Automatically use CA certificates provided by Android OS

2024-02-19 02:34:17 +02:00
parent 0862ca2007
commit 0db9dd875b
10 changed files with 48 additions and 45 deletions
--- a/app/src/main/kotlin/com/tutpro/baresip/Config.kt
+++ b/app/src/main/kotlin/com/tutpro/baresip/Config.kt
@ -61,9 +61,36 @@ object Config {
        if (sipVerifyServer != "")
            config = "${config}sip_verify_server $sipVerifyServer\n"

-        val sipCaFile = previousVariable("sip_cafile")
-        if (sipCaFile != "")
-            config = "${config}sip_cafile $sipCaFile\n"
+        val caBundlePath = "${BaresipService.filesPath}/ca_bundle.crt"
+        val caBundleFile = File(caBundlePath)
+        val caFilePath = "${BaresipService.filesPath}/ca_certs.crt"
+        val caFile = File(caFilePath)
+        if (caFile.exists())
+            caFile.copyTo(caBundleFile, true)
+        else
+            caBundleFile.writeBytes(byteArrayOf())
+        Log.d(TAG, "Size of caFile = ${caBundleFile.length()}")
+        val cacertsPath = "/system/etc/security/cacerts"
+        val cacertsDir = File(cacertsPath)
+        var caCount = 0
+        if (cacertsDir.exists()) {
+            cacertsDir.walk().forEach {
+                if (it.isFile) {
+                    caBundleFile.appendBytes(
+                        it.readBytes()
+                            .toString(Charsets.UTF_8)
+                            .substringBefore("Certificate:")
+                            .toByteArray(Charsets.UTF_8)
+                    )
+                    caCount++
+                }
+            }
+            Log.d(TAG, "Added $caCount ca certificates from $cacertsPath")
+        } else {
+            Log.w(TAG, "Directory $cacertsDir does not exist!")
+        }
+        Log.d(TAG, "Size of caBundleFile = ${caBundleFile.length()}")
+        config = "${config}sip_cafile $caBundlePath\n"

        val dynamicDns = previousVariable("dyn_dns")
        if (dynamicDns == "no") {
--- a/app/src/main/kotlin/com/tutpro/baresip/ConfigActivity.kt
+++ b/app/src/main/kotlin/com/tutpro/baresip/ConfigActivity.kt
@ -70,7 +70,6 @@ class ConfigActivity : AppCompatActivity() {
    private var oldDnsServers = ""
    private var oldCertificateFile = false
    private var oldVerifyServer = false
-    private var oldCAFile = false
    private var oldLogLevel = ""
    private var oldDisplayTheme = -1
    private var oldContactsMode = ""
@ -313,8 +312,8 @@ class ConfigActivity : AppCompatActivity() {
        verifyServer.isChecked = oldVerifyServer

        caFile = binding.CAFile
-        oldCAFile = Config.variable("sip_cafile") != ""
-        caFile.isChecked = oldCAFile
+        val caCertsFile = File(BaresipService.filesPath + "/ca_certs.crt")
+        caFile.isChecked = caCertsFile.exists()

        val certificatesRequest =
            registerForActivityResult(ActivityResultContracts.StartActivityForResult()) {
@ -324,11 +323,8 @@ class ConfigActivity : AppCompatActivity() {
                            val inputStream =
                                applicationContext.contentResolver.openInputStream(uri)
                                        as FileInputStream
-                            val caCertsPath = BaresipService.filesPath + "/ca_certs.crt"
-                            File(caCertsPath).copyInputStreamToFile(inputStream)
+                            caCertsFile.copyInputStreamToFile(inputStream)
                            inputStream.close()
-                            Config.replaceVariable("sip_cafile", caCertsPath)
-                            save = true
                            restart = true
                        } catch (e: Error) {
                            Utils.alertView(
@ -340,6 +336,8 @@ class ConfigActivity : AppCompatActivity() {
                    }
                else
                    caFile.isChecked = false
+                if (!caFile.isChecked && caCertsFile.exists())
+                    caCertsFile.delete()
            }

        caFile.setOnCheckedChangeListener { _, isChecked ->
@ -361,11 +359,8 @@ class ConfigActivity : AppCompatActivity() {
                                )
                                return@setOnCheckedChangeListener
                            }
-                            val caCertsPath = BaresipService.filesPath + "/ca_certs.crt"
-                            Utils.putFileContents(caCertsPath, content)
-                            Config.replaceVariable("sip_cafile", caCertsPath)
+                            caCertsFile.writeBytes(content)
                            caFile.isChecked = true
-                            save = true
                            restart = true
                        }
                        ActivityCompat.shouldShowRequestPermissionRationale(
@ -389,8 +384,8 @@ class ConfigActivity : AppCompatActivity() {
                    Utils.selectInputFile(certificatesRequest)
                }
            } else {
-                Config.removeVariable("sip_cafile")
-                save = true
+                if (caCertsFile.exists())
+                    caCertsFile.delete()
                restart = true
            }
        }
@ -613,13 +608,6 @@ class ConfigActivity : AppCompatActivity() {
                    save = true
                }

