I am maintaining jabberd for Fedora and I am currently looking into why
the verify-mode parameter is not working. The current code still uses
the verfiy-mode parameter from the old 5223 SSL code path.
Following patch seems necessary which just moves the reading of
verify-mode a bit up.
--- jabberd-2.1.20/c2s/main.c 2007-12-27 18:52:04.000000000 +0100
+++ /tmp/main.c 2008-01-08 11:11:24.433818914 +0100
@@ -241,9 +242,11 @@
host->host_pemfile = j_attr((const char **) elem->attrs[i], "pemfile");
+ host->host_verify_mode = j_atoi(j_attr((const char **) elem->attrs[i],
"verify-mode"), 0);
+
#ifdef HAVE_SSL
if(c2s->sx_ssl == NULL && host->host_pemfile != NULL) {
- c2s->sx_ssl = sx_env_plugin(c2s->sx_env, sx_ssl_init,
host->host_pemfile, NULL, c2s->local_verify_mode);
+ c2s->sx_ssl = sx_env_plugin(c2s->sx_env, sx_ssl_init,
host->host_pemfile, NULL, host->host_verify_mode);
if(c2s->sx_ssl == NULL) {
log_write(c2s->log, LOG_ERR, "failed to load %s SSL pemfile",
host->realm);
host->host_pemfile = NULL;
@@ -253,8 +256,6 @@
host->host_require_starttls = (j_attr((const char **) elem->attrs[i],
"require-starttls") != NULL);
- host->host_verify_mode = j_atoi(j_attr((const char **) elem->attrs[i],
"verify-mode"), 0);
-
host->ar_register_enable = (j_attr((const char **) elem->attrs[i],
"register-enable") != NULL);
host->ar_register_oob = j_attr((const char **) elem->attrs[i],
"register-oob");
if(host->ar_register_enable || host->ar_register_oob) {
Hope this is correct.
Adrian
_______________________________________________
Jabberd2 mailing list
[email protected]
http://lists.xiaoka.com/listinfo.cgi/jabberd2-xiaoka.com
