summaryrefslogtreecommitdiff
path: root/usr.sbin
diff options
context:
space:
mode:
authormartin <martin@NetBSD.org>2023-06-09 18:44:16 +0000
committermartin <martin@NetBSD.org>2023-06-09 18:44:16 +0000
commit0bc5486f4ce6cf685e0c959edc63fba0df5751b0 (patch)
tree4de9c81938d7ec31d24a9a148ae9f9e9ef137a80 /usr.sbin
parent2aed567c621ebd64482c1541b7bfa8fa26056583 (diff)
If the install medium does not come with any openssl trusted root certs,
tell ftp(1) not to verify trust chains when doing https downloads.
Diffstat (limited to 'usr.sbin')
-rw-r--r--usr.sbin/sysinst/main.c50
1 files changed, 49 insertions, 1 deletions
diff --git a/usr.sbin/sysinst/main.c b/usr.sbin/sysinst/main.c
index 816ae2e789f..652585ba2c8 100644
--- a/usr.sbin/sysinst/main.c
+++ b/usr.sbin/sysinst/main.c
@@ -1,4 +1,4 @@
-/* $NetBSD: main.c,v 1.30 2022/07/10 10:52:40 martin Exp $ */
+/* $NetBSD: main.c,v 1.31 2023/06/09 18:44:16 martin Exp $ */
/*
* Copyright 1997 Piermont Information Systems Inc.
@@ -97,6 +97,7 @@ __dead static void miscsighandler(int);
static void ttysighandler(int);
static void cleanup(void);
static void process_f_flag(char *);
+static bool no_openssl_trust_anchors_available(void);
static int exit_cleanly = 0; /* Did we finish nicely? */
FILE *logfp; /* log file */
@@ -264,6 +265,10 @@ main(int argc, char **argv)
/* Initialize the partitioning subsystem */
partitions_init();
+ /* do we need to tell ftp(1) to avoid checking certificate chains? */
+ if (no_openssl_trust_anchors_available())
+ setenv("FTPSSLNOVERIFY", "1", 1);
+
/* initialize message window */
if (menu_init()) {
__menu_initerror();
@@ -635,3 +640,46 @@ process_f_flag(char *f_name)
fclose(fp);
}
+
+/*
+ * return true if we do not have any root certificates installed,
+ * so can not verify any trust chain.
+ * We rely on /etc/openssl being the OPENSSLDIR and test the
+ * "all in one" /etc/openssl/cert.pem first, if that is not found
+ * check if there are multiple regular files or symlinks in
+ * /etc/openssl/certs/.
+ */
+static bool
+no_openssl_trust_anchors_available(void)
+{
+ struct stat sb;
+ DIR *dir;
+ struct dirent *ent;
+ size_t cnt;
+
+ /* check the omnibus single file variant first */
+ if (stat("/etc/openssl/cert.pem", &sb) == 0 &&
+ S_ISREG(sb.st_mode) && sb.st_size > 0)
+ return false; /* exists and is a non-empty file */
+
+ /* look for files/symlinks in the certs subdirectory */
+ dir = opendir("/etc/openssl/certs");
+ if (dir == NULL)
+ return true;
+ for (cnt = 0; cnt < 2; ) {
+ ent = readdir(dir);
+ if (ent == NULL)
+ break;
+ switch (ent->d_type) {
+ case DT_REG:
+ case DT_LNK:
+ cnt++;
+ break;
+ default:
+ break;
+ }
+ }
+ closedir(dir);
+
+ return cnt < 2;
+}