lib-ssl-iostream: Add io_stream_ssl_global_init()

diff --git a/src/lib-ssl-iostream/iostream-openssl-context.c b/src/lib-ssl-iostream/iostream-openssl-context.c
index ae35005fa18641d1edf013f45e291650715fdfb6..d83bccc6151202e335ed8bf1f89d8f97dab5ca7a 100644 (file)
--- a/src/lib-ssl-iostream/iostream-openssl-context.c
+++ b/src/lib-ssl-iostream/iostream-openssl-context.c
@@ -23,9 +23,6 @@ struct ssl_iostream_password_context {
 static bool ssl_global_initialized = FALSE;
 int dovecot_ssl_extdata_index;
 
-static int ssl_iostream_init_global(const struct ssl_iostream_settings *set,
-                                   const char **error_r);
-
 static RSA *ssl_gen_rsa_key(SSL *ssl ATTR_UNUSED,
                            int is_export ATTR_UNUSED, int keylength)
 {
@@ -580,8 +577,6 @@ int openssl_iostream_context_init_client(const struct ssl_iostream_settings *set
        struct ssl_iostream_context *ctx;
        SSL_CTX *ssl_ctx;
 
-       if (ssl_iostream_init_global(set, error_r) < 0)
-               return -1;
        if ((ssl_ctx = SSL_CTX_new(SSLv23_client_method())) == NULL) {
                *error_r = t_strdup_printf("SSL_CTX_new() failed: %s",
                                           openssl_iostream_error());
@@ -608,8 +603,6 @@ int openssl_iostream_context_init_server(const struct ssl_iostream_settings *set
        struct ssl_iostream_context *ctx;
        SSL_CTX *ssl_ctx;
 
-       if (ssl_iostream_init_global(set, error_r) < 0)
-               return -1;
        if ((ssl_ctx = SSL_CTX_new(SSLv23_server_method())) == NULL) {
                *error_r = t_strdup_printf("SSL_CTX_new() failed: %s",
                                           openssl_iostream_error());
@@ -651,8 +644,8 @@ void openssl_iostream_global_deinit(void)
        dovecot_openssl_common_global_unref();
 }
 
-static int ssl_iostream_init_global(const struct ssl_iostream_settings *set,
-                                   const char **error_r)
+int openssl_iostream_global_init(const struct ssl_iostream_settings *set,
+                                const char **error_r)
 {
        static char dovecot[] = "dovecot";
        const char *error;

diff --git a/src/lib-ssl-iostream/iostream-openssl.c b/src/lib-ssl-iostream/iostream-openssl.c
index e960f485ef546ce10488ad6f3aaed8c8be5141de..539b9545888d55a87238288110e18ff051f9bb87 100644 (file)
--- a/src/lib-ssl-iostream/iostream-openssl.c
+++ b/src/lib-ssl-iostream/iostream-openssl.c
@@ -798,6 +798,7 @@ openssl_iostream_get_last_error(struct ssl_iostream *ssl_io)
 }
 
 static const struct iostream_ssl_vfuncs ssl_vfuncs = {
+       .global_init = openssl_iostream_global_init,
        .context_init_client = openssl_iostream_context_init_client,
        .context_init_server = openssl_iostream_context_init_server,
        .context_ref = openssl_iostream_context_ref,

diff --git a/src/lib-ssl-iostream/iostream-openssl.h b/src/lib-ssl-iostream/iostream-openssl.h
index caa34ed1f27f0e8f025089e0e88333969be3373a..137e0bfafb6aaa97578511aa016869497bc020a5 100644 (file)
--- a/src/lib-ssl-iostream/iostream-openssl.h
+++ b/src/lib-ssl-iostream/iostream-openssl.h
@@ -73,6 +73,9 @@ extern int dovecot_ssl_extdata_index;
 struct istream *openssl_i_stream_create_ssl(struct ssl_iostream *ssl_io);
 struct ostream *openssl_o_stream_create_ssl(struct ssl_iostream *ssl_io);
 
