dart:io | Change the way SecureSocket initializes the NSS library with an empty database.

runtime/bin/secure_socket.cc

 // Copyright (c) 2012, the Dart project authors.  Please see the AUTHORS file
 // for details. All rights reserved. Use of this source code is governed by a
 // BSD-style license that can be found in the LICENSE file.
 
 #include "bin/secure_socket.h"
 
 #include <errno.h>
 #include <fcntl.h>
 #include <sys/stat.h>
 #include <stdio.h>
 #include <string.h>
 
 #include <key.h>
 #include <keyt.h>
 #include <nss.h>
 #include <pk11pub.h>
 #include <prerror.h>
 #include <prinit.h>
 #include <prnetdb.h>
+#include <secmod.h>
 #include <ssl.h>
 #include <sslproto.h>
 
 #include "bin/builtin.h"
 #include "bin/dartutils.h"
 #include "bin/net/nss_memio.h"
 #include "bin/thread.h"
 #include "bin/utils.h"
 #include "platform/utils.h"
 
@@ skipping 296 matching lines @@
 }
 
 
 void SSLFilter::RegisterBadCertificateCallback(Dart_Handle callback) {
   if (NULL != bad_certificate_callback_) {
     Dart_DeletePersistentHandle(bad_certificate_callback_);
   }
   bad_certificate_callback_ = ThrowIfError(Dart_NewPersistentHandle(callback));
 }
 
+static const char* builtin_roots_module =

[Søren Gjesse, 2013/04/12 14:59:31]

As we don't currently have secure_socket_<platform>.cc I think it is of with
having it like this here.

+#if defined(TARGET_OS_LINUX) || defined(TARGET_OS_ANDROID)
+    "name=\"Root Certs\" library=\"libnssckbi.so\"";
+#elif defined(TARGET_OS_MACOS)
+    "name=\"Root Certs\" library=\"libnssckbi.dylib\"";
+#elif defined(TARGET_OS_WINDOWS)
+    "name=\"Root Certs\" library=\"nssckbi.dll\"";
+#else
+#error Automatic target os detection failed.
+#endif
+
+

[Bill Hesse, 2013/04/12 14:42:14]

Too many spaces.

 
 void SSLFilter::InitializeLibrary(const char* certificate_database,
                                   const char* password,
                                   bool use_builtin_root_certificates,
                                   bool report_duplicate_initialization) {
   MutexLocker locker(&mutex_);
+  SECStatus status;
   if (!library_initialized_) {
     password_ = strdup(password);  // This one copy persists until Dart exits.
     PR_Init(PR_USER_THREAD, PR_PRIORITY_NORMAL, 0);
     // TODO(whesse): Verify there are no UTF-8 issues here.
-    PRUint32 init_flags = NSS_INIT_READONLY;
-    if (certificate_database == NULL) {
-      // Passing the empty string as the database path does not try to open
-      // a database in the current directory.
-      certificate_database = "";
-      // The flag NSS_INIT_NOCERTDB is documented to do what we want here,
-      // however it causes the builtins not to be available on Windows.
-      init_flags |= NSS_INIT_FORCEOPEN;
-    }
-    if (!use_builtin_root_certificates) {
-      init_flags |= NSS_INIT_NOMODDB;
-    }
-    SECStatus status = NSS_Initialize(certificate_database,
-                                      "",
-                                      "",
-                                      SECMOD_DB,
-                                      init_flags);
-    if (status != SECSuccess) {
-      mutex_.Unlock();  // MutexLocker destructor not called when throwing.
-      ThrowPRException("Failed NSS_Init call.");
+    if (certificate_database == NULL || certificate_database[0] == '\0') {

[Søren Gjesse, 2013/04/12 14:59:31]

Maybe add a test which passes both null and the empty string to the database
argument of SecureSocket.initialize.

+      status = NSS_NoDB_Init(NULL);
+      if (status != SECSuccess) {
+        mutex_.Unlock();  // MutexLocker destructor not called when throwing.
+        ThrowPRException("Failed NSS_NoDB_Init call.");
+      }
+      if (use_builtin_root_certificates) {
+        SECMODModule* module = SECMOD_LoadUserModule(
+            const_cast<char*>(builtin_roots_module), NULL, PR_FALSE);
+        if (!module) {
+          mutex_.Unlock();  // MutexLocker destructor not called when throwing.
+          ThrowPRException("Failed to load builtin root certificates.");
+        }
+      }
+    } else {
+      PRUint32 init_flags = NSS_INIT_READONLY;
+      if (!use_builtin_root_certificates) {
+        init_flags |= NSS_INIT_NOMODDB;
+      }
+      status = NSS_Initialize(certificate_database,
+                              "",
+                              "",
+                              SECMOD_DB,
+                              init_flags);
+      if (status != SECSuccess) {
+        mutex_.Unlock();  // MutexLocker destructor not called when throwing.
+        ThrowPRException("Failed NSS_Init call.");
+      }
     }
     library_initialized_ = true;
 
     status = NSS_SetDomesticPolicy();
     if (status != SECSuccess) {
       mutex_.Unlock();  // MutexLocker destructor not called when throwing.
       ThrowPRException("Failed NSS_SetDomesticPolicy call.");
     }
     // Enable TLS, as well as SSL3 and SSL2.
     status = SSL_OptionSetDefault(SSL_ENABLE_TLS, PR_TRUE);
@@ skipping 311 matching lines @@
         if (PR_WOULD_BLOCK_ERROR != pr_error) {
           ThrowPRException("Error reading plaintext from SSLFilter");
         }
         bytes_processed = 0;
       }
       break;
     }
   }
   return bytes_processed;
 }