From: Kevin McCarthy <kevin@8t8.us>
Date: Wed, 8 Mar 2017 02:26:06 +0000 (-0800)
Subject: Move the OpenSSL partial chain support check inside configure.ac. (see #3916)
X-Git-Tag: mutt-1-9-rel~147
X-Git-Url: https://granicus.if.org/sourcecode?a=commitdiff_plain;h=a51d6478d2c3b2dcdd19031a6f01a19ea14fe8df;p=mutt

Move the OpenSSL partial chain support check inside configure.ac. (see #3916)

Instead of directly checking whether X509_V_FLAG_PARTIAL_CHAIN is
defined everywhere, do it once inside configure.  This will allow
better support in the future if the test needs to change.
---

diff --git a/configure.ac b/configure.ac
index 8905b723..4f41632a 100644
--- a/configure.ac
+++ b/configure.ac
@@ -710,6 +710,11 @@ AC_ARG_WITH(ssl, AS_HELP_STRING([--with-ssl@<:@=PFX@:>@],[Enable TLS support usi
             AC_CHECK_DECLS([SSL_set_mode, SSL_MODE_AUTO_RETRY],,
               AC_MSG_ERROR([Unable to find decent SSL header]), [[#include <openssl/ssl.h>]])
 
+            AC_CHECK_DECL([X509_V_FLAG_PARTIAL_CHAIN],
+              AC_DEFINE(HAVE_SSL_PARTIAL_CHAIN,1,[ Define if OpenSSL supports partial chains. ]),
+              ,
+              [[#include <openssl/x509_vfy.h>]])
+
             AC_DEFINE(USE_SSL,1,[ Define if you want support for SSL. ])
             AC_DEFINE(USE_SSL_OPENSSL,1,[ Define if you want support for SSL via OpenSSL. ])
             LIBS="$saved_LIBS"
diff --git a/doc/makedoc-defs.h b/doc/makedoc-defs.h
index dddae75f..2da29f48 100644
--- a/doc/makedoc-defs.h
+++ b/doc/makedoc-defs.h
@@ -19,8 +19,8 @@
 # ifndef USE_SSL_OPENSSL
 #  define USE_SSL_OPENSSL
 # endif
-# ifndef X509_V_FLAG_PARTIAL_CHAIN
-#  define X509_V_FLAG_PARTIAL_CHAIN
+# ifndef HAVE_SSL_PARTIAL_CHAIN
+#  define HAVE_SSL_PARTIAL_CHAIN
 # endif
 # ifndef USE_SSL_GNUTLS
 #  define USE_SSL_GNUTLS
diff --git a/init.h b/init.h
index a03e4960..e7742d67 100644
--- a/init.h
+++ b/init.h
@@ -78,11 +78,6 @@ struct option_t
 };
 
 #define UL (unsigned long)
-
-#ifdef USE_SSL_OPENSSL
-/* need to check X509_V_FLAG_PARTIAL_CHAIN later */
-# include <openssl/x509_vfy.h>
-#endif
 #endif /* _MAKEDOC */
 
 #ifndef ISPELL
@@ -3382,7 +3377,7 @@ struct option_t MuttVars[] = {
   ** the \fC$<account-hook>\fP function.
   */
 # ifdef USE_SSL_OPENSSL
-#  ifdef X509_V_FLAG_PARTIAL_CHAIN
+#  ifdef HAVE_SSL_PARTIAL_CHAIN
   { "ssl_verify_partial_chains", DT_BOOL, R_NONE, OPTSSLVERIFYPARTIAL, 0 },
   /*
   ** .pp
@@ -3397,7 +3392,7 @@ struct option_t MuttVars[] = {
   ** .pp
   ** (OpenSSL 1.0.2b and newer only).
   */
-#  endif /* defined X509_V_FLAG_PARTIAL_CHAIN */
+#  endif /* defined HAVE_SSL_PARTIAL_CHAIN */
 # endif /* defined USE_SSL_OPENSSL */
   { "ssl_ciphers", DT_STR, R_NONE, UL &SslCiphers, UL 0 },
   /*
diff --git a/mutt.h b/mutt.h
index c73b1dd4..3f7166ba 100644
--- a/mutt.h
+++ b/mutt.h
@@ -396,7 +396,7 @@ enum
   OPTSSLFORCETLS,
   OPTSSLVERIFYDATES,
   OPTSSLVERIFYHOST,
-# ifdef USE_SSL_OPENSSL
+# if defined(USE_SSL_OPENSSL) && defined(HAVE_SSL_PARTIAL_CHAIN)
   OPTSSLVERIFYPARTIAL,
 # endif /* USE_SSL_OPENSSL */
 #endif /* defined(USE_SSL) */
diff --git a/mutt_ssl.c b/mutt_ssl.c
index 71aa51bf..82a23767 100644
--- a/mutt_ssl.c
+++ b/mutt_ssl.c
@@ -146,7 +146,7 @@ static int ssl_load_certificates (SSL_CTX *ctx)
 static int ssl_set_verify_partial (SSL_CTX *ctx)
 {
   int rv = 0;
-#ifdef X509_V_FLAG_PARTIAL_CHAIN
+#ifdef HAVE_SSL_PARTIAL_CHAIN
   X509_VERIFY_PARAM *param;
 
   if (option (OPTSSLVERIFYPARTIAL))
@@ -1148,7 +1148,7 @@ static int interactive_check_cert (X509 *cert, int idx, int len, SSL *ssl)
   menu->title = title;
 
   /* The leaf/host certificate can't be skipped. */
-#ifdef X509_V_FLAG_PARTIAL_CHAIN
+#ifdef HAVE_SSL_PARTIAL_CHAIN
   if ((idx != 0) &&
       (option (OPTSSLVERIFYPARTIAL)))
     allow_skip = 1;