From: Timo Sirainen <timo.sirainen@open-xchange.com>
Date: Wed, 14 Jun 2023 09:28:35 +0000 (+0300)
Subject: lib-ssl-iostream: Change ssl_iostream_settings.verify_remote_cert to be context-only
X-Git-Tag: 2.4.1~1520
X-Git-Url: http://git.ipfire.org/gitweb.cgi?a=commitdiff_plain;h=f7cf8bad5ff0c58aa61d8f518a2ede74afac52ee;p=thirdparty%2Fdovecot%2Fcore.git

lib-ssl-iostream: Change ssl_iostream_settings.verify_remote_cert to be context-only
---

diff --git a/src/lib-master/master-service-ssl.c b/src/lib-master/master-service-ssl.c
index 2ad45388f8..8e89b98006 100644
--- a/src/lib-master/master-service-ssl.c
+++ b/src/lib-master/master-service-ssl.c
@@ -44,7 +44,6 @@ int master_service_ssl_init(struct master_service *service,
 
 	i_zero(&ssl_set);
 	ssl_set.verbose = set->verbose_ssl;
-	ssl_set.verify_remote_cert = server_set->ssl_request_client_cert;
 	ret = io_stream_create_ssl_server(service->ssl_ctx, &ssl_set, NULL,
 					  input, output, ssl_iostream_r, error_r);
 	settings_free(set);
diff --git a/src/lib-ssl-iostream/iostream-openssl.c b/src/lib-ssl-iostream/iostream-openssl.c
index 58005b29a6..f69ae16b41 100644
--- a/src/lib-ssl-iostream/iostream-openssl.c
+++ b/src/lib-ssl-iostream/iostream-openssl.c
@@ -188,7 +188,7 @@ openssl_iostream_set(struct ssl_iostream *ssl_io,
 		if (openssl_iostream_use_key(ssl_io, "ssl_alt_key", &set->alt_cert, error_r) < 0)
 			return -1;
 	}
-	if (set->verify_remote_cert) {
+	if (ssl_io->ctx->set.verify_remote_cert) {
 		if (ssl_io->ctx->client_ctx)
 			verify_flags = SSL_VERIFY_NONE;
 		else
diff --git a/src/lib-ssl-iostream/iostream-ssl.h b/src/lib-ssl-iostream/iostream-ssl.h
index 9e076ba8f5..1664bc79d1 100644
--- a/src/lib-ssl-iostream/iostream-ssl.h
+++ b/src/lib-ssl-iostream/iostream-ssl.h
@@ -29,7 +29,7 @@ struct ssl_iostream_settings {
 
 	bool verbose, verbose_invalid_cert; /* stream-only */
 	bool skip_crl_check; /* context-only */
-	bool verify_remote_cert; /* neither/both */
+	bool verify_remote_cert; /* context-only */
 	bool allow_invalid_cert; /* stream-only */
 	bool prefer_server_ciphers; /* context-only */
 	bool compression; /* context-only */