Added ssl_verify_client_cert setting.

--HG--
branch : HEAD

diff --git a/dovecot-example.conf b/dovecot-example.conf
index 17ba4dab55234e95ed0a79b20dd747b075b5cfed..715912f0fa0e39096d95c50c89bb87c2fd2acfae 100644 (file)
--- a/dovecot-example.conf
+++ b/dovecot-example.conf
@@ -34,6 +34,12 @@
 #ssl_cert_file = /etc/ssl/certs/dovecot.pem
 #ssl_key_file = /etc/ssl/private/dovecot.pem
 
+# File containing trusted SSL certificate authorities. Usually not needed.
+#ssl_ca_file = 
+
+# Require client to send a valid certificate, otherwise fail the SSL handshake.
+#ssl_verify_client_cert = no
+
 # SSL parameter file. Master process generates this file for login processes.
 # It contains Diffie Hellman and RSA parameters.
 #ssl_parameters_file = /var/run/dovecot/ssl-parameters.dat

diff --git a/src/login-common/ssl-proxy-openssl.c b/src/login-common/ssl-proxy-openssl.c
index 6e5722ea25c0a539da9b7d382b96112fbe44a39b..554eae3233912bb6ef20ea999d5443005b5dfd38 100644 (file)
--- a/src/login-common/ssl-proxy-openssl.c
+++ b/src/login-common/ssl-proxy-openssl.c
@@ -453,6 +453,12 @@ void ssl_proxy_init(void)
        if (SSL_CTX_need_tmp_RSA(ssl_ctx))
                SSL_CTX_set_tmp_rsa_callback(ssl_ctx, ssl_gen_rsa_key);
 
+       if (getenv("SSL_VERIFY_CLIENT_CERT") != NULL) {
+               SSL_CTX_set_verify(ssl_ctx, SSL_VERIFY_PEER |
+                                  SSL_VERIFY_FAIL_IF_NO_PEER_CERT |
+                                  SSL_VERIFY_CLIENT_ONCE, NULL);
+       }
+
        /* PRNG initialization might want to use /dev/urandom, make sure it
           does it before chrooting. */
        if (RAND_bytes(&buf, 1) != 1)

diff --git a/src/master/login-process.c b/src/master/login-process.c
index 6f773286fb4879fae6ffdeea239eef3ec9c69f63..3adf77b678bdb1b5bf85bdf04ecd4d1626c38807 100644 (file)
--- a/src/master/login-process.c
+++ b/src/master/login-process.c
@@ -396,6 +396,8 @@ static void login_process_init_env(struct login_group *group, pid_t pid)
                        env_put(t_strconcat("SSL_CIPHER_LIST=",
                                            set->ssl_cipher_list, NULL));
                }
+               if (set->ssl_verify_client_cert)
+                       env_put("SSL_VERIFY_CLIENT_CERT=1");
        }
 
        if (set->disable_plaintext_auth)

diff --git a/src/master/master-settings.c b/src/master/master-settings.c
index b17a7b6d14d184a50c9f3cf313dad4820fa85926..cb1a944839c4cb478e106fd62ad87cc666cd9598 100644 (file)
--- a/src/master/master-settings.c
+++ b/src/master/master-settings.c
@@ -52,6 +52,7 @@ static struct setting_def setting_defs[] = {
        DEF(SET_STR, ssl_parameters_file),
        DEF(SET_STR, ssl_parameters_regenerate),
        DEF(SET_STR, ssl_cipher_list),
+       DEF(SET_BOOL, ssl_verify_client_cert),
        DEF(SET_BOOL, disable_plaintext_auth),
        DEF(SET_BOOL, verbose_ssl),
 
@@ -174,6 +175,7 @@ struct settings default_settings = {
        MEMBER(ssl_parameters_file) "ssl-parameters.dat",
        MEMBER(ssl_parameters_regenerate) 24,
        MEMBER(ssl_cipher_list) NULL,
+       MEMBER(ssl_verify_client_cert) FALSE,
        MEMBER(disable_plaintext_auth) TRUE,
        MEMBER(verbose_ssl) FALSE,
 

diff --git a/src/master/master-settings.h b/src/master/master-settings.h
index 84ec964cfb828deabc989c2d6825fb464a288a78..8b717c42958344a25704adda69effee2999b6710 100644 (file)
--- a/src/master/master-settings.h
+++ b/src/master/master-settings.h
@@ -29,6 +29,7 @@ struct settings {
        const char *ssl_parameters_file;
        unsigned int ssl_parameters_regenerate;
        const char *ssl_cipher_list;
+       int ssl_verify_client_cert;
        int disable_plaintext_auth;
        int verbose_ssl;