curl: mitigate migration to OpenSSL on Linux

The problem is that curl 8.3.0 removed the NSS backend, so we now have no other choice than to use the bundled OpenSSL on Linux. Currently any curl https connection fails with: CurlSession.cxx:963: curl_easy_perform failed: (60) SSL certificate problem: unable to get local issuer certificate Apparently this requires manually telling curl which CA certificates to trust; there is a configure flag --with-ca-bundle but that is useless as it tries to load the file relative to whatever is the current working directory, and also did i mention that there are at least 3 different locations where a Linux system may store its system trusted CA certificates because ALL ABOUT CHOICE. So add a new header with an init function to try out various file locations listed in this nice blog article and call it from way too many places that independently use curl. https://www.happyassassin.net/posts/2015/01/12/a-note-about-ssltls-trusted-certificate-stores-and-platforms/ TODO: perhaps bundle a cacert.pem as a fallback in case the system chose to innovate by putting its certificates in yet another unexpected place (regression from commit c2930ebff8) Change-Id: Ibf1cc0069bc2ae011ecead9a4c2b455e94b01241 Reviewed-on: https://gerrit.libreoffice.org/c/core/+/158915 Tested-by: Jenkins Reviewed-by: Michael Stahl <michael.stahl@allotropia.de>
2023-11-07 14:26:38 +01:00
parent 6313e83a6f
commit 11f439b861
10 changed files with 97 additions and 0 deletions
@@ -37,6 +37,8 @@
 #include <orcus/json_document_tree.hpp>
 #include <orcus/config.hpp>
 #include <orcus/pstring.hpp>
+
+#include <curlinit.hxx>
 #include <comphelper/hash.hxx>

 #include <com/sun/star/container/XNameAccess.hpp>
@@ -546,6 +548,8 @@ std::string download_content(const OString& rURL, bool bFile, OUString& rHash)
    if (!curl)
        return std::string();

+    ::InitCurl_easy(curl.get());
+
    curl_easy_setopt(curl.get(), CURLOPT_URL, rURL.getStr());
    curl_easy_setopt(curl.get(), CURLOPT_USERAGENT, kUserAgent);
    bool bUseProxy = false;
@@ -17,6 +17,8 @@

 #include <curl/curl.h>

+#include <curlinit.hxx>
+
 #ifdef _WIN32
 #include <memory>
 #include <windows.h>
@@ -95,6 +97,8 @@ static bool uploadContent(std::map<std::string, std::string>& parameters, std::s
    if (!curl)
        return false;

+    ::InitCurl_easy(curl);
+
    std::string proxy, proxy_user_pwd, ca_certificate_file, file, url, version;

    getProperty("Proxy", proxy, parameters);
@@ -23,6 +23,8 @@

 #include <curl/curl.h>

+#include <curlinit.hxx>
+
 #include <o3tl/string_view.hxx>
 #include <osl/diagnose.h>
 #include <osl/file.h>
@@ -222,6 +224,8 @@ static bool curl_run(std::u16string_view rURL, OutData& out, const OString& aPro

    if( nullptr != pCURL )
    {
+        ::InitCurl_easy(pCURL);
+
        out.curl = pCURL;

        OString aURL(OUStringToOString(rURL, RTL_TEXTENCODING_UTF8));
@@ -0,0 +1,59 @@
+/* -*- Mode: C++; tab-width: 4; indent-tabs-mode: nil; c-basic-offset: 4; fill-column: 100 -*- */
+/*
+ * This file is part of the LibreOffice project.
+ *
+ * This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/.
+ */
+
+#pragma once
+
+#include <curl/curl.h>
+
+#if defined(LINUX) && !defined(SYSTEM_CURL)
+#include <com/sun/star/uno/RuntimeException.hpp>
+
+#include <unistd.h>
+
+static char const* GetCABundleFile()
+{
+    // try system ones first; inspired by:
+    // https://www.happyassassin.net/posts/2015/01/12/a-note-about-ssltls-trusted-certificate-stores-and-platforms/
+    auto const candidates = {
+        "/etc/pki/tls/certs/ca-bundle.crt",
+        "/etc/pki/tls/certs/ca-bundle.trust.crt",
+        "/etc/ssl/certs/ca-certificates.crt",
+        "/var/lib/ca-certificates/ca-bundle.pem",
+    };
+    for (char const* const candidate : candidates)
+    {
+        if (access(candidate, R_OK) == 0)
+        {
+            return candidate;
+        }
+    }
+
+    throw css::uno::RuntimeException("no OpenSSL CA certificate bundle found");
+}
+
+static void InitCurl_easy(CURL* const pCURL)
+{
+    char const* const path = GetCABundleFile();
+    auto rc = curl_easy_setopt(pCURL, CURLOPT_CAINFO, path);
+    if (rc != CURLE_OK) // only if OOM?
+    {
+        throw css::uno::RuntimeException("CURLOPT_CAINFO failed");
+    }
+}
+
+#else
+
+static void InitCurl_easy(CURL* const)
+{
+    // these don't use OpenSSL so CAs work out of the box
+}
+
+#endif
+
+/* vim:set shiftwidth=4 softtabstop=4 expandtab cinoptions=b1,g0,N-s cinkeys+=0=break: */
@@ -41,6 +41,9 @@
 #include <boost/property_tree/json_parser.hpp>
 #include <algorithm>
 #include <string_view>
+
+#include <curlinit.hxx>
+
 #include <sal/log.hxx>
 #include <tools/color.hxx>
 #include <tools/long.hxx>
@@ -130,6 +133,8 @@ std::string makeHttpRequest_impl(std::u16string_view aURL, HTTP_METHOD method,
        return {}; // empty string
    }

