Remove the support for MAILSTREAM_CFSTREAM_SSL_ALLOWS_EXPIRED_CERTIFI…

…CATES, MAILSTREAM_CFSTREAM_SSL_ALLOWS_EXPIRED_ROOTS, and MAILSTREAM_CFSTREAM_SSL_ALLOWS_ANY_ROOT. The underlying functionality for these (kCFStreamSSLAllowsExpiredCertificates, kCFStreamSSLAllowsExpiredRoots, kCFStreamSSLAllowsAnyRoot) has been deprecated since iOS 4 (!). This means that the only thing that can be done is for the entire certificate validation to be disabled, using kCFStreamSSLValidatesCertificateChain via MAILSTREAM_CFSTREAM_SSL_DISABLE_VALIDATES_CERTIFICATE_CHAIN.
tipbit · Oct 25, 2015 · eca926b · eca926b
1 parent 32a61d5
commit eca926b
Show file tree

Hide file tree

Showing 7 changed files with 6 additions and 22 deletions.
diff --git a/src/data-types/mailstream_cfstream.c b/src/data-types/mailstream_cfstream.c
@@ -963,15 +963,6 @@ int mailstream_cfstream_set_ssl_enabled(mailstream * s, int ssl_enabled)
         break;
     }
 
-    if ((cfstream_data->ssl_certificate_verification_mask & MAILSTREAM_CFSTREAM_SSL_ALLOWS_EXPIRED_CERTIFICATES) != 0) {
-      CFDictionarySetValue(settings, kCFStreamSSLAllowsExpiredCertificates, kCFBooleanTrue);
-    }
-    if ((cfstream_data->ssl_certificate_verification_mask & MAILSTREAM_CFSTREAM_SSL_ALLOWS_EXPIRED_ROOTS) != 0) {
-      CFDictionarySetValue(settings, kCFStreamSSLAllowsExpiredRoots, kCFBooleanTrue);
-    }
-    if ((cfstream_data->ssl_certificate_verification_mask & MAILSTREAM_CFSTREAM_SSL_ALLOWS_ANY_ROOT) != 0) {
-      CFDictionarySetValue(settings, kCFStreamSSLAllowsAnyRoot, kCFBooleanTrue);
-    }
     if ((cfstream_data->ssl_certificate_verification_mask & MAILSTREAM_CFSTREAM_SSL_DISABLE_VALIDATES_CERTIFICATE_CHAIN) != 0) {
       CFDictionarySetValue(settings, kCFStreamSSLValidatesCertificateChain, kCFBooleanFalse);
     }

diff --git a/src/data-types/mailstream_cfstream.h b/src/data-types/mailstream_cfstream.h
@@ -43,14 +43,7 @@ extern "C" {
   extern int mailstream_cfstream_voip_enabled;
 
   enum {
-    MAILSTREAM_CFSTREAM_SSL_ALLOWS_EXPIRED_CERTIFICATES = 1 << 0,
-    MAILSTREAM_CFSTREAM_SSL_ALLOWS_EXPIRED_ROOTS = 1 << 1,
-    MAILSTREAM_CFSTREAM_SSL_ALLOWS_ANY_ROOT = 1 << 2,
-    MAILSTREAM_CFSTREAM_SSL_DISABLE_VALIDATES_CERTIFICATE_CHAIN = 1 << 3,
-    MAILSTREAM_CFSTREAM_SSL_NO_VERIFICATION = MAILSTREAM_CFSTREAM_SSL_ALLOWS_EXPIRED_CERTIFICATES | 
-       MAILSTREAM_CFSTREAM_SSL_ALLOWS_EXPIRED_ROOTS |
-       MAILSTREAM_CFSTREAM_SSL_ALLOWS_ANY_ROOT |
-       MAILSTREAM_CFSTREAM_SSL_DISABLE_VALIDATES_CERTIFICATE_CHAIN
+    MAILSTREAM_CFSTREAM_SSL_DISABLE_VALIDATES_CERTIFICATE_CHAIN = 1 << 0,
   };
 
