From owner-freebsd-bugs@FreeBSD.ORG Sat May 17 11:00:04 2014 Return-Path: Delivered-To: freebsd-bugs@smarthost.ysv.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [8.8.178.115]) (using TLSv1 with cipher ADH-AES256-SHA (256/256 bits)) (No client certificate requested) by hub.freebsd.org (Postfix) with ESMTPS id 8018B202 for ; Sat, 17 May 2014 11:00:04 +0000 (UTC) Received: from freefall.freebsd.org (freefall.freebsd.org [IPv6:2001:1900:2254:206c::16:87]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (Client did not present a certificate) by mx1.freebsd.org (Postfix) with ESMTPS id 5FAC925F1 for ; Sat, 17 May 2014 11:00:04 +0000 (UTC) Received: from freefall.freebsd.org (localhost [127.0.0.1]) by freefall.freebsd.org (8.14.8/8.14.8) with ESMTP id s4HB04OV046269 for ; Sat, 17 May 2014 11:00:04 GMT (envelope-from gnats@freefall.freebsd.org) Received: (from gnats@localhost) by freefall.freebsd.org (8.14.8/8.14.8/Submit) id s4HB04xD046268; Sat, 17 May 2014 11:00:04 GMT (envelope-from gnats) Resent-Date: Sat, 17 May 2014 11:00:04 GMT Resent-Message-Id: <201405171100.s4HB04xD046268@freefall.freebsd.org> Resent-From: FreeBSD-gnats-submit@FreeBSD.org (GNATS Filer) Resent-To: freebsd-bugs@FreeBSD.org Resent-Reply-To: FreeBSD-gnats-submit@FreeBSD.org, Kurt Jaeger Received: from mx1.freebsd.org (mx1.freebsd.org [8.8.178.115]) (using TLSv1 with cipher ADH-AES256-SHA (256/256 bits)) (No client certificate requested) by hub.freebsd.org (Postfix) with ESMTPS id 14680CD0 for ; Sat, 17 May 2014 10:52:25 +0000 (UTC) Received: from f10.opsec.eu (f10.opsec.eu [IPv6:2001:14f8:200:4::2]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (Client did not present a certificate) by mx1.freebsd.org (Postfix) with ESMTPS id C0DD425B5 for ; Sat, 17 May 2014 10:52:24 +0000 (UTC) Received: from pi by f10.opsec.eu with local (Exim 4.82 (FreeBSD)) (envelope-from ) id 1WlcE0-000Mzw-UO for FreeBSD-gnats-submit@freebsd.org; Sat, 17 May 2014 12:52:20 +0200 Message-Id: Date: Sat, 17 May 2014 12:52:20 +0200 From: Kurt Jaeger Reply-To: Kurt Jaeger To: FreeBSD-gnats-submit@freebsd.org X-Send-Pr-Version: 3.114 Subject: bin/189882: fetch -no-verify-peer no longer disables SSL verification X-BeenThere: freebsd-bugs@freebsd.org X-Mailman-Version: 2.1.18 Precedence: list List-Id: Bug reports List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sat, 17 May 2014 11:00:04 -0000 >Number: 189882 >Category: bin >Synopsis: fetch -no-verify-peer no longer disables SSL verification >Confidential: no >Severity: non-critical >Priority: low >Responsible: freebsd-bugs >State: open >Quarter: >Keywords: >Date-Required: >Class: sw-bug >Submitter-Id: current-users >Arrival-Date: Sat May 17 11:00:04 UTC 2014 >Closed-Date: >Last-Modified: >Originator: Kurt Jaeger >Release: FreeBSD 10.0-RELEASE-p3 amd64 >Organization: - >Environment: System: FreeBSD f10.opsec.eu 10.0-RELEASE-p3 FreeBSD 10.0-RELEASE-p3 #0: Tue May 13 18:31:10 UTC 2014 root@amd64-builder.daemonology.net:/usr/obj/usr/src/sys/GENERIC amd64 >Description: fetch -no-verify-peer allows to fetch from https even if the remote site can not be verified. It no longer works. --------- f10# fetch -v -no-verify-peer https://gist.githubusercontent.com/anonymous/eb379038510a6f15c0cb/raw/cc836df6365e975fd19b49f9eedee5f1ebfa4e46/mnemosyne-2.3.diff looking up gist.githubusercontent.com connecting to gist.githubusercontent.com:443 SSL options: 81004bff Peer verification enabled Using CA cert file: /etc/ssl/cert.pem Certificate verification failed for /C=US/O=DigiCert Inc/OU=www.digicert.com/CN=DigiCert SHA2 High Assurance Server CA 34380826280:error:14090086:SSL routines:SSL3_GET_SERVER_CERTIFICATE:certificate verify failed:/usr/src/secure/lib/libssl/../../../crypto/openssl/ssl/s3_clnt.c:1168: fetch: https://gist.githubusercontent.com/anonymous/eb379038510a6f15c0cb/raw/cc836df6365e975fd19b49f9eedee5f1ebfa4e46/mnemosyne-2.3.diff: Authentication error --------- The cause seems to be that the system-ssl-lib no longer supports disabling the verification via setenv("SSL_NO_VERIFY_PEER", "", 1); which it did in the past ? (/usr/src/usr.bin/fetch/fetch.c, line 1034) >How-To-Repeat: see above >Fix: TODO: Find a fix. >Release-Note: >Audit-Trail: >Unformatted: