net/nmap/patches/030-ncat-drop-ca-bundle.patch

   1 Author: Konstantin Demin <rockdrilla@gmail.com>
   2 Title: ncat: avoid shipping/using internal ca-bundle.crt
   3
   4 1. ca-bundle.crt may provide outdated trusted CAs.
   5 2. maintain trusted CAs in one place.
   6
   7 Also remove references to NCAT_CA_CERTS_FILE and NCAT_CA_CERTS_PATH in order to catch future errors early (i.e. at compile-time).
   8
   9  ncat/Makefile.in  |  1 -
  10  ncat/ncat_posix.c | 13 +------------
  11  ncat/ncat_ssl.h   |  2 --
  12  3 files changed, 1 insertion(+), 15 deletions(-)
  13
  14 --- a/ncat/Makefile.in
  15 +++ b/ncat/Makefile.in
  16 @@ -80,7 +80,6 @@ DATAFILES =
  17  ifneq ($(HAVE_OPENSSL),)
  18  SRCS += http_digest.c
  19  OBJS += http_digest.o
  20 -DATAFILES = certs/ca-bundle.crt
  21  endif
  22
  23  ifneq ($(NOLUA),yes)
  24 --- a/ncat/ncat_posix.c
  25 +++ b/ncat/ncat_posix.c
  26 @@ -357,28 +357,17 @@ void set_lf_mode(void)
  27
  28  #ifdef HAVE_OPENSSL
  29
  30 -#define NCAT_CA_CERTS_PATH (NCAT_DATADIR "/" NCAT_CA_CERTS_FILE)
  31 -
  32  int ssl_load_default_ca_certs(SSL_CTX *ctx)
  33  {
  34      int rc;
  35
  36      if (o.debug)
  37 -        logdebug("Using system default trusted CA certificates and those in %s.\n", NCAT_CA_CERTS_PATH);
  38 +        logdebug("Using system default trusted CA certificates.\n");
  39
  40      /* Load distribution-provided defaults, if any. */
  41      rc = SSL_CTX_set_default_verify_paths(ctx);
  42      ncat_assert(rc > 0);
  43
  44 -    /* Also load the trusted certificates we ship. */
  45 -    rc = SSL_CTX_load_verify_locations(ctx, NCAT_CA_CERTS_PATH, NULL);
  46 -    if (rc != 1) {
  47 -        if (o.debug)
  48 -            logdebug("Unable to load trusted CA certificates from %s: %s\n",
  49 -                NCAT_CA_CERTS_PATH, ERR_error_string(ERR_get_error(), NULL));
  50 -        return -1;
  51 -    }
  52 -
  53      return 0;
  54  }
  55  #endif
  56 --- a/ncat/ncat_ssl.h
  57 +++ b/ncat/ncat_ssl.h
  58 @@ -66,8 +66,6 @@
  59  #include <openssl/ssl.h>
  60  #include <openssl/err.h>
  61
  62 -#define NCAT_CA_CERTS_FILE "ca-bundle.crt"
  63 -
  64  enum {
  65      SHA1_BYTES = 160 / 8,
  66      /* 40 bytes for hex digits and 9 bytes for ' '. */