src/src/tls-openssl.c

   1 /*************************************************
   2 *     Exim - an Internet mail transport agent    *
   3 *************************************************/
   4
   5 /* Copyright (c) University of Cambridge 1995 - 2014 */
   6 /* See the file NOTICE for conditions of use and distribution. */
   7
   8 /* Portions Copyright (c) The OpenSSL Project 1999 */
   9
  10 /* This module provides the TLS (aka SSL) support for Exim using the OpenSSL
  11 library. It is #included into the tls.c file when that library is used. The
  12 code herein is based on a patch that was originally contributed by Steve
  13 Haslam. It was adapted from stunnel, a GPL program by Michal Trojnara.
  14
  15 No cryptographic code is included in Exim. All this module does is to call
  16 functions from the OpenSSL library. */
  17
  18
  19 /* Heading stuff */
  20
  21 #include <openssl/lhash.h>
  22 #include <openssl/ssl.h>
  23 #include <openssl/err.h>
  24 #include <openssl/rand.h>
  25 #ifndef DISABLE_OCSP
  26 # include <openssl/ocsp.h>
  27 #endif
  28 #ifdef EXPERIMENTAL_DANE
  29 # include <danessl.h>
  30 #endif
  31
  32
  33 #ifndef DISABLE_OCSP
  34 # define EXIM_OCSP_SKEW_SECONDS (300L)
  35 # define EXIM_OCSP_MAX_AGE (-1L)
  36 #endif
  37
  38 #if OPENSSL_VERSION_NUMBER >= 0x0090806fL && !defined(OPENSSL_NO_TLSEXT)
  39 # define EXIM_HAVE_OPENSSL_TLSEXT
  40 #endif
  41
  42 #if !defined(EXIM_HAVE_OPENSSL_TLSEXT) && !defined(DISABLE_OCSP)
  43 # warning "OpenSSL library version too old; define DISABLE_OCSP in Makefile"
  44 # define DISABLE_OCSP
  45 #endif
  46
  47 /* Structure for collecting random data for seeding. */
  48
  49 typedef struct randstuff {
  50   struct timeval tv;
  51   pid_t          p;
  52 } randstuff;
  53
  54 /* Local static variables */
  55
  56 static BOOL client_verify_callback_called = FALSE;
  57 static BOOL server_verify_callback_called = FALSE;
  58 static const uschar *sid_ctx = US"exim";
  59
  60 /* We have three different contexts to care about.
  61
  62 Simple case: client, `client_ctx`
  63  As a client, we can be doing a callout or cut-through delivery while receiving
  64  a message.  So we have a client context, which should have options initialised
  65  from the SMTP Transport.
  66
  67 Server:
  68  There are two cases: with and without ServerNameIndication from the client.
  69  Given TLS SNI, we can be using different keys, certs and various other
  70  configuration settings, because they're re-expanded with $tls_sni set.  This
  71  allows vhosting with TLS.  This SNI is sent in the handshake.
  72  A client might not send SNI, so we need a fallback, and an initial setup too.
  73  So as a server, we start out using `server_ctx`.
  74  If SNI is sent by the client, then we as server, mid-negotiation, try to clone
  75  `server_sni` from `server_ctx` and then initialise settings by re-expanding
  76  configuration.
  77 */
  78
  79 static SSL_CTX *client_ctx = NULL;
  80 static SSL_CTX *server_ctx = NULL;
  81 static SSL     *client_ssl = NULL;
  82 static SSL     *server_ssl = NULL;
  83
  84 #ifdef EXIM_HAVE_OPENSSL_TLSEXT
  85 static SSL_CTX *server_sni = NULL;
  86 #endif
  87
  88 static char ssl_errstring[256];
  89
  90 static int  ssl_session_timeout = 200;
  91 static BOOL client_verify_optional = FALSE;
  92 static BOOL server_verify_optional = FALSE;
  93
  94 static BOOL reexpand_tls_files_for_sni = FALSE;
  95
  96
  97 typedef struct tls_ext_ctx_cb {
  98   uschar *certificate;
  99   uschar *privatekey;
 100 #ifndef DISABLE_OCSP
 101   BOOL is_server;
 102   union {
 103     struct {
 104       uschar        *file;
 105       uschar        *file_expanded;
 106       OCSP_RESPONSE *response;
 107     } server;
 108     struct {
 109       X509_STORE    *verify_store;      /* non-null if status requested */
 110       BOOL          verify_required;
 111     } client;
 112   } u_ocsp;
 113 #endif
 114   uschar *dhparam;
 115   /* these are cached from first expand */
 116   uschar *server_cipher_list;
 117   /* only passed down to tls_error: */
 118   host_item *host;
 119
 120 #ifdef EXPERIMENTAL_CERTNAMES
 121   uschar * verify_cert_hostnames;
 122 #endif
 123 } tls_ext_ctx_cb;
 124
 125 /* should figure out a cleanup of API to handle state preserved per
 126 implementation, for various reasons, which can be void * in the APIs.
