Radish alpha
H
HardenedBSD-pkg
rad:z3QDZAW2FAfuLvihrhiyDC9fAD8G9
HardenedBSD Package Manager
Radicle
Git
Commits › c2d5800
Test for /etc/ssl/cert.pem existence to avoid masking SSL_CA_CERT_PATH
John W. O'Brien committed 10 years ago
commit c2d5800ff9ea7ad900ae731a479e8431202f8154
parent 05ca859
1 file changed +10 -3
modified external/libfetch/common.c
@@ -716,7 +716,8 @@ fetch_ssl_setup_peer_verification(SSL_CTX *ctx, int verbose)
		if (ca_cert_file == NULL &&

		    access(LOCAL_CERT_FILE, R_OK) == 0)

			ca_cert_file = LOCAL_CERT_FILE;
- 
		if (ca_cert_file == NULL)
+ 
		if (ca_cert_file == NULL &&
+ 
		    access(BASE_CERT_FILE, R_OK) == 0)

			ca_cert_file = BASE_CERT_FILE;

		ca_cert_path = getenv("SSL_CA_CERT_PATH");

		if (verbose) {
@@ -727,11 +728,17 @@ fetch_ssl_setup_peer_verification(SSL_CTX *ctx, int verbose)
			if (ca_cert_path != NULL)

				fetch_info("Using CA cert path: %s",

				    ca_cert_path);
+ 
			if (ca_cert_file == NULL && ca_cert_path == NULL)
+ 
				fetch_info("Using OpenSSL default "
+ 
				    "CA cert file and path");

		}

		SSL_CTX_set_verify(ctx, SSL_VERIFY_PEER,

		    fetch_ssl_cb_verify_crt);
- 
		SSL_CTX_load_verify_locations(ctx, ca_cert_file,
- 
		    ca_cert_path);
+ 
		if (ca_cert_file != NULL || ca_cert_path != NULL)
+ 
			SSL_CTX_load_verify_locations(ctx, ca_cert_file,
+ 
			    ca_cert_path);
+ 
		else
+ 
			SSL_CTX_set_default_verify_paths(ctx);

		if ((crl_file = getenv("SSL_CRL_FILE")) != NULL) {

			if (verbose)

				fetch_info("Using CRL file: %s", crl_file);