Sync with our smtpd repo:

* first bricks of ldap and sqlite support (not finished but both working)
* new table API to replace map API, all lookups are done through tables
* improved handling of temporary errors throughout the daemon
* improved scheduler and mta logic: connection reuse, optimizes batches
* improved queue: more tolerant to admin errors, new layout, less disk-IO
* improved memory usage under high load
* SSL certs/keys isolated to lookup process to avoid facing network
* VIRTUAL support improved, fully virtual setups possible now
* runtime tracing of processes through smtpctl trace
* ssl_privsep.c sync-ed with relayd
* ssl.c no longer contains smtpd specific interfaces
* smtpd-specific ssl bits moved to ssl_smtpd.c
* update mail address in copyright

FLUSH YOUR QUEUE. FLUSH YOUR QUEUE. FLUSH YOUR QUEUE. FLUSH YOUR QUEUE.

smtpd.conf(5) simplified, it will require adaptations

ok eric@

1 files changed, 63 insertions, 0 deletions

diff --git a/usr.sbin/smtpd/ca.c b/usr.sbin/smtpd/ca.c
new file mode 100644
index 00000000000..970ccb921ed
--- /dev/null
+++ b/usr.sbin/smtpd/ca.c
@@ -0,0 +1,63 @@
+/*	$OpenBSD: ca.c,v 1.1 2013/01/26 09:37:23 gilles Exp $	*/
+
+/*
+ * Copyright (c) 2012 Gilles Chehade <gilles@poolp.org>
+ *
+ * Permission to use, copy, modify, and distribute this software for any
+ * purpose with or without fee is hereby granted, provided that the above
+ * copyright notice and this permission notice appear in all copies.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
+ * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
+ * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
+ * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+ * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
+ * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
+ * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+ */
+
+#include <sys/types.h>
+
+#include <openssl/err.h>
+#include <openssl/ssl.h>
+
+int	ca_X509_verify(X509 *, STACK_OF(X509) *, const char *, const char *, const char **);
+
+int
+ca_X509_verify(X509 *certificate, STACK_OF(X509) *chain, const char *CAfile,
+    const char *CRLfile, const char **errstr)
+{
+	X509_STORE     *store = NULL;
+	X509_STORE_CTX *xsc = NULL;
+	int		ret = 0;
+
+	if ((store = X509_STORE_new()) == NULL)
+		goto end;
+
+	X509_STORE_load_locations(store, CAfile, NULL);
+	X509_STORE_set_default_paths(store);
+
+	if ((xsc = X509_STORE_CTX_new()) == NULL)
+		goto end;
+
+	if (X509_STORE_CTX_init(xsc, store, certificate, chain) != 1)
+		goto end;
+
+	ret = X509_verify_cert(xsc);
+
+end:
+	*errstr = NULL;
+	if (ret != 1) {
+		if (xsc)
+			*errstr = X509_verify_cert_error_string(xsc->error);
+		else if (ERR_peek_last_error())
+			*errstr = ERR_error_string(ERR_peek_last_error(), NULL);
+	}
+
+	if (xsc)
+		X509_STORE_CTX_free(xsc);
+	if (store)
+		X509_STORE_free(store);
+
+	return ret > 0 ? 1 : 0;
+}