dont write a certificate bundle if the shipped ca bundle is empty

Signed-off-by: Robin Appelman <robin@icewind.nl>
This commit is contained in:
Robin Appelman 2017-01-09 14:26:31 +01:00
parent ae934cbdab
commit 817e974c5f
No known key found for this signature in database
GPG Key ID: CBCA68FBAEBF98C9
3 changed files with 23 additions and 8 deletions

View File

@ -30,6 +30,7 @@ namespace OC\Security;
use OC\Files\Filesystem; use OC\Files\Filesystem;
use OCP\ICertificateManager; use OCP\ICertificateManager;
use OCP\IConfig; use OCP\IConfig;
use OCP\ILogger;
/** /**
* Manage trusted certificates for users * Manage trusted certificates for users
@ -50,15 +51,22 @@ class CertificateManager implements ICertificateManager {
*/ */
protected $config; protected $config;
/**
* @var ILogger
*/
protected $logger;
/** /**
* @param string $uid * @param string $uid
* @param \OC\Files\View $view relative to data/ * @param \OC\Files\View $view relative to data/
* @param IConfig $config * @param IConfig $config
* @param ILogger $logger
*/ */
public function __construct($uid, \OC\Files\View $view, IConfig $config) { public function __construct($uid, \OC\Files\View $view, IConfig $config, ILogger $logger) {
$this->uid = $uid; $this->uid = $uid;
$this->view = $view; $this->view = $view;
$this->config = $config; $this->config = $config;
$this->logger = $logger;
} }
/** /**
@ -104,6 +112,13 @@ class CertificateManager implements ICertificateManager {
$this->view->mkdir($path); $this->view->mkdir($path);
} }
$defaultCertificates = file_get_contents(\OC::$SERVERROOT . '/resources/config/ca-bundle.crt');
if (strlen($defaultCertificates) < 1024) { // sanity check to verify that we have some content for our bundle
// log as exception so we have a stacktrace
$this->logger->logException(new \Exception('Shipped ca-bundle is empty, refusing to create certificate bundle'));
return;
}
$fhCerts = $this->view->fopen($path . '/rootcerts.crt', 'w'); $fhCerts = $this->view->fopen($path . '/rootcerts.crt', 'w');
// Write user certificates // Write user certificates
@ -117,7 +132,6 @@ class CertificateManager implements ICertificateManager {
} }
// Append the default certificates // Append the default certificates
$defaultCertificates = file_get_contents(\OC::$SERVERROOT . '/resources/config/ca-bundle.crt');
fwrite($fhCerts, $defaultCertificates); fwrite($fhCerts, $defaultCertificates);
// Append the system certificate bundle // Append the system certificate bundle
@ -203,7 +217,7 @@ class CertificateManager implements ICertificateManager {
} }
if ($this->needsRebundling($uid)) { if ($this->needsRebundling($uid)) {
if (is_null($uid)) { if (is_null($uid)) {
$manager = new CertificateManager(null, $this->view, $this->config); $manager = new CertificateManager(null, $this->view, $this->config, $this->logger);
$manager->createCertificateBundle(); $manager->createCertificateBundle();
} else { } else {
$this->createCertificateBundle(); $this->createCertificateBundle();

View File

@ -482,7 +482,7 @@ class Server extends ServerContainer implements IServerContainer {
$uid = $user ? $user : null; $uid = $user ? $user : null;
return new ClientService( return new ClientService(
$c->getConfig(), $c->getConfig(),
new \OC\Security\CertificateManager($uid, new View(), $c->getConfig()) new \OC\Security\CertificateManager($uid, new View(), $c->getConfig(), $c->getLogger())
); );
}); });
$this->registerService('EventLogger', function (Server $c) { $this->registerService('EventLogger', function (Server $c) {
@ -1220,7 +1220,7 @@ class Server extends ServerContainer implements IServerContainer {
} }
$userId = $user->getUID(); $userId = $user->getUID();
} }
return new CertificateManager($userId, new View(), $this->getConfig()); return new CertificateManager($userId, new View(), $this->getConfig(), $this->getLogger());
} }
/** /**

View File

@ -8,8 +8,10 @@
namespace Test\Security; namespace Test\Security;
use OC\Files\Storage\Temporary;
use \OC\Security\CertificateManager; use \OC\Security\CertificateManager;
use OCP\IConfig; use OCP\IConfig;
use OCP\ILogger;
/** /**
* Class CertificateManagerTest * Class CertificateManagerTest
@ -43,7 +45,7 @@ class CertificateManagerTest extends \Test\TestCase {
$config->expects($this->any())->method('getSystemValue') $config->expects($this->any())->method('getSystemValue')
->with('installed', false)->willReturn(true); ->with('installed', false)->willReturn(true);
$this->certificateManager = new CertificateManager($this->username, new \OC\Files\View(), $config); $this->certificateManager = new CertificateManager($this->username, new \OC\Files\View(), $config, $this->createMock(ILogger::class));
} }
protected function tearDown() { protected function tearDown() {
@ -143,7 +145,7 @@ class CertificateManagerTest extends \Test\TestCase {
/** @var CertificateManager | \PHPUnit_Framework_MockObject_MockObject $certificateManager */ /** @var CertificateManager | \PHPUnit_Framework_MockObject_MockObject $certificateManager */
$certificateManager = $this->getMockBuilder('OC\Security\CertificateManager') $certificateManager = $this->getMockBuilder('OC\Security\CertificateManager')
->setConstructorArgs([$uid, $view, $config]) ->setConstructorArgs([$uid, $view, $config, $this->createMock(ILogger::class)])
->setMethods(['getFilemtimeOfCaBundle', 'getCertificateBundle']) ->setMethods(['getFilemtimeOfCaBundle', 'getCertificateBundle'])
->getMock(); ->getMock();
@ -210,5 +212,4 @@ class CertificateManagerTest extends \Test\TestCase {
[null, 10, 5, 8, false, true], [null, 10, 5, 8, false, true],
]; ];
} }
} }