|
 |
682f57 |
New settings:
|
|
|
682f57 |
|
|
|
682f57 |
tls_prefer_server_ciphers: 0
|
|
|
682f57 |
|
|
|
682f57 |
Prefer the cipher order configured on the server-side.
|
|
|
682f57 |
|
|
|
682f57 |
tls_versions: ssl2 ssl3 tls1_0 tls1_1 tls1_2
|
|
|
682f57 |
|
|
|
682f57 |
Disable SSL/TLS protocols not in this list.
|
|
|
682f57 |
|
|
|
682f57 |
diff --git a/imap/tls.c b/imap/tls.c
|
|
|
682f57 |
index b2cf666..5a626e2 100644
|
|
|
682f57 |
--- a/imap/tls.c
|
|
|
682f57 |
+++ b/imap/tls.c
|
|
|
682f57 |
@@ -632,6 +632,7 @@ int tls_init_serverengine(const char *ident,
|
|
|
682f57 |
const char *s_cert_file;
|
|
|
682f57 |
const char *s_key_file;
|
|
|
682f57 |
int requirecert;
|
|
|
682f57 |
+ int server_cipher_order;
|
|
|
682f57 |
int timeout;
|
|
|
682f57 |
|
|
|
682f57 |
if (tls_serverengine)
|
|
|
682f57 |
@@ -663,10 +657,40 @@ int tls_init_serverengine(const char *ident,
|
|
|
682f57 |
};
|
|
|
682f57 |
|
|
|
682f57 |
off |= SSL_OP_ALL; /* Work around all known bugs */
|
|
|
682f57 |
- if (tlsonly) {
|
|
|
682f57 |
- off |= SSL_OP_NO_SSLv2;
|
|
|
682f57 |
- off |= SSL_OP_NO_SSLv3;
|
|
|
682f57 |
+
|
|
|
682f57 |
+ const char *tls_versions = config_getstring(IMAPOPT_TLS_VERSIONS);
|
|
|
682f57 |
+
|
|
|
682f57 |
+ if (strstr(tls_versions, "ssl2") == NULL || tlsonly) {
|
|
|
682f57 |
+ off |= SSL_OP_NO_SSLv2;
|
|
|
682f57 |
+ }
|
|
|
682f57 |
+
|
|
|
682f57 |
+ if (strstr(tls_versions, "ssl3") == NULL || tlsonly) {
|
|
|
682f57 |
+ off |= SSL_OP_NO_SSLv3;
|
|
|
682f57 |
+ }
|
|
|
682f57 |
+
|
|
|
682f57 |
+ if (strstr(tls_versions, "tls1_2") == NULL) {
|
|
|
682f57 |
+#if (OPENSSL_VERSION_NUMBER >= 0x1000105fL)
|
|
|
682f57 |
+ off |= SSL_OP_NO_TLSv1_2;
|
|
|
682f57 |
+#else
|
|
|
682f57 |
+ syslog(LOG_ERR, "ERROR: TLSv1.2 configured, OpenSSL < 1.0.1e insufficient");
|
|
|
682f57 |
+#endif
|
|
|
682f57 |
}
|
|
|
682f57 |
+
|
|
|
682f57 |
+ if (strstr(tls_versions, "tls1_1") == NULL) {
|
|
|
682f57 |
+#if (OPENSSL_VERSION_NUMBER >= 0x1000000fL)
|
|
|
682f57 |
+ off |= SSL_OP_NO_TLSv1_1;
|
|
|
682f57 |
+#else
|
|
|
682f57 |
+ syslog(LOG_ERR, "ERROR: TLSv1.1 configured, OpenSSL < 1.0.0 insufficient");
|
|
|
682f57 |
+#endif
|
|
|
682f57 |
+ }
|
|
|
682f57 |
+ if (strstr(tls_versions, "tls1_0") == NULL) {
|
|
|
682f57 |
+ off |= SSL_OP_NO_TLSv1;
|
|
|
682f57 |
+ }
|
|
|
682f57 |
+
|
|
|
682f57 |
+ server_cipher_order = config_getswitch(IMAPOPT_TLS_PREFER_SERVER_CIPHERS);
|
|
|
682f57 |
+ if (server_cipher_order)
|
|
|
682f57 |
+ off |= SSL_OP_CIPHER_SERVER_PREFERENCE;
|
|
|
682f57 |
+
|
|
|
682f57 |
SSL_CTX_set_options(s_ctx, off);
|
|
|
682f57 |
SSL_CTX_set_info_callback(s_ctx, (void (*)()) apps_ssl_info_callback);
|
|
|
682f57 |
|
|
|
682f57 |
@@ -1196,7 +1220,7 @@ int tls_init_clientengine(int verifydepth,
|
|
|
682f57 |
return -1;
|
|
|
682f57 |
}
|
|
|
682f57 |
|
|
|
682f57 |
- c_ctx = SSL_CTX_new(TLSv1_client_method());
|
|
|
682f57 |
+ c_ctx = SSL_CTX_new(SSLv23_client_method());
|
|
|
682f57 |
if (c_ctx == NULL) {
|
|
|
682f57 |
return (-1);
|
|
|
682f57 |
};
|
|
|
682f57 |
diff --git a/imtest/imtest.c b/imtest/imtest.c
|
|
|
682f57 |
index 01ac72c..50d115d 100644
|
|
|
682f57 |
--- a/imtest/imtest.c
|
|
|
682f57 |
+++ b/imtest/imtest.c
|
|
|
682f57 |
@@ -510,7 +510,7 @@ static int tls_init_clientengine(int verifydepth, char *var_tls_cert_file, char
|
|
|
682f57 |
return IMTEST_FAIL;
|
|
|
682f57 |
}
|
|
|
682f57 |
|
|
|
682f57 |
- tls_ctx = SSL_CTX_new(TLSv1_client_method());
|
|
|
682f57 |
+ tls_ctx = SSL_CTX_new(SSLv23_client_method());
|
|
|
682f57 |
if (tls_ctx == NULL) {
|
|
|
682f57 |
return IMTEST_FAIL;
|
|
|
682f57 |
};
|
|
|
682f57 |
Index: cyrus-imapd-2.3.16/lib/imapoptions
|
|
|
682f57 |
===================================================================
|
|
|
682f57 |
--- cyrus-imapd-2.3.16.orig/lib/imapoptions
|
|
|
682f57 |
+++ cyrus-imapd-2.3.16/lib/imapoptions
|
|
|
682f57 |
@@ -1288,6 +1288,15 @@ product version in the capabilities */
|
|
|
682f57 |
the special use flag "\Drafts" added. Later versions of Cyrus
|
|
|
682f57 |
have a much more flexible RFC 6154 compatible system. */
|
|
|
682f57 |
|
|
|
682f57 |
+{ "tls_prefer_server_ciphers", 0, SWITCH }
|
|
|
682f57 |
+/* Prefer the ciphers on the server side instead of client side */
|
|
|
682f57 |
+
|
|
|
682f57 |
+{ "tls_versions", "ssl2 ssl3 tls1_0 tls1_1 tls1_2", STRING }
|
|
|
682f57 |
+/* A list of SSL/TLS versions to not disable. Cyrus IMAP SSL/TLS starts
|
|
|
682f57 |
+ with all protocols, and substracts protocols not in this list. Newer
|
|
|
682f57 |
+ versions of SSL/TLS will need to be added here to allow them to get
|
|
|
682f57 |
+ disabled. */
|
|
|
682f57 |
+
|
|
|
682f57 |
/*
|
|
|
682f57 |
.SH SEE ALSO
|
|
|
682f57 |
.PP
|