diff options
| -rw-r--r-- | src/src/tls-openssl.c | 19 |
1 files changed, 19 insertions, 0 deletions
diff --git a/src/src/tls-openssl.c b/src/src/tls-openssl.c index ae009c028..08b92bae5 100644 --- a/src/src/tls-openssl.c +++ b/src/src/tls-openssl.c @@ -46,6 +46,25 @@ static BOOL client_verify_callback_called = FALSE; static BOOL server_verify_callback_called = FALSE; static const uschar *sid_ctx = US"exim"; +/* We have three different contexts to care about. + +Simple case: client, `client_ctx` + As a client, we can be doing a callout or cut-through delivery while receiving + a message. So we have a client context, which should have options initialised + from the SMTP Transport. + +Server: + There are two cases: with and without ServerNameIndication from the client. + Given TLS SNI, we can be using different keys, certs and various other + configuration settings, because they're re-expanded with $tls_sni set. This + allows vhosting with TLS. This SNI is sent in the handshake. + A client might not send SNI, so we need a fallback, and an initial setup too. + So as a server, we start out using `server_ctx`. + If SNI is sent by the client, then we as server, mid-negotiation, try to clone + `server_sni` from `server_ctx` and then initialise settings by re-expanding + configuration. +*/ + static SSL_CTX *client_ctx = NULL; static SSL_CTX *server_ctx = NULL; static SSL *client_ssl = NULL; |