src/lib-master/master-service-ssl-settings.c

	master-service-ssl-settings.c revision 2454dfa32c93c20a8522c6ed42fe057baaac9f9a
2454dfa32c93c20a8522c6ed42fe057baaac9f9aStephan Bosch/* Copyright (c) 2013-2017 Dovecot authors, see the included COPYING file */
f29756821a4c6b12b73e4a2a3e1c230117a43773Timo Sirainen
f29756821a4c6b12b73e4a2a3e1c230117a43773Timo Sirainen#include "lib.h"
f29756821a4c6b12b73e4a2a3e1c230117a43773Timo Sirainen#include "settings-parser.h"
f29756821a4c6b12b73e4a2a3e1c230117a43773Timo Sirainen#include "master-service-private.h"
f29756821a4c6b12b73e4a2a3e1c230117a43773Timo Sirainen#include "master-service-ssl-settings.h"
f29756821a4c6b12b73e4a2a3e1c230117a43773Timo Sirainen
f29756821a4c6b12b73e4a2a3e1c230117a43773Timo Sirainen#include <stddef.h>
f29756821a4c6b12b73e4a2a3e1c230117a43773Timo Sirainen
f29756821a4c6b12b73e4a2a3e1c230117a43773Timo Sirainen#undef DEF
f29756821a4c6b12b73e4a2a3e1c230117a43773Timo Sirainen#define DEF(type, name) \
f29756821a4c6b12b73e4a2a3e1c230117a43773Timo Sirainen    { type, #name, offsetof(struct master_service_ssl_settings, name), NULL }
f29756821a4c6b12b73e4a2a3e1c230117a43773Timo Sirainen
f29756821a4c6b12b73e4a2a3e1c230117a43773Timo Sirainenstatic bool
f29756821a4c6b12b73e4a2a3e1c230117a43773Timo Sirainenmaster_service_ssl_settings_check(void *_set, pool_t pool, const char **error_r);
f29756821a4c6b12b73e4a2a3e1c230117a43773Timo Sirainen
f29756821a4c6b12b73e4a2a3e1c230117a43773Timo Sirainenstatic const struct setting_define master_service_ssl_setting_defines[] = {
f29756821a4c6b12b73e4a2a3e1c230117a43773Timo Sirainen    DEF(SET_ENUM, ssl),
f29756821a4c6b12b73e4a2a3e1c230117a43773Timo Sirainen    DEF(SET_STR, ssl_ca),
f29756821a4c6b12b73e4a2a3e1c230117a43773Timo Sirainen    DEF(SET_STR, ssl_cert),
f29756821a4c6b12b73e4a2a3e1c230117a43773Timo Sirainen    DEF(SET_STR, ssl_key),
f29756821a4c6b12b73e4a2a3e1c230117a43773Timo Sirainen    DEF(SET_STR, ssl_key_password),
878734e3d9ff8da069a2567f18ca61eefa3116aaAki Tuomi    DEF(SET_STR, ssl_dh),
f29756821a4c6b12b73e4a2a3e1c230117a43773Timo Sirainen    DEF(SET_STR, ssl_cipher_list),
f29756821a4c6b12b73e4a2a3e1c230117a43773Timo Sirainen    DEF(SET_STR, ssl_protocols),
f29756821a4c6b12b73e4a2a3e1c230117a43773Timo Sirainen    DEF(SET_STR, ssl_cert_username_field),
f29756821a4c6b12b73e4a2a3e1c230117a43773Timo Sirainen    DEF(SET_STR, ssl_crypto_device),
f29756821a4c6b12b73e4a2a3e1c230117a43773Timo Sirainen    DEF(SET_BOOL, ssl_verify_client_cert),
f29756821a4c6b12b73e4a2a3e1c230117a43773Timo Sirainen    DEF(SET_BOOL, ssl_require_crl),
f29756821a4c6b12b73e4a2a3e1c230117a43773Timo Sirainen    DEF(SET_BOOL, verbose_ssl),
f974134f495e47ba7173f5b0f75fbd5cbacf1fe2Timo Sirainen    DEF(SET_BOOL, ssl_prefer_server_ciphers),
9864489d143fafe6f08f6a6d98a478d36458aa98Phil Carmody    DEF(SET_STR, ssl_options), /* parsed as a string to set bools */
f29756821a4c6b12b73e4a2a3e1c230117a43773Timo Sirainen
f29756821a4c6b12b73e4a2a3e1c230117a43773Timo Sirainen    SETTING_DEFINE_LIST_END
f29756821a4c6b12b73e4a2a3e1c230117a43773Timo Sirainen};
