Make smtp transport try server cert verify by default

This is an exim client checking a server certificate.

diff --git a/doc/doc-docbook/spec.xfpt b/doc/doc-docbook/spec.xfpt
index 7dfc4d623c11157d551fe01f3631fd49675291e7..b2b703b451ba60f9891a07d92700a4fb200eb778 100644 (file)
--- a/doc/doc-docbook/spec.xfpt
+++ b/doc/doc-docbook/spec.xfpt
@@ -23433,7 +23433,7 @@ unknown state), opens a new one to the same host, and then tries the delivery
 in clear.
 
 
 in clear.
 
 

-.option tls_try_verify_hosts smtp "host list&!!" unset
+.option tls_try_verify_hosts smtp "host list&!!" *

 .cindex "TLS" "server certificate verification"
 .cindex "certificate" "verification of server"
 This option gives a list of hosts for which, on encrypted connections,
 .cindex "TLS" "server certificate verification"
 .cindex "certificate" "verification of server"
 This option gives a list of hosts for which, on encrypted connections,


@@ -23489,6 +23489,7 @@ expansion of this option. See chapter &<<CHAPTLS>>& for details of TLS.
 
 For back-compatability,
 if neither tls_verify_hosts nor tls_try_verify_hosts are set
 
 For back-compatability,
 if neither tls_verify_hosts nor tls_try_verify_hosts are set

+(a single-colon empty list counts as being set)

 and certificate verification fails the TLS connection is closed.
 
 
 and certificate verification fails the TLS connection is closed.
 
 

diff --git a/doc/doc-txt/ChangeLog b/doc/doc-txt/ChangeLog
index 76d18a87c2af2589915716948faa5ed97a135fb5..ab55078086a53a315e0bb52fb3ab1065cee610b4 100644 (file)
--- a/doc/doc-txt/ChangeLog
+++ b/doc/doc-txt/ChangeLog
@@ -21,6 +21,9 @@ JH/05 The value of the tls_verify_certificates smtp transport and main options
       default to the word "system" to access the system default CA bundle.
       For GnuTLS, only version 3.0.20 or later.
 
       default to the word "system" to access the system default CA bundle.
       For GnuTLS, only version 3.0.20 or later.
 

+JH/06 Verification of the server certificate for a TLS connection is now tried
+      (but not required) by default.
+

 
 Exim version 4.85
 -----------------
 
 Exim version 4.85
 -----------------

diff --git a/src/src/tls-gnu.c b/src/src/tls-gnu.c
index 42d04224a4646ba1908d5c3f6987b269de2bc131..8b28d55664d779d1e6e01db346779511866298f5 100644 (file)
--- a/src/src/tls-gnu.c
+++ b/src/src/tls-gnu.c
@@ -853,14 +853,14 @@ error message is provided. However, if we just refrain from setting anything up
 in that case, certificate verification fails, which seems to be the correct
 behaviour. */
 
 in that case, certificate verification fails, which seems to be the correct
 behaviour. */
 

-if (  state->tls_verify_certificates && *state->tls_verify_certificates
-#ifndef SUPPORT_SYSDEFAULT_CABUNDLE
-   && Ustrcmp(state->exp_tls_verify_certificates, "system") != 0
-#endif
-   )
+if (state->tls_verify_certificates && *state->tls_verify_certificates)

   {
   if (!expand_check_tlsvar(tls_verify_certificates))
     return DEFER;
   {
   if (!expand_check_tlsvar(tls_verify_certificates))
     return DEFER;

+#ifndef SUPPORT_SYSDEFAULT_CABUNDLE
+  if (Ustrcmp(state->exp_tls_verify_certificates, "system") == 0)
+    state->exp_tls_verify_certificates = NULL;
+#endif

   if (state->tls_crl && *state->tls_crl)
     if (!expand_check_tlsvar(tls_crl))
       return DEFER;
   if (state->tls_crl && *state->tls_crl)
     if (!expand_check_tlsvar(tls_crl))
       return DEFER;


@@ -1860,7 +1860,7 @@ the specified host patterns if one of them is defined */
 
 if (  (  state->exp_tls_verify_certificates
       && !ob->tls_verify_hosts
 
 if (  (  state->exp_tls_verify_certificates
       && !ob->tls_verify_hosts

-      && !ob->tls_try_verify_hosts
+      && (!ob->tls_try_verify_hosts || !*ob->tls_try_verify_hosts)

       )
     || verify_check_given_host(&ob->tls_verify_hosts, host) == OK
    )
       )
     || verify_check_given_host(&ob->tls_verify_hosts, host) == OK
    )

diff --git a/src/src/tls-openssl.c b/src/src/tls-openssl.c
index bb17821e474d37fc39c31ebd1fee204041b255c8..ce6b47832843b06b17c4b804f11029b3f954be8e 100644 (file)
--- a/src/src/tls-openssl.c
+++ b/src/src/tls-openssl.c
@@ -1686,7 +1686,9 @@ int rc;
    set but both tls_verify_hosts and tls_try_verify_hosts is not set. Check only
    the specified host patterns if one of them is defined */
 
    set but both tls_verify_hosts and tls_try_verify_hosts is not set. Check only
    the specified host patterns if one of them is defined */
 

-if (  (!ob->tls_verify_hosts && !ob->tls_try_verify_hosts)
+if (  (  !ob->tls_verify_hosts
+      && (!ob->tls_try_verify_hosts || !*ob->tls_try_verify_hosts)
+      )

    || (verify_check_given_host(&ob->tls_verify_hosts, host) == OK)
    )
   client_verify_optional = FALSE;
    || (verify_check_given_host(&ob->tls_verify_hosts, host) == OK)
    )
   client_verify_optional = FALSE;

diff --git a/src/src/transports/smtp.c b/src/src/transports/smtp.c
index a455ba5532afcf1298ac3df6be3bd9741de12d5f..181081b60eff7fff285d2afa57ca2ec5d44d28fb 100644 (file)
--- a/src/src/transports/smtp.c
+++ b/src/src/transports/smtp.c
@@ -260,7 +260,7 @@ smtp_transport_options_block smtp_transport_option_defaults = {
                        /* tls_dh_min_bits */
   TRUE,                /* tls_tempfail_tryclear */
   NULL,                /* tls_verify_hosts */
                        /* tls_dh_min_bits */
   TRUE,                /* tls_tempfail_tryclear */
   NULL,                /* tls_verify_hosts */

