Make "system" location for certificate CA bundle the default

diff --git a/doc/doc-docbook/spec.xfpt b/doc/doc-docbook/spec.xfpt
index dc7e4f75c8470872b6426816071634e4bf61a843..7dfc4d623c11157d551fe01f3631fd49675291e7 100644 (file)
--- a/doc/doc-docbook/spec.xfpt
+++ b/doc/doc-docbook/spec.xfpt
@@ -16478,7 +16478,7 @@ preference order of the available ciphers. Details are given in sections
 See &%tls_verify_hosts%& below.
 
 
 See &%tls_verify_hosts%& below.
 
 

-.option tls_verify_certificates main string&!! unset
+.option tls_verify_certificates main string&!! system

 .cindex "TLS" "client certificate verification"
 .cindex "certificate" "verification of client"
 The value of this option is expanded, and must then be either the
 .cindex "TLS" "client certificate verification"
 .cindex "certificate" "verification of client"
 The value of this option is expanded, and must then be either the


@@ -16489,7 +16489,8 @@ match &%tls_verify_hosts%& or &%tls_try_verify_hosts%&.
 
 The "system" value for the option will use a
 system default location compiled into the SSL library.
 
 The "system" value for the option will use a
 system default location compiled into the SSL library.

-This is not available for GnuTLS versions preceding 3.0.20 and an explicit location
+This is not available for GnuTLS versions preceding 3.0.20,
+and will be taken as empty; an explicit location

 must be specified.
 
 The use of a directory for the option value is not avilable for GnuTLS versions
 must be specified.
 
 The use of a directory for the option value is not avilable for GnuTLS versions


@@ -23458,7 +23459,7 @@ limited to being the initial component of a 3-or-more component FQDN.
 There is no equivalent checking on client certificates.
 
 
 There is no equivalent checking on client certificates.
 
 

-.option tls_verify_certificates smtp string&!! unset
+.option tls_verify_certificates smtp string&!! system

 .cindex "TLS" "server certificate verification"
 .cindex "certificate" "verification of server"
 .vindex "&$host$&"
 .cindex "TLS" "server certificate verification"
 .cindex "certificate" "verification of server"
 .vindex "&$host$&"


@@ -23470,7 +23471,8 @@ a file or directory containing permitted certificates for servers,
 for use when setting up an encrypted connection.
 
 The "system" value for the option will use a location compiled into the SSL library.
 for use when setting up an encrypted connection.
 
 The "system" value for the option will use a location compiled into the SSL library.

-This is not available for GnuTLS versions preceding 3.0.20 and an explicit location
+This is not available for GnuTLS versions preceding 3.0.20; a value of "system"
+is taken as empty and an explicit location

 must be specified.
 
 The use of a directory for the option value is not avilable for GnuTLS versions
 must be specified.
 
 The use of a directory for the option value is not avilable for GnuTLS versions


@@ -26479,7 +26481,7 @@ if it requests it. If the server is Exim, it will request a certificate only if
 &%tls_verify_hosts%& or &%tls_try_verify_hosts%& matches the client.
 
 If the &%tls_verify_certificates%& option is set on the &(smtp)& transport, it
 &%tls_verify_hosts%& or &%tls_try_verify_hosts%& matches the client.
 
 If the &%tls_verify_certificates%& option is set on the &(smtp)& transport, it

-specified a collection of expected server certificates.
+specifies a collection of expected server certificates.

 These may be the system default set (depeding on library version),
 a file or,
 depnding on liibrary version, a directory,
 These may be the system default set (depeding on library version),
 a file or,
 depnding on liibrary version, a directory,

diff --git a/doc/doc-txt/ChangeLog b/doc/doc-txt/ChangeLog
index f2954b9455d21cb247fc55cca4a4c9e25cb79f77..76d18a87c2af2589915716948faa5ed97a135fb5 100644 (file)
--- a/doc/doc-txt/ChangeLog
+++ b/doc/doc-txt/ChangeLog
@@ -18,7 +18,7 @@ JH/04 Certificate name checking on server certificates, when exim is a client,
       EXPERIMENTAL_CERTNAMES is withdrawn.
 
