S2S-TLS/OpenSSL: Set the verification flags only once

[ngircd-alex.git] / src / ngircd / conn-ssl.c

diff --git a/src/ngircd/conn-ssl.c b/src/ngircd/conn-ssl.c
index dcd21defe4b57aece797198d9f7360ff5b5bca50..a51f46b2b48d3b762b8fac5e41cb6d19ec17e757 100644 (file)
--- a/src/ngircd/conn-ssl.c
+++ b/src/ngircd/conn-ssl.c
@@ -401,8 +401,6 @@ ConnSSL_InitLibrary( void )
                            SSL_OP_NO_SSLv3 | SSL_OP_NO_TLSv1 | SSL_OP_NO_TLSv1_1 |
                            SSL_OP_NO_COMPRESSION);
        SSL_CTX_set_mode(newctx, SSL_MODE_ENABLE_PARTIAL_WRITE);
-       SSL_CTX_set_verify(newctx, SSL_VERIFY_PEER|SSL_VERIFY_CLIENT_ONCE,
-                          Verify_openssl);
        SSL_CTX_free(ssl_ctx);
        ssl_ctx = newctx;
        Log(LOG_INFO, "%s initialized.", OpenSSL_version(OPENSSL_VERSION));
@@ -615,7 +613,6 @@ ConnSSL_SetVerifyProperties_openssl(SSL_CTX * ctx)
 {
        X509_STORE *store = NULL;
        X509_LOOKUP *lookup;
-       int verify_flags = SSL_VERIFY_PEER;
        bool ret = false;
 
        if (!Conf_SSLOptions.CAFile)
@@ -649,7 +646,8 @@ ConnSSL_SetVerifyProperties_openssl(SSL_CTX * ctx)
                }
        }
 
-       SSL_CTX_set_verify(ctx, verify_flags, Verify_openssl);
+       SSL_CTX_set_verify(ctx, SSL_VERIFY_PEER|SSL_VERIFY_CLIENT_ONCE,
+                          Verify_openssl);
        SSL_CTX_set_verify_depth(ctx, MAX_CERT_CHAIN_LENGTH);
        ret = true;
 out:
@@ -748,25 +746,27 @@ ConnSSL_PrepareConnect(CONNECTION * c, CONF_SERVER * s)
        if (!ret)
                return false;
        Conn_OPTION_ADD(c, CONN_SSL_CONNECT);
+
 #ifdef HAVE_LIBSSL
        assert(c->ssl_state.ssl);
-       if (s->SSLVerify) {
-               X509_VERIFY_PARAM *param = NULL;
-               param = SSL_get0_param(c->ssl_state.ssl);
-               X509_VERIFY_PARAM_set_hostflags(param,
-                                               X509_CHECK_FLAG_NO_PARTIAL_WILDCARDS);
-               int err = X509_VERIFY_PARAM_set1_host(param, s->host, 0);
-               if (err != 1) {
-                       Log(LOG_ERR,
-                           "Cannot set up hostname verification for '%s': %u",
-                           s->host, err);
-                       return false;
-               }
+
+       X509_VERIFY_PARAM *param = SSL_get0_param(c->ssl_state.ssl);
+       X509_VERIFY_PARAM_set_hostflags(param, X509_CHECK_FLAG_NO_PARTIAL_WILDCARDS);
+       int err = X509_VERIFY_PARAM_set1_host(param, s->host, 0);
+       if (err != 1) {
+               Log(LOG_ERR,
+                   "Cannot set up hostname verification for '%s': %u",
+                   s->host, err);
+               return false;
+       }
+
+       if (s->SSLVerify)
                SSL_set_verify(c->ssl_state.ssl, SSL_VERIFY_PEER,
                               Verify_openssl);
-       } else
+       else
                SSL_set_verify(c->ssl_state.ssl, SSL_VERIFY_NONE, NULL);
 #endif
+
        return true;
 }