authorgravatar for andrew@ziglang.orgAndrew Kelley <andrew@ziglang.org> 2025-10-09 15:24:11-07:00
committergravatar for andrew@ziglang.orgAndrew Kelley <andrew@ziglang.org> 2025-10-29 06:20:49-07:00
log63801c4b058feae3a9b6ca2bbe8effeae267abbc
tree7af2caea39065bb7aa02903204e1f1735aec8c8b
parentfcac8617b4e3c8fcb3a8c888fe77fa8bff1c2057

std.crypto.Certificate.Bundle: remove use of File.readAll

2 files changed, 59 insertions(+), 46 deletions(-)

lib/std/crypto/Certificate/Bundle.zig+56-45
......@@ -4,6 +4,20 @@
44//! concatenated together in the `bytes` array. The `map` field contains an
55//! index from the DER-encoded subject name to the index of the containing
66//! certificate within `bytes`.
7const Bundle = @This();
8const builtin = @import("builtin");
9
10const std = @import("../../std.zig");
11const Io = std.Io;
12const assert = std.debug.assert;
13const fs = std.fs;
14const mem = std.mem;
15const crypto = std.crypto;
16const Allocator = std.mem.Allocator;
17const Certificate = std.crypto.Certificate;
18const der = Certificate.der;
19
20const base64 = std.base64.standard.decoderWithIgnore(" \t\r\n");
721
822/// The key is the contents slice of the subject.
923map: std.HashMapUnmanaged(der.Element.Slice, u32, MapContext, std.hash_map.default_max_load_percentage) = .empty,
......@@ -56,17 +70,17 @@ pub const RescanError = RescanLinuxError || RescanMacError || RescanWithPathErro
5670/// file system standard locations for certificates.
5771/// For operating systems that do not have standard CA installations to be
5872/// found, this function clears the set of certificates.
59pub fn rescan(cb: *Bundle, gpa: Allocator) RescanError!void {
73pub fn rescan(cb: *Bundle, gpa: Allocator, io: Io) RescanError!void {
6074 switch (builtin.os.tag) {
61 .linux => return rescanLinux(cb, gpa),
75 .linux => return rescanLinux(cb, gpa, io),
6276 .macos => return rescanMac(cb, gpa),
63 .freebsd, .openbsd => return rescanWithPath(cb, gpa, "/etc/ssl/cert.pem"),
64 .netbsd => return rescanWithPath(cb, gpa, "/etc/openssl/certs/ca-certificates.crt"),
65 .dragonfly => return rescanWithPath(cb, gpa, "/usr/local/etc/ssl/cert.pem"),
66 .illumos => return rescanWithPath(cb, gpa, "/etc/ssl/cacert.pem"),
67 .haiku => return rescanWithPath(cb, gpa, "/boot/system/data/ssl/CARootCertificates.pem"),
77 .freebsd, .openbsd => return rescanWithPath(cb, gpa, io, "/etc/ssl/cert.pem"),
78 .netbsd => return rescanWithPath(cb, gpa, io, "/etc/openssl/certs/ca-certificates.crt"),
79 .dragonfly => return rescanWithPath(cb, gpa, io, "/usr/local/etc/ssl/cert.pem"),
80 .illumos => return rescanWithPath(cb, gpa, io, "/etc/ssl/cacert.pem"),
81 .haiku => return rescanWithPath(cb, gpa, io, "/boot/system/data/ssl/CARootCertificates.pem"),
6882 // https://github.com/SerenityOS/serenity/blob/222acc9d389bc6b490d4c39539761b043a4bfcb0/Ports/ca-certificates/package.sh#L19
69 .serenity => return rescanWithPath(cb, gpa, "/etc/ssl/certs/ca-certificates.crt"),
83 .serenity => return rescanWithPath(cb, gpa, io, "/etc/ssl/certs/ca-certificates.crt"),
7084 .windows => return rescanWindows(cb, gpa),
7185 else => {},
7286 }
......@@ -77,7 +91,7 @@ const RescanMacError = @import("Bundle/macos.zig").RescanMacError;
7791
7892const RescanLinuxError = AddCertsFromFilePathError || AddCertsFromDirPathError;
7993
80fn rescanLinux(cb: *Bundle, gpa: Allocator) RescanLinuxError!void {
94fn rescanLinux(cb: *Bundle, gpa: Allocator, io: Io) RescanLinuxError!void {
8195 // Possible certificate files; stop after finding one.
8296 const cert_file_paths = [_][]const u8{
8397 "/etc/ssl/certs/ca-certificates.crt", // Debian/Ubuntu/Gentoo etc.