-  NULL,                /* tls_try_verify_hosts */
+  US"*",               /* tls_try_verify_hosts */

   US"*"                /* tls_verify_cert_hostnames */
 #endif
 #ifndef DISABLE_DKIM
   US"*"                /* tls_verify_cert_hostnames */
 #endif
 #ifndef DISABLE_DKIM

diff --git a/test/confs/2000 b/test/confs/2000
index 06e5a153cab4558f1a2b0ea2d98e244f05d217ca..bc4fff2a4cd6d77bb2eb251b21f3166099bab783 100644 (file)
--- a/test/confs/2000
+++ b/test/confs/2000
@@ -56,6 +56,7 @@ send_to_server:
   tls_certificate = DIR/aux-fixed/cert2
   tls_privatekey = DIR/aux-fixed/cert2
   tls_verify_certificates = DIR/aux-fixed/cert2
   tls_certificate = DIR/aux-fixed/cert2
   tls_privatekey = DIR/aux-fixed/cert2
   tls_verify_certificates = DIR/aux-fixed/cert2

+  tls_try_verify_hosts =

 
 
 # ----- Retry -----
 
 
 # ----- Retry -----

diff --git a/test/confs/2001 b/test/confs/2001
index 741796b678cd6c3ac3e1987d8270447737607178..7e49aeda20085264b5415a1fad67c31f45108e46 100644 (file)
--- a/test/confs/2001
+++ b/test/confs/2001
@@ -56,6 +56,7 @@ send_to_server:
   tls_certificate = DIR/aux-fixed/cert2
   tls_privatekey = DIR/aux-fixed/cert2
   tls_verify_certificates = DIR/aux-fixed/cert2
   tls_certificate = DIR/aux-fixed/cert2
   tls_privatekey = DIR/aux-fixed/cert2
   tls_verify_certificates = DIR/aux-fixed/cert2

+  tls_try_verify_hosts =

 
 
 # ----- Retry -----
 
 
 # ----- Retry -----

diff --git a/test/confs/2012 b/test/confs/2012
index 6bc5487fffbc9edc4ef5790a8640bc933ff5b30a..023a594a8a456fd3fc04b132c6c741ad160d9289 100644 (file)
--- a/test/confs/2012
+++ b/test/confs/2012
@@ -104,6 +104,7 @@ send_to_server_failcert:
   tls_privatekey = CERT2
 
   tls_verify_certificates = CA2
   tls_privatekey = CERT2
 
   tls_verify_certificates = CA2

+  tls_try_verify_hosts =

   tls_verify_cert_hostnames =
 
 # this will fail to verify the cert at HOSTIPV4 so fail the crypt, then retry on 127.1; ok
   tls_verify_cert_hostnames =
 
 # this will fail to verify the cert at HOSTIPV4 so fail the crypt, then retry on 127.1; ok


@@ -118,6 +119,7 @@ send_to_server_retry:
 
   tls_verify_certificates = \
     ${if eq{$host_address}{127.0.0.1}{CA1}{CA2}}
 
   tls_verify_certificates = \
     ${if eq{$host_address}{127.0.0.1}{CA1}{CA2}}

+  tls_try_verify_hosts =

   tls_verify_cert_hostnames =
 
 # this will fail to verify the cert but continue unverified though crypted
   tls_verify_cert_hostnames =
 
 # this will fail to verify the cert but continue unverified though crypted

diff --git a/test/confs/2100 b/test/confs/2100
index 791c6bd436699dadcc02ba5e4f1c99d11c3abd73..c6a7e698e4a4812c335dcc88b63dd02ca588d28d 100644 (file)
--- a/test/confs/2100
+++ b/test/confs/2100
@@ -54,6 +54,7 @@ send_to_server:
   tls_certificate = DIR/aux-fixed/cert2
   tls_privatekey = DIR/aux-fixed/cert2
   tls_verify_certificates = DIR/aux-fixed/cert2
   tls_certificate = DIR/aux-fixed/cert2
   tls_privatekey = DIR/aux-fixed/cert2
   tls_verify_certificates = DIR/aux-fixed/cert2

+  tls_try_verify_hosts = :

 
 
 # ----- Retry -----
 
 
 # ----- Retry -----

diff --git a/test/confs/2101 b/test/confs/2101
index 73e0bdd7dc4732c58281c501611fdabc4e536db1..99fad1a4857442f75db1cfd98925eae5e7a3afb8 100644 (file)
--- a/test/confs/2101
+++ b/test/confs/2101
@@ -56,6 +56,7 @@ send_to_server:
   tls_certificate = DIR/aux-fixed/cert2
   tls_privatekey = DIR/aux-fixed/cert2
   tls_verify_certificates = DIR/aux-fixed/cert2
   tls_certificate = DIR/aux-fixed/cert2
   tls_privatekey = DIR/aux-fixed/cert2
   tls_verify_certificates = DIR/aux-fixed/cert2

+  tls_try_verify_hosts =

 
 
 # ----- Retry -----
 
 
 # ----- Retry -----

diff --git a/test/confs/2112 b/test/confs/2112
index 2c81e0cf3a2240250379031b171e5edd39820add..d21fee0648f04b7c9241e37192cce98942a0549e 100644 (file)
--- a/test/confs/2112
+++ b/test/confs/2112
@@ -104,6 +104,7 @@ send_to_server_failcert:
   tls_privatekey = CERT2
 
   tls_verify_certificates = CA2
   tls_privatekey = CERT2
 
   tls_verify_certificates = CA2

+  tls_try_verify_hosts =

   tls_verify_cert_hostnames =
 
 # this will fail to verify the cert at HOSTIPV4 so fail the crypt, then retry on 127.1; ok
   tls_verify_cert_hostnames =
 