   enum {

diff --git a/src/driver/interface/mailstorage_tools.c b/src/driver/interface/mailstorage_tools.c
@@ -281,7 +281,7 @@ int mailstorage_generic_connect_with_local_address(mailsession_driver * driver,
     if (mailstream_cfstream_enabled) {
       int ssl_level = MAILSTREAM_CFSTREAM_SSL_LEVEL_NEGOCIATED_SSL;
       mailstream_cfstream_set_ssl_level(stream, ssl_level);
-      mailstream_cfstream_set_ssl_verification_mask(stream, MAILSTREAM_CFSTREAM_SSL_NO_VERIFICATION);
+      mailstream_cfstream_set_ssl_verification_mask(stream, MAILSTREAM_CFSTREAM_SSL_DISABLE_VALIDATES_CERTIFICATE_CHAIN);
       r = mailstream_cfstream_set_ssl_enabled(stream, 1);
       if (r < 0) {
         mailstream_close(stream);

diff --git a/src/low-level/imap/mailimap_socket.c b/src/low-level/imap/mailimap_socket.c
@@ -172,7 +172,7 @@ static int mailimap_cfsocket_starttls(mailimap * f)
       return r;
   }
 
-  mailstream_cfstream_set_ssl_verification_mask(f->imap_stream, MAILSTREAM_CFSTREAM_SSL_NO_VERIFICATION);
+  mailstream_cfstream_set_ssl_verification_mask(f->imap_stream, MAILSTREAM_CFSTREAM_SSL_DISABLE_VALIDATES_CERTIFICATE_CHAIN);
   r = mailstream_cfstream_set_ssl_enabled(f->imap_stream, 1);
   if (r < 0) {
     return MAILIMAP_ERROR_SSL;

diff --git a/src/low-level/imap/mailimap_ssl.c b/src/low-level/imap/mailimap_ssl.c
@@ -125,7 +125,7 @@ static int mailimap_cfssl_connect_voip_ssl_level(mailimap * f, const char * serv
     return MAILIMAP_ERROR_CONNECTION_REFUSED;
   }
   mailstream_cfstream_set_ssl_level(stream, ssl_level);
-  mailstream_cfstream_set_ssl_verification_mask(stream, MAILSTREAM_CFSTREAM_SSL_NO_VERIFICATION);
+  mailstream_cfstream_set_ssl_verification_mask(stream, MAILSTREAM_CFSTREAM_SSL_DISABLE_VALIDATES_CERTIFICATE_CHAIN);
   r = mailstream_cfstream_set_ssl_enabled(stream, 1);
   if (r < 0) {
     mailstream_close(stream);

diff --git a/src/low-level/smtp/mailsmtp_socket.c b/src/low-level/smtp/mailsmtp_socket.c
@@ -156,7 +156,7 @@ static int mailsmtp_cfsocket_starttls(mailsmtp * session)
   if (r != MAILSMTP_NO_ERROR)
     return r;
 
-  mailstream_cfstream_set_ssl_verification_mask(session->stream, MAILSTREAM_CFSTREAM_SSL_NO_VERIFICATION);
+  mailstream_cfstream_set_ssl_verification_mask(session->stream, MAILSTREAM_CFSTREAM_SSL_DISABLE_VALIDATES_CERTIFICATE_CHAIN);
   r = mailstream_cfstream_set_ssl_enabled(session->stream, 1);
   if (r < 0) {
     return MAILSMTP_ERROR_SSL;

diff --git a/src/low-level/smtp/mailsmtp_ssl.c b/src/low-level/smtp/mailsmtp_ssl.c
@@ -113,7 +113,7 @@ static int mailsmtp_cfssl_connect_ssl_level(mailsmtp * session,
     return MAILSMTP_ERROR_CONNECTION_REFUSED;
   }
   mailstream_cfstream_set_ssl_level(stream, ssl_level);
-  mailstream_cfstream_set_ssl_verification_mask(stream, MAILSTREAM_CFSTREAM_SSL_NO_VERIFICATION);
+  mailstream_cfstream_set_ssl_verification_mask(stream, MAILSTREAM_CFSTREAM_SSL_DISABLE_VALIDATES_CERTIFICATE_CHAIN);
   r = mailstream_cfstream_set_ssl_enabled(stream, 1);
   if (r < 0) {
     mailstream_close(stream);