Fix symlink-following. Bug 2909

[user/henk/code/exim.git] / src / src / tls-openssl.c

diff --git a/src/src/tls-openssl.c b/src/src/tls-openssl.c
index f8b4db06a12349f07c6871f7e258ffd107c56ae2..4c61fc0e6b2270fbc78f3466d88fcf99b69ce46c 100644 (file)
--- a/src/src/tls-openssl.c
+++ b/src/src/tls-openssl.c
@@ -2405,7 +2405,7 @@ BIO_puts(bp, "\n");
 }
 
 static int
-tls_client_stapling_cb(SSL *s, void *arg)
+tls_client_stapling_cb(SSL * ssl, void * arg)
 {
 exim_openssl_state_st * cbinfo = arg;
 const unsigned char * p;
@@ -2415,10 +2415,10 @@ OCSP_BASICRESP * bs;
 int i;
 
 DEBUG(D_tls) debug_printf("Received TLS status callback (OCSP stapling):\n");
-len = SSL_get_tlsext_status_ocsp_resp(s, &p);
+len = SSL_get_tlsext_status_ocsp_resp(ssl, &p);
 if(!p)
  {                             /* Expect this when we requested ocsp but got none */
-  if (SSL_session_reused(s) && tls_out.ocsp == OCSP_VFIED)
+  if (SSL_session_reused(ssl) && tls_out.ocsp == OCSP_VFIED)
     {
     DEBUG(D_tls) debug_printf(" null, but resumed; ocsp vfy stored with session is good\n");
     return 1;
@@ -2476,9 +2476,19 @@ if (!(bs = OCSP_response_get1_basic(rsp)))
       if (ERR_peek_error())
        {
        tls_out.ocsp = OCSP_FAILED;
-       if (LOGGING(tls_cipher)) log_write(0, LOG_MAIN,
-               "Received TLS cert status response, itself unverifiable: %s",
-               ERR_reason_error_string(ERR_peek_error()));
+       if (LOGGING(tls_cipher))
+         {
+         const uschar * errstr = CUS ERR_reason_error_string(ERR_peek_error());
+         static uschar peerdn[256];
+         X509_NAME_oneline(X509_get_subject_name(SSL_get_peer_certificate(ssl)),
+                                                 CS peerdn, sizeof(peerdn));
+         log_write(0, LOG_MAIN,
+               "[%s] %s Received TLS cert (DN: '%.*s') status response, "
+               "itself unverifiable: %s",
+               sender_host_address, sender_host_name,
+               (int)sizeof(peerdn), peerdn,
+               errstr);
+         }
        DEBUG(D_tls)
          {
          BIO_printf(bp, "OCSP response verify failure\n");
@@ -3341,8 +3351,9 @@ if (rc <= 0)
     case SSL_ERROR_ZERO_RETURN:
       DEBUG(D_tls) debug_printf("Got SSL_ERROR_ZERO_RETURN\n");
       (void) tls_error(US"SSL_accept", NULL, sigalrm_seen ? US"timed out" : NULL, errstr);
+#ifndef DISABLE_EVENT
       (void) event_raise(event_action, US"tls:fail:connect", *errstr, NULL);
-
+#endif
       if (SSL_get_shutdown(ssl) == SSL_RECEIVED_SHUTDOWN)
        SSL_shutdown(ssl);
 
@@ -3361,7 +3372,9 @@ if (rc <= 0)
          || r == SSL_R_UNKNOWN_PROTOCOL || r == SSL_R_UNSUPPORTED_PROTOCOL)
        s = string_sprintf("(%s)", SSL_get_version(ssl));
       (void) tls_error(US"SSL_accept", NULL, sigalrm_seen ? US"timed out" : s, errstr);
+#ifndef DISABLE_EVENT
       (void) event_raise(event_action, US"tls:fail:connect", *errstr, NULL);
+#endif
       return FAIL;
       }
 
@@ -3372,7 +3385,9 @@ if (rc <= 0)
        if (!errno)
          {
          *errstr = US"SSL_accept: TCP connection closed by peer";
+#ifndef DISABLE_EVENT
          (void) event_raise(event_action, US"tls:fail:connect", *errstr, NULL);
+#endif
          return FAIL;
          }
        DEBUG(D_tls) debug_printf(" - syscall %s\n", strerror(errno));
@@ -3381,7 +3396,9 @@ if (rc <= 0)
                      sigalrm_seen ? US"timed out"
                      : ERR_peek_error() ? NULL : string_sprintf("ret %d", error),
                      errstr);
+#ifndef DISABLE_EVENT
       (void) event_raise(event_action, US"tls:fail:connect", *errstr, NULL);
+#endif
       return FAIL;
     }
   }
@@ -4017,7 +4034,12 @@ if (ob->tls_alpn)
 #endif
 
 #ifndef DISABLE_TLS_RESUME
-if (verify_check_given_host(CUSS &ob->tls_resumption_hosts, host) == OK)
+/*XXX have_lbserver: another cmdline arg possibly, for continued-conn, but use
+will be very low. */
+
+if (!conn_args->have_lbserver) /* wanted for tls_client_resmption_key() */
+  { DEBUG(D_tls) debug_printf("resumption not supported on continued-connection\n"); }
+else if (verify_check_given_host(CUSS &ob->tls_resumption_hosts, host) == OK)
   tls_client_ctx_resume_prehandshake(exim_client_ctx, conn_args, tlsp, ob);
 #endif