[Feature] Initialize ssl library to use SSL connections

diff --git a/CMakeLists.txt b/CMakeLists.txt
index 219fdce41a7e41af9217d40487eeb50d905a8c2e..0b5331bb3cc80ff811846fd195b9f14ff5340afb 100644 (file)
--- a/CMakeLists.txt
+++ b/CMakeLists.txt
@@ -613,7 +613,6 @@ IF(CMAKE_SYSTEM_NAME STREQUAL "SunOS")
        LIST(APPEND CMAKE_REQUIRED_LIBRARIES socket)
        LIST(APPEND CMAKE_REQUIRED_LIBRARIES umem)
        # Ugly hack, but FindOpenSSL on Solaris does not link with libcrypto
-       LIST(APPEND CMAKE_REQUIRED_LIBRARIES crypto)
        SET(CMAKE_VERBOSE_MAKEFILE ON)
        SET(CMAKE_INSTALL_RPATH_USE_LINK_PATH FALSE)
        SET(CMAKE_INSTALL_RPATH "${CMAKE_INSTALL_PREFIX}/lib:${RSPAMD_LIBDIR}")
@@ -671,8 +670,10 @@ ProcessPackage(SQLITE3 LIBRARY sqlite3 INCLUDE sqlite3.h INCLUDE_SUFFIXES includ
        ROOT ${SQLITE3_ROOT_DIR} MODULES sqlite3 sqlite)
 ProcessPackage(ICONV LIBRARY iconv libiconv libiconv-2 c INCLUDE iconv.h INCLUDE_SUFFIXES include/libiconv
        ROOT ${ICONV_ROOT_DIR} MODULES iconv)
-ProcessPackage(OPENSSL LIBRARY crypto INCLUDE err.h INCLUDE_SUFFIXES include/openssl
-       ROOT ${OPENSSL_ROOT_DIR} MODULES openssl)
+ProcessPackage(LIBCRYPT LIBRARY crypto INCLUDE err.h INCLUDE_SUFFIXES include/openssl
+       ROOT ${OPENSSL_ROOT_DIR} MODULES openssl libcrypt)
+ProcessPackage(LIBSSL LIBRARY ssl INCLUDE ssl.h INCLUDE_SUFFIXES include/openssl
+       ROOT ${OPENSSL_ROOT_DIR} MODULES openssl libssl)
 ProcessPackage(MAGIC LIBRARY magic INCLUDE magic.h INCLUDE_SUFFIXES include/libmagic
        ROOT ${LIBMAGIC_ROOT_DIR} MODULES magic)
 
@@ -690,9 +691,7 @@ IF (ENABLE_FANN MATCHES "ON")
 ENDIF ()
 
 #Check for openssl (required for dkim)
-IF(WITH_OPENSSL)
-       SET(HAVE_OPENSSL 1)
-ENDIF(WITH_OPENSSL)
+SET(HAVE_OPENSSL 1)
 
 IF(GMIME2_VERSION VERSION_GREATER "2.4.0" OR NOT GMIME2_VERSION)
        SET(GMIME24 1)

diff --git a/src/libutil/util.c b/src/libutil/util.c
index 3b0203f9fc6fe42cb6ea5d9fd1b5540edf727ef7..10753ec93caccacca41c4ad437c3cef3ad6f22aa 100644 (file)
--- a/src/libutil/util.c
+++ b/src/libutil/util.c
@@ -28,6 +28,7 @@
 #include <openssl/rand.h>
 #include <openssl/err.h>
 #include <openssl/evp.h>
+#include <openssl/ssl.h>
 #endif
 
 #ifdef HAVE_TERMIOS_H
@@ -1971,6 +1972,7 @@ rspamd_init_libs (void)
        struct rlimit rlim;
        struct rspamd_external_libs_ctx *ctx;
        struct ottery_config *ottery_cfg;
+       static const char secure_ciphers[] = "HIGH:!aNULL:!kRSA:!PSK:!SRP:!MD5:!RC4";
 
        ctx = g_slice_alloc0 (sizeof (*ctx));
        ctx->crypto_ctx = rspamd_cryptobox_init ();
@@ -2007,6 +2009,24 @@ rspamd_init_libs (void)
        OpenSSL_add_all_algorithms ();
        OpenSSL_add_all_digests ();
        OpenSSL_add_all_ciphers ();
+       SSL_library_init ();
+       SSL_load_error_strings ();
+
+       if (RAND_poll () == 0) {
+               guchar seed[128];
+
+               /* Try to use ottery to seed rand */
+               ottery_rand_bytes (seed, sizeof (seed));
+               RAND_seed (seed, sizeof (seed));
+               rspamd_explicit_memzero (seed, sizeof (seed));
+       }
+
+       ctx->ssl_ctx = SSL_CTX_new (SSLv23_method ());
+       SSL_CTX_set_verify (ctx->ssl_ctx, SSL_VERIFY_PEER, NULL);
+       SSL_CTX_set_verify_depth (ctx->ssl_ctx, 4);
+       SSL_CTX_set_options(ctx->ssl_ctx, SSL_OP_NO_SSLv2|SSL_OP_NO_SSLv3|SSL_OP_NO_COMPRESSION);
+       /* Default settings */
+       SSL_CTX_set_cipher_list (ctx->ssl_ctx, secure_ciphers);
 #endif
        g_random_set_seed (ottery_rand_uint32 ());
 
@@ -2067,6 +2087,7 @@ rspamd_deinit_libs (struct rspamd_external_libs_ctx *ctx)
 #ifdef HAVE_OPENSSL
                EVP_cleanup ();
                ERR_free_strings ();
+               SSL_CTX_free (ctx->ssl_ctx);
 #endif
                rspamd_inet_library_destroy ();
        }

diff --git a/src/rspamd.h b/src/rspamd.h
index c0c60185d9681bae3f7016872d8b81ecb7745b5e..6a24370aa25e56522cd57d4df90020b7d0ee8e44 100644 (file)
--- a/src/rspamd.h
+++ b/src/rspamd.h
@@ -19,6 +19,7 @@
 #include "libserver/events.h"
 #include "libserver/roll_history.h"
 #include "libserver/task.h"
+#include <openssl/ssl.h>
 #include <magic.h>
 
 
@@ -295,6 +296,7 @@ struct rspamd_external_libs_ctx {
        void **local_addrs;
        struct rspamd_cryptobox_library_ctx *crypto_ctx;
        struct ottery_config *ottery_cfg;
+       SSL_CTX *ssl_ctx;
        ref_entry_t ref;
 };