From: Timo Sirainen <timo.sirainen@open-xchange.com>
Date: Thu, 3 Nov 2022 17:11:11 +0000 (+0200)
Subject: login-common: Rename client.proxied_ssl to haproxy_terminated_tls
X-Git-Tag: 2.4.0~3427
X-Git-Url: http://git.ipfire.org/gitweb.cgi?a=commitdiff_plain;h=84ed20c13bff37f8cc8913402c156968ca69b95b;p=thirdparty%2Fdovecot%2Fcore.git

login-common: Rename client.proxied_ssl to haproxy_terminated_tls
---

diff --git a/src/login-common/client-common.c b/src/login-common/client-common.c
index eaa46bdb8a..a757284d88 100644
--- a/src/login-common/client-common.c
+++ b/src/login-common/client-common.c
@@ -217,7 +217,7 @@ client_alloc(int fd, pool_t pool,
 	client->trusted = client_is_trusted(client);
 
 	if (conn->haproxied) {
-		client->proxied_ssl = conn->haproxy.ssl;
+		client->haproxy_terminated_tls = conn->haproxy.ssl;
 		client->connection_secured = conn->haproxy.ssl || client->trusted;
 		client->end_client_tls_secured = conn->haproxy.ssl;
 		client->local_name = conn->haproxy.hostname;
@@ -890,7 +890,7 @@ get_var_expand_table(struct client *client)
 	if (!client->connection_tls_secured) {
 		tab[11].value = client->connection_secured ? "secured" : NULL;
 		tab[12].value = "";
-	} else if (client->proxied_ssl) {
+	} else if (client->haproxy_terminated_tls) {
 		tab[11].value = "TLS";
 		tab[12].value = "(proxied)";
 	} else if (client->ssl_iostream != NULL) {
diff --git a/src/login-common/client-common.h b/src/login-common/client-common.h
index d70901110b..5bc17e6ae5 100644
--- a/src/login-common/client-common.h
+++ b/src/login-common/client-common.h
@@ -232,7 +232,8 @@ struct client {
 	/* Client/proxy connection is using TLS. Dovecot has terminated the
 	   TLS connection (not haproxy). */
 	bool connection_tls_secured:1;
-	bool proxied_ssl:1;
+	/* HAProxy terminated the TLS connection. */
+	bool haproxy_terminated_tls:1;
 	/* Connection from the previous hop (client, proxy, haproxy) is
 	   considered secured. Either because TLS is used, or because the
 	   connection is otherwise considered not to need TLS. Note that this
diff --git a/src/login-common/sasl-server.c b/src/login-common/sasl-server.c
index 86e844eca8..4e98547620 100644
--- a/src/login-common/sasl-server.c
+++ b/src/login-common/sasl-server.c
@@ -106,7 +106,7 @@ client_get_auth_flags(struct client *client)
 	if (client->ssl_iostream != NULL &&
 	    ssl_iostream_has_valid_client_cert(client->ssl_iostream))
 		auth_flags |= AUTH_REQUEST_FLAG_VALID_CLIENT_CERT;
-	if (client->connection_tls_secured || client->proxied_ssl)
+	if (client->connection_tls_secured || client->haproxy_terminated_tls)
 		auth_flags |= AUTH_REQUEST_FLAG_TRANSPORT_SECURITY_TLS;
 	if (client->connection_secured)
 		auth_flags |= AUTH_REQUEST_FLAG_SECURED;