lib-ssl-iostream: Use SSL_CTX_set_ecdh_auto macro This macro is same for 1.0.2 and 1.1.0 and libressl.

Updated copyright notices to include the year 2018.

lib-ssl-iostream: Use SSL_CTX_set_min_proto_version if available

Replace ssl_protocols config option with ssl_min_protocol Default to TLSv1.

lib-ssl-iostream: Add io_stream_ssl_global_init()

lib-ssl-iostream: io_stream_create_ssl_client() - Move code to set verify_remote_cert=TRUE Enable it in the generic SSL code instead of OpenSSL-specific code.

lib-ssl-iostream: Add TLS SNI callback and a way to change SSL context

lib-ssl-iostream: Add refcounting to ssl_iostream_context

global: Rename ssl_iostream_context_deinit() to ssl_iostream_context_unref()

lib-ssl-iostream: Change ssl_iostream_context.set to not be a pointer It's just unnecessary memory usage.

lib-ssl-iostream: Fix alt cert support It was only partially implemented in 0577701d04beea222fc49a7318851ddcea3b99d3

lib-ssl-iostream: Split host to connected_host and sni_host Using the same variable for both was causing confusion.

lib-ssl-iostream: Allow skipping CRL check

lib-ssl-iostream: Add alternate certificate support

global: Splice cert into separate struct from iostream_ssl_settings

lib-ssl-iostream: Fix compiler warning ~SSL_OP_DONT_INSERT_EMPTY_FRAGMENTS makes it unsigned, so it doesn't fit into signed 32bit long.

lib-ssl-iostream: Fixed deinitialization of openssl library. Previously, it also dereferenced the library when it was never initialized in the first place.

lib-ssl-iostream: Don't require SSL CA certs if allow_invalid_cert=TRUE This happened only when verify_remote_cert was also TRUE. But this behavior now allows verifying the cert without actually requiring it to be valid.

lib-ssl-iostream: Fix ambiguity with SSL settings - lib-ssl-iostream as client: Use only allow_invalid_cert. If it's not set, verify the server cert. - lib-ssl-iostream as server: If verify_client_cert=FALSE, don't ask for the client cert. Otherwise, ask for client cert but still allow it if allow_invalid_cert=TRUE.

lib-ssl-iostream: Fix memory leak in RSA_generate_key_ex() usage

lib-ssl-iostream: Use RSA_generate_key_ex() if it exists This avoids deprecation warnings about RSA_generate_key() in OpenSSL v1.1.

ssl: add ssl_curve_list setting for selecting ECHDE curves

Updated copyright notices to include the year 2017.

-Wstrict-bool warning fixes

lib-ssl-iostream: Read dh parameters from PEM string

dovecot: Remove ssl-params

lib-dcrypt, lib-ssl-iostream: Share OpenSSL init/deinit code.

global: Require comparisons to be strict boolean expressions * No implicit integer -> boolean or pointer -> boolean conversions * !expr can be used only if expr is boolean type These were checked with a patched clang. It found various actual bugs, which were fixed by the previous commits.

lib-ssl-iostream: move ssl_iostream_settings_dup to iostream-ssl.c

global: freshen copyright git ls-files | xargs perl -p -i -e 's/(\d+)-201[0-5]/$1-2016/g;s/ (201[0-5]) Dovecot/ $1-2016 Dovecot/'

lib-ssl-iostream, login-*: Hide unnecessary "EVP_PKEY_get1_EC_KEY:expecting a ec key" errors.

lib-ssl-iostream: Fixed compiler warning when OpenSSL didn't support ECDH.

lib-ssl-iostream: Moved openssl_iostream_*error() to -common.c login-common code only links with this file, so that's required for the previous changes to actually work.

login, lib-ssl-iostream: Clear errors caused by manual EC key selection when there was no EC key. EVP_PKEY_get1_EC_KEY() would return an error, which should be ignored instead of being logged later on.

lib-ssl-iostream: Check for SSL_CTX_set_ecdh_auto() failure. This shouldn't happen though.

login, lib-ssl-iostream: Deduplicate code with shared openssl_iostream_use_certificate_error()

lib-ssl-iostream: Fixes to error handling. Copy behavior from login-common/ssl-proxy-openssl.c: - Handle stacked errors. - Improve errors with ERR_TXT_STRING flag.

lib-ssl-iostream: Don't ignore errors on SSL certificate loading. Patch by Sebastiaan Hoogeveen.

ssl_options: Added support for no_ticket

global: freshen copyright Robomatically: git ls-files | xargs perl -p -i -e 's/(\d+)-201[0-4]/$1-2015/g;s/ (201[0-4]) Dovecot/ $1-2015 Dovecot/' Happy 2015 everyone! Signed-off-by: Phil Carmody <phil@dovecot.fi>

lib-ssl-iostream: Support non-1024bit DH parameters in ssl-parameters.dat.

libressl fix: Check for SSL_CTRL_SET_ECDH_AUTO macro instead of OpenSSL version number Patch by Hanno Böck

Compile fix for old systems without SSL_OP_NO_COMPRESSION

openssl: optionally disable TLS compression Make ssl compression optional, but enabled by default. Other ssl options might be tweakable in the future, so have a single ssl_options string, and explode it into individual flags. (Compare postfix configuration.) Based on an idea by Andreas Schulze <sca@andreasschulze.de> Signed-off-by: Phil Carmody <phil@dovecot.fi>

lib-ssl-iostream: Use SSL_MODE_RELEASE_BUFFERS if it exists to reduce memory usage.

Updated copyright notices to include year 2014.

Added ssl_prefer_server_ciphers setting.

lib-ssl-iostream: Give better error message if CA settings are missing.

ssl: Fixed compiling with older OpenSSL libraries.

Compiler warning fixes.

lib-ssl-iostream: Deinitialization fixes.

lib-ssl-iostream: Crashfix for recent change.

lib-ssl-iostream: Compiler warning fix

lib-ssl-iostream: Added support for ECDH/ECDHE cipher suites Based on the login-common patch by David Hicks.

Added ssl_client_ca_file to specify the CA certs as a file instead of as a dir. This is required for Redhat-based systems where there isn't a CA directory like in Debian/Ubuntu.

lib-ssl-iostream: Added support for TLS SNI, which caused some API changes.

lib-ssl-iostream: API changes to return error strings if init() functions fail. This also fixed a couple of broken error handlings.

lib-ssl-iostream: Enable SSL_MODE_ENABLE_PARTIAL_WRITE

Oops :) Update copyrights to 2013 without breaking all .c files.

Updated copyright notices to include year 2013.