libraries/LibTLS/CMakeLists.txt index 68c833205c7..412e21cd6b1 100644 --- a/Libraries/LibTLS/CMakeLists.txt +++ b/Libraries/LibTLS/CMakeLists.txt @@ -1,7 +1,6 @@ add_cxx_compile_options(-Wvla) set(SOURCES - DefaultRootCACertificates.cpp TLSv12.cpp ) diff --git a/Libraries/LibTLS/DefaultRootCACertificates.cpp b/Libraries/LibTLS/DefaultRootCACertificates.cpp deleted file mode 100644 index b545e03e0fe..00000000000 --- a/Libraries/LibTLS/DefaultRootCACertificates.cpp +++ /dev/null @@ -1,93 +0,0 @@ -/* - * Copyright (c) 2020, Ali Mohammad Pur - * Copyright (c) 2025, Altomani Gianluca - * - * SPDX-License-Identifier: BSD-2-Clause - */ - -#include -#include -#include -#include -#include - -namespace TLS { - -static Vector s_default_ca_certificate_paths; - -void DefaultRootCACertificates::set_default_certificate_paths(Span paths) -{ - s_default_ca_certificate_paths.clear(); - s_default_ca_certificate_paths.ensure_capacity(paths.size()); - for (auto& path : paths) - s_default_ca_certificate_paths.unchecked_append(path); -} - -DefaultRootCACertificates::DefaultRootCACertificates() -{ - auto load_result = load_certificates(s_default_ca_certificate_paths); - if (load_result.is_error()) { - dbgln("Failed to load CA Certificates: {}", load_result.error()); - return; - } - - m_ca_certificates = load_result.release_value(); -} - -DefaultRootCACertificates& DefaultRootCACertificates::the() -{ - static thread_local DefaultRootCACertificates s_the; - return s_the; -} - -ErrorOr> DefaultRootCACertificates::load_certificates(Span custom_cert_paths) -{ - auto cacert_file_or_error = Core::File::open("/etc/cacert.pem"sv, Core::File::OpenMode::Read); - ByteBuffer data; - if (!cacert_file_or_error.is_error()) - data = TRY(cacert_file_or_error.value()->read_until_eof()); - - auto user_cert_path = TRY(String::formatted("{}/.config/certs.pem", Core::StandardPaths::home_directory())); - if (FileSystem::exists(user_cert_path)) { - auto user_cert_file = TRY(Core::File::open(user_cert_path, Core::File::OpenMode::Read)); - TRY(data.try_append(TRY(user_cert_file->read_until_eof()))); - } - - for (auto& custom_cert_path : custom_cert_paths) { - if (FileSystem::exists(custom_cert_path)) { - auto custom_cert_file = TRY(Core::File::open(custom_cert_path, Core::File::OpenMode::Read)); - TRY(data.try_append(TRY(custom_cert_file->read_until_eof()))); - } - } - - return TRY(parse_pem_root_certificate_authorities(data)); -} - -ErrorOr> DefaultRootCACertificates::parse_pem_root_certificate_authorities(ByteBuffer& data) -{ - Vector certificates; - - auto certs = TRY(Crypto::decode_pems(data)); - - for (auto& cert : certs) { - auto certificate_result = Certificate::parse_certificate(cert.data); - if (certificate_result.is_error()) { - // FIXME: It would be nice to have more informations about the certificate we failed to parse. - // Like: Issuer, Algorithm, CN, etc - dbgln("Failed to load certificate: {}", certificate_result.error()); - continue; - } - auto certificate = certificate_result.release_value(); - if (certificate.is_certificate_authority && certificate.is_self_signed()) { - TRY(certificates.try_append(move(certificate))); - } else { - dbgln("Skipped '{}' because it is not a valid root CA", TRY(certificate.subject.to_string())); - } - } - - dbgln_if(TLS_DEBUG, "Loaded {} of {} ({:.2}%) provided CA Certificates", certificates.size(), certs.size(), (certificates.size() * 100.0) / certs.size()); - - return certificates; -} - -} diff --git a/Libraries/LibTLS/DefaultRootCACertificates.h b/Libraries/LibTLS/DefaultRootCACertificates.h deleted file mode 100644 index 0fc0ddc6226..00000000000 --- a/Libraries/LibTLS/DefaultRootCACertificates.h +++ /dev/null @@ -1,34 +0,0 @@ -/* - * Copyright (c) 2020, Ali Mohammad Pur - * Copyright (c) 2025, Altomani Gianluca - * - * SPDX-License-Identifier: BSD-2-Clause - */ - -#pragma once - -#include - -namespace TLS { - -using Crypto::Certificate::Certificate; - -class DefaultRootCACertificates { -public: - DefaultRootCACertificates(); - - Vector const& certificates() const { return m_ca_certificates; } - - static ErrorOr> parse_pem_root_certificate_authorities(ByteBuffer&); - static ErrorOr> load_certificates(Span custom_cert_paths = {}); - - static DefaultRootCACertificates& the(); - - static void set_default_certificate_paths(Span paths); - -private: - Vector m_ca_certificates; -}; -} - -using TLS::DefaultRootCACertificates; diff --git a/Services/RequestServer/main.cpp b/Services/RequestServer/main.cpp index edee16b4538..742b1cfcc34 100644 --- a/Services/RequestServer/main.cpp +++ b/Services/RequestServer/main.cpp @@ -15,7 +15,6 @@ #include #include #include -#include #include #include @@ -60,9 +59,6 @@ ErrorOr serenity_main(Main::Arguments arguments) else RequestServer::g_default_certificate_path = certificates.first(); - DefaultRootCACertificates::set_default_certificate_paths(certificates.span()); - [[maybe_unused]] auto& certs = DefaultRootCACertificates::the(); - Core::EventLoop event_loop; #if defined(AK_OS_MACOS) diff --git a/UI/Android/src/main/cpp/RequestServerService.cpp b/UI/Android/src/main/cpp/RequestServerService.cpp index 6f91b46b8fc..5fefe5da4a6 100644 --- a/UI/Android/src/main/cpp/RequestServerService.cpp +++ b/UI/Android/src/main/cpp/RequestServerService.cpp @@ -20,21 +20,8 @@ #include #include -// FIXME: Share b/w RequestServer and WebSocket -static ErrorOr find_certificates(StringView serenity_resource_root) -{ - auto cert_path = ByteString::formatted("{}/res/ladybird/cacert.pem", serenity_resource_root); - if (!FileSystem::exists(cert_path)) - return Error::from_string_literal("Don't know how to load certs!"); - return cert_path; -} - ErrorOr service_main(int ipc_socket) { - // Ensure the certificates are read out here. - DefaultRootCACertificates::set_default_certificate_paths(Vector { TRY(find_certificates(s_ladybird_resource_root)) }); - [[maybe_unused]] auto& certs = DefaultRootCACertificates::the(); - Core::EventLoop event_loop; RequestServer::HttpProtocol::install(); diff --git a/Utilities/dns.cpp b/Utilities/dns.cpp index 7e06b42ec4f..20640ab4b8b 100644 --- a/Utilities/dns.cpp +++ b/Utilities/dns.cpp @@ -9,7 +9,6 @@ #include #include #include -#include #include ErrorOr serenity_main(Main::Arguments arguments) @@ -95,8 +94,6 @@ ErrorOr serenity_main(Main::Arguments arguments) } }; - DefaultRootCACertificates::set_default_certificate_paths(Array { cert_path.is_empty() ? "/etc/ssl/cert.pem"sv : cert_path }); - MUST(resolver.when_socket_ready()->await()); size_t pending_requests = requests.size();