rsyslog/rsyslog
1
0
Fork 0
mirror of https://github.com/rsyslog/rsyslog.git synced 2025-12-18 14:30:41 +01:00
Code Issues Packages Projects Releases Wiki Activity

Changed default for permitExpiredCerts to "off"

Browse Source 
This is to be conssitent with rsyslog's prior behavior where
expired certs were automatically rejected
This commit is contained in:
Jiri Vymazal 2019-12-11 15:35:26 +01:00
parent 7e1b40427b
commit 0de93c9e15
2 changed files with 9 additions and 9 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

10
runtime/nsd_gtls.c
View File

@ -1461,16 +1461,16 @@ SetPermitExpiredCerts(nsd_t *pNsd, uchar *mode)
nsd_gtls_t *pThis = (nsd_gtls_t*) pNsd;
ISOBJ_TYPE_assert((pThis), nsd_gtls);
/* default is set to warn! */
if(mode == NULL || !strcasecmp((char*)mode, "warn")) {
pThis->permitExpiredCerts = GTLS_EXPIRED_WARN;
} else if(!strcasecmp((char*) mode, "off")) {
/* default is set to off! */
if(mode == NULL || !strcasecmp((char*)mode, "off")) {
pThis->permitExpiredCerts = GTLS_EXPIRED_DENY;
} else if(!strcasecmp((char*) mode, "warn")) {
pThis->permitExpiredCerts = GTLS_EXPIRED_WARN;
} else if(!strcasecmp((char*) mode, "on")) {
pThis->permitExpiredCerts = GTLS_EXPIRED_PERMIT;
} else {
LogError(0, RS_RET_VALUE_NOT_SUPPORTED, "error: permitexpiredcerts mode '%s' not supported by "
"ossl netstream driver", mode);
"gtls netstream driver", mode);
ABORT_FINALIZE(RS_RET_VALUE_NOT_SUPPORTED);
}

8
runtime/nsd_ossl.c
View File

@ -1130,11 +1130,11 @@ SetPermitExpiredCerts(nsd_t *pNsd, uchar *mode)
nsd_ossl_t *pThis = (nsd_ossl_t*) pNsd;
ISOBJ_TYPE_assert((pThis), nsd_ossl);
/* default is set to warn! */
if(mode == NULL || !strcasecmp((char*)mode, "warn")) {
pThis->permitExpiredCerts = OSSL_EXPIRED_WARN;
} else if(!strcasecmp((char*) mode, "off")) {
/* default is set to off! */
if(mode == NULL || !strcasecmp((char*)mode, "off")) {
pThis->permitExpiredCerts = OSSL_EXPIRED_DENY;
} else if(!strcasecmp((char*) mode, "warn")) {
pThis->permitExpiredCerts = OSSL_EXPIRED_WARN;
} else if(!strcasecmp((char*) mode, "on")) {
pThis->permitExpiredCerts = OSSL_EXPIRED_PERMIT;
} else {