From 0441d265f2bb9da249c7abf333f0f771fadb4ab5 Mon Sep 17 00:00:00 2001 From: Daniel Baumann Date: Mon, 15 Apr 2024 19:36:47 +0200 Subject: Adding upstream version 1:2.3.21+dfsg1. Signed-off-by: Daniel Baumann --- src/lib-ssl-iostream/iostream-ssl.c | 351 ++++++++++++++++++++++++++++++++++++ 1 file changed, 351 insertions(+) create mode 100644 src/lib-ssl-iostream/iostream-ssl.c (limited to 'src/lib-ssl-iostream/iostream-ssl.c') diff --git a/src/lib-ssl-iostream/iostream-ssl.c b/src/lib-ssl-iostream/iostream-ssl.c new file mode 100644 index 0000000..430e69d --- /dev/null +++ b/src/lib-ssl-iostream/iostream-ssl.c @@ -0,0 +1,351 @@ +/* Copyright (c) 2009-2018 Dovecot authors, see the included COPYING file */ + +#include "lib.h" +#include "module-dir.h" +#include "iostream-ssl-private.h" + +#define OFFSET(name) offsetof(struct ssl_iostream_settings, name) +static const size_t ssl_iostream_settings_string_offsets[] = { + OFFSET(min_protocol), + OFFSET(cipher_list), + OFFSET(ciphersuites), + OFFSET(curve_list), + OFFSET(ca), + OFFSET(ca_file), + OFFSET(ca_dir), + OFFSET(cert.cert), + OFFSET(cert.key), + OFFSET(cert.key_password), + OFFSET(alt_cert.cert), + OFFSET(alt_cert.key), + OFFSET(alt_cert.key_password), + OFFSET(dh), + OFFSET(cert_username_field), + OFFSET(crypto_device), +}; + +static bool ssl_module_loaded = FALSE; +#ifdef HAVE_SSL +static struct module *ssl_module = NULL; +#endif +static const struct iostream_ssl_vfuncs *ssl_vfuncs = NULL; + +#ifdef HAVE_SSL +static void ssl_module_unload(void) +{ + ssl_iostream_context_cache_free(); + module_dir_unload(&ssl_module); +} +#endif + +void iostream_ssl_module_init(const struct iostream_ssl_vfuncs *vfuncs) +{ + ssl_vfuncs = vfuncs; + ssl_module_loaded = TRUE; +} + +int ssl_module_load(const char **error_r) +{ +#ifdef HAVE_SSL + const char *plugin_name = "ssl_iostream_openssl"; + struct module_dir_load_settings mod_set; + + i_zero(&mod_set); + mod_set.abi_version = DOVECOT_ABI_VERSION; + mod_set.setting_name = ""; + mod_set.require_init_funcs = TRUE; + ssl_module = module_dir_load(MODULE_DIR, plugin_name, &mod_set); + if (module_dir_try_load_missing(&ssl_module, MODULE_DIR, plugin_name, + &mod_set, error_r) < 0) + return -1; + module_dir_init(ssl_module); + if (!ssl_module_loaded) { + *error_r = t_strdup_printf( + "%s didn't call iostream_ssl_module_init() - SSL not initialized", + plugin_name); + module_dir_unload(&ssl_module); + return -1; + } + + /* Destroy SSL module after (most of) the others. Especially lib-fs + backends may still want to access SSL module in their own + atexit-callbacks. */ + lib_atexit_priority(ssl_module_unload, LIB_ATEXIT_PRIORITY_LOW); + return 0; +#else + *error_r = "SSL support not compiled in"; + return -1; +#endif +} + +int io_stream_ssl_global_init(const struct ssl_iostream_settings *set, + const char **error_r) +{ + return ssl_vfuncs->global_init(set, error_r); +} + +int ssl_iostream_context_init_client(const struct ssl_iostream_settings *set, + struct ssl_iostream_context **ctx_r, + const char **error_r) +{ + struct ssl_iostream_settings set_copy = *set; + + /* ensure this is set to TRUE */ + set_copy.verify_remote_cert = TRUE; + + if (!ssl_module_loaded) { + if (ssl_module_load(error_r) < 0) + return -1; + } + if (io_stream_ssl_global_init(&set_copy, error_r) < 0) + return -1; + return ssl_vfuncs->context_init_client(&set_copy, ctx_r, error_r); +} + +int