lib-ssl-iostream, global: Remove ssl_iostream_settings.verbose_invalid_cert

The error about invalid certificate will be included in the SSL iostream's
error string, which the caller will eventually log. There's no need to
have a separate warning logged about it.

diff --git a/src/auth/db-oauth2.c b/src/auth/db-oauth2.c
index d8f78f3ddcbdf1b5dd0b3681ce3e06aec7c13378..b0420b3415ebe5144e3090726a32f29d8cf5023b 100644 (file)
--- a/src/auth/db-oauth2.c
+++ b/src/auth/db-oauth2.c
@@ -229,7 +229,6 @@ struct db_oauth2 *db_oauth2_init(const char *config_path)
        ssl_set.prefer_server_ciphers = TRUE;
        ssl_set.allow_invalid_cert = db->set.tls_allow_invalid_cert;
        ssl_set.verbose = db->set.debug;
-       ssl_set.verbose_invalid_cert = db->set.debug;
        http_set.ssl = &ssl_set;
 
        http_set.dns_client_socket_path = "dns-client";

diff --git a/src/lib-doveadm/doveadm-client.c b/src/lib-doveadm/doveadm-client.c
index 9177568f13b99c2f1164d8f697eb05b1b1207ebe..c530da66ab945ff778fc769ddc8e100e23dbc1d4 100644 (file)
--- a/src/lib-doveadm/doveadm-client.c
+++ b/src/lib-doveadm/doveadm-client.c
@@ -567,8 +567,6 @@ static int doveadm_client_init_ssl(struct doveadm_client *conn,
 
        if ((conn->set.ssl_flags & AUTH_PROXY_SSL_FLAG_ANY_CERT) != 0)
                ssl_set.allow_invalid_cert = TRUE;
-       if (ssl_set.allow_invalid_cert)
-               ssl_set.verbose_invalid_cert = TRUE;
 
        if (conn->set.ssl_ctx == NULL &&
            ssl_iostream_client_context_cache_get(&ssl_set, &conn->set.ssl_ctx,

diff --git a/src/lib-http/http-client-connection.c b/src/lib-http/http-client-connection.c
index dc920ac744e8429e713882c827d90bf75c4db4d0..c3250ab725a1ac7a21fba22d04301dac0a6cc032 100644 (file)
--- a/src/lib-http/http-client-connection.c
+++ b/src/lib-http/http-client-connection.c
@@ -1502,21 +1502,16 @@ http_client_connection_ssl_init(struct http_client_connection *conn,
        struct http_client_peer_shared *pshared = ppool->peer;
        const struct http_client_settings *set =
                http_client_connection_get_settings(conn);
-       struct ssl_iostream_settings ssl_set;
        struct ssl_iostream_context *ssl_ctx = ppool->ssl_ctx;
        const char *error;
 
        i_assert(ssl_ctx != NULL);
 
-       ssl_set = *set->ssl;
-       if (!set->ssl->allow_invalid_cert)
-               ssl_set.verbose_invalid_cert = TRUE;
-
        e_debug(conn->event, "Starting SSL handshake");
 
        connection_input_halt(&conn->conn);
        if (io_stream_create_ssl_client(ssl_ctx, pshared->addr.a.tcp.https_name,
-                                       &ssl_set, conn->event,
+                                       set->ssl, conn->event,
                                        &conn->conn.input, &conn->conn.output,
                                        &conn->ssl_iostream, &error) < 0) {
                *error_r = t_strdup_printf(

diff --git a/src/lib-imap-client/imapc-client.c b/src/lib-imap-client/imapc-client.c
index eeff396e5e1ef8bc87a08448ca9680d9c4f01d02..10ca1a5bcbcd21459b03f65b953af4597207fefa 100644 (file)
--- a/src/lib-imap-client/imapc-client.c
+++ b/src/lib-imap-client/imapc-client.c
@@ -104,7 +104,6 @@ imapc_client_init(const struct imapc_client_settings *set,
        if (set->ssl_mode != IMAPC_CLIENT_SSL_MODE_NONE) {
                client->set.ssl_mode = set->ssl_mode;
                ssl_iostream_settings_init_from(pool, &client->set.ssl_set, &set->ssl_set);
-               client->set.ssl_set.verbose_invalid_cert = !client->set.ssl_set.allow_invalid_cert;
                if (ssl_iostream_client_context_cache_get(&client->set.ssl_set,
                                                          &client->ssl_ctx,
                                                          &error) < 0) {

diff --git a/src/lib-master/master-service-ssl-settings.c b/src/lib-master/master-service-ssl-settings.c
index a2f1f4cb7105ab1ea4fb77294c5ab4f9f3eadbee..4b292ee6bcce0d86d7da4d78c89aab2ebbd276fe 100644 (file)
--- a/src/lib-master/master-service-ssl-settings.c
+++ b/src/lib-master/master-service-ssl-settings.c
@@ -181,7 +181,6 @@ static void master_service_ssl_common_settings_to_iostream_set(
        set_r->crypto_device = p_strdup(pool, ssl_set->ssl_crypto_device);
 
        set_r->verbose = ssl_set->verbose_ssl;
-       set_r->verbose_invalid_cert = ssl_set->verbose_ssl;
        set_r->compression = ssl_set->parsed_opts.compression;
        set_r->tickets = ssl_set->parsed_opts.tickets;
        set_r->curve_list = p_strdup(pool, ssl_set->ssl_curve_list);