 # this will fail to verify the cert at HOSTIPV4 so fail the crypt, then retry on 127.1; ok


@@ -118,6 +119,7 @@ send_to_server_retry:
 
   tls_verify_certificates = \
     ${if eq{$host_address}{127.0.0.1}{CA1}{CA2}}
 
   tls_verify_certificates = \
     ${if eq{$host_address}{127.0.0.1}{CA1}{CA2}}

+  tls_try_verify_hosts =

   tls_verify_cert_hostnames =
 
 # this will fail to verify the cert but continue unverified though crypted
   tls_verify_cert_hostnames =
 
 # this will fail to verify the cert but continue unverified though crypted

diff --git a/test/confs/2113 b/test/confs/2113
index bff43ff574fb9ba3d9dd8bb95acf1c459c7b7ee3..d5be248615d607c25bb70e499ddb2af7a8c9993a 100644 (file)
--- a/test/confs/2113
+++ b/test/confs/2113
@@ -61,5 +61,6 @@ send_to_server:
   allow_localhost
   hosts = 127.0.0.1
   port = PORT_D
   allow_localhost
   hosts = 127.0.0.1
   port = PORT_D

+  tls_try_verify_hosts = :

 
 # End
 
 # End

diff --git a/test/confs/2117 b/test/confs/2117
index 16cc0c39e75652850e70fb6cd2bc4765d67b18a3..ab809d0817333dc1e31c83dde83aac99bad708d1 100644 (file)
--- a/test/confs/2117
+++ b/test/confs/2117
@@ -60,6 +60,7 @@ send_to_server:
   hosts = 127.0.0.1
   hosts_nopass_tls = *
   port = PORT_D
   hosts = 127.0.0.1
   hosts_nopass_tls = *
   port = PORT_D

+  tls_try_verify_hosts = :

 
 
 # ----- Retry -----
 
 
 # ----- Retry -----

diff --git a/test/confs/2125 b/test/confs/2125
index 70736be88ec74991a68b82d3086d7374ffdcf26a..767bb1c4fc724d2f2ec676ff5617ca79d252f686 100644 (file)
--- a/test/confs/2125
+++ b/test/confs/2125
@@ -53,6 +53,7 @@ send_to_server:
   hosts_require_tls = HOSTIPV4
   tls_require_ciphers = DES-CBC3-SHA
   port = PORT_D
   hosts_require_tls = HOSTIPV4
   tls_require_ciphers = DES-CBC3-SHA
   port = PORT_D

+  tls_try_verify_hosts = :

 
 
 # ----- Retry -----
 
 
 # ----- Retry -----

diff --git a/test/confs/2126 b/test/confs/2126
index e2b79016856d98e5888e33fca4aaaeee447d8062..704346e5655105b8c88da59837d883082ee53caa 100644 (file)
--- a/test/confs/2126
+++ b/test/confs/2126
@@ -57,6 +57,7 @@ t1:
   hosts = 127.0.0.1 : HOSTIPV4
   port = PORT_D
   allow_localhost
   hosts = 127.0.0.1 : HOSTIPV4
   port = PORT_D
   allow_localhost

+  tls_try_verify_hosts = :

 
 t2:
   driver = appendfile
 
 t2:
   driver = appendfile

diff --git a/test/confs/2127 b/test/confs/2127
index 3639c5bbf38580e9f4286a54c89721abb3de5bf9..862ad710d05e94815370918a7fddb760c8b01156 100644 (file)
--- a/test/confs/2127
+++ b/test/confs/2127
@@ -56,5 +56,6 @@ send_to_server:
   allow_localhost
   hosts = ${if eq{$local_part}{userx}{127.0.0.1}{HOSTIPV4}}
   port = PORT_D
   allow_localhost
   hosts = ${if eq{$local_part}{userx}{127.0.0.1}{HOSTIPV4}}
   port = PORT_D

+  tls_try_verify_hosts = :

 
 # End
 
 # End

diff --git a/test/confs/2130 b/test/confs/2130
index 4143fc8caaae6008440dc59588d452de56c4d805..9f6de76b474732bd8020d11c0232231a25cb49a2 100644 (file)
--- a/test/confs/2130
+++ b/test/confs/2130
@@ -60,12 +60,14 @@ send_to_server1:
   hosts = HOSTIPV4
   port = PORT_D
   tls_sni = fred
   hosts = HOSTIPV4
   port = PORT_D
   tls_sni = fred

+  tls_try_verify_hosts = :

 
 send_to_server2:
   driver = smtp
   allow_localhost
   hosts = HOSTIPV4
   port = PORT_D
 
 send_to_server2:
   driver = smtp
   allow_localhost
   hosts = HOSTIPV4
   port = PORT_D

+  tls_try_verify_hosts = :

 
 
 # ----- Retry -----
 
 
 # ----- Retry -----

diff --git a/test/confs/2131 b/test/confs/2131
index 8566c24baf443761bca90fb0a322e7da0d244ff6..53c06f1f735413aa21b12f17b816c7c322b2fcf3 100644 (file)
--- a/test/confs/2131
+++ b/test/confs/2131
@@ -73,6 +73,7 @@ send_to_server1:
   port = PORT_D
   tls_sni = fred
   hosts_require_tls = *
   port = PORT_D
   tls_sni = fred
   hosts_require_tls = *

+  tls_try_verify_hosts = :

 
 send_to_server2:
   driver = smtp
 
 send_to_server2:
   driver = smtp


@@ -81,6 +82,7 @@ send_to_server2:
   port = PORT_D
   tls_sni = bill
   hosts_require_tls = *
   port = PORT_D
   tls_sni = bill
   hosts_require_tls = *

+  tls_try_verify_hosts = :

 
 
