OLD | NEW |
1 // Copyright (c) 2015, the Dart project authors. Please see the AUTHORS file | 1 // Copyright (c) 2015, the Dart project authors. Please see the AUTHORS file |
2 // for details. All rights reserved. Use of this source code is governed by a | 2 // for details. All rights reserved. Use of this source code is governed by a |
3 // BSD-style license that can be found in the LICENSE file. | 3 // BSD-style license that can be found in the LICENSE file. |
4 | 4 |
5 part of dart.io; | 5 part of dart.io; |
6 | 6 |
7 /** | 7 /** |
8 * The object containing the certificates to trust when making | 8 * The object containing the certificates to trust when making |
9 * a secure client connection, and the certificate chain and | 9 * a secure client connection, and the certificate chain and |
10 * private key to serve from a secure server. | 10 * private key to serve from a secure server. |
11 * | 11 * |
12 * The [SecureSocket] and [SecureServer] classes take a SecurityContext | 12 * The [SecureSocket] and [SecureServerSocket] classes take a SecurityContext |
13 * as an argument to their connect and bind methods. | 13 * as an argument to their connect and bind methods. |
14 * | 14 * |
15 * Certificates and keys can be added to a SecurityContext from either PEM | 15 * Certificates and keys can be added to a SecurityContext from either PEM |
16 * or PKCS12 containers. | 16 * or PKCS12 containers. |
17 * | 17 * |
18 * iOS note: Some methods to add, remove, and inspect certificates are not yet | 18 * iOS note: Some methods to add, remove, and inspect certificates are not yet |
19 * implemented. However, the platform's built-in trusted certificates can | 19 * implemented. However, the platform's built-in trusted certificates can |
20 * be used, by way of [SecurityContext.defaultContext]. | 20 * be used, by way of [SecurityContext.defaultContext]. |
21 */ | 21 */ |
22 abstract class SecurityContext { | 22 abstract class SecurityContext { |
(...skipping 15 matching lines...) Expand all Loading... |
38 /** | 38 /** |
39 * Sets the private key for a server certificate or client certificate. | 39 * Sets the private key for a server certificate or client certificate. |
40 * | 40 * |
41 * A secure connection using this SecurityContext will use this key with | 41 * A secure connection using this SecurityContext will use this key with |
42 * the server or client certificate to sign and decrypt messages. | 42 * the server or client certificate to sign and decrypt messages. |
43 * [file] is the path to a PEM or PKCS12 file containing an encrypted | 43 * [file] is the path to a PEM or PKCS12 file containing an encrypted |
44 * private key, encrypted with [password]. Assuming it is well-formatted, all | 44 * private key, encrypted with [password]. Assuming it is well-formatted, all |
45 * other contents of [file] are ignored. An unencrypted file can be used, | 45 * other contents of [file] are ignored. An unencrypted file can be used, |
46 * but this is not usual. | 46 * but this is not usual. |
47 * | 47 * |
48 * NB: This function calls [ReadFileAsBytesSync], and will block on file IO. | 48 * NB: This function calls [File.readAsBytesSync], and will block on file IO. |
49 * Prefer using [usePrivateKeyBytes]. | 49 * Prefer using [usePrivateKeyBytes]. |
50 * | 50 * |
51 * iOS note: Only PKCS12 data is supported. It should contain both the private | 51 * iOS note: Only PKCS12 data is supported. It should contain both the private |
52 * key and the certificate chain. On iOS one call to [usePrivateKey] with this | 52 * key and the certificate chain. On iOS one call to [usePrivateKey] with this |
53 * data is used instead of two calls to [useCertificateChain] and | 53 * data is used instead of two calls to [useCertificateChain] and |
54 * [usePrivateKey]. | 54 * [usePrivateKey]. |
55 */ | 55 */ |
56 void usePrivateKey(String file, {String password}); | 56 void usePrivateKey(String file, {String password}); |
57 | 57 |
58 /** | 58 /** |
59 * Sets the private key for a server certificate or client certificate. | 59 * Sets the private key for a server certificate or client certificate. |
60 * | 60 * |
61 * Like [usePrivateKey], but takes the contents of the file as a list | 61 * Like [usePrivateKey], but takes the contents of the file as a list |
62 * of bytes. | 62 * of bytes. |
63 */ | 63 */ |
64 void usePrivateKeyBytes(List<int> keyBytes, {String password}); | 64 void usePrivateKeyBytes(List<int> keyBytes, {String password}); |
