Logging: make cipher info available for continued-TLS connection deliveries

diff --git a/doc/doc-docbook/spec.xfpt b/doc/doc-docbook/spec.xfpt
index 128ee8004002062b88476fe64b63b6a5e715c2a1..c62c1eecf1e1e86deb010b363ecf3dbaf2622851 100644 (file)
--- a/doc/doc-docbook/spec.xfpt
+++ b/doc/doc-docbook/spec.xfpt
@@ -3869,12 +3869,12 @@ by Exim in conjunction with the &%-MC%& option, and passes on the fact that the
 host to which Exim is connected supports TLS encryption.
 
 .new
 host to which Exim is connected supports TLS encryption.
 
 .new

-.vitem &%-MCt%&&~<&'IP&~address'&>&~<&'port'&>
+.vitem &%-MCt%&&~<&'IP&~address'&>&~<&'port'&>&~<&'cipher'&>

 .oindex "&%-MCt%&"
 This option is not intended for use by external callers. It is used internally
 by Exim in conjunction with the &%-MC%& option, and passes on the fact that the
 connection is being proxied by a parent process for handling TLS encryption.
 .oindex "&%-MCt%&"
 This option is not intended for use by external callers. It is used internally
 by Exim in conjunction with the &%-MC%& option, and passes on the fact that the
 connection is being proxied by a parent process for handling TLS encryption.

-The pair of arguments give the local address and port being proxied.
+The arguments give the local address and port being proxied, and the TLS cipher.

 .wen
 
 .vitem &%-Mc%&&~<&'message&~id'&>&~<&'message&~id'&>&~...
 .wen
 
 .vitem &%-Mc%&&~<&'message&~id'&>&~<&'message&~id'&>&~...


@@ -35774,10 +35774,9 @@ down a single SMTP connection, an asterisk follows the IP address in the log
 lines for the second and subsequent messages.
 .new
 When two or more messages are delivered down a single TLS connection, the
 lines for the second and subsequent messages.
 .new
 When two or more messages are delivered down a single TLS connection, the

-DNS and TLS-related information logged for the first message delivered
+DNS and some TLS-related information logged for the first message delivered

 will not be present in the log lines for the second and subsequent messages.
 will not be present in the log lines for the second and subsequent messages.

-A TLS-marker indication of &'X=*'& is added to the log line instead of
-cipher information.
+TLS cipher information is still available.

 .wen
 
 .cindex "delivery" "cutthrough; logging"
 .wen
 
 .cindex "delivery" "cutthrough; logging"


@@ -35906,7 +35905,7 @@ the following table:
 &`T   `&        on &`<=`& lines: message subject (topic)
 &`    `&        on &`=>`& &`**`& and &`==`& lines: transport name
 &`U   `&        local user or RFC 1413 identity
 &`T   `&        on &`<=`& lines: message subject (topic)
 &`    `&        on &`=>`& &`**`& and &`==`& lines: transport name
 &`U   `&        local user or RFC 1413 identity

-&`X   `&        TLS cipher suite, or TLS usage mark
+&`X   `&        TLS cipher suite

 .endd
 
 
 .endd
 
 

diff --git a/doc/doc-txt/ChangeLog b/doc/doc-txt/ChangeLog
index ac35c75f1aa150caa7583130ce9feeee7d56d694..3e5d6f7fc4e544b5d96b38d11f577d4d84345d69 100644 (file)
--- a/doc/doc-txt/ChangeLog
+++ b/doc/doc-txt/ChangeLog
@@ -24,8 +24,7 @@ JH/03 Rework the transport continued-connection mechanism: when TLS is active,
       the passed-on TCP connection.  Instead, proxy the child (and any
       subsequent ones) for TLS via a unix-domain socket channel.  Logging is
       affected: the continued delivery log lines do not have any DNSSEC, TLS
       the passed-on TCP connection.  Instead, proxy the child (and any
       subsequent ones) for TLS via a unix-domain socket channel.  Logging is
       affected: the continued delivery log lines do not have any DNSSEC, TLS

-      cipher, Certificate or OCSP information. A "continued-TLS" marker is
-      added instead of the cipher information: "X=*".
+      Certificate or OCSP information.  TLS cipher information is still logged.

