diff options
| author | bapt <bapt@FreeBSD.org> | 2016-01-19 15:02:37 +0000 |
|---|---|---|
| committer | bapt <bapt@FreeBSD.org> | 2016-01-19 15:02:37 +0000 |
| commit | 7eac7d868498a1b5fdc6b2be090afbc05e95c736 (patch) | |
| tree | 4ddec1d373190cd648a9548c3d0336b85f936eff /lib/libfetch | |
| parent | 43b4a69321547147333695abb6579e202b6b7967 (diff) | |
| download | FreeBSD-src-7eac7d868498a1b5fdc6b2be090afbc05e95c736.zip FreeBSD-src-7eac7d868498a1b5fdc6b2be090afbc05e95c736.tar.gz | |
Test for /etc/ssl/cert.pem existence to avoid masking SSL_CA_CERT_PATH
Prior to this patch, unless SSL_CA_CERT_FILE is set in the environment,
libfetch will set the CA file to "/usr/local/etc/cert.pem" if it exists,
and to "/etc/ssl/cert.pem" otherwise. This has the consequence of
masking SSL_CA_CERT_PATH, because OpenSSL will ignore the CA path if a CA
file is set but fails to load (see X509_STORE_load_locations()).
While here, fall back to OpenSSL defaults if neither SSL_CA_CERT_FILE nor
SSL_CA_CERT_PATH are set in the environment, and if neither of the
libfetch default CA files exists.
PR: 193871
Submitted by: John W. O'Brien <john@saltant.com>
Approved by: des
MFC after: 1 week
Diffstat (limited to 'lib/libfetch')
| -rw-r--r-- | lib/libfetch/common.c | 13 |
1 files changed, 10 insertions, 3 deletions
diff --git a/lib/libfetch/common.c b/lib/libfetch/common.c index ae8b79d..76dc4f9 100644 --- a/lib/libfetch/common.c +++ b/lib/libfetch/common.c @@ -705,7 +705,8 @@ fetch_ssl_setup_peer_verification(SSL_CTX *ctx, int verbose) if (ca_cert_file == NULL && access(LOCAL_CERT_FILE, R_OK) == 0) ca_cert_file = LOCAL_CERT_FILE; - if (ca_cert_file == NULL) + if (ca_cert_file == NULL && + access(BASE_CERT_FILE, R_OK) == 0) ca_cert_file = BASE_CERT_FILE; ca_cert_path = getenv("SSL_CA_CERT_PATH"); if (verbose) { @@ -716,11 +717,17 @@ fetch_ssl_setup_peer_verification(SSL_CTX *ctx, int verbose) if (ca_cert_path != NULL) fetch_info("Using CA cert path: %s", ca_cert_path); + if (ca_cert_file == NULL && ca_cert_path == NULL) + fetch_info("Using OpenSSL default " + "CA cert file and path"); } SSL_CTX_set_verify(ctx, SSL_VERIFY_PEER, fetch_ssl_cb_verify_crt); - SSL_CTX_load_verify_locations(ctx, ca_cert_file, - ca_cert_path); + if (ca_cert_file != NULL || ca_cert_path != NULL) + SSL_CTX_load_verify_locations(ctx, ca_cert_file, + ca_cert_path); + else + SSL_CTX_set_default_verify_paths(ctx); if ((crl_file = getenv("SSL_CRL_FILE")) != NULL) { if (verbose) fetch_info("Using CRL file: %s", crl_file); |
