iostream-openssl.h revision 3faa1040e5a3f9f35ffad29110216094ab2f5880
e98de01b5644c88b6053e2921eb5e9a506fe263fTimo Sirainen#ifndef IOSTREAM_OPENSSL_H
e98de01b5644c88b6053e2921eb5e9a506fe263fTimo Sirainen#define IOSTREAM_OPENSSL_H
e98de01b5644c88b6053e2921eb5e9a506fe263fTimo Sirainen
3faa1040e5a3f9f35ffad29110216094ab2f5880Timo Sirainen#include "iostream-ssl-private.h"
e98de01b5644c88b6053e2921eb5e9a506fe263fTimo Sirainen
e98de01b5644c88b6053e2921eb5e9a506fe263fTimo Sirainen#include <openssl/ssl.h>
e98de01b5644c88b6053e2921eb5e9a506fe263fTimo Sirainen
e98de01b5644c88b6053e2921eb5e9a506fe263fTimo Sirainenstruct ssl_iostream_context {
e98de01b5644c88b6053e2921eb5e9a506fe263fTimo Sirainen SSL_CTX *ssl_ctx;
e98de01b5644c88b6053e2921eb5e9a506fe263fTimo Sirainen
e98de01b5644c88b6053e2921eb5e9a506fe263fTimo Sirainen pool_t pool;
e98de01b5644c88b6053e2921eb5e9a506fe263fTimo Sirainen const struct ssl_iostream_settings *set;
e98de01b5644c88b6053e2921eb5e9a506fe263fTimo Sirainen /* Used as logging prefix, e.g. "client" or "server" */
e98de01b5644c88b6053e2921eb5e9a506fe263fTimo Sirainen const char *source;
e98de01b5644c88b6053e2921eb5e9a506fe263fTimo Sirainen
e98de01b5644c88b6053e2921eb5e9a506fe263fTimo Sirainen DH *dh_512, *dh_1024;
e98de01b5644c88b6053e2921eb5e9a506fe263fTimo Sirainen int username_nid;
e98de01b5644c88b6053e2921eb5e9a506fe263fTimo Sirainen
e98de01b5644c88b6053e2921eb5e9a506fe263fTimo Sirainen unsigned int client_ctx:1;
e98de01b5644c88b6053e2921eb5e9a506fe263fTimo Sirainen};
e98de01b5644c88b6053e2921eb5e9a506fe263fTimo Sirainen
e98de01b5644c88b6053e2921eb5e9a506fe263fTimo Sirainenstruct ssl_iostream {
e98de01b5644c88b6053e2921eb5e9a506fe263fTimo Sirainen int refcount;
e98de01b5644c88b6053e2921eb5e9a506fe263fTimo Sirainen struct ssl_iostream_context *ctx;
e98de01b5644c88b6053e2921eb5e9a506fe263fTimo Sirainen
e98de01b5644c88b6053e2921eb5e9a506fe263fTimo Sirainen const struct ssl_iostream_settings *set;
e98de01b5644c88b6053e2921eb5e9a506fe263fTimo Sirainen
e98de01b5644c88b6053e2921eb5e9a506fe263fTimo Sirainen SSL *ssl;
e98de01b5644c88b6053e2921eb5e9a506fe263fTimo Sirainen BIO *bio_ext;
e98de01b5644c88b6053e2921eb5e9a506fe263fTimo Sirainen
e98de01b5644c88b6053e2921eb5e9a506fe263fTimo Sirainen struct istream *plain_input;
e98de01b5644c88b6053e2921eb5e9a506fe263fTimo Sirainen struct ostream *plain_output;
e98de01b5644c88b6053e2921eb5e9a506fe263fTimo Sirainen struct ostream *ssl_output;
e98de01b5644c88b6053e2921eb5e9a506fe263fTimo Sirainen
e98de01b5644c88b6053e2921eb5e9a506fe263fTimo Sirainen char *source;
e98de01b5644c88b6053e2921eb5e9a506fe263fTimo Sirainen char *last_error;
c2c0c1e5d2e97ae114ad83d8cb486b0aab23ac38Timo Sirainen int plain_stream_errno;
e98de01b5644c88b6053e2921eb5e9a506fe263fTimo Sirainen
e98de01b5644c88b6053e2921eb5e9a506fe263fTimo Sirainen /* copied settings */
