}
#endif /* HAVE_SOCKETPAIR */
-static int setsocktimeout(int sock, int which, int timeout) {
- struct timeval tv;
- int rc;
-
- tv.tv_sec = timeout;
- tv.tv_usec = 0;
- rc = setsockopt(sock, SOL_SOCKET, which, &tv, sizeof(tv));
- if (rc) {
- report(stderr, GT_("setsockopt(%d, SOL_SOCKET) failed: %s"), sock, strerror(errno));
- }
- return rc;
-}
-
-/** Configure socket options such as send/receive timeout at the socket
- * level, to avoid network-induced stalls.
- */
-int SockTimeout(int sock, int timeout)
-{
- int err = 0;
-
- if (setsocktimeout(sock, SO_RCVTIMEO, timeout)) err = 1;
- if (setsocktimeout(sock, SO_SNDTIMEO, timeout)) err = 1;
- return err;
-}
-
/** Set socket to SO_KEEPALIVE. \return 0 for success. */
int SockKeepalive(int sock) {
int keepalive = 1;
return -1;
}
- /* Socket opened saved. Usefull if connect timeout
- * because it can be closed.
- */
- mailserver_socket_temp = sock;
-
- if (connect(sock, (struct sockaddr *) &ad, sizeof(ad)) < 0)
+ /* Socket opened saved. Usefull if connect timeout
+ * because it can be closed.
+ */
+ mailserver_socket_temp = sock;
+
+ if (connect(sock, (struct sockaddr *) &ad, sizeof(ad)) < 0)
{
int olderr = errno;
fm_close(sock); /* don't use SockClose, no traffic yet */
errno = olderr;
sock = -1;
}
-
- /* No connect timeout, then no need to set mailserver_socket_temp */
- mailserver_socket_temp = -1;
+
+ /* No connect timeout, then no need to set mailserver_socket_temp */
+ mailserver_socket_temp = -1;
return sock;
}
continue;
}
- SockTimeout(i, mytimeout);
SockKeepalive(i);
/* Save socket descriptor.
#include <openssl/x509v3.h>
#include <openssl/rand.h>
+static void report_SSL_errors(FILE *stream)
+{
+ unsigned long err;
+
+ while (0ul != (err = ERR_get_error())) {
+ char *errstr = ERR_error_string(err, NULL);
+ report(stream, GT_("OpenSSL reported: %s\n"), errstr);
+ }
+}
+
+/* override ERR_print_errors_fp to our own implementation */
+#undef ERR_print_errors_fp
+#define ERR_print_errors_fp(stream) report_SSL_errors((stream))
+
static SSL_CTX *_ctx[FD_SETSIZE];
static SSL *_ssl_context[FD_SETSIZE];
if (outlevel >= O_VERBOSE) {
if (depth == 0 && SSLverbose)
- report(stderr, GT_("Server certificate:\n"));
+ report(stdout, GT_("Server certificate:\n"));
else {
if (_firstrun) {
_firstrun = 0;
}
}
}
- sk_GENERAL_NAME_free(gens);
+ GENERAL_NAMES_free(gens);
}
if (name_match(p1, p2)) {
matched = 1;
} /* if (depth == 0 && !_depth0ck) */
if (err != X509_V_OK && err != _prev_err && !(_check_fp != 0 && _check_digest && !strict)) {
+ char *tmp;
+ int did_rep_err = 0;
_prev_err = err;
-
+
report(stderr, GT_("Server certificate verification error: %s\n"), X509_verify_cert_error_string(err));
/* We gave the error code, but maybe we can add some more details for debugging */
switch (err) {
+ /* actually we do not want to lump these together, but
+ * since OpenSSL flipped the meaning of these error
+ * codes in the past, and they do hardly make a
+ * practical difference because servers need not provide
+ * the root signing certificate, we don't bother telling
+ * users the difference:
+ */
+ case X509_V_ERR_UNABLE_TO_GET_ISSUER_CERT_LOCALLY:
case X509_V_ERR_UNABLE_TO_GET_ISSUER_CERT:
X509_NAME_oneline(issuer, buf, sizeof(buf));
buf[sizeof(buf) - 1] = '\0';
- report(stderr, GT_("unknown issuer (first %d characters): %s\n"), (int)(sizeof(buf)-1), buf);
- report(stderr, GT_("This error usually happens when the server provides an incomplete certificate "