65 | 65 |
66 /** | 66 /** |
67 * Sets the set of trusted X509 certificates used by [SecureSocket] | 67 * Sets the set of trusted X509 certificates used by [SecureSocket] |
68 * client connections, when connecting to a secure server. | 68 * client connections, when connecting to a secure server. |
69 * | 69 * |
70 * [file] is the path to a PEM or PKCS12 file containing X509 certificates, | 70 * [file] is the path to a PEM or PKCS12 file containing X509 certificates, |
71 * usually root certificates from certificate authorities. For PKCS12 files, | 71 * usually root certificates from certificate authorities. For PKCS12 files, |
72 * [password] is the password for the file. For PEM files, [password] is | 72 * [password] is the password for the file. For PEM files, [password] is |
73 * ignored. Assuming it is well-formatted, all other contents of [file] are | 73 * ignored. Assuming it is well-formatted, all other contents of [file] are |
74 * ignored. | 74 * ignored. |
75 * | 75 * |
76 * NB: This function calls [ReadFileAsBytesSync], and will block on file IO. | 76 * NB: This function calls [File.readAsBytesSync], and will block on file IO. |
77 * Prefer using [setTrustedCertificatesBytes]. | 77 * Prefer using [setTrustedCertificatesBytes]. |
78 * | 78 * |
79 * iOS note: On iOS, this call takes only the bytes for a single DER | 79 * iOS note: On iOS, this call takes only the bytes for a single DER |
80 * encoded X509 certificate. It may be called multiple times to add | 80 * encoded X509 certificate. It may be called multiple times to add |
81 * multiple trusted certificates to the context. A DER encoded certificate | 81 * multiple trusted certificates to the context. A DER encoded certificate |
82 * can be obtained from a PEM encoded certificate by using the openssl tool: | 82 * can be obtained from a PEM encoded certificate by using the openssl tool: |
83 * | 83 * |
84 * $ openssl x509 -outform der -in cert.pem -out cert.der | 84 * $ openssl x509 -outform der -in cert.pem -out cert.der |
85 */ | 85 */ |
86 void setTrustedCertificates(String file, {String password}); | 86 void setTrustedCertificates(String file, {String password}); |
87 | 87 |
88 /** | 88 /** |
89 * Sets the set of trusted X509 certificates used by [SecureSocket] | 89 * Sets the set of trusted X509 certificates used by [SecureSocket] |
90 * client connections, when connecting to a secure server. | 90 * client connections, when connecting to a secure server. |
91 * | 91 * |
92 * Like [setTrustedCertificates] but takes the contents of the file. | 92 * Like [setTrustedCertificates] but takes the contents of the file. |
93 */ | 93 */ |
94 void setTrustedCertificatesBytes(List<int> certBytes, {String password}); | 94 void setTrustedCertificatesBytes(List<int> certBytes, {String password}); |
95 | 95 |
96 /** | 96 /** |
97 * Sets the chain of X509 certificates served by [SecureServer] | 97 * Sets the chain of X509 certificates served by [SecureServerSocket] |
98 * when making secure connections, including the server certificate. | 98 * when making secure connections, including the server certificate. |
99 * | 99 * |
100 * [file] is a PEM or PKCS12 file containing X509 certificates, starting with | 100 * [file] is a PEM or PKCS12 file containing X509 certificates, starting with |
101 * the root authority and intermediate authorities forming the signed | 101 * the root authority and intermediate authorities forming the signed |
102 * chain to the server certificate, and ending with the server certificate. | 102 * chain to the server certificate, and ending with the server certificate. |
103 * The private key for the server certificate is set by [usePrivateKey]. For | 103 * The private key for the server certificate is set by [usePrivateKey]. For |
104 * PKCS12 files, [password] is the password for the file. For PEM files, | 104 * PKCS12 files, [password] is the password for the file. For PEM files, |
105 * [password] is ignored. Assuming it is well-formatted, all | 105 * [password] is ignored. Assuming it is well-formatted, all |
106 * other contents of [file] are ignored. | 106 * other contents of [file] are ignored. |
107 * | 107 * |
108 * NB: This function calls [ReadFileAsBytesSync], and will block on file IO. | 108 * NB: This function calls [File.readAsBytesSync], and will block on file IO. |
