Logging: make cipher info available for continued-TLS connection deliveries

diff --git a/doc/doc-docbook/spec.xfpt b/doc/doc-docbook/spec.xfpt
index 128ee8004002062b88476fe64b63b6a5e715c2a1..c62c1eecf1e1e86deb010b363ecf3dbaf2622851 100644 (file)
--- a/doc/doc-docbook/spec.xfpt
+++ b/doc/doc-docbook/spec.xfpt
@@ -3869,12 +3869,12 @@ by Exim in conjunction with the &%-MC%& option, and passes on the fact that the
 host to which Exim is connected supports TLS encryption.
 
 .new
-.vitem &%-MCt%&&~<&'IP&~address'&>&~<&'port'&>
+.vitem &%-MCt%&&~<&'IP&~address'&>&~<&'port'&>&~<&'cipher'&>
 .oindex "&%-MCt%&"
 This option is not intended for use by external callers. It is used internally
 by Exim in conjunction with the &%-MC%& option, and passes on the fact that the
 connection is being proxied by a parent process for handling TLS encryption.
-The pair of arguments give the local address and port being proxied.
+The arguments give the local address and port being proxied, and the TLS cipher.
 .wen
 
 .vitem &%-Mc%&&~<&'message&~id'&>&~<&'message&~id'&>&~...
@@ -35774,10 +35774,9 @@ down a single SMTP connection, an asterisk follows the IP address in the log
 lines for the second and subsequent messages.
 .new
 When two or more messages are delivered down a single TLS connection, the
-DNS and TLS-related information logged for the first message delivered
+DNS and some TLS-related information logged for the first message delivered
 will not be present in the log lines for the second and subsequent messages.
-A TLS-marker indication of &'X=*'& is added to the log line instead of
-cipher information.
+TLS cipher information is still available.
 .wen
 
 .cindex "delivery" "cutthrough; logging"
@@ -35906,7 +35905,7 @@ the following table:
 &`T   `&        on &`<=`& lines: message subject (topic)
 &`    `&        on &`=>`& &`**`& and &`==`& lines: transport name
 &`U   `&        local user or RFC 1413 identity
-&`X   `&        TLS cipher suite, or TLS usage mark
+&`X   `&        TLS cipher suite
 .endd
 
 

diff --git a/doc/doc-txt/ChangeLog b/doc/doc-txt/ChangeLog
index ac35c75f1aa150caa7583130ce9feeee7d56d694..3e5d6f7fc4e544b5d96b38d11f577d4d84345d69 100644 (file)
--- a/doc/doc-txt/ChangeLog
+++ b/doc/doc-txt/ChangeLog
@@ -24,8 +24,7 @@ JH/03 Rework the transport continued-connection mechanism: when TLS is active,
       the passed-on TCP connection.  Instead, proxy the child (and any
       subsequent ones) for TLS via a unix-domain socket channel.  Logging is
       affected: the continued delivery log lines do not have any DNSSEC, TLS
-      cipher, Certificate or OCSP information. A "continued-TLS" marker is
-      added instead of the cipher information: "X=*".
+      Certificate or OCSP information.  TLS cipher information is still logged.
 
 JH/04 Shorten the log line for daemon startup by collapsing adjacent sets of
       identical IP addresses on different listening ports.  Will also affect

diff --git a/src/src/deliver.c b/src/src/deliver.c
index 7743d37c3eb77ec59b1f798e74c21d73bb7d9d34..ccc32667e7ed3a57039eb81c45a54275dda88473 100644 (file)
--- a/src/src/deliver.c
+++ b/src/src/deliver.c
@@ -4715,8 +4715,12 @@ for (delivery_count = 0; addr_remote; delivery_count++)
 
         rmt_dlv_checked_write(fd, 'X', '1', big_buffer, ptr - big_buffer);
         }
-      else if (continue_proxy)         /* known TLS, but no cipher info */
-        rmt_dlv_checked_write(fd, 'X', '1', US"*\0", 3);
+      else if (continue_proxy_cipher)
+       {
+        ptr = big_buffer + sprintf(CS big_buffer, "%.128s", continue_proxy_cipher) + 1;
+       *ptr++ = 0;
+        rmt_dlv_checked_write(fd, 'X', '1', big_buffer, ptr - big_buffer);
+       }
 
       if (addr->peercert)
        {

diff --git a/src/src/exim.c b/src/src/exim.c
index fd08cc780d7c233fa103ca03b2d244f675bafb56..383382072dfe0cc9bd013d4c7208d0d4ce07a340 100644 (file)
--- a/src/src/exim.c
+++ b/src/src/exim.c
@@ -2710,7 +2710,7 @@ for (i = 1; i < argc; i++)
 
