1 files changed, 44 insertions, 5 deletions

diff --git a/qmail-remote.c b/qmail-remote.c
index d2412aa..94bb69f 100644
--- a/qmail-remote.c
+++ b/qmail-remote.c
@@ -302,8 +302,8 @@ void smtp_quit()
 {
 #ifdef TLS
   /* shouldn't talk to the client unless in an appropriate state */
-  int state = ssl ? ssl->state : SSL_ST_BEFORE;
-  if (state & SSL_ST_OK || (!smtps && state & SSL_ST_BEFORE))
+  if ((!smtps && !ssl) || (ssl && SSL_is_init_finished(ssl))
+    || (!smtps && ssl && SSL_in_before(ssl)))
 #endif
   substdio_putsflush(&smtpto,"QUIT\r\n");
   /* waiting for remote side is just too ridiculous */
@@ -539,6 +539,41 @@ int tls_init()
   SSL_set_cipher_list(myssl, ciphers);
   alloc_free(saciphers.s);
 
+#if OPENSSL_VERSION_NUMBER >= 0x10100005L
+  stralloc opensslconf = {0};
+  if (control_readfile(&opensslconf, "control/opensslconf", 0) == -1)
+    { SSL_free(myssl); temp_control(); }
+  if (opensslconf.len) {
+    SSL_CONF_CTX *cctx = SSL_CONF_CTX_new();
+    SSL_CONF_CTX_set_flags(cctx, SSL_CONF_FLAG_FILE);
+    SSL_CONF_CTX_set_flags(cctx, SSL_CONF_FLAG_CLIENT);
+    SSL_CONF_CTX_set_flags(cctx, SSL_CONF_FLAG_CERTIFICATE);
+    SSL_CONF_CTX_set_flags(cctx, SSL_CONF_FLAG_SHOW_ERRORS);
+    SSL_CONF_CTX_set_ssl(cctx, myssl);
+
+    int i, j, next = 0;
+    char *cmd, * arg;
+    for (i = 0; i < opensslconf.len; i += next) {
+      cmd = opensslconf.s + i;
+      next = str_len(cmd) + 1;
+
+      j = str_chr(cmd, ' ');
+      arg = cmd + j;
+      while (*arg == ' ') ++arg;
+      cmd[j] = 0;
+
+      if (SSL_CONF_cmd(cctx, cmd, arg) <= 0) {
+        SSL_free(myssl);
+        out("Zopensslconf \""); out(cmd); out(" "); out(arg);
+        out("\" failed: "); out(ssl_error());
+        TLS_QUIT;
+      }
+    }
+
+    (void)SSL_CONF_CTX_finish(cctx);
+  }
+#endif
+
   /* set SNI hostname */
   if (partner_fqdn)
     SSL_set_tlsext_host_name(myssl, partner_fqdn);
@@ -614,8 +649,12 @@ int tls_init()
       X509_NAME *subj = X509_get_subject_name(peercert);
       i = X509_NAME_get_index_by_NID(subj, NID_commonName, -1);
       if (i >= 0) {
-        const ASN1_STRING *s = X509_NAME_get_entry(subj, i)->value;
-        if (s) { peer.len = s->length; peer.s = s->data; }
+        X509_NAME_ENTRY *entry = X509_NAME_get_entry(subj, i);
+        ASN1_STRING *s = X509_NAME_ENTRY_get_data(entry);
+#if OPENSSL_VERSION_NUMBER < 0x10100005L
+#define ASN1_STRING_get0_data ASN1_STRING_data
+#endif
+        if (s) { peer.len = ASN1_STRING_length(s); peer.s = (unsigned char *)ASN1_STRING_get0_data(s); }
       }
       if (peer.len <= 0) {
         out("ZTLS unable to verify server ");
@@ -668,7 +707,7 @@ int utf8received()
     if (r == 0) break;
     if (r == -1) temp_read();
 
-    if (ch == '\n') {
+    if (ch == '\n' && receivedline.len) {
       if (!stralloc_append(&header,"\r")) temp_nomem();                 /* received.c does not add '\r' */
       if (!stralloc_append(&header,"\n")) temp_nomem();
       if (case_startb(receivedline.s,5,"Date:")) return 0;              /* header to quit asap */