Skip to content

John McEleney / mailutils

Go to a project
Toggle navigation
Toggle navigation pinning
Commit 6ff197ca 6ff197ca52419567c123c4e9069e207ec55aadcb by Sergey Poznyakoff
Options

Log ciphersuite info after successful initiation of TLS connection 

* include/mailutils/stream.h (MU_IOCTL_TLSSTREAM): New ioctl code.
(MU_IOCTL_TLS_GET_CIPHER_INFO): New ioctl opcode.
* libmailutils/property/assocprop.c (_assoc_prop_fill)
(_assoc_prop_save): allow for NULL stream pointer.
* libmu_auth/tls.c (_tls_io_ioctl,_tls_ioctl): Handle
MU_IOCTL_TLSSTREAM/MU_IOCTL_TLS_GET_CIPHER_INFO ioctl.

* imap4d/io.c (log_cipher): New function.
(io_setio, imap4d_init_tls_server): Call log_cipher after successfully
establishing the TLS connection.
* imap4d/starttls.c (tls_encryption_on): Remove diagnostic output.
* pop3d/extra.c (log_cipher): New function.
(pop3d_setio,pop3d_init_tls_server): Call log_cipher after successfully
establishing the TLS connection.
1 parent 4d642922
Inline Side-by-side
Showing 6 changed files with 127 additions and 4 deletions
...@@ -16,9 +16,39 @@ ...@@ -16,9 +16,39 @@
16 along with GNU Mailutils. If not, see <http://www.gnu.org/licenses/>. */ 16 along with GNU Mailutils. If not, see <http://www.gnu.org/licenses/>. */
17 17
18 #include "imap4d.h" 18 #include "imap4d.h"
19 #include <mailutils/property.h>
19 20
20 mu_stream_t iostream; 21 mu_stream_t iostream;
21 22
23 static void
24 log_cipher (mu_stream_t stream)
25 {
26 mu_property_t prop;
27 int rc = mu_stream_ioctl (stream, MU_IOCTL_TLSSTREAM,
28 MU_IOCTL_TLS_GET_CIPHER_INFO, &prop);
29 if (rc)
30 {
31 mu_diag_output (MU_DIAG_INFO, _("TLS established"));
32 mu_diag_output (MU_DIAG_ERROR, _("can't get TLS details: %s"),
33 mu_strerror (rc));
34 }
35 else
36 {
37 char const *cipher, *mac, *proto;
38 if (mu_property_sget_value (prop, "cipher", &cipher))
39 cipher = "UNKNOWN";
40 if (mu_property_sget_value (prop, "mac", &mac))
41 mac = "UNKNOWN";
42 if (mu_property_sget_value (prop, "protocol", &proto))
43 proto = "UNKNOWN";
44
45 mu_diag_output (MU_DIAG_INFO, _("TLS established using %s-%s (%s)"),
46 cipher, mac, proto);
47
48 mu_property_destroy (&prop);
49 }
50 }
51
22 void 52 void
23 io_setio (int ifd, int ofd, int tls) 53 io_setio (int ifd, int ofd, int tls)
24 { 54 {
...@@ -49,6 +79,7 @@ io_setio (int ifd, int ofd, int tls) ...@@ -49,6 +79,7 @@ io_setio (int ifd, int ofd, int tls)
49 mu_error (_("failed to create TLS stream: %s"), mu_strerror (rc)); 79 mu_error (_("failed to create TLS stream: %s"), mu_strerror (rc));
50 imap4d_bye (ERR_STREAM_CREATE); 80 imap4d_bye (ERR_STREAM_CREATE);
51 } 81 }
82 log_cipher (str);
52 } 83 }
53 else 84 else
54 #endif 85 #endif
...@@ -112,6 +143,8 @@ imap4d_init_tls_server () ...@@ -112,6 +143,8 @@ imap4d_init_tls_server ()
112 return 1; 143 return 1;
113 } 144 }
114 145
146 log_cipher (tlsstream);
147
115 mu_stream_unref (stream[0]); 148 mu_stream_unref (stream[0]);
116 mu_stream_unref (stream[1]); 149 mu_stream_unref (stream[1]);
117 stream[0] = stream[1] = tlsstream; 150 stream[0] = stream[1] = tlsstream;
......
...@@ -71,7 +71,6 @@ tls_encryption_on (struct imap4d_session *session) ...@@ -71,7 +71,6 @@ tls_encryption_on (struct imap4d_session *session)
71 71
72 session->tls_mode = tls_no; 72 session->tls_mode = tls_no;
73 imap4d_capability_remove (IMAP_CAPA_XTLSREQUIRED); 73 imap4d_capability_remove (IMAP_CAPA_XTLSREQUIRED);
74 mu_diag_output (MU_DIAG_INFO, _("TLS established"));
75 } 74 }
76 75
77 void 76 void
......
