From 0f284e2c754cafdb7d9eda5bc256adacc91a0c58 Mon Sep 17 00:00:00 2001 From: Jari Matilainen Date: Tue, 7 Jul 2020 14:29:05 +0200 Subject: [PATCH] Keep cafile/capath, allow explicit disabling of tls_verify --- src/fe-common/core/fe-server.c | 19 +++++++------------ 1 file changed, 7 insertions(+), 12 deletions(-) diff --git a/src/fe-common/core/fe-server.c b/src/fe-common/core/fe-server.c index f07d3bbe..48acbe15 100644 --- a/src/fe-common/core/fe-server.c +++ b/src/fe-common/core/fe-server.c @@ -172,11 +172,6 @@ static void cmd_server_add_modify(const char *data, gboolean add) rec->use_tls = FALSE; /* tls_verify implies use_tls, disable it explicitly */ rec->tls_verify = FALSE; - /* explicitly null tls_cafile and tls_capath if we don't use tls */ - if (rec->tls_cafile != NULL) - g_free_and_null(rec->tls_cafile); - if (rec->tls_capath != NULL) - g_free_and_null(rec->tls_capath); } value = g_hash_table_lookup(optlist, "tls_cert"); @@ -197,11 +192,6 @@ static void cmd_server_add_modify(const char *data, gboolean add) if (value != NULL && *value != '\0') rec->tls_pass = g_strdup(value); - if (g_hash_table_lookup(optlist, "tls_verify") || g_hash_table_lookup(optlist, "ssl_verify")) - rec->tls_verify = TRUE; - else if (g_hash_table_lookup(optlist, "notls_verify") || g_hash_table_lookup(optlist, "nossl_verify")) - rec->tls_verify = FALSE; - value = g_hash_table_lookup(optlist, "tls_cafile"); if (value == NULL) value = g_hash_table_lookup(optlist, "ssl_cafile"); @@ -232,10 +222,15 @@ static void cmd_server_add_modify(const char *data, gboolean add) if (value != NULL && *value != '\0') rec->tls_pinned_pubkey = g_strdup(value); - if ((rec->tls_cafile != NULL && rec->tls_cafile[0] != '\0') - || (rec->tls_capath != NULL && rec->tls_capath[0] != '\0')) + if (rec->use_tls && ((rec->tls_cafile != NULL && rec->tls_cafile[0] != '\0') + || (rec->tls_capath != NULL && rec->tls_capath[0] != '\0'))) rec->tls_verify = TRUE; + if (g_hash_table_lookup(optlist, "tls_verify") || g_hash_table_lookup(optlist, "ssl_verify")) + rec->tls_verify = TRUE; + else if (g_hash_table_lookup(optlist, "notls_verify") || g_hash_table_lookup(optlist, "nossl_verify")) + rec->tls_verify = FALSE; + if ((rec->tls_cert != NULL && rec->tls_cert[0] != '\0') || rec->tls_verify == TRUE) rec->use_tls = TRUE;