-                if (verifyServer.isChecked && !caFile.isChecked) {
-                    Utils.alertView(this, getString(R.string.error),
-                            getString(R.string.verify_server_error))
-                    verifyServer.isChecked = false
-                    return false
-                }
-
                if (oldVerifyServer != verifyServer.isChecked) {
                    Config.replaceVariable("sip_verify_server",
                            if (verifyServer.isChecked) "yes" else "no")
--- a/app/src/main/res/values-cs/strings.xml
+++ b/app/src/main/res/values-cs/strings.xml
@ -107,7 +107,6 @@
    <string name="tls_ca_file">Soubor TLS CA</string>
    <string name="failed_to_set_dns_servers">Nepodařilo se nastavit servery DNS</string>
    <string name="verify_server">Ověřit certifikáty serveru</string>
-    <string name="verify_server_error">Certifikáty serveru nelze ověřit bez souboru certifikační autority TLS.</string>
    <string name="verify_server_help">Pokud je tato možnost zaškrtnuta, ověřuje baresip certifikáty TLS uživatelského agenta SIP a proxy serverů SIP, pokud se používá přenos TLS. Pokud je zaškrtnuto, musí být načten také soubor TLS CA.</string>
    <string name="dtmf_inband">Události v pásmu RTP</string>
    <string name="dtmf_info">Žádosti SIP INFO</string>
--- a/app/src/main/res/values-es/strings.xml
+++ b/app/src/main/res/values-es/strings.xml
@ -257,7 +257,6 @@
    <string name="aec_extended_filter">Filtro extendido AEC</string>
    <string name="audio">Audio</string>
    <string name="verify_server_help">Si se marca, baresip verifica los certificados TLS del Agente de Usuario SIP y de los Servidores Proxy SIP cuando se utiliza el transporte TLS. Si se marca, también se debe cargar el archivo TLS CA.</string>
-    <string name="verify_server_error">Los certificados del servidor no pueden ser verificados sin el archivo TLS CA.</string>
    <string name="verify_server">Verificar los certificados del servidor</string>
    <string name="transfer_request_to">Solicitud de transferencia de llamada a</string>
    <string name="missed_call_from">Llamada perdida de</string>
--- a/app/src/main/res/values-fi/strings.xml
+++ b/app/src/main/res/values-fi/strings.xml
@ -344,18 +344,14 @@
        ladataan Download-kansiosta. Turvallisuusyistä tuhoa tiedosto heti lataamisen jälkeen.
    </string>
    <string name="verify_server">Tarkista palvelinten sertifikaatit</string>
-    <string name="verify_server_error">Palvelinten sertifikaatteja ei voi tarkistaa ilman TLS
-        CA-tiedostoa.
-    </string>
    <string name="verify_server_help">Jos merkitty, baresip tarkistaa SIP-palvelinten
-        sertifikaatit, kun TLS-tiedonsiirto on käytössä.  Tällöin myös TLS CA-tiedoston on oltava
-        ladattuna.
+        sertifikaatit, kun TLS-tiedonsiirto on käytössä.
    </string>
    <string name="tls_ca_file">TLS CA-tiedosto</string>
-    <string name="tls_ca_file_help">Jos merkitty, tiedosto joka sisältää
-        sertifikaattiauktoriteettien (CA) julkiset sertifikaatit, on joko jo ladattu tai tullaan
-        lataamaan. Android versioon 9 saakka tiedosto nimeltään \'ca_certs.crt\' ladataan
-        Download-kansiosta.
+    <string name="tls_ca_file_help">Jos merkitty, tiedosto on joko jo ladattu tai tullaan
+        lataamaan, joka sisältää sellaisten sertifikaattiauktoriteettien (CA) julkiset sertifikaatit,
+        jotka eivät sisälly Android-käyttöjärjestelmään. Android versioon 9 saakka tiedosto
+        nimeltään \'ca_certs.crt\' ladataan Download-kansiosta.
    </string>
    <string name="audio">Audio</string>
    <string name="audio_settings">Audio-asetukset</string>
--- a/app/src/main/res/values-pt-rBR/strings.xml
+++ b/app/src/main/res/values-pt-rBR/strings.xml
@ -240,7 +240,6 @@
    <string name="dark_theme">Tema Escuro</string>
    <string name="android_contact_help">Se for marcado, este contato será adicionado nos contatos do Android.</string>