...@@ -77,6 +77,7 @@ enum mu_buffer_type ...@@ -77,6 +77,7 @@ enum mu_buffer_type
77 #define MU_IOCTL_TOPSTREAM 12 /* Same as MU_IOCTL_SUBSTREAM, but 77 #define MU_IOCTL_TOPSTREAM 12 /* Same as MU_IOCTL_SUBSTREAM, but
78 always returns the topmost substream. 78 always returns the topmost substream.
79 */ 79 */
80 #define MU_IOCTL_TLSSTREAM 13 /* TLS stream */
80 81
81 /* Opcodes common for various families */ 82 /* Opcodes common for various families */
82 #define MU_IOCTL_OP_GET 0 83 #define MU_IOCTL_OP_GET 0
...@@ -193,6 +194,13 @@ enum mu_buffer_type ...@@ -193,6 +194,13 @@ enum mu_buffer_type
193 #define MU_IOCTL_FILTER_GET_DISABLED 0 194 #define MU_IOCTL_FILTER_GET_DISABLED 0
194 #define MU_IOCTL_FILTER_SET_DISABLED 1 195 #define MU_IOCTL_FILTER_SET_DISABLED 1
195 196
197 /* TLS transport streams */
198 /* Get cipher info.
199 Arg: mu_property_t *
200 On success, the following keys are defined: "protocol", "cipher", "mac"
201 */
202 #define MU_IOCTL_TLS_GET_CIPHER_INFO 0
203
196 #define MU_TRANSPORT_INPUT 0 204 #define MU_TRANSPORT_INPUT 0
197 #define MU_TRANSPORT_OUTPUT 1 205 #define MU_TRANSPORT_OUTPUT 1
198 #define MU_TRANSPORT_VALID_TYPE(n) \ 206 #define MU_TRANSPORT_VALID_TYPE(n) \
......
...@@ -145,7 +145,7 @@ _assoc_prop_fill (struct _mu_property *prop) ...@@ -145,7 +145,7 @@ _assoc_prop_fill (struct _mu_property *prop)
145 size_t size[2] = { 0, 0 }, n; 145 size_t size[2] = { 0, 0 }, n;
146 146
147 if (!str) 147 if (!str)
148 return EINVAL; 148 return 0;
149 mu_stream_seek (str, 0, MU_SEEK_SET, NULL); 149 mu_stream_seek (str, 0, MU_SEEK_SET, NULL);
150 while ((rc = mu_stream_getdelim (str, &buf[state], &size[state], 150 while ((rc = mu_stream_getdelim (str, &buf[state], &size[state],
151 0, &n)) == 0 && 151 0, &n)) == 0 &&
...@@ -169,7 +169,7 @@ _assoc_prop_save (struct _mu_property *prop) ...@@ -169,7 +169,7 @@ _assoc_prop_save (struct _mu_property *prop)
169 mu_off_t off; 169 mu_off_t off;
170 170
171 if (!str) 171 if (!str)
172 return EINVAL; 172 return 0;
173 rc = mu_property_get_iterator (prop, &itr); 173 rc = mu_property_get_iterator (prop, &itr);
174 if (rc) 174 if (rc)
175 return rc; 175 return rc;
......
...@@ -34,6 +34,7 @@ ...@@ -34,6 +34,7 @@
34 #include <mailutils/stream.h> 34 #include <mailutils/stream.h>
35 #include <mailutils/errno.h> 35 #include <mailutils/errno.h>
36 #include <mailutils/util.h> 36 #include <mailutils/util.h>
37 #include <mailutils/property.h>
37 38
38 struct mu_tls_module_config mu_tls_module_config = { 39 struct mu_tls_module_config mu_tls_module_config = {
39 #ifdef WITH_TLS 40 #ifdef WITH_TLS
...@@ -295,6 +296,34 @@ _tls_wr_wait (struct _mu_stream *stream, int *pflags, struct timeval *tvp) ...@@ -295,6 +296,34 @@ _tls_wr_wait (struct _mu_stream *stream, int *pflags, struct timeval *tvp)
295 } 296 }
296 297
297 static int 298 static int
299 get_cipher_info (gnutls_session_t session, mu_property_t *pprop)
300 {
301 mu_property_t prop;
302 const char *s;
303 int rc;
304
305 if (!pprop)
306 return EINVAL;
307
308 rc = mu_property_create_init (&prop, mu_assoc_property_init, NULL);
309 if (rc)
310 return rc;
311
312 s = gnutls_protocol_get_name (gnutls_protocol_get_version (session));
313 mu_property_set_value (prop, "protocol", s, 1);
314
315 s = gnutls_cipher_get_name (gnutls_cipher_get (session));
316 mu_property_set_value (prop, "cipher", s, 1);
317
318 s = gnutls_mac_get_name (gnutls_mac_get (session));
319 mu_property_set_value (prop, "mac", s, 1);
320
321 *pprop = prop;
322
323 return 0;
324 }
325
326 static int