 127 For now, we hack around it. */
 128 tls_ext_ctx_cb *client_static_cbinfo = NULL;
 129 tls_ext_ctx_cb *server_static_cbinfo = NULL;
 130
 131 static int
 132 setup_certs(SSL_CTX *sctx, uschar *certs, uschar *crl, host_item *host, BOOL optional,
 133     int (*cert_vfy_cb)(int, X509_STORE_CTX *) );
 134
 135 /* Callbacks */
 136 #ifdef EXIM_HAVE_OPENSSL_TLSEXT
 137 static int tls_servername_cb(SSL *s, int *ad ARG_UNUSED, void *arg);
 138 #endif
 139 #ifndef DISABLE_OCSP
 140 static int tls_server_stapling_cb(SSL *s, void *arg);
 141 #endif
 142
 143
 144 /*************************************************
 145 *               Handle TLS error                 *
 146 *************************************************/
 147
 148 /* Called from lots of places when errors occur before actually starting to do
 149 the TLS handshake, that is, while the session is still in clear. Always returns
 150 DEFER for a server and FAIL for a client so that most calls can use "return
 151 tls_error(...)" to do this processing and then give an appropriate return. A
 152 single function is used for both server and client, because it is called from
 153 some shared functions.
 154
 155 Argument:
 156   prefix    text to include in the logged error
 157   host      NULL if setting up a server;
 158             the connected host if setting up a client
 159   msg       error message or NULL if we should ask OpenSSL
 160
 161 Returns:    OK/DEFER/FAIL
 162 */
 163
 164 static int
 165 tls_error(uschar *prefix, host_item *host, uschar *msg)
 166 {
 167 if (msg == NULL)
 168   {
 169   ERR_error_string(ERR_get_error(), ssl_errstring);
 170   msg = (uschar *)ssl_errstring;
 171   }
 172
 173 if (host == NULL)
 174   {
 175   uschar *conn_info = smtp_get_connection_info();
 176   if (Ustrncmp(conn_info, US"SMTP ", 5) == 0)
 177     conn_info += 5;
 178   log_write(0, LOG_MAIN, "TLS error on %s (%s): %s",
 179     conn_info, prefix, msg);
 180   return DEFER;
 181   }
 182 else
 183   {
 184   log_write(0, LOG_MAIN, "TLS error on connection to %s [%s] (%s): %s",
 185     host->name, host->address, prefix, msg);
 186   return FAIL;
 187   }
 188 }
 189
 190
 191
 192 /*************************************************
 193 *        Callback to generate RSA key            *
 194 *************************************************/
 195
 196 /*
 197 Arguments:
 198   s          SSL connection
 199   export     not used
 200   keylength  keylength
 201
 202 Returns:     pointer to generated key
 203 */
 204
 205 static RSA *
 206 rsa_callback(SSL *s, int export, int keylength)
 207 {
 208 RSA *rsa_key;
 209 export = export;     /* Shut picky compilers up */
 210 DEBUG(D_tls) debug_printf("Generating %d bit RSA key...\n", keylength);
 211 rsa_key = RSA_generate_key(keylength, RSA_F4, NULL, NULL);
 212 if (rsa_key == NULL)
 213   {
 214   ERR_error_string(ERR_get_error(), ssl_errstring);
 215   log_write(0, LOG_MAIN|LOG_PANIC, "TLS error (RSA_generate_key): %s",
 216     ssl_errstring);
 217   return NULL;
 218   }
 219 return rsa_key;
 220 }
 221
 222
 223
 224 /* Extreme debug
 225 #ifndef DISABLE_OCSP
 226 void
 227 x509_store_dump_cert_s_names(X509_STORE * store)
 228 {
 229 STACK_OF(X509_OBJECT) * roots= store->objs;
 230 int i;
 231 static uschar name[256];
 232
 233 for(i= 0; i<sk_X509_OBJECT_num(roots); i++)
 234   {
 235   X509_OBJECT * tmp_obj= sk_X509_OBJECT_value(roots, i);
 236   if(tmp_obj->type == X509_LU_X509)
 237     {
 238     X509 * current_cert= tmp_obj->data.x509;
 239     X509_NAME_oneline(X509_get_subject_name(current_cert), CS name, sizeof(name));
 240     debug_printf(" %s\n", name);
 241     }
 242   }
 243 }
 244 #endif
 245 */
 246
 247
 248 /*************************************************
 249 *        Callback for verification               *
 250 *************************************************/
 251
 252 /* The SSL library does certificate verification if set up to do so. This
 253 callback has the current yes/no state is in "state". If verification succeeded,
 254 we set up the tls_peerdn string. If verification failed, what happens depends
 255 on whether the client is required to present a verifiable certificate or not.
