Compiler quietening

[exim.git] / src / src / tls-openssl.c

diff --git a/src/src/tls-openssl.c b/src/src/tls-openssl.c
index 13b0c232f0e9ac263343882c9e4a8a21c79c2ccd..cc72b2eeb40edef3de9f02a8f377ee8c33f82ea6 100644 (file)
--- a/src/src/tls-openssl.c
+++ b/src/src/tls-openssl.c
@@ -903,10 +903,12 @@ DEBUG(D_tls)
          str = where & SSL_CB_READ ? US"read" : US"write",
          SSL_alert_type_string_long(ret), SSL_alert_desc_string_long(ret));
   else if (where & SSL_CB_EXIT)
-     if (ret == 0)
-       debug_printf("%s: failed in %s\n", str, SSL_state_string_long(s));
-     else if (ret < 0)
-       debug_printf("%s: error in %s\n", str, SSL_state_string_long(s));
+    {
+    if (ret == 0)
+      debug_printf("%s: failed in %s\n", str, SSL_state_string_long(s));
+    else if (ret < 0)
+      debug_printf("%s: error in %s\n", str, SSL_state_string_long(s));
+    }
   else if (where & SSL_CB_HANDSHAKE_START)
      debug_printf("%s: hshake start: %s\n", str, SSL_state_string_long(s));
   else if (where & SSL_CB_HANDSHAKE_DONE)
@@ -1247,10 +1249,14 @@ int status, reason, i;
 DEBUG(D_tls)
   debug_printf("tls_ocsp_file (%s)  '%s'\n", is_pem ? "PEM" : "DER", filename);
 
+if (!filename || !*filename) return;
+
+ERR_clear_error();
 if (!(bio = BIO_new_file(CS filename, "rb")))
   {
-  DEBUG(D_tls) debug_printf("Failed to open OCSP response file \"%s\"\n",
-      filename);
+  log_write(0, LOG_MAIN|LOG_PANIC,
+    "Failed to open OCSP response file \"%s\": %.100s",
+    filename, ERR_reason_error_string(ERR_get_error()));
   return;
   }
 
@@ -1261,8 +1267,8 @@ if (is_pem)
   long len;
   if (!PEM_read_bio(bio, &dummy, &dummy, &data, &len))
     {
-    DEBUG(D_tls) debug_printf("Failed to read PEM file \"%s\"\n",
-       filename);
+    log_write(0, LOG_MAIN|LOG_PANIC, "Failed to read PEM file \"%s\": %.100s",
+      filename, ERR_reason_error_string(ERR_get_error()));
     return;
     }
   freep = data;
@@ -1275,7 +1281,8 @@ BIO_free(bio);
 
 if (!resp)
   {
-  DEBUG(D_tls) debug_printf("Error reading OCSP response.\n");
+  log_write(0, LOG_MAIN|LOG_PANIC, "Error reading OCSP response from \"%s\": %s",
+      filename, ERR_reason_error_string(ERR_get_error()));
   return;
   }
 
@@ -2753,18 +2760,23 @@ if (tlsp->peercert)
 /* Load certs from file, return TRUE on success */
 
 static BOOL
-chain_from_pem_file(const uschar * file, STACK_OF(X509) * verify_stack)
+chain_from_pem_file(const uschar * file, STACK_OF(X509) ** vp)
 {
 BIO * bp;
+STACK_OF(X509) * verify_stack = *vp;
 X509 * x;
 
-while (sk_X509_num(verify_stack) > 0)
-  X509_free(sk_X509_pop(verify_stack));
+if (verify_stack)
+  while (sk_X509_num(verify_stack) > 0)
+    X509_free(sk_X509_pop(verify_stack));
+else
+  verify_stack = sk_X509_new_null();
 
