diff options
Diffstat (limited to 'network/opensmtpd/openbsd65-029-smptd-tls.patch')
| -rw-r--r-- | network/opensmtpd/openbsd65-029-smptd-tls.patch | 52 |
1 files changed, 52 insertions, 0 deletions
diff --git a/network/opensmtpd/openbsd65-029-smptd-tls.patch b/network/opensmtpd/openbsd65-029-smptd-tls.patch new file mode 100644 index 0000000000..a2727decf8 --- /dev/null +++ b/network/opensmtpd/openbsd65-029-smptd-tls.patch @@ -0,0 +1,52 @@ +OpenBSD 6.5 errata 029, January 30, 2020: + +smtpd can crash on opportunistic TLS downgrade, causing a denial of service. + +--- usr.sbin/smtpd/mta_session.c 23 Dec 2018 16:37:53 -0000 1.115 ++++ usr.sbin/smtpd/mta_session.c 20 Jan 2020 10:36:58 -0000 +@@ -1292,40 +1292,20 @@ mta_io(struct io *io, int evt, void *arg + break; + + case IO_ERROR: ++ case IO_TLSERROR: + log_debug("debug: mta: %p: IO error: %s", s, io_error(io)); +- if (!s->ready) { +- mta_error(s, "IO Error: %s", io_error(io)); +- mta_connect(s); +- break; +- } +- else if (!(s->flags & (MTA_FORCE_TLS|MTA_FORCE_SMTPS|MTA_FORCE_ANYSSL))) { +- /* error in non-strict SSL negotiation, downgrade to plain */ +- if (s->flags & MTA_TLS) { +- log_info("smtp-out: Error on session %016"PRIx64 +- ": opportunistic TLS failed, " +- "downgrading to plain", s->id); +- s->flags &= ~MTA_TLS; +- s->flags |= MTA_DOWNGRADE_PLAIN; +- mta_connect(s); +- break; +- } +- } +- mta_error(s, "IO Error: %s", io_error(io)); +- mta_free(s); +- break; + +- case IO_TLSERROR: +- log_debug("debug: mta: %p: TLS IO error: %s", s, io_error(io)); +- if (!(s->flags & (MTA_FORCE_TLS|MTA_FORCE_SMTPS|MTA_FORCE_ANYSSL))) { ++ if (s->state == MTA_STARTTLS && s->use_smtp_tls) { + /* error in non-strict SSL negotiation, downgrade to plain */ +- log_info("smtp-out: TLS Error on session %016"PRIx64 +- ": TLS failed, " ++ log_info("smtp-out: Error on session %016"PRIx64 ++ ": opportunistic TLS failed, " + "downgrading to plain", s->id); + s->flags &= ~MTA_TLS; + s->flags |= MTA_DOWNGRADE_PLAIN; + mta_connect(s); + break; + } ++ + mta_error(s, "IO Error: %s", io_error(io)); + mta_free(s); + break; |