 256
 257 If verification is optional, we change the state to yes, but still log the
 258 verification error. For some reason (it really would help to have proper
 259 documentation of OpenSSL), this callback function then gets called again, this
 260 time with state = 1. In fact, that's useful, because we can set up the peerdn
 261 value, but we must take care not to set the private verified flag on the second
 262 time through.
 263
 264 Note: this function is not called if the client fails to present a certificate
 265 when asked. We get here only if a certificate has been received. Handling of
 266 optional verification for this case is done when requesting SSL to verify, by
 267 setting SSL_VERIFY_FAIL_IF_NO_PEER_CERT in the non-optional case.
 268
 269 Arguments:
 270   state      current yes/no state as 1/0
 271   x509ctx    certificate information.
 272   client     TRUE for client startup, FALSE for server startup
 273
 274 Returns:     1 if verified, 0 if not
 275 */
 276
 277 static int
 278 verify_callback(int state, X509_STORE_CTX *x509ctx,
 279   tls_support *tlsp, BOOL *calledp, BOOL *optionalp)
 280 {
 281 X509 * cert = X509_STORE_CTX_get_current_cert(x509ctx);
 282 static uschar txt[256];
 283
 284 X509_NAME_oneline(X509_get_subject_name(cert), CS txt, sizeof(txt));
 285
 286 if (state == 0)
 287   {
 288   log_write(0, LOG_MAIN, "SSL verify error: depth=%d error=%s cert=%s",
 289     X509_STORE_CTX_get_error_depth(x509ctx),
 290     X509_verify_cert_error_string(X509_STORE_CTX_get_error(x509ctx)),
 291     txt);
 292   tlsp->certificate_verified = FALSE;
 293   *calledp = TRUE;
 294   if (!*optionalp)
 295     {
 296     tlsp->peercert = X509_dup(cert);
 297     return 0;                       /* reject */
 298     }
 299   DEBUG(D_tls) debug_printf("SSL verify failure overridden (host in "
 300     "tls_try_verify_hosts)\n");
 301   }
 302
 303 else if (X509_STORE_CTX_get_error_depth(x509ctx) != 0)
 304   {
 305   DEBUG(D_tls) debug_printf("SSL verify ok: depth=%d SN=%s\n",
 306      X509_STORE_CTX_get_error_depth(x509ctx), txt);
 307 #ifndef DISABLE_OCSP
 308   if (tlsp == &tls_out && client_static_cbinfo->u_ocsp.client.verify_store)
 309     {   /* client, wanting stapling  */
 310     /* Add the server cert's signing chain as the one
 311     for the verification of the OCSP stapled information. */
 312
 313     if (!X509_STORE_add_cert(client_static_cbinfo->u_ocsp.client.verify_store,
 314                              cert))
 315       ERR_clear_error();
 316     }
 317 #endif
 318   }
 319 else
 320   {
 321 #ifdef EXPERIMENTAL_CERTNAMES
 322   uschar * verify_cert_hostnames;
 323 #endif
 324
 325   tlsp->peerdn = txt;
 326   tlsp->peercert = X509_dup(cert);
 327
 328 #ifdef EXPERIMENTAL_CERTNAMES
 329   if (  tlsp == &tls_out
 330      && ((verify_cert_hostnames = client_static_cbinfo->verify_cert_hostnames)))
 331         /* client, wanting hostname check */
 332
 333 # if OPENSSL_VERSION_NUMBER >= 0x010100000L || OPENSSL_VERSION_NUMBER >= 0x010002000L
 334 #  ifndef X509_CHECK_FLAG_NO_PARTIAL_WILDCARDS
 335 #   define X509_CHECK_FLAG_NO_PARTIAL_WILDCARDS 0
 336 #  endif
 337     {
 338     int sep = 0;
 339     uschar * list = verify_cert_hostnames;
 340     uschar * name;
 341     int rc;
 342     while ((name = string_nextinlist(&list, &sep, NULL, 0)))
 343       if ((rc = X509_check_host(cert, name, 0,
 344                   X509_CHECK_FLAG_NO_PARTIAL_WILDCARDS)))
 345         {
 346         if (rc < 0)
 347           {
 348           log_write(0, LOG_MAIN, "SSL verify error: internal error\n");
 349           name = NULL;
 350           }
 351         break;
 352         }
 353     if (!name)
 354       {
 355       log_write(0, LOG_MAIN,
 356         "SSL verify error: certificate name mismatch: \"%s\"\n", txt);
 357       return 0;                         /* reject */
 358       }
 359     }
 360 # else
 361     if (!tls_is_name_for_cert(verify_cert_hostnames, cert))
 362       {
