Skip to content
Newer
Older
100644 185 lines (159 sloc) 5.08 KB
86e4d16 Add the DragonFly Mail Agent dma(8) to the base.
Matthias Schmidt authored Feb 2, 2008
1 /*
2 * Copyright (c) 2008 The DragonFly Project. All rights reserved.
3 *
4 * This code is derived from software contributed to The DragonFly Project
5 * by Matthias Schmidt <matthias@dragonflybsd.org>, University of Marburg,
6 * Germany.
7 *
8 * Redistribution and use in source and binary forms, with or without
9 * modification, are permitted provided that the following conditions
10 * are met:
11 *
12 * 1. Redistributions of source code must retain the above copyright
13 * notice, this list of conditions and the following disclaimer.
14 * 2. Redistributions in binary form must reproduce the above copyright
15 * notice, this list of conditions and the following disclaimer in
16 * the documentation and/or other materials provided with the
17 * distribution.
18 * 3. Neither the name of The DragonFly Project nor the names of its
19 * contributors may be used to endorse or promote products derived
20 * from this software without specific, prior written permission.
21 *
22 * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
23 * ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
24 * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS
25 * FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE
26 * COPYRIGHT HOLDERS OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT,
27 * INCIDENTAL, SPECIAL, EXEMPLARY OR CONSEQUENTIAL DAMAGES (INCLUDING,
28 * BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
29 * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED
30 * AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY,
31 * OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT
32 * OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
33 * SUCH DAMAGE.
34 *
35 * $DragonFly: src/libexec/dma/crypto.c,v 1.1 2008/02/02 18:20:51 matthias Exp $
36 */
37
38 #ifdef HAVE_CRYPTO
39
40 #include <openssl/x509.h>
41 #include <openssl/ssl.h>
42 #include <openssl/err.h>
43 #include <openssl/pem.h>
44 #include <openssl/rand.h>
45
46 #include <syslog.h>
47
48 #include "dma.h"
49
50 extern struct config *config;
51
52 static int
53 init_cert_file(struct qitem *it, SSL_CTX *ctx, const char *path)
54 {
55 int error;
56
57 /* Load certificate into ctx */
58 error = SSL_CTX_use_certificate_chain_file(ctx, path);
59 if (error < 1) {
60 syslog(LOG_ERR, "%s: SSL: Cannot load certificate: %s",
61 it->queueid, path);
62 return (-1);
63 }
64
65 /* Add private key to ctx */
66 error = SSL_CTX_use_PrivateKey_file(ctx, path, SSL_FILETYPE_PEM);
67 if (error < 1) {
68 syslog(LOG_ERR, "%s: SSL: Cannot load private key: %s",
69 it->queueid, path);
70 return (-1);
71 }
72
73 /*
74 * Check the consistency of a private key with the corresponding
75 * certificate
76 */
77 error = SSL_CTX_check_private_key(ctx);
78 if (error < 1) {
79 syslog(LOG_ERR, "%s: SSL: Cannot check private key: %s",
80 it->queueid, path);
81 return (-1);
82 }
83
84 return (0);
85 }
86
87 int
88 smtp_init_crypto(struct qitem *it, int fd, int feature)
89 {
90 SSL_CTX *ctx = NULL;
91 SSL_METHOD *meth = NULL;
92 X509 *cert;
93 char buf[2048];
94 int error;
95
96 /* Init SSL library */
97 SSL_library_init();
98
99 meth = TLSv1_client_method();
100
101 ctx = SSL_CTX_new(meth);
102 if (ctx == NULL) {
103 syslog(LOG_ERR, "%s: remote delivery deferred:"
104 " SSL init failed: %m", it->queueid);
105 return (2);
106 }
107
108 /* User supplied a certificate */
109 if (config->certfile != NULL)
110 init_cert_file(it, ctx, config->certfile);
111
112 /*
113 * If the user wants STARTTLS, we have to send EHLO here
114 */
115 if (((feature & SECURETRANS) != 0) &&
116 (feature & STARTTLS) != 0) {
117 /* TLS init phase, disable SSL_write */
118 config->features |= TLSINIT;
119
120 send_remote_command(fd, "EHLO %s", hostname());
121 if (check_for_smtp_error(fd, buf) == 0) {
122 send_remote_command(fd, "STARTTLS");
123 if (check_for_smtp_error(fd, buf) < 0) {
124 syslog(LOG_ERR, "%s: remote delivery failed:"
125 " STARTTLS not available: %m", it->queueid);
126 config->features &= ~TLSINIT;
127 return (-1);
128 }
129 }
130 /* End of TLS init phase, enable SSL_write/read */
131 config->features &= ~TLSINIT;
132 }
133
134 config->ssl = SSL_new(ctx);
135 if (config->ssl == NULL) {
136 syslog(LOG_ERR, "%s: remote delivery deferred:"
137 " SSL struct creation failed:", it->queueid);
138 return (2);
139 }
140
141 /* Set ssl to work in client mode */
142 SSL_set_connect_state(config->ssl);
143
144 /* Set fd for SSL in/output */
145 error = SSL_set_fd(config->ssl, fd);
146 if (error == 0) {
147 error = SSL_get_error(config->ssl, error);
148 syslog(LOG_ERR, "%s: remote delivery deferred:"
149 " SSL set fd failed (%d): %m", it->queueid, error);
150 return (2);
151 }
152
153 /* Open SSL connection */
154 error = SSL_connect(config->ssl);
155 if (error < 0) {
156 syslog(LOG_ERR, "%s: remote delivery failed:"
157 " SSL handshake fataly failed: %m", it->queueid);
158 return (-1);
159 }
160
161 /* Get peer certificate */
162 cert = SSL_get_peer_certificate(config->ssl);
163 if (cert == NULL) {
164 syslog(LOG_ERR, "%s: remote delivery deferred:"
165 " Peer did not provied certificate: %m", it->queueid);
166 }
167 X509_free(cert);
168
169 return (0);
170 }
171
172 #if 0
173 /*
174 * CRAM-MD5 authentication
175 *
176 * XXX TODO implement me, I don't have a mail server with CRAM-MD5 available
177 */
178 int
179 smtp_auth_md5(int fd, char *login, char *password)
180 {
181 }
182 #endif /* 0 */
183
184 #endif /* HAVE_CRYPTO */
Something went wrong with that request. Please try again.