+int openssl_iostream_global_init(const struct ssl_iostream_settings *set,
+                                const char **error_r);
+
 int openssl_iostream_context_init_client(const struct ssl_iostream_settings *set,
                                         struct ssl_iostream_context **ctx_r,
                                         const char **error_r);

diff --git a/src/lib-ssl-iostream/iostream-ssl-private.h b/src/lib-ssl-iostream/iostream-ssl-private.h
index 19b581e28a02306a44205e40d465c6de7474a5b1..430dbc5f7374f415a5287698908781b66d791602 100644 (file)
--- a/src/lib-ssl-iostream/iostream-ssl-private.h
+++ b/src/lib-ssl-iostream/iostream-ssl-private.h
@@ -4,6 +4,8 @@
 #include "iostream-ssl.h"
 
 struct iostream_ssl_vfuncs {
+       int (*global_init)(const struct ssl_iostream_settings *set,
+                          const char **error_r);
        int (*context_init_client)(const struct ssl_iostream_settings *set,
                                   struct ssl_iostream_context **ctx_r,
                                   const char **error_r);

diff --git a/src/lib-ssl-iostream/iostream-ssl.c b/src/lib-ssl-iostream/iostream-ssl.c
index 2daa04e1b1d6f0840ce605c654c6a8c737bd0773..79722a4bdf1cd377f0e00231d6951acf0a24744d 100644 (file)
--- a/src/lib-ssl-iostream/iostream-ssl.c
+++ b/src/lib-ssl-iostream/iostream-ssl.c
@@ -76,6 +76,12 @@ int ssl_module_load(const char **error_r)
 #endif
 }
 
+int io_stream_ssl_global_init(const struct ssl_iostream_settings *set,
+                             const char **error_r)
+{
+       return ssl_vfuncs->global_init(set, error_r);
+}
+
 int ssl_iostream_context_init_client(const struct ssl_iostream_settings *set,
                                     struct ssl_iostream_context **ctx_r,
                                     const char **error_r)
@@ -89,6 +95,8 @@ int ssl_iostream_context_init_client(const struct ssl_iostream_settings *set,
                if (ssl_module_load(error_r) < 0)
                        return -1;
        }
+       if (io_stream_ssl_global_init(&set_copy, error_r) < 0)
+               return -1;
        return ssl_vfuncs->context_init_client(&set_copy, ctx_r, error_r);
 }
 
@@ -100,6 +108,8 @@ int ssl_iostream_context_init_server(const struct ssl_iostream_settings *set,
                if (ssl_module_load(error_r) < 0)
                        return -1;
        }
+       if (io_stream_ssl_global_init(set, error_r) < 0)
+               return -1;
        return ssl_vfuncs->context_init_server(set, ctx_r, error_r);
 }
 

diff --git a/src/lib-ssl-iostream/iostream-ssl.h b/src/lib-ssl-iostream/iostream-ssl.h
index cee3810a100cfdcb65e8a6ebb6e423929192d1a1..80a681b99fc9671810e0ee2888984c7a663af248 100644 (file)
--- a/src/lib-ssl-iostream/iostream-ssl.h
+++ b/src/lib-ssl-iostream/iostream-ssl.h
@@ -47,6 +47,13 @@ ssl_iostream_handshake_callback_t(const char **error_r, void *context);
 typedef int ssl_iostream_sni_callback_t(const char *name, const char **error_r,
                                        void *context);
 
+/* Explicitly initialize SSL library globally. This is also done automatically
+   when the first SSL connection is created, but it may be useful to call it
+   earlier in case of chrooting. After the initialization is successful, any
+   further calls will just be ignored. Returns 0 on success, -1 on error. */
+int io_stream_ssl_global_init(const struct ssl_iostream_settings *set,
+                             const char **error_r);
+
 int io_stream_create_ssl_client(struct ssl_iostream_context *ctx, const char *host,
                                const struct ssl_iostream_settings *set,
                                struct istream **input, struct ostream **output,