src/src/tls-openssl.c

   1 /*************************************************
   2 *     Exim - an Internet mail transport agent    *
   3 *************************************************/
   4
   5 /* Copyright (c) University of Cambridge 1995 - 2014 */
   6 /* See the file NOTICE for conditions of use and distribution. */
   7
   8 /* Portions Copyright (c) The OpenSSL Project 1999 */
   9
  10 /* This module provides the TLS (aka SSL) support for Exim using the OpenSSL
  11 library. It is #included into the tls.c file when that library is used. The
  12 code herein is based on a patch that was originally contributed by Steve
  13 Haslam. It was adapted from stunnel, a GPL program by Michal Trojnara.
  14
  15 No cryptographic code is included in Exim. All this module does is to call
  16 functions from the OpenSSL library. */
  17
  18
  19 /* Heading stuff */
  20
  21 #include <openssl/lhash.h>
  22 #include <openssl/ssl.h>
  23 #include <openssl/err.h>
  24 #include <openssl/rand.h>
  25 #ifndef DISABLE_OCSP
  26 # include <openssl/ocsp.h>
  27 #endif
  28 #ifdef EXPERIMENTAL_DANE
  29 # include <danessl.h>
  30 #endif
  31
  32
  33 #ifndef DISABLE_OCSP
  34 # define EXIM_OCSP_SKEW_SECONDS (300L)
  35 # define EXIM_OCSP_MAX_AGE (-1L)
  36 #endif
  37
  38 #if OPENSSL_VERSION_NUMBER >= 0x0090806fL && !defined(OPENSSL_NO_TLSEXT)
  39 # define EXIM_HAVE_OPENSSL_TLSEXT
  40 #endif
  41 #if OPENSSL_VERSION_NUMBER >= 0x010100000L
  42 # define EXIM_HAVE_OPENSSL_CHECKHOST
  43 #endif
  44 #if OPENSSL_VERSION_NUMBER >= 0x010000000L \
  45     && (OPENSSL_VERSION_NUMBER & 0x0000ff000L) >= 0x000002000L
  46 # define EXIM_HAVE_OPENSSL_CHECKHOST
  47 #endif
  48
  49 #if !defined(EXIM_HAVE_OPENSSL_TLSEXT) && !defined(DISABLE_OCSP)
  50 # warning "OpenSSL library version too old; define DISABLE_OCSP in Makefile"
  51 # define DISABLE_OCSP
  52 #endif
  53
  54 /* Structure for collecting random data for seeding. */
  55
  56 typedef struct randstuff {
  57   struct timeval tv;
  58   pid_t          p;
  59 } randstuff;
  60
  61 /* Local static variables */
  62
  63 static BOOL client_verify_callback_called = FALSE;
  64 static BOOL server_verify_callback_called = FALSE;
  65 static const uschar *sid_ctx = US"exim";
  66
  67 /* We have three different contexts to care about.
  68
  69 Simple case: client, `client_ctx`
  70  As a client, we can be doing a callout or cut-through delivery while receiving
  71  a message.  So we have a client context, which should have options initialised
  72  from the SMTP Transport.
  73
  74 Server:
  75  There are two cases: with and without ServerNameIndication from the client.
  76  Given TLS SNI, we can be using different keys, certs and various other
  77  configuration settings, because they're re-expanded with $tls_sni set.  This
  78  allows vhosting with TLS.  This SNI is sent in the handshake.
  79  A client might not send SNI, so we need a fallback, and an initial setup too.
  80  So as a server, we start out using `server_ctx`.
  81  If SNI is sent by the client, then we as server, mid-negotiation, try to clone
  82  `server_sni` from `server_ctx` and then initialise settings by re-expanding
  83  configuration.
  84 */
  85
  86 static SSL_CTX *client_ctx = NULL;
  87 static SSL_CTX *server_ctx = NULL;
  88 static SSL     *client_ssl = NULL;
  89 static SSL     *server_ssl = NULL;
  90
  91 #ifdef EXIM_HAVE_OPENSSL_TLSEXT
  92 static SSL_CTX *server_sni = NULL;
  93 #endif
  94
  95 static char ssl_errstring[256];
  96
  97 static int  ssl_session_timeout = 200;
  98 static BOOL client_verify_optional = FALSE;
  99 static BOOL server_verify_optional = FALSE;
 100
 101 static BOOL reexpand_tls_files_for_sni = FALSE;
 102
 103
 104 typedef struct tls_ext_ctx_cb {
 105   uschar *certificate;
 106   uschar *privatekey;
 107 #ifndef DISABLE_OCSP
 108   BOOL is_server;
 109   union {
 110     struct {
 111       uschar        *file;
 112       uschar        *file_expanded;
 113       OCSP_RESPONSE *response;
 114     } server;
 115     struct {
 116       X509_STORE    *verify_store;      /* non-null if status requested */
 117       BOOL          verify_required;
 118     } client;
 119   } u_ocsp;
 120 #endif
 121   uschar *dhparam;
 122   /* these are cached from first expand */
 123   uschar *server_cipher_list;
 124   /* only passed down to tls_error: */
 125   host_item *host;
 126   const uschar * verify_cert_hostnames;
 127 #ifdef EXPERIMENTAL_EVENT
 128   uschar * event_action;
 129 #endif
 130 } tls_ext_ctx_cb;
 131
 132 /* should figure out a cleanup of API to handle state preserved per
 133 implementation, for various reasons, which can be void * in the APIs.
 134 For now, we hack around it. */
 135 tls_ext_ctx_cb *client_static_cbinfo = NULL;
 136 tls_ext_ctx_cb *server_static_cbinfo = NULL;
 137
 138 static int
 139 setup_certs(SSL_CTX *sctx, uschar *certs, uschar *crl, host_item *host, BOOL optional,
 140     int (*cert_vfy_cb)(int, X509_STORE_CTX *) );
 141
 142 /* Callbacks */
 143 #ifdef EXIM_HAVE_OPENSSL_TLSEXT
 144 static int tls_servername_cb(SSL *s, int *ad ARG_UNUSED, void *arg);
 145 #endif
 146 #ifndef DISABLE_OCSP
 147 static int tls_server_stapling_cb(SSL *s, void *arg);
 148 #endif
 149
 150
 151 /*************************************************
 152 *               Handle TLS error                 *
 153 *************************************************/
 154
 155 /* Called from lots of places when errors occur before actually starting to do
 156 the TLS handshake, that is, while the session is still in clear. Always returns
 157 DEFER for a server and FAIL for a client so that most calls can use "return
 158 tls_error(...)" to do this processing and then give an appropriate return. A
 159 single function is used for both server and client, because it is called from
 160 some shared functions.
 161
 162 Argument:
 163   prefix    text to include in the logged error
 164   host      NULL if setting up a server;
 165             the connected host if setting up a client
 166   msg       error message or NULL if we should ask OpenSSL
 167
 168 Returns:    OK/DEFER/FAIL
 169 */
 170
 171 static int
 172 tls_error(uschar * prefix, const host_item * host, uschar *  msg)
 173 {
 174 if (!msg)
 175   {
 176   ERR_error_string(ERR_get_error(), ssl_errstring);
 177   msg = (uschar *)ssl_errstring;
 178   }
 179
 180 if (host)
 181   {
 182   log_write(0, LOG_MAIN, "H=%s [%s] TLS error on connection (%s): %s",
 183     host->name, host->address, prefix, msg);
 184   return FAIL;
 185   }
 186 else
 187   {
 188   uschar *conn_info = smtp_get_connection_info();
 189   if (Ustrncmp(conn_info, US"SMTP ", 5) == 0)
 190     conn_info += 5;
 191   /* I'd like to get separated H= here, but too hard for now */
 192   log_write(0, LOG_MAIN, "TLS error on %s (%s): %s",
 193     conn_info, prefix, msg);
 194   return DEFER;
 195   }
 196 }
 197
 198
 199
 200 /*************************************************
 201 *        Callback to generate RSA key            *
 202 *************************************************/
 203
 204 /*
 205 Arguments:
 206   s          SSL connection
 207   export     not used
 208   keylength  keylength
 209
 210 Returns:     pointer to generated key
 211 */
 212
 213 static RSA *
 214 rsa_callback(SSL *s, int export, int keylength)
 215 {
 216 RSA *rsa_key;
 217 export = export;     /* Shut picky compilers up */
 218 DEBUG(D_tls) debug_printf("Generating %d bit RSA key...\n", keylength);
 219 rsa_key = RSA_generate_key(keylength, RSA_F4, NULL, NULL);
 220 if (rsa_key == NULL)
 221   {
 222   ERR_error_string(ERR_get_error(), ssl_errstring);
 223   log_write(0, LOG_MAIN|LOG_PANIC, "TLS error (RSA_generate_key): %s",
 224     ssl_errstring);
 225   return NULL;
 226   }
 227 return rsa_key;
 228 }
 229
 230
 231
 232 /* Extreme debug
 233 #ifndef DISABLE_OCSP
 234 void
 235 x509_store_dump_cert_s_names(X509_STORE * store)
 236 {
 237 STACK_OF(X509_OBJECT) * roots= store->objs;
 238 int i;
 239 static uschar name[256];
 240
 241 for(i= 0; i<sk_X509_OBJECT_num(roots); i++)
 242   {
 243   X509_OBJECT * tmp_obj= sk_X509_OBJECT_value(roots, i);
 244   if(tmp_obj->type == X509_LU_X509)
 245     {
 246     X509 * current_cert= tmp_obj->data.x509;
 247     X509_NAME_oneline(X509_get_subject_name(current_cert), CS name, sizeof(name));
 248         txt[sizeof(name)-1] = '\0';
 249     debug_printf(" %s\n", name);
 250     }
 251   }
 252 }
 253 #endif
 254 */
 255
 256
 257 /*************************************************
 258 *        Callback for verification               *
 259 *************************************************/
 260
 261 /* The SSL library does certificate verification if set up to do so. This
 262 callback has the current yes/no state is in "state". If verification succeeded,
 263 we set up the tls_peerdn string. If verification failed, what happens depends
 264 on whether the client is required to present a verifiable certificate or not.
 265
 266 If verification is optional, we change the state to yes, but still log the
 267 verification error. For some reason (it really would help to have proper
 268 documentation of OpenSSL), this callback function then gets called again, this
 269 time with state = 1. In fact, that's useful, because we can set up the peerdn
 270 value, but we must take care not to set the private verified flag on the second
 271 time through.
 272
 273 Note: this function is not called if the client fails to present a certificate
 274 when asked. We get here only if a certificate has been received. Handling of
 275 optional verification for this case is done when requesting SSL to verify, by
 276 setting SSL_VERIFY_FAIL_IF_NO_PEER_CERT in the non-optional case.
 277
 278 May be called multiple times for different issues with a certificate, even
 279 for a given "depth" in the certificate chain.
 280
 281 Arguments:
 282   state      current yes/no state as 1/0
 283   x509ctx    certificate information.
