security/ca_root_nss: Disable ETCSYMLINK on FreeBSD 15

[fluffy]

LGTM

[bdrewery]

Why? I assume certctl is expected to do the right thing but it doesn't. The port was installing a symlink to /usr/local/openssl/cert.pem but now nothing lands there and node breaks.

[des]

That's a bug in Node then. It should be using /etc/ssl/cert.pem.

[michaelo]

I have worked on node a couple of months ago and verified in its codebase that it does the right thing with OpenSSL, see my ports commits. I am surprised about the finding mentioned here.

[bdrewery]

Even if it's a bug in node, the symlink option installs a symlink to /usr/local/openssl/cert.pem, and now the package does not do that. It's a simple hack to keep locally but there is a behavior change here that was probably not intended.

[bdrewery]

In D52398#1306397, @michaelo wrote:

I have worked on node a couple of months ago and verified in its codebase that it does the right thing with OpenSSL, see my ports commits. I am surprised about the finding mentioned here.

Yes the changes to www/node* and ca_root_nss were all proper when using base ssl.
The unintended oversight is when using ports ssl with DEFAULT_VERSIONS+= ssl=openssl in make.conf.
The ports ssl is looking for /usr/local/openssl/cert.pem which nothing provides now on 15+.

At minimum having /usr/local/openssl/cert.pem -> /etc/ssl/cert.pem fixes the problem. But what creates that? In ports typically anything wanting to use the cert store uses ca_root_nss.

The combination of these is what allowed node TLS to work before (both npm fetches during builds and at runtime):

1. ca_root_nss installed for www/node*, which https://bugs.freebsd.org/291482 (db2245ab68) removed because it only considered base which ensures /etc/ssl/cert.pem exists.
2. /usr/local/openssl/cert.pem exists which ETCSYMLINK was providing but excluded for 15+ in this review (D52398) because base did not need it. ports does.

For now a build workaround for anyone using ports ssl is export SSL_CERT_FILE=/etc/ssl/cert.pem in their poudriere.conf or in their make.conf after the DEFAULT_VERSIONS line:

# Use base cert trust store when using ports ssl and it is otherwise not provided.
.if (${DEFAULT_VERSIONS:Mssl=*} && !${DEFAULT_VERSIONS:Mssl=base}) && !exists(/usr/local/openssl/cert.pem)
SSL_CERT_FILE=/etc/ssl/cert.pem
.export SSL_CERT_FILE
.endif

At runtime, users would need SSL_CERT_FILE set in their environment as well, or the /usr/local/openssl/cert.pem -> /etc/ssl/cert.pem symlink created.

[michaelo]

In D52398#1399811, @bdrewery wrote:

In D52398#1306397, @michaelo wrote:

I have worked on node a couple of months ago and verified in its codebase that it does the right thing with OpenSSL, see my ports commits. I am surprised about the finding mentioned here.

Yes the changes to www/node* and ca_root_nss were all proper when using base ssl.
The unintended oversight is when using ports ssl with DEFAULT_VERSIONS+= ssl=openssl in make.conf.
The ports ssl is looking for /usr/local/openssl/cert.pem which nothing provides now on 15+.

At minimum having /usr/local/openssl/cert.pem -> /etc/ssl/cert.pem fixes the problem. But what creates that? In ports typically anything wanting to use the cert store uses ca_root_nss.

The combination of these is what allowed node TLS to work before (both npm fetches during builds and at runtime):

1. ca_root_nss installed for www/node*, which https://bugs.freebsd.org/291482 (db2245ab68) removed because it only considered base which ensures /etc/ssl/cert.pem exists.
2. /usr/local/openssl/cert.pem exists which ETCSYMLINK was providing but excluded for 15+ in this review (D52398) because base did not need it. ports does.

For now a build workaround for anyone using ports ssl is export SSL_CERT_FILE=/etc/ssl/cert.pem in their poudriere.conf or in their make.conf after the DEFAULT_VERSIONS line:

# Use base cert trust store when using ports ssl and it is otherwise not provided.
.if (${DEFAULT_VERSIONS:Mssl=*} && !${DEFAULT_VERSIONS:Mssl=base}) && !exists(/usr/local/openssl/cert.pem)
SSL_CERT_FILE=/etc/ssl/cert.pem
.export SSL_CERT_FILE
.endif

At runtime, users would need SSL_CERT_FILE set in their environment as well, or the /usr/local/openssl/cert.pem -> /etc/ssl/cert.pem symlink created.

OpenSSL from ports is just broken in this regard. See https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=269473

I have offerend brnrd my help several times to patch those ports (header files) to use the system truststore while retaining OPENSSLDIR at LOCALBASE: no reaction.

[bdrewery]

In D52398#1399823, @michaelo wrote:

OpenSSL from ports is just broken in this regard. See https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=269473

I have offerend brnrd my help several times to patch those ports (header files) to use the system truststore while retaining OPENSSLDIR at LOCALBASE: no reaction.

Thanks for the pointer. I'll send some attention over there.

[michaelo]

In D52398#1399824, @bdrewery wrote:

In D52398#1399823, @michaelo wrote:

OpenSSL from ports is just broken in this regard. See https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=269473

I have offerend brnrd my help several times to patch those ports (header files) to use the system truststore while retaining OPENSSLDIR at LOCALBASE: no reaction.

Thanks for the pointer. I'll send some attention over there.

To be more specific, we are talking about:

84 #define X509_CERT_DIR OPENSSLDIR "/certs"
85 #define X509_CERT_FILE OPENSSLDIR "/cert.pem"

in ./include/internal/common.h

maybe something else, but I haven't checked beyond that.