    <string name="verify_server_help">Se estiver marcado, o baresip verifica os certificados TLS do SIP User Agent e o SIP Proxy Servers quando o transporte TLS for usado. Se estiver marcado, o arquivo TLS CA também deve ser carregado.</string>
-    <string name="verify_server_error">Os certificados do servidor não podem ser aferidos sem o arquivo CA TLS.</string>
    <string name="verify_server">Verifique os certificados do servidor</string>
    <string name="dtmf_info">Solicitações INFO SIP</string>
    <string name="dtmf_inband">Eventos na Banda RTP</string>
--- a/app/src/main/res/values-pt/strings.xml
+++ b/app/src/main/res/values-pt/strings.xml
@ -235,7 +235,6 @@
    <string name="dark_theme_help">Impor o uso do tema escuro no ecrã</string>
    <string name="dark_theme">Tema Escuro</string>
    <string name="verify_server_help">Se estiver marcado, o baresip verifica os certificados TLS do SIP User Agent e o SIP Proxy Servers quando o transporte TLS for usado. Se estiver marcado, o ficheiro TLS CA também deve ser carregado.</string>
-    <string name="verify_server_error">Os certificados do servidor não podem ser aferidos sem o ficheiro CA TLS.</string>
    <string name="verify_server">Verifique os certificados do servidor</string>
    <string name="transfer_request_to">Chamada de solicitação de transferência para</string>
    <string name="missed_call_from">Ligação perdida de</string>
--- a/app/src/main/res/values-ru/strings.xml
+++ b/app/src/main/res/values-ru/strings.xml
@ -232,7 +232,6 @@
    <string name="about_title_plus">О baresip+</string>
    <string name="stun_server_uri">URI-адрес сервера STUN/TURN</string>
    <string name="dark_theme">Темная тема</string>
-    <string name="verify_server_error">Сертификаты сервера не могут быть проверены без файла TLS CA.</string>
    <string name="verify_server">Проверка сертификатов сервера</string>
    <string name="peer">Пир</string>
    <string name="direction">Направление</string>
--- a/app/src/main/res/values-sv/strings.xml
+++ b/app/src/main/res/values-sv/strings.xml
@ -172,7 +172,6 @@
    <string name="failed_to_load_module">Kunde inte ladda modul.</string>
    <string name="audio_modules_help">Ljudkodekar som tillhandahålls av de förkryssade modulerna är tillgängliga för konton.</string>
    <string name="tls_ca_file">TLS CA-fil</string>
-    <string name="verify_server_error">Servercertifikat kan inte verifieras utan TLS CA-fil.</string>
    <string name="verify_server">Verifiera servercertifikat</string>
    <string name="chat_with">Chatta med %1$s</string>
    <string name="chat">Chattmeddelanden</string>
--- a/app/src/main/res/values/strings.xml
+++ b/app/src/main/res/values/strings.xml
@ -324,15 +324,13 @@
        below, a file called \'cert.pem\' is loaded from Download folder. For security reasons,
        delete the file after loading.</string>
    <string name="verify_server">Verify Server Certificates</string>
-    <string name="verify_server_error">Server Certificates cannot be verified without
-        TLS CA file.</string>
    <string name="verify_server_help">If checked, baresip verifies TLS certificates of SIP User
-        Agent and SIP Proxy Servers when TLS transport is used.  If checked, also TLS CA File has
-        to be loaded.</string>
+        Agent and SIP Proxy Servers when TLS transport is used.</string>
    <string name="tls_ca_file">TLS CA File</string>
-    <string name="tls_ca_file_help">If checked, a file containing TLS certificates
-        of needed Certificate Authorities has been or will be loaded. In Android versions 9 and
-        below, a file called \'ca_certs.crt\' is loaded from Download folder.</string>
+    <string name="tls_ca_file_help">If checked, a file has been or will be loaded that contains
+        TLS certificates of such Certificate Authorities that are not included in Android OS.
+        In Android versions 9 and below, a file called \'ca_certs.crt\' is loaded from
+        Download folder.</string>
    <string name="audio">Audio</string>
    <string name="audio_settings">Audio Settings</string>
    <string name="audio_modules_title">Audio Modules</string>