suzanne.soy/racket
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

openssl: guard default cert location setup with libcrypto check

Browse Source 
Commit dc8a2ca6 removed the check, which caused problems
when libcrypto.so is not found.
This commit is contained in:
Ryan Culpepper 2018-09-17 15:38:45 +02:00
parent 710cbd25bf
commit 0ceb67ebc6
1 changed files with 45 additions and 42 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

87
racket/collects/openssl/mzssl.rkt
View File

@ -363,48 +363,51 @@ TO DO:
(define-crypto X509_get_default_cert_file_env (_fun -> _string)) (define-crypto X509_get_default_cert_file_env (_fun -> _string))
(define (x509-root-sources) (define (x509-root-sources)
;; Workaround for natipkg openssl library: the default cert locations vary (cond
;; from distro to distro, and there is no one configuration that works with [libcrypto
;; all. So build natipkg libssl.so with `--openssldir="/RACKET_USE_ALT_PATH"` ;; Workaround for natipkg openssl library: the default cert locations vary
;; and this code will override with better guesses. ;; from distro to distro, and there is no one configuration that works with
;; Cert locations for various distros: ;; all. So build natipkg libssl.so with `--openssldir="/RACKET_USE_ALT_PATH"`
;; Debian: dir=/etc/ssl/certs, file=/etc/ssl/certs/ca-certificates.crt (prefer dir!) ;; and this code will override with better guesses.
;; RedHat: file=/etc/pki/tls/certs/ca-bundle.crt; /etc/ssl/certs exists but useless! ;; Cert locations for various distros:
;; OpenSUSE: dir=/etc/ssl/certs, file=/var/lib/ca-certificates/ca-bundle.pem (prefer dir!) ;; Debian: dir=/etc/ssl/certs, file=/etc/ssl/certs/ca-certificates.crt (prefer dir!)
;; So try file=/etc/pki/tls/certs/ca-bundle.crt, dir=/etc/ssl/certs. ;; RedHat: file=/etc/pki/tls/certs/ca-bundle.crt; /etc/ssl/certs exists but useless!
(define (use-alt-path? p) (regexp-match? #rx"^/RACKET_USE_ALT_PATH" p)) ;; OpenSUSE: dir=/etc/ssl/certs, file=/var/lib/ca-certificates/ca-bundle.pem (prefer dir!)
(define (subst-cert-file p) ;; So try file=/etc/pki/tls/certs/ca-bundle.crt, dir=/etc/ssl/certs.
(cond [(use-alt-path? p) (define (use-alt-path? p) (regexp-match? #rx"^/RACKET_USE_ALT_PATH" p))
(log-openssl-debug "cert file path is ~s; using alternatives" p) (define (subst-cert-file p)
(filter file-exists? '("/etc/pki/tls/certs/ca-bundle.crt"))] (cond [(use-alt-path? p)
[else p])) (log-openssl-debug "cert file path is ~s; using alternatives" p)
(define (subst-cert-dir p) (filter file-exists? '("/etc/pki/tls/certs/ca-bundle.crt"))]
(cond [(use-alt-path? p) [else p]))
(log-openssl-debug "cert dir path is ~s; using alternatives" p) (define (subst-cert-dir p)
(filter directory-exists? '("/etc/ssl/certs"))] (cond [(use-alt-path? p)
[else p])) (log-openssl-debug "cert dir path is ~s; using alternatives" p)
;; ---- (filter directory-exists? '("/etc/ssl/certs"))]
(define dir-sep (case (system-type) [(windows) ";"] [else ":"])) [else p]))
(define cert-file0 ;; ----
(or (getenv (X509_get_default_cert_file_env)) (X509_get_default_cert_file))) (define dir-sep (case (system-type) [(windows) ";"] [else ":"]))
(define cert-dirs0 (define cert-file0
(or (getenv (X509_get_default_cert_dir_env)) (X509_get_default_cert_dir))) (or (getenv (X509_get_default_cert_file_env)) (X509_get_default_cert_file)))
;; Use path-string? filter to avoid {file,directory}-exists? error on "". (define cert-dirs0
(define cert-files (or (getenv (X509_get_default_cert_dir_env)) (X509_get_default_cert_dir)))
(filter path-string? (flatten (map subst-cert-file (list cert-file0))))) ;; Use path-string? filter to avoid {file,directory}-exists? error on "".
(define cert-dirs (define cert-files
(filter path-string? (flatten (map subst-cert-dir (string-split cert-dirs0 dir-sep))))) (filter path-string? (flatten (map subst-cert-file (list cert-file0)))))
;; Log error only if *no* cert source exists (eg, on Debian/Ubuntu, default (define cert-dirs
;; cert file does not exist). (filter path-string? (flatten (map subst-cert-dir (string-split cert-dirs0 dir-sep)))))
(unless (or (ormap file-exists? cert-files) (ormap directory-exists? cert-dirs)) ;; Log error only if *no* cert source exists (eg, on Debian/Ubuntu, default
(log-openssl-error ;; cert file does not exist).
"x509-root-sources: cert sources do not exist: ~s, ~s; ~a" (unless (or (ormap file-exists? cert-files) (ormap directory-exists? cert-dirs))
cert-file0 cert-dirs0 (log-openssl-error
(format "override using ~a, ~a" "x509-root-sources: cert sources do not exist: ~s, ~s; ~a"
(X509_get_default_cert_file_env) cert-file0 cert-dirs0
(X509_get_default_cert_dir_env)))) (format "override using ~a, ~a"
(log-openssl-debug "using cert sources: ~s, ~s" cert-files cert-dirs) (X509_get_default_cert_file_env)
(append cert-files (map (lambda (p) (list 'directory p)) cert-dirs))) (X509_get_default_cert_dir_env))))
(log-openssl-debug "using cert sources: ~s, ~s" cert-files cert-dirs)
(append cert-files (map (lambda (p) (list 'directory p)) cert-dirs))]
[else null]))
(define ssl-default-verify-sources (define ssl-default-verify-sources
(make-parameter (make-parameter