 363       log_write(0, LOG_MAIN,
 364         "SSL verify error: certificate name mismatch: \"%s\"\n", txt);
 365       return 0;                         /* reject */
 366       }
 367 # endif
 368 #endif  /*EXPERIMENTAL_CERTNAMES*/
 369
 370   DEBUG(D_tls) debug_printf("SSL%s verify ok: depth=0 SN=%s\n",
 371     *calledp ? "" : " authenticated", txt);
 372   if (!*calledp) tlsp->certificate_verified = TRUE;
 373   *calledp = TRUE;
 374   }
 375
 376 return 1;   /* accept */
 377 }
 378
 379 static int
 380 verify_callback_client(int state, X509_STORE_CTX *x509ctx)
 381 {
 382 return verify_callback(state, x509ctx, &tls_out, &client_verify_callback_called, &client_verify_optional);
 383 }
 384
 385 static int
 386 verify_callback_server(int state, X509_STORE_CTX *x509ctx)
 387 {
 388 return verify_callback(state, x509ctx, &tls_in, &server_verify_callback_called, &server_verify_optional);
 389 }
 390
 391
 392 #ifdef EXPERIMENTAL_DANE
 393
 394 /* This gets called *by* the dane library verify callback, which interposes
 395 itself.
 396 */
 397 static int
 398 verify_callback_client_dane(int state, X509_STORE_CTX * x509ctx)
 399 {
 400 X509 * cert = X509_STORE_CTX_get_current_cert(x509ctx);
 401 static uschar txt[256];
 402
 403 X509_NAME_oneline(X509_get_subject_name(cert), CS txt, sizeof(txt));
 404
 405 DEBUG(D_tls) debug_printf("verify_callback_client_dane: %s\n", txt);
 406 tls_out.peerdn = txt;
 407 tls_out.peercert = X509_dup(cert);
 408
 409 if (state == 1)
 410   tls_out.dane_verified =
 411   tls_out.certificate_verified = TRUE;
 412 return 1;
 413 }
 414
 415 #endif  /*EXPERIMENTAL_DANE*/
 416
 417
 418 /*************************************************
 419 *           Information callback                 *
 420 *************************************************/
 421
 422 /* The SSL library functions call this from time to time to indicate what they
 423 are doing. We copy the string to the debugging output when TLS debugging has
 424 been requested.
 425
 426 Arguments:
 427   s         the SSL connection
 428   where
 429   ret
 430
 431 Returns:    nothing
 432 */
 433
 434 static void
 435 info_callback(SSL *s, int where, int ret)
 436 {
 437 where = where;
 438 ret = ret;
 439 DEBUG(D_tls) debug_printf("SSL info: %s\n", SSL_state_string_long(s));
 440 }
 441
 442
 443
 444 /*************************************************
 445 *                Initialize for DH               *
 446 *************************************************/
 447
 448 /* If dhparam is set, expand it, and load up the parameters for DH encryption.
 449
 450 Arguments:
 451   dhparam   DH parameter file or fixed parameter identity string
 452   host      connected host, if client; NULL if server
 453
 454 Returns:    TRUE if OK (nothing to set up, or setup worked)
 455 */
 456
 457 static BOOL
 458 init_dh(SSL_CTX *sctx, uschar *dhparam, host_item *host)
 459 {
 460 BIO *bio;
 461 DH *dh;
 462 uschar *dhexpanded;
 463 const char *pem;
 464
 465 if (!expand_check(dhparam, US"tls_dhparam", &dhexpanded))
 466   return FALSE;
 467
 468 if (!dhexpanded || !*dhexpanded)
 469   bio = BIO_new_mem_buf(CS std_dh_prime_default(), -1);
 470 else if (dhexpanded[0] == '/')
 471   {
 472   if (!(bio = BIO_new_file(CS dhexpanded, "r")))
 473     {
 474     tls_error(string_sprintf("could not read dhparams file %s", dhexpanded),
 475           host, US strerror(errno));
 476     return FALSE;
 477     }
 478   }
 479 else
 480   {
 481   if (Ustrcmp(dhexpanded, "none") == 0)
 482     {
 483     DEBUG(D_tls) debug_printf("Requested no DH parameters.\n");
 484     return TRUE;
 485     }
 486
 487   if (!(pem = std_dh_prime_named(dhexpanded)))
 488     {
 489     tls_error(string_sprintf("Unknown standard DH prime \"%s\"", dhexpanded),
 490         host, US strerror(errno));
 491     return FALSE;
 492     }
 493   bio = BIO_new_mem_buf(CS pem, -1);
 494   }
 495
 496 if (!(dh = PEM_read_bio_DHparams(bio, NULL, NULL, NULL)))
 497   {
 498   BIO_free(bio);
