From: Timo Sirainen <tss@iki.fi>
Date: Wed, 23 Nov 2011 23:49:58 +0000 (+0200)
Subject: lib-ssl-iostream: Added crypto_device setting to set OpenSSL engine.
X-Git-Tag: 2.1.rc1~7
X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=cd5d9e833554e831095d0e52d32f433b674e1e73;p=thirdparty%2Fdovecot%2Fcore.git

lib-ssl-iostream: Added crypto_device setting to set OpenSSL engine.
Multiple engines aren't supported, so the first crypto_device value gets
used for all SSL connections.
---

diff --git a/src/lib-ssl-iostream/iostream-openssl-context.c b/src/lib-ssl-iostream/iostream-openssl-context.c
index 69de344a44..cbceabde23 100644
--- a/src/lib-ssl-iostream/iostream-openssl-context.c
+++ b/src/lib-ssl-iostream/iostream-openssl-context.c
@@ -6,6 +6,7 @@
 
 #include <openssl/crypto.h>
 #include <openssl/x509.h>
+#include <openssl/engine.h>
 #include <openssl/pem.h>
 #include <openssl/ssl.h>
 #include <openssl/err.h>
@@ -17,9 +18,10 @@ struct ssl_iostream_password_context {
 };
 
 static bool ssl_global_initialized = FALSE;
+static ENGINE *ssl_iostream_engine;
 int dovecot_ssl_extdata_index;
 
-static void ssl_iostream_init_global(void);
+static void ssl_iostream_init_global(const struct ssl_iostream_settings *set);
 
 const char *ssl_iostream_error(void)
 {
@@ -369,7 +371,7 @@ int ssl_iostream_context_init_client(const char *source,
 	struct ssl_iostream_context *ctx;
 	SSL_CTX *ssl_ctx;
 
-	ssl_iostream_init_global();
+	ssl_iostream_init_global(set);
 	if ((ssl_ctx = SSL_CTX_new(SSLv23_client_method())) == NULL) {
 		i_error("SSL_CTX_new() failed: %s", ssl_iostream_error());
 		return -1;
@@ -393,7 +395,7 @@ int ssl_iostream_context_init_server(const char *source,
 	struct ssl_iostream_context *ctx;
 	SSL_CTX *ssl_ctx;
 
-	ssl_iostream_init_global();
+	ssl_iostream_init_global(set);
 	if ((ssl_ctx = SSL_CTX_new(SSLv23_server_method())) == NULL) {
 		i_error("SSL_CTX_new() failed: %s", ssl_iostream_error());
 		return -1;
@@ -422,11 +424,14 @@ void ssl_iostream_context_deinit(struct ssl_iostream_context **_ctx)
 
 static void ssl_iostream_deinit_global(void)
 {
+	if (ssl_iostream_engine != NULL)
+		ENGINE_finish(ssl_iostream_engine);
+	ENGINE_cleanup();
 	EVP_cleanup();
 	ERR_free_strings();
 }
 
-static void ssl_iostream_init_global(void)
+static void ssl_iostream_init_global(const struct ssl_iostream_settings *set)
 {
 	static char dovecot[] = "dovecot";
 	unsigned char buf;
@@ -448,4 +453,18 @@ static void ssl_iostream_init_global(void)
 	   the first try, so this function may fail. It's still been
 	   initialized though. */
 	(void)RAND_bytes(&buf, 1);
+
+	if (set->crypto_device != NULL && *set->crypto_device != '\0') {
+		ENGINE_load_builtin_engines();
+		ssl_iostream_engine = ENGINE_by_id(set->crypto_device);
+		if (ssl_iostream_engine == NULL) {
+			i_error("Unknown ssl_crypto_device: %s",
+				set->crypto_device);
+		} else {
+			ENGINE_init(ssl_iostream_engine);
+			ENGINE_set_default_RSA(ssl_iostream_engine);
+			ENGINE_set_default_DSA(ssl_iostream_engine);
+			ENGINE_set_default_ciphers(ssl_iostream_engine);
+		}
+	}
 }
diff --git a/src/lib-ssl-iostream/iostream-ssl.h b/src/lib-ssl-iostream/iostream-ssl.h
index 9f62d375d4..f343e95197 100644
--- a/src/lib-ssl-iostream/iostream-ssl.h
+++ b/src/lib-ssl-iostream/iostream-ssl.h
@@ -11,6 +11,7 @@ struct ssl_iostream_settings {
 	const char *key;
 	const char *key_password;
 	const char *cert_username_field;
+	const char *crypto_device;
 
 	bool verbose, verbose_invalid_cert;
 	bool verify_remote_cert;