298 _tls_io_ioctl (struct _mu_stream *stream, int code, int opcode, void *arg) 327 _tls_io_ioctl (struct _mu_stream *stream, int code, int opcode, void *arg)
299 { 328 {
300 struct _mu_tls_io_stream *sp = (struct _mu_tls_io_stream *) stream; 329 struct _mu_tls_io_stream *sp = (struct _mu_tls_io_stream *) stream;
...@@ -323,6 +352,17 @@ _tls_io_ioctl (struct _mu_stream *stream, int code, int opcode, void *arg) ...@@ -323,6 +352,17 @@ _tls_io_ioctl (struct _mu_stream *stream, int code, int opcode, void *arg)
323 } 352 }
324 break; 353 break;
325 354
355 case MU_IOCTL_TLSSTREAM:
356 switch (opcode)
357 {
358 case MU_IOCTL_TLS_GET_CIPHER_INFO:
359 return get_cipher_info (sp->up->session, arg);
360
361 default:
362 return EINVAL;
363 }
364 break;
365
326 default: 366 default:
327 return ENOSYS; 367 return ENOSYS;
328 } 368 }
...@@ -586,6 +626,17 @@ _tls_ioctl (struct _mu_stream *stream, int code, int opcode, void *arg) ...@@ -586,6 +626,17 @@ _tls_ioctl (struct _mu_stream *stream, int code, int opcode, void *arg)
586 } 626 }
587 break; 627 break;
588 628
629 case MU_IOCTL_TLSSTREAM:
630 switch (opcode)
631 {
632 case MU_IOCTL_TLS_GET_CIPHER_INFO:
633 return get_cipher_info (sp->session, arg);
634
635 default:
636 return EINVAL;
637 }
638 break;
639
589 default: 640 default:
590 return ENOSYS; 641 return ENOSYS;
591 } 642 }
......
...@@ -17,6 +17,7 @@ ...@@ -17,6 +17,7 @@
17 17
18 #include "pop3d.h" 18 #include "pop3d.h"
19 #include "mailutils/libargp.h" 19 #include "mailutils/libargp.h"
20 #include "mailutils/property.h"
20 21
21 mu_stream_t iostream; 22 mu_stream_t iostream;
22 23
...@@ -128,6 +129,35 @@ pop3d_abquit (int reason) ...@@ -128,6 +129,35 @@ pop3d_abquit (int reason)
128 exit (code); 129 exit (code);
129 } 130 }
130 131
132 static void
133 log_cipher (mu_stream_t stream)
134 {
135 mu_property_t prop;
136 int rc = mu_stream_ioctl (stream, MU_IOCTL_TLSSTREAM,
137 MU_IOCTL_TLS_GET_CIPHER_INFO, &prop);
138 if (rc)
139 {
140 mu_diag_output (MU_DIAG_INFO, _("TLS established"));
141 mu_diag_output (MU_DIAG_ERROR, _("can't get TLS details: %s"),
142 mu_strerror (rc));
143 }
144 else
145 {
146 char const *cipher, *mac, *proto;
147 if (mu_property_sget_value (prop, "cipher", &cipher))
148 cipher = "UNKNOWN";
149 if (mu_property_sget_value (prop, "mac", &mac))
150 mac = "UNKNOWN";
151 if (mu_property_sget_value (prop, "protocol", &proto))
152 proto = "UNKNOWN";
153
154 mu_diag_output (MU_DIAG_INFO, _("TLS established using %s-%s (%s)"),
155 cipher, mac, proto);
156
157 mu_property_destroy (&prop);
158 }
159 }
160
131 void 161 void
132 pop3d_setio (int ifd, int ofd, int tls) 162 pop3d_setio (int ifd, int ofd, int tls)
133 { 163 {
...@@ -158,7 +188,7 @@ pop3d_setio (int ifd, int ofd, int tls) ...@@ -158,7 +188,7 @@ pop3d_setio (int ifd, int ofd, int tls)
158 pop3d_abquit (ERR_FILE); 188 pop3d_abquit (ERR_FILE);
159 } 189 }
160 tls_done = 1; 190 tls_done = 1;
161 mu_diag_output (MU_DIAG_INFO, _("TLS established")); 191 log_cipher (str);
162 } 192 }
163 else 193 else
164 #endif 194 #endif
...@@ -220,6 +250,8 @@ pop3d_init_tls_server () ...@@ -220,6 +250,8 @@ pop3d_init_tls_server ()
220 if (rc) 250 if (rc)
221 return 1; 251 return 1;
222 252
253 log_cipher (tlsstream);
254
223 stream[0] = stream[1] = tlsstream; 255 stream[0] = stream[1] = tlsstream;
224 rc = mu_stream_ioctl (iostream, MU_IOCTL_SUBSTREAM, MU_IOCTL_OP_SET, stream); 256 rc = mu_stream_ioctl (iostream, MU_IOCTL_SUBSTREAM, MU_IOCTL_OP_SET, stream);
225 mu_stream_unref (stream[0]); 257 mu_stream_unref (stream[0]);
......