 499   tls_error(string_sprintf("Could not read tls_dhparams \"%s\"", dhexpanded),
 500       host, NULL);
 501   return FALSE;
 502   }
 503
 504 /* Even if it is larger, we silently return success rather than cause things
 505  * to fail out, so that a too-large DH will not knock out all TLS; it's a
 506  * debatable choice. */
 507 if ((8*DH_size(dh)) > tls_dh_max_bits)
 508   {
 509   DEBUG(D_tls)
 510     debug_printf("dhparams file %d bits, is > tls_dh_max_bits limit of %d",
 511         8*DH_size(dh), tls_dh_max_bits);
 512   }
 513 else
 514   {
 515   SSL_CTX_set_tmp_dh(sctx, dh);
 516   DEBUG(D_tls)
 517     debug_printf("Diffie-Hellman initialized from %s with %d-bit prime\n",
 518       dhexpanded ? dhexpanded : US"default", 8*DH_size(dh));
 519   }
 520
 521 DH_free(dh);
 522 BIO_free(bio);
 523
 524 return TRUE;
 525 }
 526
 527
 528
 529
 530 #ifndef DISABLE_OCSP
 531 /*************************************************
 532 *       Load OCSP information into state         *
 533 *************************************************/
 534
 535 /* Called to load the server OCSP response from the given file into memory, once
 536 caller has determined this is needed.  Checks validity.  Debugs a message
 537 if invalid.
 538
 539 ASSUMES: single response, for single cert.
 540
 541 Arguments:
 542   sctx            the SSL_CTX* to update
 543   cbinfo          various parts of session state
 544   expanded        the filename putatively holding an OCSP response
 545
 546 */
 547
 548 static void
 549 ocsp_load_response(SSL_CTX *sctx, tls_ext_ctx_cb *cbinfo, const uschar *expanded)
 550 {
 551 BIO *bio;
 552 OCSP_RESPONSE *resp;
 553 OCSP_BASICRESP *basic_response;
 554 OCSP_SINGLERESP *single_response;
 555 ASN1_GENERALIZEDTIME *rev, *thisupd, *nextupd;
 556 X509_STORE *store;
 557 unsigned long verify_flags;
 558 int status, reason, i;
 559
 560 cbinfo->u_ocsp.server.file_expanded = string_copy(expanded);
 561 if (cbinfo->u_ocsp.server.response)
 562   {
 563   OCSP_RESPONSE_free(cbinfo->u_ocsp.server.response);
 564   cbinfo->u_ocsp.server.response = NULL;
 565   }
 566
 567 bio = BIO_new_file(CS cbinfo->u_ocsp.server.file_expanded, "rb");
 568 if (!bio)
 569   {
 570   DEBUG(D_tls) debug_printf("Failed to open OCSP response file \"%s\"\n",
 571       cbinfo->u_ocsp.server.file_expanded);
 572   return;
 573   }
 574
 575 resp = d2i_OCSP_RESPONSE_bio(bio, NULL);
 576 BIO_free(bio);
 577 if (!resp)
 578   {
 579   DEBUG(D_tls) debug_printf("Error reading OCSP response.\n");
 580   return;
 581   }
 582
 583 status = OCSP_response_status(resp);
 584 if (status != OCSP_RESPONSE_STATUS_SUCCESSFUL)
 585   {
 586   DEBUG(D_tls) debug_printf("OCSP response not valid: %s (%d)\n",
 587       OCSP_response_status_str(status), status);
 588   goto bad;
 589   }
 590
 591 basic_response = OCSP_response_get1_basic(resp);
 592 if (!basic_response)
 593   {
 594   DEBUG(D_tls)
 595     debug_printf("OCSP response parse error: unable to extract basic response.\n");
 596   goto bad;
 597   }
 598
 599 store = SSL_CTX_get_cert_store(sctx);
 600 verify_flags = OCSP_NOVERIFY; /* check sigs, but not purpose */
 601
 602 /* May need to expose ability to adjust those flags?
 603 OCSP_NOSIGS OCSP_NOVERIFY OCSP_NOCHAIN OCSP_NOCHECKS OCSP_NOEXPLICIT
 604 OCSP_TRUSTOTHER OCSP_NOINTERN */
 605
 606 i = OCSP_basic_verify(basic_response, NULL, store, verify_flags);
 607 if (i <= 0)
 608   {
 609   DEBUG(D_tls) {
 610     ERR_error_string(ERR_get_error(), ssl_errstring);
 611     debug_printf("OCSP response verify failure: %s\n", US ssl_errstring);
 612     }
 613   goto bad;
 614   }
 615
 616 /* Here's the simplifying assumption: there's only one response, for the
 617 one certificate we use, and nothing for anything else in a chain.  If this
 618 proves false, we need to extract a cert id from our issued cert
 619 (tls_certificate) and use that for OCSP_resp_find_status() (which finds the
 620 right cert in the stack and then calls OCSP_single_get0_status()).
