File ssmtp-validate-TLS-server-cert.patch of Package ssmtp

Overview Repositories Revisions Requests Users Attributes Meta

File ssmtp-validate-TLS-server-cert.patch of Package ssmtp

diff -up ssmtp-2.64/ssmtp.conf.5.orig ssmtp-2.64/ssmtp.conf.5
--- ssmtp-2.64/ssmtp.conf.5.orig	2013-08-20 10:09:28.912253115 +0300
+++ ssmtp-2.64/ssmtp.conf.5	2013-08-20 10:10:05.666212495 +0300
@@ -53,6 +53,13 @@ See RFC 2487.
 .Pp
 .It Cm TLSCert
 The file name of an RSA certificate to use for TLS, if required.
+.It Cm TLSKey
+The file name of an RSA key to use for TLS, if required.
+.It Cm TLS_CA_File
+A file of trusted certificates for validating the server, if required.
+.Pp
+.It Cm TLS_CA_Dir
+A directory of trusted certificates for validating the server, if required.
 .Pp
 .It Cm AuthUser
 The user name to use for SMTP AUTH.
diff -up ssmtp-2.64/ssmtp.c.orig ssmtp-2.64/ssmtp.c
--- ssmtp-2.64/ssmtp.c.orig	2013-08-20 10:09:03.510255402 +0300
+++ ssmtp-2.64/ssmtp.c	2013-08-20 10:10:05.666212495 +0300
@@ -69,7 +69,10 @@ char *minus_F = (char)NULL;
 char *gecos;
 char *prog = (char)NULL;
 char *root = NULL;
-char *tls_cert = "/etc/ssl/certs/ssmtp.pem";	/* Default Certificate */
+char *tls_cert = "/etc/pki/tls/private/ssmtp.pem";	/* Default Certificate */
+char *tls_key = "/etc/pki/tls/private/ssmtp.pem";    /* Default private key */
+char *tls_ca_file = NULL;      /* Trusted Certificate file */
+char *tls_ca_dir = NULL;       /* Trusted Certificate directory */
 char *uad = (char)NULL;
 char *config_file = (char)NULL;		/* alternate configuration file */
 
@@ -1084,6 +1087,33 @@ bool_t read_config()
 					log_event(LOG_INFO, "Set TLSCert=\"%s\"\n", tls_cert);
 				}
 			}
+                       else if(strcasecmp(p, "TLSKey") == 0) {
+                               if((tls_key = strdup(q)) == (char *)NULL) {
+                                       die("parse_config() -- strdup() failed");
+                               }
+
+                               if(log_level > 0) {
+                                       log_event(LOG_INFO, "Set TLSKey=\"%s\"\n", tls_key);
+                               }
+                       }
+                       else if(strcasecmp(p, "TLS_CA_File") == 0) {
+                               if((tls_ca_file = strdup(q)) == (char *)NULL) {
+                                       die("parse_config() -- strdup() failed");
+                               }
+
+                               if(log_level > 0) {
+                                       log_event(LOG_INFO, "Set TLS_CA_File=\"%s\"\n", tls_ca_file);
+                               }
+                       }
+                       else if(strcasecmp(p, "TLS_CA_Dir") == 0) {
+                               if((tls_ca_dir = strdup(q)) == (char *)NULL) {
+                                       die("parse_config() -- strdup() failed");
+                               }
+
+                               if(log_level > 0) {
+                                       log_event(LOG_INFO, "Set TLS_CA_Dir=\"%s\"\n", tls_ca_dir);
+                               }
+                       }
 #endif
 			/* Command-line overrides these */
 			else if(strcasecmp(p, "AuthUser") == 0 && !auth_user) {
@@ -1168,6 +1198,8 @@ int smtp_open(char *host, int port)
 
 #ifdef HAVE_SSL
 	int err;
+	long lerr;
+	unsigned long ulerr;
 	char buf[(BUF_SZ + 1)];
 
 	/* Init SSL stuff */
@@ -1190,7 +1222,7 @@ int smtp_open(char *host, int port)
 			return(-1);
 		}
 
-		if(SSL_CTX_use_PrivateKey_file(ctx, tls_cert, SSL_FILETYPE_PEM) <= 0) {
+		if(SSL_CTX_use_PrivateKey_file(ctx, tls_key, SSL_FILETYPE_PEM) <= 0) {
 			perror("Use PrivateKey");
 			return(-1);
 		}
@@ -1200,6 +1232,16 @@ int smtp_open(char *host, int port)
 			return(-1);
 		}
 	}
+	if (tls_ca_file || tls_ca_dir) {
+		if(!SSL_CTX_load_verify_locations(ctx, tls_ca_file, tls_ca_dir)) {
+			ulerr = ERR_get_error();
+			log_event(LOG_ERR, "Error setting verify location: %s",
+				  ERR_reason_error_string(ulerr));
+			return(-1);
+		}
+	}
+
+	SSL_CTX_set_verify(ctx, SSL_VERIFY_PEER, NULL);
 #endif
 
 #ifdef INET6
@@ -1303,14 +1345,20 @@ int smtp_open(char *host, int port)
 
 		ssl = SSL_new(ctx);
 		if(!ssl) {
-			log_event(LOG_ERR, "SSL not working");
+			ulerr = ERR_get_error();
+			log_event(LOG_ERR, "SSL not working: %s",
+                                 ERR_reason_error_string(ulerr));
 			return(-1);
 		}
 		SSL_set_fd(ssl, s);
 
 		err = SSL_connect(ssl);
 		if(err < 0) { 
-			perror("SSL_connect");
+			ulerr = ERR_get_error();
+			lerr = SSL_get_verify_result(ssl);
+			log_event(LOG_ERR, "SSL not working: %s (%ld)",
+				ERR_reason_error_string(ulerr), lerr);
+
 			return(-1);
 		}
 
@@ -1324,8 +1372,6 @@ int smtp_open(char *host, int port)
 			return(-1);
 		}
 		X509_free(server_cert);
-
-		/* TODO: Check server cert if changed! */
 	}
 #endif
 
diff -up ssmtp-2.64/TLS.orig ssmtp-2.64/TLS
--- ssmtp-2.64/TLS.orig	2013-08-20 10:09:52.524212818 +0300
+++ ssmtp-2.64/TLS	2013-08-20 10:10:05.667213425 +0300
@@ -26,9 +26,13 @@ Set this to yes to make ssmtp identify i
 TLSCert=<file>
 Specify which certificate file should be used.
 
+TLSKey=<file>
+Specify which key file should be used (can be the same as the certificate file).
 
-TODO:
-* Check server certificate for changes and notify about it.
-* Diffrent Certificate and Key file?
+TLS_CA_File=<file>
+Optional file of trusted certificates for validating the server.
+
+TLS_CA_Dir=<file>
+Optional directory of trusted certificates for validating the server.

Places

File ssmtp-validate-TLS-server-cert.patch of Package ssmtp

Places