From 171a56ee2dcb18050edbcfaf62c121d35d06d43f Mon Sep 17 00:00:00 2001 From: Klemens Nanni Date: Thu, 10 Jun 2021 01:32:09 +0000 Subject: Hoist loading default root certificates into ircConfig() tls_connect_socket(3) in ircConnect() does that by default already unless tls_config_set_ca_file(3) was used. Loading CA certificates before connecting makes no practical difference except on OpenBSD where this allows for tighter unveil und pledge setups now that all required (TLS related) file I/O is finished by the time ircConnect() gets to do network I/O. In case of the hidden `-!' insecure flag which is implied by `-o' to print server certificates and exit, loading root certificates is not required at all; likewise, using explicit self signed server certificates will not involve certificate authorities either, hence load them only if needed. --- irc.c | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/irc.c b/irc.c index c98193a..720e1ce 100644 --- a/irc.c +++ b/irc.c @@ -71,6 +71,12 @@ void ircConfig( if (error) errx(EX_NOINPUT, "%s: %s", trust, tls_config_error(config)); } + if (!insecure && !trust) { + const char *ca = tls_default_ca_cert_file(); + error = tls_config_set_ca_file(config, ca); + if (error) errx(EX_OSFILE, "%s: %s", ca, tls_config_error(config)); + } + if (cert) { const char *dirs = NULL; for (const char *path; NULL != (path = configPath(&dirs, cert));) { -- cgit 1.4.1