try_init_openssl_env_vars() breaks certificate validation (on FreeBSD)

Abierto
  • ¿Algo no está bien?
#37 1 comentario 1 reacción 0 asignados Ver en GitHub

Nadie ha tomado este issue todavía.

  • #39 de @michael-o — cerrado sin fusionar
  • #43 de @michael-o — cerrado sin fusionar

Evaluación

Dificultad
4/5
Tiempo estimado
3-5 días
Aptitud para principiantes
18/100
Tipo de issue
Error
Claridad
Bastante claro
Estado de actividad
Estancado
Stack tecnológico
rust
Área
cryptography, security

Línea de trabajo

The bug sits in the candidate directory list and environment setup in src/lib.rs, where try_init_openssl_env_vars() calls probe() and then sets SSL_CERT_DIR and SSL_CERT_FILE. Start by reading that probe logic and reproduce the FreeBSD case by checking which candidate directories contain a certs subdirectory. Done means the variables are only set to paths OpenSSL can actually use, verified by the sample program succeeding.

Escrito por el modelo de indexación a partir del texto del issue.

Descripción

try_init_openssl_env_vars() invokes probe() and then manipulates the process environment with SSL_CERT_DIR/SSL_CERT_FILE. This may happen on any system, but for me at least on FreeBSD, when the following condition is met:
https://github.com/alexcrichton/openssl-probe/blob/4221247cfad3e77b758bf9b6e4c3d91a557c429e/src/lib.rs#L31-L50
None of these directories contain a CAfile, but contain a dir CANDIDATE/certs which is not CApath. That path is being used to set SSL_CERT_DIR, OpenSSL picks up this empty directory and fails all validations.
Here on the example of FreeBSD:
For many years FreeBSD contains certctl(8) to manage the system truststore which is assembled from various sources into a CApath in /etc/ssl/certs. If one relies on OpenSSL's SSL_CTX_set_default_verify_paths() all is good.
certctl(8) includes by default these two paths with CA certificates:

  • /usr/share/certs/trusted: comes with the base system and contains all NSS CA certificate from Mozilla
  • /usr/local/share/certs: is initially empty and allows an admin to drop off custom/enterprise CAs (which a do at work).

certcrtl rehash scans all of them and puts symlinks into /etc/ssl/certs, but since candidate_cert_dirs[] has ""/usr/local/share" before "/etc/ssl" an invalid value is set and all fails.

A sample main which fails:

use curl::easy::Easy;

fn main() {
 openssl_probe::init_ssl_cert_env_vars();
 let mut data = Vec::new();
 let mut handle = Easy::new();
 handle.url("https://www.rust-lang.org/").unwrap();
 {
     let mut transfer = handle.transfer();
     transfer.write_function(|new_data| {
         data.extend_from_slice(new_data);
         Ok(new_data.len())
     }).unwrap();
     transfer.perform().unwrap();
 }
 }

Remove the first line in the main and you are good to go.

This causes problems with downstream consumers like git2-rs and then cargo. I will report the issue also downstream.

Lenguaje dominante
Rust
Estrellas
61
Forks
23
Merge medio
43 min
PR fusionados (30 d)
2

Preparar el entorno

Este proyecto no incluye contenedor de desarrollo, Dockerfile ni guía de contribución, así que la configuración corre por tu cuenta: empieza por su README y consulta nuestra guía para la primera contribución para los pasos generales.

Primeros pasos

  1. Lee el issue completo y luego la guía de contribución del proyecto.
  2. Comenta en el issue que vas a ocuparte — evita que dos personas hagan lo mismo.
  3. Haz un fork del repositorio y trabaja en una rama.
  4. Abre un pull request que haga referencia al número del issue.

Más de rustls/openssl-probe

Todos los issues de rustls/openssl-probe

Issues similares

Más issues de Rust

Recibe los nuevos issues en tu correo

Un resumen breve de issues de GitHub para principiantes.