/****************************************************************************/
#ifdef HAVE_OPENSSL
+# ifndef DISABLE_OCSP
-X509_STORE *
-setup_verify(BIO *bp, char *CAfile, char *CApath)
-{
- X509_STORE *store;
- X509_LOOKUP *lookup;
- if(!(store = X509_STORE_new())) goto end;
- lookup=X509_STORE_add_lookup(store,X509_LOOKUP_file());
- if (lookup == NULL) goto end;
- if (CAfile) {
- if(!X509_LOOKUP_load_file(lookup,CAfile,X509_FILETYPE_PEM)) {
- BIO_printf(bp, "Error loading file %s\n", CAfile);
- goto end;
- }
- } else X509_LOOKUP_load_file(lookup,NULL,X509_FILETYPE_DEFAULT);
-
- lookup=X509_STORE_add_lookup(store,X509_LOOKUP_hash_dir());
- if (lookup == NULL) goto end;
- if (CApath) {
- if(!X509_LOOKUP_add_dir(lookup,CApath,X509_FILETYPE_PEM)) {
- BIO_printf(bp, "Error loading directory %s\n", CApath);
- goto end;
- }
- } else X509_LOOKUP_add_dir(lookup,NULL,X509_FILETYPE_DEFAULT);
-
- ERR_clear_error();
- return store;
- end:
- X509_STORE_free(store);
- return NULL;
-}
-
-
-#ifndef DISABLE_OCSP
static STACK_OF(X509) *
-cert_stack_from_store(X509_STORE * store)
+chain_from_pem_file(const uschar * file)
{
-STACK_OF(X509_OBJECT) * roots= store->objs;
-STACK_OF(X509) * sk = sk_X509_new_null();
-int i;
+BIO * bp;
+X509 * x;
+STACK_OF(X509) * sk;
-for(i = sk_X509_OBJECT_num(roots) - 1; i >= 0; i--)
- {
- X509_OBJECT * tmp_obj= sk_X509_OBJECT_value(roots, i);
- if(tmp_obj->type == X509_LU_X509)
- {
- X509 * x = tmp_obj->data.x509;
- sk_X509_push(sk, x);
- }
- }
+if (!(sk = sk_X509_new_null())) return NULL;
+if (!(bp = BIO_new_file(CS file, "r"))) return NULL;
+while ((x = PEM_read_bio_X509(bp, NULL, 0, NULL)))
+ sk_X509_push(sk, x);
+BIO_free(bp);
return sk;
}
+
+
static void
cert_stack_free(STACK_OF(X509) * sk)
{
int len;
OCSP_RESPONSE *rsp;
OCSP_BASICRESP *bs;
-char *CAfile = NULL;
-X509_STORE *store = NULL;
STACK_OF(X509) * sk;
int ret = 1;
}
-CAfile = ocsp_stapling;
-if(!(store = setup_verify(arg, CAfile, NULL)))
+if (!(sk = chain_from_pem_file(ocsp_stapling)))
{
BIO_printf(arg, "error in cert setup\n");
return 0;
}
-sk = cert_stack_from_store(store);
-
/* OCSP_basic_verify takes a "store" arg, but does not
use it for the chain verification, which is all we do
when OCSP_NOVERIFY is set. The content from the wire
BIO_printf(arg, "Response verify OK\n");
cert_stack_free(sk);
-X509_STORE_free(store);
return ret;
}
-#endif
+# endif /*DISABLE_OCSP*/
/*************************************************
/****************************************************************************/
+/* Turn "\n" and "\r" into the relevant characters. This is a hack. */
+
+static int
+unescape_buf(unsigned char * buf, int len)
+{
+unsigned char * s;
+unsigned char c, t;
+unsigned shift;
+
+for (s = buf; s < buf+len; s++) if (*s == '\\')
+ {
+ switch (s[1])
+ {
+ default: c = s[1]; shift = 1; break;
+ case 'n': c = '\n'; shift = 1; break;
+ case 'r': c = '\r'; shift = 1; break;
+ case 'x':
+ t = s[2];
+ if (t >= 'A' && t <= 'F') t -= 'A'-'9'-1;
+ else if (t >= 'a' && t <= 'f') t -= 'a'-'9'-1;
+ t -= '0';
+ c = (t<<4) & 0xf0;
+ t = s[3];
+ if (t >= 'A' && t <= 'F') t -= 'A'-'9'-1;
+ else if (t >= 'a' && t <= 'f') t -= 'a'-'9'-1;
+ t -= '0';
