login-common: If proxying fails due to remote having invalid SSL cert, don't reconnect

Consistently use LOGIN_PROXY_FAILURE_TYPE_INTERNAL_CONFIG type regardless of
whether the failure happens in ssl_iostream_handshake() or later.

diff --git a/src/login-common/client-common-auth.c b/src/login-common/client-common-auth.c
index 3d9d6530bd1069467f9a437c1262606d1eac861f..ec110e81d92ac606c003308cafd73a7d70874db0 100644 (file)
--- a/src/login-common/client-common-auth.c
+++ b/src/login-common/client-common-auth.c
@@ -353,9 +353,14 @@ static void proxy_input(struct client *client)
                        client_proxy_get_state(client), duration,
                        line == NULL ? "" : t_strdup_printf(
                                " - BUG: line not read: %s", line));
+
+               enum login_proxy_failure_type type =
+                       login_proxy_failed_because_invalid_cert(client->login_proxy) ?
+                       LOGIN_PROXY_FAILURE_TYPE_INTERNAL_CONFIG :
+                       LOGIN_PROXY_FAILURE_TYPE_CONNECT;
                login_proxy_failed(client->login_proxy,
                                   login_proxy_get_event(client->login_proxy),
-                                  LOGIN_PROXY_FAILURE_TYPE_CONNECT, reason);
+                                  type, reason);
                return;
        }
 

diff --git a/src/login-common/login-proxy.c b/src/login-common/login-proxy.c
index cf2af358ca55947e9d206b16de158aece4f760b3..01561fedcb9b239fda45d33340d8795eedc90f9e 100644 (file)
--- a/src/login-common/login-proxy.c
+++ b/src/login-common/login-proxy.c
@@ -1320,8 +1320,12 @@ int login_proxy_starttls(struct login_proxy *proxy)
                const char *reason = t_strdup_printf(
                        "Failed to start SSL handshake: %s",
                        ssl_iostream_get_last_error(proxy->server_ssl_iostream));
-               login_proxy_failed(proxy, proxy->event,
-                                  LOGIN_PROXY_FAILURE_TYPE_INTERNAL, reason);
+
+               enum login_proxy_failure_type type =
+                       login_proxy_failed_because_invalid_cert(proxy) ?
+                       LOGIN_PROXY_FAILURE_TYPE_INTERNAL_CONFIG :
+                       LOGIN_PROXY_FAILURE_TYPE_INTERNAL;
+               login_proxy_failed(proxy, proxy->event, type, reason);
                return -1;
        }
        proxy_rawlog_init(proxy);
@@ -1333,6 +1337,17 @@ int login_proxy_starttls(struct login_proxy *proxy)
        return 0;
 }
 
+bool login_proxy_failed_because_invalid_cert(struct login_proxy *proxy)
+{
+       if (proxy->server_ssl_iostream == NULL)
+               return FALSE;
+
+       enum ssl_iostream_state state =
+               ssl_iostream_get_state(proxy->server_ssl_iostream);
+       return state == SSL_IOSTREAM_STATE_INVALID_CERT ||
+               state == SSL_IOSTREAM_STATE_NAME_MISMATCH;
+}
+
 void login_proxy_multiplex_input_start(struct login_proxy *proxy)
 {
        struct istream *input = i_stream_create_multiplex(proxy->server_input,

diff --git a/src/login-common/login-proxy.h b/src/login-common/login-proxy.h
index 7ce6a04838f4f32f9ae8729f39a8adb511da133a..0064b81258578077de15cbf8bbad121fdfaf956f 100644 (file)
--- a/src/login-common/login-proxy.h
+++ b/src/login-common/login-proxy.h
@@ -116,6 +116,8 @@ void login_proxy_detach(struct login_proxy *proxy);
 
 /* STARTTLS command was issued. */
 int login_proxy_starttls(struct login_proxy *proxy);
+/* Returns TRUE if proxying failed because of invalid SSL certificate. */
+bool login_proxy_failed_because_invalid_cert(struct login_proxy *proxy);
 /* MULTIPLEX input was started. */
 void login_proxy_multiplex_input_start(struct login_proxy *proxy);