 284   client     TRUE for client startup, FALSE for server startup
 285
 286 Returns:     1 if verified, 0 if not
 287 */
 288
 289 static int
 290 verify_callback(int state, X509_STORE_CTX *x509ctx,
 291   tls_support *tlsp, BOOL *calledp, BOOL *optionalp)
 292 {
 293 X509 * cert = X509_STORE_CTX_get_current_cert(x509ctx);
 294 int depth = X509_STORE_CTX_get_error_depth(x509ctx);
 295 static uschar txt[256];
 296 #ifdef EXPERIMENTAL_EVENT
 297 uschar * ev;
 298 uschar * yield;
 299 #endif
 300
 301 X509_NAME_oneline(X509_get_subject_name(cert), CS txt, sizeof(txt));
 302 txt[sizeof(txt)-1] = '\0';
 303
 304 if (state == 0)
 305   {
 306   log_write(0, LOG_MAIN, "[%s] SSL verify error: depth=%d error=%s cert=%s",
 307         tlsp == &tls_out ? deliver_host_address : sender_host_address,
 308     depth,
 309     X509_verify_cert_error_string(X509_STORE_CTX_get_error(x509ctx)),
 310     txt);
 311   *calledp = TRUE;
 312   if (!*optionalp)
 313     {
 314     tlsp->peercert = X509_dup(cert);
 315     return 0;                       /* reject */
 316     }
 317   DEBUG(D_tls) debug_printf("SSL verify failure overridden (host in "
 318     "tls_try_verify_hosts)\n");
 319   }
 320
 321 else if (depth != 0)
 322   {
 323   DEBUG(D_tls) debug_printf("SSL verify ok: depth=%d SN=%s\n", depth, txt);
 324 #ifndef DISABLE_OCSP
 325   if (tlsp == &tls_out && client_static_cbinfo->u_ocsp.client.verify_store)
 326     {   /* client, wanting stapling  */
 327     /* Add the server cert's signing chain as the one
 328     for the verification of the OCSP stapled information. */
 329
 330     if (!X509_STORE_add_cert(client_static_cbinfo->u_ocsp.client.verify_store,
 331                              cert))
 332       ERR_clear_error();
 333     }
 334 #endif
 335 #ifdef EXPERIMENTAL_EVENT
 336   ev = tlsp == &tls_out ? client_static_cbinfo->event_action : event_action;
 337   if (ev)
 338     {
 339     tlsp->peercert = X509_dup(cert);
 340     if ((yield = event_raise(ev, US"tls:cert", string_sprintf("%d", depth))))
 341       {
 342       log_write(0, LOG_MAIN, "[%s] SSL verify denied by event-action: "
 343                   "depth=%d cert=%s: %s",
 344                 tlsp == &tls_out ? deliver_host_address : sender_host_address,
 345                 depth, txt, yield);
 346       *calledp = TRUE;
 347       if (!*optionalp)
 348         return 0;                           /* reject */
 349       DEBUG(D_tls) debug_printf("Event-action verify failure overridden "
 350         "(host in tls_try_verify_hosts)\n");
 351       }
 352     X509_free(tlsp->peercert);
 353     tlsp->peercert = NULL;
 354     }
 355 #endif
 356   }
 357 else
 358   {
 359   const uschar * verify_cert_hostnames;
 360
 361   tlsp->peerdn = txt;
 362   tlsp->peercert = X509_dup(cert);
 363
 364   if (  tlsp == &tls_out
 365      && ((verify_cert_hostnames = client_static_cbinfo->verify_cert_hostnames)))
 366         /* client, wanting hostname check */
 367
 368 # if EXIM_HAVE_OPENSSL_CHECKHOST
 369 #  ifndef X509_CHECK_FLAG_NO_PARTIAL_WILDCARDS
 370 #   define X509_CHECK_FLAG_NO_PARTIAL_WILDCARDS 0
 371 #  endif
 372 #  ifndef X509_CHECK_FLAG_SINGLE_LABEL_SUBDOMAINS
 373 #   define X509_CHECK_FLAG_SINGLE_LABEL_SUBDOMAINS 0
 374 #  endif
 375     {
 376     int sep = 0;
 377     const uschar * list = verify_cert_hostnames;
 378     uschar * name;
 379     int rc;
 380     while ((name = string_nextinlist(&list, &sep, NULL, 0)))
 381       if ((rc = X509_check_host(cert, name, 0,
 382                   X509_CHECK_FLAG_NO_PARTIAL_WILDCARDS
 383                   | X509_CHECK_FLAG_SINGLE_LABEL_SUBDOMAINS)))
 384         {
 385         if (rc < 0)
 386           {
 387           log_write(0, LOG_MAIN, "[%s] SSL verify error: internal error",
 388                 tlsp == &tls_out ? deliver_host_address : sender_host_address);
 389           name = NULL;
 390           }
 391         break;
 392         }
 393     if (!name)
 394       {
 395       log_write(0, LOG_MAIN,
 396                 "[%s] SSL verify error: certificate name mismatch: \"%s\"",
 397                 tlsp == &tls_out ? deliver_host_address : sender_host_address,
 398                 txt);
 399       *calledp = TRUE;
 400       if (!*optionalp)
 401         return 0;                           /* reject */
 402       DEBUG(D_tls) debug_printf("SSL verify failure overridden (host in "
 403         "tls_try_verify_hosts)\n");
 404       }
 405     }
 406 # else
 407     if (!tls_is_name_for_cert(verify_cert_hostnames, cert))
 408       {
 409       log_write(0, LOG_MAIN,
 410                 "[%s] SSL verify error: certificate name mismatch: \"%s\"",
 411                 tlsp == &tls_out ? deliver_host_address : sender_host_address,
 412                 txt);
 413       *calledp = TRUE;
 414       if (!*optionalp)
 415         return 0;                           /* reject */
 416       DEBUG(D_tls) debug_printf("SSL verify failure overridden (host in "
 417         "tls_try_verify_hosts)\n");
 418       }
 419 # endif
 420
 421 #ifdef EXPERIMENTAL_EVENT
 422   ev = tlsp == &tls_out ? client_static_cbinfo->event_action : event_action;
 423   if (ev)
 424     if ((yield = event_raise(ev, US"tls:cert", US"0")))
 425       {
 426       log_write(0, LOG_MAIN, "[%s] SSL verify denied by event-action: "
 427                   "depth=0 cert=%s: %s",
 428                 tlsp == &tls_out ? deliver_host_address : sender_host_address,
 429                 txt, yield);
 430       *calledp = TRUE;
 431       if (!*optionalp)
 432         return 0;                           /* reject */
 433       DEBUG(D_tls) debug_printf("Event-action verify failure overridden "
 434         "(host in tls_try_verify_hosts)\n");
 435       }
 436 #endif
 437
 438   DEBUG(D_tls) debug_printf("SSL%s verify ok: depth=0 SN=%s\n",
 439     *calledp ? "" : " authenticated", txt);
 440   if (!*calledp) tlsp->certificate_verified = TRUE;
 441   *calledp = TRUE;
 442   }
 443
 444 return 1;   /* accept, at least for this level */
 445 }
 446
 447 static int
 448 verify_callback_client(int state, X509_STORE_CTX *x509ctx)
 449 {
 450 return verify_callback(state, x509ctx, &tls_out, &client_verify_callback_called, &client_verify_optional);
 451 }
 452
 453 static int
 454 verify_callback_server(int state, X509_STORE_CTX *x509ctx)
 455 {
 456 return verify_callback(state, x509ctx, &tls_in, &server_verify_callback_called, &server_verify_optional);
 457 }
 458
 459
 460 #ifdef EXPERIMENTAL_DANE
 461
 462 /* This gets called *by* the dane library verify callback, which interposes
 463 itself.
 464 */
 465 static int
 466 verify_callback_client_dane(int state, X509_STORE_CTX * x509ctx)
 467 {
 468 X509 * cert = X509_STORE_CTX_get_current_cert(x509ctx);
 469 static uschar txt[256];
 470 #ifdef EXPERIMENTAL_EVENT
 471 int depth = X509_STORE_CTX_get_error_depth(x509ctx);
 472 uschar * yield;
 473 #endif
 474
 475 X509_NAME_oneline(X509_get_subject_name(cert), CS txt, sizeof(txt));
 476 txt[sizeof(txt)-1] = '\0';
 477
 478 DEBUG(D_tls) debug_printf("verify_callback_client_dane: %s\n", txt);
 479 tls_out.peerdn = txt;
 480 tls_out.peercert = X509_dup(cert);
 481
 482 #ifdef EXPERIMENTAL_EVENT
 483   if (client_static_cbinfo->event_action)
 484     {
 485     if ((yield = event_raise(client_static_cbinfo->event_action,
 486                     US"tls:cert", string_sprintf("%d", depth))))
 487       {
 488       log_write(0, LOG_MAIN, "DANE verify denied by event-action: "
 489                               "depth=%d cert=%s: %s", depth, txt, yield);
 490       tls_out.certificate_verified = FALSE;
 491       return 0;                     /* reject */
 492       }
 493     if (depth != 0)
 494       {
 495       X509_free(tls_out.peercert);
 496       tls_out.peercert = NULL;
 497       }
 498     }
 499 #endif
 500
 501 if (state == 1)
 502   tls_out.dane_verified =
 503   tls_out.certificate_verified = TRUE;
 504 return 1;
 505 }
 506
 507 #endif  /*EXPERIMENTAL_DANE*/
 508
 509
 510 /*************************************************
 511 *           Information callback                 *
 512 *************************************************/
 513
 514 /* The SSL library functions call this from time to time to indicate what they
 515 are doing. We copy the string to the debugging output when TLS debugging has
 516 been requested.
 517
 518 Arguments:
 519   s         the SSL connection
 520   where
 521   ret
 522
 523 Returns:    nothing
 524 */
 525
 526 static void
 527 info_callback(SSL *s, int where, int ret)
 528 {
 529 where = where;
 530 ret = ret;
 531 DEBUG(D_tls) debug_printf("SSL info: %s\n", SSL_state_string_long(s));
 532 }
 533
 534
 535
 536 /*************************************************
 537 *                Initialize for DH               *
 538 *************************************************/
 539
 540 /* If dhparam is set, expand it, and load up the parameters for DH encryption.
 541
 542 Arguments:
 543   dhparam   DH parameter file or fixed parameter identity string
 544   host      connected host, if client; NULL if server
 545
 546 Returns:    TRUE if OK (nothing to set up, or setup worked)
 547 */
 548
 549 static BOOL
 550 init_dh(SSL_CTX *sctx, uschar *dhparam, const host_item *host)
 551 {
 552 BIO *bio;
 553 DH *dh;
 554 uschar *dhexpanded;
 555 const char *pem;
 556
 557 if (!expand_check(dhparam, US"tls_dhparam", &dhexpanded))
 558   return FALSE;
 559
 560 if (!dhexpanded || !*dhexpanded)
 561   bio = BIO_new_mem_buf(CS std_dh_prime_default(), -1);
 562 else if (dhexpanded[0] == '/')
 563   {
 564   if (!(bio = BIO_new_file(CS dhexpanded, "r")))
 565     {
 566     tls_error(string_sprintf("could not read dhparams file %s", dhexpanded),
 567           host, US strerror(errno));
 568     return FALSE;
 569     }
 570   }
 571 else
 572   {
 573   if (Ustrcmp(dhexpanded, "none") == 0)
 574     {
 575     DEBUG(D_tls) debug_printf("Requested no DH parameters.\n");
 576     return TRUE;
 577     }
 578
 579   if (!(pem = std_dh_prime_named(dhexpanded)))
 580     {
 581     tls_error(string_sprintf("Unknown standard DH prime \"%s\"", dhexpanded),
 582         host, US strerror(errno));
 583     return FALSE;
 584     }
 585   bio = BIO_new_mem_buf(CS pem, -1);
 586   }
 587
 588 if (!(dh = PEM_read_bio_DHparams(bio, NULL, NULL, NULL)))
 589   {
 590   BIO_free(bio);
 591   tls_error(string_sprintf("Could not read tls_dhparams \"%s\"", dhexpanded),
 592       host, NULL);
 593   return FALSE;
 594   }
 595
 596 /* Even if it is larger, we silently return success rather than cause things
 597  * to fail out, so that a too-large DH will not knock out all TLS; it's a
 598  * debatable choice. */
 599 if ((8*DH_size(dh)) > tls_dh_max_bits)
 600   {
 601   DEBUG(D_tls)
 602     debug_printf("dhparams file %d bits, is > tls_dh_max_bits limit of %d",
 603         8*DH_size(dh), tls_dh_max_bits);
 604   }
 605 else
 606   {
 607   SSL_CTX_set_tmp_dh(sctx, dh);
 608   DEBUG(D_tls)
 609     debug_printf("Diffie-Hellman initialized from %s with %d-bit prime\n",
 610       dhexpanded ? dhexpanded : US"default", 8*DH_size(dh));
 611   }
 612
 613 DH_free(dh);
 614 BIO_free(bio);
 615
 616 return TRUE;
 617 }
 618
 619
 620
 621
 622 #ifndef DISABLE_OCSP
 623 /*************************************************
 624 *       Load OCSP information into state         *
 625 *************************************************/
 626
 627 /* Called to load the server OCSP response from the given file into memory, once
 628 caller has determined this is needed.  Checks validity.  Debugs a message
 629 if invalid.
 630
 631 ASSUMES: single response, for single cert.
 632
 633 Arguments:
 634   sctx            the SSL_CTX* to update
 635   cbinfo          various parts of session state
 636   expanded        the filename putatively holding an OCSP response
 637
 638 */
 639
 640 static void
 641 ocsp_load_response(SSL_CTX *sctx, tls_ext_ctx_cb *cbinfo, const uschar *expanded)
 642 {
 643 BIO *bio;
 644 OCSP_RESPONSE *resp;
 645 OCSP_BASICRESP *basic_response;
 646 OCSP_SINGLERESP *single_response;
 647 ASN1_GENERALIZEDTIME *rev, *thisupd, *nextupd;
 648 X509_STORE *store;
 649 unsigned long verify_flags;
 650 int status, reason, i;
 651
 652 cbinfo->u_ocsp.server.file_expanded = string_copy(expanded);
 653 if (cbinfo->u_ocsp.server.response)
 654   {
 655   OCSP_RESPONSE_free(cbinfo->u_ocsp.server.response);
 656   cbinfo->u_ocsp.server.response = NULL;
 657   }
 658
 659 bio = BIO_new_file(CS cbinfo->u_ocsp.server.file_expanded, "rb");
 660 if (!bio)
 661   {
 662   DEBUG(D_tls) debug_printf("Failed to open OCSP response file \"%s\"\n",
 663       cbinfo->u_ocsp.server.file_expanded);
 664   return;
 665   }
 666
 667 resp = d2i_OCSP_RESPONSE_bio(bio, NULL);
 668 BIO_free(bio);
 669 if (!resp)
 670   {
 671   DEBUG(D_tls) debug_printf("Error reading OCSP response.\n");
 672   return;
 673   }
 674
 675 status = OCSP_response_status(resp);
 676 if (status != OCSP_RESPONSE_STATUS_SUCCESSFUL)
 677   {
 678   DEBUG(D_tls) debug_printf("OCSP response not valid: %s (%d)\n",
 679       OCSP_response_status_str(status), status);
 680   goto bad;
 681   }
 682
 683 basic_response = OCSP_response_get1_basic(resp);
 684 if (!basic_response)
 685   {
 686   DEBUG(D_tls)
 687     debug_printf("OCSP response parse error: unable to extract basic response.\n");
 688   goto bad;
 689   }
 690
 691 store = SSL_CTX_get_cert_store(sctx);
 692 verify_flags = OCSP_NOVERIFY; /* check sigs, but not purpose */
 693
 694 /* May need to expose ability to adjust those flags?
