Subject: certificate checking in ssl_start_tls()

From: "Peter Derr" <[email-masked]>
Date: Mon, 22 Jul 2002 11:34:22 -0400

In imap-2002.RC1, in src/imapd/imapd.c this code at line 3169 is used to
decide whether to advertise STARTTLS capability:

      if (s = ssl_start_tls (NIL)) fs_give ((void *) &s);
      else PSOUT (" STARTTLS");

But, in src/osdep/unix/ssl_unix.c the ssl_start_tls() function doesn't check
whether the certificate exists if passed a null pointer as the server
parameter:

/* Start TLS
 * Accepts: /etc/services service name
 * Returns: cpystr'd error string if TLS failed, else NIL for success
 */

char *ssl_start_tls (char *server)
{
  char tmp[MAILTMPLEN];
  struct stat sbuf;
  if (sslstdio) return cpystr ("Already in an SSL session");
  if (start_tls) return cpystr ("TLS already started");
  if (server) { /* build specific certificate/key file name */
    sprintf (tmp,"%s/%s-%s.pem",SSL_CERT_DIRECTORY,server,tcp_serveraddr
());
    if (stat (tmp,&sbuf)) { /* use non-specific name if no specific file */
      sprintf (tmp,"%s/%s.pem",SSL_CERT_DIRECTORY,server);
      if (stat (tmp,&sbuf)) return cpystr ("Server certificate not
installed");
    }
    start_tls = server; /* switch to STARTTLS mode */
  }
  return NIL;
}

The result is that, if built with SSL capability, the imapd server
advertises STARTTLS even when there's no certificate.

One way to get around this is to pass something other than "NIL" when
calling ssl_start_tls from imapd.c, for example:

*** 3166,3172 ****
    }
    if (flag <= 0) {            /* want pre-authentication capabilities? */
     PSOUT (" LOGIN-REFERRALS");
!     if (s = ssl_start_tls (NIL)) fs_give ((void *) &s);
      else PSOUT (" STARTTLS");
                                /* disable plaintext */
      if (mail_parameters (NIL,GET_DISABLEPLAINTEXT,NIL)) {
--- 3166,3172 ----
    }
    if (flag <= 0) {            /* want pre-authentication capabilities? */
     PSOUT (" LOGIN-REFERRALS");
!     if (s = ssl_start_tls ("imapd")) fs_give ((void *) &s);
      else PSOUT (" STARTTLS");
                                /* disable plaintext */
      if (mail_parameters (NIL,GET_DISABLEPLAINTEXT,NIL)) {

Is this a good solution or is there a better way?

Thanks,

Peter Derr
HP Tru64 UNIX Engineering

-- 
------------------------------------------------------------------
 For information about this mailing list, and its archives, see: 
 http://www.washington.edu/imap/c-client-list.html
------------------------------------------------------------------

---

From: "Peter Derr" <[email-masked]>
Date: Thu, 15 Aug 2002 17:26:43 -0400

In my message of July 22 I said:

> parameter.

> advertises STARTTLS even when there's no certificate.

And then I proposed a fix, but my fix had the unfortunate side effect of
causing all TLS connections to fail because the static variable 'start_tls'
in src/osdep/unix/ssl_unix.c was set prematurely.

A better solution to this problem requires small modifications to both
src/osdep/unix/ssl_unix.c and src/imapd/imapd.c.

My context diffs against 2002.RC2 are in the attached text file.  I've
tested this with Pine and MS OE 6 with and without TLS and with and without
SSL.

Comments??

Peter Derr

---

From: Mark Crispin <[email-masked]>
Date: Tue, 20 Aug 2002 18:31:18 -0700 (Pacific Daylight Time)

> advertises STARTTLS even when there's no certificate.

This is intentional.  If you do STARTTLS in that situation, you'll get a
"Server certificate not installed" error message, which explains the
problem and what has to be done to fix it.

Otherwise, people will wonder why, when they built a server with SSL/TLS
support, it doesn't advertise it.

-- Mark --

http://staff.washington.edu/mrc
Science does not emerge from voting, party politics, or public debate.

---

From: "Peter Derr" <[email-masked]>
Date: Thu, 22 Aug 2002 16:23:41 -0400

> support, it doesn't advertise it.

Well, I've said this before, but my goal is to provide one pre-built imapd
for our customers that they may use with SSL/TLS, if they want to and have a
certificate, or without, it they don't.  The change I suggest allows this.

Peter