# HG changeset patch
# User Sergey Kandaurov <pluknet@nginx.com>
# Date 1425043711 -10800
# Node ID 6a7c6973d6fc3b628b38e000f0ed192c99bdfc49
# Parent  ec01b1d1fff12468fe1a2a1ee8e385c514358356
Mail: don't emit Auth-SSL-Verify with disabled ssl_verify_client.

Previously, the Auth-SSL-Verify header with the "NONE" value was always passed
to the auth_http script if verification of client certificates is disabled.

diff --git a/src/mail/ngx_mail_auth_http_module.c b/src/mail/ngx_mail_auth_http_module.c
--- a/src/mail/ngx_mail_auth_http_module.c
+++ b/src/mail/ngx_mail_auth_http_module.c
@@ -1155,6 +1155,7 @@ ngx_mail_auth_http_create_request(ngx_ma
     ngx_str_t                  verify, subject, issuer, serial, fingerprint,
                                raw_cert, cert;
     ngx_connection_t          *c;
+    ngx_mail_ssl_conf_t       *sslcf;
 #endif
     ngx_mail_core_srv_conf_t  *cscf;
 
@@ -1169,8 +1170,9 @@ ngx_mail_auth_http_create_request(ngx_ma
 #if (NGX_MAIL_SSL)
 
     c = s->connection;
+    sslcf = ngx_mail_get_module_srv_conf(s, ngx_mail_ssl_module);
 
-    if (c->ssl) {
+    if (c->ssl && sslcf->verify) {
 
         /* certificate details */
 
@@ -1339,10 +1341,12 @@ ngx_mail_auth_http_create_request(ngx_ma
         b->last = ngx_cpymem(b->last, "Auth-SSL: on" CRLF,
                              sizeof("Auth-SSL: on" CRLF) - 1);
 
-        b->last = ngx_cpymem(b->last, "Auth-SSL-Verify: ",
-                             sizeof("Auth-SSL-Verify: ") - 1);
-        b->last = ngx_copy(b->last, verify.data, verify.len);
-        *b->last++ = CR; *b->last++ = LF;
+        if (verify.len) {
+            b->last = ngx_cpymem(b->last, "Auth-SSL-Verify: ",
+                                 sizeof("Auth-SSL-Verify: ") - 1);
+            b->last = ngx_copy(b->last, verify.data, verify.len);
+            *b->last++ = CR; *b->last++ = LF;
+        }
 
         if (subject.len) {
             b->last = ngx_cpymem(b->last, "Auth-SSL-Subject: ",