 621
 622 I'm hoping to avoid reworking a bunch more of how we handle state here. */
 623 single_response = OCSP_resp_get0(basic_response, 0);
 624 if (!single_response)
 625   {
 626   DEBUG(D_tls)
 627     debug_printf("Unable to get first response from OCSP basic response.\n");
 628   goto bad;
 629   }
 630
 631 status = OCSP_single_get0_status(single_response, &reason, &rev, &thisupd, &nextupd);
 632 if (status != V_OCSP_CERTSTATUS_GOOD)
 633   {
 634   DEBUG(D_tls) debug_printf("OCSP response bad cert status: %s (%d) %s (%d)\n",
 635       OCSP_cert_status_str(status), status,
 636       OCSP_crl_reason_str(reason), reason);
 637   goto bad;
 638   }
 639
 640 if (!OCSP_check_validity(thisupd, nextupd, EXIM_OCSP_SKEW_SECONDS, EXIM_OCSP_MAX_AGE))
 641   {
 642   DEBUG(D_tls) debug_printf("OCSP status invalid times.\n");
 643   goto bad;
 644   }
 645
 646 supply_response:
 647   cbinfo->u_ocsp.server.response = resp;
 648 return;
 649
 650 bad:
 651   if (running_in_test_harness)
 652     {
 653     extern char ** environ;
 654     uschar ** p;
 655     for (p = USS environ; *p != NULL; p++)
 656       if (Ustrncmp(*p, "EXIM_TESTHARNESS_DISABLE_OCSPVALIDITYCHECK", 42) == 0)
 657         {
 658         DEBUG(D_tls) debug_printf("Supplying known bad OCSP response\n");
 659         goto supply_response;
 660         }
 661     }
 662 return;
 663 }
 664 #endif  /*!DISABLE_OCSP*/
 665
 666
 667
 668
 669 /*************************************************
 670 *        Expand key and cert file specs          *
 671 *************************************************/
 672
 673 /* Called once during tls_init and possibly again during TLS setup, for a
 674 new context, if Server Name Indication was used and tls_sni was seen in
 675 the certificate string.
 676
 677 Arguments:
 678   sctx            the SSL_CTX* to update
 679   cbinfo          various parts of session state
 680
 681 Returns:          OK/DEFER/FAIL
 682 */
 683
 684 static int
 685 tls_expand_session_files(SSL_CTX *sctx, tls_ext_ctx_cb *cbinfo)
 686 {
 687 uschar *expanded;
 688
 689 if (cbinfo->certificate == NULL)
 690   return OK;
 691
 692 if (Ustrstr(cbinfo->certificate, US"tls_sni") ||
 693     Ustrstr(cbinfo->certificate, US"tls_in_sni") ||
 694     Ustrstr(cbinfo->certificate, US"tls_out_sni")
 695    )
 696   reexpand_tls_files_for_sni = TRUE;
 697
 698 if (!expand_check(cbinfo->certificate, US"tls_certificate", &expanded))
 699   return DEFER;
 700
 701 if (expanded != NULL)
 702   {
 703   DEBUG(D_tls) debug_printf("tls_certificate file %s\n", expanded);
 704   if (!SSL_CTX_use_certificate_chain_file(sctx, CS expanded))
 705     return tls_error(string_sprintf(
 706       "SSL_CTX_use_certificate_chain_file file=%s", expanded),
 707         cbinfo->host, NULL);
 708   }
 709
 710 if (cbinfo->privatekey != NULL &&
 711     !expand_check(cbinfo->privatekey, US"tls_privatekey", &expanded))
 712   return DEFER;
 713
 714 /* If expansion was forced to fail, key_expanded will be NULL. If the result
 715 of the expansion is an empty string, ignore it also, and assume the private
 716 key is in the same file as the certificate. */
 717
 718 if (expanded != NULL && *expanded != 0)
 719   {
 720   DEBUG(D_tls) debug_printf("tls_privatekey file %s\n", expanded);
 721   if (!SSL_CTX_use_PrivateKey_file(sctx, CS expanded, SSL_FILETYPE_PEM))
 722     return tls_error(string_sprintf(
 723       "SSL_CTX_use_PrivateKey_file file=%s", expanded), cbinfo->host, NULL);
 724   }
 725
 726 #ifndef DISABLE_OCSP
 727 if (cbinfo->is_server &&  cbinfo->u_ocsp.server.file != NULL)
 728   {
 729   if (!expand_check(cbinfo->u_ocsp.server.file, US"tls_ocsp_file", &expanded))
 730     return DEFER;
 731
 732   if (expanded != NULL && *expanded != 0)
 733     {
 734     DEBUG(D_tls) debug_printf("tls_ocsp_file %s\n", expanded);
 735     if (cbinfo->u_ocsp.server.file_expanded &&
 736         (Ustrcmp(expanded, cbinfo->u_ocsp.server.file_expanded) == 0))
 737       {
 738       DEBUG(D_tls)
 739         debug_printf("tls_ocsp_file value unchanged, using existing values.\n");
 740       } else {
 741         ocsp_load_response(sctx, cbinfo, expanded);
 742       }
 743     }
 744   }
 745 #endif
 746
 747 return OK;
 748 }
 749
 750
 751
 752
 753 /*************************************************
 754 *            Callback to handle SNI              *
 755 *************************************************/
 756
 757 /* Called when acting as server during the TLS session setup if a Server Name