 JH/05 The value of the tls_verify_certificates smtp transport and main options
       EXPERIMENTAL_CERTNAMES is withdrawn.
 
 JH/05 The value of the tls_verify_certificates smtp transport and main options

-      can now be the word "system" to access the system default CA bundle.
+      default to the word "system" to access the system default CA bundle.

       For GnuTLS, only version 3.0.20 or later.
 
 
       For GnuTLS, only version 3.0.20 or later.
 
 

diff --git a/src/src/globals.c b/src/src/globals.c
index a7beec602370f78c1ac6ffd1e6b53c072d58f1fd..1b09008a141034d61e763ecacc9a7cf0fe60c295 100644 (file)
--- a/src/src/globals.c
+++ b/src/src/globals.c
@@ -166,7 +166,7 @@ uschar *tls_privatekey         = NULL;
 BOOL    tls_remember_esmtp     = FALSE;
 uschar *tls_require_ciphers    = NULL;
 uschar *tls_try_verify_hosts   = NULL;
 BOOL    tls_remember_esmtp     = FALSE;
 uschar *tls_require_ciphers    = NULL;
 uschar *tls_try_verify_hosts   = NULL;

-uschar *tls_verify_certificates= NULL;
+uschar *tls_verify_certificates= US"system";

 uschar *tls_verify_hosts       = NULL;
 #endif
 
 uschar *tls_verify_hosts       = NULL;
 #endif
 

diff --git a/src/src/tls-gnu.c b/src/src/tls-gnu.c
index 4943f48b7d2e3318bb46c683d32c44e65b629185..42d04224a4646ba1908d5c3f6987b269de2bc131 100644 (file)
--- a/src/src/tls-gnu.c
+++ b/src/src/tls-gnu.c
@@ -853,7 +853,11 @@ error message is provided. However, if we just refrain from setting anything up
 in that case, certificate verification fails, which seems to be the correct
 behaviour. */
 
 in that case, certificate verification fails, which seems to be the correct
 behaviour. */
 

-if (state->tls_verify_certificates && *state->tls_verify_certificates)
+if (  state->tls_verify_certificates && *state->tls_verify_certificates
+#ifndef SUPPORT_SYSDEFAULT_CABUNDLE
+   && Ustrcmp(state->exp_tls_verify_certificates, "system") != 0
+#endif
+   )

   {
   if (!expand_check_tlsvar(tls_verify_certificates))
     return DEFER;
   {
   if (!expand_check_tlsvar(tls_verify_certificates))
     return DEFER;

diff --git a/src/src/transports/smtp.c b/src/src/transports/smtp.c
index f57ee69d033cf338b85dcaca29c3448080cc5bfa..a455ba5532afcf1298ac3df6be3bd9741de12d5f 100644 (file)
--- a/src/src/transports/smtp.c
+++ b/src/src/transports/smtp.c
@@ -255,7 +255,7 @@ smtp_transport_options_block smtp_transport_option_defaults = {
   NULL,                /* gnutls_require_mac */
   NULL,                /* gnutls_require_proto */
   NULL,                /* tls_sni */
   NULL,                /* gnutls_require_mac */
   NULL,                /* gnutls_require_proto */
   NULL,                /* tls_sni */

-  NULL,                /* tls_verify_certificates */
+  US"system",          /* tls_verify_certificates */

   EXIM_CLIENT_DH_DEFAULT_MIN_BITS,
                        /* tls_dh_min_bits */
   TRUE,                /* tls_tempfail_tryclear */
   EXIM_CLIENT_DH_DEFAULT_MIN_BITS,
                        /* tls_dh_min_bits */
   TRUE,                /* tls_tempfail_tryclear */