Bug#828589: uw-imap: FTBFS with openssl 1.1.0

--nextPart1919496.vmhSj0NHZz
Content-Type: multipart/mixed; boundary="nextPart1852412.ZxhmpHrdWR"
Content-Transfer-Encoding: 7Bit

This is a multi-part message in MIME format.

--nextPart1852412.ZxhmpHrdWR
Content-Transfer-Encoding: quoted-printable
Content-Type: text/plain; charset="UTF-8"

torsdag 3 november 2016 kl. 00:23:37 CET skrev  Sebastian Andrzej Siewior:
> On 2016-09-12 17:00:28 [+0200], Kurt Roeckx wrote:
> > > But this problem existed before 1.1.0 support (this patch).
> > > What do you recommend here? The builtin usage
> > > (X509_VERIFY_PARAM_set_hostflags()) looks simple. The alternative
> > > X509_check_host() is 1.0.2+ and since it can not be applied to stable=
 I
> > > don't see the point. I would add this for 1.1.0 and keep the current
> > > validation for < 1.1.0.
> >=20
> > We don't want to upload this to Debian stable in any case.  But if
> > it's only doing the right thing with 1.1.0 that works for me.
>=20
> So I've been looking at this again. The patch attached should do what
> you asked for. It is so untested that EA is already using it=E2=80=A6

I'm thinking we can and should keep using CTX functions (e.g.=20
SSL_CTX_get0_param()), which minimizes the amount of changes. And your=20
cert_verify() seems to essentially do the same things as the existing=20
ssl_open_verify().

> Ehm. One thing: The callback that uw-imap invokes
> 	scq(err_str_cpy, "hostname", cert_subj)
>=20
> expects to pass the hostname of the connection. I have no idea how to
> obtain it at that point.=20

ssl_start_work() puts it in a static variable that ssl_open_verify() reads.

I have tested my patch to the extent that I get a validation error when I u=
se=20
"mailutil check" with an IP address, but not when I use the hostname. I=20
haven't tested all kinds of SAN shenanigans, but I suppose we can trust=20
OpenSSL here. The error message is of course different since we rely on the=
=20
built-in validation routine instead of our ssl_validate_cert().

=2D-=20
Magnus Holmgren        [email protected]
Debian Developer=20
--nextPart1852412.ZxhmpHrdWR
Content-Disposition: attachment; filename="openssl1.1_autoverify.patch"
Content-Transfer-Encoding: 7Bit
Content-Type: text/x-patch; charset="UTF-8"; name="openssl1.1_autoverify.patch"

--- a/src/osdep/unix/ssl_unix.c
+++ b/src/osdep/unix/ssl_unix.c
@@ -227,8 +227,16 @@ static char *ssl_start_work (SSLSTREAM *
 				/* disable certificate validation? */
   if (flags & NET_NOVALIDATECERT)
     SSL_CTX_set_verify (stream->context,SSL_VERIFY_NONE,NIL);
-  else SSL_CTX_set_verify (stream->context,SSL_VERIFY_PEER,ssl_open_verify);
+  else {
+#if OPENSSL_VERSION_NUMBER >= 0x10100000      
+      X509_VERIFY_PARAM *param = SSL_CTX_get0_param(stream->context);
+      X509_VERIFY_PARAM_set_hostflags(param, X509_CHECK_FLAG_NO_PARTIAL_WILDCARDS);
+      X509_VERIFY_PARAM_set1_host(param, host, 0);
+#endif
+
+      SSL_CTX_set_verify (stream->context,SSL_VERIFY_PEER,ssl_open_verify);
 				/* set default paths to CAs... */
+  }
   SSL_CTX_set_default_verify_paths (stream->context);
 				/* ...unless a non-standard path desired */
   if (s = (char *) mail_parameters (NIL,GET_SSLCAPATH,NIL))
@@ -266,6 +274,7 @@ static char *ssl_start_work (SSLSTREAM *
   if (SSL_write (stream->con,"",0) < 0)
     return ssl_last_error ? ssl_last_error : "SSL negotiation failed";
 				/* need to validate host names? */
+#if OPENSSL_VERSION_NUMBER < 0x10100000
   if (!(flags & NET_NOVALIDATECERT) &&
       (err = ssl_validate_cert (cert = SSL_get_peer_certificate (stream->con),
 				host))) {
@@ -275,6 +284,7 @@ static char *ssl_start_work (SSLSTREAM *
     sprintf (tmp,"*%.128s: %.255s",err,cert ? cert->name : "???");
     return ssl_last_error = cpystr (tmp);
   }
+#endif
   return NIL;
 }
 
@@ -312,7 +322,7 @@ static int ssl_open_verify (int ok,X509_
  *	    host to validate against
  * Returns: NIL if validated, else string of error message
  */
-
+#if OPENSSL_VERSION_NUMBER < 0x10100000
 static char *ssl_validate_cert (X509 *cert,char *host)
 {
   int i,n;
@@ -342,6 +352,7 @@ static char *ssl_validate_cert (X509 *ce
   else ret = "Unable to locate common name in certificate";
   return ret;
 }
+#endif
 
 /* Case-independent wildcard pattern match
  * Accepts: base string

--nextPart1852412.ZxhmpHrdWR--

--nextPart1919496.vmhSj0NHZz
Content-Type: application/pgp-signature; name="signature.asc"
Content-Description: This is a digitally signed message part.
Content-Transfer-Encoding: 7Bit

-----BEGIN PGP SIGNATURE-----

iQIzBAABCAAdFiEEzSoHOzhhVBcKQILo1PIZv+yZhIkFAlgyNn0ACgkQ1PIZv+yZ
hIkMZQ//WUIXC8423MrhT+clKJ2AuES+XGd9Ze+GOTHrwrO0X0wmbqYguxmuR0Fi
tatkTw7tsEPKu/oxxeHvqZwveywo33barjNRXjqTlGIKnv8gBVChTUHL11TTz8Y4
s1102qxYT/VVU4vcg5xFeCDgYcSfYLJI/VbjpoCG+0ih4C/SuYT8DzC5FgTnFeAO
ycaYcF/iQMv4IpOM0fGE8uQkG0a2C+Ud+BT+up2Fe5HJjjji3SpRm6aB7HrKyWWe
BkX9ozqeaK/y0cOzIeacyq+vVGJMapTGRzVcpJLNCiBws4ORYylUWdwuioE0ZiUI
1BzShjkssYs9mlVzkJ71EjkrIDU+uhlFjKNqkm75dTODS168cuHzbYrwS+m6tzUn
0a6h8i0GiycKIExXAJrHMnOwCCrbbo180uj+lR+9wcsPSb83qXNhL7XVhvadmcmR
sSCCclDZxesFit8uAt30gt0EJ1DCcZ+bvuT8sFsIhOEjUnwhD+cUB0vbnuVvVJzq
4FhogCg0sYZbR5SL/26Qm803aRxrETFykKQxC96lvl5ZoZJ+s3LAflL8oCJn9A90
B20dfLdX97EPzH9ZYPMkdDrZk08vnzBz2pZ38TARrUWA5QWIRACCQFBL1+elk5yZ
NXDMjjyGmXaYykRzOjDIAjR/VU+QQdHlZ4EaJFZsi1i14xRwYuo=
=smdN
-----END PGP SIGNATURE-----

--nextPart1919496.vmhSj0NHZz--