lib-ssl-iostream: Added ssl_iostream_has_handshake_failed()

diff --git a/src/lib-ssl-iostream/iostream-openssl.c b/src/lib-ssl-iostream/iostream-openssl.c
index 7efcd874d431a647eb04925e466d8d5c199ed800..14a581cef3711c17edf7e7c718c7deae72bafbc6 100644 (file)
--- a/src/lib-ssl-iostream/iostream-openssl.c
+++ b/src/lib-ssl-iostream/iostream-openssl.c
@@ -117,8 +117,10 @@ openssl_iostream_verify_client_cert(int preverify_ok, X509_STORE_CTX *ctx)
        }
        if (!preverify_ok) {
                ssl_io->cert_broken = TRUE;
-               if (ssl_io->require_valid_cert)
+               if (ssl_io->require_valid_cert) {
+                       ssl_io->handshake_failed = TRUE;
                        return 0;
+               }
        }
        return 1;
 }
@@ -550,6 +552,7 @@ static int openssl_iostream_handshake(struct ssl_iostream *ssl_io)
                        i_stream_close(ssl_io->plain_input);
                        o_stream_close(ssl_io->plain_output);
                        openssl_iostream_set_error(ssl_io, error);
+                       ssl_io->handshake_failed = TRUE;
                        errno = EINVAL;
                        return -1;
                }
@@ -583,6 +586,12 @@ static bool openssl_iostream_is_handshaked(const struct ssl_iostream *ssl_io)
        return ssl_io->handshaked;
 }
 
+static bool
+openssl_iostream_has_handshake_failed(const struct ssl_iostream *ssl_io)
+{
+       return ssl_io->handshake_failed;
+}
+
 static bool
 openssl_iostream_has_valid_client_cert(const struct ssl_iostream *ssl_io)
 {
@@ -685,6 +694,7 @@ const struct iostream_ssl_vfuncs ssl_vfuncs = {
 
        openssl_iostream_set_log_prefix,
        openssl_iostream_is_handshaked,
+       openssl_iostream_has_handshake_failed,
        openssl_iostream_has_valid_client_cert,
        openssl_iostream_has_broken_client_cert,
        openssl_iostream_cert_match_name,

diff --git a/src/lib-ssl-iostream/iostream-openssl.h b/src/lib-ssl-iostream/iostream-openssl.h
index 72bdb0bc720a060003e683633fdff035a978d657..6258961db5b5a2e6156f73cfd2d4295d96c519b4 100644 (file)
--- a/src/lib-ssl-iostream/iostream-openssl.h
+++ b/src/lib-ssl-iostream/iostream-openssl.h
@@ -41,6 +41,7 @@ struct ssl_iostream {
        void *handshake_context;
 
        unsigned int handshaked:1;
+       unsigned int handshake_failed:1;
        unsigned int cert_received:1;
        unsigned int cert_broken:1;
        unsigned int want_read:1;

diff --git a/src/lib-ssl-iostream/iostream-ssl-private.h b/src/lib-ssl-iostream/iostream-ssl-private.h
index eac184eb0c9727bf7cebe223bf714b590a0f2a93..9c8c432e99a9662272a880daa6311fa1d1bd2b6a 100644 (file)
--- a/src/lib-ssl-iostream/iostream-ssl-private.h
+++ b/src/lib-ssl-iostream/iostream-ssl-private.h
@@ -30,6 +30,7 @@ struct iostream_ssl_vfuncs {
 
        void (*set_log_prefix)(struct ssl_iostream *ssl_io, const char *prefix);
        bool (*is_handshaked)(const struct ssl_iostream *ssl_io);
+       bool (*has_handshake_failed)(const struct ssl_iostream *ssl_io);
        bool (*has_valid_client_cert)(const struct ssl_iostream *ssl_io);
        bool (*has_broken_client_cert)(struct ssl_iostream *ssl_io);
        int (*cert_match_name)(struct ssl_iostream *ssl_io, const char *name);

diff --git a/src/lib-ssl-iostream/iostream-ssl.c b/src/lib-ssl-iostream/iostream-ssl.c
index 87d51fbc70706a921d461479e6d209f10dd3b83c..ce639ce4bdd4a457562306879c8d91fcf0053116 100644 (file)
--- a/src/lib-ssl-iostream/iostream-ssl.c
+++ b/src/lib-ssl-iostream/iostream-ssl.c
@@ -151,6 +151,11 @@ bool ssl_iostream_is_handshaked(const struct ssl_iostream *ssl_io)
        return ssl_vfuncs->is_handshaked(ssl_io);
 }
 
+bool ssl_iostream_has_handshake_failed(const struct ssl_iostream *ssl_io)
+{
+       return ssl_vfuncs->has_handshake_failed(ssl_io);
+}
+
 bool ssl_iostream_has_valid_client_cert(const struct ssl_iostream *ssl_io)
 {
        return ssl_vfuncs->has_valid_client_cert(ssl_io);

diff --git a/src/lib-ssl-iostream/iostream-ssl.h b/src/lib-ssl-iostream/iostream-ssl.h
index 5fd4b6550ee0685d9609b9dcb33655523222bf90..8db6bb8f4d0aa503b981f1571977334cfaa3d904 100644 (file)
--- a/src/lib-ssl-iostream/iostream-ssl.h
+++ b/src/lib-ssl-iostream/iostream-ssl.h
@@ -49,6 +49,9 @@ void ssl_iostream_set_handshake_callback(struct ssl_iostream *ssl_io,
                                         void *context);
 
 bool ssl_iostream_is_handshaked(const struct ssl_iostream *ssl_io);
+/* Returns TRUE if the remote cert is invalid, or handshake callback returned
+   failure. */
+bool ssl_iostream_has_handshake_failed(const struct ssl_iostream *ssl_io);
 bool ssl_iostream_has_valid_client_cert(const struct ssl_iostream *ssl_io);
 bool ssl_iostream_has_broken_client_cert(struct ssl_iostream *ssl_io);
 int ssl_iostream_check_cert_validity(struct ssl_iostream *ssl_io,