Gitweb:
https://git.exim.org/exim.git/commitdiff/25fa08681506fa01e9e15406f9d35a853da19476
Commit: 25fa08681506fa01e9e15406f9d35a853da19476
Parent: aa672401091ae127b095c2bb479f1de6cc4848ff
Author: Jeremy Harris <jgh146exb@???>
AuthorDate: Fri Dec 21 15:36:42 2018 +0000
Committer: Jeremy Harris <jgh146exb@???>
CommitDate: Fri Dec 21 15:46:59 2018 +0000
OpenSSL: clear any leftover errors from the stack after SSL_accept succeeds
---
doc/doc-txt/ChangeLog | 5 +++++
src/src/pdkim/signing.c | 30 +++++++++++++++++++-----------
src/src/tls-openssl.c | 2 ++
3 files changed, 26 insertions(+), 11 deletions(-)
diff --git a/doc/doc-txt/ChangeLog b/doc/doc-txt/ChangeLog
index e9e83e0..785d59b 100644
--- a/doc/doc-txt/ChangeLog
+++ b/doc/doc-txt/ChangeLog
@@ -175,6 +175,11 @@ JH/37 Bug 2341: Send "message delayed" warning MDNs (restricted to external
JH/38 Bug 2351: Log failures to extract envelope addresses from message headers.
+JH/39 OpenSSL: clear the error stack after an SSL_accept(). With anon-auth
+ cipher-suites, an error can be left on the stack even for a succeeding
+ accept; this results in impossible error messages when a later operation
+ actually does fail.
+
Exim version 4.91
-----------------
diff --git a/src/src/pdkim/signing.c b/src/src/pdkim/signing.c
index 7b8a6a0..2a086b1 100644
--- a/src/src/pdkim/signing.c
+++ b/src/src/pdkim/signing.c
@@ -831,6 +831,7 @@ const uschar *
exim_dkim_verify(ev_ctx * verify_ctx, hashmethod hash, blob * data, blob * sig)
{
const EVP_MD * md;
+const uschar * where;
switch (hash)
{
@@ -859,18 +860,25 @@ else
{
EVP_PKEY_CTX * ctx;
- if ( (ctx = EVP_PKEY_CTX_new(verify_ctx->key, NULL))
- && EVP_PKEY_verify_init(ctx) > 0
- && EVP_PKEY_CTX_set_rsa_padding(ctx, RSA_PKCS1_PADDING) > 0
- && EVP_PKEY_CTX_set_signature_md(ctx, md) > 0
- && EVP_PKEY_verify(ctx, sig->data, sig->len,
- data->data, data->len) == 1
- )
- { EVP_PKEY_CTX_free(ctx); return NULL; }
-
- if (ctx) EVP_PKEY_CTX_free(ctx);
+ if ((where = US"EVP_PKEY_CTX_new",
+ (ctx = EVP_PKEY_CTX_new(verify_ctx->key, NULL))))
+ {
+ if ( (where = US"EVP_PKEY_verify_init",
+ EVP_PKEY_verify_init(ctx) > 0)
+ && (where = US"EVP_PKEY_CTX_set_rsa_padding",
+ EVP_PKEY_CTX_set_rsa_padding(ctx, RSA_PKCS1_PADDING) > 0)
+ && (where = US"EVP_PKEY_CTX_set_signature_md",
+ EVP_PKEY_CTX_set_signature_md(ctx, md) > 0)
+ && (where = US"EVP_PKEY_verify",
+ EVP_PKEY_verify(ctx, sig->data, sig->len,
+ data->data, data->len) == 1)
+ )
+ { EVP_PKEY_CTX_free(ctx); return NULL; }
+
+ EVP_PKEY_CTX_free(ctx);
+ }
}
-return US ERR_error_string(ERR_get_error(), NULL);
+return string_sprintf("%s: %s", where, ERR_error_string(ERR_get_error(), NULL));
}
diff --git a/src/src/tls-openssl.c b/src/src/tls-openssl.c
index 8a1fec6..8f4cf4d 100644
--- a/src/src/tls-openssl.c
+++ b/src/src/tls-openssl.c
@@ -2281,6 +2281,8 @@ if (rc <= 0)
}
DEBUG(D_tls) debug_printf("SSL_accept was successful\n");
+ERR_clear_error(); /* Even success can leave errors in the stack. Seen with
+ anon-authentication ciphersuite negociated. */
/* TLS has been set up. Adjust the input functions to read via TLS,
and initialize things. */
