qmail-remote: let openssl verify the certificate

this is veeery old code. openssl already handles this for us

1 files changed, 14 insertions, 45 deletions

diff --git a/qmail-remote.c b/qmail-remote.c
index dbeef95..7eb2714 100644
--- a/qmail-remote.c
+++ b/qmail-remote.c
@@ -82,10 +82,15 @@ void out(s) char *s; { if (substdio_puts(subfdoutsmall,s) == -1) _exit(0); }
 void zero() { if (substdio_put(subfdoutsmall,"\0",1) == -1) _exit(0); }
 void zeroflush()  { zero(); substdio_flush(subfdoutsmall); }
 void zerodie() { zeroflush(); _exit(0); }
-void outsafe(sa) stralloc *sa; { int i; unsigned char ch;
-for (i = 0;i < sa->len;++i) {
-ch = sa->s[i]; if (ch < 33) ch = '?'; if (ch > 126 && ch <= 127) ch = '?';
-if (substdio_put(subfdoutsmall,&ch,1) == -1) _exit(0); } }
+void outsafe(const stralloc *sa) {
+  int i; unsigned char ch;
+  for (i = 0;i < sa->len;++i) {
+    ch = sa->s[i];
+    if (ch < 33) ch = '?';
+    if (ch > 126 && ch <= 127) ch = '?';
+    if (substdio_put(subfdoutsmall,&ch,1) == -1) _exit(0);
+  }
+}
 
 void temp_nomem() { out("ZOut of memory. (#4.3.0)\n"); zerodie(); }
 void temp_oserr() { out("Z\
@@ -511,6 +516,11 @@ static int tls_init(unsigned long code, struct ip_mx *current_mx)
     }
     /* set the callback here; SSL_set_verify didn't work before 0.9.6c */
     SSL_CTX_set_verify(ctx, SSL_VERIFY_PEER, verify_cb);
+
+    X509_VERIFY_PARAM *param = X509_VERIFY_PARAM_new();
+    X509_VERIFY_PARAM_set1_host(param, mx_host, 0);
+    SSL_CTX_set1_param(ctx, param);
+    X509_VERIFY_PARAM_free(param);
   }
 
   /* let the other side complain if it needs a cert and we don't have one */
@@ -681,47 +691,6 @@ static int tls_init(unsigned long code, struct ip_mx *current_mx)
       tls_quit(servercert, X509_verify_cert_error_string(r));
     }
     alloc_free(servercert);
-
-    peercert = SSL_get_peer_certificate(myssl);
-    if (!peercert) {
-      out("ZTLS unable to verify server ");
-      tls_quit(mx_host, "no certificate provided");
-    }
-
-    /* RFC 2595 section 2.4: find a matching name
-     * first find a match among alternative names */
-    gens = X509_get_ext_d2i(peercert, NID_subject_alt_name, 0, 0);
-    if (gens) {
-      for (i = 0, r = sk_GENERAL_NAME_num(gens); i < r; ++i)
-      {
-        const GENERAL_NAME *gn = sk_GENERAL_NAME_value(gens, i);
-        if (gn->type == GEN_DNS)
-          if (match_mx_host(mx_host, ASN1_STRING_get0_data(gn->d.dNSName), ASN1_STRING_length(gn->d.dNSName))) break;
-      }
-      sk_GENERAL_NAME_pop_free(gens, GENERAL_NAME_free);
-    }
-
-    /* no alternative name matched, look up commonName */
-    if (!gens || i >= r) {
-      stralloc peer = {0};
-      X509_NAME *subj = X509_get_subject_name(peercert);
-      i = X509_NAME_get_index_by_NID(subj, NID_commonName, -1);
-      if (i >= 0) {
-        X509_NAME_ENTRY *entry = X509_NAME_get_entry(subj, i);
-        ASN1_STRING *s = X509_NAME_ENTRY_get_data(entry);
-        if (s) { peer.len = ASN1_STRING_length(s); peer.s = (char *)ASN1_STRING_get0_data(s); }
-      }
-      if (peer.len <= 0) {
-        out("ZTLS unable to verify server ");
-        tls_quit(mx_host, "certificate contains no valid commonName");
-      }
-      if (!match_mx_host(mx_host, peer.s, peer.len)) {
-        out("ZTLS unable to verify server "); out(mx_host);
-        out(": received certificate for "); outsafe(&peer); TLS_QUIT;
-      }
-    }
-
-    X509_free(peercert);
   }
   /* DANE: verify result */
   else if (tlsa_rr.len) {