OSSL_STORE, HTTP, apps/: fix URI scheme parsing and URI-related doc#27507
OSSL_STORE, HTTP, apps/: fix URI scheme parsing and URI-related doc#27507DDvO wants to merge 8 commits intoopenssl:masterfrom
apps/: fix URI scheme parsing and URI-related doc#27507Conversation
059997e to
f28af72
Compare
|
BTW, the recent relaxation in #27482 allowed for some further simplifications, |
|
In partial contrast to what I had suggested yesterday, the output is |
676da4b to
0705b36
Compare
|
Polished the extraction of the new helper function by slightly generalizing it and renaming it to |
|
Apart from those little remarks, this looks fine. Sorry for taking so long to get back on this, @DDvO |
Pleased to hear. And sorry for slow responding this week, where I'm on vacation. |
|
Sigh, will need to provide extra PRs for backporting this to 3.4 and below. |
|
@levitte can you please approve/reconfirm. |
|
This PR is in a state where it requires action by @openssl/committers but the last update was 30 days ago |
|
This PR is in a state where it requires action by @openssl/committers but the last update was 61 days ago |
…s: filenames are allowed as well
…etc: filenames are allowed as well
… sure to check that scheme is non-empty
83792d7 to
c7c05ae
Compare
|
Rebased on latest master and updated to clang-format. |
…uery and fragment components
|
Rebased to fix merge conflicts after switch to clang-format |
This fixes the remaining issues from #27461:When registering a store URI or filename viaSSL_CTX_set_default_verify_store(),X509_STORE_load_store{,_ex}(), orX509_LOOKUP_add_store{,_ex}(), which are used for the-CAstoreetc. options of several apps:At first (e.g., during app startup) the URI or filename is just registered but on actively used. So far, in contrast to the plain file and directory cases, no feedback is given the caller/user in case anything is wrong with the filename/URI.When the URI or filename is actually used later to retrieve trust anchor certs, all errors about the URI and its contents get lost.There is just the very indirect feedback that not issuer cert could be found, but this is very blurry because this can also be due to many other reasons apart from an error related to the filename/URI.
The fix adds the missing check toby_store_ctrl_ex()for the case that the URI may be interpreted as a local file (path) name, i.e., if there is no scheme or the scheme isfile:.This motivated factoring out a new slightly generalized, corrected, and simplified functionOSSL_file_stat()fromfile_store.c:file_open()ande_loader_attic.c:file_open_ex()Fix the parsing of URI schemes in
OSSL_parse_url(),OSSL_STORE_open_ex(), andossl_store_register_loader_int(),factoring out a new internal macro
OSSL_SKIP_SCHEME().So far, the check were too weak, allowing invalid chars and/or an empty scheme.
This caught an invalid scheme name in
test/fake_rsa, which is now renamed to 'fake-rsa'.Fix the documentation of the mentioned function and CLI option parameters,
for which so far it was not mentioned that they support not only URIs but also plain file (path) names,
and partly not mentioned that certs in those stores are loaded only on demand.