 695 OCSP_NOSIGS OCSP_NOVERIFY OCSP_NOCHAIN OCSP_NOCHECKS OCSP_NOEXPLICIT
 696 OCSP_TRUSTOTHER OCSP_NOINTERN */
 697
 698 i = OCSP_basic_verify(basic_response, NULL, store, verify_flags);
 699 if (i <= 0)
 700   {
 701   DEBUG(D_tls) {
 702     ERR_error_string(ERR_get_error(), ssl_errstring);
 703     debug_printf("OCSP response verify failure: %s\n", US ssl_errstring);
 704     }
 705   goto bad;
 706   }
 707
 708 /* Here's the simplifying assumption: there's only one response, for the
 709 one certificate we use, and nothing for anything else in a chain.  If this
 710 proves false, we need to extract a cert id from our issued cert
 711 (tls_certificate) and use that for OCSP_resp_find_status() (which finds the
 712 right cert in the stack and then calls OCSP_single_get0_status()).
 713
 714 I'm hoping to avoid reworking a bunch more of how we handle state here. */
 715 single_response = OCSP_resp_get0(basic_response, 0);
 716 if (!single_response)
 717   {
 718   DEBUG(D_tls)
 719     debug_printf("Unable to get first response from OCSP basic response.\n");
 720   goto bad;
 721   }
 722
 723 status = OCSP_single_get0_status(single_response, &reason, &rev, &thisupd, &nextupd);
 724 if (status != V_OCSP_CERTSTATUS_GOOD)
 725   {
 726   DEBUG(D_tls) debug_printf("OCSP response bad cert status: %s (%d) %s (%d)\n",
 727       OCSP_cert_status_str(status), status,
 728       OCSP_crl_reason_str(reason), reason);
 729   goto bad;
 730   }
 731
 732 if (!OCSP_check_validity(thisupd, nextupd, EXIM_OCSP_SKEW_SECONDS, EXIM_OCSP_MAX_AGE))
 733   {
 734   DEBUG(D_tls) debug_printf("OCSP status invalid times.\n");
 735   goto bad;
 736   }
 737
 738 supply_response:
 739   cbinfo->u_ocsp.server.response = resp;
 740 return;
 741
 742 bad:
 743   if (running_in_test_harness)
 744     {
 745     extern char ** environ;
 746     uschar ** p;
 747     for (p = USS environ; *p != NULL; p++)
 748       if (Ustrncmp(*p, "EXIM_TESTHARNESS_DISABLE_OCSPVALIDITYCHECK", 42) == 0)
 749         {
 750         DEBUG(D_tls) debug_printf("Supplying known bad OCSP response\n");
 751         goto supply_response;
 752         }
 753     }
 754 return;
 755 }
 756 #endif  /*!DISABLE_OCSP*/
 757
 758
 759
 760
 761 /*************************************************
 762 *        Expand key and cert file specs          *
 763 *************************************************/
 764
 765 /* Called once during tls_init and possibly again during TLS setup, for a
 766 new context, if Server Name Indication was used and tls_sni was seen in
 767 the certificate string.
 768
 769 Arguments:
 770   sctx            the SSL_CTX* to update
 771   cbinfo          various parts of session state
 772
 773 Returns:          OK/DEFER/FAIL
 774 */
 775
 776 static int
 777 tls_expand_session_files(SSL_CTX *sctx, tls_ext_ctx_cb *cbinfo)
 778 {
 779 uschar *expanded;
 780
 781 if (cbinfo->certificate == NULL)
 782   return OK;
 783
 784 if (Ustrstr(cbinfo->certificate, US"tls_sni") ||
 785     Ustrstr(cbinfo->certificate, US"tls_in_sni") ||
 786     Ustrstr(cbinfo->certificate, US"tls_out_sni")
 787    )
 788   reexpand_tls_files_for_sni = TRUE;
 789
 790 if (!expand_check(cbinfo->certificate, US"tls_certificate", &expanded))
 791   return DEFER;
 792
 793 if (expanded != NULL)
 794   {
 795   DEBUG(D_tls) debug_printf("tls_certificate file %s\n", expanded);
 796   if (!SSL_CTX_use_certificate_chain_file(sctx, CS expanded))
 797     return tls_error(string_sprintf(
 798       "SSL_CTX_use_certificate_chain_file file=%s", expanded),
 799         cbinfo->host, NULL);
 800   }
 801
 802 if (cbinfo->privatekey != NULL &&
 803     !expand_check(cbinfo->privatekey, US"tls_privatekey", &expanded))
 804   return DEFER;
 805
 806 /* If expansion was forced to fail, key_expanded will be NULL. If the result
 807 of the expansion is an empty string, ignore it also, and assume the private
 808 key is in the same file as the certificate. */
 809
 810 if (expanded != NULL && *expanded != 0)
 811   {
 812   DEBUG(D_tls) debug_printf("tls_privatekey file %s\n", expanded);
 813   if (!SSL_CTX_use_PrivateKey_file(sctx, CS expanded, SSL_FILETYPE_PEM))
 814     return tls_error(string_sprintf(
 815       "SSL_CTX_use_PrivateKey_file file=%s", expanded), cbinfo->host, NULL);
 816   }
 817
 818 #ifndef DISABLE_OCSP
 819 if (cbinfo->is_server &&  cbinfo->u_ocsp.server.file != NULL)
 820   {
 821   if (!expand_check(cbinfo->u_ocsp.server.file, US"tls_ocsp_file", &expanded))
 822     return DEFER;
 823
 824   if (expanded != NULL && *expanded != 0)
 825     {
 826     DEBUG(D_tls) debug_printf("tls_ocsp_file %s\n", expanded);
 827     if (cbinfo->u_ocsp.server.file_expanded &&
 828         (Ustrcmp(expanded, cbinfo->u_ocsp.server.file_expanded) == 0))
 829       {
 830       DEBUG(D_tls)
 831         debug_printf("tls_ocsp_file value unchanged, using existing values.\n");
 832       } else {
 833         ocsp_load_response(sctx, cbinfo, expanded);
 834       }
 835     }
 836   }
 837 #endif
 838
 839 return OK;
 840 }
 841
 842
 843
 844
 845 /*************************************************
 846 *            Callback to handle SNI              *
 847 *************************************************/
 848
 849 /* Called when acting as server during the TLS session setup if a Server Name
 850 Indication extension was sent by the client.
 851
 852 API documentation is OpenSSL s_server.c implementation.
 853
 854 Arguments:
 855   s               SSL* of the current session
 856   ad              unknown (part of OpenSSL API) (unused)
 857   arg             Callback of "our" registered data
 858
 859 Returns:          SSL_TLSEXT_ERR_{OK,ALERT_WARNING,ALERT_FATAL,NOACK}
 860 */
 861
 862 #ifdef EXIM_HAVE_OPENSSL_TLSEXT
 863 static int
 864 tls_servername_cb(SSL *s, int *ad ARG_UNUSED, void *arg)
 865 {
 866 const char *servername = SSL_get_servername(s, TLSEXT_NAMETYPE_host_name);
 867 tls_ext_ctx_cb *cbinfo = (tls_ext_ctx_cb *) arg;
 868 int rc;
 869 int old_pool = store_pool;
 870
 871 if (!servername)
 872   return SSL_TLSEXT_ERR_OK;
 873
 874 DEBUG(D_tls) debug_printf("Received TLS SNI \"%s\"%s\n", servername,
 875     reexpand_tls_files_for_sni ? "" : " (unused for certificate selection)");
 876
 877 /* Make the extension value available for expansion */
 878 store_pool = POOL_PERM;
 879 tls_in.sni = string_copy(US servername);
 880 store_pool = old_pool;
 881
 882 if (!reexpand_tls_files_for_sni)
 883   return SSL_TLSEXT_ERR_OK;
 884
 885 /* Can't find an SSL_CTX_clone() or equivalent, so we do it manually;
 886 not confident that memcpy wouldn't break some internal reference counting.
 887 Especially since there's a references struct member, which would be off. */
 888
 889 if (!(server_sni = SSL_CTX_new(SSLv23_server_method())))
 890   {
 891   ERR_error_string(ERR_get_error(), ssl_errstring);
 892   DEBUG(D_tls) debug_printf("SSL_CTX_new() failed: %s\n", ssl_errstring);
 893   return SSL_TLSEXT_ERR_NOACK;
 894   }
 895
 896 /* Not sure how many of these are actually needed, since SSL object
 897 already exists.  Might even need this selfsame callback, for reneg? */
 898
 899 SSL_CTX_set_info_callback(server_sni, SSL_CTX_get_info_callback(server_ctx));
 900 SSL_CTX_set_mode(server_sni, SSL_CTX_get_mode(server_ctx));
 901 SSL_CTX_set_options(server_sni, SSL_CTX_get_options(server_ctx));
 902 SSL_CTX_set_timeout(server_sni, SSL_CTX_get_timeout(server_ctx));
 903 SSL_CTX_set_tlsext_servername_callback(server_sni, tls_servername_cb);
 904 SSL_CTX_set_tlsext_servername_arg(server_sni, cbinfo);
 905 if (cbinfo->server_cipher_list)
 906   SSL_CTX_set_cipher_list(server_sni, CS cbinfo->server_cipher_list);
 907 #ifndef DISABLE_OCSP
 908 if (cbinfo->u_ocsp.server.file)
 909   {
 910   SSL_CTX_set_tlsext_status_cb(server_sni, tls_server_stapling_cb);
 911   SSL_CTX_set_tlsext_status_arg(server_sni, cbinfo);
 912   }
 913 #endif
 914
 915 rc = setup_certs(server_sni, tls_verify_certificates, tls_crl, NULL, FALSE, verify_callback_server);
 916 if (rc != OK) return SSL_TLSEXT_ERR_NOACK;
 917
 918 /* do this after setup_certs, because this can require the certs for verifying
 919 OCSP information. */
 920 rc = tls_expand_session_files(server_sni, cbinfo);
 921 if (rc != OK) return SSL_TLSEXT_ERR_NOACK;
 922
 923 if (!init_dh(server_sni, cbinfo->dhparam, NULL))
 924   return SSL_TLSEXT_ERR_NOACK;
 925
 926 DEBUG(D_tls) debug_printf("Switching SSL context.\n");
 927 SSL_set_SSL_CTX(s, server_sni);
 928
 929 return SSL_TLSEXT_ERR_OK;
 930 }
 931 #endif /* EXIM_HAVE_OPENSSL_TLSEXT */
 932
 933
 934
 935
 936 #ifndef DISABLE_OCSP
 937
 938 /*************************************************
 939 *        Callback to handle OCSP Stapling        *
 940 *************************************************/
 941
 942 /* Called when acting as server during the TLS session setup if the client
 943 requests OCSP information with a Certificate Status Request.
 944
 945 Documentation via openssl s_server.c and the Apache patch from the OpenSSL
 946 project.
