alexcrichton / openssl-probe

Apache License 2.0
54 stars 13 forks source link

Bad probe result on OpenHarmonyOS #29

Open bgfist opened 1 month ago

bgfist commented 1 month ago

the default ca cert file on openharmonyos is /etc/ssl/certs/cacert.pem.

the probe result is: SSL_CERT_FILE: SSL_CERT_DIR: /etc/ssl/certs

I've checked the probe's code. which is

https://github.com/alexcrichton/openssl-probe/blob/db67c9e5b333b1b4164467b17f5d99207fad004c/src/lib.rs#L119

if result.cert_file.is_none() {
    result.cert_file = cert_filenames
        .iter()
        .map(|fname| certs_dir.join(fname))
        .find(|p| p.exists());
}
if result.cert_dir.is_none() {
    let cert_dir = certs_dir.join("certs");
    if cert_dir.exists() {
        result.cert_dir = Some(cert_dir);
    }
}

cert_dir has an added "certs" path segment than cert_file.

I think we can probe the cert_dir first, then try probe cert_file twice, once without "certs" path segment, once with "certs" path segment, then we would not miss the cert_file.

Like this:

if result.cert_dir.is_none() {
    let cert_dir = certs_dir.join("certs");
    if cert_dir.exists() {
        result.cert_dir = Some(cert_dir);
    }
}
if result.cert_file.is_none() {
    result.cert_file = cert_filenames
        .iter()
        .map(|fname| certs_dir.join(fname))
        .find(|p| p.exists());
}
if result.cert_file.is_none() && result.cert_dir.is_some() {
    let certs_dir = result.cert_dir.unwrap();
    result.cert_file = cert_filenames
        .iter()
        .map(|fname| certs_dir.join(fname))
        .find(|p| p.exists());
}