- "chain, which is nothing fetchmail could do anything about. For details, "
- "please see the README.SSL-SERVER document that comes with fetchmail.\n"));
- break;
+ report(stderr, GT_("Broken certification chain at: %s\n"), (tmp = sdump(buf, strlen(buf))));
+ xfree(tmp);
+ report(stderr, GT_( "This could mean that the server did not provide the intermediate CA's certificate(s), "
+ "which is nothing fetchmail could do anything about. For details, "
+ "please see the README.SSL-SERVER document that ships with fetchmail.\n"));
+ did_rep_err = 1;
+ /* FALLTHROUGH */
case X509_V_ERR_DEPTH_ZERO_SELF_SIGNED_CERT:
- case X509_V_ERR_UNABLE_TO_GET_ISSUER_CERT_LOCALLY:
case X509_V_ERR_SELF_SIGNED_CERT_IN_CHAIN:
- X509_NAME_oneline(subj, buf, sizeof(buf));
- buf[sizeof(buf) - 1] = '\0';
- report(stderr, GT_("This means that the root signing certificate (issued for %s) is not in the "
- "trusted CA certificate locations, or that c_rehash needs to be run "
+ if (!did_rep_err) {
+ X509_NAME_oneline(issuer, buf, sizeof(buf));
+ buf[sizeof(buf) - 1] = '\0';
+ report(stderr, GT_("Missing trust anchor certificate: %s\n"), (tmp = sdump(buf, strlen(buf))));
+ xfree(tmp);
+ }
+ report(stderr, GT_( "This could mean that the root CA's signing certificate is not in the "
+ "trusted CA certificate location, or that c_rehash needs to be run "
"on the certificate directory. For details, please "
- "see the documentation of --sslcertpath and --sslcertfile in the manual page.\n"), buf);
+ "see the documentation of --sslcertpath and --sslcertfile in the manual page.\n"));
break;
default:
break;
{
struct stat randstat;
int i;
+ long sslopts = SSL_OP_ALL;
SSL_load_error_strings();
SSL_library_init();
/* Make sure a connection referring to an older context is not left */
_ssl_context[sock] = NULL;
if(myproto) {
- if(!strcasecmp("ssl3",myproto)) {
+ if(!strcasecmp("ssl2",myproto)) {
+#if HAVE_DECL_SSLV2_CLIENT_METHOD + 0 > 0
+ _ctx[sock] = SSL_CTX_new(SSLv2_client_method());
+#else
+ report(stderr, GT_("Your operating system does not support SSLv2.\n"));
+ return -1;
+#endif
+ } else if(!strcasecmp("ssl3",myproto)) {
_ctx[sock] = SSL_CTX_new(SSLv3_client_method());
} else if(!strcasecmp("tls1",myproto)) {
_ctx[sock] = SSL_CTX_new(TLSv1_client_method());
} else if (!strcasecmp("ssl23",myproto)) {
myproto = NULL;
} else {
- fprintf(stderr,GT_("Invalid SSL protocol '%s' specified, using default (SSL23).\n"), myproto);
+ report(stderr,GT_("Invalid SSL protocol '%s' specified, using default (SSLv23).\n"), myproto);
myproto = NULL;
}
}
return(-1);
}
- SSL_CTX_set_options(_ctx[sock], SSL_OP_ALL | SSL_OP_NO_SSLv2);
+ {
+ char *tmp = getenv("FETCHMAIL_DISABLE_CBC_IV_COUNTERMEASURE");
+ if (tmp == NULL || *tmp == '\0' || strspn(tmp, " \t") == strlen(tmp))
+ sslopts &= ~ SSL_OP_DONT_INSERT_EMPTY_FRAGMENTS;
+ }
+
+ SSL_CTX_set_options(_ctx[sock], sslopts);
if (certck) {
SSL_CTX_set_verify(_ctx[sock], SSL_VERIFY_PEER, SSL_ck_verify_callback);
return count;
}
#endif /* __CYGWIN__ */
-
-#ifdef MAIN
-/*
- * Use the chargen service to test input buffering directly.
- * You may have to uncomment the `chargen' service description in your
- * inetd.conf (and then SIGHUP inetd) for this to work. */
-main()
-{
- int sock = SockOpen("localhost", "chargen", NULL);
- char buf[80];
-
- while (SockRead(sock, buf, sizeof(buf)-1))
- SockWrite(1, buf, strlen(buf));
- SockClose(sock);
-}
-#endif /* MAIN */
-
-/* socket.c ends here */