 947
 948 */
 949
 950 static int
 951 tls_server_stapling_cb(SSL *s, void *arg)
 952 {
 953 const tls_ext_ctx_cb *cbinfo = (tls_ext_ctx_cb *) arg;
 954 uschar *response_der;
 955 int response_der_len;
 956
 957 DEBUG(D_tls)
 958   debug_printf("Received TLS status request (OCSP stapling); %s response.",
 959     cbinfo->u_ocsp.server.response ? "have" : "lack");
 960
 961 tls_in.ocsp = OCSP_NOT_RESP;
 962 if (!cbinfo->u_ocsp.server.response)
 963   return SSL_TLSEXT_ERR_NOACK;
 964
 965 response_der = NULL;
 966 response_der_len = i2d_OCSP_RESPONSE(cbinfo->u_ocsp.server.response,
 967                       &response_der);
 968 if (response_der_len <= 0)
 969   return SSL_TLSEXT_ERR_NOACK;
 970
 971 SSL_set_tlsext_status_ocsp_resp(server_ssl, response_der, response_der_len);
 972 tls_in.ocsp = OCSP_VFIED;
 973 return SSL_TLSEXT_ERR_OK;
 974 }
 975
 976
 977 static void
 978 time_print(BIO * bp, const char * str, ASN1_GENERALIZEDTIME * time)
 979 {
 980 BIO_printf(bp, "\t%s: ", str);
 981 ASN1_GENERALIZEDTIME_print(bp, time);
 982 BIO_puts(bp, "\n");
 983 }
 984
 985 static int
 986 tls_client_stapling_cb(SSL *s, void *arg)
 987 {
 988 tls_ext_ctx_cb * cbinfo = arg;
 989 const unsigned char * p;
 990 int len;
 991 OCSP_RESPONSE * rsp;
 992 OCSP_BASICRESP * bs;
 993 int i;
 994
 995 DEBUG(D_tls) debug_printf("Received TLS status response (OCSP stapling):");
 996 len = SSL_get_tlsext_status_ocsp_resp(s, &p);
 997 if(!p)
 998  {
 999   /* Expect this when we requested ocsp but got none */
1000   if (  cbinfo->u_ocsp.client.verify_required
1001      && log_extra_selector & LX_tls_cipher)
1002     log_write(0, LOG_MAIN, "Received TLS status callback, null content");
1003   else
1004     DEBUG(D_tls) debug_printf(" null\n");
1005   return cbinfo->u_ocsp.client.verify_required ? 0 : 1;
1006  }
1007
1008 if(!(rsp = d2i_OCSP_RESPONSE(NULL, &p, len)))
1009  {
1010   tls_out.ocsp = OCSP_FAILED;
1011   if (log_extra_selector & LX_tls_cipher)
1012     log_write(0, LOG_MAIN, "Received TLS cert status response, parse error");
1013   else
1014     DEBUG(D_tls) debug_printf(" parse error\n");
1015   return 0;
1016  }
1017
1018 if(!(bs = OCSP_response_get1_basic(rsp)))
1019   {
1020   tls_out.ocsp = OCSP_FAILED;
1021   if (log_extra_selector & LX_tls_cipher)
1022     log_write(0, LOG_MAIN, "Received TLS cert status response, error parsing response");
1023   else
1024     DEBUG(D_tls) debug_printf(" error parsing response\n");
1025   OCSP_RESPONSE_free(rsp);
1026   return 0;
1027   }
1028
1029 /* We'd check the nonce here if we'd put one in the request. */
1030 /* However that would defeat cacheability on the server so we don't. */
1031
1032 /* This section of code reworked from OpenSSL apps source;
1033    The OpenSSL Project retains copyright:
1034    Copyright (c) 1999 The OpenSSL Project.  All rights reserved.
1035 */
1036   {
1037     BIO * bp = NULL;
1038     int status, reason;
1039     ASN1_GENERALIZEDTIME *rev, *thisupd, *nextupd;
1040
1041     DEBUG(D_tls) bp = BIO_new_fp(stderr, BIO_NOCLOSE);
1042
1043     /*OCSP_RESPONSE_print(bp, rsp, 0);   extreme debug: stapling content */
1044
1045     /* Use the chain that verified the server cert to verify the stapled info */
1046     /* DEBUG(D_tls) x509_store_dump_cert_s_names(cbinfo->u_ocsp.client.verify_store); */
1047
1048     if ((i = OCSP_basic_verify(bs, NULL,
1049               cbinfo->u_ocsp.client.verify_store, 0)) <= 0)
1050       {
1051       tls_out.ocsp = OCSP_FAILED;
1052       if (log_extra_selector & LX_tls_cipher)
1053         log_write(0, LOG_MAIN, "Received TLS cert status response, itself unverifiable");
1054       BIO_printf(bp, "OCSP response verify failure\n");
1055       ERR_print_errors(bp);
1056       i = cbinfo->u_ocsp.client.verify_required ? 0 : 1;
1057       goto out;
1058       }
1059
1060     BIO_printf(bp, "OCSP response well-formed and signed OK\n");
1061
1062       {
1063       STACK_OF(OCSP_SINGLERESP) * sresp = bs->tbsResponseData->responses;
1064       OCSP_SINGLERESP * single;
1065
1066       if (sk_OCSP_SINGLERESP_num(sresp) != 1)
1067         {
1068         tls_out.ocsp = OCSP_FAILED;
1069         log_write(0, LOG_MAIN, "OCSP stapling "
1070             "with multiple responses not handled");
1071         i = cbinfo->u_ocsp.client.verify_required ? 0 : 1;
1072         goto out;
1073         }
1074       single = OCSP_resp_get0(bs, 0);
1075       status = OCSP_single_get0_status(single, &reason, &rev,
1076                   &thisupd, &nextupd);
1077       }
1078
1079     DEBUG(D_tls) time_print(bp, "This OCSP Update", thisupd);
1080     DEBUG(D_tls) if(nextupd) time_print(bp, "Next OCSP Update", nextupd);
1081     if (!OCSP_check_validity(thisupd, nextupd,
1082           EXIM_OCSP_SKEW_SECONDS, EXIM_OCSP_MAX_AGE))
1083       {
1084       tls_out.ocsp = OCSP_FAILED;
1085       DEBUG(D_tls) ERR_print_errors(bp);
1086       log_write(0, LOG_MAIN, "Server OSCP dates invalid");
1087       i = cbinfo->u_ocsp.client.verify_required ? 0 : 1;
1088       }
1089     else
1090       {
1091       DEBUG(D_tls) BIO_printf(bp, "Certificate status: %s\n",
1092                     OCSP_cert_status_str(status));
1093       switch(status)
1094         {
1095         case V_OCSP_CERTSTATUS_GOOD:
1096           tls_out.ocsp = OCSP_VFIED;
1097           i = 1;
1098           break;
1099         case V_OCSP_CERTSTATUS_REVOKED:
1100           tls_out.ocsp = OCSP_FAILED;
1101           log_write(0, LOG_MAIN, "Server certificate revoked%s%s",
1102               reason != -1 ? "; reason: " : "",
1103               reason != -1 ? OCSP_crl_reason_str(reason) : "");
1104           DEBUG(D_tls) time_print(bp, "Revocation Time", rev);
1105           i = cbinfo->u_ocsp.client.verify_required ? 0 : 1;
1106           break;
1107         default:
1108           tls_out.ocsp = OCSP_FAILED;
1109           log_write(0, LOG_MAIN,
1110               "Server certificate status unknown, in OCSP stapling");
1111           i = cbinfo->u_ocsp.client.verify_required ? 0 : 1;
1112           break;
1113         }
1114       }
1115   out:
1116     BIO_free(bp);
1117   }
1118
1119 OCSP_RESPONSE_free(rsp);
1120 return i;
1121 }
1122 #endif  /*!DISABLE_OCSP*/
1123
1124
1125 /*************************************************
1126 *            Initialize for TLS                  *
1127 *************************************************/
1128
1129 /* Called from both server and client code, to do preliminary initialization
1130 of the library.  We allocate and return a context structure.
1131
1132 Arguments:
1133   ctxp            returned SSL context
1134   host            connected host, if client; NULL if server
1135   dhparam         DH parameter file
1136   certificate     certificate file
1137   privatekey      private key
1138   ocsp_file       file of stapling info (server); flag for require ocsp (client)
1139   addr            address if client; NULL if server (for some randomness)
1140   cbp             place to put allocated callback context
1141
1142 Returns:          OK/DEFER/FAIL
1143 */
1144
1145 static int
1146 tls_init(SSL_CTX **ctxp, host_item *host, uschar *dhparam, uschar *certificate,
1147   uschar *privatekey,
1148 #ifndef DISABLE_OCSP
1149   uschar *ocsp_file,
1150 #endif
1151   address_item *addr, tls_ext_ctx_cb ** cbp)
1152 {
1153 long init_options;
1154 int rc;
1155 BOOL okay;
1156 tls_ext_ctx_cb * cbinfo;
1157
1158 cbinfo = store_malloc(sizeof(tls_ext_ctx_cb));
1159 cbinfo->certificate = certificate;
1160 cbinfo->privatekey = privatekey;
1161 #ifndef DISABLE_OCSP
1162 if ((cbinfo->is_server = host==NULL))
1163   {
1164   cbinfo->u_ocsp.server.file = ocsp_file;
1165   cbinfo->u_ocsp.server.file_expanded = NULL;
1166   cbinfo->u_ocsp.server.response = NULL;
1167   }
1168 else
1169   cbinfo->u_ocsp.client.verify_store = NULL;
1170 #endif
1171 cbinfo->dhparam = dhparam;
1172 cbinfo->server_cipher_list = NULL;
1173 cbinfo->host = host;
1174 #ifdef EXPERIMENTAL_EVENT
1175 cbinfo->event_action = NULL;
1176 #endif
1177
1178 SSL_load_error_strings();          /* basic set up */
1179 OpenSSL_add_ssl_algorithms();
1180
1181 #if (OPENSSL_VERSION_NUMBER >= 0x0090800fL) && !defined(OPENSSL_NO_SHA256)
1182 /* SHA256 is becoming ever more popular. This makes sure it gets added to the
1183 list of available digests. */
1184 EVP_add_digest(EVP_sha256());
1185 #endif
1186
1187 /* Create a context.
1188 The OpenSSL docs in 1.0.1b have not been updated to clarify TLS variant
1189 negotiation in the different methods; as far as I can tell, the only
1190 *_{server,client}_method which allows negotiation is SSLv23, which exists even
1191 when OpenSSL is built without SSLv2 support.
1192 By disabling with openssl_options, we can let admins re-enable with the
1193 existing knob. */
1194
1195 *ctxp = SSL_CTX_new((host == NULL)?
1196   SSLv23_server_method() : SSLv23_client_method());
1197
1198 if (*ctxp == NULL) return tls_error(US"SSL_CTX_new", host, NULL);
1199
1200 /* It turns out that we need to seed the random number generator this early in
1201 order to get the full complement of ciphers to work. It took me roughly a day
1202 of work to discover this by experiment.
1203
1204 On systems that have /dev/urandom, SSL may automatically seed itself from
1205 there. Otherwise, we have to make something up as best we can. Double check
1206 afterwards. */
1207
1208 if (!RAND_status())
1209   {
1210   randstuff r;
1211   gettimeofday(&r.tv, NULL);
1212   r.p = getpid();
1213
1214   RAND_seed((uschar *)(&r), sizeof(r));
1215   RAND_seed((uschar *)big_buffer, big_buffer_size);
1216   if (addr != NULL) RAND_seed((uschar *)addr, sizeof(addr));
1217
1218   if (!RAND_status())
1219     return tls_error(US"RAND_status", host,
1220       US"unable to seed random number generator");
1221   }
1222
1223 /* Set up the information callback, which outputs if debugging is at a suitable
1224 level. */
1225
1226 SSL_CTX_set_info_callback(*ctxp, (void (*)())info_callback);
1227
1228 /* Automatically re-try reads/writes after renegotiation. */
1229 (void) SSL_CTX_set_mode(*ctxp, SSL_MODE_AUTO_RETRY);
1230
1231 /* Apply administrator-supplied work-arounds.
1232 Historically we applied just one requested option,
1233 SSL_OP_DONT_INSERT_EMPTY_FRAGMENTS, but when bug 994 requested a second, we
1234 moved to an administrator-controlled list of options to specify and
1235 grandfathered in the first one as the default value for "openssl_options".
