lib-ssl-iostream: Assert-crash if input stream has IO already set

lib-ssl-iostream: openssl: Make verbose logging robust against i_debug() writing to stream itself. In dsync, i_debug() is overridden to write to the SSL stream itself through a multiplexed data stream. So, during the i_debug() call all kinds of things can happen to the persisted error string in the stream, which caused problems.

Updated copyright notices to include the year 2018.

lib-ssl-iostream: Add accessors for additional SSL protocol details This is needed in order to send these details as fields to auth process

lib-ssl-iostream: If allow_invalid_cert=TRUE, skip verifying hostname

lib-ssl-iostream: Use SSL_CTX_set_min_proto_version if available

Replace ssl_protocols config option with ssl_min_protocol Default to TLSv1.

lib-ssl-iostream: Add io_stream_ssl_global_init()

lib-ssl-iostream: Add TLS SNI callback and a way to change SSL context

lib-ssl-iostream: ssl_iostream_cert_match_name() - add reason_r parameter The callers were also changed to add the reason to error messages.

lib-ssl-iostream: openssl_cert_match_name() - add reason_r parameter The returned string explains what exactly matched or why nothing matched.

lib-ssl-iostream: ssl_iostream_cert_match_name() - Change to return bool The return value makes much more sense as a boolean TRUE/FALSE than 0/-1.

lib-ssl-iostream: Keep ssl_iostream_context referenced while it has streams

lib-ssl-iostream: Add refcounting to ssl_iostream_context

lib-ssl-iostream: Change ssl_iostream_context.set to not be a pointer It's just unnecessary memory usage.

iostream-openssl: Refactor stream sync code When doing input or stream sync, specify the type of operation that we are doing to make sure we do IO correctly.

lib-ssl-iostream: Set error on clean connection closing during handshake. Set the error to "SSL connection closed during handshake".

lib-ssl-iostream: Cleanup disconnection handling Avoid code duplication. Set error to "Connection closed" if there's no other error.

lib-ssl-iostream: Verify SSL server's hostname against cert if it's non-NULL The hostname verification was skipped when handshake-callback wasn't used. All of the existing code used the callback though, so this doesn't fix any bugs.

lib-ssl-iostream: Fix checking cert validity when handshake callback isn't used

lib-ssl-iostream: Split host to connected_host and sni_host Using the same variable for both was causing confusion.

lib-ssl-iostream: Seed OpenSSL RNG earlier Make sure we give the RNG a chance to seed before we chroot.

lib-ssl-iostream: Use named initializers

lib-ssl-iostream: Remove input_handler flag It is no longer needed after 87da941c

lib-ssl-iostream: Add get_compression accessor This is needed by login-common

lib-ssl-iostream: Close ostream before istream If i_stream is autoclose, then o_stream close will fail if done after i_stream close.

lib-ssl-iostream: Add alternate certificate support

global: Splice cert into separate struct from iostream_ssl_settings

ssl: add ssl_curve_list setting for selecting ECHDE curves

Updated copyright notices to include the year 2017.

openssl: Clear error queue after an incomplete SSL_shutdown If the SSL_shutdown-call fails (e.g. because the underlaying socket has already been closed) OpenSSL puts the corresponding error into the queue. We don't care about details so we need to clear the queue. Otherwise the error will be pulled while error checking the next OpenSSL call of an unrelated connection.

configure: Fix build with old OpenSSL without SSL_clear_options SSL_clear_options was introduced in OpenSSL 0.9.8m but may be backported to older versions in "enterprise" OS releases, so a version check is insufficient here. It was originally implemented as a macro but is a function in more recent OpenSSL versions, so a test that works for both cases is needed.

lib-ssl-iostream: Fixed OpenSSL module to be actually initialized.

lib-ssl-iostream: Use more standard _init() & _deinit() to initialize SSL plugin This is mainly to make it easier for test programs to link to the plugin directly.

openssl: Fix v1.1 compability

dovecot: Remove ssl-params

lib-ssl-iostream: Changed require_valid_cert -> allow_invalid_cert We should default to being safe.

global: Require comparisons to be strict boolean expressions * No implicit integer -> boolean or pointer -> boolean conversions * !expr can be used only if expr is boolean type These were checked with a patched clang. It found various actual bugs, which were fixed by the previous commits.

Replace some t_malloc_no0 calls with t_malloc0 This might increase safety.

Remove t_malloc in favour of t_malloc_no0 Using either t_malloc_no0 or t_malloc0 makes it clear whether the allocated memory is zeroed or not.

lib: istream - migrate to i_stream_read_more() Scripted to find all the low-hanging-fruit (single line calls), but hand-checked: git grep i_stream_read_data.*,\ 0\) | sed s/:.*// | \ xargs sed -i -e 's/i_stream_read_data(\(.*\), \(.*\), \(.*\), 0)/i_stream_read_more(\1, \2, \3)/' Signed-off-by: Phil Carmody <phil@dovecot.fi>

lib-ssl-iostream: If verbose=TRUE, internally log all errors.

lib-ssl-iostream: Log all SSL info lines with debug-level. They're not logged at all if verbose=FALSE, so they're really debug messages.

global: freshen copyright git ls-files | xargs perl -p -i -e 's/(\d+)-201[0-5]/$1-2016/g;s/ (201[0-5]) Dovecot/ $1-2016 Dovecot/'

login, lib-ssl-iostream: Deduplicate code with shared openssl_iostream_use_certificate_error()

lib-ssl-iostream: Don't set EPIPE/ECONNRESET error to istream when connection is closed. Several istream users verify at EOF that stream_errno=0 and fail if it isn't.

global: freshen copyright Robomatically: git ls-files | xargs perl -p -i -e 's/(\d+)-201[0-4]/$1-2015/g;s/ (201[0-4]) Dovecot/ $1-2015 Dovecot/' Happy 2015 everyone! Signed-off-by: Phil Carmody <phil@dovecot.fi>

lib-ssl-iostream: Close the plain iostreams when ssl-iostream is destroyed.

libressl fix: Fixed compiling with SSL compression disabled. Patch by Pascal Stumpf

lib-ssl-iostream: Make sure I/O input event is triggered after ostream-ssl has read some data to buffer.

Updated copyright notices to include year 2014.

Added ssl_prefer_server_ciphers setting.

iostreams: Set stream error string when it provides extra information.

lib-ssl-iostream: Deinitialization fixes.

ssl: Log SSL "close notify" alerts as debug messages, not warnings. They are clean shutdown messages after all.

lib-ssl-iostream: Added ssl_iostream_has_handshake_failed()

lib-ssl-iostream: Simplified certificate validation. Also give better error messages.

lib-ssl-iostream: Added support for TLS SNI, which caused some API changes.

lib-ssl-iostream: If handshake callback fails, close the iostreams immediately. This way the callback itself doesn't have to do it. Also fixes errors caused by it, since they didn't close the ostream.

lib-ssl-iostream: ssl_iostream_set_handshake_callback() API changed. The callback can now return the error message to caller instead of having to log it itself.

lib-ssl-iostream: API changes to return error strings if init() functions fail. This also fixed a couple of broken error handlings.

Oops :) Update copyrights to 2013 without breaking all .c files.

Updated copyright notices to include year 2013.