......@@ -100,7 +114,7 @@ fn rescanLinux(cb: *Bundle, gpa: Allocator) RescanLinuxError!void {
100114
101115 scan: {
102116 for (cert_file_paths) |cert_file_path| {
103 if (addCertsFromFilePathAbsolute(cb, gpa, cert_file_path)) |_| {
117 if (addCertsFromFilePathAbsolute(cb, gpa, io, cert_file_path)) |_| {
104118 break :scan;
105119 } else |err| switch (err) {
106120 error.FileNotFound => continue,
......@@ -109,7 +123,7 @@ fn rescanLinux(cb: *Bundle, gpa: Allocator) RescanLinuxError!void {
109123 }
110124
111125 for (cert_dir_paths) |cert_dir_path| {
112 addCertsFromDirPathAbsolute(cb, gpa, cert_dir_path) catch |err| switch (err) {
126 addCertsFromDirPathAbsolute(cb, gpa, io, cert_dir_path) catch |err| switch (err) {
113127 error.FileNotFound => continue,
114128 else => |e| return e,
115129 };
......@@ -121,10 +135,10 @@ fn rescanLinux(cb: *Bundle, gpa: Allocator) RescanLinuxError!void {
121135
122136const RescanWithPathError = AddCertsFromFilePathError;
123137
124fn rescanWithPath(cb: *Bundle, gpa: Allocator, cert_file_path: []const u8) RescanWithPathError!void {
138fn rescanWithPath(cb: *Bundle, gpa: Allocator, io: Io, cert_file_path: []const u8) RescanWithPathError!void {
125139 cb.bytes.clearRetainingCapacity();
126140 cb.map.clearRetainingCapacity();
127 try addCertsFromFilePathAbsolute(cb, gpa, cert_file_path);
141 try addCertsFromFilePathAbsolute(cb, gpa, io, cert_file_path);
128142 cb.bytes.shrinkAndFree(gpa, cb.bytes.items.len);
129143}
130144
......@@ -160,28 +174,30 @@ pub const AddCertsFromDirPathError = fs.File.OpenError || AddCertsFromDirError;
160174pub fn addCertsFromDirPath(
161175 cb: *Bundle,
162176 gpa: Allocator,
177 io: Io,
163178 dir: fs.Dir,
164179 sub_dir_path: []const u8,
165180) AddCertsFromDirPathError!void {
166181 var iterable_dir = try dir.openDir(sub_dir_path, .{ .iterate = true });
167182 defer iterable_dir.close();
168 return addCertsFromDir(cb, gpa, iterable_dir);
183 return addCertsFromDir(cb, gpa, io, iterable_dir);
169184}
170185
171186pub fn addCertsFromDirPathAbsolute(
172187 cb: *Bundle,
173188 gpa: Allocator,
189 io: Io,
174190 abs_dir_path: []const u8,
175191) AddCertsFromDirPathError!void {
176192 assert(fs.path.isAbsolute(abs_dir_path));
177193 var iterable_dir = try fs.openDirAbsolute(abs_dir_path, .{ .iterate = true });
178194 defer iterable_dir.close();
179 return addCertsFromDir(cb, gpa, iterable_dir);
195 return addCertsFromDir(cb, gpa, io, iterable_dir);
180196}
181197
182198pub const AddCertsFromDirError = AddCertsFromFilePathError;
183199
184pub fn addCertsFromDir(cb: *Bundle, gpa: Allocator, iterable_dir: fs.Dir) AddCertsFromDirError!void {
200pub fn addCertsFromDir(cb: *Bundle, gpa: Allocator, io: Io, iterable_dir: fs.Dir) AddCertsFromDirError!void {
185201 var it = iterable_dir.iterate();
186202 while (try it.next()) |entry| {
187203 switch (entry.kind) {
......@@ -189,32 +205,37 @@ pub fn addCertsFromDir(cb: *Bundle, gpa: Allocator, iterable_dir: fs.Dir) AddCer
189205 else => continue,
190206 }
191207
192 try addCertsFromFilePath(cb, gpa, iterable_dir, entry.name);
208 try addCertsFromFilePath(cb, gpa, io, iterable_dir.adaptToNewApi(), entry.name);
193209 }
194210}
195211
196pub const AddCertsFromFilePathError = fs.File.OpenError || AddCertsFromFileError;
212pub const AddCertsFromFilePathError = fs.File.OpenError || AddCertsFromFileError || Io.Clock.Error;
197213
198214pub fn addCertsFromFilePathAbsolute(
199215 cb: *Bundle,
200216 gpa: Allocator,
217 io: Io,
201218 abs_file_path: []const u8,
202219) AddCertsFromFilePathError!void {
203 assert(fs.path.isAbsolute(abs_file_path));
220 const now = try Io.Clock.real.now(io);
204221 var file = try fs.openFileAbsolute(abs_file_path, .{});
205222 defer file.close();
206 return addCertsFromFile(cb, gpa, file);
223 var file_reader = file.reader(io, &.{});
224 return addCertsFromFile(cb, gpa, &file_reader, now.toSeconds());
207225}
208226
209227pub fn addCertsFromFilePath(
210228 cb: *Bundle,
211229 gpa: Allocator,
212 dir: fs.Dir,
230 io: Io,
231 dir: Io.Dir,