e98de01b5644c88b6053e2921eb5e9a506fe263fTimo Sirainen bool verbose, verbose_invalid_cert, require_valid_cert;
e98de01b5644c88b6053e2921eb5e9a506fe263fTimo Sirainen int username_nid;
e98de01b5644c88b6053e2921eb5e9a506fe263fTimo Sirainen
e98de01b5644c88b6053e2921eb5e9a506fe263fTimo Sirainen int (*handshake_callback)(void *context);
e98de01b5644c88b6053e2921eb5e9a506fe263fTimo Sirainen void *handshake_context;
e98de01b5644c88b6053e2921eb5e9a506fe263fTimo Sirainen
e98de01b5644c88b6053e2921eb5e9a506fe263fTimo Sirainen unsigned int handshaked:1;
e98de01b5644c88b6053e2921eb5e9a506fe263fTimo Sirainen unsigned int cert_received:1;
e98de01b5644c88b6053e2921eb5e9a506fe263fTimo Sirainen unsigned int cert_broken:1;
21fed972adb354b92771eefad27f8ac8cbd5dd45Timo Sirainen unsigned int want_read:1;
739125f23e3312045e620014812fe2249a309cc4Timo Sirainen unsigned int input_handler:1;
21fed972adb354b92771eefad27f8ac8cbd5dd45Timo Sirainen unsigned int ostream_flush_waiting_input:1;
c2c0c1e5d2e97ae114ad83d8cb486b0aab23ac38Timo Sirainen unsigned int closed:1;
e98de01b5644c88b6053e2921eb5e9a506fe263fTimo Sirainen};
e98de01b5644c88b6053e2921eb5e9a506fe263fTimo Sirainen
e98de01b5644c88b6053e2921eb5e9a506fe263fTimo Sirainenextern int dovecot_ssl_extdata_index;
e98de01b5644c88b6053e2921eb5e9a506fe263fTimo Sirainen
3faa1040e5a3f9f35ffad29110216094ab2f5880Timo Sirainenstruct istream *openssl_i_stream_create_ssl(struct ssl_iostream *ssl_io);
3faa1040e5a3f9f35ffad29110216094ab2f5880Timo Sirainenstruct ostream *openssl_o_stream_create_ssl(struct ssl_iostream *ssl_io);
e98de01b5644c88b6053e2921eb5e9a506fe263fTimo Sirainen
3faa1040e5a3f9f35ffad29110216094ab2f5880Timo Sirainenint openssl_iostream_context_init_client(const char *source,
3faa1040e5a3f9f35ffad29110216094ab2f5880Timo Sirainen const struct ssl_iostream_settings *set,
3faa1040e5a3f9f35ffad29110216094ab2f5880Timo Sirainen struct ssl_iostream_context **ctx_r);
3faa1040e5a3f9f35ffad29110216094ab2f5880Timo Sirainenint openssl_iostream_context_init_server(const char *source,
3faa1040e5a3f9f35ffad29110216094ab2f5880Timo Sirainen const struct ssl_iostream_settings *set,
3faa1040e5a3f9f35ffad29110216094ab2f5880Timo Sirainen struct ssl_iostream_context **ctx_r);
3faa1040e5a3f9f35ffad29110216094ab2f5880Timo Sirainenvoid openssl_iostream_context_deinit(struct ssl_iostream_context *ctx);
3faa1040e5a3f9f35ffad29110216094ab2f5880Timo Sirainen
3faa1040e5a3f9f35ffad29110216094ab2f5880Timo Sirainenint openssl_iostream_load_key(const struct ssl_iostream_settings *set,
3faa1040e5a3f9f35ffad29110216094ab2f5880Timo Sirainen const char *key_source, EVP_PKEY **pkey_r);
e98de01b5644c88b6053e2921eb5e9a506fe263fTimo Sirainenconst char *ssl_iostream_get_use_certificate_error(const char *cert);
831f3bcdde51fa388462eda1daa555e90651ca2eTimo Sirainenint openssl_cert_match_name(SSL *ssl, const char *verify_name);
