Dnssec observability: add variable $lookup_dnssec_authenticated

[exim.git] / src / src / tls-gnu.c

diff --git a/src/src/tls-gnu.c b/src/src/tls-gnu.c
index 5600d6bb8e4c2aa3db52f8546432cb64ec7a4f5f..cbd44d6f2faa68afce009740b8632edf4422b58d 100644 (file)
--- a/src/src/tls-gnu.c
+++ b/src/src/tls-gnu.c
@@ -2,7 +2,7 @@
 *     Exim - an Internet mail transport agent    *
 *************************************************/
 
-/* Copyright (c) University of Cambridge 1995 - 2013 */
+/* Copyright (c) University of Cambridge 1995 - 2014 */
 /* See the file NOTICE for conditions of use and distribution. */
 
 /* Copyright (c) Phil Pennock 2012 */
@@ -1228,25 +1228,23 @@ unsigned int verify;
 
 *error = NULL;
 
-rc = peer_status(state);
-if (rc != OK)
+if ((rc = peer_status(state)) != OK)
   {
   verify = GNUTLS_CERT_INVALID;
-  *error = "not supplied";
+  *error = "certificate not supplied";
   }
 else
-  {
   rc = gnutls_certificate_verify_peers2(state->session, &verify);
-  }
 
 /* Handle the result of verification. INVALID seems to be set as well
 as REVOKED, but leave the test for both. */
 
-if ((rc < 0) || (verify & (GNUTLS_CERT_INVALID|GNUTLS_CERT_REVOKED)) != 0)
+if (rc < 0 || verify & (GNUTLS_CERT_INVALID|GNUTLS_CERT_REVOKED))
   {
   state->peer_cert_verified = FALSE;
-  if (*error == NULL)
-    *error = ((verify & GNUTLS_CERT_REVOKED) != 0) ? "revoked" : "invalid";
+  if (!*error)
+    *error = verify & GNUTLS_CERT_REVOKED
+      ? "certificate revoked" : "certificate invalid";
 
   DEBUG(D_tls)
     debug_printf("TLS certificate verification failed (%s): peerdn=%s\n",