Skip to content
Snippets Groups Projects
Commit cae4e785 authored by Roxie Linden's avatar Roxie Linden
Browse files

Allow update of the default CAs on install

parent 75755a67
No related branches found
No related tags found
No related merge requests found
...@@ -585,6 +585,11 @@ LLBasicCertificateStore::LLBasicCertificateStore(const std::string& filename) ...@@ -585,6 +585,11 @@ LLBasicCertificateStore::LLBasicCertificateStore(const std::string& filename)
void LLBasicCertificateStore::load_from_file(const std::string& filename) void LLBasicCertificateStore::load_from_file(const std::string& filename)
{ {
// scan the PEM file extracting each certificate // scan the PEM file extracting each certificate
if (!LLFile::isfile(filename))
{
return;
}
BIO* file_bio = BIO_new(BIO_s_file()); BIO* file_bio = BIO_new(BIO_s_file());
if(file_bio) if(file_bio)
{ {
...@@ -1148,30 +1153,26 @@ void LLSecAPIBasicHandler::init() ...@@ -1148,30 +1153,26 @@ void LLSecAPIBasicHandler::init()
"bin_conf.dat"); "bin_conf.dat");
std::string store_file = gDirUtilp->getExpandedFilename(LL_PATH_USER_SETTINGS, std::string store_file = gDirUtilp->getExpandedFilename(LL_PATH_USER_SETTINGS,
"CA.pem"); "CA.pem");
// copy the CA file to a user writable location so we can manipulate it.
// for this provider, by using a user writable file, there is a risk that
// an attacking program can modify the file, but OS dependent providers
// will reduce that risk.
// by using a user file, modifications will be limited to one user if
// we read-only the main file
if (!LLFile::isfile(store_file))
{
LL_INFOS("SECAPI") << "Loading certificate store from " << store_file << LL_ENDL;
mStore = new LLBasicCertificateStore(store_file);
// grab the application CA.pem file that contains the well-known certs shipped
// with the product
std::string ca_file_path = gDirUtilp->getExpandedFilename(LL_PATH_APP_SETTINGS, "CA.pem"); std::string ca_file_path = gDirUtilp->getExpandedFilename(LL_PATH_APP_SETTINGS, "CA.pem");
llifstream ca_file(ca_file_path.c_str(), llifstream::binary | llifstream::in); llinfos << "app path " << ca_file_path << llendl;
llofstream copied_store_file(store_file.c_str(), llofstream::binary | llofstream::out); LLBasicCertificateStore app_ca_store = LLBasicCertificateStore(ca_file_path);
while(!ca_file.fail()) // push the applicate CA files into the store, therefore adding any new CA certs that
// updated
for(LLCertificateVector::iterator i = app_ca_store.begin();
i != app_ca_store.end();
i++)
{ {
char buffer[BUFFER_READ_SIZE]; mStore->add(*i);
ca_file.read(buffer, sizeof(buffer));
copied_store_file.write(buffer, ca_file.gcount());
}
ca_file.close();
copied_store_file.close();
} }
LL_INFOS("SECAPI") << "Loading certificate store from " << store_file << LL_ENDL;
mStore = new LLBasicCertificateStore(store_file);
} }
_readProtectedData(); // initialize mProtectedDataMap _readProtectedData(); // initialize mProtectedDataMap
// may throw LLProtectedDataException if saved datamap is not decryptable // may throw LLProtectedDataException if saved datamap is not decryptable
......
0% Loading or .
You are about to add 0 people to the discussion. Proceed with caution.
Please register or to comment