lib-master: Add MASTER_SERVICE_FLAG_DISABLE_SSL_SET

diff --git a/src/lib-master/master-service-settings.c b/src/lib-master/master-service-settings.c
index 6c1f259548e3494c627b57786b46edff440d7862..06025f1fcbbb620cddb3789353d631abe5c103f5 100644 (file)
--- a/src/lib-master/master-service-settings.c
+++ b/src/lib-master/master-service-settings.c
@@ -223,7 +223,8 @@ master_service_exec_config(struct master_service *service,
                        strarr_push(&conf_argv, input->extra_modules[i]);
                }
        }
-       if (input->module != NULL || input->extra_modules != NULL) {
+       if ((service->flags & MASTER_SERVICE_FLAG_DISABLE_SSL_SET) == 0 &&
+           (input->module != NULL || input->extra_modules != NULL)) {
                strarr_push(&conf_argv, "-m");
                if (service->want_ssl_server)
                        strarr_push(&conf_argv, "ssl-server");
@@ -359,7 +360,8 @@ config_build_request(struct master_service *service, string_t *str,
                for (unsigned int i = 0; input->extra_modules[i] != NULL; i++)
                        str_printfa(str, "\tmodule=%s", input->extra_modules[i]);
        }
-       if (input->module != NULL || input->extra_modules != NULL) {
+       if ((service->flags & MASTER_SERVICE_FLAG_DISABLE_SSL_SET) == 0 &&
+           (input->module != NULL || input->extra_modules != NULL)) {
                str_printfa(str, "\tmodule=%s",
                            service->want_ssl_server ? "ssl-server" : "ssl");
        }

diff --git a/src/lib-master/master-service.h b/src/lib-master/master-service.h
index 1138f24b50cca9fe6eea02caa9b89101aaff50ee..192f7e641c266cda9f0f77f85eb32d3a90c66a37 100644 (file)
--- a/src/lib-master/master-service.h
+++ b/src/lib-master/master-service.h
@@ -27,6 +27,12 @@ enum master_service_flags {
        /* Show number of connections in process title
           (only if verbose_proctitle setting is enabled) */
        MASTER_SERVICE_FLAG_UPDATE_PROCTITLE    = 0x100,
+       /* Don't read any SSL settings. This is mainly needed to prevent master
+          process from trying to pass through huge list of SSL CA certificates
+          through environment for ssl_ca setting, which could fail. Although
+          the same problem can still happen with standalone doveadm if it
+          reads settings via doveconf instead of config socket. */
+       MASTER_SERVICE_FLAG_DISABLE_SSL_SET     = 0x200,
        /* Don't initialize SSL context automatically. */
        MASTER_SERVICE_FLAG_NO_SSL_INIT         = 0x400,
        /* Don't create a data stack frame between master_service_init() and