 
 JH/04 Shorten the log line for daemon startup by collapsing adjacent sets of
       identical IP addresses on different listening ports.  Will also affect
 
 JH/04 Shorten the log line for daemon startup by collapsing adjacent sets of
       identical IP addresses on different listening ports.  Will also affect

diff --git a/src/src/deliver.c b/src/src/deliver.c
index 7743d37c3eb77ec59b1f798e74c21d73bb7d9d34..ccc32667e7ed3a57039eb81c45a54275dda88473 100644 (file)
--- a/src/src/deliver.c
+++ b/src/src/deliver.c
@@ -4715,8 +4715,12 @@ for (delivery_count = 0; addr_remote; delivery_count++)
 
         rmt_dlv_checked_write(fd, 'X', '1', big_buffer, ptr - big_buffer);
         }
 
         rmt_dlv_checked_write(fd, 'X', '1', big_buffer, ptr - big_buffer);
         }

-      else if (continue_proxy)         /* known TLS, but no cipher info */
-        rmt_dlv_checked_write(fd, 'X', '1', US"*\0", 3);
+      else if (continue_proxy_cipher)
+       {
+        ptr = big_buffer + sprintf(CS big_buffer, "%.128s", continue_proxy_cipher) + 1;
+       *ptr++ = 0;
+        rmt_dlv_checked_write(fd, 'X', '1', big_buffer, ptr - big_buffer);
+       }

 
       if (addr->peercert)
        {
 
       if (addr->peercert)
        {

diff --git a/src/src/exim.c b/src/src/exim.c
index fd08cc780d7c233fa103ca03b2d244f675bafb56..383382072dfe0cc9bd013d4c7208d0d4ce07a340 100644 (file)
--- a/src/src/exim.c
+++ b/src/src/exim.c
@@ -2710,7 +2710,7 @@ for (i = 1; i < argc; i++)
 
       /* Set up $sending_ip_address and $sending_port, unless proxied */
 
 
       /* Set up $sending_ip_address and $sending_port, unless proxied */
 

-      if (!continue_proxy)
+      if (!continue_proxy_cipher)

        if (getsockname(fileno(stdin), (struct sockaddr *)(&interface_sock),
            &size) == 0)
          sending_ip_address = host_ntoa(-1, &interface_sock, NULL,
        if (getsockname(fileno(stdin), (struct sockaddr *)(&interface_sock),
            &size) == 0)
          sending_ip_address = host_ntoa(-1, &interface_sock, NULL,


@@ -2774,13 +2774,15 @@ for (i = 1; i < argc; i++)
 #ifdef SUPPORT_TLS
     /* -MCt: similar to -MCT below but the connection is still open
     via a proxy proces which handles the TLS context and coding.
 #ifdef SUPPORT_TLS
     /* -MCt: similar to -MCT below but the connection is still open
     via a proxy proces which handles the TLS context and coding.

-    Require two arguments for the proxied local address and port.  */
+    Require three arguments for the proxied local address and port,
+    and the TLS cipher.  */

 
 

-       case 't': continue_proxy = TRUE;
-                 if (++i < argc) sending_ip_address = argv[i];
+       case 't': if (++i < argc) sending_ip_address = argv[i];

                  else badarg = TRUE;
                  if (++i < argc) sending_port = (int)(Uatol(argv[i]));
                  else badarg = TRUE;
                  else badarg = TRUE;
                  if (++i < argc) sending_port = (int)(Uatol(argv[i]));
                  else badarg = TRUE;

+                 if (++i < argc) continue_proxy_cipher = argv[i];
+                 else badarg = TRUE;

                  /*FALLTHROUGH*/
 
     /* -MCT: set the tls_offered flag; this is useful only when it
                  /*FALLTHROUGH*/
 
     /* -MCT: set the tls_offered flag; this is useful only when it

diff --git a/src/src/globals.c b/src/src/globals.c
index f3e4bad96bb5b3c0c01e26b799a9aefd83e476d4..9e417b0d295ef70705d6daf76ab0c7a8256dc2ee 100644 (file)
--- a/src/src/globals.c
+++ b/src/src/globals.c
@@ -529,11 +529,11 @@ uid_t   config_uid             = 0;
 #endif
 
 int     connection_max_messages= -1;
 #endif
 
 int     connection_max_messages= -1;