 # ----- Retry -----
 
 
 # ----- Retry -----

diff --git a/test/confs/2149 b/test/confs/2149
index 1684f11c6af54adeb135dc71068b9b7e9252286a..cf67f8cbcb66308bf00e9bc7c2f445adf1782907 100644 (file)
--- a/test/confs/2149
+++ b/test/confs/2149
@@ -55,5 +55,6 @@ send_to_server:
   allow_localhost
   hosts = 127.0.0.1
   port = PORT_D
   allow_localhost
   hosts = 127.0.0.1
   port = PORT_D

+  tls_try_verify_hosts = :

 
 # End
 
 # End

diff --git a/test/confs/3461 b/test/confs/3461
index 48fe4da3ef557640a165bcda537f929794b30674..93ab8d8d82dcf5463dce4b52f563a91d81ef8634 100644 (file)
--- a/test/confs/3461
+++ b/test/confs/3461
@@ -75,5 +75,6 @@ send_to_server:
   hosts = 127.0.0.1
   hosts_try_auth = *
   port = PORT_D
   hosts = 127.0.0.1
   hosts_try_auth = *
   port = PORT_D

+  tls_try_verify_hosts = :

 
 # End
 
 # End

diff --git a/test/confs/3462 b/test/confs/3462
index ec155bfddbb15eff4c860b24e4cbdae663aee23e..3907aecef51265ab97138b7dc358eda056b37d68 100644 (file)
--- a/test/confs/3462
+++ b/test/confs/3462
@@ -74,6 +74,7 @@ send_to_server:
   hosts = 127.0.0.1
   hosts_try_auth = *
   port = PORT_D
   hosts = 127.0.0.1
   hosts_try_auth = *
   port = PORT_D

+  tls_try_verify_hosts = :

 
 
 # ----- Retry -----
 
 
 # ----- Retry -----

diff --git a/test/confs/3465 b/test/confs/3465
index 83592a678c3a6ebd663fe581fa3c69ea98dbba68..2f2061be0cb687a1d7c11dcba8f525feed0c74de 100644 (file)
--- a/test/confs/3465
+++ b/test/confs/3465
@@ -67,6 +67,7 @@ t1:
   hosts = 127.0.0.1
   port = PORT_D
   hosts_avoid_tls = HOSTS_AVOID_TLS
   hosts = 127.0.0.1
   port = PORT_D
   hosts_avoid_tls = HOSTS_AVOID_TLS

+  tls_try_verify_hosts = :

   hosts_require_auth = *
   allow_localhost
 
   hosts_require_auth = *
   allow_localhost
 

diff --git a/test/confs/5410 b/test/confs/5410
index 576967cacb977d6ea124086542ee17fca9f1cdf8..bea8e10bac2ec38e90b8272566f54efa31c752a6 100644 (file)
--- a/test/confs/5410
+++ b/test/confs/5410
@@ -54,6 +54,7 @@ smtp:
   port = PORT_D
   hosts_avoid_tls =        ${if eq {$address_data}{usery}{*}{:}}
   hosts_verify_avoid_tls = ${if eq {$address_data}{userz}{*}{:}}
   port = PORT_D
   hosts_avoid_tls =        ${if eq {$address_data}{usery}{*}{:}}
   hosts_verify_avoid_tls = ${if eq {$address_data}{userz}{*}{:}}

+  tls_try_verify_hosts = :

 
 
 # End
 
 
 # End

diff --git a/test/confs/5651 b/test/confs/5651
index 19f16d03dd4f5e531e13096a78b7ca9f6cb7ced7..f09df575b02decd9ad12ccaa84eb5004e723a112 100644 (file)
--- a/test/confs/5651
+++ b/test/confs/5651
@@ -116,6 +116,7 @@ send_to_server3:
   helo_data = helo.data.changed
   #tls_verify_certificates = DIR/aux-fixed/exim-ca/example.com/server1.example.com/ca_chain.pem
   tls_verify_certificates = DIR/aux-fixed/exim-ca/example.com/CA/CA.pem
   helo_data = helo.data.changed
   #tls_verify_certificates = DIR/aux-fixed/exim-ca/example.com/server1.example.com/ca_chain.pem
   tls_verify_certificates = DIR/aux-fixed/exim-ca/example.com/CA/CA.pem

+  tls_try_verify_hosts =

   tls_verify_cert_hostnames =
   hosts_require_tls =  *
   hosts_require_ocsp = *
   tls_verify_cert_hostnames =
   hosts_require_tls =  *
   hosts_require_ocsp = *

diff --git a/test/confs/5658 b/test/confs/5658
index de486e083f3d370246b45ed5008c56699beb1625..6a75b8c675e315a5115f7147e9b2e0b626e1c6ae 100644 (file)
--- a/test/confs/5658
+++ b/test/confs/5658
@@ -125,6 +125,7 @@ send_to_server3:
   helo_data = helo.data.changed
   #tls_verify_certificates = DIR/aux-fixed/exim-ca/example.com/server1.example.com/ca_chain.pem
   tls_verify_certificates = DIR/aux-fixed/exim-ca/example.com/CA/CA.pem
   helo_data = helo.data.changed
   #tls_verify_certificates = DIR/aux-fixed/exim-ca/example.com/server1.example.com/ca_chain.pem
   tls_verify_certificates = DIR/aux-fixed/exim-ca/example.com/CA/CA.pem

+  tls_try_verify_hosts =

   tls_verify_cert_hostnames =
   hosts_require_tls =  *
   hosts_require_ocsp = *
   tls_verify_cert_hostnames =
   hosts_require_tls =  *
   hosts_require_ocsp = *

diff --git a/test/confs/5750 b/test/confs/5750
index d1e2e7ce05c42c783e8ae7665d9da247869beaf3..98fd46f7d05cf5479e07686a5d120f80df59cd06 100644 (file)
--- a/test/confs/5750
+++ b/test/confs/5750
@@ -104,6 +104,7 @@ send_to_server:
        ${if eq {$local_part}{good}\
 {example.com/server1.example.com/ca_chain.pem}\
 {example.net/server1.example.net/ca_chain.pem}}
        ${if eq {$local_part}{good}\
 {example.com/server1.example.com/ca_chain.pem}\
 {example.net/server1.example.net/ca_chain.pem}}

