1 /* $NetBSD: tls_level.c,v 1.2 2017/02/14 01:16:48 christos Exp $ */ 2 3 /*++ 4 /* NAME 5 /* tls_level 3 6 /* SUMMARY 7 /* TLS security level conversion 8 /* SYNOPSIS 9 /* #include <tls.h> 10 /* 11 /* int tls_level_lookup(name) 12 /* const char *name; 13 /* 14 /* const char *str_tls_level(level) 15 /* int level; 16 /* DESCRIPTION 17 /* The functions in this module convert TLS levels from symbolic 18 /* name to internal form and vice versa. 19 /* 20 /* tls_level_lookup() converts a TLS level from symbolic name 21 /* to internal form. When an unknown level is specified, 22 /* tls_level_lookup() logs no warning, and returns TLS_LEV_INVALID. 23 /* 24 /* str_tls_level() converts a TLS level from internal form to 25 /* symbolic name. The result is a null pointer for an unknown 26 /* level. The "halfdane" level is not a valid user-selected TLS level, 27 /* it is generated internally and is only valid output for the 28 /* str_tls_level() function. 29 /* SEE ALSO 30 /* name_code(3) name to number mapping 31 /* LICENSE 32 /* .ad 33 /* .fi 34 /* The Secure Mailer license must be distributed with this software. 35 /* AUTHOR(S) 36 /* Wietse Venema 37 /* IBM T.J. Watson Research 38 /* P.O. Box 704 39 /* Yorktown Heights, NY 10598, USA 40 /* 41 /* Victor Duchovni 42 /* Morgan Stanley 43 /*--*/ 44 45 /* System library. */ 46 47 #include <sys_defs.h> 48 49 /* Utility library. */ 50 51 #include <name_code.h> 52 53 /* TLS library. */ 54 55 #include <tls.h> 56 57 /* Application-specific. */ 58 59 /* 60 * Numerical order of levels is critical (see tls.h): 61 * 62 * - With "may" and higher, TLS is enabled. 63 * 64 * - With "encrypt" and higher, TLS is required. 65 * 66 * - With "fingerprint" and higher, the peer certificate must match. 67 * 68 * - With "dane" and higher, the peer certificate must also be trusted, 69 * possibly via TLSA RRs that make it its own authority. 70 * 71 * The smtp(8) client will report trust failure in preference to reporting 72 * failure to match, so we make "dane" larger than "fingerprint". 73 */ 74 static const NAME_CODE tls_level_table[] = { 75 "none", TLS_LEV_NONE, 76 "may", TLS_LEV_MAY, 77 "encrypt", TLS_LEV_ENCRYPT, 78 "fingerprint", TLS_LEV_FPRINT, 79 "halfdane", TLS_LEV_HALF_DANE, /* output only */ 80 "dane", TLS_LEV_DANE, 81 "dane-only", TLS_LEV_DANE_ONLY, 82 "verify", TLS_LEV_VERIFY, 83 "secure", TLS_LEV_SECURE, 84 0, TLS_LEV_INVALID, 85 }; 86 87 int tls_level_lookup(const char *name) 88 { 89 int level = name_code(tls_level_table, NAME_CODE_FLAG_NONE, name); 90 91 return ((level != TLS_LEV_HALF_DANE) ? level : TLS_LEV_INVALID); 92 } 93 94 const char *str_tls_level(int level) 95 { 96 return (str_name_code(tls_level_table, level)); 97 } 98