+uschar *continue_proxy_cipher  = NULL;

 uschar *continue_hostname      = NULL;
 uschar *continue_host_address  = NULL;
 BOOL    continue_more          = FALSE;
 int     continue_sequence      = 1;
 uschar *continue_hostname      = NULL;
 uschar *continue_host_address  = NULL;
 BOOL    continue_more          = FALSE;
 int     continue_sequence      = 1;

-BOOL    continue_proxy        = FALSE;

 uschar *continue_transport     = NULL;
 
 uschar *csa_status             = NULL;
 uschar *continue_transport     = NULL;
 
 uschar *csa_status             = NULL;

diff --git a/src/src/globals.h b/src/src/globals.h
index 750a960ebe2dbc761c85932fe2ac685986181bed..72be706a46fe4f797e2c629009e6bc90c892e2b4 100644 (file)
--- a/src/src/globals.h
+++ b/src/src/globals.h
@@ -289,11 +289,11 @@ extern uschar *config_main_filelist;   /* List of possible config files */
 extern uschar *config_main_filename;   /* File name actually used */
 extern uschar *config_main_directory;  /* Directory where the main config file was found */
 extern uid_t   config_uid;             /* Additional owner */
 extern uschar *config_main_filename;   /* File name actually used */
 extern uschar *config_main_directory;  /* Directory where the main config file was found */
 extern uid_t   config_uid;             /* Additional owner */

+extern uschar *continue_proxy_cipher;  /* TLS cipher for proxied continued delivery */

 extern uschar *continue_hostname;      /* Host for continued delivery */
 extern uschar *continue_host_address;  /* IP address for ditto */
 extern BOOL    continue_more;          /* Flag more addresses waiting */
 extern int     continue_sequence;      /* Sequence num for continued delivery */
 extern uschar *continue_hostname;      /* Host for continued delivery */
 extern uschar *continue_host_address;  /* IP address for ditto */
 extern BOOL    continue_more;          /* Flag more addresses waiting */
 extern int     continue_sequence;      /* Sequence num for continued delivery */

-extern BOOL    continue_proxy;        /* Continued delivery is proxied for TLS */

 extern uschar *continue_transport;     /* Transport for continued delivery */
 
 extern uschar *csa_status;             /* Client SMTP Authorization result */
 extern uschar *continue_transport;     /* Transport for continued delivery */
 
 extern uschar *csa_status;             /* Client SMTP Authorization result */

diff --git a/src/src/transport.c b/src/src/transport.c
index aca33762b12c10036da01ac4a3c7567ebe8632b5..e6e327822c1a6d7224e21ab958eab61ad132f5c0 100644 (file)
--- a/src/src/transport.c
+++ b/src/src/transport.c
@@ -1959,7 +1959,7 @@ DEBUG(D_transport) debug_printf("transport_pass_socket entered\n");
 
 if ((pid = fork()) == 0)
   {
 
 if ((pid = fork()) == 0)
   {

-  int i = 19;
+  int i = 20;

   const uschar **argv;
 
   /* Disconnect entirely from the parent process. If we are running in the
   const uschar **argv;
 
   /* Disconnect entirely from the parent process. If we are running in the


@@ -1983,11 +1983,12 @@ if ((pid = fork()) == 0)
   if (smtp_peer_options & PEER_OFFERED_SIZE) argv[i++] = US"-MCS";
 #ifdef SUPPORT_TLS
   if (smtp_peer_options & PEER_OFFERED_TLS)
   if (smtp_peer_options & PEER_OFFERED_SIZE) argv[i++] = US"-MCS";
 #ifdef SUPPORT_TLS
   if (smtp_peer_options & PEER_OFFERED_TLS)

-    if (tls_out.active >= 0 || continue_proxy)
+    if (tls_out.active >= 0 || continue_proxy_cipher)

       {
       argv[i++] = US"-MCt";
       argv[i++] = sending_ip_address;
       argv[i++] = string_sprintf("%d", sending_port);
       {
       argv[i++] = US"-MCt";
       argv[i++] = sending_ip_address;
       argv[i++] = string_sprintf("%d", sending_port);

+      argv[i++] = tls_out.active >= 0 ? tls_out.cipher : continue_proxy_cipher;

