lib-ssl-iostream: Always set allow_invalid_cert=TRUE for SSL servers

The callers are now always expected to check if the client certificates were
valid.

Currently the only servers that even supports client certificates are the
login processes, and they had already set this.

diff --git a/src/lib-ssl-iostream/iostream-ssl.c b/src/lib-ssl-iostream/iostream-ssl.c
index 89028bf74bfe26ed015cc8a6d5f992816ed016e2..cac44a781bf381cf5d664b600bc48b0a92172f4a 100644 (file)
--- a/src/lib-ssl-iostream/iostream-ssl.c
+++ b/src/lib-ssl-iostream/iostream-ssl.c
@@ -96,13 +96,19 @@ int ssl_iostream_context_init_server(const struct ssl_iostream_settings *set,
                                     struct ssl_iostream_context **ctx_r,
                                     const char **error_r)
 {
+       struct ssl_iostream_settings set_copy = *set;
+
+       /* Allow client to provide an invalid certificate. The caller is
+          expected to check and handle it however it wants. */
+       set_copy.allow_invalid_cert = TRUE;
+
        if (!ssl_module_loaded) {
                if (ssl_module_load(error_r) < 0)
                        return -1;
        }
-       if (io_stream_ssl_global_init(set, error_r) < 0)
+       if (io_stream_ssl_global_init(&set_copy, error_r) < 0)
                return -1;
-       return ssl_vfuncs->context_init_server(set, ctx_r, error_r);
+       return ssl_vfuncs->context_init_server(&set_copy, ctx_r, error_r);
 }
 
 void ssl_iostream_context_ref(struct ssl_iostream_context *ctx)

diff --git a/src/lib-ssl-iostream/test-iostream-ssl.c b/src/lib-ssl-iostream/test-iostream-ssl.c
index 519bf7fd31ed6f77ba6f5f514b8575da295cd0d2..e44b96d2b080707a50251855448dd50a91834e3d 100644 (file)
--- a/src/lib-ssl-iostream/test-iostream-ssl.c
+++ b/src/lib-ssl-iostream/test-iostream-ssl.c
@@ -369,14 +369,7 @@ static void test_iostream_ssl_handshake(void)
        server_set.verify_remote_cert = TRUE;
        server_set.ca = client_set.ca;
        client_set.cert = server_set.cert;
-#ifdef DOVECOT_USE_OPENSSL3
-       test_expect_error_string("server: SSL_accept() failed: error:0A000086:SSL routines::"
-                                "certificate verify failed+Received invalid SSL certificate:");
-#else
-       test_expect_error_string("server: SSL_accept() failed: error:1417C086:SSL routines:"
-                                "tls_process_client_certificate:certificate verify failed+"
-                                "Received invalid SSL certificate: ");
-#endif
+       test_expect_error_string("server: Received invalid SSL certificate");
        test_assert_idx(test_iostream_ssl_handshake_real(&server_set, &client_set,
                                                         "127.0.0.1") != 0, idx);
        idx++;