|  | @@ -27,6 +27,7 @@
 | 
	
		
			
				|  |  |  
 | 
	
		
			
				|  |  |  #include "src/core/ext/transport/chttp2/alpn/alpn.h"
 | 
	
		
			
				|  |  |  #include "src/core/lib/channel/channel_args.h"
 | 
	
		
			
				|  |  | +#include "src/core/lib/gpr/env.h"
 | 
	
		
			
				|  |  |  #include "src/core/lib/gpr/host_port.h"
 | 
	
		
			
				|  |  |  #include "src/core/lib/gpr/string.h"
 | 
	
		
			
				|  |  |  #include "src/core/lib/gprpp/global_config.h"
 | 
	
	
		
			
				|  | @@ -45,13 +46,7 @@ static const char* installed_roots_path =
 | 
	
		
			
				|  |  |      INSTALL_PREFIX "/share/grpc/roots.pem";
 | 
	
		
			
				|  |  |  #endif
 | 
	
		
			
				|  |  |  
 | 
	
		
			
				|  |  | -/** Config variable that points to the default SSL roots file. This file
 | 
	
		
			
				|  |  | -   must be a PEM encoded file with all the roots such as the one that can be
 | 
	
		
			
				|  |  | -   downloaded from https://pki.google.com/roots.pem.  */
 | 
	
		
			
				|  |  | -GPR_GLOBAL_CONFIG_DEFINE_STRING(grpc_default_ssl_roots_file_path, "",
 | 
	
		
			
				|  |  | -                                "Path to the default SSL roots file.");
 | 
	
		
			
				|  |  | -
 | 
	
		
			
				|  |  | -/** Config variable used as a flag to enable/disable loading system root
 | 
	
		
			
				|  |  | +/** Environment variable used as a flag to enable/disable loading system root
 | 
	
		
			
				|  |  |      certificates from the OS trust store. */
 | 
	
		
			
				|  |  |  GPR_GLOBAL_CONFIG_DEFINE_BOOL(grpc_not_use_system_ssl_roots, false,
 | 
	
		
			
				|  |  |                                "Disable loading system root certificates.");
 | 
	
	
		
			
				|  | @@ -70,22 +65,20 @@ void grpc_set_ssl_roots_override_callback(grpc_ssl_roots_override_callback cb) {
 | 
	
		
			
				|  |  |  
 | 
	
		
			
				|  |  |  /* -- Cipher suites. -- */
 | 
	
		
			
				|  |  |  
 | 
	
		
			
				|  |  | +/* Defines the cipher suites that we accept by default. All these cipher suites
 | 
	
		
			
				|  |  | +   are compliant with HTTP2. */
 | 
	
		
			
				|  |  | +#define GRPC_SSL_CIPHER_SUITES     \
 | 
	
		
			
				|  |  | +  "ECDHE-ECDSA-AES128-GCM-SHA256:" \
 | 
	
		
			
				|  |  | +  "ECDHE-ECDSA-AES256-GCM-SHA384:" \
 | 
	
		
			
				|  |  | +  "ECDHE-RSA-AES128-GCM-SHA256:"   \
 | 
	
		
			
				|  |  | +  "ECDHE-RSA-AES256-GCM-SHA384"
 | 
	
		
			
				|  |  | +
 | 
	
		
			
				|  |  |  static gpr_once cipher_suites_once = GPR_ONCE_INIT;
 | 
	
		
			
				|  |  |  static const char* cipher_suites = nullptr;
 | 
	
		
			
				|  |  |  
 | 
	
		
			
				|  |  | -// All cipher suites for default are compliant with HTTP2.
 | 
	
		
			
				|  |  | -GPR_GLOBAL_CONFIG_DEFINE_STRING(
 | 
	
		
			
				|  |  | -    grpc_ssl_cipher_suites,
 | 
	
		
			
				|  |  | -    "ECDHE-ECDSA-AES128-GCM-SHA256:"
 | 
	
		
			
				|  |  | -    "ECDHE-ECDSA-AES256-GCM-SHA384:"
 | 
	
		
			
				|  |  | -    "ECDHE-RSA-AES128-GCM-SHA256:"
 | 
	
		
			
				|  |  | -    "ECDHE-RSA-AES256-GCM-SHA384",
 | 
	
		
			
				|  |  | -    "A colon separated list of cipher suites to use with OpenSSL")
 | 
	
		
			
				|  |  | -
 | 
	
		
			
				|  |  |  static void init_cipher_suites(void) {
 | 
	
		
			
				|  |  | -  grpc_core::UniquePtr<char> value =
 | 
	
		
			
				|  |  | -      GPR_GLOBAL_CONFIG_GET(grpc_ssl_cipher_suites);
 | 
	
		
			
				|  |  | -  cipher_suites = value.release();
 | 
	
		
			
				|  |  | +  char* overridden = gpr_getenv("GRPC_SSL_CIPHER_SUITES");
 | 
	
		
			
				|  |  | +  cipher_suites = overridden != nullptr ? overridden : GRPC_SSL_CIPHER_SUITES;
 | 
	
		
			
				|  |  |  }
 | 
	
		
			
				|  |  |  
 | 
	
		
			
				|  |  |  /* --- Util --- */
 | 
	
	
		
			
				|  | @@ -437,12 +430,13 @@ grpc_slice DefaultSslRootStore::ComputePemRootCerts() {
 | 
	
		
			
				|  |  |    grpc_slice result = grpc_empty_slice();
 | 
	
		
			
				|  |  |    const bool not_use_system_roots =
 | 
	
		
			
				|  |  |        GPR_GLOBAL_CONFIG_GET(grpc_not_use_system_ssl_roots);
 | 
	
		
			
				|  |  | -  // First try to load the roots from the configuration.
 | 
	
		
			
				|  |  | -  UniquePtr<char> default_root_certs_path =
 | 
	
		
			
				|  |  | -      GPR_GLOBAL_CONFIG_GET(grpc_default_ssl_roots_file_path);
 | 
	
		
			
				|  |  | -  if (strlen(default_root_certs_path.get()) > 0) {
 | 
	
		
			
				|  |  | -    GRPC_LOG_IF_ERROR(
 | 
	
		
			
				|  |  | -        "load_file", grpc_load_file(default_root_certs_path.get(), 1, &result));
 | 
	
		
			
				|  |  | +  // First try to load the roots from the environment.
 | 
	
		
			
				|  |  | +  char* default_root_certs_path =
 | 
	
		
			
				|  |  | +      gpr_getenv(GRPC_DEFAULT_SSL_ROOTS_FILE_PATH_ENV_VAR);
 | 
	
		
			
				|  |  | +  if (default_root_certs_path != nullptr) {
 | 
	
		
			
				|  |  | +    GRPC_LOG_IF_ERROR("load_file",
 | 
	
		
			
				|  |  | +                      grpc_load_file(default_root_certs_path, 1, &result));
 | 
	
		
			
				|  |  | +    gpr_free(default_root_certs_path);
 | 
	
		
			
				|  |  |    }
 | 
	
		
			
				|  |  |    // Try overridden roots if needed.
 | 
	
		
			
				|  |  |    grpc_ssl_roots_override_result ovrd_res = GRPC_SSL_ROOTS_OVERRIDE_FAIL;
 |