|
|
- From c3f68d987c00284d91ad6599a013b7111662545b Mon Sep 17 00:00:00 2001
- From: Sebastian Andrzej Siewior <sebastian@breakpoint.cc>
- Date: Fri, 2 Sep 2016 21:33:33 +0000
- Subject: [PATCH] uw-imap: compile against openssl 1.1.0
-
- I *think* I replaced access to cert->name with certificate's subject name. I
- assume that the re-aranged C-code is doing the same thing. A double check
- wouldn't hurt :)
-
- Signed-off-by: Sebastian Andrzej Siewior <sebastian@breakpoint.cc>
- ---
- src/osdep/unix/ssl_unix.c | 28 +++++++++++++++++-----------
- 1 file changed, 17 insertions(+), 11 deletions(-)
-
- --- a/src/osdep/unix/ssl_unix.c
- +++ b/src/osdep/unix/ssl_unix.c
- @@ -59,7 +59,7 @@ typedef struct ssl_stream {
- static SSLSTREAM *ssl_start(TCPSTREAM *tstream,char *host,unsigned long flags);
- static char *ssl_start_work (SSLSTREAM *stream,char *host,unsigned long flags);
- static int ssl_open_verify (int ok,X509_STORE_CTX *ctx);
- -static char *ssl_validate_cert (X509 *cert,char *host);
- +static char *ssl_validate_cert (X509 *cert,char *host, char *cert_subj);
- static long ssl_compare_hostnames (unsigned char *s,unsigned char *pat);
- static char *ssl_getline_work (SSLSTREAM *stream,unsigned long *size,
- long *contd);
- @@ -210,6 +210,7 @@ static char *ssl_start_work (SSLSTREAM *
- BIO *bio;
- X509 *cert;
- unsigned long sl,tl;
- + char cert_subj[250];
- char *s,*t,*err,tmp[MAILTMPLEN];
- sslcertificatequery_t scq =
- (sslcertificatequery_t) mail_parameters (NIL,GET_SSLCERTIFICATEQUERY,NIL);
- @@ -266,14 +267,19 @@ static char *ssl_start_work (SSLSTREAM *
- if (SSL_write (stream->con,"",0) < 0)
- return ssl_last_error ? ssl_last_error : "SSL negotiation failed";
- /* need to validate host names? */
- - if (!(flags & NET_NOVALIDATECERT) &&
- - (err = ssl_validate_cert (cert = SSL_get_peer_certificate (stream->con),
- - host))) {
- - /* application callback */
- - if (scq) return (*scq) (err,host,cert ? cert->name : "???") ? NIL : "";
- + if (!(flags & NET_NOVALIDATECERT)) {
- +
- + cert_subj[0] = '\0';
- + cert = SSL_get_peer_certificate(stream->con);
- + if (cert)
- + X509_NAME_oneline(X509_get_subject_name(cert), cert_subj, sizeof(cert_subj));
- + err = ssl_validate_cert (cert, host, cert_subj);
- + if (err)
- + /* application callback */
- + if (scq) return (*scq) (err,host,cert ? cert_subj : "???") ? NIL : "";
- /* error message to return via mm_log() */
- - sprintf (tmp,"*%.128s: %.255s",err,cert ? cert->name : "???");
- - return ssl_last_error = cpystr (tmp);
- + sprintf (tmp,"*%.128s: %.255s",err,cert ? cert_subj : "???");
- + return ssl_last_error = cpystr (tmp);
- }
- return NIL;
- }
- @@ -313,7 +319,7 @@ static int ssl_open_verify (int ok,X509_
- * Returns: NIL if validated, else string of error message
- */
-
- -static char *ssl_validate_cert (X509 *cert,char *host)
- +static char *ssl_validate_cert (X509 *cert,char *host, char *cert_subj)
- {
- int i,n;
- char *s,*t,*ret;
- @@ -322,9 +328,9 @@ static char *ssl_validate_cert (X509 *ce
- /* make sure have a certificate */
- if (!cert) ret = "No certificate from server";
- /* and that it has a name */
- - else if (!cert->name) ret = "No name in certificate";
- + else if (cert_subj[0] == '\0') ret = "No name in certificate";
- /* locate CN */
- - else if (s = strstr (cert->name,"/CN=")) {
- + else if (s = strstr (cert_subj,"/CN=")) {
- if (t = strchr (s += 4,'/')) *t = '\0';
- /* host name matches pattern? */
- ret = ssl_compare_hostnames (host,s) ? NIL :
|