f29756821a4c6b12b73e4a2a3e1c230117a43773Timo Sirainen
f29756821a4c6b12b73e4a2a3e1c230117a43773Timo Sirainenstatic const struct master_service_ssl_settings master_service_ssl_default_settings = {
b244040178025c901c47be4fef3fa3bbc4c1e75aTimo Sirainen#ifdef HAVE_SSL
f29756821a4c6b12b73e4a2a3e1c230117a43773Timo Sirainen    .ssl = "yes:no:required",
b244040178025c901c47be4fef3fa3bbc4c1e75aTimo Sirainen#else
b244040178025c901c47be4fef3fa3bbc4c1e75aTimo Sirainen    .ssl = "no:yes:required",
b244040178025c901c47be4fef3fa3bbc4c1e75aTimo Sirainen#endif
f29756821a4c6b12b73e4a2a3e1c230117a43773Timo Sirainen    .ssl_ca = "",
f29756821a4c6b12b73e4a2a3e1c230117a43773Timo Sirainen    .ssl_cert = "",
f29756821a4c6b12b73e4a2a3e1c230117a43773Timo Sirainen    .ssl_key = "",
f29756821a4c6b12b73e4a2a3e1c230117a43773Timo Sirainen    .ssl_key_password = "",
878734e3d9ff8da069a2567f18ca61eefa3116aaAki Tuomi    .ssl_dh = "",
f29756821a4c6b12b73e4a2a3e1c230117a43773Timo Sirainen    .ssl_cipher_list = "ALL:!LOW:!SSLv2:!EXP:!aNULL",
7a6197f909f23febec07194a5f4c0e1f53d49cefApollon Oikonomopoulos#ifdef SSL_TXT_SSLV2
7a6197f909f23febec07194a5f4c0e1f53d49cefApollon Oikonomopoulos    .ssl_protocols = "!SSLv2 !SSLv3",
7a6197f909f23febec07194a5f4c0e1f53d49cefApollon Oikonomopoulos#else
7a6197f909f23febec07194a5f4c0e1f53d49cefApollon Oikonomopoulos    .ssl_protocols = "!SSLv3",
7a6197f909f23febec07194a5f4c0e1f53d49cefApollon Oikonomopoulos#endif
f29756821a4c6b12b73e4a2a3e1c230117a43773Timo Sirainen    .ssl_cert_username_field = "commonName",
f29756821a4c6b12b73e4a2a3e1c230117a43773Timo Sirainen    .ssl_crypto_device = "",
f29756821a4c6b12b73e4a2a3e1c230117a43773Timo Sirainen    .ssl_verify_client_cert = FALSE,
f29756821a4c6b12b73e4a2a3e1c230117a43773Timo Sirainen    .ssl_require_crl = TRUE,
f974134f495e47ba7173f5b0f75fbd5cbacf1fe2Timo Sirainen    .verbose_ssl = FALSE,
9864489d143fafe6f08f6a6d98a478d36458aa98Phil Carmody    .ssl_prefer_server_ciphers = FALSE,
9864489d143fafe6f08f6a6d98a478d36458aa98Phil Carmody    .ssl_options = "",
f29756821a4c6b12b73e4a2a3e1c230117a43773Timo Sirainen};
f29756821a4c6b12b73e4a2a3e1c230117a43773Timo Sirainen
f29756821a4c6b12b73e4a2a3e1c230117a43773Timo Sirainenconst struct setting_parser_info master_service_ssl_setting_parser_info = {
32b78da5dfbbf6a06b3dbdc9278c60b55714f9bcTimo Sirainen    .module_name = "ssl",
f29756821a4c6b12b73e4a2a3e1c230117a43773Timo Sirainen    .defines = master_service_ssl_setting_defines,
f29756821a4c6b12b73e4a2a3e1c230117a43773Timo Sirainen    .defaults = &master_service_ssl_default_settings,
f29756821a4c6b12b73e4a2a3e1c230117a43773Timo Sirainen
f29756821a4c6b12b73e4a2a3e1c230117a43773Timo Sirainen    .type_offset = (size_t)-1,
f29756821a4c6b12b73e4a2a3e1c230117a43773Timo Sirainen    .struct_size = sizeof(struct master_service_ssl_settings),
f29756821a4c6b12b73e4a2a3e1c230117a43773Timo Sirainen
f29756821a4c6b12b73e4a2a3e1c230117a43773Timo Sirainen    .parent_offset = (size_t)-1,
f29756821a4c6b12b73e4a2a3e1c230117a43773Timo Sirainen    .check_func = master_service_ssl_settings_check