+  tls_try_verify_hosts =

   tls_verify_cert_hostnames =
 
   event_action =   ${acl {logger} {$event_name} {$domain} }
   tls_verify_cert_hostnames =
 
   event_action =   ${acl {logger} {$event_name} {$domain} }

diff --git a/test/confs/5760 b/test/confs/5760
index 80dde3e151b22f1789b07adc38a36b7dbb269ec4..03d1a6b0a84d823205f9c9df2aa3cdbcea6cf492 100644 (file)
--- a/test/confs/5760
+++ b/test/confs/5760
@@ -105,6 +105,7 @@ send_to_server:
 {example.com/server1.example.com/ca_chain.pem}\
 {example.net/server1.example.net/ca_chain.pem}}
   tls_verify_cert_hostnames =
 {example.com/server1.example.com/ca_chain.pem}\
 {example.net/server1.example.net/ca_chain.pem}}
   tls_verify_cert_hostnames =

+  tls_try_verify_hosts =

 
   event_action =   ${acl {logger} {$event_name} {$domain} }
 
 
   event_action =   ${acl {logger} {$event_name} {$domain} }
 

diff --git a/test/log/2100 b/test/log/2100
index 02b6f0e607971f923a95dfb508fbf57a144494c0..9c57bffcc20d0f37a75100117e088ef5c2e86a89 100644 (file)
--- a/test/log/2100
+++ b/test/log/2100
@@ -1,14 +1,9 @@
 1999-03-02 09:44:33 10HmaX-0005vi-00 <= CALLER@myhost.test.ex U=CALLER P=local S=sss
 1999-03-02 09:44:33 Start queue run: pid=pppp -qf
 1999-03-02 09:44:33 10HmaX-0005vi-00 <= CALLER@myhost.test.ex U=CALLER P=local S=sss
 1999-03-02 09:44:33 Start queue run: pid=pppp -qf

-1999-03-02 09:44:33 10HmaX-0005vi-00 SSL verify error: depth=0 error=self signed certificate cert=/C=UK/O=The Exim Maintainers/OU=Test Suite/CN=Phil Pennock
-1999-03-02 09:44:33 10HmaX-0005vi-00 H=127.0.0.1 [127.0.0.1] TLS error on connection (SSL_connect): error: <<detail omitted>>
-1999-03-02 09:44:33 10HmaX-0005vi-00 TLS session failure: delivering unencrypted to 127.0.0.1 [127.0.0.1] (not in hosts_require_tls)
-1999-03-02 09:44:33 10HmaX-0005vi-00 => CALLER@test.ex R=client T=send_to_server H=127.0.0.1 [127.0.0.1] C="250 OK id=10HmaY-0005vi-00"
+1999-03-02 09:44:33 10HmaX-0005vi-00 => CALLER@test.ex R=client T=send_to_server H=127.0.0.1 [127.0.0.1] X=TLSv1:AES256-SHA:256 DN="/C=UK/O=The Exim Maintainers/OU=Test Suite/CN=Phil Pennock" C="250 OK id=10HmaY-0005vi-00"

 1999-03-02 09:44:33 10HmaX-0005vi-00 Completed
 1999-03-02 09:44:33 End queue run: pid=pppp -qf
 
 ******** SERVER ********
 1999-03-02 09:44:33 exim x.yz daemon started: pid=pppp, no queue runs, listening for SMTP on port 1225
 1999-03-02 09:44:33 10HmaX-0005vi-00 Completed
 1999-03-02 09:44:33 End queue run: pid=pppp -qf
 
 ******** SERVER ********
 1999-03-02 09:44:33 exim x.yz daemon started: pid=pppp, no queue runs, listening for SMTP on port 1225

-1999-03-02 09:44:33 TLS error on connection from localhost (myhost.test.ex) [127.0.0.1] (SSL_accept): error: <<detail omitted>>
-1999-03-02 09:44:33 TLS client disconnected cleanly (rejected our certificate?)
-1999-03-02 09:44:33 10HmaY-0005vi-00 <= CALLER@myhost.test.ex H=localhost (myhost.test.ex) [127.0.0.1] P=esmtp S=sss id=E10HmaX-0005vi-00@myhost.test.ex
+1999-03-02 09:44:33 10HmaY-0005vi-00 <= CALLER@myhost.test.ex H=localhost (myhost.test.ex) [127.0.0.1] P=esmtps X=TLSv1:AES256-SHA:256 DN="/C=UK/O=The Exim Maintainers/OU=Test Suite/CN=Phil Pennock" S=sss id=E10HmaX-0005vi-00@myhost.test.ex

diff --git a/test/log/2107 b/test/log/2107
index 5d3817accebb49f2ee19ffc2f4d3bfc7a2ca67a0..73b5d8e59fe848e5c244959d38f1fcfb7145fb77 100644 (file)
--- a/test/log/2107
+++ b/test/log/2107
@@ -1,5 +1,8 @@
 1999-03-02 09:44:33 10HmaX-0005vi-00 <= CALLER@myhost.test.ex U=CALLER P=local S=sss
 1999-03-02 09:44:33 Start queue run: pid=pppp -qf
 1999-03-02 09:44:33 10HmaX-0005vi-00 <= CALLER@myhost.test.ex U=CALLER P=local S=sss
 1999-03-02 09:44:33 Start queue run: pid=pppp -qf

+1999-03-02 09:44:33 10HmaX-0005vi-00 SSL verify error: depth=0 error=self signed certificate cert=/C=UK/O=The Exim Maintainers/OU=Test Suite/CN=Phil Pennock
+1999-03-02 09:44:33 10HmaX-0005vi-00 SSL verify error: certificate name mismatch: "/C=UK/O=The Exim Maintainers/OU=Test Suite/CN=Phil Pennock"
+

