From: Timo Sirainen <timo.sirainen@open-xchange.com>
Date: Thu, 15 Jun 2023 21:51:54 +0000 (+0300)
Subject: lib-ssl-iostream: Always set allow_invalid_cert=TRUE for SSL servers
X-Git-Tag: 2.4.1~1506
X-Git-Url: http://git.ipfire.org/gitweb.cgi?a=commitdiff_plain;h=b42768ec1bb8d259a22fba1413f8bb092b3d617d;p=thirdparty%2Fdovecot%2Fcore.git

lib-ssl-iostream: Always set allow_invalid_cert=TRUE for SSL servers

The callers are now always expected to check if the client certificates were
valid.

Currently the only servers that even supports client certificates are the
login processes, and they had already set this.
---

diff --git a/src/lib-ssl-iostream/iostream-ssl.c b/src/lib-ssl-iostream/iostream-ssl.c
index 89028bf74b..cac44a781b 100644
--- a/src/lib-ssl-iostream/iostream-ssl.c
+++ b/src/lib-ssl-iostream/iostream-ssl.c
@@ -96,13 +96,19 @@ int ssl_iostream_context_init_server(const struct ssl_iostream_settings *set,
 				     struct ssl_iostream_context **ctx_r,
 				     const char **error_r)
 {
+	struct ssl_iostream_settings set_copy = *set;
+
+	/* Allow client to provide an invalid certificate. The caller is
+	   expected to check and handle it however it wants. */
+	set_copy.allow_invalid_cert = TRUE;
+
 	if (!ssl_module_loaded) {
 		if (ssl_module_load(error_r) < 0)
 			return -1;
 	}
-	if (io_stream_ssl_global_init(set, error_r) < 0)
+	if (io_stream_ssl_global_init(&set_copy, error_r) < 0)
 		return -1;
-	return ssl_vfuncs->context_init_server(set, ctx_r, error_r);
+	return ssl_vfuncs->context_init_server(&set_copy, ctx_r, error_r);
 }
 
 void ssl_iostream_context_ref(struct ssl_iostream_context *ctx)
diff --git a/src/lib-ssl-iostream/test-iostream-ssl.c b/src/lib-ssl-iostream/test-iostream-ssl.c
index 519bf7fd31..e44b96d2b0 100644
--- a/src/lib-ssl-iostream/test-iostream-ssl.c
+++ b/src/lib-ssl-iostream/test-iostream-ssl.c
@@ -369,14 +369,7 @@ static void test_iostream_ssl_handshake(void)
 	server_set.verify_remote_cert = TRUE;
 	server_set.ca = client_set.ca;
 	client_set.cert = server_set.cert;
-#ifdef DOVECOT_USE_OPENSSL3
-	test_expect_error_string("server: SSL_accept() failed: error:0A000086:SSL routines::"
-				 "certificate verify failed+Received invalid SSL certificate:");
-#else
-	test_expect_error_string("server: SSL_accept() failed: error:1417C086:SSL routines:"
-				 "tls_process_client_certificate:certificate verify failed+"
-				 "Received invalid SSL certificate: ");
-#endif
+	test_expect_error_string("server: Received invalid SSL certificate");
 	test_assert_idx(test_iostream_ssl_handshake_real(&server_set, &client_set,
 							 "127.0.0.1") != 0, idx);
 	idx++;