commit b2a7f05dd3a0156d7f35c1d82686d2d276c13306
Author: Bartek Szady <[email protected]>
Date: Fri Nov 26 16:00:11 2021 +0100
- added bug fixing (2, 3) and enhancement patches from fedora, rel 9
defaultvalues.patch | 11 +++
ssmtp-authpass.patch | 13 +++
ssmtp-garbage_writes.patch | 18 +++++
ssmtp-validate-TLS-server-cert.patch | 153 +++++++++++++++++++++++++++++++++++
ssmtp.spec | 10 ++-
5 files changed, 204 insertions(+), 1 deletion(-)
---
diff --git a/ssmtp.spec b/ssmtp.spec
index aad8586..36f54f1 100644
--- a/ssmtp.spec
+++ b/ssmtp.spec
@@ -2,13 +2,17 @@ Summary: Extremely simple MTA to get mail off the system
to a mail hub
Summary(pl.UTF-8): Skrajnie prosty MTA do przekazywania poczty z systemu
do huba
Name: ssmtp
Version: 2.64
-Release: 8
+Release: 9
License: GPL
Group: Networking/Daemons/SMTP
Source0:
http://http.us.debian.org/debian/pool/main/s/ssmtp/%{name}_%{version}.orig.tar.bz2
# Source0-md5: 65b4e0df4934a6cd08c506cabcbe584f
Patch0: %{name}-nonsl.patch
Patch1: %{name}-ssl.patch
+Patch2: %{name}-garbage_writes.patch
+Patch3: %{name}-authpass.patch
+Patch4: %{name}-validate-TLS-server-cert.patch
+Patch5: defaultvalues.patch
BuildRequires: autoconf
BuildRequires: automake
BuildRequires: openssl-devel
@@ -64,6 +68,10 @@ należy do huba pocztowego z własnym administratorem.
%setup -q
%patch0 -p1
%patch1 -p1
+%patch2 -p1
+%patch3 -p1
+%patch4 -p1
+%patch5 -p1
%build
rm -f missing
diff --git a/defaultvalues.patch b/defaultvalues.patch
new file mode 100644
index 0000000..e417cd0
--- /dev/null
+++ b/defaultvalues.patch
@@ -0,0 +1,11 @@
+--- ssmtp-2.64/ssmtp.conf.orig 2008-02-29 03:50:15.000000000 +0100
++++ ssmtp-2.64/ssmtp.conf 2021-11-26 15:50:46.285946096 +0100
+@@ -30,6 +30,8 @@
+
+ # Use SSL/TLS to send secure messages to server.
+ #UseTLS=YES
++#IMPORTANT: The following line is mandatory for TLS authentication
++TLS_CA_File=/etc/ssl/certs/ca-certificates.crt
+
+ # Use SSL/TLS certificate to authenticate against smtp host.
+ #UseTLSCert=YES
diff --git a/ssmtp-authpass.patch b/ssmtp-authpass.patch
new file mode 100644
index 0000000..8937df8
--- /dev/null
+++ b/ssmtp-authpass.patch
@@ -0,0 +1,13 @@
+diff -up ssmtp-2.61/ssmtp.c.orig ssmtp-2.61/ssmtp.c
+--- ssmtp-2.61/ssmtp.c.orig 2008-11-26 17:27:29.000000000 +0200
++++ ssmtp-2.61/ssmtp.c 2008-11-26 17:25:36.000000000 +0200
+@@ -1051,7 +1051,8 @@ bool_t read_config()
+ }
+ }
+ else if(strcasecmp(p, "AuthPass") == 0 && !auth_pass) {
+- if((auth_pass = strdup(q)) == (char *)NULL) {
++ auth_pass = firsttok(&rightside, " \n\t");
++ if(auth_pass == (char *)NULL) {
+ die("parse_config() -- strdup()
failed");
+ }
+
diff --git a/ssmtp-garbage_writes.patch b/ssmtp-garbage_writes.patch
new file mode 100644
index 0000000..754e654
--- /dev/null
+++ b/ssmtp-garbage_writes.patch
@@ -0,0 +1,18 @@
+--- ssmtp-2.64/ssmtp.c.orig 2012-06-30 23:56:31.000000000 +0300