ssl_iostream_context_init_server(const struct ssl_iostream_settings *set, + struct ssl_iostream_context **ctx_r, + const char **error_r) +{ + if (!ssl_module_loaded) { + if (ssl_module_load(error_r) < 0) + return -1; + } + if (io_stream_ssl_global_init(set, error_r) < 0) + return -1; + return ssl_vfuncs->context_init_server(set, ctx_r, error_r); +} + +void ssl_iostream_context_ref(struct ssl_iostream_context *ctx) +{ + ssl_vfuncs->context_ref(ctx); +} + +void ssl_iostream_context_unref(struct ssl_iostream_context **_ctx) +{ + struct ssl_iostream_context *ctx = *_ctx; + + if (*_ctx == NULL) + return; + *_ctx = NULL; + ssl_vfuncs->context_unref(ctx); +} + +int io_stream_create_ssl_client(struct ssl_iostream_context *ctx, const char *host, + const struct ssl_iostream_settings *set, + struct istream **input, struct ostream **output, + struct ssl_iostream **iostream_r, + const char **error_r) +{ + struct ssl_iostream_settings set_copy = *set; + set_copy.verify_remote_cert = TRUE; + return ssl_vfuncs->create(ctx, host, &set_copy, input, output, + iostream_r, error_r); +} + +int io_stream_create_ssl_server(struct ssl_iostream_context *ctx, + const struct ssl_iostream_settings *set, + struct istream **input, struct ostream **output, + struct ssl_iostream **iostream_r, + const char **error_r) +{ + return ssl_vfuncs->create(ctx, NULL, set, input, output, + iostream_r, error_r); +} + +void ssl_iostream_unref(struct ssl_iostream **_ssl_io) +{ + struct ssl_iostream *ssl_io = *_ssl_io; + + *_ssl_io = NULL; + ssl_vfuncs->unref(ssl_io); +} + +void ssl_iostream_destroy(struct ssl_iostream **_ssl_io) +{ + struct ssl_iostream *ssl_io; + + if (_ssl_io == NULL || *_ssl_io == NULL) + return; + + ssl_io = *_ssl_io; + *_ssl_io = NULL; + ssl_vfuncs->destroy(ssl_io); +} + +void ssl_iostream_set_log_prefix(struct ssl_iostream *ssl_io, + const char *prefix) +{ + ssl_vfuncs->set_log_prefix(ssl_io, prefix); +} + +int ssl_iostream_handshake(struct ssl_iostream *ssl_io) +{ + return ssl_vfuncs->handshake(ssl_io); +} + +void ssl_iostream_set_handshake_callback(struct ssl_iostream *ssl_io, + ssl_iostream_handshake_callback_t *callback, + void *context) +{ + ssl_vfuncs->set_handshake_callback(ssl_io, callback, context); +} + +void ssl_iostream_set_sni_callback(struct ssl_iostream *ssl_io, + ssl_iostream_sni_callback_t *callback, + void *context) +{ + ssl_vfuncs->set_sni_callback(ssl_io, callback, context); +} + +void ssl_iostream_change_context(struct ssl_iostream *ssl_io, + struct ssl_iostream_context *ctx) +{ + ssl_vfuncs->change_context(ssl_io, ctx); +} + +bool ssl_iostream_is_handshaked(const struct ssl_iostream *ssl_io) +{ + return ssl_vfuncs->is_handshaked(ssl_io); +} + +bool ssl_iostream_has_handshake_failed(const struct ssl_iostream *ssl_io) +{ + return ssl_vfuncs->has_handshake_failed(ssl_io); +} + +bool ssl_iostream_has_valid_client_cert(const struct ssl_iostream *ssl_io) +{ + return ssl_vfuncs->has_valid_client_cert(ssl_io); +} + +bool ssl_iostream_has_broken_client_cert(struct ssl_iostream *ssl_io) +{ + return ssl_vfuncs->has_broken_client_cert(ssl_io); +} + +bool ssl_iostream_cert_match_name(struct ssl_iostream *ssl_io, const char *name, + const char **reason_r) +{ + return ssl_vfuncs->cert_match_name(ssl_io, name, reason_r); +} + +int ssl_iostream_check_cert_validity(struct ssl_iostream *ssl_io, + const char *host, const char **error_r) +{ + const char *reason; + + if (!ssl_iostream_has_valid_client_cert(ssl_io)) { + if (!ssl_iostream_has_broken_client_cert(ssl_io)) + *error_r = "SSL certificate not received"; + else { + *error_r = t_strdup(ssl_iostream_get_last_error(ssl_io)); + if (*error_r == NULL) + *error_r = "Received invalid SSL certificate"; + } + return -1; + } else if (!ssl_iostream_cert_match_name(ssl_io, host, &reason)) { + *error_r = t_strdup_printf( + "SSL certificate doesn't match expected host name %s: %s", + host, reason); + return -1; + } + return 0; +} + +const char *ssl_iostream_get_peer_name(struct ssl_iostream *ssl_io) +{ + return ssl_vfuncs->get_peer_name(ssl_io); +} + +const char *ssl_iostream_get_server_name(struct ssl_iostream *ssl_io) +{ + return ssl_vfuncs->get_server_name(ssl_io); +} + +const char *ssl_iostream_get_compression(struct ssl_iostream *ssl_io) +{ + return ssl_vfuncs->get_compression(ssl_io); +} + +const char *ssl_iostream_get_security_string(struct ssl_iostream *ssl_io) +{ + return ssl_vfuncs->get_security_string(ssl_io); +} + +const char *ssl_iostream_get_last_error(struct ssl_iostream *ssl_io) +{ + return ssl_vfuncs->get_last_error(ssl_io); +} + +struct ssl_iostream_settings *ssl_iostream_settings_dup(pool_t pool, + const struct ssl_iostream_settings *old_set) +{ + struct ssl_iostream_settings *new_set; + + new_set = p_new(pool, struct ssl_iostream_settings, 1); + ssl_iostream_settings_init_from(pool, new_set, old_set); + return new_set; +} + +void ssl_iostream_settings_init_from(pool_t pool, + struct ssl_iostream_settings *dest, + const struct ssl_iostream_settings *src) +{ + unsigned int i; + + *dest = *src; + for (i = 0; i < N_ELEMENTS(ssl_iostream_settings_string_offsets); i++) { + const size_t offset = ssl_iostream_settings_string_offsets[i]; + const char *const *src_str = CONST_PTR_OFFSET(src, offset); + const char **dest_str = PTR_OFFSET(dest, offset); + *dest_str = p_strdup(pool, *src_str); + } +} + +bool ssl_iostream_settings_equals(const struct ssl_iostream_settings *set1, + const struct ssl_iostream_settings *set2) +{ + struct ssl_iostream_settings set1_nonstr, set2_nonstr; + unsigned int i; + + set1_nonstr = *set1; + set2_nonstr = *set2; + for (i = 0; i < N_ELEMENTS(ssl_iostream_settings_string_offsets); i++) { + const size_t offset = ssl_iostream_settings_string_offsets[i]; + const char **str1 = PTR_OFFSET(&set1_nonstr, offset); + const char **str2 = PTR_OFFSET(&set2_nonstr, offset); + + if (null_strcmp(*str1, *str2) != 0) + return FALSE; + + /* clear away the string pointer from the settings struct */ + *str1 = NULL; + *str2 = NULL; + } + /* The set*_nonstr no longer have any pointers, so we can compare them + directly. */ + return memcmp(&set1_nonstr, &set2_nonstr, sizeof(set1_nonstr)) == 0; +} + +void ssl_iostream_settings_drop_stream_only(struct ssl_iostream_settings *set) +{ + set->verbose = FALSE; + set->verbose_invalid_cert = FALSE; + set->allow_invalid_cert = FALSE; +} + +const char *ssl_iostream_get_cipher(struct ssl_iostream *ssl_io, + unsigned int *bits_r) +{ + return ssl_vfuncs->get_cipher(ssl_io, bits_r); +} + +const char *ssl_iostream_get_pfs(struct ssl_iostream *ssl_io) +{ + return ssl_vfuncs->get_pfs(ssl_io); +} + +const char *ssl_iostream_get_protocol_name(struct ssl_iostream *ssl_io) +{ + return ssl_vfuncs->get_protocol_name(ssl_io); +} -- cgit v1.2.3