From 7be5e389cf0b2f94e80f06a6deddec7c612075f3 Mon Sep 17 00:00:00 2001 From: Sam Varshavchik Date: Thu, 28 Jun 2018 07:13:10 -0400 Subject: couriertls: add -user option --- tcpd/couriertls.sgml | 74 +++++++++++++++++++++++++++++++--------------------- tcpd/starttls.c | 17 ++++++++---- 2 files changed, 56 insertions(+), 35 deletions(-) (limited to 'tcpd') diff --git a/tcpd/couriertls.sgml b/tcpd/couriertls.sgml index 63e5e40..a7a8e72 100644 --- a/tcpd/couriertls.sgml +++ b/tcpd/couriertls.sgml @@ -1,5 +1,5 @@ - + SamVarshavchikAuthorCourier Mail Server @@ -12,13 +12,13 @@ couriertls - the Courier mail server + the Courier mail server TLS/SSL protocol wrapper - couriertls + couriertls option program arg @@ -29,16 +29,16 @@ TLS/SSL protocol wrapper DESCRIPTION -The couriertls program is used by applications to encrypt a +The couriertls program is used by applications to encrypt a network connection using SSL/TLS, without having the application deal with the -gory details of SSL/TLS. couriertls is used by the -Courier mail server +gory details of SSL/TLS. couriertls is used by the +Courier mail server IMAP and ESMTP servers. -couriertls is not usually run directly from the commandline. +couriertls is not usually run directly from the commandline. An application typically creates a network connection, then runs -couriertls with appropriate options to encrypt the network +couriertls with appropriate options to encrypt the network connection with SSL/TLS. @@ -52,7 +52,7 @@ connection with SSL/TLS. These options are used instead of , mostly for debugging purposes. -couriertls connects to the specified server and immediately +couriertls connects to the specified server and immediately starts SSL/TLS negotation when the connection is established. @@ -76,7 +76,7 @@ If SSL starts succesfully, reading on n gets an immediate EOF. Otherwise, a single line of text - the error message - is read; the file descriptor is -closed; and couriertls terminates. +closed; and couriertls terminates. @@ -87,7 +87,7 @@ closed; and couriertls terminates. Print the x509 certificate on file descriptor n then close it. The x509 certificate is printed before SSL/TLS encryption starts. The application may immediately read the -certificate after running couriertls, until the file +certificate after running couriertls, until the file descriptor is closed. @@ -115,14 +115,25 @@ negotiated. -tcpd -couriertls is being called from -couriertcpd, and the remote socket is present on descriptors +couriertls is being called from +couriertcpd, and the remote socket is present on descriptors 0 and 1. means, basically, the same as -, but couriertls closes file +, but couriertls closes file descriptor 1, and redirects file descriptor 1 to file descriptor 2. + + -user=username + + + Used when + couriertls needs to get started as root + and fork off a root child process (see below), before dropping + root and running as the specified user. + + + -verify=domain @@ -131,7 +142,7 @@ Verify that domain is set in the CN field of the trusted X.509 certificate presented by the SSL/TLS peer. TLS_TRUSTCERTS must be initialized (see below), and the certificate must be signed by one of the trusted certificates. The CN field can -contain a wildcard: CN=*.example will match +contain a wildcard: CN=*.example will match . For SSL/TLS clients, TLS_VERIFYPEER must be set to PEER (see below). @@ -144,7 +155,7 @@ SSL/TLS clients, Send proto protocol commands before enabling SSL/TLS on the remote connection. proto is -either "smtp" or "imap". +either "smtp" or "imap". This is a debugging option that can be used to troubleshoot SSL/TLS with a remote IMAP or SMTP server. @@ -156,8 +167,11 @@ If the option is not specified, the rest of the command line specifies the program to run -- and its arguments -- whose standard input and output is encrypted via SSL/TLS over the network -connection. If the program is not specified, the standard input and output of -couriertls itself is encrypted. +connection. +This is done before the option drops root and +couriertls continues to run as the indicated user. +If the program is not specified, the standard input and output of +couriertls itself is encrypted. @@ -165,7 +179,7 @@ connection. If the program is not specified, the standard input and output of ENVIRONMENT VARIABLES -couriertls reads the following environment variables in +couriertls reads the following environment variables in order to configure the SSL/TLS protocol: @@ -174,8 +188,8 @@ order to configure the SSL/TLS protocol: Set the protocol version. The possible versions are: -SSL2, SSL3, -TLS1. +SSL2, SSL3, +TLS1. @@ -231,11 +245,11 @@ can be a file or a directory. If a file, the file should contain a list of trusted certificates, in PEM format. If a directory, the directory should contain the trusted certificates, in PEM format, one per file and hashed using OpenSSL's -c_rehash script. TLS_TRUSTCERTS is used by +c_rehash script. TLS_TRUSTCERTS is used by SSL/TLS clients (by specifying the option) and by SSL/TLS servers -(TLS_VERIFYPEER is set to PEER or -REQUIREPEER). +(TLS_VERIFYPEER is set to PEER or +REQUIREPEER). @@ -245,18 +259,18 @@ specifying the option) and by SSL/TLS servers Whether to verify peer's X.509 certificate. The exact meaning of this option depends upon whether -couriertls is used in the client or server mode. +couriertls is used in the client or server mode. In server mode: -NONE - do not request an X.509 certificate from the client; -PEER - request an optional X.509 certificate from the +NONE - do not request an X.509 certificate from the client; +PEER - request an optional X.509 certificate from the client, if the client returns one, the SSL/TLS connection is shut down unless the certificate is signed by a trusted certificate authority (see TLS_TRUSTCERTS); -REQUIREPEER - same as +REQUIREPEER - same as PEER, except that the SSL/TLS connects is also shut down if the client does not return the optional X.509 certificate. In client mode: -NONE - ignore the server's X.509 certificate; -PEER - verify the server's +NONE - ignore the server's X.509 certificate; +PEER - verify the server's X.509 certificate according to the option, (see above). diff --git a/tcpd/starttls.c b/tcpd/starttls.c index 23c4a69..cb3bd2c 100644 --- a/tcpd/starttls.c +++ b/tcpd/starttls.c @@ -10,6 +10,8 @@ #include "tlscache.h" #include "rfc1035/rfc1035.h" #include "soxwrap/soxwrap.h" +#include "numlib/numlib.h" + #ifdef getc #undef getc #endif @@ -74,6 +76,7 @@ const char *statusfd=0; const char *tcpd=0; const char *peer_verify_domain=0; const char *fdprotocol=0; +const char *username=0; static FILE *errfp; static FILE *statusfp; @@ -536,6 +539,14 @@ static int dossl(int fd, int argn, int argc, char **argv) info.connect_callback= &verify_connection; info.app_data=NULL; + stdin_fd=0; + stdout_fd=1; + + startclient(argn, argc, argv, fd, &stdin_fd, &stdout_fd); + + if (username) + libmail_changeusername(username, 0); + ctx=tls_create(server ? 1:0, &info); if (ctx == 0) return (1); @@ -555,11 +566,6 @@ static int dossl(int fd, int argn, int argc, char **argv) return 1; } - stdin_fd=0; - stdout_fd=1; - - startclient(argn, argc, argv, fd, &stdin_fd, &stdout_fd); - docopy(ssl, fd, stdin_fd, stdout_fd); tls_disconnect(ssl, fd); @@ -778,6 +784,7 @@ static struct args arginfo[] = { { "verify", &peer_verify_domain}, { "statusfd", &statusfd}, { "protocol", &fdprotocol}, + { "user", &username}, {0}}; void (*protocol_func)(int)=0; -- cgit v1.2.3