++++ ssmtp-2.64/ssmtp.c 2012-06-30 23:59:02.764119487 +0300
+@@ -1655,12 +1655,12 @@ int ssmtp(char *argv[])
+ outbytes += smtp_write(sock, "%s", leadingdot ? b :
buf);
+ } else {
+ if (log_level > 0) {
+- log_event(LOG_INFO, "Sent a very long line in
chunks");
++ log_event(LOG_INFO, "Sending a partial line");
+ }
+ if (leadingdot) {
+- outbytes += fd_puts(sock, b, sizeof(b));
++ outbytes += fd_puts(sock, b, strlen(b));
+ } else {
+- outbytes += fd_puts(sock, buf, bufsize);
++ outbytes += fd_puts(sock, buf, strlen(buf));
+ }
+ }
+ (void)alarm((unsigned) MEDWAIT);
diff --git a/ssmtp-validate-TLS-server-cert.patch
b/ssmtp-validate-TLS-server-cert.patch
new file mode 100644
index 0000000..96cb331
--- /dev/null
+++ b/ssmtp-validate-TLS-server-cert.patch
@@ -0,0 +1,153 @@
+diff -up ssmtp-2.64/ssmtp.conf.5.orig ssmtp-2.64/ssmtp.conf.5
+--- ssmtp-2.64/ssmtp.conf.5.orig 2013-08-20 10:09:28.912253115 +0300
++++ ssmtp-2.64/ssmtp.conf.5 2013-08-20 10:10:05.666212495 +0300
+@@ -53,6 +53,13 @@ See RFC 2487.
+ .Pp
+ .It Cm TLSCert
+ The file name of an RSA certificate to use for TLS, if required.
++.It Cm TLSKey
++The file name of an RSA key to use for TLS, if required.
++.It Cm TLS_CA_File
++A file of trusted certificates for validating the server, if required.
++.Pp
++.It Cm TLS_CA_Dir
++A directory of trusted certificates for validating the server, if required.
+ .Pp
+ .It Cm AuthUser
+ The user name to use for SMTP AUTH.
+diff -up ssmtp-2.64/ssmtp.c.orig ssmtp-2.64/ssmtp.c
+--- ssmtp-2.64/ssmtp.c.orig 2013-08-20 10:09:03.510255402 +0300
++++ ssmtp-2.64/ssmtp.c 2013-08-20 10:10:05.666212495 +0300
+@@ -69,7 +69,10 @@ char *minus_F = (char)NULL;
+ char *gecos;
+ char *prog = (char)NULL;
+ char *root = NULL;
+-char *tls_cert = "/etc/ssl/certs/ssmtp.pem"; /* Default Certificate */
++char *tls_cert = "/etc/pki/tls/private/ssmtp.pem"; /* Default Certificate
*/
++char *tls_key = "/etc/pki/tls/private/ssmtp.pem"; /* Default private key */
++char *tls_ca_file = NULL; /* Trusted Certificate file */
++char *tls_ca_dir = NULL; /* Trusted Certificate directory */
+ char *uad = (char)NULL;
+ char *config_file = (char)NULL; /* alternate configuration file
*/
+
+@@ -1084,6 +1087,33 @@ bool_t read_config()
+ log_event(LOG_INFO, "Set
TLSCert=\"%s\"\n", tls_cert);
+ }
+ }
++ else if(strcasecmp(p, "TLSKey") == 0) {
++ if((tls_key = strdup(q)) == (char *)NULL) {
++ die("parse_config() -- strdup()
failed");
++ }
++
++ if(log_level > 0) {
++ log_event(LOG_INFO, "Set
TLSKey=\"%s\"\n", tls_key);
++ }
++ }
++ else if(strcasecmp(p, "TLS_CA_File") == 0) {
++ if((tls_ca_file = strdup(q)) == (char *)NULL) {
++ die("parse_config() -- strdup()
failed");
++ }
++
++ if(log_level > 0) {
++ log_event(LOG_INFO, "Set
TLS_CA_File=\"%s\"\n", tls_ca_file);
++ }
++ }
++ else if(strcasecmp(p, "TLS_CA_Dir") == 0) {
++ if((tls_ca_dir = strdup(q)) == (char *)NULL) {
