Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 94d44d20 authored by Treehugger Robot's avatar Treehugger Robot Committed by Automerger Merge Worker
Browse files

Merge "Remove RESOLV_INJECT_CA_CERTIFICATE" am: 5b757efb am: c5bc85b9 am: 9af96f85 

Original change: https://android-review.googlesource.com/c/platform/packages/modules/DnsResolver/+/1210063

Change-Id: Ib68df3d5352777951737ba28203daeccc634d1dd
parents 7a7f09f2 9af96f85

Android.bp

+0 −1
Original line number Diff line number Diff line
@@ -167,7 +167,6 @@ cc_library { 
        debuggable: {

            cppflags: [

                "-DRESOLV_ALLOW_VERBOSE_LOGGING=1",

                "-DRESOLV_INJECT_CA_CERTIFICATE=1",

            ],

        },

    },

DnsTlsSocket.cpp

+2 −8
Original line number Diff line number Diff line
@@ -41,11 +41,6 @@ 
#include "private/android_filesystem_config.h"  // AID_DNS

#include "resolv_private.h"



// NOTE: Inject CA certificate for internal testing -- do NOT enable in production builds

#ifndef RESOLV_INJECT_CA_CERTIFICATE

#define RESOLV_INJECT_CA_CERTIFICATE 0

#endif



namespace android {



using base::StringPrintf;
@@ -152,10 +147,9 @@ bool DnsTlsSocket::initialize() { 
    // Load system CA certs from CAPath for hostname verification.

    //

    // For discussion of alternative, sustainable approaches see b/71909242.

    if (RESOLV_INJECT_CA_CERTIFICATE && !mServer.certificate.empty()) {

    if (!mServer.certificate.empty()) {

        // Inject test CA certs from ResolverParamsParcel.caCertificate for internal testing.

        // This is only allowed by DnsResolverService if the caller is not AID_SYSTEM, and on

        // debug builds.

        // This is only allowed by DnsResolverService if the caller is not AID_SYSTEM

        LOG(WARNING) << "Setting test CA certificate. This should never happen in production code.";

        if (!setTestCaCertificate()) {

            LOG(ERROR) << "Failed to set test CA certificate";