       }
     else
       argv[i++] = US"-MCT";
       }
     else
       argv[i++] = US"-MCT";

diff --git a/src/src/transports/smtp.c b/src/src/transports/smtp.c
index 52e04b8a57a032082679a7a5929796b2903439e5..34c96dbff29829a0aa2fad65d2b057b33acd7a9d 100644 (file)
--- a/src/src/transports/smtp.c
+++ b/src/src/transports/smtp.c
@@ -1823,7 +1823,7 @@ else
   /* For a continued connection with TLS being proxied for us, nothing
   more to do. */
 
   /* For a continued connection with TLS being proxied for us, nothing
   more to do. */
 

-  if (continue_proxy)
+  if (continue_proxy_cipher)

     {
     sx->peer_offered = smtp_peer_options;
     pipelining_active = !!(smtp_peer_options & PEER_OFFERED_PIPE);
     {
     sx->peer_offered = smtp_peer_options;
     pipelining_active = !!(smtp_peer_options & PEER_OFFERED_PIPE);


@@ -3277,7 +3277,7 @@ if (sx.completed_addr && sx.ok && sx.send_quit)
      || continue_more
      || (
 #ifdef SUPPORT_TLS
      || continue_more
      || (
 #ifdef SUPPORT_TLS

-          (  tls_out.active < 0  &&  !continue_proxy
+          (  tls_out.active < 0  &&  !continue_proxy_cipher

            || verify_check_given_host(&sx.ob->hosts_nopass_tls, host) != OK
           )
         &&
            || verify_check_given_host(&sx.ob->hosts_nopass_tls, host) != OK
           )
         &&

diff --git a/test/log/2013 b/test/log/2013
index ad78743ec15523c670ba85189ca2cba05d6ffb3e..e66fdbfae0391c51b5cae6a33075a7acf7745d98 100644 (file)
--- a/test/log/2013
+++ b/test/log/2013
@@ -4,9 +4,9 @@
 1999-03-02 09:44:33 Start queue run: pid=pppp -qqf
 1999-03-02 09:44:33 10HmaX-0005vi-00 => userx@test.ex R=client T=send_to_server H=127.0.0.1 [127.0.0.1] X=TLS1.x:xxxxRSA_AES_256_CBC_SHAnnn:256 CV=no DN="C=UK,O=The Exim Maintainers,OU=Test Suite,CN=Phil Pennock" C="250 OK id=10HmbA-0005vi-00"
 1999-03-02 09:44:33 10HmaX-0005vi-00 Completed
 1999-03-02 09:44:33 Start queue run: pid=pppp -qqf
 1999-03-02 09:44:33 10HmaX-0005vi-00 => userx@test.ex R=client T=send_to_server H=127.0.0.1 [127.0.0.1] X=TLS1.x:xxxxRSA_AES_256_CBC_SHAnnn:256 CV=no DN="C=UK,O=The Exim Maintainers,OU=Test Suite,CN=Phil Pennock" C="250 OK id=10HmbA-0005vi-00"
 1999-03-02 09:44:33 10HmaX-0005vi-00 Completed

-1999-03-02 09:44:33 10HmaZ-0005vi-00 => userz@test.ex R=client T=send_to_server H=127.0.0.1 [127.0.0.1]* X=* CV=no C="250 OK id=10HmbB-0005vi-00"
+1999-03-02 09:44:33 10HmaZ-0005vi-00 => userz@test.ex R=client T=send_to_server H=127.0.0.1 [127.0.0.1]* X=TLS1.x:xxxxRSA_AES_256_CBC_SHAnnn:256 CV=no C="250 OK id=10HmbB-0005vi-00"

 1999-03-02 09:44:33 10HmaZ-0005vi-00 Completed
 1999-03-02 09:44:33 10HmaZ-0005vi-00 Completed

-1999-03-02 09:44:33 10HmaY-0005vi-00 => usery@test.ex R=client T=send_to_server H=127.0.0.1 [127.0.0.1]* X=* CV=no C="250 OK id=10HmbC-0005vi-00"
+1999-03-02 09:44:33 10HmaY-0005vi-00 => usery@test.ex R=client T=send_to_server H=127.0.0.1 [127.0.0.1]* X=TLS1.x:xxxxRSA_AES_256_CBC_SHAnnn:256 CV=no C="250 OK id=10HmbC-0005vi-00"

