zynk/irssi
2
0
Fork 0
mirror of https://github.com/irssi/irssi.git synced 2026-08-18 16:12:30 +02:00
Code Issues Projects Releases Packages Wiki Activity

Change the way we load default CA certificates so it works with Capsicum.

Browse source 
Signed-off-by: Edward Tomasz Napierala <trasz@FreeBSD.org>
This commit is contained in:
Edward Tomasz Napierala 2017-08-01 01:47:45 +01:00
commit 96f4fe10c6
3 changed files with 34 additions and 3 deletions
Download patch file Download diff file Expand all files Collapse all files

23
src/core/network-openssl.c
View file

@ -20,6 +20,7 @@
#include "module.h"
#include "network.h"
#include "network-openssl.h"
#include "net-sendbuffer.h"
#include "misc.h"
#include "servers.h"
@ -58,6 +59,7 @@ typedef struct
} GIOSSLChannel;
static int ssl_inited = FALSE;
static X509_STORE *store = NULL;
static void irssi_ssl_free(GIOChannel *handle)
{
@ -362,8 +364,10 @@ static GIOFuncs irssi_ssl_channel_funcs = {
irssi_ssl_get_flags
};
static gboolean irssi_ssl_init(void)
gboolean irssi_ssl_init(void)
{
int success;
#if (OPENSSL_VERSION_NUMBER >= 0x10100000L) && !defined(LIBRESSL_VERSION_NUMBER)
if (!OPENSSL_init_ssl(OPENSSL_INIT_SSL_DEFAULT, NULL)) {
g_error("Could not initialize OpenSSL");
@ -374,6 +378,20 @@ static gboolean irssi_ssl_init(void)
SSL_load_error_strings();
OpenSSL_add_all_algorithms();
#endif
store = X509_STORE_new();
if (store == NULL) {
g_error("Could not initialize OpenSSL: X509_STORE_new() failed");
return FALSE;
}
success = X509_STORE_set_default_paths(store);
if (success == 0) {
g_error("Could not load default certificates");
X509_STORE_free(store);
store = NULL;
return FALSE;
}
ssl_inited = TRUE;
return TRUE;
@ -492,8 +510,7 @@ static GIOChannel *irssi_ssl_get_iochannel(GIOChannel *handle, int port, SERVER_
g_free(scapath);
verify = TRUE;
} else {
if (!SSL_CTX_set_default_verify_paths(ctx))
g_warning("Could not load default certificates");
SSL_CTX_set_cert_store(ctx, store);
}
if(!(ssl = SSL_new(ctx)))