From: Alan T. DeKok <aland@freeradius.org>
Date: Mon, 20 Apr 2020 20:35:56 +0000 (-0400)
Subject: we don't need a configuration flag for use_delta
X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=172c2716e5c8d64bcdd916e1aa05adac4e38e854;p=thirdparty%2Ffreeradius-server.git

we don't need a configuration flag for use_delta

it's safe to always set it
---

diff --git a/src/lib/tls/base-h b/src/lib/tls/base-h
index 99b522a8e70..29645c2b81f 100644
--- a/src/lib/tls/base-h
+++ b/src/lib/tls/base-h
@@ -244,7 +244,6 @@ struct fr_tls_conf_s {
 
 	uint32_t	fragment_size;			//!< Maximum record fragment, or record size.
 	bool		check_crl;			//!< Check certificate revocation lists.
-	bool		use_deltas;			//!< Enable support for delta CRLs.
 	bool		allow_expired_crl;		//!< Don't error out if CRL is expired.
 	char const	*check_cert_cn;			//!< Verify cert CN matches the expansion of this string.
 
diff --git a/src/lib/tls/conf.c b/src/lib/tls/conf.c
index bba07752c82..f5cffdea57b 100644
--- a/src/lib/tls/conf.c
+++ b/src/lib/tls/conf.c
@@ -144,9 +144,6 @@ CONF_PARSER fr_tls_server_config[] = {
 
 	{ FR_CONF_OFFSET("disable_single_dh_use", FR_TYPE_BOOL, fr_tls_conf_t, disable_single_dh_use) },
 	{ FR_CONF_OFFSET("check_crl", FR_TYPE_BOOL, fr_tls_conf_t, check_crl), .dflt = "no" },
-#ifdef X509_V_FLAG_USE_DELTAS
-	{ FR_CONF_OFFSET("use_deltas", FR_TYPE_BOOL, fr_tls_conf_t, use_deltas), .dflt = "no" },
-#endif
 #ifdef X509_V_FLAG_CRL_CHECK_ALL
 	{ FR_CONF_DEPRECATED("check_all_crl", FR_TYPE_BOOL, fr_tls_conf_t, NULL) },
 #endif
diff --git a/src/lib/tls/ctx.c b/src/lib/tls/ctx.c
index 5900d28b3ef..1296dd52b36 100644
--- a/src/lib/tls/ctx.c
+++ b/src/lib/tls/ctx.c
@@ -749,9 +749,14 @@ post_ca:
 		}
 		X509_STORE_set_flags(cert_vpstore, X509_V_FLAG_CRL_CHECK | X509_V_FLAG_CRL_CHECK_ALL);
 #ifdef X509_V_FLAG_USE_DELTAS 
-		if (conf->use_deltas) {
-			X509_STORE_set_flags(cert_vpstore, X509_V_FLAG_USE_DELTAS);
-		}
+		/*
+		 *	If set, delta CRLs (if present) are used to
+		 *	determine certificate status. If not set
+		 *	deltas are ignored.
+		 *
+		 *	So it's safe to always set this flag.
+		 */
+		X509_STORE_set_flags(cert_vpstore, X509_V_FLAG_USE_DELTAS);
 #endif
 	}
 #endif