[pkgsrc/trunk]: pkgsrc/mail/up-imappproxy mail/up-imappproxy: add patch to ve...

[tm <tm%pkgsrc.org@localhost>]

details:   https://anonhg.NetBSD.org/pkgsrc/rev/22a6ccbf8985
branches:  trunk
changeset: 448964:22a6ccbf8985
user:      tm <tm%pkgsrc.org@localhost>
date:      Thu Mar 18 22:05:56 2021 +0000

description:
mail/up-imappproxy: add patch to verify hostname on tls connection

Patch provided from OpenBSD and reported by Stuart Henderson

diffstat:

 mail/up-imappproxy/Makefile                                       |   4 +-
 mail/up-imappproxy/distinfo                                       |   3 +-
 mail/up-imappproxy/patches/patch-fix-verify-hostname-imapcommon.c |  39 ++++++++++
 3 files changed, 43 insertions(+), 3 deletions(-)

diffs (74 lines):

diff -r 17727e079f7d -r 22a6ccbf8985 mail/up-imappproxy/Makefile
--- a/mail/up-imappproxy/Makefile       Thu Mar 18 21:59:17 2021 +0000
+++ b/mail/up-imappproxy/Makefile       Thu Mar 18 22:05:56 2021 +0000
@@ -1,8 +1,8 @@
-# $NetBSD: Makefile,v 1.3 2020/05/02 19:16:15 rillig Exp $
+# $NetBSD: Makefile,v 1.4 2021/03/18 22:05:56 tm Exp $
 
 VERSION=       1.2.8
 PKGNAME=       up-imapproxy-${VERSION}
-PKGREVISION=   1
+PKGREVISION=   2
 DISTNAME=      up-imapproxy_${VERSION}~svn20171105.orig
 CATEGORIES=    mail
 MASTER_SITES=  ${MASTER_SITE_DEBIAN:=pool/main/u/up-imapproxy/}
diff -r 17727e079f7d -r 22a6ccbf8985 mail/up-imappproxy/distinfo
--- a/mail/up-imappproxy/distinfo       Thu Mar 18 21:59:17 2021 +0000
+++ b/mail/up-imappproxy/distinfo       Thu Mar 18 22:05:56 2021 +0000
@@ -1,4 +1,4 @@
-$NetBSD: distinfo,v 1.4 2020/05/02 00:38:10 mef Exp $
+$NetBSD: distinfo,v 1.5 2021/03/18 22:05:56 tm Exp $
 
 SHA1 (up-imapproxy_1.2.8~svn20171105.orig.tar.bz2) = 85e76717b0d2f790e366b7516cc567fc551c9cc6
 RMD160 (up-imapproxy_1.2.8~svn20171105.orig.tar.bz2) = dac57dcea68c333f6b05942c99fb8d0bfd0b7808
@@ -14,6 +14,7 @@
 SHA1 (patch-fix-socklen_t-types-main.c) = d9ec2c92ecfee08c54c6e28a6a15dfc6730eeffd
 SHA1 (patch-fix-socklen_t-types-request.c) = 99cd03e88f7885bebc766be9d2d14958ffd45be6
 SHA1 (patch-fix-ssl-types) = 2f32060a7ab8922dd038e07f20da6d4240c2bdb0
+SHA1 (patch-fix-verify-hostname-imapcommon.c) = 682355e3997367de2b918f455cdd6cc7c8edb4f8
 SHA1 (patch-openssl-1.1-imapcommon.c) = 69fca63f349fc4c2c11169936136e4611d496901
 SHA1 (patch-openssl-1.1-main.c) = fe2d2eab38a872dd55f0f1cf965e50bd9e501022
 SHA1 (patch-remove-install-chown) = e3811e13fa3fe89dc7d58162a3dcde9a57527be2
diff -r 17727e079f7d -r 22a6ccbf8985 mail/up-imappproxy/patches/patch-fix-verify-hostname-imapcommon.c
--- /dev/null   Thu Jan 01 00:00:00 1970 +0000
+++ b/mail/up-imappproxy/patches/patch-fix-verify-hostname-imapcommon.c Thu Mar 18 22:05:56 2021 +0000
@@ -0,0 +1,39 @@
+Fix TLS verification to set hostname.
+
+Patch from OpenBSD
+Reported by Stuart Henderson
+
+--- src/imapcommon.c.orig
++++ src/imapcommon.c
+@@ -169,6 +169,7 @@ extern ProxyConfig_Struct PC_Struct;
+ static int send_queued_preauth_commands( char *, ITD_Struct * );
+ 
+ #if HAVE_LIBSSL
++#include <openssl/x509v3.h>
+ extern SSL_CTX *tls_ctx;
+ 
+ /*++
+@@ -369,6 +370,7 @@ extern void UnLockMutex( pthread_mutex_t *mutex )
+ extern int Attempt_STARTTLS( ITD_Struct *Server )
+ {
+     char *fn = "Attempt_STARTTLS()";
++    X509_VERIFY_PARAM *param = NULL;
+ 
+     unsigned int BufLen = BUFSIZE - 1;
+     char SendBuf[BUFSIZE];
+@@ -467,6 +469,15 @@ extern int Attempt_STARTTLS( ITD_Struct *Server )
+       {
+           syslog(LOG_INFO,
+                   "STARTTLS failed: SSL_set_fd() failed: %d",
++                  SSL_get_error( Server->conn->tls, rc ) );
++          goto fail;
++      }
++
++      param = SSL_get0_param(Server->conn->tls);
++      X509_VERIFY_PARAM_set_hostflags(param, X509_CHECK_FLAG_NO_PARTIAL_WILDCARDS);
++      if (!X509_VERIFY_PARAM_set1_host(param, PC_Struct.server_hostname, 0)) {
++          syslog(LOG_INFO,
++                  "STARTTLS failed: X509_VERIFY_PARAM_set1_host() failed: %d",
+                   SSL_get_error( Server->conn->tls, rc ) );
+           goto fail;
+       }