From: Timo Sirainen <tss@iki.fi>
Date: Mon, 8 Apr 2013 10:02:27 +0000 (+0300)
Subject: lib-ssl-iostream: Added ssl_iostream_has_handshake_failed()
X-Git-Tag: 2.2.rc7~28
X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=71b60849a773dd68bdc015cb6a8ea1664d16b359;p=thirdparty%2Fdovecot%2Fcore.git

lib-ssl-iostream: Added ssl_iostream_has_handshake_failed()
---

diff --git a/src/lib-ssl-iostream/iostream-openssl.c b/src/lib-ssl-iostream/iostream-openssl.c
index 7efcd874d4..14a581cef3 100644
--- a/src/lib-ssl-iostream/iostream-openssl.c
+++ b/src/lib-ssl-iostream/iostream-openssl.c
@@ -117,8 +117,10 @@ openssl_iostream_verify_client_cert(int preverify_ok, X509_STORE_CTX *ctx)
 	}
 	if (!preverify_ok) {
 		ssl_io->cert_broken = TRUE;
-		if (ssl_io->require_valid_cert)
+		if (ssl_io->require_valid_cert) {
+			ssl_io->handshake_failed = TRUE;
 			return 0;
+		}
 	}
 	return 1;
 }
@@ -550,6 +552,7 @@ static int openssl_iostream_handshake(struct ssl_iostream *ssl_io)
 			i_stream_close(ssl_io->plain_input);
 			o_stream_close(ssl_io->plain_output);
 			openssl_iostream_set_error(ssl_io, error);
+			ssl_io->handshake_failed = TRUE;
 			errno = EINVAL;
 			return -1;
 		}
@@ -583,6 +586,12 @@ static bool openssl_iostream_is_handshaked(const struct ssl_iostream *ssl_io)
 	return ssl_io->handshaked;
 }
 
+static bool
+openssl_iostream_has_handshake_failed(const struct ssl_iostream *ssl_io)
+{
+	return ssl_io->handshake_failed;
+}
+
 static bool
 openssl_iostream_has_valid_client_cert(const struct ssl_iostream *ssl_io)
 {
@@ -685,6 +694,7 @@ const struct iostream_ssl_vfuncs ssl_vfuncs = {
 
 	openssl_iostream_set_log_prefix,
 	openssl_iostream_is_handshaked,
+	openssl_iostream_has_handshake_failed,
 	openssl_iostream_has_valid_client_cert,
 	openssl_iostream_has_broken_client_cert,
 	openssl_iostream_cert_match_name,
diff --git a/src/lib-ssl-iostream/iostream-openssl.h b/src/lib-ssl-iostream/iostream-openssl.h
index 72bdb0bc72..6258961db5 100644
--- a/src/lib-ssl-iostream/iostream-openssl.h
+++ b/src/lib-ssl-iostream/iostream-openssl.h
@@ -41,6 +41,7 @@ struct ssl_iostream {
 	void *handshake_context;
 
 	unsigned int handshaked:1;
+	unsigned int handshake_failed:1;
 	unsigned int cert_received:1;
 	unsigned int cert_broken:1;
 	unsigned int want_read:1;
diff --git a/src/lib-ssl-iostream/iostream-ssl-private.h b/src/lib-ssl-iostream/iostream-ssl-private.h
index eac184eb0c..9c8c432e99 100644
--- a/src/lib-ssl-iostream/iostream-ssl-private.h
+++ b/src/lib-ssl-iostream/iostream-ssl-private.h
@@ -30,6 +30,7 @@ struct iostream_ssl_vfuncs {
 
 	void (*set_log_prefix)(struct ssl_iostream *ssl_io, const char *prefix);
 	bool (*is_handshaked)(const struct ssl_iostream *ssl_io);
+	bool (*has_handshake_failed)(const struct ssl_iostream *ssl_io);
 	bool (*has_valid_client_cert)(const struct ssl_iostream *ssl_io);
 	bool (*has_broken_client_cert)(struct ssl_iostream *ssl_io);
 	int (*cert_match_name)(struct ssl_iostream *ssl_io, const char *name);
diff --git a/src/lib-ssl-iostream/iostream-ssl.c b/src/lib-ssl-iostream/iostream-ssl.c
index 87d51fbc70..ce639ce4bd 100644
--- a/src/lib-ssl-iostream/iostream-ssl.c
+++ b/src/lib-ssl-iostream/iostream-ssl.c
@@ -151,6 +151,11 @@ bool ssl_iostream_is_handshaked(const struct ssl_iostream *ssl_io)
 	return ssl_vfuncs->is_handshaked(ssl_io);
 }
 
+bool ssl_iostream_has_handshake_failed(const struct ssl_iostream *ssl_io)
+{
+	return ssl_vfuncs->has_handshake_failed(ssl_io);
+}
+
 bool ssl_iostream_has_valid_client_cert(const struct ssl_iostream *ssl_io)
 {
 	return ssl_vfuncs->has_valid_client_cert(ssl_io);
diff --git a/src/lib-ssl-iostream/iostream-ssl.h b/src/lib-ssl-iostream/iostream-ssl.h
index 5fd4b6550e..8db6bb8f4d 100644
--- a/src/lib-ssl-iostream/iostream-ssl.h
+++ b/src/lib-ssl-iostream/iostream-ssl.h
@@ -49,6 +49,9 @@ void ssl_iostream_set_handshake_callback(struct ssl_iostream *ssl_io,
 					 void *context);
 
 bool ssl_iostream_is_handshaked(const struct ssl_iostream *ssl_io);
+/* Returns TRUE if the remote cert is invalid, or handshake callback returned
+   failure. */
+bool ssl_iostream_has_handshake_failed(const struct ssl_iostream *ssl_io);
 bool ssl_iostream_has_valid_client_cert(const struct ssl_iostream *ssl_io);
 bool ssl_iostream_has_broken_client_cert(struct ssl_iostream *ssl_io);
 int ssl_iostream_check_cert_validity(struct ssl_iostream *ssl_io,