++ die("parse_config() -- strdup()
failed");
++ }
++
++ if(log_level > 0) {
++ log_event(LOG_INFO, "Set
TLS_CA_Dir=\"%s\"\n", tls_ca_dir);
++ }
++ }
+ #endif
+ /* Command-line overrides these */
+ else if(strcasecmp(p, "AuthUser") == 0 && !auth_user) {
+@@ -1168,6 +1198,8 @@ int smtp_open(char *host, int port)
+
+ #ifdef HAVE_SSL
+ int err;
++ long lerr;
++ unsigned long ulerr;
+ char buf[(BUF_SZ + 1)];
+
+ /* Init SSL stuff */
+@@ -1190,7 +1222,7 @@ int smtp_open(char *host, int port)
+ return(-1);
+ }
+
+- if(SSL_CTX_use_PrivateKey_file(ctx, tls_cert, SSL_FILETYPE_PEM)
<= 0) {
++ if(SSL_CTX_use_PrivateKey_file(ctx, tls_key, SSL_FILETYPE_PEM)
<= 0) {
+ perror("Use PrivateKey");
+ return(-1);
+ }
+@@ -1200,6 +1232,16 @@ int smtp_open(char *host, int port)
+ return(-1);
+ }
+ }
++ if (tls_ca_file || tls_ca_dir) {
++ if(!SSL_CTX_load_verify_locations(ctx, tls_ca_file,
tls_ca_dir)) {
++ ulerr = ERR_get_error();
++ log_event(LOG_ERR, "Error setting verify location: %s",
++ ERR_reason_error_string(ulerr));
++ return(-1);
++ }
++ }
++
++ SSL_CTX_set_verify(ctx, SSL_VERIFY_PEER, NULL);
+ #endif
+
+ #ifdef INET6
+@@ -1303,14 +1345,20 @@ int smtp_open(char *host, int port)
+
+ ssl = SSL_new(ctx);
+ if(!ssl) {
+- log_event(LOG_ERR, "SSL not working");
++ ulerr = ERR_get_error();
++ log_event(LOG_ERR, "SSL not working: %s",
++ ERR_reason_error_string(ulerr));
+ return(-1);
+ }
+ SSL_set_fd(ssl, s);
+
+ err = SSL_connect(ssl);
+ if(err < 0) {
+- perror("SSL_connect");
++ ulerr = ERR_get_error();
++ lerr = SSL_get_verify_result(ssl);
++ log_event(LOG_ERR, "SSL not working: %s (%ld)",
++ ERR_reason_error_string(ulerr), lerr);
++
+ return(-1);
+ }
+
+@@ -1324,8 +1372,6 @@ int smtp_open(char *host, int port)
+ return(-1);
+ }
+ X509_free(server_cert);
+-
+- /* TODO: Check server cert if changed! */
+ }
+ #endif
+
+diff -up ssmtp-2.64/TLS.orig ssmtp-2.64/TLS
+--- ssmtp-2.64/TLS.orig 2013-08-20 10:09:52.524212818 +0300
++++ ssmtp-2.64/TLS 2013-08-20 10:10:05.667213425 +0300
+@@ -26,9 +26,13 @@ Set this to yes to make ssmtp identify i
+ TLSCert=<file>
+ Specify which certificate file should be used.
+
++TLSKey=<file>
++Specify which key file should be used (can be the same as the certificate
file).
+
+-TODO:
+-* Check server certificate for changes and notify about it.
+-* Diffrent Certificate and Key file?
++TLS_CA_File=<file>
++Optional file of trusted certificates for validating the server.
++
++TLS_CA_Dir=<file>
++Optional directory of trusted certificates for validating the server.
+
+
================================================================
---- gitweb:
http://git.pld-linux.org/gitweb.cgi/packages/ssmtp.git/commitdiff/b2a7f05dd3a0156d7f35c1d82686d2d276c13306
_______________________________________________
pld-cvs-commit mailing list
[email protected]
http://lists.pld-linux.org/mailman/listinfo/pld-cvs-commit