 1999-03-02 09:44:33 10HmaY-0005vi-00 Completed
 1999-03-02 09:44:33 End queue run: pid=pppp -qqf
 
 1999-03-02 09:44:33 10HmaY-0005vi-00 Completed
 1999-03-02 09:44:33 End queue run: pid=pppp -qqf
 

diff --git a/test/log/2113 b/test/log/2113
index 88eafe9b3d690ce7a50c4e80ab39f3a326d64b63..144154088f295a5a87bf16bbc0fefee99c105f50 100644 (file)
--- a/test/log/2113
+++ b/test/log/2113
@@ -4,9 +4,9 @@
 1999-03-02 09:44:33 Start queue run: pid=pppp -qqf
 1999-03-02 09:44:33 10HmaX-0005vi-00 => userx@test.ex R=client T=send_to_server H=127.0.0.1 [127.0.0.1] X=TLSv1:AES256-SHA:256 CV=no DN="/C=UK/O=The Exim Maintainers/OU=Test Suite/CN=Phil Pennock" C="250 OK id=10HmbA-0005vi-00"
 1999-03-02 09:44:33 10HmaX-0005vi-00 Completed
 1999-03-02 09:44:33 Start queue run: pid=pppp -qqf
 1999-03-02 09:44:33 10HmaX-0005vi-00 => userx@test.ex R=client T=send_to_server H=127.0.0.1 [127.0.0.1] X=TLSv1:AES256-SHA:256 CV=no DN="/C=UK/O=The Exim Maintainers/OU=Test Suite/CN=Phil Pennock" C="250 OK id=10HmbA-0005vi-00"
 1999-03-02 09:44:33 10HmaX-0005vi-00 Completed

-1999-03-02 09:44:33 10HmaZ-0005vi-00 => userz@test.ex R=client T=send_to_server H=127.0.0.1 [127.0.0.1]* X=* CV=no C="250 OK id=10HmbB-0005vi-00"
+1999-03-02 09:44:33 10HmaZ-0005vi-00 => userz@test.ex R=client T=send_to_server H=127.0.0.1 [127.0.0.1]* X=TLSv1:AES256-SHA:256 CV=no C="250 OK id=10HmbB-0005vi-00"

 1999-03-02 09:44:33 10HmaZ-0005vi-00 Completed
 1999-03-02 09:44:33 10HmaZ-0005vi-00 Completed

-1999-03-02 09:44:33 10HmaY-0005vi-00 => usery@test.ex R=client T=send_to_server H=127.0.0.1 [127.0.0.1]* X=* CV=no C="250 OK id=10HmbC-0005vi-00"
+1999-03-02 09:44:33 10HmaY-0005vi-00 => usery@test.ex R=client T=send_to_server H=127.0.0.1 [127.0.0.1]* X=TLSv1:AES256-SHA:256 CV=no C="250 OK id=10HmbC-0005vi-00"

 1999-03-02 09:44:33 10HmaY-0005vi-00 Completed
 1999-03-02 09:44:33 End queue run: pid=pppp -qqf
 
 1999-03-02 09:44:33 10HmaY-0005vi-00 Completed
 1999-03-02 09:44:33 End queue run: pid=pppp -qqf
 

diff --git a/test/stderr/2013 b/test/stderr/2013
index c183664d6ab6d5c99bda97dd83adb96097c5bdbe..4c1b0ce122b05af8d3e56b56ecbdcf0fe3050fb8 100644 (file)
--- a/test/stderr/2013
+++ b/test/stderr/2013
@@ -49,7 +49,7 @@ cmd buf flush ddd bytes
   SMTP<< 250 OK id=10HmbB-0005vi-00
   SMTP(close)>>
 LOG: MAIN
   SMTP<< 250 OK id=10HmbB-0005vi-00
   SMTP(close)>>
 LOG: MAIN

-  => userz@test.ex R=client T=send_to_server H=127.0.0.1 [127.0.0.1]* X=* CV=no C="250 OK id=10HmbB-0005vi-00"
+  => userz@test.ex R=client T=send_to_server H=127.0.0.1 [127.0.0.1]* X=TLS1.x:xxxxRSA_AES_256_CBC_SHAnnn:256 CV=no C="250 OK id=10HmbB-0005vi-00"

