1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
|
OpenBSD 6.5 errata 029, January 30, 2020:
smtpd can crash on opportunistic TLS downgrade, causing a denial of service.
--- usr.sbin/smtpd/mta_session.c 23 Dec 2018 16:37:53 -0000 1.115
+++ usr.sbin/smtpd/mta_session.c 20 Jan 2020 10:36:58 -0000
@@ -1292,40 +1292,20 @@ mta_io(struct io *io, int evt, void *arg
break;
case IO_ERROR:
+ case IO_TLSERROR:
log_debug("debug: mta: %p: IO error: %s", s, io_error(io));
- if (!s->ready) {
- mta_error(s, "IO Error: %s", io_error(io));
- mta_connect(s);
- break;
- }
- else if (!(s->flags & (MTA_FORCE_TLS|MTA_FORCE_SMTPS|MTA_FORCE_ANYSSL))) {
- /* error in non-strict SSL negotiation, downgrade to plain */
- if (s->flags & MTA_TLS) {
- log_info("smtp-out: Error on session %016"PRIx64
- ": opportunistic TLS failed, "
- "downgrading to plain", s->id);
- s->flags &= ~MTA_TLS;
- s->flags |= MTA_DOWNGRADE_PLAIN;
- mta_connect(s);
- break;
- }
- }
- mta_error(s, "IO Error: %s", io_error(io));
- mta_free(s);
- break;
- case IO_TLSERROR:
- log_debug("debug: mta: %p: TLS IO error: %s", s, io_error(io));
- if (!(s->flags & (MTA_FORCE_TLS|MTA_FORCE_SMTPS|MTA_FORCE_ANYSSL))) {
+ if (s->state == MTA_STARTTLS && s->use_smtp_tls) {
/* error in non-strict SSL negotiation, downgrade to plain */
- log_info("smtp-out: TLS Error on session %016"PRIx64
- ": TLS failed, "
+ log_info("smtp-out: Error on session %016"PRIx64
+ ": opportunistic TLS failed, "
"downgrading to plain", s->id);
s->flags &= ~MTA_TLS;
s->flags |= MTA_DOWNGRADE_PLAIN;
mta_connect(s);
break;
}
+
mta_error(s, "IO Error: %s", io_error(io));
mta_free(s);
break;
|
