Project

General

Profile

Actions
Copy link

Enhancement #350

closed

Allow CA mode check store to be a file instead of a directory

Added by Adam Williamson over 9 years ago. Updated over 9 years ago.

Status:
Resolved
Priority:
Normal
Assignee:
Pierre-Louis Bonicoli
Target version:
0.9.0
Start date:
2014-09-19
Due date:
% Done:

100%

Estimated time:
Patch Available:
Yes
Found in Versions:
0.8.9
Confirmed:
No
Branch:
Security:
Help Needed:

Description

I use Bip on Fedora, which has a feature in the last few versions called Shared System Certificates - https://fedoraproject.org/wiki/Features/SharedSystemCertificates - which provides a system-wide store of trusted CAs, hooks into various apps and libraries, and some tools for managing it. It's a neat feature.

It doesn't provide a representation of its data in the form that Bip wants for its 'ssl_check_store' parameter when operating in CA mode, though - bip expects a directory full of .pems with a c_rehash-generated index, the Fedora system only provides bundles in various formats.

So, I fixed it. Attaching a patch which checks whether the check store is a file or a directory when activating it at the time it sets up a new server connection, and calls SSL_CTX_load_verify_locations() appropriately (the function already supports both approaches, it was only bip's use of it which restricted you to using a directory). With this applied I can set:

ssl_check_store = "/etc/pki/ca-trust/extracted/openssl/ca-bundle.trust.crt";

and it works fine. I also checked that it errors correctly if set to a non-existent file.

I am no kind of C coder so it may be possible to improve on this, but it works fine for me. st_buf is defined where it is because defining it right after case SSL_CHECK_CA: appears to be a violation of C grammar.

Files

Download all files
0001-check-whether-trust-store-is-a-file-or-directory-in-.patch (4.36 KB) 0001-check-whether-trust-store-is-a-file-or-directory-in-.patch patch to allow CA mode check store as a file Adam Williamson, 2014-09-19 23:23
0002-allow-for-certificate-store-to-be-unspecified-in-CA-.patch (4.34 KB) 0002-allow-for-certificate-store-to-be-unspecified-in-CA-.patch patch to allow CA mode check store to be empty, in which case default will be used Adam Williamson, 2014-09-20 05:43
Actions
Copy link

Also available in: Atom PDF