imap, pop3: Prevent reading ssl_ca setting into memory

Especially with imap there can be a lot of processes and a large ssl_ca
could be wasting a lot of memory. This was already the old behavior before
removing ssl_* settings from lib-storage.

diff --git a/src/imap/main.c b/src/imap/main.c
index 5e8526d98f3baa432881e67303e39495661a0bd0..a95f41b9514db06f54d170beead080b196ce6544 100644 (file)
--- a/src/imap/main.c
+++ b/src/imap/main.c
@@ -470,6 +470,7 @@ int main(int argc, char *argv[])
        struct master_login_settings login_set;
        enum master_service_flags service_flags = 0;
        enum mail_storage_service_flags storage_service_flags =
+               MAIL_STORAGE_SERVICE_FLAG_NO_SSL_CA |
                /*
                 * We include MAIL_STORAGE_SERVICE_FLAG_NO_NAMESPACES so
                 * that the mail_user initialization is fast and we can

diff --git a/src/lib-master/master-service-settings.c b/src/lib-master/master-service-settings.c
index 4e408c9deab8e28a86462eac4beac5e1c5433f04..6c1f259548e3494c627b57786b46edff440d7862 100644 (file)
--- a/src/lib-master/master-service-settings.c
+++ b/src/lib-master/master-service-settings.c
@@ -363,6 +363,8 @@ config_build_request(struct master_service *service, string_t *str,
                str_printfa(str, "\tmodule=%s",
                            service->want_ssl_server ? "ssl-server" : "ssl");
        }
+       if (input->no_ssl_ca)
+               str_append(str, "\texclude=ssl_ca\texclude=ssl_verify_client_cert");
        if (input->service != NULL)
                str_printfa(str, "\tservice=%s", input->service);
        if (input->username != NULL)

diff --git a/src/lib-master/master-service-settings.h b/src/lib-master/master-service-settings.h
index 4fe281f4148b6e1cb49de2247812efa336a5fd8d..fc396f9d4990a71ee3ae72686784fed6e4440543 100644 (file)
--- a/src/lib-master/master-service-settings.h
+++ b/src/lib-master/master-service-settings.h
@@ -49,6 +49,11 @@ struct master_service_settings_input {
        const char *username;
        struct ip_addr local_ip, remote_ip;
        const char *local_name;
+
+       /* A bit of a memory saving kludge: Mail processes (especially imap)
+          shouldn't read ssl_ca setting since it's likely not needed and it
+          can use a lot of memory. */
+       bool no_ssl_ca;
 };
 
 struct master_service_settings_output {

diff --git a/src/lib-storage/mail-storage-service.c b/src/lib-storage/mail-storage-service.c
index 0b29cd5e91a4c6316d9827c105393f023dac5b20..f6bd9bbe4956dedb37f5e3a8802d31a3e092f7a9 100644 (file)
--- a/src/lib-storage/mail-storage-service.c
+++ b/src/lib-storage/mail-storage-service.c
@@ -1073,6 +1073,8 @@ int mail_storage_service_read_settings(struct mail_storage_service_ctx *ctx,
                (flags & MAIL_STORAGE_SERVICE_FLAG_USERDB_LOOKUP) == 0;
        set_input.use_sysexits =
                (flags & MAIL_STORAGE_SERVICE_FLAG_USE_SYSEXITS) != 0;
+       set_input.no_ssl_ca =
+               (flags & MAIL_STORAGE_SERVICE_FLAG_NO_SSL_CA) != 0;
 
        if (input != NULL) {
                set_input.module = input->module;

diff --git a/src/lib-storage/mail-storage-service.h b/src/lib-storage/mail-storage-service.h
index 60dc8bb728dcdd64146cf29652f62c0b434ddb4e..31508e80ed22c9afc1565cb40ff911caa94da40b 100644 (file)
--- a/src/lib-storage/mail-storage-service.h
+++ b/src/lib-storage/mail-storage-service.h
@@ -34,6 +34,8 @@ enum mail_storage_service_flags {
        MAIL_STORAGE_SERVICE_FLAG_USE_SYSEXITS          = 0x400,
        /* Don't create namespaces, only the user. */
        MAIL_STORAGE_SERVICE_FLAG_NO_NAMESPACES         = 0x800,
+       /* Disable reading ssl_ca setting to save memory. */
+       MAIL_STORAGE_SERVICE_FLAG_NO_SSL_CA             = 0x1000,
 };
 
 struct mail_storage_service_input {

diff --git a/src/pop3/main.c b/src/pop3/main.c
index 96de77697d640a749737888f93df6fa1a3cb8910..3e08cb03519ee479c2aa140137b5fb0a6ad22914 100644 (file)
--- a/src/pop3/main.c
+++ b/src/pop3/main.c
@@ -327,7 +327,8 @@ int main(int argc, char *argv[])
        };
        struct master_login_settings login_set;
        enum master_service_flags service_flags = 0;
-       enum mail_storage_service_flags storage_service_flags = 0;
+       enum mail_storage_service_flags storage_service_flags =
+               MAIL_STORAGE_SERVICE_FLAG_NO_SSL_CA;
        const char *username = NULL, *auth_socket_path = "auth-master";
        int c;