1236
1237 No OpenSSL version number checks: the options we accept depend upon the
1238 availability of the option value macros from OpenSSL.  */
1239
1240 okay = tls_openssl_options_parse(openssl_options, &init_options);
1241 if (!okay)
1242   return tls_error(US"openssl_options parsing failed", host, NULL);
1243
1244 if (init_options)
1245   {
1246   DEBUG(D_tls) debug_printf("setting SSL CTX options: %#lx\n", init_options);
1247   if (!(SSL_CTX_set_options(*ctxp, init_options)))
1248     return tls_error(string_sprintf(
1249           "SSL_CTX_set_option(%#lx)", init_options), host, NULL);
1250   }
1251 else
1252   DEBUG(D_tls) debug_printf("no SSL CTX options to set\n");
1253
1254 /* Initialize with DH parameters if supplied */
1255
1256 if (!init_dh(*ctxp, dhparam, host)) return DEFER;
1257
1258 /* Set up certificate and key (and perhaps OCSP info) */
1259
1260 rc = tls_expand_session_files(*ctxp, cbinfo);
1261 if (rc != OK) return rc;
1262
1263 /* If we need to handle SNI, do so */
1264 #ifdef EXIM_HAVE_OPENSSL_TLSEXT
1265 if (host == NULL)               /* server */
1266   {
1267 # ifndef DISABLE_OCSP
1268   /* We check u_ocsp.server.file, not server.response, because we care about if
1269   the option exists, not what the current expansion might be, as SNI might
1270   change the certificate and OCSP file in use between now and the time the
1271   callback is invoked. */
1272   if (cbinfo->u_ocsp.server.file)
1273     {
1274     SSL_CTX_set_tlsext_status_cb(server_ctx, tls_server_stapling_cb);
1275     SSL_CTX_set_tlsext_status_arg(server_ctx, cbinfo);
1276     }
1277 # endif
1278   /* We always do this, so that $tls_sni is available even if not used in
1279   tls_certificate */
1280   SSL_CTX_set_tlsext_servername_callback(*ctxp, tls_servername_cb);
1281   SSL_CTX_set_tlsext_servername_arg(*ctxp, cbinfo);
1282   }
1283 # ifndef DISABLE_OCSP
1284 else                    /* client */
1285   if(ocsp_file)         /* wanting stapling */
1286     {
1287     if (!(cbinfo->u_ocsp.client.verify_store = X509_STORE_new()))
1288       {
1289       DEBUG(D_tls) debug_printf("failed to create store for stapling verify\n");
1290       return FAIL;
1291       }
1292     SSL_CTX_set_tlsext_status_cb(*ctxp, tls_client_stapling_cb);
1293     SSL_CTX_set_tlsext_status_arg(*ctxp, cbinfo);
1294     }
1295 # endif
1296 #endif
1297
1298 cbinfo->verify_cert_hostnames = NULL;
1299
1300 /* Set up the RSA callback */
1301
1302 SSL_CTX_set_tmp_rsa_callback(*ctxp, rsa_callback);
1303
1304 /* Finally, set the timeout, and we are done */
1305
1306 SSL_CTX_set_timeout(*ctxp, ssl_session_timeout);
1307 DEBUG(D_tls) debug_printf("Initialized TLS\n");
1308
1309 *cbp = cbinfo;
1310
1311 return OK;
1312 }
1313
1314
1315
1316
1317 /*************************************************
1318 *           Get name of cipher in use            *
1319 *************************************************/
1320
1321 /*
1322 Argument:   pointer to an SSL structure for the connection
1323             buffer to use for answer
1324             size of buffer
1325             pointer to number of bits for cipher
1326 Returns:    nothing
1327 */
1328
1329 static void
1330 construct_cipher_name(SSL *ssl, uschar *cipherbuf, int bsize, int *bits)
1331 {
1332 /* With OpenSSL 1.0.0a, this needs to be const but the documentation doesn't
1333 yet reflect that.  It should be a safe change anyway, even 0.9.8 versions have
1334 the accessor functions use const in the prototype. */
1335 const SSL_CIPHER *c;
1336 const uschar *ver;
1337
1338 ver = (const uschar *)SSL_get_version(ssl);
1339
1340 c = (const SSL_CIPHER *) SSL_get_current_cipher(ssl);
1341 SSL_CIPHER_get_bits(c, bits);
1342
1343 string_format(cipherbuf, bsize, "%s:%s:%u", ver,
1344   SSL_CIPHER_get_name(c), *bits);
1345
1346 DEBUG(D_tls) debug_printf("Cipher: %s\n", cipherbuf);
1347 }
1348
1349
1350
1351
1352
1353 /*************************************************
1354 *        Set up for verifying certificates       *
1355 *************************************************/
1356
1357 /* Called by both client and server startup
1358
1359 Arguments:
1360   sctx          SSL_CTX* to initialise
1361   certs         certs file or NULL
1362   crl           CRL file or NULL
1363   host          NULL in a server; the remote host in a client
1364   optional      TRUE if called from a server for a host in tls_try_verify_hosts;
1365                 otherwise passed as FALSE
1366   cert_vfy_cb   Callback function for certificate verification
1367
1368 Returns:        OK/DEFER/FAIL
1369 */
1370
1371 static int
1372 setup_certs(SSL_CTX *sctx, uschar *certs, uschar *crl, host_item *host, BOOL optional,
1373     int (*cert_vfy_cb)(int, X509_STORE_CTX *) )
1374 {
1375 uschar *expcerts, *expcrl;
1376
1377 if (!expand_check(certs, US"tls_verify_certificates", &expcerts))
1378   return DEFER;
1379
1380 if (expcerts != NULL && *expcerts != '\0')
1381   {
1382   if (Ustrcmp(expcerts, "system") == 0)
1383     {
1384     /* Tell the library to use its compiled-in location for the system default
1385     CA bundle, only */
1386
1387     if (!SSL_CTX_set_default_verify_paths(sctx))
1388       return tls_error(US"SSL_CTX_set_default_verify_paths", host, NULL);
1389     }
1390   else
1391     {
1392     struct stat statbuf;
1393
1394     /* Tell the library to use its compiled-in location for the system default
1395     CA bundle. Those given by the exim config are additional to these */
1396
1397     if (!SSL_CTX_set_default_verify_paths(sctx))
1398       return tls_error(US"SSL_CTX_set_default_verify_paths", host, NULL);
1399
1400     if (Ustat(expcerts, &statbuf) < 0)
1401       {
1402       log_write(0, LOG_MAIN|LOG_PANIC,
1403         "failed to stat %s for certificates", expcerts);
1404       return DEFER;
1405       }
1406     else
1407       {
1408       uschar *file, *dir;
1409       if ((statbuf.st_mode & S_IFMT) == S_IFDIR)
1410         { file = NULL; dir = expcerts; }
1411       else
1412         { file = expcerts; dir = NULL; }
1413
1414       /* If a certificate file is empty, the next function fails with an
1415       unhelpful error message. If we skip it, we get the correct behaviour (no
1416       certificates are recognized, but the error message is still misleading (it
1417       says no certificate was supplied.) But this is better. */
1418
1419       if ((file == NULL || statbuf.st_size > 0) &&
1420             !SSL_CTX_load_verify_locations(sctx, CS file, CS dir))
1421         return tls_error(US"SSL_CTX_load_verify_locations", host, NULL);
1422
1423       /* Load the list of CAs for which we will accept certs, for sending
1424       to the client.  This is only for the one-file tls_verify_certificates
1425       variant.
1426       If a list isn't loaded into the server, but
1427       some verify locations are set, the server end appears to make
1428       a wildcard reqest for client certs.
1429       Meanwhile, the client library as deafult behaviour *ignores* the list
1430       we send over the wire - see man SSL_CTX_set_client_cert_cb.
1431       Because of this, and that the dir variant is likely only used for
1432       the public-CA bundle (not for a private CA), not worth fixing.
1433       */
1434       if (file != NULL)
1435         {
1436         STACK_OF(X509_NAME) * names = SSL_load_client_CA_file(CS file);
1437   DEBUG(D_tls) debug_printf("Added %d certificate authorities.\n",
1438                                     sk_X509_NAME_num(names));
1439         SSL_CTX_set_client_CA_list(sctx, names);
1440         }
1441       }
1442     }
1443
1444   /* Handle a certificate revocation list. */
1445
1446   #if OPENSSL_VERSION_NUMBER > 0x00907000L
1447
1448   /* This bit of code is now the version supplied by Lars Mainka. (I have
1449    * merely reformatted it into the Exim code style.)
1450
1451    * "From here I changed the code to add support for multiple crl's
1452    * in pem format in one file or to support hashed directory entries in
1453    * pem format instead of a file. This method now uses the library function
1454    * X509_STORE_load_locations to add the CRL location to the SSL context.
1455    * OpenSSL will then handle the verify against CA certs and CRLs by
1456    * itself in the verify callback." */
1457
1458   if (!expand_check(crl, US"tls_crl", &expcrl)) return DEFER;
1459   if (expcrl != NULL && *expcrl != 0)
1460     {
1461     struct stat statbufcrl;
1462     if (Ustat(expcrl, &statbufcrl) < 0)
1463       {
1464       log_write(0, LOG_MAIN|LOG_PANIC,
1465         "failed to stat %s for certificates revocation lists", expcrl);
1466       return DEFER;
1467       }
1468     else
1469       {
1470       /* is it a file or directory? */
1471       uschar *file, *dir;
1472       X509_STORE *cvstore = SSL_CTX_get_cert_store(sctx);
1473       if ((statbufcrl.st_mode & S_IFMT) == S_IFDIR)
1474         {
1475         file = NULL;
1476         dir = expcrl;
1477         DEBUG(D_tls) debug_printf("SSL CRL value is a directory %s\n", dir);
1478         }
1479       else
1480         {
1481         file = expcrl;
1482         dir = NULL;
1483         DEBUG(D_tls) debug_printf("SSL CRL value is a file %s\n", file);
1484         }
1485       if (X509_STORE_load_locations(cvstore, CS file, CS dir) == 0)
1486         return tls_error(US"X509_STORE_load_locations", host, NULL);
1487
1488       /* setting the flags to check against the complete crl chain */
1489
1490       X509_STORE_set_flags(cvstore,
1491         X509_V_FLAG_CRL_CHECK|X509_V_FLAG_CRL_CHECK_ALL);
1492       }
1493     }
1494
1495   #endif  /* OPENSSL_VERSION_NUMBER > 0x00907000L */
1496
1497   /* If verification is optional, don't fail if no certificate */
1498
1499   SSL_CTX_set_verify(sctx,
1500     SSL_VERIFY_PEER | (optional? 0 : SSL_VERIFY_FAIL_IF_NO_PEER_CERT),
1501     cert_vfy_cb);
1502   }
1503
1504 return OK;
1505 }
1506
1507
1508
1509 /*************************************************
1510 *       Start a TLS session in a server          *
1511 *************************************************/
1512
1513 /* This is called when Exim is running as a server, after having received
1514 the STARTTLS command. It must respond to that command, and then negotiate
1515 a TLS session.
1516
1517 Arguments:
1518   require_ciphers   allowed ciphers
1519
1520 Returns:            OK on success
1521                     DEFER for errors before the start of the negotiation
1522                     FAIL for errors during the negotation; the server can't
1523                       continue running.
1524 */
1525
1526 int
1527 tls_server_start(const uschar *require_ciphers)
1528 {
1529 int rc;
1530 uschar *expciphers;
1531 tls_ext_ctx_cb *cbinfo;
1532 static uschar cipherbuf[256];
1533
1534 /* Check for previous activation */
1535
1536 if (tls_in.active >= 0)
1537   {
1538   tls_error(US"STARTTLS received after TLS started", NULL, US"");
1539   smtp_printf("554 Already in TLS\r\n");
1540   return FAIL;
1541   }
1542
1543 /* Initialize the SSL library. If it fails, it will already have logged
1544 the error. */
1545
1546 rc = tls_init(&server_ctx, NULL, tls_dhparam, tls_certificate, tls_privatekey,
1547 #ifndef DISABLE_OCSP
1548     tls_ocsp_file,
1549 #endif
1550     NULL, &server_static_cbinfo);
1551 if (rc != OK) return rc;
1552 cbinfo = server_static_cbinfo;
1553
1554 if (!expand_check(require_ciphers, US"tls_require_ciphers", &expciphers))
1555   return FAIL;
1556
1557 /* In OpenSSL, cipher components are separated by hyphens. In GnuTLS, they
1558 were historically separated by underscores. So that I can use either form in my
1559 tests, and also for general convenience, we turn underscores into hyphens here.
1560 */
1561
1562 if (expciphers != NULL)
1563   {
1564   uschar *s = expciphers;
1565   while (*s != 0) { if (*s == '_') *s = '-'; s++; }
1566   DEBUG(D_tls) debug_printf("required ciphers: %s\n", expciphers);
1567   if (!SSL_CTX_set_cipher_list(server_ctx, CS expciphers))
1568     return tls_error(US"SSL_CTX_set_cipher_list", NULL, NULL);
1569   cbinfo->server_cipher_list = expciphers;
1570   }
1571
1572 /* If this is a host for which certificate verification is mandatory or
1573 optional, set up appropriately. */
1574
1575 tls_in.certificate_verified = FALSE;
1576 #ifdef EXPERIMENTAL_DANE
1577 tls_in.dane_verified = FALSE;
1578 #endif
1579 server_verify_callback_called = FALSE;
1580
1581 if (verify_check_host(&tls_verify_hosts) == OK)
1582   {
1583   rc = setup_certs(server_ctx, tls_verify_certificates, tls_crl, NULL,
1584                         FALSE, verify_callback_server);
1585   if (rc != OK) return rc;
1586   server_verify_optional = FALSE;
1587   }
1588 else if (verify_check_host(&tls_try_verify_hosts) == OK)
1589   {
1590   rc = setup_certs(server_ctx, tls_verify_certificates, tls_crl, NULL,
1591                         TRUE, verify_callback_server);
1592   if (rc != OK) return rc;
1593   server_verify_optional = TRUE;
1594   }
1595
1596 /* Prepare for new connection */
1597
1598 if ((server_ssl = SSL_new(server_ctx)) == NULL) return tls_error(US"SSL_new", NULL, NULL);
1599
1600 /* Warning: we used to SSL_clear(ssl) here, it was removed.
1601  *
1602  * With the SSL_clear(), we get strange interoperability bugs with
1603  * OpenSSL 1.0.1b and TLS1.1/1.2.  It looks as though this may be a bug in
1604  * OpenSSL itself, as a clear should not lead to inability to follow protocols.
1605  *
1606  * The SSL_clear() call is to let an existing SSL* be reused, typically after
1607  * session shutdown.  In this case, we have a brand new object and there's no
1608  * obvious reason to immediately clear it.  I'm guessing that this was
1609  * originally added because of incomplete initialisation which the clear fixed,
1610  * in some historic release.