 758 Indication extension was sent by the client.
 759
 760 API documentation is OpenSSL s_server.c implementation.
 761
 762 Arguments:
 763   s               SSL* of the current session
 764   ad              unknown (part of OpenSSL API) (unused)
 765   arg             Callback of "our" registered data
 766
 767 Returns:          SSL_TLSEXT_ERR_{OK,ALERT_WARNING,ALERT_FATAL,NOACK}
 768 */
 769
 770 #ifdef EXIM_HAVE_OPENSSL_TLSEXT
 771 static int
 772 tls_servername_cb(SSL *s, int *ad ARG_UNUSED, void *arg)
 773 {
 774 const char *servername = SSL_get_servername(s, TLSEXT_NAMETYPE_host_name);
 775 tls_ext_ctx_cb *cbinfo = (tls_ext_ctx_cb *) arg;
 776 int rc;
 777 int old_pool = store_pool;
 778
 779 if (!servername)
 780   return SSL_TLSEXT_ERR_OK;
 781
 782 DEBUG(D_tls) debug_printf("Received TLS SNI \"%s\"%s\n", servername,
 783     reexpand_tls_files_for_sni ? "" : " (unused for certificate selection)");
 784
 785 /* Make the extension value available for expansion */
 786 store_pool = POOL_PERM;
 787 tls_in.sni = string_copy(US servername);
 788 store_pool = old_pool;
 789
 790 if (!reexpand_tls_files_for_sni)
 791   return SSL_TLSEXT_ERR_OK;
 792
 793 /* Can't find an SSL_CTX_clone() or equivalent, so we do it manually;
 794 not confident that memcpy wouldn't break some internal reference counting.
 795 Especially since there's a references struct member, which would be off. */
 796
 797 if (!(server_sni = SSL_CTX_new(SSLv23_server_method())))
 798   {
 799   ERR_error_string(ERR_get_error(), ssl_errstring);
 800   DEBUG(D_tls) debug_printf("SSL_CTX_new() failed: %s\n", ssl_errstring);
 801   return SSL_TLSEXT_ERR_NOACK;
 802   }
 803
 804 /* Not sure how many of these are actually needed, since SSL object
 805 already exists.  Might even need this selfsame callback, for reneg? */
 806
 807 SSL_CTX_set_info_callback(server_sni, SSL_CTX_get_info_callback(server_ctx));
 808 SSL_CTX_set_mode(server_sni, SSL_CTX_get_mode(server_ctx));
 809 SSL_CTX_set_options(server_sni, SSL_CTX_get_options(server_ctx));
 810 SSL_CTX_set_timeout(server_sni, SSL_CTX_get_timeout(server_ctx));
 811 SSL_CTX_set_tlsext_servername_callback(server_sni, tls_servername_cb);
 812 SSL_CTX_set_tlsext_servername_arg(server_sni, cbinfo);
 813 if (cbinfo->server_cipher_list)
 814   SSL_CTX_set_cipher_list(server_sni, CS cbinfo->server_cipher_list);
 815 #ifndef DISABLE_OCSP
 816 if (cbinfo->u_ocsp.server.file)
 817   {
 818   SSL_CTX_set_tlsext_status_cb(server_sni, tls_server_stapling_cb);
 819   SSL_CTX_set_tlsext_status_arg(server_sni, cbinfo);
 820   }
 821 #endif
 822
 823 rc = setup_certs(server_sni, tls_verify_certificates, tls_crl, NULL, FALSE, verify_callback_server);
 824 if (rc != OK) return SSL_TLSEXT_ERR_NOACK;
 825
 826 /* do this after setup_certs, because this can require the certs for verifying
 827 OCSP information. */
 828 rc = tls_expand_session_files(server_sni, cbinfo);
 829 if (rc != OK) return SSL_TLSEXT_ERR_NOACK;
 830
 831 if (!init_dh(server_sni, cbinfo->dhparam, NULL))
 832   return SSL_TLSEXT_ERR_NOACK;
 833
 834 DEBUG(D_tls) debug_printf("Switching SSL context.\n");
 835 SSL_set_SSL_CTX(s, server_sni);
 836
 837 return SSL_TLSEXT_ERR_OK;
 838 }
 839 #endif /* EXIM_HAVE_OPENSSL_TLSEXT */
 840
 841
 842
 843
 844 #ifndef DISABLE_OCSP
 845
 846 /*************************************************
 847 *        Callback to handle OCSP Stapling        *
 848 *************************************************/
 849
 850 /* Called when acting as server during the TLS session setup if the client
 851 requests OCSP information with a Certificate Status Request.
