TLS: restore TLS protocol version to default Received: header

[exim.git] / src / src / tls.c

diff --git a/src/src/tls.c b/src/src/tls.c
index 796bc6d61649c482fa7846d8831a36a27311f31d..a541a3c7a3210546aae49bc79435adb0e0623864 100644 (file)
--- a/src/src/tls.c
+++ b/src/src/tls.c
@@ -369,6 +369,40 @@ else if ((subjdn = tls_cert_subject(cert, NULL)))
   }
 return FALSE;
 }
+
+
+/* Environment cleanup: The GnuTLS library uses SSLKEYLOGFILE in the environment
+and writes a file by that name.  Our OpenSSL code does the same, using keying
+info from the library API.
+The GnuTLS support only works if exim is run by root, not taking advantage of
+the setuid bit.
+You can use either the external environment (modulo the keep_environment config)
+or the add_environment config option for SSLKEYLOGFILE; the latter takes
+precedence.
+
+If the path is absolute, require it starts with the spooldir; otherwise delete
+the env variable.  If relative, prefix the spooldir.
+*/
+void
+tls_clean_env(void)
+{
+uschar * path = US getenv("SSLKEYLOGFILE");
+if (path)
+  if (!*path)
+    unsetenv("SSLKEYLOGFILE");
+  else if (*path != '/')
+    {
+    DEBUG(D_tls)
+      debug_printf("prepending spooldir to  env SSLKEYLOGFILE\n");
+    setenv("SSLKEYLOGFILE", CCS string_sprintf("%s/%s", spool_directory, path), 1);
+    }
+  else if (Ustrncmp(path, spool_directory, Ustrlen(spool_directory)) != 0)
+    {
+    DEBUG(D_tls)
+      debug_printf("removing env SSLKEYLOGFILE=%s: not under spooldir\n", path);
+    unsetenv("SSLKEYLOGFILE");
+    }
+}
 #endif /*!DISABLE_TLS*/
 #endif /*!MACRO_PREDEF*/