1611  */
1612
1613 /* Set context and tell client to go ahead, except in the case of TLS startup
1614 on connection, where outputting anything now upsets the clients and tends to
1615 make them disconnect. We need to have an explicit fflush() here, to force out
1616 the response. Other smtp_printf() calls do not need it, because in non-TLS
1617 mode, the fflush() happens when smtp_getc() is called. */
1618
1619 SSL_set_session_id_context(server_ssl, sid_ctx, Ustrlen(sid_ctx));
1620 if (!tls_in.on_connect)
1621   {
1622   smtp_printf("220 TLS go ahead\r\n");
1623   fflush(smtp_out);
1624   }
1625
1626 /* Now negotiate the TLS session. We put our own timer on it, since it seems
1627 that the OpenSSL library doesn't. */
1628
1629 SSL_set_wfd(server_ssl, fileno(smtp_out));
1630 SSL_set_rfd(server_ssl, fileno(smtp_in));
1631 SSL_set_accept_state(server_ssl);
1632
1633 DEBUG(D_tls) debug_printf("Calling SSL_accept\n");
1634
1635 sigalrm_seen = FALSE;
1636 if (smtp_receive_timeout > 0) alarm(smtp_receive_timeout);
1637 rc = SSL_accept(server_ssl);
1638 alarm(0);
1639
1640 if (rc <= 0)
1641   {
1642   tls_error(US"SSL_accept", NULL, sigalrm_seen ? US"timed out" : NULL);
1643   if (ERR_get_error() == 0)
1644     log_write(0, LOG_MAIN,
1645         "TLS client disconnected cleanly (rejected our certificate?)");
1646   return FAIL;
1647   }
1648
1649 DEBUG(D_tls) debug_printf("SSL_accept was successful\n");
1650
1651 /* TLS has been set up. Adjust the input functions to read via TLS,
1652 and initialize things. */
1653
1654 construct_cipher_name(server_ssl, cipherbuf, sizeof(cipherbuf), &tls_in.bits);
1655 tls_in.cipher = cipherbuf;
1656
1657 DEBUG(D_tls)
1658   {
1659   uschar buf[2048];
1660   if (SSL_get_shared_ciphers(server_ssl, CS buf, sizeof(buf)) != NULL)
1661     debug_printf("Shared ciphers: %s\n", buf);
1662   }
1663
1664 /* Record the certificate we presented */
1665   {
1666   X509 * crt = SSL_get_certificate(server_ssl);
1667   tls_in.ourcert = crt ? X509_dup(crt) : NULL;
1668   }
1669
1670 /* Only used by the server-side tls (tls_in), including tls_getc.
1671    Client-side (tls_out) reads (seem to?) go via
1672    smtp_read_response()/ip_recv().
1673    Hence no need to duplicate for _in and _out.
1674  */
1675 ssl_xfer_buffer = store_malloc(ssl_xfer_buffer_size);
1676 ssl_xfer_buffer_lwm = ssl_xfer_buffer_hwm = 0;
1677 ssl_xfer_eof = ssl_xfer_error = 0;
1678
1679 receive_getc = tls_getc;
1680 receive_ungetc = tls_ungetc;
1681 receive_feof = tls_feof;
1682 receive_ferror = tls_ferror;
1683 receive_smtp_buffered = tls_smtp_buffered;
1684
1685 tls_in.active = fileno(smtp_out);
1686 return OK;
1687 }
1688
1689
1690
1691
1692 static int
1693 tls_client_basic_ctx_init(SSL_CTX * ctx,
1694     host_item * host, smtp_transport_options_block * ob, tls_ext_ctx_cb * cbinfo
1695                           )
1696 {
1697 int rc;
1698 /* stick to the old behaviour for compatibility if tls_verify_certificates is
1699    set but both tls_verify_hosts and tls_try_verify_hosts is not set. Check only
1700    the specified host patterns if one of them is defined */
1701
1702 if (  (  !ob->tls_verify_hosts
1703       && (!ob->tls_try_verify_hosts || !*ob->tls_try_verify_hosts)
1704       )
1705    || (verify_check_given_host(&ob->tls_verify_hosts, host) == OK)
1706    )
1707   client_verify_optional = FALSE;
1708 else if (verify_check_given_host(&ob->tls_try_verify_hosts, host) == OK)
1709   client_verify_optional = TRUE;
1710 else
1711   return OK;
1712
1713 if ((rc = setup_certs(ctx, ob->tls_verify_certificates,
1714       ob->tls_crl, host, client_verify_optional, verify_callback_client)) != OK)
1715   return rc;
1716
1717 if (verify_check_given_host(&ob->tls_verify_cert_hostnames, host) == OK)
1718   {
1719   cbinfo->verify_cert_hostnames = host->name;
1720   DEBUG(D_tls) debug_printf("Cert hostname to check: \"%s\"\n",
1721                     cbinfo->verify_cert_hostnames);
1722   }
1723 return OK;
1724 }
1725
1726
1727 #ifdef EXPERIMENTAL_DANE
1728 static int
1729 dane_tlsa_load(SSL * ssl, host_item * host, dns_answer * dnsa)
1730 {
1731 dns_record * rr;
1732 dns_scan dnss;
1733 const char * hostnames[2] = { CS host->name, NULL };
1734 int found = 0;
1735
1736 if (DANESSL_init(ssl, NULL, hostnames) != 1)
1737   return tls_error(US"hostnames load", host, NULL);
1738
1739 for (rr = dns_next_rr(dnsa, &dnss, RESET_ANSWERS);
1740      rr;
1741      rr = dns_next_rr(dnsa, &dnss, RESET_NEXT)
1742     ) if (rr->type == T_TLSA)
1743   {
1744   uschar * p = rr->data;
1745   uint8_t usage, selector, mtype;
1746   const char * mdname;
1747
1748   usage = *p++;
1749
1750   /* Only DANE-TA(2) and DANE-EE(3) are supported */
1751   if (usage != 2 && usage != 3) continue;
1752
1753   selector = *p++;
1754   mtype = *p++;
1755
1756   switch (mtype)
1757     {
1758     default: continue;  /* Only match-types 0, 1, 2 are supported */
1759     case 0:  mdname = NULL; break;
1760     case 1:  mdname = "sha256"; break;
1761     case 2:  mdname = "sha512"; break;
1762     }
1763
1764   found++;
1765   switch (DANESSL_add_tlsa(ssl, usage, selector, mdname, p, rr->size - 3))
1766     {
1767     default:
1768     case 0:     /* action not taken */
1769       return tls_error(US"tlsa load", host, NULL);
1770     case 1:     break;
1771     }
1772
1773   tls_out.tlsa_usage |= 1<<usage;
1774   }
1775
1776 if (found)
1777   return OK;
1778
1779 log_write(0, LOG_MAIN, "DANE error: No usable TLSA records");
1780 return DEFER;
1781 }
1782 #endif  /*EXPERIMENTAL_DANE*/
1783
1784
1785
1786 /*************************************************
1787 *    Start a TLS session in a client             *
1788 *************************************************/
1789
1790 /* Called from the smtp transport after STARTTLS has been accepted.
1791
1792 Argument:
1793   fd               the fd of the connection
1794   host             connected host (for messages)
1795   addr             the first address
1796   tb               transport (always smtp)
1797   tlsa_dnsa        tlsa lookup, if DANE, else null
1798
1799 Returns:           OK on success
1800                    FAIL otherwise - note that tls_error() will not give DEFER
1801                      because this is not a server
1802 */
1803
1804 int
1805 tls_client_start(int fd, host_item *host, address_item *addr,
1806   transport_instance *tb
1807 #ifdef EXPERIMENTAL_DANE
1808   , dns_answer * tlsa_dnsa
1809 #endif
1810   )
1811 {
1812 smtp_transport_options_block * ob =
1813   (smtp_transport_options_block *)tb->options_block;
1814 static uschar txt[256];
1815 uschar * expciphers;
1816 X509 * server_cert;
1817 int rc;
1818 static uschar cipherbuf[256];
1819
1820 #ifndef DISABLE_OCSP
1821 BOOL request_ocsp = FALSE;
1822 BOOL require_ocsp = FALSE;
1823 #endif
1824
1825 #ifdef EXPERIMENTAL_DANE
1826 tls_out.tlsa_usage = 0;
1827 #endif
1828
1829 #ifndef DISABLE_OCSP
1830   {
1831 # ifdef EXPERIMENTAL_DANE
1832   if (  tlsa_dnsa
1833      && ob->hosts_request_ocsp[0] == '*'
1834      && ob->hosts_request_ocsp[1] == '\0'
1835      )
1836     {
1837     /* Unchanged from default.  Use a safer one under DANE */
1838     request_ocsp = TRUE;
1839     ob->hosts_request_ocsp = US"${if or { {= {0}{$tls_out_tlsa_usage}} "
1840                                       "   {= {4}{$tls_out_tlsa_usage}} } "
1841                                  " {*}{}}";
1842     }
1843 # endif
1844
1845   if ((require_ocsp =
1846         verify_check_given_host(&ob->hosts_require_ocsp, host) == OK))
1847     request_ocsp = TRUE;
1848   else
1849 # ifdef EXPERIMENTAL_DANE
1850     if (!request_ocsp)
1851 # endif
1852       request_ocsp =
1853         verify_check_given_host(&ob->hosts_request_ocsp, host) == OK;
1854   }
1855 #endif
1856
1857 rc = tls_init(&client_ctx, host, NULL,
1858     ob->tls_certificate, ob->tls_privatekey,
1859 #ifndef DISABLE_OCSP
1860     (void *)(long)request_ocsp,
1861 #endif
1862     addr, &client_static_cbinfo);
1863 if (rc != OK) return rc;
1864
1865 tls_out.certificate_verified = FALSE;
1866 client_verify_callback_called = FALSE;
1867
1868 if (!expand_check(ob->tls_require_ciphers, US"tls_require_ciphers",
1869     &expciphers))
1870   return FAIL;
1871
1872 /* In OpenSSL, cipher components are separated by hyphens. In GnuTLS, they
1873 are separated by underscores. So that I can use either form in my tests, and
1874 also for general convenience, we turn underscores into hyphens here. */
1875
1876 if (expciphers != NULL)
1877   {
1878   uschar *s = expciphers;
1879   while (*s != 0) { if (*s == '_') *s = '-'; s++; }
1880   DEBUG(D_tls) debug_printf("required ciphers: %s\n", expciphers);
1881   if (!SSL_CTX_set_cipher_list(client_ctx, CS expciphers))
1882     return tls_error(US"SSL_CTX_set_cipher_list", host, NULL);
1883   }
1884
1885 #ifdef EXPERIMENTAL_DANE
1886 if (tlsa_dnsa)
1887   {
1888   SSL_CTX_set_verify(client_ctx,
1889     SSL_VERIFY_PEER | SSL_VERIFY_FAIL_IF_NO_PEER_CERT,
1890     verify_callback_client_dane);
1891
1892   if (!DANESSL_library_init())
1893     return tls_error(US"library init", host, NULL);
1894   if (DANESSL_CTX_init(client_ctx) <= 0)
1895     return tls_error(US"context init", host, NULL);
1896   }
1897 else
1898
1899 #endif
1900
1901   if ((rc = tls_client_basic_ctx_init(client_ctx, host, ob, client_static_cbinfo))
1902       != OK)
1903     return rc;
1904
1905 if ((client_ssl = SSL_new(client_ctx)) == NULL)
1906   return tls_error(US"SSL_new", host, NULL);
1907 SSL_set_session_id_context(client_ssl, sid_ctx, Ustrlen(sid_ctx));
1908 SSL_set_fd(client_ssl, fd);
1909 SSL_set_connect_state(client_ssl);
1910
1911 if (ob->tls_sni)
1912   {
1913   if (!expand_check(ob->tls_sni, US"tls_sni", &tls_out.sni))
1914     return FAIL;
1915   if (tls_out.sni == NULL)
1916     {
1917     DEBUG(D_tls) debug_printf("Setting TLS SNI forced to fail, not sending\n");
1918     }
1919   else if (!Ustrlen(tls_out.sni))
1920     tls_out.sni = NULL;
1921   else
1922     {
1923 #ifdef EXIM_HAVE_OPENSSL_TLSEXT
1924     DEBUG(D_tls) debug_printf("Setting TLS SNI \"%s\"\n", tls_out.sni);
1925     SSL_set_tlsext_host_name(client_ssl, tls_out.sni);
1926 #else
1927     DEBUG(D_tls)
1928       debug_printf("OpenSSL at build-time lacked SNI support, ignoring \"%s\"\n",
1929           tls_out.sni);
1930 #endif
1931     }
1932   }
1933
1934 #ifdef EXPERIMENTAL_DANE
1935 if (tlsa_dnsa)
1936   if ((rc = dane_tlsa_load(client_ssl, host, tlsa_dnsa)) != OK)
1937     return rc;
1938 #endif
1939
1940 #ifndef DISABLE_OCSP
1941 /* Request certificate status at connection-time.  If the server
1942 does OCSP stapling we will get the callback (set in tls_init()) */
1943 # ifdef EXPERIMENTAL_DANE
1944 if (request_ocsp)
1945   {
1946   const uschar * s;
1947   if (  ((s = ob->hosts_require_ocsp) && Ustrstr(s, US"tls_out_tlsa_usage"))
1948      || ((s = ob->hosts_request_ocsp) && Ustrstr(s, US"tls_out_tlsa_usage"))
1949      )
1950     {   /* Re-eval now $tls_out_tlsa_usage is populated.  If
1951         this means we avoid the OCSP request, we wasted the setup
1952         cost in tls_init(). */
1953     require_ocsp = verify_check_given_host(&ob->hosts_require_ocsp, host) == OK;
1954     request_ocsp = require_ocsp
1955       || verify_check_given_host(&ob->hosts_request_ocsp, host) == OK;
1956     }
1957   }
1958 # endif
1959
1960 if (request_ocsp)
1961   {
1962   SSL_set_tlsext_status_type(client_ssl, TLSEXT_STATUSTYPE_ocsp);
1963   client_static_cbinfo->u_ocsp.client.verify_required = require_ocsp;
1964   tls_out.ocsp = OCSP_NOT_RESP;
1965   }
1966 #endif
1967
1968 #ifdef EXPERIMENTAL_EVENT
1969 client_static_cbinfo->event_action = tb->event_action;
1970 #endif
1971
1972 /* There doesn't seem to be a built-in timeout on connection. */
1973
1974 DEBUG(D_tls) debug_printf("Calling SSL_connect\n");
1975 sigalrm_seen = FALSE;
1976 alarm(ob->command_timeout);
1977 rc = SSL_connect(client_ssl);
1978 alarm(0);
1979
1980 #ifdef EXPERIMENTAL_DANE
1981 if (tlsa_dnsa)
1982   DANESSL_cleanup(client_ssl);
1983 #endif
1984
1985 if (rc <= 0)
1986   return tls_error(US"SSL_connect", host, sigalrm_seen ? US"timed out" : NULL);
1987
1988 DEBUG(D_tls) debug_printf("SSL_connect succeeded\n");
1989
1990 /* Beware anonymous ciphers which lead to server_cert being NULL */
1991 /*XXX server_cert is never freed... use X509_free() */
1992 server_cert = SSL_get_peer_certificate (client_ssl);
1993 if (server_cert)
1994   {
1995   tls_out.peerdn = US X509_NAME_oneline(X509_get_subject_name(server_cert),
1996     CS txt, sizeof(txt));
1997   txt[sizeof(txt)-1] = '\0';
1998   tls_out.peerdn = txt;         /*XXX a static buffer... */
1999   }
2000 else
2001   tls_out.peerdn = NULL;
2002
2003 construct_cipher_name(client_ssl, cipherbuf, sizeof(cipherbuf), &tls_out.bits);
2004 tls_out.cipher = cipherbuf;
2005
2006 /* Record the certificate we presented */
2007   {
2008   X509 * crt = SSL_get_certificate(client_ssl);
2009   tls_out.ourcert = crt ? X509_dup(crt) : NULL;
2010   }
2011
2012 tls_out.active = fd;
2013 return OK;
2014 }
2015
2016
2017
2018
2019
2020 /*************************************************
2021 *            TLS version of getc                 *
2022 *************************************************/
2023
2024 /* This gets the next byte from the TLS input buffer. If the buffer is empty,
2025 it refills the buffer via the SSL reading function.
