Replace ssl_protocols config option with ssl_min_protocol Default to TLSv1.

lib-ssl-iostream: Add io_stream_ssl_global_init()

lib-ssl-iostream: Add TLS SNI callback and a way to change SSL context

lib-ssl-iostream: openssl_cert_match_name() - add reason_r parameter The returned string explains what exactly matched or why nothing matched.

lib-ssl-iostream: ssl_iostream_cert_match_name() - Change to return bool The return value makes much more sense as a boolean TRUE/FALSE than 0/-1.

lib-ssl-iostream: Add refcounting to ssl_iostream_context

lib-ssl-iostream: Change ssl_iostream_context.set to not be a pointer It's just unnecessary memory usage.

iostream-openssl: Refactor stream sync code When doing input or stream sync, specify the type of operation that we are doing to make sure we do IO correctly.

lib-ssl-iostream: Split host to connected_host and sni_host Using the same variable for both was causing confusion.

lib-ssl-iostream: Remove input_handler flag It is no longer needed after 87da941c

global: Splice cert into separate struct from iostream_ssl_settings

lib-ssl-iostream: Use ASN1_STRING_get0_data() if it exists This avoids deprecation warnings about ASN1_STRING_data() in OpenSSL v1.1.

lib-ssl-iostream: Fixed OpenSSL module to be actually initialized.

lib-ssl-iostream: Use more standard _init() & _deinit() to initialize SSL plugin This is mainly to make it easier for test programs to link to the plugin directly.

dovecot: Remove ssl-params

lib-ssl-iostream: Changed require_valid_cert -> allow_invalid_cert We should default to being safe.

global: unsigned int:1 -> bool:1 perl -i -pe 's/unsigned int ([^,:;]+):1;/bool $1:1;/' **/*.[ch]

lib-ssl-iostream, login-*: Hide unnecessary "EVP_PKEY_get1_EC_KEY:expecting a ec key" errors.

login, lib-ssl-iostream: Deduplicate code with shared openssl_iostream_use_certificate_error()

lib-ssl-iostream: Added dh_length parameter to ssl_iostream_generate_params() This is an API change, but nobody was actually using this function.

lib-ssl-iostream: Support non-1024bit DH parameters in ssl-parameters.dat.

lib-ssl-iostream: Make sure I/O input event is triggered after ostream-ssl has read some data to buffer.

iostreams: Set stream error string when it provides extra information.

lib-ssl-iostream: Deinitialization fixes.

lib-ssl-iostream: Added ssl_iostream_has_handshake_failed()

lib-ssl-iostream: Added support for TLS SNI, which caused some API changes.

lib-ssl-iostream: ssl_iostream_set_handshake_callback() API changed. The callback can now return the error message to caller instead of having to log it itself.

lib-ssl-iostream: API changes to return error strings if init() functions fail. This also fixed a couple of broken error handlings.

lib-ssl-iostream now dynamically loads openssl library instead of linking to it. This allowed removing the separate libdovecot-ssl library. In future if GnuTLS/NSS support is added it would also allow switching between them dynamically.

lib-ssl-iostream: Make the input buffering behave the same as in file-istream Previously i_stream_read(ssl_input) could have still left some data buffered into the underlying file-istream, which meant that I/O loop didn't detect any new input from the fd and the connection got stuck.

lib-ssl-iostream: Added protocols setting.

login proxy: Verify that remote hostname matches SSL cert, unless ssl=any-cert

lib-ssl-iostream: Don't require SSL ostream to always have unlimited buffer size. It's important when reading/handshaking wants to write to output buffer, but writing itself can safely have zero sized buffer (e.g. while sending a large input stream).

lib-ssl-iostream: If plain stream disconnects, disconnect SSL stream also.

lib-ssl-iostream: Code cleanups, fixes, asserts and comments.

Added lib-ssl-iostream for handling SSL connections more easily.