 LOG: MAIN
   Completed
 >>>>>>>>>>>>>>>> Exim pid=pppp terminating with rc=0 >>>>>>>>>>>>>>>>
 LOG: MAIN
   Completed
 >>>>>>>>>>>>>>>> Exim pid=pppp terminating with rc=0 >>>>>>>>>>>>>>>>


@@ -70,7 +70,7 @@ cmd buf flush ddd bytes
   SMTP(close)>>
 >>>>>>>>>>>>>>>> Exim pid=pppp terminating with rc=0 >>>>>>>>>>>>>>>>
 LOG: MAIN
   SMTP(close)>>
 >>>>>>>>>>>>>>>> Exim pid=pppp terminating with rc=0 >>>>>>>>>>>>>>>>
 LOG: MAIN

-  => usery@test.ex R=client T=send_to_server H=127.0.0.1 [127.0.0.1]* X=* CV=no C="250 OK id=10HmbC-0005vi-00"
+  => usery@test.ex R=client T=send_to_server H=127.0.0.1 [127.0.0.1]* X=TLS1.x:xxxxRSA_AES_256_CBC_SHAnnn:256 CV=no C="250 OK id=10HmbC-0005vi-00"

 LOG: MAIN
   Completed
 >>>>>>>>>>>>>>>> Exim pid=pppp terminating with rc=0 >>>>>>>>>>>>>>>>
 LOG: MAIN
   Completed
 >>>>>>>>>>>>>>>> Exim pid=pppp terminating with rc=0 >>>>>>>>>>>>>>>>

diff --git a/test/stderr/2113 b/test/stderr/2113
index ae0044b99674ce699997a66c0284ce9cb5d55760..af5ff730f9d1a1373563da6feb4a33e2082b03f4 100644 (file)
--- a/test/stderr/2113
+++ b/test/stderr/2113
@@ -49,7 +49,7 @@ cmd buf flush ddd bytes
   SMTP<< 250 OK id=10HmbB-0005vi-00
   SMTP(close)>>
 LOG: MAIN
   SMTP<< 250 OK id=10HmbB-0005vi-00
   SMTP(close)>>
 LOG: MAIN

-  => userz@test.ex R=client T=send_to_server H=127.0.0.1 [127.0.0.1]* X=* CV=no C="250 OK id=10HmbB-0005vi-00"
+  => userz@test.ex R=client T=send_to_server H=127.0.0.1 [127.0.0.1]* X=TLSv1:AES256-SHA:256 CV=no C="250 OK id=10HmbB-0005vi-00"

 LOG: MAIN
   Completed
 >>>>>>>>>>>>>>>> Exim pid=pppp terminating with rc=0 >>>>>>>>>>>>>>>>
 LOG: MAIN
   Completed
 >>>>>>>>>>>>>>>> Exim pid=pppp terminating with rc=0 >>>>>>>>>>>>>>>>


@@ -70,7 +70,7 @@ cmd buf flush ddd bytes
   SMTP(close)>>
 >>>>>>>>>>>>>>>> Exim pid=pppp terminating with rc=0 >>>>>>>>>>>>>>>>
 LOG: MAIN
   SMTP(close)>>
 >>>>>>>>>>>>>>>> Exim pid=pppp terminating with rc=0 >>>>>>>>>>>>>>>>
 LOG: MAIN

-  => usery@test.ex R=client T=send_to_server H=127.0.0.1 [127.0.0.1]* X=* CV=no C="250 OK id=10HmbC-0005vi-00"
+  => usery@test.ex R=client T=send_to_server H=127.0.0.1 [127.0.0.1]* X=TLSv1:AES256-SHA:256 CV=no C="250 OK id=10HmbC-0005vi-00"

 LOG: MAIN
   Completed
 >>>>>>>>>>>>>>>> Exim pid=pppp terminating with rc=0 >>>>>>>>>>>>>>>>
 LOG: MAIN
   Completed
 >>>>>>>>>>>>>>>> Exim pid=pppp terminating with rc=0 >>>>>>>>>>>>>>>>