login, lib-ssl-iostream: Deduplicate code with shared openssl_iostream_use_certificat...

diff --git a/src/lib-ssl-iostream/iostream-openssl-context.c b/src/lib-ssl-iostream/iostream-openssl-context.c
index 2313de39edcdf00a00c0e91dad8be69a8566c86f..96b6e7b9169d1720fa067534e5590d41ab36f953 100644 (file)
--- a/src/lib-ssl-iostream/iostream-openssl-context.c
+++ b/src/lib-ssl-iostream/iostream-openssl-context.c
@@ -174,7 +174,8 @@ static bool is_pem_key(const char *cert)
        return strstr(cert, "PRIVATE KEY---") != NULL;
 }
 
-const char *ssl_iostream_get_use_certificate_error(const char *cert)
+const char *
+openssl_iostream_use_certificate_error(const char *cert, const char *set_name)
 {
        unsigned long err;
 
@@ -185,8 +186,11 @@ const char *ssl_iostream_get_use_certificate_error(const char *cert)
        else if (is_pem_key(cert)) {
                return "The file contains a private key "
                        "(you've mixed ssl_cert and ssl_key settings)";
+       } else if (set_name != NULL && strchr(cert, '\n') == NULL) {
+               return t_strdup_printf("There is no valid PEM certificate. "
+                       "(You probably forgot '<' from %s=<%s)", set_name, cert);
        } else {
-               return "There is no certificate.";
+               return "There is no valid PEM certificate.";
        }
 }
 
@@ -398,7 +402,7 @@ ssl_iostream_context_set(struct ssl_iostream_context *ctx,
        if (set->cert != NULL &&
            ssl_ctx_use_certificate_chain(ctx->ssl_ctx, set->cert) == 0) {
                *error_r = t_strdup_printf("Can't load SSL certificate: %s",
-                       ssl_iostream_get_use_certificate_error(set->cert));
+                       openssl_iostream_use_certificate_error(set->cert, NULL));
                return -1;
        }
        if (set->key != NULL) {

diff --git a/src/lib-ssl-iostream/iostream-openssl.c b/src/lib-ssl-iostream/iostream-openssl.c
index 5bad303e81e67f462baf16aa97a3a93d5cfb4cc8..e9c403ec8676c349f06667e9bd43233d968fe125 100644 (file)
--- a/src/lib-ssl-iostream/iostream-openssl.c
+++ b/src/lib-ssl-iostream/iostream-openssl.c
@@ -71,7 +71,7 @@ openssl_iostream_use_certificate(struct ssl_iostream *ssl_io, const char *cert,
 
        if (ret == 0) {
                *error_r = t_strdup_printf("Can't load ssl_cert: %s",
-                       ssl_iostream_get_use_certificate_error(cert));
+                       openssl_iostream_use_certificate_error(cert, NULL));
                return -1;
        }
        return 0;

diff --git a/src/lib-ssl-iostream/iostream-openssl.h b/src/lib-ssl-iostream/iostream-openssl.h
index fac2880c888fa838085f0ef25d58e2c4b36b91fe..eb8e8104bdae34c7c049a0ee92cc03a1a6e82479 100644 (file)
--- a/src/lib-ssl-iostream/iostream-openssl.h
+++ b/src/lib-ssl-iostream/iostream-openssl.h
@@ -68,7 +68,6 @@ void openssl_iostream_global_deinit(void);
 
 int openssl_iostream_load_key(const struct ssl_iostream_settings *set,
                              EVP_PKEY **pkey_r, const char **error_r);
-const char *ssl_iostream_get_use_certificate_error(const char *cert);
 int openssl_cert_match_name(SSL *ssl, const char *verify_name);
 int openssl_get_protocol_options(const char *protocols);
 #define OPENSSL_ALL_PROTOCOL_OPTIONS \
@@ -92,6 +91,8 @@ int openssl_iostream_handle_write_error(struct ssl_iostream *ssl_io, int ret,
 
 const char *openssl_iostream_error(void);
 const char *openssl_iostream_key_load_error(void);
+const char *
+openssl_iostream_use_certificate_error(const char *cert, const char *set_name);
 
 int openssl_iostream_generate_params(buffer_t *output, unsigned int dh_length,
                                     const char **error_r);

diff --git a/src/login-common/ssl-proxy-openssl.c b/src/login-common/ssl-proxy-openssl.c
index ee78eddbf17e8e0582e485a62f12c4588bf0e0ee..f4983addc3418fd88ce736e51bc76cb8fc822310 100644 (file)
--- a/src/login-common/ssl-proxy-openssl.c
+++ b/src/login-common/ssl-proxy-openssl.c
@@ -935,11 +935,6 @@ unsigned int ssl_proxy_get_count(void)
        return ssl_proxy_count;
 }
 
-static bool is_pem_key(const char *cert)
-{
-       return strstr(cert, "PRIVATE KEY---") != NULL;
-}
-
 static void load_ca(X509_STORE *store, const char *ca,
                    STACK_OF(X509_NAME) **xnames_r)
 {
@@ -1080,25 +1075,6 @@ ssl_proxy_ctx_verify_client(SSL_CTX *ssl_ctx, STACK_OF(X509_NAME) *ca_names)
        SSL_CTX_set_client_CA_list(ssl_ctx, ca_names);
 }
 
-static const char *ssl_proxy_get_use_certificate_error(const char *cert)
-{
-       unsigned long err;
-
-       err = ERR_peek_error();
-       if (ERR_GET_LIB(err) != ERR_LIB_PEM ||
-           ERR_GET_REASON(err) != PEM_R_NO_START_LINE)
-               return openssl_iostream_error();
-       else if (is_pem_key(cert)) {
-               return "The file contains a private key "
-                       "(you've mixed ssl_cert and ssl_key settings)";
-       } else if (strchr(cert, '\n') == NULL) {
-               return t_strdup_printf("There is no valid PEM certificate. "
-                       "(You probably forgot '<' from ssl_cert=<%s)", cert);
-       } else {
-               return "There is no valid PEM certificate.";
-       }
-}
-
 static EVP_PKEY * ATTR_NULL(2)
 ssl_proxy_load_key(const char *key, const char *password)
 {
@@ -1277,7 +1253,7 @@ ssl_server_context_init(const struct login_settings *login_set,
 
        if (ssl_proxy_ctx_use_certificate_chain(ctx->ctx, ctx->cert) != 1) {
                i_fatal("Can't load ssl_cert: %s",
-                       ssl_proxy_get_use_certificate_error(ctx->cert));
+                       openssl_iostream_use_certificate_error(ctx->cert, "ssl_cert"));
        }
 
 #ifdef HAVE_SSL_GET_SERVERNAME
@@ -1317,7 +1293,8 @@ ssl_proxy_client_ctx_set_client_cert(SSL_CTX *ctx,
 
        if (ssl_proxy_ctx_use_certificate_chain(ctx, set->ssl_client_cert) != 1) {
                i_fatal("Can't load ssl_client_cert: %s",
-                       ssl_proxy_get_use_certificate_error(set->ssl_client_cert));
+                       openssl_iostream_use_certificate_error(
+                               set->ssl_client_cert, "ssl_client_cert"));
        }
 
        pkey = ssl_proxy_load_key(set->ssl_client_key, NULL);