we don't need a configuration flag for use_delta

it's safe to always set it

diff --git a/src/lib/tls/base-h b/src/lib/tls/base-h
index 99b522a8e70febd5a6ab59c8790597b6e36331ad..29645c2b81fff1350f0c1c19476cb741d6ccc9f8 100644 (file)
--- a/src/lib/tls/base-h
+++ b/src/lib/tls/base-h
@@ -244,7 +244,6 @@ struct fr_tls_conf_s {
 
        uint32_t        fragment_size;                  //!< Maximum record fragment, or record size.
        bool            check_crl;                      //!< Check certificate revocation lists.
-       bool            use_deltas;                     //!< Enable support for delta CRLs.
        bool            allow_expired_crl;              //!< Don't error out if CRL is expired.
        char const      *check_cert_cn;                 //!< Verify cert CN matches the expansion of this string.
 

diff --git a/src/lib/tls/conf.c b/src/lib/tls/conf.c
index bba07752c8202c01a0f01f9783dbf00e332b8a4c..f5cffdea57b992100d0e6ef3dc09908d960d33a4 100644 (file)
--- a/src/lib/tls/conf.c
+++ b/src/lib/tls/conf.c
@@ -144,9 +144,6 @@ CONF_PARSER fr_tls_server_config[] = {
 
        { FR_CONF_OFFSET("disable_single_dh_use", FR_TYPE_BOOL, fr_tls_conf_t, disable_single_dh_use) },
        { FR_CONF_OFFSET("check_crl", FR_TYPE_BOOL, fr_tls_conf_t, check_crl), .dflt = "no" },
-#ifdef X509_V_FLAG_USE_DELTAS
-       { FR_CONF_OFFSET("use_deltas", FR_TYPE_BOOL, fr_tls_conf_t, use_deltas), .dflt = "no" },
-#endif
 #ifdef X509_V_FLAG_CRL_CHECK_ALL
        { FR_CONF_DEPRECATED("check_all_crl", FR_TYPE_BOOL, fr_tls_conf_t, NULL) },
 #endif

diff --git a/src/lib/tls/ctx.c b/src/lib/tls/ctx.c
index 5900d28b3efc5339ec4077569113ffd51acb9c5e..1296dd52b3661baaeaabb6e4f910eedf8aa5a036 100644 (file)
--- a/src/lib/tls/ctx.c
+++ b/src/lib/tls/ctx.c
@@ -749,9 +749,14 @@ post_ca:
                }
                X509_STORE_set_flags(cert_vpstore, X509_V_FLAG_CRL_CHECK | X509_V_FLAG_CRL_CHECK_ALL);
 #ifdef X509_V_FLAG_USE_DELTAS 
-               if (conf->use_deltas) {
-                       X509_STORE_set_flags(cert_vpstore, X509_V_FLAG_USE_DELTAS);
-               }
+               /*
+                *      If set, delta CRLs (if present) are used to
+                *      determine certificate status. If not set
+                *      deltas are ignored.
+                *
+                *      So it's safe to always set this flag.
+                */
+               X509_STORE_set_flags(cert_vpstore, X509_V_FLAG_USE_DELTAS);
 #endif
        }
 #endif