Sign Up
Log In
Log In
or
Sign Up
Places
All Projects
Status Monitor
Collapse sidebar
SUSE:SLE-15-SP2:Update
sendmail.14171
8.15.2.mci.p0
Overview
Repositories
Revisions
Requests
Users
Attributes
Meta
File 8.15.2.mci.p0 of Package sendmail.14171
If sendmail tried to reuse an SMTP session which had already been closed by the server, then the connection cache could have invalid information about the session. One possible consequence was that STARTTLS was not used even if offered. The problem can be fixed by either: - applying this patch (for 8.15.2) - or disabling the connection cache: define(`confMCI_CACHE_SIZE', `0') The problem can be mitigated by setting at least one of these options: - using a very short timeout: define(`confMCI_CACHE_TIMEOUT', `5s') - sorting the queue by hosts: define(`confQUEUE_SORT_ORDER', `Host') To apply this patch, cd to the source code directory, then rebuild and reinstall sendmail. cd sendmail-8.15.2 patch < 8.15.2.mci.p0 Note: This issue is fixed in sendmail snapshot 8.16.0.16 (or newer) for those who would like to test upcoming releases. diff -ru sendmail-/deliver.c sendmail/deliver.c --- sendmail-/deliver.c 2016-02-29 06:01:55.000000000 -0800 +++ sendmail/deliver.c 2016-02-29 06:02:06.000000000 -0800 @@ -6274,8 +6274,7 @@ tlslogerr(LOG_WARNING, "client"); } - SSL_free(clt_ssl); - clt_ssl = NULL; + SM_SSL_FREE(clt_ssl); return EX_SOFTWARE; } mci->mci_ssl = clt_ssl; @@ -6287,8 +6286,7 @@ return EX_OK; /* failure */ - SSL_free(clt_ssl); - clt_ssl = NULL; + SM_SSL_FREE(clt_ssl); return EX_SOFTWARE; } /* @@ -6309,7 +6307,7 @@ if (!bitset(MCIF_TLSACT, mci->mci_flags)) return EX_OK; - r = endtls(mci->mci_ssl, "client"); + r = endtls(&mci->mci_ssl, "client"); mci->mci_flags &= ~MCIF_TLSACT; return r; } diff -ru sendmail-/macro.c sendmail/macro.c --- sendmail-/macro.c 2016-02-29 06:01:55.000000000 -0800 +++ sendmail/macro.c 2016-02-29 06:02:06.000000000 -0800 @@ -362,6 +362,33 @@ } /* +** MACTABCLEAR -- clear entire macro table +** +** Parameters: +** mac -- Macro table. +** +** Returns: +** none. +** +** Side Effects: +** clears entire mac structure including rpool pointer! +*/ + +void +mactabclear(mac) + MACROS_T *mac; +{ + int i; + + if (mac->mac_rpool == NULL) + { + for (i = 0; i < MAXMACROID; i++) + SM_FREE_CLR(mac->mac_table[i]); + } + memset((char *) mac, '\0', sizeof(*mac)); +} + +/* ** MACDEFINE -- bind a macro name to a value ** ** Set a macro to a value, with fancy storage management. diff -ru sendmail-/mci.c sendmail/mci.c --- sendmail-/mci.c 2016-02-29 06:01:55.000000000 -0800 +++ sendmail/mci.c 2016-02-29 06:02:06.000000000 -0800 @@ -25,6 +25,7 @@ int, bool)); static bool mci_load_persistent __P((MCI *)); static void mci_uncache __P((MCI **, bool)); +static void mci_clear __P((MCI *)); static int mci_lock_host_statfile __P((MCI *)); static int mci_read_persistent __P((SM_FILE_T *, MCI *)); @@ -253,6 +254,7 @@ SM_FREE_CLR(mci->mci_status); SM_FREE_CLR(mci->mci_rstatus); SM_FREE_CLR(mci->mci_heloname); + mci_clear(mci); if (mci->mci_rpool != NULL) { sm_rpool_free(mci->mci_rpool); @@ -315,6 +317,41 @@ } /* +** MCI_CLEAR -- clear mci +** +** Parameters: +** mci -- the connection to clear. +** +** Returns: +** none. +*/ + +static void +mci_clear(mci) + MCI *mci; +{ + if (mci == NULL) + return; + + mci->mci_maxsize = 0; + mci->mci_min_by = 0; + mci->mci_deliveries = 0; +#if SASL + if (bitset(MCIF_AUTHACT, mci->mci_flags)) + sasl_dispose(&mci->mci_conn); +#endif +#if STARTTLS + if (bitset(MCIF_TLSACT, mci->mci_flags) && mci->mci_ssl != NULL) + SM_SSL_FREE(mci->mci_ssl); +#endif + + /* which flags to preserve? */ + mci->mci_flags &= MCIF_CACHED; + mactabclear(&mci->mci_macro); +} + + +/* ** MCI_GET -- get information about a particular host ** ** Parameters: @@ -419,6 +456,7 @@ mci->mci_errno = 0; mci->mci_exitstat = EX_OK; } + mci_clear(mci); } return mci; diff -ru sendmail-/sendmail.h sendmail/sendmail.h --- sendmail-/sendmail.h 2016-02-29 06:01:55.000000000 -0800 +++ sendmail/sendmail.h 2016-02-29 06:02:06.000000000 -0800 @@ -1186,6 +1186,7 @@ #define macid(name) macid_parse(name, NULL) extern char *macname __P((int)); extern char *macvalue __P((int, ENVELOPE *)); +extern void mactabclear __P((MACROS_T *)); extern int rscheck __P((char *, char *, char *, ENVELOPE *, int, int, char *, char *, ADDRESS *, char **)); extern int rscap __P((char *, char *, char *, ENVELOPE *, char ***, char *, int)); extern void setclass __P((int, char *)); @@ -2002,7 +2003,15 @@ extern void setclttls __P((bool)); extern bool initsrvtls __P((bool)); extern int tls_get_info __P((SSL *, bool, char *, MACROS_T *, bool)); -extern int endtls __P((SSL *, char *)); +#define SM_SSL_FREE(ssl) \ + do { \ + if (ssl != NULL) \ + { \ + SSL_free(ssl); \ + ssl = NULL; \ + } \ + } while (0) +extern int endtls __P((SSL **, char *)); extern void tlslogerr __P((int, const char *)); diff -ru sendmail-/srvrsmtp.c sendmail/srvrsmtp.c --- sendmail-/srvrsmtp.c 2016-02-29 06:01:55.000000000 -0800 +++ sendmail/srvrsmtp.c 2016-02-29 06:02:06.000000000 -0800 @@ -2122,8 +2122,7 @@ if (get_tls_se_options(e, srv_ssl, true) != 0) { message("454 4.3.3 TLS not available: error setting options"); - SSL_free(srv_ssl); - srv_ssl = NULL; + SM_SSL_FREE(srv_ssl); goto tls_done; } @@ -2145,8 +2144,7 @@ SSL_set_wfd(srv_ssl, wfd) <= 0) { message("454 4.3.3 TLS not available: error set fd"); - SSL_free(srv_ssl); - srv_ssl = NULL; + SM_SSL_FREE(srv_ssl); goto tls_done; } if (!smtps) @@ -2188,8 +2186,7 @@ tlslogerr(LOG_WARNING, "server"); } tls_ok_srv = false; - SSL_free(srv_ssl); - srv_ssl = NULL; + SM_SSL_FREE(srv_ssl); /* ** according to the next draft of @@ -3416,7 +3413,7 @@ /* shutdown TLS connection */ if (tls_active) { - (void) endtls(srv_ssl, "server"); + (void) endtls(&srv_ssl, "server"); tls_active = false; } #endif /* STARTTLS */ diff -ru sendmail-/tls.c sendmail/tls.c --- sendmail-/tls.c 2016-02-29 06:01:55.000000000 -0800 +++ sendmail/tls.c 2016-02-29 06:02:06.000000000 -0800 @@ -1624,7 +1624,7 @@ ** ENDTLS -- shutdown secure connection ** ** Parameters: -** ssl -- SSL connection information. +** pssl -- pointer to TLS session context ** side -- server/client (for logging). ** ** Returns: @@ -1632,12 +1632,16 @@ */ int -endtls(ssl, side) - SSL *ssl; +endtls(pssl, side) + SSL **pssl; char *side; { int ret = EX_OK; + SSL *ssl; + SM_REQUIRE(pssl != NULL); + ret = EX_OK; + ssl = *pssl; if (ssl != NULL) { int r; @@ -1703,8 +1707,7 @@ ret = EX_SOFTWARE; } # endif /* !defined(OPENSSL_VERSION_NUMBER) || OPENSSL_VERSION_NUMBER > 0x0090602fL */ - SSL_free(ssl); - ssl = NULL; + SM_SSL_FREE(*pssl); } return ret; }
Locations
Projects
Search
Status Monitor
Help
OpenBuildService.org
Documentation
API Documentation
Code of Conduct
Contact
Support
@OBShq
Terms
openSUSE Build Service is sponsored by
The Open Build Service is an
openSUSE project
.
Sign Up
Log In
Places
Places
All Projects
Status Monitor
