login: Added ssl_crypto_device setting to set OpenSSL engine.

diff --git a/src/login-common/login-settings.c b/src/login-common/login-settings.c
index 8850ea6114b4017999f3f837dd5f2cfb0b335120..61a14483e09dce1ce2a86fda2f21e6b1431c70af 100644 (file)
--- a/src/login-common/login-settings.c
+++ b/src/login-common/login-settings.c
@@ -35,6 +35,7 @@ static const struct setting_define login_setting_defines[] = {
        DEF(SET_STR, ssl_cert_username_field),
        DEF(SET_STR, ssl_client_cert),
        DEF(SET_STR, ssl_client_key),
+       DEF(SET_STR, ssl_crypto_device),
        DEF(SET_BOOL, ssl_verify_client_cert),
        DEF(SET_BOOL, auth_ssl_require_client_cert),
        DEF(SET_BOOL, auth_ssl_username_from_cert),
@@ -67,6 +68,7 @@ static const struct login_settings login_default_settings = {
        .ssl_cert_username_field = "commonName",
        .ssl_client_cert = "",
        .ssl_client_key = "",
+       .ssl_crypto_device = "",
        .ssl_verify_client_cert = FALSE,
        .auth_ssl_require_client_cert = FALSE,
        .auth_ssl_username_from_cert = FALSE,

diff --git a/src/login-common/login-settings.h b/src/login-common/login-settings.h
index 5eef51bebada89c25f5070e2ec1a0abce25c72c7..145e21ce96ae8eb3bcf1dd3da3015b3aee2ab2c4 100644 (file)
--- a/src/login-common/login-settings.h
+++ b/src/login-common/login-settings.h
@@ -17,6 +17,7 @@ struct login_settings {
        const char *ssl_cert_username_field;
        const char *ssl_client_cert;
        const char *ssl_client_key;
+       const char *ssl_crypto_device;
        bool ssl_verify_client_cert;
        bool auth_ssl_require_client_cert;
        bool auth_ssl_username_from_cert;

diff --git a/src/login-common/ssl-proxy-openssl.c b/src/login-common/ssl-proxy-openssl.c
index 4b937e5ce1f2634e362e0ee89b66bb7bc57f82b2..02000235de93088eef6a0553a694cae7e7c2e716 100644 (file)
--- a/src/login-common/ssl-proxy-openssl.c
+++ b/src/login-common/ssl-proxy-openssl.c
@@ -21,6 +21,7 @@
 
 #include "iostream-openssl.h"
 #include <openssl/crypto.h>
+#include <openssl/engine.h>
 #include <openssl/x509.h>
 #include <openssl/pem.h>
 #include <openssl/ssl.h>
@@ -99,6 +100,7 @@ static unsigned int ssl_proxy_count;
 static struct ssl_proxy *ssl_proxies;
 static struct ssl_parameters ssl_params;
 static int ssl_username_nid;
+static ENGINE *ssl_engine;
 
 static void plain_read(struct ssl_proxy *proxy);
 static void ssl_read(struct ssl_proxy *proxy);
@@ -1274,6 +1276,19 @@ void ssl_proxy_init(void)
        SSL_load_error_strings();
        OpenSSL_add_all_algorithms();
 
+       if (*set->ssl_crypto_device != '\0') {
+               ENGINE_load_builtin_engines();
+               ssl_engine = ENGINE_by_id(set->ssl_crypto_device);
+               if (ssl_engine == NULL) {
+                       i_fatal("Unknown ssl_crypto_device: %s",
+                               set->ssl_crypto_device);
+               }
+               ENGINE_init(ssl_engine);
+               ENGINE_set_default_RSA(ssl_engine);
+               ENGINE_set_default_DSA(ssl_engine);
+               ENGINE_set_default_ciphers(ssl_engine);
+       }
+
        extdata_index = SSL_get_ex_new_index(0, dovecot, NULL, NULL, NULL);
 
        ssl_servers = hash_table_create(default_pool, default_pool, 0,
@@ -1324,6 +1339,10 @@ void ssl_proxy_deinit(void)
 
        ssl_free_parameters(&ssl_params);
        SSL_CTX_free(ssl_client_ctx);
+       if (ssl_engine != NULL) {
+               ENGINE_cleanup();
+               ENGINE_finish(ssl_engine);
+       }
        EVP_cleanup();
        ERR_free_strings();
 }