From: Timo Sirainen <timo.sirainen@dovecot.fi>
Date: Thu, 16 Jun 2016 08:23:16 +0000 (+0300)
Subject: lib-ssl-iostream: Changed require_valid_cert -> allow_invalid_cert
X-Git-Tag: 2.3.0.rc1~3490
X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=095481fee84040436ce2dccca472c9bb1df4d5bb;p=thirdparty%2Fdovecot%2Fcore.git

lib-ssl-iostream: Changed require_valid_cert -> allow_invalid_cert

We should default to being safe.
---

diff --git a/src/doveadm/server-connection.c b/src/doveadm/server-connection.c
index 59562715da..2454c743ef 100644
--- a/src/doveadm/server-connection.c
+++ b/src/doveadm/server-connection.c
@@ -433,7 +433,6 @@ static int server_connection_init_ssl(struct server_connection *conn)
 
 	memset(&ssl_set, 0, sizeof(ssl_set));
 	ssl_set.verify_remote_cert = TRUE;
-	ssl_set.require_valid_cert = TRUE;
 	ssl_set.verbose_invalid_cert = TRUE;
 
 	if (io_stream_create_ssl_client(conn->server->ssl_ctx,
diff --git a/src/lib-http/http-client-connection.c b/src/lib-http/http-client-connection.c
index d89b35647c..fed1bba168 100644
--- a/src/lib-http/http-client-connection.c
+++ b/src/lib-http/http-client-connection.c
@@ -1124,7 +1124,7 @@ http_client_connection_ssl_handshaked(const char **error_r, void *context)
 
 	if (ssl_iostream_check_cert_validity(conn->ssl_iostream, host, &error) == 0)
 		http_client_connection_debug(conn, "SSL handshake successful");
-	else if (!conn->client->set.ssl->require_valid_cert) {
+	else if (conn->client->set.ssl->allow_invalid_cert) {
 		http_client_connection_debug(conn, "SSL handshake successful, "
 			"ignoring invalid certificate: %s", error);
 	} else {
@@ -1144,10 +1144,9 @@ http_client_connection_ssl_init(struct http_client_connection *conn,
 	i_assert(conn->client->ssl_ctx != NULL);
 
 	memset(&ssl_set, 0, sizeof(ssl_set));
-	if (conn->client->set.ssl->require_valid_cert) {
+	if (!conn->client->set.ssl->allow_invalid_cert) {
 		ssl_set.verbose_invalid_cert = TRUE;
 		ssl_set.verify_remote_cert = TRUE;
-		ssl_set.require_valid_cert = TRUE;
 	}
 
 	if (conn->client->set.debug)
diff --git a/src/lib-http/test-http-client.c b/src/lib-http/test-http-client.c
index a98328abd2..7f34f469ed 100644
--- a/src/lib-http/test-http-client.c
+++ b/src/lib-http/test-http-client.c
@@ -360,7 +360,7 @@ int main(int argc, char *argv[])
 		i_fatal("Couldn't initialize DNS client: %s", error);
 
 	memset(&ssl_set, 0, sizeof(ssl_set));
-	ssl_set.require_valid_cert = FALSE;
+	ssl_set.allow_invalid_cert = TRUE;
 	ssl_set.ca_dir = "/etc/ssl/certs"; /* debian */
 	ssl_set.ca_file = "/etc/pki/tls/cert.pem"; /* redhat */
 
diff --git a/src/lib-imap-client/imapc-connection.c b/src/lib-imap-client/imapc-connection.c
index a6bc16eea3..8ffd059d66 100644
--- a/src/lib-imap-client/imapc-connection.c
+++ b/src/lib-imap-client/imapc-connection.c
@@ -1500,7 +1500,6 @@ static int imapc_connection_ssl_init(struct imapc_connection *conn)
 	if (conn->client->set.ssl_verify) {
 		ssl_set.verbose_invalid_cert = TRUE;
 		ssl_set.verify_remote_cert = TRUE;
-		ssl_set.require_valid_cert = TRUE;
 	}
 
 	if (conn->client->set.debug)
diff --git a/src/lib-ssl-iostream/iostream-openssl.c b/src/lib-ssl-iostream/iostream-openssl.c
index db5c1216fc..955010233e 100644
--- a/src/lib-ssl-iostream/iostream-openssl.c
+++ b/src/lib-ssl-iostream/iostream-openssl.c
@@ -132,7 +132,7 @@ openssl_iostream_verify_client_cert(int preverify_ok, X509_STORE_CTX *ctx)
 	}
 	if (preverify_ok == 0) {
 		ssl_io->cert_broken = TRUE;
-		if (ssl_io->require_valid_cert) {
+		if (!ssl_io->allow_invalid_cert) {
 			ssl_io->handshake_failed = TRUE;
 			return 0;
 		}
@@ -199,7 +199,7 @@ openssl_iostream_set(struct ssl_iostream *ssl_io,
 
 	ssl_io->verbose = set->verbose;
 	ssl_io->verbose_invalid_cert = set->verbose_invalid_cert || set->verbose;
-	ssl_io->require_valid_cert = set->require_valid_cert;
+	ssl_io->allow_invalid_cert = set->allow_invalid_cert;
 	return 0;
 }
 
diff --git a/src/lib-ssl-iostream/iostream-openssl.h b/src/lib-ssl-iostream/iostream-openssl.h
index 07f830cc24..3bfefbf23c 100644
--- a/src/lib-ssl-iostream/iostream-openssl.h
+++ b/src/lib-ssl-iostream/iostream-openssl.h
@@ -36,7 +36,7 @@ struct ssl_iostream {
 	int plain_stream_errno;
 
 	/* copied settings */
-	bool verbose, verbose_invalid_cert, require_valid_cert;
+	bool verbose, verbose_invalid_cert, allow_invalid_cert;
 	int username_nid;
 
 	ssl_iostream_handshake_callback_t *handshake_callback;
diff --git a/src/lib-ssl-iostream/iostream-ssl.h b/src/lib-ssl-iostream/iostream-ssl.h
index 930d099e71..79d5e0d2b2 100644
--- a/src/lib-ssl-iostream/iostream-ssl.h
+++ b/src/lib-ssl-iostream/iostream-ssl.h
@@ -16,7 +16,7 @@ struct ssl_iostream_settings {
 
 	bool verbose, verbose_invalid_cert; /* stream-only */
 	bool verify_remote_cert; /* neither/both */
-	bool require_valid_cert; /* stream-only */
+	bool allow_invalid_cert; /* stream-only */
 	bool prefer_server_ciphers;
 	bool compression;
 	bool tickets;
diff --git a/src/lib-storage/index/pop3c/pop3c-client.c b/src/lib-storage/index/pop3c/pop3c-client.c
index e11c24425b..23fca7e271 100644
--- a/src/lib-storage/index/pop3c/pop3c-client.c
+++ b/src/lib-storage/index/pop3c/pop3c-client.c
@@ -570,7 +570,6 @@ static int pop3c_client_ssl_init(struct pop3c_client *client)
 	if (client->set.ssl_verify) {
 		ssl_set.verbose_invalid_cert = TRUE;
 		ssl_set.verify_remote_cert = TRUE;
-		ssl_set.require_valid_cert = TRUE;
 	}
 
 	if (client->set.debug)