[exim-cvs] OpenSSL: clear any leftover errors from the stack…

Top Page
Delete this message
Reply to this message
Author: Exim Git Commits Mailing List
Date:  
To: exim-cvs
Subject: [exim-cvs] OpenSSL: clear any leftover errors from the stack after SSL_accept succeeds
Gitweb: https://git.exim.org/exim.git/commitdiff/25fa08681506fa01e9e15406f9d35a853da19476
Commit:     25fa08681506fa01e9e15406f9d35a853da19476
Parent:     aa672401091ae127b095c2bb479f1de6cc4848ff
Author:     Jeremy Harris <jgh146exb@???>
AuthorDate: Fri Dec 21 15:36:42 2018 +0000
Committer:  Jeremy Harris <jgh146exb@???>
CommitDate: Fri Dec 21 15:46:59 2018 +0000


    OpenSSL: clear any leftover errors from the stack after SSL_accept succeeds
---
 doc/doc-txt/ChangeLog   |  5 +++++
 src/src/pdkim/signing.c | 30 +++++++++++++++++++-----------
 src/src/tls-openssl.c   |  2 ++
 3 files changed, 26 insertions(+), 11 deletions(-)


diff --git a/doc/doc-txt/ChangeLog b/doc/doc-txt/ChangeLog
index e9e83e0..785d59b 100644
--- a/doc/doc-txt/ChangeLog
+++ b/doc/doc-txt/ChangeLog
@@ -175,6 +175,11 @@ JH/37 Bug 2341: Send "message delayed" warning MDNs (restricted to external

JH/38 Bug 2351: Log failures to extract envelope addresses from message headers.

+JH/39 OpenSSL: clear the error stack after an SSL_accept().  With anon-auth
+      cipher-suites, an error can be left on the stack even for a succeeding
+      accept; this results in impossible error messages when a later operation
+      actually does fail.
+


Exim version 4.91
-----------------
diff --git a/src/src/pdkim/signing.c b/src/src/pdkim/signing.c
index 7b8a6a0..2a086b1 100644
--- a/src/src/pdkim/signing.c
+++ b/src/src/pdkim/signing.c
@@ -831,6 +831,7 @@ const uschar *
exim_dkim_verify(ev_ctx * verify_ctx, hashmethod hash, blob * data, blob * sig)
{
const EVP_MD * md;
+const uschar * where;

switch (hash)
{
@@ -859,18 +860,25 @@ else
{
EVP_PKEY_CTX * ctx;

-  if (  (ctx = EVP_PKEY_CTX_new(verify_ctx->key, NULL))
-     && EVP_PKEY_verify_init(ctx) > 0
-     && EVP_PKEY_CTX_set_rsa_padding(ctx, RSA_PKCS1_PADDING) > 0
-     && EVP_PKEY_CTX_set_signature_md(ctx, md) > 0
-     && EVP_PKEY_verify(ctx, sig->data, sig->len,
-      data->data, data->len) == 1
-     )
-    { EVP_PKEY_CTX_free(ctx); return NULL; }
-
-  if (ctx) EVP_PKEY_CTX_free(ctx);
+  if ((where = US"EVP_PKEY_CTX_new",
+       (ctx = EVP_PKEY_CTX_new(verify_ctx->key, NULL))))
+    {
+    if (  (where = US"EVP_PKEY_verify_init",
+              EVP_PKEY_verify_init(ctx) > 0)
+       && (where = US"EVP_PKEY_CTX_set_rsa_padding",
+              EVP_PKEY_CTX_set_rsa_padding(ctx, RSA_PKCS1_PADDING) > 0)
+       && (where = US"EVP_PKEY_CTX_set_signature_md",
+              EVP_PKEY_CTX_set_signature_md(ctx, md) > 0)
+       && (where = US"EVP_PKEY_verify",
+              EVP_PKEY_verify(ctx, sig->data, sig->len,
+                      data->data, data->len) == 1)
+       )
+      { EVP_PKEY_CTX_free(ctx); return NULL; }
+
+    EVP_PKEY_CTX_free(ctx);
+    }
   }
-return US ERR_error_string(ERR_get_error(), NULL);
+return string_sprintf("%s: %s", where, ERR_error_string(ERR_get_error(), NULL));
 }



diff --git a/src/src/tls-openssl.c b/src/src/tls-openssl.c
index 8a1fec6..8f4cf4d 100644
--- a/src/src/tls-openssl.c
+++ b/src/src/tls-openssl.c
@@ -2281,6 +2281,8 @@ if (rc <= 0)
}

 DEBUG(D_tls) debug_printf("SSL_accept was successful\n");
+ERR_clear_error();    /* Even success can leave errors in the stack. Seen with
+            anon-authentication ciphersuite negociated. */


/* TLS has been set up. Adjust the input functions to read via TLS,
and initialize things. */