OpenSSL: clear any leftover errors from the stack after SSL_accept succeeds

diff --git a/doc/doc-txt/ChangeLog b/doc/doc-txt/ChangeLog
index e9e83e0ab8cb7b838a54a303e62ed6e196d6a86a..785d59bed05b40949ef1a62aeb53538e251a9ca7 100644 (file)
--- a/doc/doc-txt/ChangeLog
+++ b/doc/doc-txt/ChangeLog
@@ -175,6 +175,11 @@ JH/37 Bug 2341: Send "message delayed" warning MDNs (restricted to external
 
 JH/38 Bug 2351: Log failures to extract envelope addresses from message headers.
 
 
 JH/38 Bug 2351: Log failures to extract envelope addresses from message headers.
 

+JH/39 OpenSSL: clear the error stack after an SSL_accept().  With anon-auth
+      cipher-suites, an error can be left on the stack even for a succeeding
+      accept; this results in impossible error messages when a later operation
+      actually does fail.
+

 
 Exim version 4.91
 -----------------
 
 Exim version 4.91
 -----------------

diff --git a/src/src/pdkim/signing.c b/src/src/pdkim/signing.c
index 7b8a6a0df5e44f11e6393f8e080595627d02913f..2a086b1e2793d69887beee01d919d0cd533bfb3d 100644 (file)
--- a/src/src/pdkim/signing.c
+++ b/src/src/pdkim/signing.c
@@ -831,6 +831,7 @@ const uschar *
 exim_dkim_verify(ev_ctx * verify_ctx, hashmethod hash, blob * data, blob * sig)
 {
 const EVP_MD * md;
 exim_dkim_verify(ev_ctx * verify_ctx, hashmethod hash, blob * data, blob * sig)
 {
 const EVP_MD * md;

+const uschar * where;

 
 switch (hash)
   {
 
 switch (hash)
   {


@@ -859,18 +860,25 @@ else
   {
   EVP_PKEY_CTX * ctx;
 
   {
   EVP_PKEY_CTX * ctx;
 

-  if (  (ctx = EVP_PKEY_CTX_new(verify_ctx->key, NULL))
-     && EVP_PKEY_verify_init(ctx) > 0
-     && EVP_PKEY_CTX_set_rsa_padding(ctx, RSA_PKCS1_PADDING) > 0
-     && EVP_PKEY_CTX_set_signature_md(ctx, md) > 0
-     && EVP_PKEY_verify(ctx, sig->data, sig->len,
-         data->data, data->len) == 1
-     )
-    { EVP_PKEY_CTX_free(ctx); return NULL; }
-
-  if (ctx) EVP_PKEY_CTX_free(ctx);
+  if ((where = US"EVP_PKEY_CTX_new",
+          (ctx = EVP_PKEY_CTX_new(verify_ctx->key, NULL))))
+    {
+    if (  (where = US"EVP_PKEY_verify_init",
+                     EVP_PKEY_verify_init(ctx) > 0)
+       && (where = US"EVP_PKEY_CTX_set_rsa_padding",
+                     EVP_PKEY_CTX_set_rsa_padding(ctx, RSA_PKCS1_PADDING) > 0)
+       && (where = US"EVP_PKEY_CTX_set_signature_md",
+                     EVP_PKEY_CTX_set_signature_md(ctx, md) > 0)
+       && (where = US"EVP_PKEY_verify",
+                     EVP_PKEY_verify(ctx, sig->data, sig->len,
+                                     data->data, data->len) == 1)
+       )
+      { EVP_PKEY_CTX_free(ctx); return NULL; }
+
+    EVP_PKEY_CTX_free(ctx);
+    }

   }
   }

-return US ERR_error_string(ERR_get_error(), NULL);
+return string_sprintf("%s: %s", where, ERR_error_string(ERR_get_error(), NULL));

 }
 
 
 }
 
 

diff --git a/src/src/tls-openssl.c b/src/src/tls-openssl.c
index 8a1fec6a9be7f5284f065c1cdb64a4f6a5e395b0..8f4cf4d82fbd937502918de05501b883fbd866c3 100644 (file)
--- a/src/src/tls-openssl.c
+++ b/src/src/tls-openssl.c
@@ -2281,6 +2281,8 @@ if (rc <= 0)
   }
 
 DEBUG(D_tls) debug_printf("SSL_accept was successful\n");
   }
 
 DEBUG(D_tls) debug_printf("SSL_accept was successful\n");

+ERR_clear_error();     /* Even success can leave errors in the stack. Seen with
+                       anon-authentication ciphersuite negociated. */

 
 /* TLS has been set up. Adjust the input functions to read via TLS,
 and initialize things. */
 
 /* TLS has been set up. Adjust the input functions to read via TLS,
 and initialize things. */