summary refs log tree commit diff
path: root/compat/arc4random_solaris.h
diff options
context:
space:
mode:
authorJune McEnroe <june@causal.agency>2020-07-31 22:53:27 -0400
committerJune McEnroe <june@causal.agency>2020-07-31 23:10:51 -0400
commita6df11f2bbd2c9cdf4a8f16d93d8a56c8f41c68d (patch)
treeaa5fe01a11fa67f1dea2f3116f41a1684219542d /compat/arc4random_solaris.h
parenttls_config: Replace constant with X509_get_default_cert_file() (diff)
downloadlibretls-a6df11f2bbd2c9cdf4a8f16d93d8a56c8f41c68d.tar.gz
libretls-a6df11f2bbd2c9cdf4a8f16d93d8a56c8f41c68d.zip
tls: Call SSL_CTX_set_default_verify_paths by default
This removes the hard dependency on a CA bundle file existing in the
default path (which seems to not be the case on Debian, for example),
but results in a subtle behaviour change: if the CA bundle file does not
exist, the CA directory will be used instead, rather than failing hard.

I believe the only reason libtls insists on loading a CA bundle file
itself is so that it can be sandboxed afterwards, given that a file is
loaded all at once while a directory is only loaded as needed. If the
default CA bundle file exists, SSL_CTX_set_default_verify_paths will
still immediately load it, so sandboxing will still work. If it doesn't
exist, then the CA directory will be used, which will work well for
unsandboxed applications, but will likely fail during verification as it
tries to search the directory. Either way, if the CA bundle file does
not exist, a sandboxed application will not work. Enabling the use of
the CA directory, however, will allow more unsandboxed applications to
work.

Finally, to restore the original behaviour, an application can call
tls_config_set_ca_file(3) with the path returned by
tls_default_ca_cert_file(3).
Diffstat (limited to 'compat/arc4random_solaris.h')
0 files changed, 0 insertions, 0 deletions
-0500'>2020-03-03Remove setoptJune McEnroe 2020-03-03Use getopts in shell scriptsJune McEnroe WTF why did no one tell me about this? 2020-02-27Style %T outside of Rs in italicJune McEnroe 2020-02-26Add Fierce Femmes and Notorious LiarsJune McEnroe 2020-02-23Add This Is How You Lose the Time WarJune McEnroe 2020-02-22Add See Ya LaterJune McEnroe 2020-02-20Remove wiki scriptJune McEnroe Wikipedia seems to have removed the one-sentence extracts from the opensearch results. Too bad. It's not a wiki script, what we need is a command that fetches single-sentence summaries of articles on Wikipedia. 2020-02-19Add The Obelisk GateJune McEnroe 2020-02-17Add Four Tet — HandsJune McEnroe One from the cafe that caught my attention. 2020-02-12Simplify macOS notify-sendJune McEnroe 2020-02-12Add imbox and notemap to pageJune McEnroe 2020-02-12Collapse simple linksJune McEnroe 2020-02-12Move catgirl up the pageJune McEnroe 2020-02-12Update catgirl pty grabJune McEnroe 2020-02-12Link to cgit /about pages where appropriateJune McEnroe 2020-02-11Separate LINKS from BINS for html to workJune McEnroe 2020-02-11Add margin to Bl-bullet itemsJune McEnroe 2020-02-10Match URLs inside parens or with paired parens insideJune McEnroe 2020-02-10Duplicate effective URL before passing it back to curlJune McEnroe Apparently sometimes it didn't like receiving its own internal storage to parse again. Understandable. 2020-02-09Add To Be Taught, If FortunateJune McEnroe 2020-02-04Add The Future of Another TimelineJune McEnroe Wow. One of the best I've read. 2020-01-31Reorganize the Makefile for the umpteenth timeJune McEnroe Broke out LDLIBS for each bin, and made everything more uniform. 2020-01-28Change scout sensitivity to 1.4June McEnroe idk it seems to work. 2020-01-28Import shows.txtJune McEnroe