f29756821a4c6b12b73e4a2a3e1c230117a43773Timo Sirainen};
f29756821a4c6b12b73e4a2a3e1c230117a43773Timo Sirainen
f29756821a4c6b12b73e4a2a3e1c230117a43773Timo Sirainen/* <settings checks> */
f29756821a4c6b12b73e4a2a3e1c230117a43773Timo Sirainenstatic bool
f29756821a4c6b12b73e4a2a3e1c230117a43773Timo Sirainenmaster_service_ssl_settings_check(void *_set, pool_t pool ATTR_UNUSED,
f29756821a4c6b12b73e4a2a3e1c230117a43773Timo Sirainen                  const char **error_r)
f29756821a4c6b12b73e4a2a3e1c230117a43773Timo Sirainen{
f29756821a4c6b12b73e4a2a3e1c230117a43773Timo Sirainen    struct master_service_ssl_settings *set = _set;
f29756821a4c6b12b73e4a2a3e1c230117a43773Timo Sirainen
f29756821a4c6b12b73e4a2a3e1c230117a43773Timo Sirainen    if (strcmp(set->ssl, "no") == 0) {
f29756821a4c6b12b73e4a2a3e1c230117a43773Timo Sirainen        /* disabled */
f29756821a4c6b12b73e4a2a3e1c230117a43773Timo Sirainen        return TRUE;
f29756821a4c6b12b73e4a2a3e1c230117a43773Timo Sirainen    }
f29756821a4c6b12b73e4a2a3e1c230117a43773Timo Sirainen#ifndef HAVE_SSL
f29756821a4c6b12b73e4a2a3e1c230117a43773Timo Sirainen    *error_r = t_strdup_printf("SSL support not compiled in but ssl=%s",
f29756821a4c6b12b73e4a2a3e1c230117a43773Timo Sirainen                   set->ssl);
f29756821a4c6b12b73e4a2a3e1c230117a43773Timo Sirainen    return FALSE;
f29756821a4c6b12b73e4a2a3e1c230117a43773Timo Sirainen#else
b244040178025c901c47be4fef3fa3bbc4c1e75aTimo Sirainen    /* we get called from many different tools, possibly with -O parameter,
b244040178025c901c47be4fef3fa3bbc4c1e75aTimo Sirainen       and few of those tools care about SSL settings. so don't check
b244040178025c901c47be4fef3fa3bbc4c1e75aTimo Sirainen       ssl_cert/ssl_key/etc validity here except in doveconf, because it
b244040178025c901c47be4fef3fa3bbc4c1e75aTimo Sirainen       usually is just an extra annoyance. */
42cb779853b1814d7ab052436b0b6d1f507c742bAki Tuomi#ifdef CONFIG_BINARY
f29756821a4c6b12b73e4a2a3e1c230117a43773Timo Sirainen    if (*set->ssl_cert == '\0') {
f29756821a4c6b12b73e4a2a3e1c230117a43773Timo Sirainen        *error_r = "ssl enabled, but ssl_cert not set";
f29756821a4c6b12b73e4a2a3e1c230117a43773Timo Sirainen        return FALSE;
f29756821a4c6b12b73e4a2a3e1c230117a43773Timo Sirainen    }
f29756821a4c6b12b73e4a2a3e1c230117a43773Timo Sirainen    if (*set->ssl_key == '\0') {
f29756821a4c6b12b73e4a2a3e1c230117a43773Timo Sirainen        *error_r = "ssl enabled, but ssl_key not set";
f29756821a4c6b12b73e4a2a3e1c230117a43773Timo Sirainen        return FALSE;
f29756821a4c6b12b73e4a2a3e1c230117a43773Timo Sirainen    }
551f3b2ebd588ca125c01f49b54c4103fbd5b2c5Aki Tuomi    if (*set->ssl_dh == '\0') {
551f3b2ebd588ca125c01f49b54c4103fbd5b2c5Aki Tuomi        *error_r = "ssl enabled, but ssl_dh not set";
551f3b2ebd588ca125c01f49b54c4103fbd5b2c5Aki Tuomi        return FALSE;
551f3b2ebd588ca125c01f49b54c4103fbd5b2c5Aki Tuomi    }
b244040178025c901c47be4fef3fa3bbc4c1e75aTimo Sirainen#endif
f29756821a4c6b12b73e4a2a3e1c230117a43773Timo Sirainen    if (set->ssl_verify_client_cert && *set->ssl_ca == '\0') {