 1999-03-02 09:44:33 10HmaX-0005vi-00 => userx@test.ex R=client T=send_to_server1 H=127.0.0.1 [127.0.0.1] X=TLSv1:AES256-SHA:256 DN="/C=UK/O=The Exim Maintainers/OU=Test Suite/CN=Phil Pennock" C="250 OK id=10HmaY-0005vi-00"
 1999-03-02 09:44:33 10HmaX-0005vi-00 Completed
 1999-03-02 09:44:33 End queue run: pid=pppp -qf
 1999-03-02 09:44:33 10HmaX-0005vi-00 => userx@test.ex R=client T=send_to_server1 H=127.0.0.1 [127.0.0.1] X=TLSv1:AES256-SHA:256 DN="/C=UK/O=The Exim Maintainers/OU=Test Suite/CN=Phil Pennock" C="250 OK id=10HmaY-0005vi-00"
 1999-03-02 09:44:33 10HmaX-0005vi-00 Completed
 1999-03-02 09:44:33 End queue run: pid=pppp -qf

diff --git a/test/log/2108 b/test/log/2108
index 12ab295f494ea7b2d5c88f4a6b9d29cb87ae5685..b727ccb55d24b94796051badf0c2300d57f4d386 100644 (file)
--- a/test/log/2108
+++ b/test/log/2108
@@ -1,10 +1,19 @@
 1999-03-02 09:44:33 10HmaX-0005vi-00 <= CALLER@myhost.test.ex U=CALLER P=local S=sss
 1999-03-02 09:44:33 10HmaY-0005vi-00 <= CALLER@myhost.test.ex U=CALLER P=local S=sss
 1999-03-02 09:44:33 Start queue run: pid=pppp -qf
 1999-03-02 09:44:33 10HmaX-0005vi-00 <= CALLER@myhost.test.ex U=CALLER P=local S=sss
 1999-03-02 09:44:33 10HmaY-0005vi-00 <= CALLER@myhost.test.ex U=CALLER P=local S=sss
 1999-03-02 09:44:33 Start queue run: pid=pppp -qf

+1999-03-02 09:44:33 10HmaX-0005vi-00 SSL verify error: depth=0 error=self signed certificate cert=/C=UK/O=The Exim Maintainers/OU=Test Suite/CN=Phil Pennock
+1999-03-02 09:44:33 10HmaX-0005vi-00 SSL verify error: certificate name mismatch: "/C=UK/O=The Exim Maintainers/OU=Test Suite/CN=Phil Pennock"
+

 1999-03-02 09:44:33 10HmaX-0005vi-00 => CALLER@test.ex R=client T=send_to_server1 H=127.0.0.1 [127.0.0.1] X=TLSv1:AES256-SHA:256 DN="/C=UK/O=The Exim Maintainers/OU=Test Suite/CN=Phil Pennock" C="250 OK id=10HmaZ-0005vi-00"
 1999-03-02 09:44:33 10HmaX-0005vi-00 Completed
 1999-03-02 09:44:33 10HmaX-0005vi-00 => CALLER@test.ex R=client T=send_to_server1 H=127.0.0.1 [127.0.0.1] X=TLSv1:AES256-SHA:256 DN="/C=UK/O=The Exim Maintainers/OU=Test Suite/CN=Phil Pennock" C="250 OK id=10HmaZ-0005vi-00"
 1999-03-02 09:44:33 10HmaX-0005vi-00 Completed

+1999-03-02 09:44:33 10HmaY-0005vi-00 SSL verify error: depth=0 error=self signed certificate cert=/C=UK/O=The Exim Maintainers/OU=Test Suite/CN=Phil Pennock
+1999-03-02 09:44:33 10HmaY-0005vi-00 SSL verify error: certificate name mismatch: "/C=UK/O=The Exim Maintainers/OU=Test Suite/CN=Phil Pennock"
+

 1999-03-02 09:44:33 10HmaY-0005vi-00 => CALLER@test.ex R=client T=send_to_server1 H=127.0.0.1 [127.0.0.1] X=TLSv1:AES256-SHA:256 DN="/C=UK/O=The Exim Maintainers/OU=Test Suite/CN=Phil Pennock" C="250 OK id=10HmbA-0005vi-00"
 1999-03-02 09:44:33 10HmaY-0005vi-00 -> xyz@test.ex R=client T=send_to_server1 H=127.0.0.1 [127.0.0.1] X=TLSv1:AES256-SHA:256 DN="/C=UK/O=The Exim Maintainers/OU=Test Suite/CN=Phil Pennock" C="250 OK id=10HmbA-0005vi-00"
 1999-03-02 09:44:33 10HmaY-0005vi-00 => CALLER@test.ex R=client T=send_to_server1 H=127.0.0.1 [127.0.0.1] X=TLSv1:AES256-SHA:256 DN="/C=UK/O=The Exim Maintainers/OU=Test Suite/CN=Phil Pennock" C="250 OK id=10HmbA-0005vi-00"
 1999-03-02 09:44:33 10HmaY-0005vi-00 -> xyz@test.ex R=client T=send_to_server1 H=127.0.0.1 [127.0.0.1] X=TLSv1:AES256-SHA:256 DN="/C=UK/O=The Exim Maintainers/OU=Test Suite/CN=Phil Pennock" C="250 OK id=10HmbA-0005vi-00"

+1999-03-02 09:44:33 10HmaY-0005vi-00 SSL verify error: depth=0 error=self signed certificate cert=/C=UK/O=The Exim Maintainers/OU=Test Suite/CN=Phil Pennock
+1999-03-02 09:44:33 10HmaY-0005vi-00 SSL verify error: certificate name mismatch: "/C=UK/O=The Exim Maintainers/OU=Test Suite/CN=Phil Pennock"
+

