Attachment 165049 Details for Bug 193871 – test for /etc/ssl/cert.pem existence to avoid masking SSL_CA_CERT_PATH

[patch] test for /etc/ssl/cert.pem existence to avoid masking SSL_CA_CERT_PATH

patch-lib_libfetch_common.c.txt (text/plain), 1.19 KB, created by John W. O'Brien on 2016-01-04 13:01:10 UTC

(hide)

Description:

Filename:

MIME Type:

Creator: John W. O'Brien

Created: 2016-01-04 13:01:10 UTC

Size: 1.19 KB

patch

obsolete

>Index: lib/libfetch/common.c
>===================================================================
>--- lib/libfetch/common.c	(revision 293121)
>+++ lib/libfetch/common.c	(working copy)
>@@ -705,7 +705,8 @@
> 		if (ca_cert_file == NULL &&
> 		    access(LOCAL_CERT_FILE, R_OK) == 0)
> 			ca_cert_file = LOCAL_CERT_FILE;
>-		if (ca_cert_file == NULL)
>+		if (ca_cert_file == NULL &&
>+		    access(BASE_CERT_FILE, R_OK) == 0)
> 			ca_cert_file = BASE_CERT_FILE;
> 		ca_cert_path = getenv("SSL_CA_CERT_PATH");
> 		if (verbose) {
>@@ -716,11 +717,17 @@
> 			if (ca_cert_path != NULL)
> 				fetch_info("Using CA cert path: %s",
> 				    ca_cert_path);
>+			if (ca_cert_file == NULL && ca_cert_path == NULL)
>+				fetch_info("Using OpenSSL default "
>+				    "CA cert file and path");
> 		}
> 		SSL_CTX_set_verify(ctx, SSL_VERIFY_PEER,
> 		    fetch_ssl_cb_verify_crt);
>-		SSL_CTX_load_verify_locations(ctx, ca_cert_file,
>-		    ca_cert_path);
>+		if (ca_cert_file != NULL || ca_cert_path != NULL)
>+			SSL_CTX_load_verify_locations(ctx, ca_cert_file,
>+			    ca_cert_path);
>+		else
>+			SSL_CTX_set_default_verify_paths(ctx);
> 		if ((crl_file = getenv("SSL_CRL_FILE")) != NULL) {
> 			if (verbose)
> 				fetch_info("Using CRL file: %s", crl_file);

Actions: View | Diff

Attachments on bug 193871: 165049