6a4212e6d7c41de83bcac63edec3118e6a7a0f68Timo Sirainenint openssl_get_protocol_options(const char *protocols);
6a4212e6d7c41de83bcac63edec3118e6a7a0f68Timo Sirainen#define OPENSSL_ALL_PROTOCOL_OPTIONS \
6a4212e6d7c41de83bcac63edec3118e6a7a0f68Timo Sirainen (SSL_OP_NO_SSLv2 | SSL_OP_NO_SSLv3 | SSL_OP_NO_TLSv1)
e98de01b5644c88b6053e2921eb5e9a506fe263fTimo Sirainen
21fed972adb354b92771eefad27f8ac8cbd5dd45Timo Sirainen/* Sync plain_input/plain_output streams with BIOs. Returns TRUE if at least
21fed972adb354b92771eefad27f8ac8cbd5dd45Timo Sirainen one byte was read/written. */
3faa1040e5a3f9f35ffad29110216094ab2f5880Timo Sirainenbool openssl_iostream_bio_sync(struct ssl_iostream *ssl_io);
21fed972adb354b92771eefad27f8ac8cbd5dd45Timo Sirainen/* Call when there's more data available in plain_input/plain_output.
21fed972adb354b92771eefad27f8ac8cbd5dd45Timo Sirainen Returns 1 if it's ok to continue with SSL_read/SSL_write, 0 if not
21fed972adb354b92771eefad27f8ac8cbd5dd45Timo Sirainen (still handshaking), -1 if error occurred. */
3faa1040e5a3f9f35ffad29110216094ab2f5880Timo Sirainenint openssl_iostream_more(struct ssl_iostream *ssl_io);
21fed972adb354b92771eefad27f8ac8cbd5dd45Timo Sirainen
21fed972adb354b92771eefad27f8ac8cbd5dd45Timo Sirainen/* Returns 1 if the operation should be retried (we read/wrote more data),
21fed972adb354b92771eefad27f8ac8cbd5dd45Timo Sirainen 0 if the operation should retried later once more data has been
21fed972adb354b92771eefad27f8ac8cbd5dd45Timo Sirainen read/written, -1 if a fatal error occurred (errno is set). */
3faa1040e5a3f9f35ffad29110216094ab2f5880Timo Sirainenint openssl_iostream_handle_error(struct ssl_iostream *ssl_io, int ret,
3faa1040e5a3f9f35ffad29110216094ab2f5880Timo Sirainen const char *func_name);
3faa1040e5a3f9f35ffad29110216094ab2f5880Timo Sirainenint openssl_iostream_handle_write_error(struct ssl_iostream *ssl_io, int ret,
3faa1040e5a3f9f35ffad29110216094ab2f5880Timo Sirainen const char *func_name);
3faa1040e5a3f9f35ffad29110216094ab2f5880Timo Sirainen
3faa1040e5a3f9f35ffad29110216094ab2f5880Timo Sirainenconst char *openssl_iostream_error(void);
3faa1040e5a3f9f35ffad29110216094ab2f5880Timo Sirainenconst char *openssl_iostream_key_load_error(void);
3faa1040e5a3f9f35ffad29110216094ab2f5880Timo Sirainen
3faa1040e5a3f9f35ffad29110216094ab2f5880Timo Sirainenint openssl_iostream_generate_params(buffer_t *output);
3faa1040e5a3f9f35ffad29110216094ab2f5880Timo Sirainenint openssl_iostream_context_import_params(struct ssl_iostream_context *ctx,
3faa1040e5a3f9f35ffad29110216094ab2f5880Timo Sirainen const buffer_t *input);
3faa1040e5a3f9f35ffad29110216094ab2f5880Timo Sirainenvoid openssl_iostream_context_free_params(struct ssl_iostream_context *ctx);
e98de01b5644c88b6053e2921eb5e9a506fe263fTimo Sirainen
e98de01b5644c88b6053e2921eb5e9a506fe263fTimo Sirainen#endif