Gitweb:
http://git.exim.org/exim.git/commitdiff/26e72755c101f59e24735e9ca9a320d5f1ebc2b7
Commit: 26e72755c101f59e24735e9ca9a320d5f1ebc2b7
Parent: 61147df48889217a1c1023d8c6e2431c24967686
Author: Phil Pennock <pdp@???>
AuthorDate: Wed Mar 13 19:48:22 2013 -0400
Committer: Phil Pennock <pdp@???>
CommitDate: Wed Mar 13 19:48:22 2013 -0400
OpenSSL fix empty tls_verify_certificates.
New behaviour matches GnuTLS handling, and is documented.
Previously, a tls_verify_certificates expansion forced failure was the
only portable way to avoid setting this option. Now, an empty string is
equivalent.
---
doc/doc-docbook/spec.xfpt | 3 +++
doc/doc-txt/ChangeLog | 6 ++++++
src/src/tls-openssl.c | 2 +-
3 files changed, 10 insertions(+), 1 deletions(-)
diff --git a/doc/doc-docbook/spec.xfpt b/doc/doc-docbook/spec.xfpt
index 9c03523..92d0a22 100644
--- a/doc/doc-docbook/spec.xfpt
+++ b/doc/doc-docbook/spec.xfpt
@@ -16066,6 +16066,9 @@ use OpenSSL with a directory.
See &<<SECTtlssni>>& for discussion of when this option might be re-expanded.
+A forced expansion failure or setting to an empty string is equivalent to
+being unset.
+
.option tls_verify_hosts main "host list&!!" unset
.cindex "TLS" "client certificate verification"
diff --git a/doc/doc-txt/ChangeLog b/doc/doc-txt/ChangeLog
index c8155aa..a2e204d 100644
--- a/doc/doc-txt/ChangeLog
+++ b/doc/doc-txt/ChangeLog
@@ -175,6 +175,12 @@ PP/17 Update configure.default to handle IPv6 localhost better.
Patch by Alain Williams (plus minor tweaks).
Bugzilla 880.
+PP/18 OpenSSL made graceful with empty tls_verify_certificates setting.
+ This is now consistent with GnuTLS, and is now documented: the
+ previous undocumented portable approach to treating the option as
+ unset was to force an expansion failure. That still works, and
+ an empty string is now equivalent.
+
Exim version 4.80.1
-------------------
diff --git a/src/src/tls-openssl.c b/src/src/tls-openssl.c
index d879f08..42afd39 100644
--- a/src/src/tls-openssl.c
+++ b/src/src/tls-openssl.c
@@ -1008,7 +1008,7 @@ uschar *expcerts, *expcrl;
if (!expand_check(certs, US"tls_verify_certificates", &expcerts))
return DEFER;
-if (expcerts != NULL)
+if (expcerts != NULL && *expcerts != '\0')
{
struct stat statbuf;
if (!SSL_CTX_set_default_verify_paths(sctx))