2026
2027 Arguments:  none
2028 Returns:    the next character or EOF
2029
2030 Only used by the server-side TLS.
2031 */
2032
2033 int
2034 tls_getc(void)
2035 {
2036 if (ssl_xfer_buffer_lwm >= ssl_xfer_buffer_hwm)
2037   {
2038   int error;
2039   int inbytes;
2040
2041   DEBUG(D_tls) debug_printf("Calling SSL_read(%p, %p, %u)\n", server_ssl,
2042     ssl_xfer_buffer, ssl_xfer_buffer_size);
2043
2044   if (smtp_receive_timeout > 0) alarm(smtp_receive_timeout);
2045   inbytes = SSL_read(server_ssl, CS ssl_xfer_buffer, ssl_xfer_buffer_size);
2046   error = SSL_get_error(server_ssl, inbytes);
2047   alarm(0);
2048
2049   /* SSL_ERROR_ZERO_RETURN appears to mean that the SSL session has been
2050   closed down, not that the socket itself has been closed down. Revert to
2051   non-SSL handling. */
2052
2053   if (error == SSL_ERROR_ZERO_RETURN)
2054     {
2055     DEBUG(D_tls) debug_printf("Got SSL_ERROR_ZERO_RETURN\n");
2056
2057     receive_getc = smtp_getc;
2058     receive_ungetc = smtp_ungetc;
2059     receive_feof = smtp_feof;
2060     receive_ferror = smtp_ferror;
2061     receive_smtp_buffered = smtp_buffered;
2062
2063     SSL_free(server_ssl);
2064     server_ssl = NULL;
2065     tls_in.active = -1;
2066     tls_in.bits = 0;
2067     tls_in.cipher = NULL;
2068     tls_in.peerdn = NULL;
2069     tls_in.sni = NULL;
2070
2071     return smtp_getc();
2072     }
2073
2074   /* Handle genuine errors */
2075
2076   else if (error == SSL_ERROR_SSL)
2077     {
2078     ERR_error_string(ERR_get_error(), ssl_errstring);
2079     log_write(0, LOG_MAIN, "TLS error (SSL_read): %s", ssl_errstring);
2080     ssl_xfer_error = 1;
2081     return EOF;
2082     }
2083
2084   else if (error != SSL_ERROR_NONE)
2085     {
2086     DEBUG(D_tls) debug_printf("Got SSL error %d\n", error);
2087     ssl_xfer_error = 1;
2088     return EOF;
2089     }
2090
2091 #ifndef DISABLE_DKIM
2092   dkim_exim_verify_feed(ssl_xfer_buffer, inbytes);
2093 #endif
2094   ssl_xfer_buffer_hwm = inbytes;
2095   ssl_xfer_buffer_lwm = 0;
2096   }
2097
2098 /* Something in the buffer; return next uschar */
2099
2100 return ssl_xfer_buffer[ssl_xfer_buffer_lwm++];
2101 }
2102
2103
2104
2105 /*************************************************
2106 *          Read bytes from TLS channel           *
2107 *************************************************/
2108
2109 /*
2110 Arguments:
2111   buff      buffer of data
2112   len       size of buffer
2113
2114 Returns:    the number of bytes read
2115             -1 after a failed read
2116
2117 Only used by the client-side TLS.
2118 */
2119
2120 int
2121 tls_read(BOOL is_server, uschar *buff, size_t len)
2122 {
2123 SSL *ssl = is_server ? server_ssl : client_ssl;
2124 int inbytes;
2125 int error;
2126
2127 DEBUG(D_tls) debug_printf("Calling SSL_read(%p, %p, %u)\n", ssl,
2128   buff, (unsigned int)len);
2129
2130 inbytes = SSL_read(ssl, CS buff, len);
2131 error = SSL_get_error(ssl, inbytes);
2132
2133 if (error == SSL_ERROR_ZERO_RETURN)
2134   {
2135   DEBUG(D_tls) debug_printf("Got SSL_ERROR_ZERO_RETURN\n");
2136   return -1;
2137   }
2138 else if (error != SSL_ERROR_NONE)
2139   {
2140   return -1;
2141   }
2142
2143 return inbytes;
2144 }
2145
2146
2147
2148
2149
2150 /*************************************************
2151 *         Write bytes down TLS channel           *
2152 *************************************************/
2153
2154 /*
2155 Arguments:
2156   is_server channel specifier
2157   buff      buffer of data
2158   len       number of bytes
2159
2160 Returns:    the number of bytes after a successful write,
2161             -1 after a failed write
2162
2163 Used by both server-side and client-side TLS.
2164 */
2165
2166 int
2167 tls_write(BOOL is_server, const uschar *buff, size_t len)
2168 {
2169 int outbytes;
2170 int error;
2171 int left = len;
2172 SSL *ssl = is_server ? server_ssl : client_ssl;
2173
2174 DEBUG(D_tls) debug_printf("tls_do_write(%p, %d)\n", buff, left);
2175 while (left > 0)
2176   {
2177   DEBUG(D_tls) debug_printf("SSL_write(SSL, %p, %d)\n", buff, left);
2178   outbytes = SSL_write(ssl, CS buff, left);
2179   error = SSL_get_error(ssl, outbytes);
2180   DEBUG(D_tls) debug_printf("outbytes=%d error=%d\n", outbytes, error);
2181   switch (error)
2182     {
2183     case SSL_ERROR_SSL:
2184     ERR_error_string(ERR_get_error(), ssl_errstring);
2185     log_write(0, LOG_MAIN, "TLS error (SSL_write): %s", ssl_errstring);
2186     return -1;
2187
2188     case SSL_ERROR_NONE:
2189     left -= outbytes;
2190     buff += outbytes;
2191     break;
2192
2193     case SSL_ERROR_ZERO_RETURN:
2194     log_write(0, LOG_MAIN, "SSL channel closed on write");
2195     return -1;
2196
2197     case SSL_ERROR_SYSCALL:
2198     log_write(0, LOG_MAIN, "SSL_write: (from %s) syscall: %s",
2199       sender_fullhost ? sender_fullhost : US"<unknown>",
2200       strerror(errno));
2201
2202     default:
2203     log_write(0, LOG_MAIN, "SSL_write error %d", error);
2204     return -1;
2205     }
2206   }
2207 return len;
2208 }
2209
2210
2211
2212 /*************************************************
2213 *         Close down a TLS session               *
2214 *************************************************/
2215
2216 /* This is also called from within a delivery subprocess forked from the
2217 daemon, to shut down the TLS library, without actually doing a shutdown (which
2218 would tamper with the SSL session in the parent process).
2219
2220 Arguments:   TRUE if SSL_shutdown is to be called
2221 Returns:     nothing
2222
2223 Used by both server-side and client-side TLS.
2224 */
2225
2226 void
2227 tls_close(BOOL is_server, BOOL shutdown)
2228 {
2229 SSL **sslp = is_server ? &server_ssl : &client_ssl;
2230 int *fdp = is_server ? &tls_in.active : &tls_out.active;
2231
2232 if (*fdp < 0) return;  /* TLS was not active */
2233
2234 if (shutdown)
2235   {
2236   DEBUG(D_tls) debug_printf("tls_close(): shutting down SSL\n");
2237   SSL_shutdown(*sslp);
2238   }
2239
2240 SSL_free(*sslp);
2241 *sslp = NULL;
2242
2243 *fdp = -1;
2244 }
2245
2246
2247
2248
2249 /*************************************************
2250 *  Let tls_require_ciphers be checked at startup *
2251 *************************************************/
2252
2253 /* The tls_require_ciphers option, if set, must be something which the
2254 library can parse.
2255
2256 Returns:     NULL on success, or error message
2257 */
2258
2259 uschar *
2260 tls_validate_require_cipher(void)
2261 {
2262 SSL_CTX *ctx;
2263 uschar *s, *expciphers, *err;
2264
2265 /* this duplicates from tls_init(), we need a better "init just global
2266 state, for no specific purpose" singleton function of our own */
2267
2268 SSL_load_error_strings();
2269 OpenSSL_add_ssl_algorithms();
2270 #if (OPENSSL_VERSION_NUMBER >= 0x0090800fL) && !defined(OPENSSL_NO_SHA256)
2271 /* SHA256 is becoming ever more popular. This makes sure it gets added to the
2272 list of available digests. */
2273 EVP_add_digest(EVP_sha256());
2274 #endif
2275
2276 if (!(tls_require_ciphers && *tls_require_ciphers))
2277   return NULL;
2278
2279 if (!expand_check(tls_require_ciphers, US"tls_require_ciphers", &expciphers))
2280   return US"failed to expand tls_require_ciphers";
2281
2282 if (!(expciphers && *expciphers))
2283   return NULL;
2284
2285 /* normalisation ripped from above */
2286 s = expciphers;
2287 while (*s != 0) { if (*s == '_') *s = '-'; s++; }
2288
2289 err = NULL;
2290
2291 ctx = SSL_CTX_new(SSLv23_server_method());
2292 if (!ctx)
2293   {
2294   ERR_error_string(ERR_get_error(), ssl_errstring);
2295   return string_sprintf("SSL_CTX_new() failed: %s", ssl_errstring);
2296   }
2297
2298 DEBUG(D_tls)
2299   debug_printf("tls_require_ciphers expands to \"%s\"\n", expciphers);
2300
2301 if (!SSL_CTX_set_cipher_list(ctx, CS expciphers))
2302   {
2303   ERR_error_string(ERR_get_error(), ssl_errstring);
2304   err = string_sprintf("SSL_CTX_set_cipher_list(%s) failed", expciphers);
2305   }
2306
2307 SSL_CTX_free(ctx);
2308
2309 return err;
2310 }
2311
2312
2313
2314
2315 /*************************************************
2316 *         Report the library versions.           *
2317 *************************************************/
2318
2319 /* There have historically been some issues with binary compatibility in
2320 OpenSSL libraries; if Exim (like many other applications) is built against
2321 one version of OpenSSL but the run-time linker picks up another version,
2322 it can result in serious failures, including crashing with a SIGSEGV.  So
2323 report the version found by the compiler and the run-time version.
2324
2325 Note: some OS vendors backport security fixes without changing the version
2326 number/string, and the version date remains unchanged.  The _build_ date
2327 will change, so we can more usefully assist with version diagnosis by also
2328 reporting the build date.
