lib-http: If remote SSL cert is invalid, treat it as non-retryable error.

diff --git a/src/lib-http/http-client-connection.c b/src/lib-http/http-client-connection.c
index ed3300823909397b87c1dd260153df074254a9fa..b2296634b2856bef04da33eef19976531974e3bc 100644 (file)
--- a/src/lib-http/http-client-connection.c
+++ b/src/lib-http/http-client-connection.c
@@ -96,6 +96,24 @@ http_client_connection_server_close(struct http_client_connection **_conn)
        http_client_connection_unref(_conn);
 }
 
+static void
+http_client_connection_abort_error(struct http_client_connection **_conn,
+       unsigned int status, const char *error)
+{
+       struct http_client_connection *conn = *_conn;
+       struct http_client_request **req;
+
+       conn->connected = FALSE;
+       conn->closing = TRUE;
+       
+       array_foreach_modifiable(&conn->request_wait_list, req) {
+               http_client_request_error(*req, status, error);
+               http_client_request_unref(req);
+       }       
+       array_clear(&conn->request_wait_list);
+       http_client_connection_unref(_conn);
+}
+
 static void
 http_client_connection_abort_temp_error(struct http_client_connection **_conn,
        unsigned int status, const char *error)
@@ -110,6 +128,14 @@ http_client_connection_abort_temp_error(struct http_client_connection **_conn,
                        error = t_strdup_printf("%s (last SSL error: %s)",
                                                error, sslerr);
                }
+               if (ssl_iostream_has_handshake_failed(conn->ssl_iostream)) {
+                       /* this isn't really a "connection lost", but that we
+                          don't trust the remote's SSL certificate. don't
+                          retry. */
+                       http_client_connection_abort_error(_conn,
+                               HTTP_CLIENT_REQUEST_ERROR_BAD_RESPONSE, error);
+                       return;
+               }
        }
 
        conn->connected = FALSE;
@@ -119,24 +145,6 @@ http_client_connection_abort_temp_error(struct http_client_connection **_conn,
        http_client_connection_unref(_conn);
 }
 
-static void
-http_client_connection_abort_error(struct http_client_connection **_conn,
-       unsigned int status, const char *error)
-{
-       struct http_client_connection *conn = *_conn;
-       struct http_client_request **req;
-
-       conn->connected = FALSE;
-       conn->closing = TRUE;
-       
-       array_foreach_modifiable(&conn->request_wait_list, req) {
-               http_client_request_error(*req, status, error);
-               http_client_request_unref(req);
-       }       
-       array_clear(&conn->request_wait_list);
-       http_client_connection_unref(_conn);
-}
-
 static void
 http_client_connection_idle_timeout(struct http_client_connection *conn)
 {