+ c |= t & 0xf;
+ shift = 3;
+ break;
+ }
+ *s = c;
+ memmove(s+1, s+shift+1, len-shift);
+ len -= shift;
+ }
+return len;
+}
+
+
/****************************************************************************/
[<key file>]\n\
\n";
-int main(int argc, char **argv)
+int
+main(int argc, char **argv)
{
struct sockaddr *s_ptr;
struct sockaddr_in s_in4;
while (fgets(CS outbuffer, sizeof(outbuffer), stdin) != NULL)
{
int n = (int)strlen(CS outbuffer);
+ int crlf = 1;
/* Strip trailing newline */
if (outbuffer[n-1] == '\n') outbuffer[--n] = 0;
unsigned exp_eof = outbuffer[3] == '*';
printf("%s\n", outbuffer);
+ n = unescape_buf(outbuffer, n);
if (*inptr == 0) /* Refill input buffer */
{
}
else
{
- printf("Enexpected EOF read\n");
+ printf("Unexpected EOF read\n");
close(sock);
exit(80);
}
}
printf("<<< %s\n", lineptr);
- if (strncmp(CS lineptr, CS outbuffer + 4, (int)strlen(CS outbuffer) - 4) != 0)
+ if (strncmp(CS lineptr, CS outbuffer + 4, n - 4) != 0)
{
printf("\n******** Input mismatch ********\n");
exit(79);
else
{
- unsigned char *escape;
+ unsigned char * out = outbuffer;
+
+ if (strncmp(CS outbuffer, ">>> ", 4) == 0)
+ {
+ crlf = 0;
+ out += 4;
+ n -= 4;
+ }
if (*inptr != 0)
{
printf("Unconsumed input: %s", inptr);
- printf(" About to send: %s\n", outbuffer);
+ printf(" About to send: %s\n", out);
exit(78);
}
/* Shutdown TLS */
- if (strcmp(CS outbuffer, "stoptls") == 0 ||
- strcmp(CS outbuffer, "STOPTLS") == 0)
+ if (strcmp(CS out, "stoptls") == 0 ||
+ strcmp(CS out, "STOPTLS") == 0)
{
if (!tls_active)
{
/* Remember that we sent STARTTLS */
- sent_starttls = (strcmp(CS outbuffer, "starttls") == 0 ||
- strcmp(CS outbuffer, "STARTTLS") == 0);
+ sent_starttls = (strcmp(CS out, "starttls") == 0 ||
+ strcmp(CS out, "STARTTLS") == 0);
/* Fudge: if the command is "starttls_wait", we send the starttls bit,
but we haven't set the flag, so that there is no negotiation. This is for
testing the server's timeout. */
- if (strcmp(CS outbuffer, "starttls_wait") == 0)
+ if (strcmp(CS out, "starttls_wait") == 0)
{
- outbuffer[8] = 0;
+ out[8] = 0;
n = 8;
}
#endif
- printf(">>> %s\n", outbuffer);
- strcpy(CS outbuffer + n, "\r\n");
-
- /* Turn "\n" and "\r" into the relevant characters. This is a hack. */
-
- while ((escape = US strstr(CS outbuffer, "\\r")) != NULL)
+ printf(">>> %s\n", out);
+ if (crlf)
{
- *escape = '\r';
- memmove(escape + 1, escape + 2, (n + 2) - (escape - outbuffer) - 2);
- n--;
+ strcpy(CS out + n, "\r\n");
+ n += 2;
}
- while ((escape = US strstr(CS outbuffer, "\\n")) != NULL)
- {
- *escape = '\n';
- memmove(escape + 1, escape + 2, (n + 2) - (escape - outbuffer) - 2);
- n--;
- }
+ n = unescape_buf(out, n);
/* OK, do it */
if (tls_active)
{
#ifdef HAVE_OPENSSL
- rc = SSL_write (ssl, outbuffer, n + 2);
+ rc = SSL_write (ssl, out, n);
#endif
#ifdef HAVE_GNUTLS
- rc = gnutls_record_send(tls_session, CS outbuffer, n + 2);
- if (rc < 0)
+ if ((rc = gnutls_record_send(tls_session, CS out, n)) < 0)
{
printf("GnuTLS write error: %s\n", gnutls_strerror(rc));
exit(76);
#endif
}
else
- {
- rc = write(sock, outbuffer, n + 2);
- }
+ rc = write(sock, out, n);
alarm(0);
if (rc < 0)
git://git.exim.org / exim.git / blobdiff