S2S-TLS/OpenSSL: Set the verification flags only once

[ngircd-alex.git] / src / ngircd / conf.c

diff --git a/src/ngircd/conf.c b/src/ngircd/conf.c
index eaa5e932494a0697e9b7bcfe9ca713f09153a85e..86a622475c7d0a54dee7ac5b99be9d087271085c 100644 (file)
--- a/src/ngircd/conf.c
+++ b/src/ngircd/conf.c
@@ -113,6 +113,12 @@ ConfSSL_Init(void)
        free(Conf_SSLOptions.CertFile);
        Conf_SSLOptions.CertFile = NULL;
 
+       free(Conf_SSLOptions.CAFile);
+       Conf_SSLOptions.CAFile = NULL;
+
+       free(Conf_SSLOptions.CRLFile);
+       Conf_SSLOptions.CRLFile = NULL;
+
        free(Conf_SSLOptions.DHFile);
        Conf_SSLOptions.DHFile = NULL;
        array_free_wipe(&Conf_SSLOptions.KeyFilePassword);
@@ -436,10 +442,14 @@ Conf_Test( void )
 
 #ifdef SSL_SUPPORT
        puts("[SSL]");
+       printf("  CAFile = %s\n", Conf_SSLOptions.CAFile
+                                       ? Conf_SSLOptions.CAFile : "");
        printf("  CertFile = %s\n", Conf_SSLOptions.CertFile
                                        ? Conf_SSLOptions.CertFile : "");
        printf("  CipherList = %s\n", Conf_SSLOptions.CipherList ?
               Conf_SSLOptions.CipherList : DEFAULT_CIPHERS);
+       printf("  CRLFile = %s\n", Conf_SSLOptions.CRLFile
+                                       ? Conf_SSLOptions.CRLFile : "");
        printf("  DHFile = %s\n", Conf_SSLOptions.DHFile
                                        ? Conf_SSLOptions.DHFile : "");
        printf("  KeyFile = %s\n", Conf_SSLOptions.KeyFile
@@ -465,7 +475,10 @@ Conf_Test( void )
                printf( "  Host = %s\n", Conf_Server[i].host );
                printf( "  Port = %u\n", (unsigned int)Conf_Server[i].port );
 #ifdef SSL_SUPPORT
-               printf( "  SSLConnect = %s\n", yesno_to_str(Conf_Server[i].SSLConnect));
+               printf("  SSLConnect = %s\n",
+                      yesno_to_str(Conf_Server[i].SSLConnect));
+               printf("  SSLVerify = %s\n",
+                      yesno_to_str(Conf_Server[i].SSLVerify));
 #endif
                printf( "  MyPassword = %s\n", Conf_Server[i].pwd_in );
                printf( "  PeerPassword = %s\n", Conf_Server[i].pwd_out );
@@ -942,8 +955,7 @@ Read_Config(bool TestOnly, bool IsStarting)
 
        if (TestOnly && fd)
                Config_Error(LOG_INFO,
-                            "Reading configuration from \"%s\" ...",
-                            NGIRCd_ConfFile );
+                            "Reading configuration from \"%s\" ...", ptr);
 
        /* Clean up server configuration structure: mark all already
         * configured servers as "once" so that they are deleted
@@ -981,7 +993,7 @@ Read_Config(bool TestOnly, bool IsStarting)
 #endif
 
        if (fd) {
-               Read_Config_File(NGIRCd_ConfFile, fd);
+               Read_Config_File(ptr, fd);
                fclose(fd);
        }
 
@@ -1798,6 +1810,16 @@ Handle_SSL(const char *File, int Line, char *Var, char *Arg)
                Conf_SSLOptions.CipherList = strdup_warn(Arg);
                return;
        }
+       if (strcasecmp(Var, "CAFile") == 0) {
+               assert(Conf_SSLOptions.CAFile == NULL);
+               Conf_SSLOptions.CAFile = strdup_warn(Arg);
+               return;
+       }
+       if (strcasecmp(Var, "CRLFile") == 0) {
+               assert(Conf_SSLOptions.CRLFile == NULL);
+               Conf_SSLOptions.CRLFile = strdup_warn(Arg);
+               return;
+       }
 
        Config_Error_Section(File, Line, Var, "SSL");
 }
@@ -1928,7 +1950,11 @@ Handle_SERVER(const char *File, int Line, char *Var, char *Arg )
        if( strcasecmp( Var, "SSLConnect" ) == 0 ) {
                New_Server.SSLConnect = Check_ArgIsTrue(Arg);
                return;
-        }
+       }
+       if (strcasecmp(Var, "SSLVerify") == 0) {
+               New_Server.SSLVerify = Check_ArgIsTrue(Arg);
+               return;
+       }
 #endif
        if( strcasecmp( Var, "Group" ) == 0 ) {
                /* Server group */
@@ -2129,8 +2155,7 @@ Validate_Config(bool Configtest, bool Rehash)
        if (!Conf_ServerName[0] || !strchr(Conf_ServerName, '.')) {
                config_valid = false;
                Config_Error(LOG_ALERT,
-                            "No (valid) server name configured in \"%s\" (section 'Global': 'Name')!",
-                            NGIRCd_ConfFile);
+                            "No (valid) server name configured (section 'Global': 'Name')!");
                if (!Configtest && !Rehash) {
                        Config_Error(LOG_ALERT,
                                     "%s exiting due to fatal errors!",
@@ -2144,8 +2169,7 @@ Validate_Config(bool Configtest, bool Rehash)
                /* No administrative contact configured! */
                config_valid = false;
                Config_Error(LOG_ALERT,
-                            "No administrator email address configured in \"%s\" ('AdminEMail')!",
-                            NGIRCd_ConfFile);
+                            "No administrator email address configured ('AdminEMail')!");
                if (!Configtest) {
                        Config_Error(LOG_ALERT,
                                     "%s exiting due to fatal errors!",