File netqmail-1.06-tls-fixes.patch of Package netqmail

Overview Repositories Revisions Requests Users Attributes Meta

File netqmail-1.06-tls-fixes.patch of Package netqmail (Revision 581f7ce7c009b6e54733048611f25c65)

Currently displaying revision 581f7ce7c009b6e54733048611f25c65 , Show latest

Fix for netqmail-1.06 with Fred Vermeulen's tls patch.

Actually, this is more than just a fix - it modifies the patch to request
an optional client certificate already on the initial ssl handshake, instead
of trying to renegotiate later. With openssl-1.0.x, requesting client certs
when renegotiating didn't seem to work anymore.

This has the additional advantage that clients using certificates will always
be treated as RELAYCLIENTs.

This file is licensed under the terms of the
GNU General Public License Version 2. A copy of these terms should be
enclosed as "gpl-2.0.txt" in the package containing this file.

--- netqmail-1.06.orig/qmail-smtpd.c	2012-10-10 12:20:24.000000000 +0200
+++ netqmail-1.06/qmail-smtpd.c	2012-10-10 12:23:09.000000000 +0200
@@ -640,6 +640,9 @@
   /* POODLE vulnerability */
   SSL_CTX_set_options(ctx, SSL_OP_NO_SSLv2 | SSL_OP_NO_SSLv3);
 
+  /* see http://www.openssl.org/docs/ssl/SSL_CTX_set_session_id_context.html#WARNINGS */
+  SSL_CTX_set_session_id_context(ctx, "0acec650dc6248e6a763023741198894", 32);
+
   if (!SSL_CTX_use_certificate_chain_file(ctx, SERVERCERT))
     { SSL_CTX_free(ctx); tls_err("missing certificate"); return; }
   SSL_CTX_load_verify_locations(ctx, CLIENTCA, NULL);
--- netqmail-1.06/qmail-smtpd.c	2012-10-11 13:14:34.000000000 +0200
+++ netqmail-1.06.sslfix/qmail-smtpd.c	2012-10-11 13:17:28.000000000 +0200
@@ -559,27 +559,12 @@
   {
   case 1:
     if (constmap_init(&mapclients, clients.s, clients.len, 0)) {
-      /* if CLIENTCA contains all the standard root certificates, a
-       * 0.9.6b client might fail with SSL_R_EXCESSIVE_MESSAGE_SIZE;
-       * it is probably due to 0.9.6b supporting only 8k key exchange
-       * data while the 0.9.6c release increases that limit to 100k */
-      STACK_OF(X509_NAME) *sk = SSL_load_client_CA_file(CLIENTCA);
-      if (sk) {
-        SSL_set_client_CA_list(ssl, sk);
-        SSL_set_verify(ssl, SSL_VERIFY_PEER | SSL_VERIFY_CLIENT_ONCE, NULL);
-        break;
-      }
-      constmap_free(&mapclients);
+      break;
     }
   case 0: alloc_free(clients.s); return 0;
   case -1: die_control();
   }
 
-  if (ssl_timeoutrehandshake(timeout, ssl_rfd, ssl_wfd, ssl) <= 0) {
-    const char *err = ssl_error_str();
-    tls_out("rehandshake failed", err); die_read();
-  }
-
   do { /* one iteration */
     X509 *peercert;
     X509_NAME *subj;
@@ -633,6 +618,7 @@
   stralloc saciphers = {0};
   X509_STORE *store;
   X509_LOOKUP *lookup;
+  STACK_OF(X509_NAME) *sk;
 
   SSL_library_init();
 
@@ -647,6 +633,15 @@
     { SSL_CTX_free(ctx); tls_err("missing certificate"); return; }
   SSL_CTX_load_verify_locations(ctx, CLIENTCA, NULL);
 
+  sk = SSL_load_client_CA_file(CLIENTCA);
+  /* if CLIENTCA contains all the standard root certificates, a
+   * 0.9.6b client might fail with SSL_R_EXCESSIVE_MESSAGE_SIZE;
+   * it is probably due to 0.9.6b supporting only 8k key exchange
+   * data while the 0.9.6c release increases that limit to 100k */
+  if (sk) {
+    SSL_CTX_set_client_CA_list(ctx, sk);
+  }
+
 #if OPENSSL_VERSION_NUMBER >= 0x00907000L
   /* crl checking */
   store = SSL_CTX_get_cert_store(ctx);
@@ -657,7 +652,7 @@
 #endif
  
   /* set the callback here; SSL_set_verify didn't work before 0.9.6c */
-  SSL_CTX_set_verify(ctx, SSL_VERIFY_NONE, verify_cb);
+  SSL_CTX_set_verify(ctx, sk ? SSL_VERIFY_PEER | SSL_VERIFY_CLIENT_ONCE : SSL_VERIFY_NONE, verify_cb);
 
   /* a new SSL object, with the rest added to it directly to avoid copying */
   myssl = SSL_new(ctx);
--- netqmail-1.06/qmail-smtpd.c	2012-10-16 12:03:39.000000000 +0200
+++ netqmail-1.06.new/qmail-smtpd.c	2012-10-16 12:12:51.000000000 +0200
@@ -244,21 +244,18 @@
   return 0;
 }
 
-int addrallowed()
+static int addrallowed()
 {
   int r;
   r = rcpthosts(addr.s,str_len(addr.s));
   if (r == -1) die_control();
-#ifdef TLS
-  if (r == 0) if (tls_verify()) r = -2;
-#endif
   return r;
 }
 
 
 int seenmail = 0;
 int flagbarf; /* defined if seenmail */
-int allowed;
+static int allowed;
 stralloc mailfrom = {0};
 stralloc rcptto = {0};
 
@@ -534,7 +531,7 @@
 # define CLIENTCRL "control/clientcrl.pem"
 # define SERVERCERT "control/servercert.pem"
 
-int tls_verify()
+static int tls_verify()
 {
   stralloc clients = {0};
   struct constmap mapclients;
@@ -699,6 +685,8 @@
   if (!stralloc_0(&proto)) die_nomem();
   protocol = proto.s;
 
+  tls_verify(); /* set relayclient if client certifiate is acceptable */
+
   /* have to discard the pre-STARTTLS HELO/EHLO argument, if any */
   dohelo(remotehost);
 }
--- netqmail-1.06/qmail-smtpd.c	2012-10-16 12:13:50.000000000 +0200
+++ netqmail-1.06.new/qmail-smtpd.c	2012-10-16 12:15:13.000000000 +0200
@@ -39,7 +39,6 @@
 #include "ssl_timeoutio.h"
 
 void tls_init();
-int tls_verify();
 void tls_nogateway();
 int ssl_rfd = -1, ssl_wfd = -1; /* SSL_get_Xfd() are broken */
 #endif

Places

File netqmail-1.06-tls-fixes.patch of Package netqmail (Revision 581f7ce7c009b6e54733048611f25c65)

Places