109 * Prefer using [useCertificateChainBytes]. | 109 * Prefer using [useCertificateChainBytes]. |
110 * | 110 * |
111 * iOS note: As noted above, [usePrivateKey] does the job of both | 111 * iOS note: As noted above, [usePrivateKey] does the job of both |
112 * that call and this one. On iOS, this call is a no-op. | 112 * that call and this one. On iOS, this call is a no-op. |
113 */ | 113 */ |
114 void useCertificateChain(String file, {String password}); | 114 void useCertificateChain(String file, {String password}); |
115 | 115 |
116 /** | 116 /** |
117 * Sets the chain of X509 certificates served by [SecureServer] | 117 * Sets the chain of X509 certificates served by [SecureServerSocket] |
118 * when making secure connections, including the server certificate. | 118 * when making secure connections, including the server certificate. |
119 * | 119 * |
120 * Like [useCertificateChain] but takes the contents of the file. | 120 * Like [useCertificateChain] but takes the contents of the file. |
121 */ | 121 */ |
122 void useCertificateChainBytes(List<int> chainBytes, {String password}); | 122 void useCertificateChainBytes(List<int> chainBytes, {String password}); |
123 | 123 |
124 /** | 124 /** |
125 * Sets the list of authority names that a [SecureServer] will advertise | 125 * Sets the list of authority names that a [SecureServerSocket] will advertise |
126 * as accepted when requesting a client certificate from a connecting | 126 * as accepted when requesting a client certificate from a connecting |
127 * client. | 127 * client. |
128 * | 128 * |
129 * [file] is a PEM or PKCS12 file containing the accepted signing | 129 * [file] is a PEM or PKCS12 file containing the accepted signing |
130 * authority certificates - the authority names are extracted from the | 130 * authority certificates - the authority names are extracted from the |
131 * certificates. For PKCS12 files, [password] is the password for the file. | 131 * certificates. For PKCS12 files, [password] is the password for the file. |
132 * For PEM files, [password] is ignored. Assuming it is well-formatted, all | 132 * For PEM files, [password] is ignored. Assuming it is well-formatted, all |
133 * other contents of [file] are ignored. | 133 * other contents of [file] are ignored. |
134 * | 134 * |
135 * NB: This function calls [ReadFileAsBytesSync], and will block on file IO. | 135 * NB: This function calls [File.readAsBytesSync], and will block on file IO. |
136 * Prefer using [setClientAuthoritiesBytes]. | 136 * Prefer using [setClientAuthoritiesBytes]. |
137 * | 137 * |
138 * iOS note: This call is not supported. | 138 * iOS note: This call is not supported. |
139 */ | 139 */ |
140 void setClientAuthorities(String file, {String password}); | 140 void setClientAuthorities(String file, {String password}); |
141 | 141 |
142 /** | 142 /** |
143 * Sets the list of authority names that a [SecureServer] will advertise | 143 * Sets the list of authority names that a [SecureServerSocket] will advertise |
144 * as accepted, when requesting a client certificate from a connecting | 144 * as accepted, when requesting a client certificate from a connecting |
145 * client. | 145 * client. |
146 * | 146 * |
147 * Like [setClientAuthority] but takes the contents of the file. | 147 * Like [setClientAuthorities] but takes the contents of the file. |
148 */ | 148 */ |
149 void setClientAuthoritiesBytes(List<int> authCertBytes, {String password}); | 149 void setClientAuthoritiesBytes(List<int> authCertBytes, {String password}); |
150 | 150 |
151 /** | 151 /** |
152 * Whether the platform supports ALPN. | 152 * Whether the platform supports ALPN. |
153 */ | 153 */ |
154 external static bool get alpnSupported; | 154 external static bool get alpnSupported; |
155 | 155 |
156 /** | 156 /** |
157 * Sets the list of application-level protocols supported by a client | 157 * Sets the list of application-level protocols supported by a client |
(...skipping 100 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... |
258 } | 258 } |
259 | 259 |
260 if (bytes.length >= (1 << 13)) { | 260 if (bytes.length >= (1 << 13)) { |
261 throw new ArgumentError( | 261 throw new ArgumentError( |
262 'The maximum message length supported is 2^13-1.'); | 262 'The maximum message length supported is 2^13-1.'); |
263 } | 263 } |
264 | 264 |
265 return new Uint8List.fromList(bytes); | 265 return new Uint8List.fromList(bytes); |
266 } | 266 } |
267 } | 267 } |
OLD | NEW |