@@ -28,6 +28,24 @@ Guess the locations of SSL Certificate files.
28
28
sub guess_locations {
29
29
my ( $this , $reporter ) = @_ ;
30
30
31
+ my $supportBoth = 1; # Support both CA File and CA Path.
32
+
33
+ # SMELL: Versions of IO::Socket::SSL before 1.973 will croak if both CaFile and CaPath are set.
34
+ my @mods = (
35
+ {
36
+ name => ' IO::Socket::SSL' ,
37
+ usage =>
38
+ ' Required if both ={Email}{SSLCaFile}= and ={Email}{SSLCaPath}= are set. Clear one or the other.' ,
39
+ minimumVersion => 1.973
40
+ }
41
+ );
42
+ Foswiki::Configure::Dependency::checkPerlModules(@mods );
43
+ foreach my $mod (@mods ) {
44
+ if ( !$mod -> {ok } ) {
45
+ $supportBoth = 0;
46
+ }
47
+ }
48
+
31
49
my @CERT_FILES = (
32
50
" /etc/pki/tls/certs/ca-bundle.crt" , # Fedora/RHEL
33
51
" /etc/ssl/certs/ca-certificates.crt" , # Debian/Ubuntu/Gentoo etc.
@@ -53,22 +71,22 @@ sub guess_locations {
53
71
if ( $file || $path ) {
54
72
$reporter -> NOTE(" Guessed from LWP settings" );
55
73
$guessed = 1;
56
- _setLocations( $reporter , $file , $path );
74
+ _setLocations( $reporter , $file , $path , $supportBoth );
57
75
}
58
76
else {
59
77
( $file , $path ) = @ENV {qw/ HTTPS_CA_FILE HTTPS_CA_DIR/ };
60
78
if ( $file || $path ) {
61
79
$reporter -> NOTE(" Guessed from Crypt::SSLEay's settings" );
62
80
$guessed = 1;
63
- _setLocations( $reporter , $file , $path );
81
+ _setLocations( $reporter , $file , $path , $supportBoth );
64
82
}
65
83
else {
66
84
if ( eval (' require Mozilla::CA;' ) ) {
67
85
$file = Mozilla::CA::SSL_ca_file();
68
86
if ($file ) {
69
87
$reporter -> NOTE(" Obtained from Mozilla::CA" );
70
88
$guessed = 1;
71
- _setLocations( $reporter , $file , $path );
89
+ _setLocations( $reporter , $file , $path , $supportBoth );
72
90
}
73
91
else {
74
92
$reporter -> WARN(" Mozilla::CA is installed but has no file" );
@@ -83,21 +101,19 @@ sub guess_locations {
83
101
if ( -e $file && -r $file ) {
84
102
$guessed = 1;
85
103
$reporter -> NOTE(" Guessed $file as the CA certificate bundle." );
86
- _setLocations( $reporter , $file , $path );
104
+ _setLocations( $reporter , $file , $path , $supportBoth );
87
105
last ;
88
106
}
89
107
}
90
108
91
- # SMELL: I've seen some errors that suggest that only File or Path should be specified
92
- # but IO::Socket::SSL docs clearly state both are acceptable.
93
- # return undef if ($guessed);
109
+ return undef if ( $guessed && !$supportBoth );
94
110
95
111
# First see if the linux default path work
96
112
foreach $path (@CERT_DIRS ) {
97
113
if ( -d $path && -r $path ) {
98
114
$reporter -> NOTE(" Guessed $path as the certificate directory." );
99
115
$guessed = 1;
100
- _setLocations( $reporter , $file , $path );
116
+ _setLocations( $reporter , $file , $path , $supportBoth );
101
117
}
102
118
}
103
119
@@ -114,10 +130,36 @@ sub _setLocations {
114
130
115
131
# my ( $reporter, $file, $path ) = @_
116
132
# $_[0]->WARN(Foswiki::Configure::Checker::GUESSED_MESSAGE);
133
+
134
+ if (
135
+ !$_ [3]
136
+ && ( $Foswiki::cfg {Email }{SSLCaFile }
137
+ || $Foswiki::cfg {Email }{SSLCaPath } )
138
+ )
139
+ {
140
+ $_ [0]-> WARN(
141
+ ' Obsolete version of IO::Socket::SSL installed: ={Email}{SSLCaFile}= and ={Email}{SSLCaPath}= must not both be set.'
142
+ );
143
+ return ;
144
+ }
145
+
117
146
if ( $_ [1] ) {
118
147
$Foswiki::cfg {Email }{SSLCaFile } = $_ [1];
119
148
$_ [0]-> CHANGED(' {Email}{SSLCaFile}' );
120
149
}
150
+
151
+ if (
152
+ !$_ [3]
153
+ && ( $Foswiki::cfg {Email }{SSLCaFile }
154
+ || $Foswiki::cfg {Email }{SSLCaPath } )
155
+ )
156
+ {
157
+ $_ [0]-> WARN(
158
+ ' Obsolete version of IO::Socket::SSL installed: ={Email}{SSLCaFile}= and ={Email}{SSLCaPath}= must not both be set.'
159
+ );
160
+ return ;
161
+ }
162
+
121
163
if ( $_ [2] ) {
122
164
$Foswiki::cfg {Email }{SSLCaPath } = $_ [2];
123
165
$_ [0]-> CHANGED(' {Email}{SSLCaPath}' );
0 commit comments