213232 sub_file_path: []const u8,
214233) AddCertsFromFilePathError!void {
215 var file = try dir.openFile(sub_file_path, .{});
216 defer file.close();
217 return addCertsFromFile(cb, gpa, file);
234 const now = try Io.Clock.real.now(io);
235 var file = try dir.openFile(io, sub_file_path, .{});
236 defer file.close(io);
237 var file_reader = file.reader(io, &.{});
238 return addCertsFromFile(cb, gpa, &file_reader, now.toSeconds());
218239}
219240
220241pub const AddCertsFromFileError = Allocator.Error ||
......@@ -222,10 +243,10 @@ pub const AddCertsFromFileError = Allocator.Error ||
222243 fs.File.ReadError ||
223244 ParseCertError ||
224245 std.base64.Error ||
225 error{ CertificateAuthorityBundleTooBig, MissingEndCertificateMarker };
246 error{ CertificateAuthorityBundleTooBig, MissingEndCertificateMarker, Streaming };
226247
227pub fn addCertsFromFile(cb: *Bundle, gpa: Allocator, file: fs.File) AddCertsFromFileError!void {
228 const size = try file.getEndPos();
248pub fn addCertsFromFile(cb: *Bundle, gpa: Allocator, file_reader: *Io.File.Reader, now_sec: i64) AddCertsFromFileError!void {
249 const size = try file_reader.getSize();
229250
230251 // We borrow `bytes` as a temporary buffer for the base64-encoded data.
231252 // This is possible by computing the decoded length and reserving the space
......@@ -236,14 +257,14 @@ pub fn addCertsFromFile(cb: *Bundle, gpa: Allocator, file: fs.File) AddCertsFrom
236257 try cb.bytes.ensureUnusedCapacity(gpa, needed_capacity);
237258 const end_reserved: u32 = @intCast(cb.bytes.items.len + decoded_size_upper_bound);
238259 const buffer = cb.bytes.allocatedSlice()[end_reserved..];
239 const end_index = try file.readAll(buffer);
260 const end_index = file_reader.interface.readSliceShort(buffer) catch |err| switch (err) {
261 error.ReadFailed => return file_reader.err.?,
262 };
240263 const encoded_bytes = buffer[0..end_index];
241264
242265 const begin_marker = "-----BEGIN CERTIFICATE-----";
243266 const end_marker = "-----END CERTIFICATE-----";
244267
245 const now_sec = std.time.timestamp();
246
247268 var start_index: usize = 0;
248269 while (mem.indexOfPos(u8, encoded_bytes, start_index, begin_marker)) |begin_marker_start| {
249270 const cert_start = begin_marker_start + begin_marker.len;
......@@ -288,19 +309,6 @@ pub fn parseCert(cb: *Bundle, gpa: Allocator, decoded_start: u32, now_sec: i64)
288309 }
289310}
290311
291const builtin = @import("builtin");
292const std = @import("../../std.zig");
293const assert = std.debug.assert;
294const fs = std.fs;
295const mem = std.mem;
296const crypto = std.crypto;
297const Allocator = std.mem.Allocator;
298const Certificate = std.crypto.Certificate;
299const der = Certificate.der;
300const Bundle = @This();
301
302const base64 = std.base64.standard.decoderWithIgnore(" \t\r\n");
303
304312const MapContext = struct {
305313 cb: *const Bundle,
306314
......@@ -321,8 +329,11 @@ const MapContext = struct {
321329test "scan for OS-provided certificates" {
322330 if (builtin.os.tag == .wasi) return error.SkipZigTest;
323331
332 const io = std.testing.io;
333 const gpa = std.testing.allocator;
334
324335 var bundle: Bundle = .{};
325 defer bundle.deinit(std.testing.allocator);
336 defer bundle.deinit(gpa);
326337
327 try bundle.rescan(std.testing.allocator);
338 try bundle.rescan(gpa, io);
328339}
lib/std/http/Client.zig+3-1
......@@ -1666,6 +1666,8 @@ pub fn request(
16661666 uri: Uri,
16671667 options: RequestOptions,
16681668) RequestError!Request {
1669 const io = client.io;
1670
16691671 if (std.debug.runtime_safety) {
16701672 for (options.extra_headers) |header| {
16711673 assert(header.name.len != 0);
......@@ -1689,7 +1691,7 @@ pub fn request(
16891691 defer client.ca_bundle_mutex.unlock();
16901692
16911693 if (client.next_https_rescan_certs) {
1692 client.ca_bundle.rescan(client.allocator) catch
1694 client.ca_bundle.rescan(client.allocator, io) catch
16931695 return error.CertificateBundleLoadFailure;
16941696 @atomicStore(bool, &client.next_https_rescan_certs, false, .release);
16951697 }