reversion: Adapt to dotted release scheme

[user/henk/code/exim.git] / src / src / tls-openssl.c

diff --git a/src/src/tls-openssl.c b/src/src/tls-openssl.c
index cda31f140626efed4c6def4f9b141569c62259fe..8a1fec6a9be7f5284f065c1cdb64a4f6a5e395b0 100644 (file)
--- a/src/src/tls-openssl.c
+++ b/src/src/tls-openssl.c
@@ -71,6 +71,8 @@ functions from the OpenSSL library. */
 #  define EXIM_HAVE_OPENSSL_CHECKHOST
 #  define EXIM_HAVE_OPENSSL_DH_BITS
 #  define EXIM_HAVE_OPENSSL_TLS_METHOD
 #  define EXIM_HAVE_OPENSSL_CHECKHOST
 #  define EXIM_HAVE_OPENSSL_DH_BITS
 #  define EXIM_HAVE_OPENSSL_TLS_METHOD

+# else
+#  define EXIM_NEED_OPENSSL_INIT

 # endif
 # if OPENSSL_VERSION_NUMBER >= 0x010000000L \
     && (OPENSSL_VERSION_NUMBER & 0x0000ff000L) >= 0x000002000L
 # endif
 # if OPENSSL_VERSION_NUMBER >= 0x010000000L \
     && (OPENSSL_VERSION_NUMBER & 0x0000ff000L) >= 0x000002000L


@@ -368,7 +370,9 @@ if (!msg)
   msg = US ssl_errstring;
   }
 
   msg = US ssl_errstring;
   }
 

-if (errstr) *errstr = string_sprintf("(%s): %s", prefix, msg);
+msg = string_sprintf("(%s): %s", prefix, msg);
+DEBUG(D_tls) debug_printf("TLS error '%s'\n", msg);
+if (errstr) *errstr = msg;

 return host ? FAIL : DEFER;
 }
 
 return host ? FAIL : DEFER;
 }
 


@@ -749,17 +753,17 @@ DEBUG(D_tls)
   const uschar * str;
 
   if (where & SSL_ST_CONNECT)
   const uschar * str;
 
   if (where & SSL_ST_CONNECT)

-     str = "SSL_connect";
+     str = US"SSL_connect";

   else if (where & SSL_ST_ACCEPT)
   else if (where & SSL_ST_ACCEPT)

-     str = "SSL_accept";
+     str = US"SSL_accept";

   else
   else

-     str = "SSL info (undefined)";
+     str = US"SSL info (undefined)";

 
   if (where & SSL_CB_LOOP)
      debug_printf("%s: %s\n", str, SSL_state_string_long(s));
   else if (where & SSL_CB_ALERT)
     debug_printf("SSL3 alert %s:%s:%s\n",
 
   if (where & SSL_CB_LOOP)
      debug_printf("%s: %s\n", str, SSL_state_string_long(s));
   else if (where & SSL_CB_ALERT)
     debug_printf("SSL3 alert %s:%s:%s\n",

-         str = where & SSL_CB_READ ? "read" : "write",
+         str = where & SSL_CB_READ ? US"read" : US"write",

          SSL_alert_type_string_long(ret), SSL_alert_desc_string_long(ret));
   else if (where & SSL_CB_EXIT)
      if (ret == 0)
          SSL_alert_type_string_long(ret), SSL_alert_desc_string_long(ret));
   else if (where & SSL_CB_EXIT)
      if (ret == 0)


@@ -1172,7 +1176,7 @@ if (!(x509 = X509_new()))
   goto err;
 
 where = US"generating pkey";
   goto err;
 
 where = US"generating pkey";

-if (!(rsa = rsa_callback(NULL, 0, 1024)))
+if (!(rsa = rsa_callback(NULL, 0, 2048)))

   goto err;
 
 where = US"assigning pkey";
   goto err;
 
 where = US"assigning pkey";