f29756821a4c6b12b73e4a2a3e1c230117a43773Timo Sirainen        *error_r = "ssl_verify_client_cert set, but ssl_ca not";
f29756821a4c6b12b73e4a2a3e1c230117a43773Timo Sirainen        return FALSE;
f29756821a4c6b12b73e4a2a3e1c230117a43773Timo Sirainen    }
9864489d143fafe6f08f6a6d98a478d36458aa98Phil Carmody
9864489d143fafe6f08f6a6d98a478d36458aa98Phil Carmody    /* Now explode the ssl_options string into individual flags */
9864489d143fafe6f08f6a6d98a478d36458aa98Phil Carmody    /* First set them all to defaults */
9864489d143fafe6f08f6a6d98a478d36458aa98Phil Carmody    set->parsed_opts.compression = TRUE;
ea6bcfde34e4cced9b42f1b4f5140a47752cb0abTimo Sirainen    set->parsed_opts.tickets = TRUE;
9864489d143fafe6f08f6a6d98a478d36458aa98Phil Carmody
9864489d143fafe6f08f6a6d98a478d36458aa98Phil Carmody    /* Then modify anything specified in the string */
9864489d143fafe6f08f6a6d98a478d36458aa98Phil Carmody    const char **opts = t_strsplit_spaces(set->ssl_options, ", ");
9864489d143fafe6f08f6a6d98a478d36458aa98Phil Carmody    const char *opt;
9864489d143fafe6f08f6a6d98a478d36458aa98Phil Carmody    while ((opt = *opts++) != NULL) {
9864489d143fafe6f08f6a6d98a478d36458aa98Phil Carmody        if (strcasecmp(opt, "no_compression") == 0) {
9864489d143fafe6f08f6a6d98a478d36458aa98Phil Carmody            set->parsed_opts.compression = FALSE;
ea6bcfde34e4cced9b42f1b4f5140a47752cb0abTimo Sirainen        } else if (strcasecmp(opt, "no_ticket") == 0) {
ea6bcfde34e4cced9b42f1b4f5140a47752cb0abTimo Sirainen            set->parsed_opts.tickets = FALSE;
9864489d143fafe6f08f6a6d98a478d36458aa98Phil Carmody        } else {
9864489d143fafe6f08f6a6d98a478d36458aa98Phil Carmody            *error_r = t_strdup_printf("ssl_options: unknown flag: '%s'",
9864489d143fafe6f08f6a6d98a478d36458aa98Phil Carmody                           opt);
9864489d143fafe6f08f6a6d98a478d36458aa98Phil Carmody            return FALSE;
9864489d143fafe6f08f6a6d98a478d36458aa98Phil Carmody        }
9864489d143fafe6f08f6a6d98a478d36458aa98Phil Carmody    }
9864489d143fafe6f08f6a6d98a478d36458aa98Phil Carmody
f29756821a4c6b12b73e4a2a3e1c230117a43773Timo Sirainen    return TRUE;
f29756821a4c6b12b73e4a2a3e1c230117a43773Timo Sirainen#endif
f29756821a4c6b12b73e4a2a3e1c230117a43773Timo Sirainen}
f29756821a4c6b12b73e4a2a3e1c230117a43773Timo Sirainen/* </settings checks> */
f29756821a4c6b12b73e4a2a3e1c230117a43773Timo Sirainen
f29756821a4c6b12b73e4a2a3e1c230117a43773Timo Sirainenconst struct master_service_ssl_settings *
f29756821a4c6b12b73e4a2a3e1c230117a43773Timo Sirainenmaster_service_ssl_settings_get(struct master_service *service)
f29756821a4c6b12b73e4a2a3e1c230117a43773Timo Sirainen{
f29756821a4c6b12b73e4a2a3e1c230117a43773Timo Sirainen    void **sets;
f29756821a4c6b12b73e4a2a3e1c230117a43773Timo Sirainen
f29756821a4c6b12b73e4a2a3e1c230117a43773Timo Sirainen    sets = settings_parser_get_list(service->set_parser);
f29756821a4c6b12b73e4a2a3e1c230117a43773Timo Sirainen    return sets[1];
f29756821a4c6b12b73e4a2a3e1c230117a43773Timo Sirainen}