 1999-03-02 09:44:33 10HmaY-0005vi-00 => abcd@test.ex R=client T=send_to_server2 H=ip4.ip4.ip4.ip4 [ip4.ip4.ip4.ip4] X=TLSv1:AES256-SHA:256 DN="/C=UK/O=The Exim Maintainers/OU=Test Suite/CN=Phil Pennock" C="250 OK id=10HmbB-0005vi-00"
 1999-03-02 09:44:33 10HmaY-0005vi-00 Completed
 1999-03-02 09:44:33 End queue run: pid=pppp -qf
 1999-03-02 09:44:33 10HmaY-0005vi-00 => abcd@test.ex R=client T=send_to_server2 H=ip4.ip4.ip4.ip4 [ip4.ip4.ip4.ip4] X=TLSv1:AES256-SHA:256 DN="/C=UK/O=The Exim Maintainers/OU=Test Suite/CN=Phil Pennock" C="250 OK id=10HmbB-0005vi-00"
 1999-03-02 09:44:33 10HmaY-0005vi-00 Completed
 1999-03-02 09:44:33 End queue run: pid=pppp -qf

diff --git a/test/log/2110 b/test/log/2110
index 72f08dc2020aba84688e1139f1ff7c86f71763e6..574b1b7b855bd63a463c0406442a9b54d16f0c83 100644 (file)
--- a/test/log/2110
+++ b/test/log/2110
@@ -1,6 +1,9 @@
 1999-03-02 09:44:33 10HmaX-0005vi-00 <= CALLER@myhost.test.ex U=CALLER P=local S=sss
 1999-03-02 09:44:33 Start queue run: pid=pppp -qf
 1999-03-02 09:44:33 10HmaX-0005vi-00 H=127.0.0.1 [127.0.0.1]: a TLS session is required, but the server did not offer TLS support
 1999-03-02 09:44:33 10HmaX-0005vi-00 <= CALLER@myhost.test.ex U=CALLER P=local S=sss
 1999-03-02 09:44:33 Start queue run: pid=pppp -qf
 1999-03-02 09:44:33 10HmaX-0005vi-00 H=127.0.0.1 [127.0.0.1]: a TLS session is required, but the server did not offer TLS support

+1999-03-02 09:44:33 10HmaX-0005vi-00 SSL verify error: depth=0 error=self signed certificate cert=/C=UK/O=The Exim Maintainers/OU=Test Suite/CN=Phil Pennock
+1999-03-02 09:44:33 10HmaX-0005vi-00 SSL verify error: certificate name mismatch: "/C=UK/O=The Exim Maintainers/OU=Test Suite/CN=Phil Pennock"
+

 1999-03-02 09:44:33 10HmaX-0005vi-00 => userx@test.ex R=client T=send_to_server H=ip4.ip4.ip4.ip4 [ip4.ip4.ip4.ip4] X=TLSv1:AES256-SHA:256 C="250 OK id=10HmaY-0005vi-00"
 1999-03-02 09:44:33 10HmaX-0005vi-00 Completed
 1999-03-02 09:44:33 End queue run: pid=pppp -qf
 1999-03-02 09:44:33 10HmaX-0005vi-00 => userx@test.ex R=client T=send_to_server H=ip4.ip4.ip4.ip4 [ip4.ip4.ip4.ip4] X=TLSv1:AES256-SHA:256 C="250 OK id=10HmaY-0005vi-00"
 1999-03-02 09:44:33 10HmaX-0005vi-00 Completed
 1999-03-02 09:44:33 End queue run: pid=pppp -qf

diff --git a/test/log/2111 b/test/log/2111
index 0fef3f4089ea153c4aeeb7203f4f7ef8e551f8cf..584c3deb5e4b989c508f2688e8e0d1268c6f81de 100644 (file)
--- a/test/log/2111
+++ b/test/log/2111
@@ -1,6 +1,9 @@
 1999-03-02 09:44:33 10HmaX-0005vi-00 <= CALLER@myhost.test.ex U=CALLER P=local S=sss
 1999-03-02 09:44:33 Start queue run: pid=pppp -qf
 1999-03-02 09:44:33 10HmaX-0005vi-00 H=ip4.ip4.ip4.ip4 [ip4.ip4.ip4.ip4] TLS error on connection (SSL_connect): error: <<detail omitted>>
 1999-03-02 09:44:33 10HmaX-0005vi-00 <= CALLER@myhost.test.ex U=CALLER P=local S=sss
 1999-03-02 09:44:33 Start queue run: pid=pppp -qf
 1999-03-02 09:44:33 10HmaX-0005vi-00 H=ip4.ip4.ip4.ip4 [ip4.ip4.ip4.ip4] TLS error on connection (SSL_connect): error: <<detail omitted>>

+1999-03-02 09:44:33 10HmaX-0005vi-00 SSL verify error: depth=0 error=self signed certificate cert=/C=UK/O=The Exim Maintainers/OU=Test Suite/CN=Phil Pennock
+1999-03-02 09:44:33 10HmaX-0005vi-00 SSL verify error: certificate name mismatch: "/C=UK/O=The Exim Maintainers/OU=Test Suite/CN=Phil Pennock"
+

 1999-03-02 09:44:33 10HmaX-0005vi-00 => userx@test.ex R=client T=send_to_server H=127.0.0.1 [127.0.0.1] X=TLSv1:DES-CBC3-SHA:168 DN="/C=UK/O=The Exim Maintainers/OU=Test Suite/CN=Phil Pennock" C="250 OK id=10HmaY-0005vi-00"
 1999-03-02 09:44:33 10HmaX-0005vi-00 Completed
 1999-03-02 09:44:33 End queue run: pid=pppp -qf
 1999-03-02 09:44:33 10HmaX-0005vi-00 => userx@test.ex R=client T=send_to_server H=127.0.0.1 [127.0.0.1] X=TLSv1:DES-CBC3-SHA:168 DN="/C=UK/O=The Exim Maintainers/OU=Test Suite/CN=Phil Pennock" C="250 OK id=10HmaY-0005vi-00"
 1999-03-02 09:44:33 10HmaX-0005vi-00 Completed
 1999-03-02 09:44:33 End queue run: pid=pppp -qf

diff --git a/test/stderr/2108 b/test/stderr/2108
index 743f7ba713da53467fcf58cd9cb9c97af09ee1d9..3d6d87643746747bd049725e2f7c9031eb9b62cb 100644 (file)
--- a/test/stderr/2108
+++ b/test/stderr/2108
@@ -12,6 +12,11 @@ Connecting to 127.0.0.1 [127.0.0.1]:1225 ... connected
          250 HELP
   SMTP>> STARTTLS
   SMTP<< 220 TLS go ahead
          250 HELP
   SMTP>> STARTTLS
   SMTP<< 220 TLS go ahead

