53 lines
1.6 KiB
Diff
53 lines
1.6 KiB
Diff
OpenBSD 6.5 errata 029, January 30, 2020:
|
|
|
|
smtpd can crash on opportunistic TLS downgrade, causing a denial of service.
|
|
|
|
--- usr.sbin/smtpd/mta_session.c 23 Dec 2018 16:37:53 -0000 1.115
|
|
+++ usr.sbin/smtpd/mta_session.c 20 Jan 2020 10:36:58 -0000
|
|
@@ -1292,40 +1292,20 @@ mta_io(struct io *io, int evt, void *arg
|
|
break;
|
|
|
|
case IO_ERROR:
|
|
+ case IO_TLSERROR:
|
|
log_debug("debug: mta: %p: IO error: %s", s, io_error(io));
|
|
- if (!s->ready) {
|
|
- mta_error(s, "IO Error: %s", io_error(io));
|
|
- mta_connect(s);
|
|
- break;
|
|
- }
|
|
- else if (!(s->flags & (MTA_FORCE_TLS|MTA_FORCE_SMTPS|MTA_FORCE_ANYSSL))) {
|
|
- /* error in non-strict SSL negotiation, downgrade to plain */
|
|
- if (s->flags & MTA_TLS) {
|
|
- log_info("smtp-out: Error on session %016"PRIx64
|
|
- ": opportunistic TLS failed, "
|
|
- "downgrading to plain", s->id);
|
|
- s->flags &= ~MTA_TLS;
|
|
- s->flags |= MTA_DOWNGRADE_PLAIN;
|
|
- mta_connect(s);
|
|
- break;
|
|
- }
|
|
- }
|
|
- mta_error(s, "IO Error: %s", io_error(io));
|
|
- mta_free(s);
|
|
- break;
|
|
|
|
- case IO_TLSERROR:
|
|
- log_debug("debug: mta: %p: TLS IO error: %s", s, io_error(io));
|
|
- if (!(s->flags & (MTA_FORCE_TLS|MTA_FORCE_SMTPS|MTA_FORCE_ANYSSL))) {
|
|
+ if (s->state == MTA_STARTTLS && s->use_smtp_tls) {
|
|
/* error in non-strict SSL negotiation, downgrade to plain */
|
|
- log_info("smtp-out: TLS Error on session %016"PRIx64
|
|
- ": TLS failed, "
|
|
+ log_info("smtp-out: Error on session %016"PRIx64
|
|
+ ": opportunistic TLS failed, "
|
|
"downgrading to plain", s->id);
|
|
s->flags &= ~MTA_TLS;
|
|
s->flags |= MTA_DOWNGRADE_PLAIN;
|
|
mta_connect(s);
|
|
break;
|
|
}
|
|
+
|
|
mta_error(s, "IO Error: %s", io_error(io));
|
|
mta_free(s);
|
|
break;
|