+    ::InitCurl_easy(curl.get());
+
    // Same useragent string as in CurlSession (ucp/webdav-curl/CurlSession.cxx)
    curl_version_info_data const* const pVersion(curl_version_info(CURLVERSION_NOW));
    assert(pVersion);
@@ -4,6 +4,7 @@
 #include <rtl/string.h>
 #include <boost/property_tree/ptree.hpp>
 #include <boost/property_tree/json_parser.hpp>
+#include <curlinit.hxx>
 #include <vcl/htmltransferable.hxx>
 #include <tools/long.hxx>

@@ -16,6 +17,9 @@ OString Translate(const OString& rTargetLang, const OString& rAPIUrl, const OStr

    std::unique_ptr<CURL, std::function<void(CURL*)>> curl(curl_easy_init(),
                                                           [](CURL* p) { curl_easy_cleanup(p); });
+
+    ::InitCurl_easy(curl.get());
+
    (void)curl_easy_setopt(curl.get(), CURLOPT_URL, rAPIUrl.getStr());
    (void)curl_easy_setopt(curl.get(), CURLOPT_FAILONERROR, 1L);
    (void)curl_easy_setopt(curl.get(), CURLOPT_TIMEOUT, CURL_TIMEOUT);
@@ -15,6 +15,10 @@
 #include <svl/sigstruct.hxx>
 #include <config_crypto.h>

+#if USE_CRYPTO_NSS
+#include <curlinit.hxx>
+#endif
+
 #include <rtl/character.hxx>
 #include <rtl/strbuf.hxx>
 #include <rtl/string.hxx>
@@ -1086,6 +1090,8 @@ bool Signing::Sign(OStringBuffer& rCMSHexBuffer)
            return false;
        }

+        ::InitCurl_easy(curl);
+
        SAL_INFO("svl.crypto", "Setting curl to verbose: " << (curl_easy_setopt(curl, CURLOPT_VERBOSE, 1) == CURLE_OK ? "OK" : "FAIL"));

        if ((rc = curl_easy_setopt(curl, CURLOPT_URL, OUStringToOString(m_aSignTSA, RTL_TEXTENCODING_UTF8).getStr())) != CURLE_OK)
@@ -56,6 +56,8 @@
 #include <ucbhelper/proxydecider.hxx>
 #include <ucbhelper/macros.hxx>
 #include <sax/tools/converter.hxx>
+#include <curlinit.hxx>
+
 #include <utility>

 #include "auth_provider.hxx"
@@ -332,6 +334,9 @@ namespace cmis
                    new CertValidationHandler( xEnv, m_xContext, aBindingUrl.GetHost( ) ) );
            libcmis::SessionFactory::setCertificateValidationHandler( certHandler );

+            // init libcurl callback
+            libcmis::SessionFactory::setCurlInitProtocolsFunction(&::InitCurl_easy);
+
            // Get the auth credentials
            AuthProvider aAuthProvider(xEnv, m_xIdentifier->getContentIdentifier(), m_aURL.getBindingUrl());
            AuthProvider::setXEnv( xEnv );
@@ -25,6 +25,8 @@
 #include "ftploaderthread.hxx"
 #include "curl.hxx"

+#include <curlinit.hxx>
+
 using namespace ftp;


@@ -75,6 +77,8 @@ CURL* FTPLoaderThread::handle() {
    if(!ret) {
        ret = curl_easy_init();
        if (ret != nullptr) {
+            ::InitCurl_easy(ret);
+
            // Make sure curl is not internally using environment variables like
            // "ftp_proxy":
            if (curl_easy_setopt(ret, CURLOPT_PROXY, "") != CURLE_OK) {
@@ -35,6 +35,7 @@
 #include <rtl/uri.hxx>
 #include <rtl/strbuf.hxx>
 #include <rtl/ustrbuf.hxx>
+#include <curlinit.hxx>
 #include <config_version.h>

 #include <map>
@@ -680,6 +681,7 @@ CurlSession::CurlSession(uno::Reference<uno::XComponentContext> xContext,
    assert(rc == CURLE_OK);
    rc = curl_easy_setopt(m_pCurl.get(), CURLOPT_HEADERFUNCTION, &header_callback);
    assert(rc == CURLE_OK);
+    ::InitCurl_easy(m_pCurl.get());
    // tdf#149921 by default, with schannel (WNT) connection fails if revocation
    // lists cannot be checked; try to limit the checking to when revocation
    // lists can actually be retrieved (usually not the case for self-signed CA)