+LOG: MAIN
+  SSL verify error: depth=0 error=self signed certificate cert=/C=UK/O=The Exim Maintainers/OU=Test Suite/CN=Phil Pennock
+LOG: MAIN
+  SSL verify error: certificate name mismatch: "/C=UK/O=The Exim Maintainers/OU=Test Suite/CN=Phil Pennock"
+

   SMTP>> EHLO helo.data.changed
   SMTP<< 250-myhost.test.ex Hello helo.data.changed [127.0.0.1]
          250-SIZE 52428800
   SMTP>> EHLO helo.data.changed
   SMTP<< 250-myhost.test.ex Hello helo.data.changed [127.0.0.1]
          250-SIZE 52428800


@@ -43,6 +48,11 @@ Connecting to 127.0.0.1 [127.0.0.1]:1225 ... connected
          250 HELP
   SMTP>> STARTTLS
   SMTP<< 220 TLS go ahead
          250 HELP
   SMTP>> STARTTLS
   SMTP<< 220 TLS go ahead

+LOG: MAIN
+  SSL verify error: depth=0 error=self signed certificate cert=/C=UK/O=The Exim Maintainers/OU=Test Suite/CN=Phil Pennock
+LOG: MAIN
+  SSL verify error: certificate name mismatch: "/C=UK/O=The Exim Maintainers/OU=Test Suite/CN=Phil Pennock"
+

   SMTP>> EHLO helo.data.changed
   SMTP<< 250-myhost.test.ex Hello helo.data.changed [127.0.0.1]
          250-SIZE 52428800
   SMTP>> EHLO helo.data.changed
   SMTP<< 250-myhost.test.ex Hello helo.data.changed [127.0.0.1]
          250-SIZE 52428800


@@ -75,6 +85,11 @@ Connecting to ip4.ip4.ip4.ip4 [ip4.ip4.ip4.ip4]:1225 ... connected
          250 HELP
   SMTP>> STARTTLS
   SMTP<< 220 TLS go ahead
          250 HELP
   SMTP>> STARTTLS
   SMTP<< 220 TLS go ahead

+LOG: MAIN
+  SSL verify error: depth=0 error=self signed certificate cert=/C=UK/O=The Exim Maintainers/OU=Test Suite/CN=Phil Pennock
+LOG: MAIN
+  SSL verify error: certificate name mismatch: "/C=UK/O=The Exim Maintainers/OU=Test Suite/CN=Phil Pennock"
+

   SMTP>> EHLO myhost.test.ex
   SMTP<< 250-myhost.test.ex Hello the.local.host.name [ip4.ip4.ip4.ip4]
          250-SIZE 52428800
   SMTP>> EHLO myhost.test.ex
   SMTP<< 250-myhost.test.ex Hello the.local.host.name [ip4.ip4.ip4.ip4]
          250-SIZE 52428800

diff --git a/test/stderr/5410 b/test/stderr/5410
index 943681e1370873acf63fc5c90ac54d285c6f7753..54a99c7ed83f05f809fe014b5387f402c9c8a663 100644 (file)
--- a/test/stderr/5410
+++ b/test/stderr/5410
@@ -83,7 +83,8 @@ expanding: ${if eq {$address_data}{userz}{*}{:}}
   SMTP<< 220 TLS go ahead
 127.0.0.1 in hosts_require_ocsp? no (option unset)
 127.0.0.1 in hosts_request_ocsp? yes (matched "*")
   SMTP<< 220 TLS go ahead
 127.0.0.1 in hosts_require_ocsp? no (option unset)
 127.0.0.1 in hosts_request_ocsp? yes (matched "*")

-127.0.0.1 in tls_verify_cert_hostnames? yes (matched "*")
+127.0.0.1 in tls_verify_hosts? no (option unset)
+127.0.0.1 in tls_try_verify_hosts? no (end of list)

   SMTP>> EHLO myhost.test.ex
   SMTP<< 250-myhost.test.ex Hello the.local.host.name [ip4.ip4.ip4.ip4]
          250-SIZE 52428800
   SMTP>> EHLO myhost.test.ex
   SMTP<< 250-myhost.test.ex Hello the.local.host.name [ip4.ip4.ip4.ip4]
          250-SIZE 52428800

diff --git a/test/stderr/5420 b/test/stderr/5420
index 464cb2c4d2f8406ba31d5feb3ea5f953f292160f..f08ae8e9e75307c21fce36b34a5c568adb3237d8 100644 (file)
--- a/test/stderr/5420
+++ b/test/stderr/5420
@@ -82,7 +82,8 @@ expanding: ${if eq {$address_data}{userz}{*}{:}}
   SMTP>> STARTTLS
   SMTP<< 220 TLS go ahead
 127.0.0.1 in tls_verify_hosts? no (option unset)
   SMTP>> STARTTLS
   SMTP<< 220 TLS go ahead
 127.0.0.1 in tls_verify_hosts? no (option unset)

-127.0.0.1 in tls_try_verify_hosts? no (option unset)
+127.0.0.1 in tls_try_verify_hosts? yes (matched "*")
+127.0.0.1 in tls_verify_cert_hostnames? yes (matched "*")

   SMTP>> EHLO myhost.test.ex
   SMTP<< 250-myhost.test.ex Hello the.local.host.name [ip4.ip4.ip4.ip4]
          250-SIZE 52428800
   SMTP>> EHLO myhost.test.ex
   SMTP<< 250-myhost.test.ex Hello the.local.host.name [ip4.ip4.ip4.ip4]
          250-SIZE 52428800