diff --git a/src/lib-ssl-iostream/iostream-openssl.c b/src/lib-ssl-iostream/iostream-openssl.c
index f2d5cf4ec11e0e56790136b3dd485c18682ae86b..9fd7f76f410e4742010064fc762ef9350563e149 100644 (file)
--- a/src/lib-ssl-iostream/iostream-openssl.c
+++ b/src/lib-ssl-iostream/iostream-openssl.c
@@ -95,8 +95,6 @@ openssl_iostream_verify_client_cert(int preverify_ok, X509_STORE_CTX *ctx)
                        ssl_io->ctx->client_ctx ?
                                "ssl_client_ca_* settings?" :
                                "ssl_ca setting?"));
-               if (ssl_io->verbose_invalid_cert)
-                       e_warning(ssl_io->event, "%s", ssl_io->last_error);
        } else {
                e_debug(ssl_io->event, "Received valid SSL certificate: %s", certname);
        }
@@ -131,9 +129,6 @@ openssl_iostream_set(struct ssl_iostream *ssl_io,
                event_set_forced_debug(ssl_io->event, TRUE);
        else
                event_set_min_log_level(ssl_io->event, LOG_TYPE_WARNING);
-       ssl_io->verbose_invalid_cert =
-               set->verbose_invalid_cert ||
-               event_want_debug(ssl_io->event);
        ssl_io->allow_invalid_cert = set->allow_invalid_cert;
 }
 

diff --git a/src/lib-ssl-iostream/iostream-openssl.h b/src/lib-ssl-iostream/iostream-openssl.h
index 6f66e717969dd651abc0126838673d5f16e03186..0ceb6f253a0cf81bf34cba4540ca9a3cb91379d7 100644 (file)
--- a/src/lib-ssl-iostream/iostream-openssl.h
+++ b/src/lib-ssl-iostream/iostream-openssl.h
@@ -51,7 +51,7 @@ struct ssl_iostream {
        int plain_stream_errno;
 
        /* copied settings */
-       bool verbose_invalid_cert, allow_invalid_cert;
+       bool allow_invalid_cert;
 
        ssl_iostream_handshake_callback_t *handshake_callback;
        void *handshake_context;

diff --git a/src/lib-ssl-iostream/iostream-ssl.c b/src/lib-ssl-iostream/iostream-ssl.c
index 5b4148653f8813313e33b80a2be2afb9d2c1f5e4..e59f71a488b1b6844f2f727a328784a7a1bf79c4 100644 (file)
--- a/src/lib-ssl-iostream/iostream-ssl.c
+++ b/src/lib-ssl-iostream/iostream-ssl.c
@@ -322,7 +322,6 @@ bool ssl_iostream_settings_equals(const struct ssl_iostream_settings *set1,
 void ssl_iostream_settings_drop_stream_only(struct ssl_iostream_settings *set)
 {
        set->verbose = FALSE;
-       set->verbose_invalid_cert = FALSE;
        set->allow_invalid_cert = FALSE;
 }
 

diff --git a/src/lib-ssl-iostream/iostream-ssl.h b/src/lib-ssl-iostream/iostream-ssl.h
index 173b04037b5880db3fb8456abca9c6addeea27a5..3221e40c4b0697243f3de9f286af6904031253b9 100644 (file)
--- a/src/lib-ssl-iostream/iostream-ssl.h
+++ b/src/lib-ssl-iostream/iostream-ssl.h
@@ -27,7 +27,7 @@ struct ssl_iostream_settings {
        const char *cert_username_field; /* context-only */
        const char *crypto_device; /* context-only */
 
-       bool verbose, verbose_invalid_cert; /* stream-only */
+       bool verbose; /* stream-only */
        bool skip_crl_check; /* context-only */
        bool verify_remote_cert; /* context-only */
        bool allow_invalid_cert; /* stream-only */

diff --git a/src/lib-storage/index/pop3c/pop3c-client.c b/src/lib-storage/index/pop3c/pop3c-client.c
index aab979196a8dfd5fa4b52da7363e77e9aaa366e1..9c37b7e7351e1bd6888382debb078f55f3b88b47 100644 (file)
--- a/src/lib-storage/index/pop3c/pop3c-client.c
+++ b/src/lib-storage/index/pop3c/pop3c-client.c
@@ -121,7 +121,6 @@ pop3c_client_init(const struct pop3c_client_settings *set,
 
        if (set->ssl_mode != POP3C_CLIENT_SSL_MODE_NONE) {
                ssl_iostream_settings_init_from(client->pool, &client->set.ssl_set, &set->ssl_set);
-               client->set.ssl_set.verbose_invalid_cert = !client->set.ssl_set.allow_invalid_cert;
                if (ssl_iostream_client_context_cache_get(&set->ssl_set,
                                                          &client->ssl_ctx,
                                                          &error) < 0) {

diff --git a/src/submission/submission-backend-relay.c b/src/submission/submission-backend-relay.c
index 11e1004d84e539da27c6f1206e8c8349f5da32ea..76ffdfb429193d6836a40a7ec9d5a643e43da8bd 100644 (file)
--- a/src/submission/submission-backend-relay.c
+++ b/src/submission/submission-backend-relay.c
@@ -1089,9 +1089,7 @@ submission_backend_relay_create(
        event_set_append_log_prefix(rbackend->backend.event, "relay: ");
 
        ssl_set = *user->ssl_set;
-       if (set->ssl_verify)
-               ssl_set.verbose_invalid_cert = TRUE;
-       else
+       if (!set->ssl_verify)
                ssl_set.allow_invalid_cert = TRUE;
 
        /* make relay connection */