 if (!(bp = BIO_new_file(CS file, "r"))) return FALSE;
-while ((x = PEM_read_bio_X509(bp, NULL, 0, NULL)))
+for (X509 * x; x = PEM_read_bio_X509(bp, NULL, 0, NULL); )
   sk_X509_push(verify_stack, x);
 BIO_free(bp);
+*vp = verify_stack;
 return TRUE;
 }
 #endif
@@ -2819,6 +2831,13 @@ if (expcerts && *expcerts)
        { file = NULL; dir = expcerts; }
       else
        {
+       STACK_OF(X509) * verify_stack =
+#ifndef DISABLE_OCSP
+         !host ? state_server.verify_stack :
+#endif
+         NULL;
+       STACK_OF(X509) ** vp = &verify_stack;
+
        file = expcerts; dir = NULL;
 #ifndef DISABLE_OCSP
        /* In the server if we will be offering an OCSP proof, load chain from
@@ -2827,11 +2846,10 @@ if (expcerts && *expcerts)
 /*XXX Glitch!   The file here is tls_verify_certs: the chain for verifying the client cert.
 This is inconsistent with the need to verify the OCSP proof of the server cert.
 */
-
        if (  !host
           && statbuf.st_size > 0
           && state_server.u_ocsp.server.file
-          && !chain_from_pem_file(file, state_server.verify_stack)
+          && !chain_from_pem_file(file, vp)
           )
          {
          log_write(0, LOG_MAIN|LOG_PANIC,
@@ -3117,7 +3135,7 @@ if (rc <= 0)
     /* Handle genuine errors */
     case SSL_ERROR_SSL:
       {
-      uschar * s = US"SSL_accept";
+      uschar * s = NULL;
       int r = ERR_GET_REASON(ERR_peek_error());
       if (  r == SSL_R_WRONG_VERSION_NUMBER
 #ifdef SSL_R_VERSION_TOO_LOW
@@ -3125,7 +3143,7 @@ if (rc <= 0)
 #endif
          || r == SSL_R_UNKNOWN_PROTOCOL || r == SSL_R_UNSUPPORTED_PROTOCOL)
        s = string_sprintf("%s (%s)", s, SSL_get_version(ssl));
-      (void) tls_error(s, NULL, sigalrm_seen ? US"timed out" : NULL, errstr);
+      (void) tls_error(US"SSL_accept", NULL, sigalrm_seen ? US"timed out" : s, errstr);
       return FAIL;
       }
 
@@ -3390,29 +3408,35 @@ if (tlsp->host_resumable)
          debug_printf("decoding session: %s\n", ssl_errstring);
          }
        }
-#ifdef EXIM_HAVE_SESSION_TICKET
-      else if ( SSL_SESSION_get_ticket_lifetime_hint(ss) + dt->time_stamp
-              < time(NULL))
+      else
        {
-       DEBUG(D_tls) debug_printf("session expired\n");
-       dbfn_delete(dbm_file, key);
-       }
+       unsigned long lifetime =
+#ifdef EXIM_HAVE_SESSION_TICKET
+         SSL_SESSION_get_ticket_lifetime_hint(ss);
+#else                  /* Use, fairly arbitrilarily, what we as server would */
+         f.running_in_test_harness ? 6 : ssl_session_timeout;
 #endif
-      else if (!SSL_set_session(ssl, ss))
-       {
-       DEBUG(D_tls)
+       if (lifetime + dt->time_stamp < time(NULL))
          {
-         ERR_error_string_n(ERR_get_error(),
-           ssl_errstring, sizeof(ssl_errstring));
-         debug_printf("applying session to ssl: %s\n", ssl_errstring);
+         DEBUG(D_tls) debug_printf("session expired\n");
+         dbfn_delete(dbm_file, key);
+         }
+       else if (!SSL_set_session(ssl, ss))
+         {
+         DEBUG(D_tls)
+           {
+           ERR_error_string_n(ERR_get_error(),
+             ssl_errstring, sizeof(ssl_errstring));
+           debug_printf("applying session to ssl: %s\n", ssl_errstring);
+           }
+         }
+       else
+         {
+         DEBUG(D_tls) debug_printf("good session\n");
+         tlsp->resumption |= RESUME_CLIENT_SUGGESTED;
+         tlsp->verify_override = dt->verify_override;
+         tlsp->ocsp = dt->ocsp;
          }
-       }
-      else
-       {
-       DEBUG(D_tls) debug_printf("good session\n");
-       tlsp->resumption |= RESUME_CLIENT_SUGGESTED;
-       tlsp->verify_override = dt->verify_override;
-       tlsp->ocsp = dt->ocsp;
        }
       }
     else
@@ -4053,16 +4077,12 @@ if (more || corked)
   {
   if (!len) buff = US &error;  /* dummy just so that string_catn is ok */
 
-#ifndef DISABLE_PIPE_CONNECT
   int save_pool = store_pool;
   store_pool = POOL_PERM;
-#endif
 
   corked = string_catn(corked, buff, len);
 
-#ifndef DISABLE_PIPE_CONNECT
   store_pool = save_pool;
-#endif
 
   if (more)
     {