i2p/haiku-beta6
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

TLS: add user cert dir

Browse Source 
BSecureSocket currently only checks for trust anchors in the CA file,
this change will add the openssl certs/ directory as a trust anchor dir.
this matches the behaviour openssl has on the commandline and allows
users to install their own trust anchors to verify against for TLS

Change-Id: I9db5c3f3b063607e092dded3d5b141dba340a8e2
Reviewed-on: https://review.haiku-os.org/c/haiku/+/3207
Reviewed-by: Fredrik Holmqvist <[email protected]>
This commit is contained in:
Pascal Abresch
2020-09-14 19:07:17 +00:00
committed by Fredrik Holmqvist
parent 5c66a5ee54
commit 99d96cefd9
1 changed files with 5 additions and 4 deletions
Download Patch File Download Diff File Expand all files Collapse all files
src/kits/network/libnetapi/SecureSocket.cpp
+5 -4
View File
@@ -368,10 +368,11 @@ BSecureSocket::Private::_CreateContext()
BPath certificateStore;
find_directory(B_SYSTEM_DATA_DIRECTORY, &certificateStore);
certificateStore.Append("ssl/CARootCertificates.pem");
// TODO we may want to add a non-packaged certificate directory?
// (would make it possible to store user-added certificate exceptions
// there)
SSL_CTX_load_verify_locations(sContext, certificateStore.Path(), NULL);
BPath userCertificateStore;
find_directory(B_SYSTEM_NONPACKAGED_DATA_DIRECTORY, &userCertificateStore);
userCertificateStore.Append("ssl/certs/");
SSL_CTX_load_verify_locations(sContext, certificateStore.Path(), userCertificateStore.Path());
SSL_CTX_set_verify(sContext, SSL_VERIFY_PEER, VerifyCallback);
// OpenSSL 1.0.2 and later: use the alternate "trusted first" algorithm to