       /* Set up $sending_ip_address and $sending_port, unless proxied */
 
-      if (!continue_proxy)
+      if (!continue_proxy_cipher)
        if (getsockname(fileno(stdin), (struct sockaddr *)(&interface_sock),
            &size) == 0)
          sending_ip_address = host_ntoa(-1, &interface_sock, NULL,
@@ -2774,13 +2774,15 @@ for (i = 1; i < argc; i++)
 #ifdef SUPPORT_TLS
     /* -MCt: similar to -MCT below but the connection is still open
     via a proxy proces which handles the TLS context and coding.
-    Require two arguments for the proxied local address and port.  */
+    Require three arguments for the proxied local address and port,
+    and the TLS cipher.  */
 
-       case 't': continue_proxy = TRUE;
-                 if (++i < argc) sending_ip_address = argv[i];
+       case 't': if (++i < argc) sending_ip_address = argv[i];
                  else badarg = TRUE;
                  if (++i < argc) sending_port = (int)(Uatol(argv[i]));
                  else badarg = TRUE;
+                 if (++i < argc) continue_proxy_cipher = argv[i];
+                 else badarg = TRUE;
                  /*FALLTHROUGH*/
 
     /* -MCT: set the tls_offered flag; this is useful only when it

diff --git a/src/src/globals.c b/src/src/globals.c
index f3e4bad96bb5b3c0c01e26b799a9aefd83e476d4..9e417b0d295ef70705d6daf76ab0c7a8256dc2ee 100644 (file)
--- a/src/src/globals.c
+++ b/src/src/globals.c
@@ -529,11 +529,11 @@ uid_t   config_uid             = 0;
 #endif
 
 int     connection_max_messages= -1;
+uschar *continue_proxy_cipher  = NULL;
 uschar *continue_hostname      = NULL;
 uschar *continue_host_address  = NULL;
 BOOL    continue_more          = FALSE;
 int     continue_sequence      = 1;
-BOOL    continue_proxy        = FALSE;
 uschar *continue_transport     = NULL;
 
 uschar *csa_status             = NULL;

diff --git a/src/src/globals.h b/src/src/globals.h
index 750a960ebe2dbc761c85932fe2ac685986181bed..72be706a46fe4f797e2c629009e6bc90c892e2b4 100644 (file)
--- a/src/src/globals.h
+++ b/src/src/globals.h
@@ -289,11 +289,11 @@ extern uschar *config_main_filelist;   /* List of possible config files */
 extern uschar *config_main_filename;   /* File name actually used */
 extern uschar *config_main_directory;  /* Directory where the main config file was found */
 extern uid_t   config_uid;             /* Additional owner */
+extern uschar *continue_proxy_cipher;  /* TLS cipher for proxied continued delivery */
 extern uschar *continue_hostname;      /* Host for continued delivery */
 extern uschar *continue_host_address;  /* IP address for ditto */
 extern BOOL    continue_more;          /* Flag more addresses waiting */
 extern int     continue_sequence;      /* Sequence num for continued delivery */
-extern BOOL    continue_proxy;        /* Continued delivery is proxied for TLS */
 extern uschar *continue_transport;     /* Transport for continued delivery */
 
 extern uschar *csa_status;             /* Client SMTP Authorization result */

diff --git a/src/src/transport.c b/src/src/transport.c
index aca33762b12c10036da01ac4a3c7567ebe8632b5..e6e327822c1a6d7224e21ab958eab61ad132f5c0 100644 (file)
--- a/src/src/transport.c
+++ b/src/src/transport.c
@@ -1959,7 +1959,7 @@ DEBUG(D_transport) debug_printf("transport_pass_socket entered\n");
 
 if ((pid = fork()) == 0)
   {
-  int i = 19;
+  int i = 20;
   const uschar **argv;
 
   /* Disconnect entirely from the parent process. If we are running in the
@@ -1983,11 +1983,12 @@ if ((pid = fork()) == 0)
   if (smtp_peer_options & PEER_OFFERED_SIZE) argv[i++] = US"-MCS";
 #ifdef SUPPORT_TLS
   if (smtp_peer_options & PEER_OFFERED_TLS)
-    if (tls_out.active >= 0 || continue_proxy)
+    if (tls_out.active >= 0 || continue_proxy_cipher)
       {
       argv[i++] = US"-MCt";
       argv[i++] = sending_ip_address;
       argv[i++] = string_sprintf("%d", sending_port);
+      argv[i++] = tls_out.active >= 0 ? tls_out.cipher : continue_proxy_cipher;
       }
     else
       argv[i++] = US"-MCT";

diff --git a/src/src/transports/smtp.c b/src/src/transports/smtp.c
index 52e04b8a57a032082679a7a5929796b2903439e5..34c96dbff29829a0aa2fad65d2b057b33acd7a9d 100644 (file)
--- a/src/src/transports/smtp.c
+++ b/src/src/transports/smtp.c
@@ -1823,7 +1823,7 @@ else
   /* For a continued connection with TLS being proxied for us, nothing
   more to do. */
 
