TLS: fix startup after forced-fail

Broken-by: cf0c61644d7d, ce93c6d840d5, 520ef00f56ce

diff --git a/doc/doc-txt/ChangeLog b/doc/doc-txt/ChangeLog
index 40e8a9e7e6099d28615532ff9efa1f37c6bd6a04..14cd45d85d9af943e64f13f1de8442028593ac1d 100644 (file)
--- a/doc/doc-txt/ChangeLog
+++ b/doc/doc-txt/ChangeLog
@@ -86,6 +86,13 @@ JH/17 Bug 3064: Fix combination of "-q<period> -R <recipients>". Introduction of
 JH/18 Bug 3068: Log a warning for use of deprecated syntax in query-style
       lookups.
 
+JH/19 Fix TLS startup. When the last expansion done before the initiation of a
+      TLS session resulted in a forced-fail, a misleading error was logged for
+      the expansino of tls_certificates.  This would affect the common case of
+      that option being set (main-section options) but not having any vriable
+      parts.  It could also potentially affect tls_privatekeys.  The underlyding
+      coding errors go back to 4.90 but were only exposed in 4.97.
+
 
 Exim version 4.97
 -----------------

diff --git a/src/src/expand.c b/src/src/expand.c
index 9a88d38cab05c51ef3fa6120d84370ac93f9188c..f9813133d1d2091f9e2c90fbe5e862d07ae27f2a 100644 (file)
--- a/src/src/expand.c
+++ b/src/src/expand.c
@@ -8558,13 +8558,12 @@ Returns:  the expanded string, or NULL if expansion failed; if failure was
 const uschar *
 expand_string_2(const uschar * string, BOOL * textonly_p)
 {
+f.expand_string_forcedfail = f.search_find_defer = malformed_header = FALSE;
 if (Ustrpbrk(string, "$\\") != NULL)
   {
   int old_pool = store_pool;
   uschar * s;
 
-  f.search_find_defer = FALSE;
-  malformed_header = FALSE;
   store_pool = POOL_MAIN;
     s = expand_string_internal(string, ESI_HONOR_DOLLAR, NULL, NULL, textonly_p);
   store_pool = old_pool;

diff --git a/src/src/tls.c b/src/src/tls.c
index b6c5d70e123009e08e0abdac05556b98fb30cb82..e6203b7688afe70a842e2ae87cdfb545ea5c4850 100644 (file)
--- a/src/src/tls.c
+++ b/src/src/tls.c
@@ -105,7 +105,10 @@ expand_check(const uschar * s, const uschar * name,
   uschar ** result, uschar ** errstr)
 {
 if (!s)
+  {
+  f.expand_string_forcedfail = FALSE;
   *result = NULL;
+  }
 else if (  !(*result = expand_string(US s)) /* need to clean up const more */
        && !f.expand_string_forcedfail
        )