@@ -1300,8 +1304,8 @@ else
       if ((err = tls_add_certfile(sctx, cbinfo, expanded, errstr)))
        return err;
 
       if ((err = tls_add_certfile(sctx, cbinfo, expanded, errstr)))
        return err;
 

-  if (cbinfo->privatekey != NULL &&
-      !expand_check(cbinfo->privatekey, US"tls_privatekey", &expanded, errstr))
+  if (  cbinfo->privatekey
+     && !expand_check(cbinfo->privatekey, US"tls_privatekey", &expanded, errstr))

     return DEFER;
 
   /* If expansion was forced to fail, key_expanded will be NULL. If the result
     return DEFER;
 
   /* If expansion was forced to fail, key_expanded will be NULL. If the result


@@ -1404,7 +1408,7 @@ if (!(server_sni = SSL_CTX_new(SSLv23_server_method())))
   {
   ERR_error_string_n(ERR_get_error(), ssl_errstring, sizeof(ssl_errstring));
   DEBUG(D_tls) debug_printf("SSL_CTX_new() failed: %s\n", ssl_errstring);
   {
   ERR_error_string_n(ERR_get_error(), ssl_errstring, sizeof(ssl_errstring));
   DEBUG(D_tls) debug_printf("SSL_CTX_new() failed: %s\n", ssl_errstring);

-  return SSL_TLSEXT_ERR_NOACK;
+  goto bad;

   }
 
 /* Not sure how many of these are actually needed, since SSL object
   }
 
 /* Not sure how many of these are actually needed, since SSL object


@@ -1420,11 +1424,11 @@ SSL_CTX_set_tlsext_servername_arg(server_sni, cbinfo);
 if (  !init_dh(server_sni, cbinfo->dhparam, NULL, &dummy_errstr)
    || !init_ecdh(server_sni, NULL, &dummy_errstr)
    )
 if (  !init_dh(server_sni, cbinfo->dhparam, NULL, &dummy_errstr)
    || !init_ecdh(server_sni, NULL, &dummy_errstr)
    )

-  return SSL_TLSEXT_ERR_NOACK;
+  goto bad;

 
 if (  cbinfo->server_cipher_list
    && !SSL_CTX_set_cipher_list(server_sni, CS cbinfo->server_cipher_list))
 
 if (  cbinfo->server_cipher_list
    && !SSL_CTX_set_cipher_list(server_sni, CS cbinfo->server_cipher_list))

-  return SSL_TLSEXT_ERR_NOACK;
+  goto bad;

 
 #ifndef DISABLE_OCSP
 if (cbinfo->u_ocsp.server.file)
 
 #ifndef DISABLE_OCSP
 if (cbinfo->u_ocsp.server.file)


@@ -1436,17 +1440,18 @@ if (cbinfo->u_ocsp.server.file)
 
 if ((rc = setup_certs(server_sni, tls_verify_certificates, tls_crl, NULL, FALSE,
                      verify_callback_server, &dummy_errstr)) != OK)
 
 if ((rc = setup_certs(server_sni, tls_verify_certificates, tls_crl, NULL, FALSE,
                      verify_callback_server, &dummy_errstr)) != OK)

-  return SSL_TLSEXT_ERR_NOACK;
+  goto bad;

 
 /* do this after setup_certs, because this can require the certs for verifying
 OCSP information. */
 if ((rc = tls_expand_session_files(server_sni, cbinfo, &dummy_errstr)) != OK)
 
 /* do this after setup_certs, because this can require the certs for verifying
 OCSP information. */
 if ((rc = tls_expand_session_files(server_sni, cbinfo, &dummy_errstr)) != OK)

-  return SSL_TLSEXT_ERR_NOACK;
+  goto bad;

 
 DEBUG(D_tls) debug_printf("Switching SSL context.\n");
 SSL_set_SSL_CTX(s, server_sni);
 
 DEBUG(D_tls) debug_printf("Switching SSL context.\n");
 SSL_set_SSL_CTX(s, server_sni);