-  if (continue_proxy)
+  if (continue_proxy_cipher)
     {
     sx->peer_offered = smtp_peer_options;
     pipelining_active = !!(smtp_peer_options & PEER_OFFERED_PIPE);
@@ -3277,7 +3277,7 @@ if (sx.completed_addr && sx.ok && sx.send_quit)
      || continue_more
      || (
 #ifdef SUPPORT_TLS
-          (  tls_out.active < 0  &&  !continue_proxy
+          (  tls_out.active < 0  &&  !continue_proxy_cipher
            || verify_check_given_host(&sx.ob->hosts_nopass_tls, host) != OK
           )
         &&

diff --git a/test/log/2013 b/test/log/2013
index ad78743ec15523c670ba85189ca2cba05d6ffb3e..e66fdbfae0391c51b5cae6a33075a7acf7745d98 100644 (file)
--- a/test/log/2013
+++ b/test/log/2013
@@ -4,9 +4,9 @@
 1999-03-02 09:44:33 Start queue run: pid=pppp -qqf
 1999-03-02 09:44:33 10HmaX-0005vi-00 => userx@test.ex R=client T=send_to_server H=127.0.0.1 [127.0.0.1] X=TLS1.x:xxxxRSA_AES_256_CBC_SHAnnn:256 CV=no DN="C=UK,O=The Exim Maintainers,OU=Test Suite,CN=Phil Pennock" C="250 OK id=10HmbA-0005vi-00"
 1999-03-02 09:44:33 10HmaX-0005vi-00 Completed
-1999-03-02 09:44:33 10HmaZ-0005vi-00 => userz@test.ex R=client T=send_to_server H=127.0.0.1 [127.0.0.1]* X=* CV=no C="250 OK id=10HmbB-0005vi-00"
+1999-03-02 09:44:33 10HmaZ-0005vi-00 => userz@test.ex R=client T=send_to_server H=127.0.0.1 [127.0.0.1]* X=TLS1.x:xxxxRSA_AES_256_CBC_SHAnnn:256 CV=no C="250 OK id=10HmbB-0005vi-00"
 1999-03-02 09:44:33 10HmaZ-0005vi-00 Completed
-1999-03-02 09:44:33 10HmaY-0005vi-00 => usery@test.ex R=client T=send_to_server H=127.0.0.1 [127.0.0.1]* X=* CV=no C="250 OK id=10HmbC-0005vi-00"
+1999-03-02 09:44:33 10HmaY-0005vi-00 => usery@test.ex R=client T=send_to_server H=127.0.0.1 [127.0.0.1]* X=TLS1.x:xxxxRSA_AES_256_CBC_SHAnnn:256 CV=no C="250 OK id=10HmbC-0005vi-00"
 1999-03-02 09:44:33 10HmaY-0005vi-00 Completed
 1999-03-02 09:44:33 End queue run: pid=pppp -qqf
 

diff --git a/test/log/2113 b/test/log/2113
index 88eafe9b3d690ce7a50c4e80ab39f3a326d64b63..144154088f295a5a87bf16bbc0fefee99c105f50 100644 (file)
--- a/test/log/2113
+++ b/test/log/2113
@@ -4,9 +4,9 @@
 1999-03-02 09:44:33 Start queue run: pid=pppp -qqf
 1999-03-02 09:44:33 10HmaX-0005vi-00 => userx@test.ex R=client T=send_to_server H=127.0.0.1 [127.0.0.1] X=TLSv1:AES256-SHA:256 CV=no DN="/C=UK/O=The Exim Maintainers/OU=Test Suite/CN=Phil Pennock" C="250 OK id=10HmbA-0005vi-00"
 1999-03-02 09:44:33 10HmaX-0005vi-00 Completed
-1999-03-02 09:44:33 10HmaZ-0005vi-00 => userz@test.ex R=client T=send_to_server H=127.0.0.1 [127.0.0.1]* X=* CV=no C="250 OK id=10HmbB-0005vi-00"
+1999-03-02 09:44:33 10HmaZ-0005vi-00 => userz@test.ex R=client T=send_to_server H=127.0.0.1 [127.0.0.1]* X=TLSv1:AES256-SHA:256 CV=no C="250 OK id=10HmbB-0005vi-00"
 1999-03-02 09:44:33 10HmaZ-0005vi-00 Completed
-1999-03-02 09:44:33 10HmaY-0005vi-00 => usery@test.ex R=client T=send_to_server H=127.0.0.1 [127.0.0.1]* X=* CV=no C="250 OK id=10HmbC-0005vi-00"
+1999-03-02 09:44:33 10HmaY-0005vi-00 => usery@test.ex R=client T=send_to_server H=127.0.0.1 [127.0.0.1]* X=TLSv1:AES256-SHA:256 CV=no C="250 OK id=10HmbC-0005vi-00"
 1999-03-02 09:44:33 10HmaY-0005vi-00 Completed
 1999-03-02 09:44:33 End queue run: pid=pppp -qqf
 