2329
2330 Arguments:   a FILE* to print the results to
2331 Returns:     nothing
2332 */
2333
2334 void
2335 tls_version_report(FILE *f)
2336 {
2337 fprintf(f, "Library version: OpenSSL: Compile: %s\n"
2338            "                          Runtime: %s\n"
2339            "                                 : %s\n",
2340            OPENSSL_VERSION_TEXT,
2341            SSLeay_version(SSLEAY_VERSION),
2342            SSLeay_version(SSLEAY_BUILT_ON));
2343 /* third line is 38 characters for the %s and the line is 73 chars long;
2344 the OpenSSL output includes a "built on: " prefix already. */
2345 }
2346
2347
2348
2349
2350 /*************************************************
2351 *            Random number generation            *
2352 *************************************************/
2353
2354 /* Pseudo-random number generation.  The result is not expected to be
2355 cryptographically strong but not so weak that someone will shoot themselves
2356 in the foot using it as a nonce in input in some email header scheme or
2357 whatever weirdness they'll twist this into.  The result should handle fork()
2358 and avoid repeating sequences.  OpenSSL handles that for us.
2359
2360 Arguments:
2361   max       range maximum
2362 Returns     a random number in range [0, max-1]
2363 */
2364
2365 int
2366 vaguely_random_number(int max)
2367 {
2368 unsigned int r;
2369 int i, needed_len;
2370 static pid_t pidlast = 0;
2371 pid_t pidnow;
2372 uschar *p;
2373 uschar smallbuf[sizeof(r)];
2374
2375 if (max <= 1)
2376   return 0;
2377
2378 pidnow = getpid();
2379 if (pidnow != pidlast)
2380   {
2381   /* Although OpenSSL documents that "OpenSSL makes sure that the PRNG state
2382   is unique for each thread", this doesn't apparently apply across processes,
2383   so our own warning from vaguely_random_number_fallback() applies here too.
2384   Fix per PostgreSQL. */
2385   if (pidlast != 0)
2386     RAND_cleanup();
2387   pidlast = pidnow;
2388   }
2389
2390 /* OpenSSL auto-seeds from /dev/random, etc, but this a double-check. */
2391 if (!RAND_status())
2392   {
2393   randstuff r;
2394   gettimeofday(&r.tv, NULL);
2395   r.p = getpid();
2396
2397   RAND_seed((uschar *)(&r), sizeof(r));
2398   }
2399 /* We're after pseudo-random, not random; if we still don't have enough data
2400 in the internal PRNG then our options are limited.  We could sleep and hope
2401 for entropy to come along (prayer technique) but if the system is so depleted
2402 in the first place then something is likely to just keep taking it.  Instead,
2403 we'll just take whatever little bit of pseudo-random we can still manage to
2404 get. */
2405
2406 needed_len = sizeof(r);
2407 /* Don't take 8 times more entropy than needed if int is 8 octets and we were
2408 asked for a number less than 10. */
2409 for (r = max, i = 0; r; ++i)
2410   r >>= 1;
2411 i = (i + 7) / 8;
2412 if (i < needed_len)
2413   needed_len = i;
2414
2415 /* We do not care if crypto-strong */
2416 i = RAND_pseudo_bytes(smallbuf, needed_len);
2417 if (i < 0)
2418   {
2419   DEBUG(D_all)
2420     debug_printf("OpenSSL RAND_pseudo_bytes() not supported by RAND method, using fallback.\n");
2421   return vaguely_random_number_fallback(max);
2422   }
2423
2424 r = 0;
2425 for (p = smallbuf; needed_len; --needed_len, ++p)
2426   {
2427   r *= 256;
2428   r += *p;
2429   }
2430
2431 /* We don't particularly care about weighted results; if someone wants
2432 smooth distribution and cares enough then they should submit a patch then. */
2433 return r % max;
2434 }
2435
2436
2437
2438
2439 /*************************************************
2440 *        OpenSSL option parse                    *
2441 *************************************************/
2442
2443 /* Parse one option for tls_openssl_options_parse below
2444
2445 Arguments:
2446   name    one option name
2447   value   place to store a value for it
2448 Returns   success or failure in parsing
2449 */
2450
2451 struct exim_openssl_option {
2452   uschar *name;
2453   long    value;
2454 };
2455 /* We could use a macro to expand, but we need the ifdef and not all the
2456 options document which version they were introduced in.  Policylet: include
2457 all options unless explicitly for DTLS, let the administrator choose which
2458 to apply.
2459
2460 This list is current as of:
2461   ==>  1.0.1b  <==
2462 Plus SSL_OP_SAFARI_ECDHE_ECDSA_BUG from 2013-June patch/discussion on openssl-dev
2463 */
2464 static struct exim_openssl_option exim_openssl_options[] = {
2465 /* KEEP SORTED ALPHABETICALLY! */
2466 #ifdef SSL_OP_ALL
2467   { US"all", SSL_OP_ALL },
2468 #endif
2469 #ifdef SSL_OP_ALLOW_UNSAFE_LEGACY_RENEGOTIATION
2470   { US"allow_unsafe_legacy_renegotiation", SSL_OP_ALLOW_UNSAFE_LEGACY_RENEGOTIATION },
2471 #endif
2472 #ifdef SSL_OP_CIPHER_SERVER_PREFERENCE
2473   { US"cipher_server_preference", SSL_OP_CIPHER_SERVER_PREFERENCE },
2474 #endif
2475 #ifdef SSL_OP_DONT_INSERT_EMPTY_FRAGMENTS
2476   { US"dont_insert_empty_fragments", SSL_OP_DONT_INSERT_EMPTY_FRAGMENTS },
2477 #endif
2478 #ifdef SSL_OP_EPHEMERAL_RSA
2479   { US"ephemeral_rsa", SSL_OP_EPHEMERAL_RSA },
2480 #endif
2481 #ifdef SSL_OP_LEGACY_SERVER_CONNECT
2482   { US"legacy_server_connect", SSL_OP_LEGACY_SERVER_CONNECT },
2483 #endif
2484 #ifdef SSL_OP_MICROSOFT_BIG_SSLV3_BUFFER
2485   { US"microsoft_big_sslv3_buffer", SSL_OP_MICROSOFT_BIG_SSLV3_BUFFER },
2486 #endif
2487 #ifdef SSL_OP_MICROSOFT_SESS_ID_BUG
2488   { US"microsoft_sess_id_bug", SSL_OP_MICROSOFT_SESS_ID_BUG },
2489 #endif
2490 #ifdef SSL_OP_MSIE_SSLV2_RSA_PADDING
2491   { US"msie_sslv2_rsa_padding", SSL_OP_MSIE_SSLV2_RSA_PADDING },
2492 #endif
2493 #ifdef SSL_OP_NETSCAPE_CHALLENGE_BUG
2494   { US"netscape_challenge_bug", SSL_OP_NETSCAPE_CHALLENGE_BUG },
2495 #endif
2496 #ifdef SSL_OP_NETSCAPE_REUSE_CIPHER_CHANGE_BUG
2497   { US"netscape_reuse_cipher_change_bug", SSL_OP_NETSCAPE_REUSE_CIPHER_CHANGE_BUG },
2498 #endif
2499 #ifdef SSL_OP_NO_COMPRESSION
2500   { US"no_compression", SSL_OP_NO_COMPRESSION },
2501 #endif
2502 #ifdef SSL_OP_NO_SESSION_RESUMPTION_ON_RENEGOTIATION
2503   { US"no_session_resumption_on_renegotiation", SSL_OP_NO_SESSION_RESUMPTION_ON_RENEGOTIATION },
2504 #endif
2505 #ifdef SSL_OP_NO_SSLv2
2506   { US"no_sslv2", SSL_OP_NO_SSLv2 },
2507 #endif
2508 #ifdef SSL_OP_NO_SSLv3
2509   { US"no_sslv3", SSL_OP_NO_SSLv3 },
2510 #endif
2511 #ifdef SSL_OP_NO_TICKET
2512   { US"no_ticket", SSL_OP_NO_TICKET },
2513 #endif
2514 #ifdef SSL_OP_NO_TLSv1
2515   { US"no_tlsv1", SSL_OP_NO_TLSv1 },
2516 #endif
2517 #ifdef SSL_OP_NO_TLSv1_1
2518 #if SSL_OP_NO_TLSv1_1 == 0x00000400L
2519   /* Error in chosen value in 1.0.1a; see first item in CHANGES for 1.0.1b */
2520 #warning OpenSSL 1.0.1a uses a bad value for SSL_OP_NO_TLSv1_1, ignoring
2521 #else
2522   { US"no_tlsv1_1", SSL_OP_NO_TLSv1_1 },
2523 #endif
2524 #endif
2525 #ifdef SSL_OP_NO_TLSv1_2
2526   { US"no_tlsv1_2", SSL_OP_NO_TLSv1_2 },
2527 #endif
2528 #ifdef SSL_OP_SAFARI_ECDHE_ECDSA_BUG
2529   { US"safari_ecdhe_ecdsa_bug", SSL_OP_SAFARI_ECDHE_ECDSA_BUG },
2530 #endif
2531 #ifdef SSL_OP_SINGLE_DH_USE
2532   { US"single_dh_use", SSL_OP_SINGLE_DH_USE },
2533 #endif
2534 #ifdef SSL_OP_SINGLE_ECDH_USE
2535   { US"single_ecdh_use", SSL_OP_SINGLE_ECDH_USE },
2536 #endif
2537 #ifdef SSL_OP_SSLEAY_080_CLIENT_DH_BUG
2538   { US"ssleay_080_client_dh_bug", SSL_OP_SSLEAY_080_CLIENT_DH_BUG },
2539 #endif
2540 #ifdef SSL_OP_SSLREF2_REUSE_CERT_TYPE_BUG
2541   { US"sslref2_reuse_cert_type_bug", SSL_OP_SSLREF2_REUSE_CERT_TYPE_BUG },
2542 #endif
2543 #ifdef SSL_OP_TLS_BLOCK_PADDING_BUG
2544   { US"tls_block_padding_bug", SSL_OP_TLS_BLOCK_PADDING_BUG },
2545 #endif
2546 #ifdef SSL_OP_TLS_D5_BUG
2547   { US"tls_d5_bug", SSL_OP_TLS_D5_BUG },
2548 #endif
2549 #ifdef SSL_OP_TLS_ROLLBACK_BUG
2550   { US"tls_rollback_bug", SSL_OP_TLS_ROLLBACK_BUG },
2551 #endif
2552 };
2553 static int exim_openssl_options_size =
2554   sizeof(exim_openssl_options)/sizeof(struct exim_openssl_option);
2555
2556
2557 static BOOL
2558 tls_openssl_one_option_parse(uschar *name, long *value)
2559 {
2560 int first = 0;
2561 int last = exim_openssl_options_size;
2562 while (last > first)
2563   {
2564   int middle = (first + last)/2;
2565   int c = Ustrcmp(name, exim_openssl_options[middle].name);
2566   if (c == 0)
2567     {
2568     *value = exim_openssl_options[middle].value;
2569     return TRUE;
2570     }
2571   else if (c > 0)
2572     first = middle + 1;
2573   else
2574     last = middle;
2575   }
2576 return FALSE;
2577 }
2578
2579
2580
2581
2582 /*************************************************
2583 *        OpenSSL option parsing logic            *
2584 *************************************************/
2585
2586 /* OpenSSL has a number of compatibility options which an administrator might
2587 reasonably wish to set.  Interpret a list similarly to decode_bits(), so that
2588 we look like log_selector.
2589
2590 Arguments:
2591   option_spec  the administrator-supplied string of options
2592   results      ptr to long storage for the options bitmap
2593 Returns        success or failure
2594 */
2595
2596 BOOL
2597 tls_openssl_options_parse(uschar *option_spec, long *results)
2598 {
2599 long result, item;
2600 uschar *s, *end;
2601 uschar keep_c;
2602 BOOL adding, item_parsed;
2603
2604 result = 0L;
2605 /* Prior to 4.80 we or'd in SSL_OP_DONT_INSERT_EMPTY_FRAGMENTS; removed
2606  * from default because it increases BEAST susceptibility. */
2607 #ifdef SSL_OP_NO_SSLv2
2608 result |= SSL_OP_NO_SSLv2;
2609 #endif
2610
2611 if (option_spec == NULL)
2612   {
2613   *results = result;
2614   return TRUE;
2615   }
2616
2617 for (s=option_spec; *s != '\0'; /**/)
2618   {
2619   while (isspace(*s)) ++s;
2620   if (*s == '\0')
2621     break;
2622   if (*s != '+' && *s != '-')
2623     {
2624     DEBUG(D_tls) debug_printf("malformed openssl option setting: "
2625         "+ or - expected but found \"%s\"\n", s);
2626     return FALSE;
2627     }
2628   adding = *s++ == '+';
2629   for (end = s; (*end != '\0') && !isspace(*end); ++end) /**/ ;
2630   keep_c = *end;
2631   *end = '\0';
2632   item_parsed = tls_openssl_one_option_parse(s, &item);
2633   if (!item_parsed)
2634     {
2635     DEBUG(D_tls) debug_printf("openssl option setting unrecognised: \"%s\"\n", s);
2636     return FALSE;
2637     }
2638   DEBUG(D_tls) debug_printf("openssl option, %s from %lx: %lx (%s)\n",
2639       adding ? "adding" : "removing", result, item, s);
2640   if (adding)
2641     result |= item;
2642   else
2643     result &= ~item;
2644   *end = keep_c;
2645   s = end;
2646   }
2647
2648 *results = result;
2649 return TRUE;
2650 }
2651
2652 /* vi: aw ai sw=2
2653 */
2654 /* End of tls-openssl.c */