lib-ssl-iostream: Add accessors for additional SSL protocol details This is needed in order to send these details as fields to auth process

Replace ssl_protocols config option with ssl_min_protocol Default to TLSv1.

lib-ssl-iostream: Remove obsolete ssl_iostream_context_deinit()

lib-ssl-iostream: Add io_stream_ssl_global_init()

lib-ssl-iostream: Add TLS SNI callback and a way to change SSL context

lib-ssl-iostream: ssl_iostream_cert_match_name() - add reason_r parameter The callers were also changed to add the reason to error messages.

lib-ssl-iostream: ssl_iostream_cert_match_name() - Change to return bool The return value makes much more sense as a boolean TRUE/FALSE than 0/-1.

lib-ssl-iostream: Add ssl_iostream_context cache This can be used to easily get a shared ssl_iostream_context for either server or client. There's no upper size limit for the cache.

lib-ssl-iostream: Add refcounting to ssl_iostream_context

global: Rename ssl_iostream_context_deinit() to ssl_iostream_context_unref()

lib-ssl-iostream: ssl_iostream_settings_dup() - rewrite using string offsets array This array will be useful for other purposes as well.

lib-ssl-iostream: Add ssl_iostream_settings_init_from() This allows duplicating settings to an already existing struct without having to allocate it.

lib-ssl-iostream: Add stream/context comments to all ssl_iostream_settings

lib-ssl-iostream: Verify SSL server's hostname against cert if it's non-NULL The hostname verification was skipped when handshake-callback wasn't used. All of the existing code used the callback though, so this doesn't fix any bugs.

lib-ssl-iostream: Expose ssl_module_load We need to load SSL module before we chroot in login-common.

lib-ssl-iostream: Add get_compression accessor This is needed by login-common

lib-ssl-iostream: Allow skipping CRL check

lib-ssl-iostream: Add alternate certificate support

global: Splice cert into separate struct from iostream_ssl_settings

ssl: add ssl_curve_list setting for selecting ECHDE curves

lib-ssl-iostream: Read dh parameters from PEM string

dovecot: Remove ssl-params

lib-ssl-iostream: Changed require_valid_cert -> allow_invalid_cert We should default to being safe.

lib-ssl-iostream: move ssl_iostream_settings_dup to iostream-ssl.c

ssl_options: Added support for no_ticket

lib-ssl-iostream: Added dh_length parameter to ssl_iostream_generate_params() This is an API change, but nobody was actually using this function.

openssl: optionally disable TLS compression Make ssl compression optional, but enabled by default. Other ssl options might be tweakable in the future, so have a single ssl_options string, and explode it into individual flags. (Compare postfix configuration.) Based on an idea by Andreas Schulze <sca@andreasschulze.de> Signed-off-by: Phil Carmody <phil@dovecot.fi>

Added ssl_prefer_server_ciphers setting.

lib-ssl-iostream: Added ssl_iostream_has_handshake_failed()

Added ssl_client_ca_file to specify the CA certs as a file instead of as a dir. This is required for Redhat-based systems where there isn't a CA directory like in Debian/Ubuntu.

lib-ssl-iostream: Simplified certificate validation. Also give better error messages.

lib-ssl-iostream: Added support for TLS SNI, which caused some API changes.

lib-ssl-iostream: ssl_iostream_set_handshake_callback() API changed. The callback can now return the error message to caller instead of having to log it itself.

lib-ssl-iostream: API changes to return error strings if init() functions fail. This also fixed a couple of broken error handlings.

lib-ssl-iostream: Added protocols setting.

lib-ssl-iostream: Added ssl_iostream_destroy() to do a clean SSL shutdown.

lib-ssl-iostream: Added crypto_device setting to set OpenSSL engine. Multiple engines aren't supported, so the first crypto_device value gets used for all SSL connections.

lib-ssl-iostream: Added ssl_iostream_cert_match_name()

Added lib-ssl-iostream for handling SSL connections more easily.