lib-ssl-iostream: Change ssl_iostream_settings.allow_invalid_cert to be context-only

All the callers already set it for context.

diff --git a/src/lib-ssl-iostream/iostream-openssl.c b/src/lib-ssl-iostream/iostream-openssl.c
index c84206e9ded52f73dbe99903cad3f23476c0c63e..3ef8220ec00377d186958fb16ca797060d9e23c9 100644 (file)
--- a/src/lib-ssl-iostream/iostream-openssl.c
+++ b/src/lib-ssl-iostream/iostream-openssl.c
@@ -100,7 +100,7 @@ openssl_iostream_verify_client_cert(int preverify_ok, X509_STORE_CTX *ctx)
        }
        if (preverify_ok == 0) {
                ssl_io->cert_broken = TRUE;
-               if (!ssl_io->allow_invalid_cert) {
+               if (!ssl_io->ctx->set.allow_invalid_cert) {
                        ssl_io->handshake_failed = TRUE;
                        return 0;
                }
@@ -109,8 +109,7 @@ openssl_iostream_verify_client_cert(int preverify_ok, X509_STORE_CTX *ctx)
 }
 
 static void
-openssl_iostream_set(struct ssl_iostream *ssl_io,
-                    const struct ssl_iostream_settings *set)
+openssl_iostream_set(struct ssl_iostream *ssl_io)
 {
        int verify_flags;
 
@@ -124,14 +123,12 @@ openssl_iostream_set(struct ssl_iostream *ssl_io,
                SSL_set_verify(ssl_io->ssl, verify_flags,
                               openssl_iostream_verify_client_cert);
        }
-
-       ssl_io->allow_invalid_cert = set->allow_invalid_cert;
 }
 
 static int
 openssl_iostream_create(struct ssl_iostream_context *ctx,
                        struct event *event_parent, const char *host,
-                       const struct ssl_iostream_settings *set, bool client,
+                       const struct ssl_iostream_settings *set ATTR_UNUSED, bool client,
                        struct istream **input, struct ostream **output,
                        struct ssl_iostream **iostream_r,
                        const char **error_r)
@@ -186,7 +183,7 @@ openssl_iostream_create(struct ssl_iostream_context *ctx,
         SSL_set_ex_data(ssl_io->ssl, dovecot_ssl_extdata_index, ssl_io);
        SSL_set_tlsext_host_name(ssl_io->ssl, host);
 
-       openssl_iostream_set(ssl_io, set);
+       openssl_iostream_set(ssl_io);
 
        o_stream_uncork(ssl_io->plain_output);
 
@@ -604,7 +601,7 @@ static int openssl_iostream_handshake(struct ssl_iostream *ssl_io)
                        ssl_io->handshake_failed = TRUE;
                }
        } else if (ssl_io->connected_host != NULL && !ssl_io->handshake_failed &&
-                 !ssl_io->allow_invalid_cert) {
+                 !ssl_io->ctx->set.allow_invalid_cert) {
                if (ssl_iostream_check_cert_validity(ssl_io, ssl_io->connected_host, &reason) < 0) {
                        openssl_iostream_set_error(ssl_io, reason);
                        ssl_io->handshake_failed = TRUE;

diff --git a/src/lib-ssl-iostream/iostream-openssl.h b/src/lib-ssl-iostream/iostream-openssl.h
index 0ceb6f253a0cf81bf34cba4540ca9a3cb91379d7..64df95c3df45b4e440404a116470bbcb75d5cfcc 100644 (file)
--- a/src/lib-ssl-iostream/iostream-openssl.h
+++ b/src/lib-ssl-iostream/iostream-openssl.h
@@ -50,9 +50,6 @@ struct ssl_iostream {
        char *ja3_str;
        int plain_stream_errno;
 
-       /* copied settings */
-       bool allow_invalid_cert;
-
        ssl_iostream_handshake_callback_t *handshake_callback;
        void *handshake_context;
 

diff --git a/src/lib-ssl-iostream/iostream-ssl.c b/src/lib-ssl-iostream/iostream-ssl.c
index c95c758e41da1c77423c494da2d2492dff6bb75b..61ee2a708a18e2bd91938a7d9cba192e64333106 100644 (file)
--- a/src/lib-ssl-iostream/iostream-ssl.c
+++ b/src/lib-ssl-iostream/iostream-ssl.c
@@ -319,9 +319,8 @@ bool ssl_iostream_settings_equals(const struct ssl_iostream_settings *set1,
        return memcmp(&set1_nonstr, &set2_nonstr, sizeof(set1_nonstr)) == 0;
 }
 
-void ssl_iostream_settings_drop_stream_only(struct ssl_iostream_settings *set)
+void ssl_iostream_settings_drop_stream_only(struct ssl_iostream_settings *set ATTR_UNUSED)
 {
-       set->allow_invalid_cert = FALSE;
 }
 
 const char *ssl_iostream_get_cipher(struct ssl_iostream *ssl_io,

diff --git a/src/lib-ssl-iostream/iostream-ssl.h b/src/lib-ssl-iostream/iostream-ssl.h
index 015a9c674e41eb0051a7008c5816e2afd31722e5..1f05568d231589fda2df802bb31f5dc0dd18304b 100644 (file)
--- a/src/lib-ssl-iostream/iostream-ssl.h
+++ b/src/lib-ssl-iostream/iostream-ssl.h
@@ -29,7 +29,7 @@ struct ssl_iostream_settings {
 
        bool skip_crl_check; /* context-only */
        bool verify_remote_cert; /* context-only */
-       bool allow_invalid_cert; /* stream-only */
+       bool allow_invalid_cert; /* context-only */
        bool prefer_server_ciphers; /* context-only */
        bool compression; /* context-only */
        bool tickets; /* context-only */