* Enable/disable encryption in client from command line and/or citadel.rc

diff --git a/citadel/ChangeLog b/citadel/ChangeLog
index 38dd4bab9817651127bc5b13e498535f941dc220..90248fafc51d34c31142c15589971cd6c33f6a8f 100644 (file)
--- a/citadel/ChangeLog
+++ b/citadel/ChangeLog
@@ -1,4 +1,7 @@
  $Log$
+ Revision 590.47  2002/01/06 22:44:21  error
+ * Enable/disable encryption in client from command line and/or citadel.rc
+
  Revision 590.46  2002/01/06 21:25:26  ajc
  * sysdep.c: in client_write(), handle redirect_fp and redirect_sock *before*
    handling redirect_ssl, because these need to be done the same way regardless
@@ -3105,3 +3108,4 @@ Sat Jul 11 00:20:48 EDT 1998 Nathan Bryant <bryant@cs.usm.maine.edu>
 
 Fri Jul 10 1998 Art Cancro <ajc@uncensored.citadel.org>
        * Initial CVS import 
+

diff --git a/citadel/citadel.c b/citadel/citadel.c
index 6eb959a2f4b43dad038404a305ff418604550a52..6845b46123fc7c470013f3833f3d9a430da0a5d6 100644 (file)
--- a/citadel/citadel.c
+++ b/citadel/citadel.c
@@ -884,7 +884,7 @@ int main(int argc, char **argv)
        char hexstring[MD5_HEXSTRING_SIZE];
        int stored_password = 0;
        char password[SIZ];
-
+       
        /* Permissions sanity check - don't run citadel setuid/setgid */
        if (getuid() != geteuid()) {
                fprintf(stderr, "Please do not run citadel setuid!\n");
@@ -901,6 +901,8 @@ int main(int argc, char **argv)
        signal(SIGTERM, dropcarr);      /* Cleanup gracefully if terminated */
        signal(SIGCONT, catch_sigcont);         /* Catch SIGCONT so we can reset terminal */
 
+       arg_encrypt = RC_DEFAULT;
+
        /* 
         * Handle command line options as if we were called like /bin/login
         * (i.e. from in.telnetd)
@@ -910,6 +912,14 @@ int main(int argc, char **argv)
                        telnet_client_host = argv[a+1];
                        argc = shift(argc, argv, a, 2);
                }
+               if (!strcmp(argv[a], "-x")) {
+                       arg_encrypt = RC_NO;
+                       argc = shift(argc, argv, a, 1);
+               }
+               if (!strcmp(argv[a], "-X")) {
+                       arg_encrypt = RC_YES;
+                       argc = shift(argc, argv, a, 1);
+               }
                if (!strcmp(argv[a], "-p")) {
                        struct stat st;
                

diff --git a/citadel/citadel.rc b/citadel/citadel.rc
index 39bc559a45dbc5bc69a8267f0cb227a4d46fd711..dc3d6a06e66bfe4544b1f9b890fc08b06c22a2f7 100644 (file)
--- a/citadel/citadel.rc
+++ b/citadel/citadel.rc
@@ -9,6 +9,13 @@
 # 3. <compiled BBSDIR>/citadel.rc
 # 4. <current directory>/citadel.rc
 
+# Set ENCRYPT to yes to force SSL/TLS encryption when connecting to a
+# Citadel/UX server, even if the server is on the same machine as the
+# client.  Set it to no to disable SSL/TLS encryption.  The default is to
+# enable encryption for remote systems and to disable encryption for
+# systems on the same machine as the client.
+encrypt=default
+
 # Set EDITOR to the name of an external editor to be used for entering
 # messages.  If you want the external editor to be used by default, be sure
 # to reflect this in the command set below.

diff --git a/citadel/citadel_decls.h b/citadel/citadel_decls.h
index 9cbff442b64e8bb0eeb581a16908abd918ffc00c..e2b97bc67c817b7679d6bb8cdd5faa0938fb6944 100644 (file)
--- a/citadel/citadel_decls.h
+++ b/citadel/citadel_decls.h
@@ -13,6 +13,8 @@ extern char have_xterm;
 extern char rc_username[32];
 extern char rc_password[32];
 extern char rc_floor_mode;
+extern char rc_encrypt;                        /* from the citadel.rc file */
+extern char arg_encrypt;               /* from the command line */
 extern char express_msgs;
 void logoff(int code);
 void formout(char *name);

diff --git a/citadel/client_crypto.c b/citadel/client_crypto.c
index 0c173c1ed15dc5d7a1c841c72a647400fc11bd8f..5b1aba58396ebb5372833423b8b5090290a51963 100644 (file)
--- a/citadel/client_crypto.c
+++ b/citadel/client_crypto.c
@@ -18,6 +18,8 @@
 SSL *ssl;
 SSL_CTX *ssl_ctx;
 int ssl_is_connected = 0;
+char arg_encrypt;
+char rc_encrypt;
 #ifdef THREADED_CLIENT
 pthread_mutex_t **Critters;                    /* Things that need locking */
 #endif /* THREADED_CLIENT */
@@ -138,8 +140,14 @@ int starttls(void)
        SSL_METHOD *ssl_method;
        DH *dh;
        
-       /* TLS is pointless when server is local */
-       if (server_is_local) {
+       /* Figure out whether to encrypt the session based on user options */
+       /* User request to disable encryption */
+       if (arg_encrypt == RC_NO || rc_encrypt == RC_NO) {
+               return 0;
+       }
+       /* User expressed no preference */
+       else if (rc_encrypt == RC_DEFAULT && arg_encrypt == RC_DEFAULT &&
+                       server_is_local) {
                return 0;
        }
 

diff --git a/citadel/commands.c b/citadel/commands.c
index 9c7883fc7c6af4f6661b823e3acde1c3d45c7b6e..c56bdd6ba9f622c40f57481824f9e63c60836fc6 100644 (file)
--- a/citadel/commands.c
+++ b/citadel/commands.c
@@ -689,6 +689,7 @@ void load_command_set(void)
        rc_force_mail_prompts = 0;
        rc_ansi_color = 0;
        strcpy(rc_url_cmd, "");
+       rc_encrypt = RC_DEFAULT;
 
        /* now try to open the citadel.rc file */
 
@@ -715,6 +716,15 @@ void load_command_set(void)
                while ((strlen(buf) > 0) ? (isspace(buf[strlen(buf) - 1])) : 0)
                        buf[strlen(buf) - 1] = 0;
 
+               if (!strncasecmp(buf, "encrypt=", 8)) {
+                       if (!strcasecmp(&buf[8], "yes"))
+                               rc_encrypt = RC_YES;
+                       else if (!strcasecmp(&buf[8], "no"))
+                               rc_encrypt = RC_NO;
+                       else if (!strcasecmp(&buf[8], "default"))
+                               rc_encrypt = RC_DEFAULT;
+               }
+
                if (!strncasecmp(buf, "editor=", 7))
                        strcpy(editor_path, &buf[7]);