-

 return SSL_TLSEXT_ERR_OK;
 return SSL_TLSEXT_ERR_OK;

+
+bad: return SSL_TLSEXT_ERR_ALERT_FATAL;

 }
 #endif /* EXIM_HAVE_OPENSSL_TLSEXT */
 
 }
 #endif /* EXIM_HAVE_OPENSSL_TLSEXT */
 


@@ -1714,8 +1719,10 @@ cbinfo->host = host;
 cbinfo->event_action = NULL;
 #endif
 
 cbinfo->event_action = NULL;
 #endif
 

+#ifdef EXIM_NEED_OPENSSL_INIT

 SSL_load_error_strings();          /* basic set up */
 OpenSSL_add_ssl_algorithms();
 SSL_load_error_strings();          /* basic set up */
 OpenSSL_add_ssl_algorithms();

+#endif

 
 #ifdef EXIM_HAVE_SHA256
 /* SHA256 is becoming ever more popular. This makes sure it gets added to the
 
 #ifdef EXIM_HAVE_SHA256
 /* SHA256 is becoming ever more popular. This makes sure it gets added to the


@@ -2120,7 +2127,7 @@ if (expcerts && *expcerts)
   /* If verification is optional, don't fail if no certificate */
 
   SSL_CTX_set_verify(sctx,
   /* If verification is optional, don't fail if no certificate */
 
   SSL_CTX_set_verify(sctx,

-    SSL_VERIFY_PEER | (optional? 0 : SSL_VERIFY_FAIL_IF_NO_PEER_CERT),
+    SSL_VERIFY_PEER | (optional ? 0 : SSL_VERIFY_FAIL_IF_NO_PEER_CERT),

     cert_vfy_cb);
   }
 
     cert_vfy_cb);
   }
 


@@ -2263,9 +2270,9 @@ SSL_set_accept_state(server_ssl);
 DEBUG(D_tls) debug_printf("Calling SSL_accept\n");
 
 sigalrm_seen = FALSE;
 DEBUG(D_tls) debug_printf("Calling SSL_accept\n");
 
 sigalrm_seen = FALSE;

-if (smtp_receive_timeout > 0) alarm(smtp_receive_timeout);
+if (smtp_receive_timeout > 0) ALARM(smtp_receive_timeout);

 rc = SSL_accept(server_ssl);
 rc = SSL_accept(server_ssl);

-alarm(0);
+ALARM_CLR(0);

 
 if (rc <= 0)
   {
 
 if (rc <= 0)
   {


@@ -2643,9 +2650,9 @@ client_static_cbinfo->event_action = tb ? tb->event_action : NULL;
 
 DEBUG(D_tls) debug_printf("Calling SSL_connect\n");
 sigalrm_seen = FALSE;
 
 DEBUG(D_tls) debug_printf("Calling SSL_connect\n");
 sigalrm_seen = FALSE;

-alarm(ob->command_timeout);
+ALARM(ob->command_timeout);

 rc = SSL_connect(exim_client_ctx->ssl);
 rc = SSL_connect(exim_client_ctx->ssl);

-alarm(0);
+ALARM_CLR(0);

 
 #ifdef SUPPORT_DANE
 if (tlsa_dnsa)
 
 #ifdef SUPPORT_DANE
 if (tlsa_dnsa)


@@ -2689,11 +2696,11 @@ int inbytes;
 DEBUG(D_tls) debug_printf("Calling SSL_read(%p, %p, %u)\n", server_ssl,
   ssl_xfer_buffer, ssl_xfer_buffer_size);
 
 DEBUG(D_tls) debug_printf("Calling SSL_read(%p, %p, %u)\n", server_ssl,
   ssl_xfer_buffer, ssl_xfer_buffer_size);
 

