Date: Tue, 19 Jan 2016 15:02:38 +0000 (UTC) From: Baptiste Daroussin <bapt@FreeBSD.org> To: src-committers@freebsd.org, svn-src-all@freebsd.org, svn-src-head@freebsd.org Subject: svn commit: r294326 - head/lib/libfetch Message-ID: <201601191502.u0JF2cpV028900@repo.freebsd.org>
next in thread | raw e-mail | index | archive | help
Author: bapt Date: Tue Jan 19 15:02:37 2016 New Revision: 294326 URL: https://svnweb.freebsd.org/changeset/base/294326 Log: Test for /etc/ssl/cert.pem existence to avoid masking SSL_CA_CERT_PATH Prior to this patch, unless SSL_CA_CERT_FILE is set in the environment, libfetch will set the CA file to "/usr/local/etc/cert.pem" if it exists, and to "/etc/ssl/cert.pem" otherwise. This has the consequence of masking SSL_CA_CERT_PATH, because OpenSSL will ignore the CA path if a CA file is set but fails to load (see X509_STORE_load_locations()). While here, fall back to OpenSSL defaults if neither SSL_CA_CERT_FILE nor SSL_CA_CERT_PATH are set in the environment, and if neither of the libfetch default CA files exists. PR: 193871 Submitted by: John W. O'Brien <john@saltant.com> Approved by: des MFC after: 1 week Modified: head/lib/libfetch/common.c Modified: head/lib/libfetch/common.c ============================================================================== --- head/lib/libfetch/common.c Tue Jan 19 14:38:20 2016 (r294325) +++ head/lib/libfetch/common.c Tue Jan 19 15:02:37 2016 (r294326) @@ -705,7 +705,8 @@ fetch_ssl_setup_peer_verification(SSL_CT if (ca_cert_file == NULL && access(LOCAL_CERT_FILE, R_OK) == 0) ca_cert_file = LOCAL_CERT_FILE; - if (ca_cert_file == NULL) + if (ca_cert_file == NULL && + access(BASE_CERT_FILE, R_OK) == 0) ca_cert_file = BASE_CERT_FILE; ca_cert_path = getenv("SSL_CA_CERT_PATH"); if (verbose) { @@ -716,11 +717,17 @@ fetch_ssl_setup_peer_verification(SSL_CT if (ca_cert_path != NULL) fetch_info("Using CA cert path: %s", ca_cert_path); + if (ca_cert_file == NULL && ca_cert_path == NULL) + fetch_info("Using OpenSSL default " + "CA cert file and path"); } SSL_CTX_set_verify(ctx, SSL_VERIFY_PEER, fetch_ssl_cb_verify_crt); - SSL_CTX_load_verify_locations(ctx, ca_cert_file, - ca_cert_path); + if (ca_cert_file != NULL || ca_cert_path != NULL) + SSL_CTX_load_verify_locations(ctx, ca_cert_file, + ca_cert_path); + else + SSL_CTX_set_default_verify_paths(ctx); if ((crl_file = getenv("SSL_CRL_FILE")) != NULL) { if (verbose) fetch_info("Using CRL file: %s", crl_file);
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?201601191502.u0JF2cpV028900>