diff --git a/test/stderr/2013 b/test/stderr/2013
index c183664d6ab6d5c99bda97dd83adb96097c5bdbe..4c1b0ce122b05af8d3e56b56ecbdcf0fe3050fb8 100644 (file)
--- a/test/stderr/2013
+++ b/test/stderr/2013
@@ -49,7 +49,7 @@ cmd buf flush ddd bytes
   SMTP<< 250 OK id=10HmbB-0005vi-00
   SMTP(close)>>
 LOG: MAIN
-  => userz@test.ex R=client T=send_to_server H=127.0.0.1 [127.0.0.1]* X=* CV=no C="250 OK id=10HmbB-0005vi-00"
+  => userz@test.ex R=client T=send_to_server H=127.0.0.1 [127.0.0.1]* X=TLS1.x:xxxxRSA_AES_256_CBC_SHAnnn:256 CV=no C="250 OK id=10HmbB-0005vi-00"
 LOG: MAIN
   Completed
 >>>>>>>>>>>>>>>> Exim pid=pppp terminating with rc=0 >>>>>>>>>>>>>>>>
@@ -70,7 +70,7 @@ cmd buf flush ddd bytes
   SMTP(close)>>
 >>>>>>>>>>>>>>>> Exim pid=pppp terminating with rc=0 >>>>>>>>>>>>>>>>
 LOG: MAIN
-  => usery@test.ex R=client T=send_to_server H=127.0.0.1 [127.0.0.1]* X=* CV=no C="250 OK id=10HmbC-0005vi-00"
+  => usery@test.ex R=client T=send_to_server H=127.0.0.1 [127.0.0.1]* X=TLS1.x:xxxxRSA_AES_256_CBC_SHAnnn:256 CV=no C="250 OK id=10HmbC-0005vi-00"
 LOG: MAIN
   Completed
 >>>>>>>>>>>>>>>> Exim pid=pppp terminating with rc=0 >>>>>>>>>>>>>>>>

diff --git a/test/stderr/2113 b/test/stderr/2113
index ae0044b99674ce699997a66c0284ce9cb5d55760..af5ff730f9d1a1373563da6feb4a33e2082b03f4 100644 (file)
--- a/test/stderr/2113
+++ b/test/stderr/2113
@@ -49,7 +49,7 @@ cmd buf flush ddd bytes
   SMTP<< 250 OK id=10HmbB-0005vi-00
   SMTP(close)>>
 LOG: MAIN
-  => userz@test.ex R=client T=send_to_server H=127.0.0.1 [127.0.0.1]* X=* CV=no C="250 OK id=10HmbB-0005vi-00"
+  => userz@test.ex R=client T=send_to_server H=127.0.0.1 [127.0.0.1]* X=TLSv1:AES256-SHA:256 CV=no C="250 OK id=10HmbB-0005vi-00"
 LOG: MAIN
   Completed
 >>>>>>>>>>>>>>>> Exim pid=pppp terminating with rc=0 >>>>>>>>>>>>>>>>
@@ -70,7 +70,7 @@ cmd buf flush ddd bytes
   SMTP(close)>>
 >>>>>>>>>>>>>>>> Exim pid=pppp terminating with rc=0 >>>>>>>>>>>>>>>>
 LOG: MAIN
-  => usery@test.ex R=client T=send_to_server H=127.0.0.1 [127.0.0.1]* X=* CV=no C="250 OK id=10HmbC-0005vi-00"
+  => usery@test.ex R=client T=send_to_server H=127.0.0.1 [127.0.0.1]* X=TLSv1:AES256-SHA:256 CV=no C="250 OK id=10HmbC-0005vi-00"
 LOG: MAIN
   Completed
 >>>>>>>>>>>>>>>> Exim pid=pppp terminating with rc=0 >>>>>>>>>>>>>>>>