-if (smtp_receive_timeout > 0) alarm(smtp_receive_timeout);
+if (smtp_receive_timeout > 0) ALARM(smtp_receive_timeout);

 inbytes = SSL_read(server_ssl, CS ssl_xfer_buffer,
                  MIN(ssl_xfer_buffer_size, lim));
 error = SSL_get_error(server_ssl, inbytes);
 inbytes = SSL_read(server_ssl, CS ssl_xfer_buffer,
                  MIN(ssl_xfer_buffer_size, lim));
 error = SSL_get_error(server_ssl, inbytes);

-if (smtp_receive_timeout > 0) alarm(0);
+if (smtp_receive_timeout > 0) ALARM_CLR(0);

 
 if (had_command_timeout)               /* set by signal handler */
   smtp_command_timeout_exit();         /* does not return */
 
 if (had_command_timeout)               /* set by signal handler */
   smtp_command_timeout_exit();         /* does not return */


@@ -2909,10 +2916,22 @@ DEBUG(D_tls) debug_printf("%s(%p, %lu%s)\n", __FUNCTION__,
 "more" is notified.  This hack is only ok if small amounts are involved AND only
 one stream does it, in one context (i.e. no store reset).  Currently it is used
 for the responses to the received SMTP MAIL , RCPT, DATA sequence, only. */
 "more" is notified.  This hack is only ok if small amounts are involved AND only
 one stream does it, in one context (i.e. no store reset).  Currently it is used
 for the responses to the received SMTP MAIL , RCPT, DATA sequence, only. */

+/*XXX + if PIPE_COMMAND, banner & ehlo-resp for smmtp-on-connect. Suspect there's
+a store reset there. */

 
 if (!ct_ctx && (more || corked))
   {
 
 if (!ct_ctx && (more || corked))
   {

+#ifdef EXPERIMENTAL_PIPE_CONNECT
+  int save_pool = store_pool;
+  store_pool = POOL_PERM;
+#endif
+

   corked = string_catn(corked, buff, len);
   corked = string_catn(corked, buff, len);

+
+#ifdef EXPERIMENTAL_PIPE_CONNECT
+  store_pool = save_pool;
+#endif
+

   if (more)
     return len;
   buff = CUS corked->s;
   if (more)
     return len;
   buff = CUS corked->s;


@@ -2995,9 +3014,9 @@ if (shutdown)
   if (  (rc = SSL_shutdown(*sslp)) == 0        /* send "close notify" alert */
      && shutdown > 1)
     {
   if (  (rc = SSL_shutdown(*sslp)) == 0        /* send "close notify" alert */
      && shutdown > 1)
     {

-    alarm(2);
+    ALARM(2);

     rc = SSL_shutdown(*sslp);          /* wait for response */
     rc = SSL_shutdown(*sslp);          /* wait for response */

-    alarm(0);
+    ALARM_CLR(0);

     }
 
   if (rc < 0) DEBUG(D_tls)
     }
 
   if (rc < 0) DEBUG(D_tls)


@@ -3044,8 +3063,10 @@ uschar *s, *expciphers, *err;
 /* this duplicates from tls_init(), we need a better "init just global
 state, for no specific purpose" singleton function of our own */
 
 /* this duplicates from tls_init(), we need a better "init just global
 state, for no specific purpose" singleton function of our own */
 

+#ifdef EXIM_NEED_OPENSSL_INIT

 SSL_load_error_strings();
 OpenSSL_add_ssl_algorithms();
 SSL_load_error_strings();
 OpenSSL_add_ssl_algorithms();

+#endif

 #if (OPENSSL_VERSION_NUMBER >= 0x0090800fL) && !defined(OPENSSL_NO_SHA256)
 /* SHA256 is becoming ever more popular. This makes sure it gets added to the
 list of available digests. */
 #if (OPENSSL_VERSION_NUMBER >= 0x0090800fL) && !defined(OPENSSL_NO_SHA256)
 /* SHA256 is becoming ever more popular. This makes sure it gets added to the
 list of available digests. */