 852
 853 Documentation via openssl s_server.c and the Apache patch from the OpenSSL
 854 project.
 855
 856 */
 857
 858 static int
 859 tls_server_stapling_cb(SSL *s, void *arg)
 860 {
 861 const tls_ext_ctx_cb *cbinfo = (tls_ext_ctx_cb *) arg;
 862 uschar *response_der;
 863 int response_der_len;
 864
 865 DEBUG(D_tls)
 866   debug_printf("Received TLS status request (OCSP stapling); %s response.",
 867     cbinfo->u_ocsp.server.response ? "have" : "lack");
 868
 869 tls_in.ocsp = OCSP_NOT_RESP;
 870 if (!cbinfo->u_ocsp.server.response)
 871   return SSL_TLSEXT_ERR_NOACK;
 872
 873 response_der = NULL;
 874 response_der_len = i2d_OCSP_RESPONSE(cbinfo->u_ocsp.server.response,
 875                       &response_der);
 876 if (response_der_len <= 0)
 877   return SSL_TLSEXT_ERR_NOACK;
 878
 879 SSL_set_tlsext_status_ocsp_resp(server_ssl, response_der, response_der_len);
 880 tls_in.ocsp = OCSP_VFIED;
 881 return SSL_TLSEXT_ERR_OK;
 882 }
 883
 884
 885 static void
 886 time_print(BIO * bp, const char * str, ASN1_GENERALIZEDTIME * time)
 887 {
 888 BIO_printf(bp, "\t%s: ", str);
 889 ASN1_GENERALIZEDTIME_print(bp, time);
 890 BIO_puts(bp, "\n");
 891 }
 892
 893 static int
 894 tls_client_stapling_cb(SSL *s, void *arg)
 895 {
 896 tls_ext_ctx_cb * cbinfo = arg;
 897 const unsigned char * p;
 898 int len;
 899 OCSP_RESPONSE * rsp;
 900 OCSP_BASICRESP * bs;
 901 int i;
 902
 903 DEBUG(D_tls) debug_printf("Received TLS status response (OCSP stapling):");
 904 len = SSL_get_tlsext_status_ocsp_resp(s, &p);
 905 if(!p)
 906  {
 907   /* Expect this when we requested ocsp but got none */
 908   if (  cbinfo->u_ocsp.client.verify_required
 909      && log_extra_selector & LX_tls_cipher)
 910     log_write(0, LOG_MAIN, "Received TLS status callback, null content");
 911   else
 912     DEBUG(D_tls) debug_printf(" null\n");
 913   return cbinfo->u_ocsp.client.verify_required ? 0 : 1;
 914  }
 915
 916 if(!(rsp = d2i_OCSP_RESPONSE(NULL, &p, len)))
 917  {
 918   tls_out.ocsp = OCSP_FAILED;
 919   if (log_extra_selector & LX_tls_cipher)
 920     log_write(0, LOG_MAIN, "Received TLS status response, parse error");
 921   else
 922     DEBUG(D_tls) debug_printf(" parse error\n");
 923   return 0;
 924  }
 925
 926 if(!(bs = OCSP_response_get1_basic(rsp)))
 927   {
 928   tls_out.ocsp = OCSP_FAILED;
 929   if (log_extra_selector & LX_tls_cipher)
 930     log_write(0, LOG_MAIN, "Received TLS status response, error parsing response");
 931   else
 932     DEBUG(D_tls) debug_printf(" error parsing response\n");
 933   OCSP_RESPONSE_free(rsp);
 934   return 0;
 935   }
 936
 937 /* We'd check the nonce here if we'd put one in the request. */
 938 /* However that would defeat cacheability on the server so we don't. */
 939
 940 /* This section of code reworked from OpenSSL apps source;
 941    The OpenSSL Project retains copyright:
 942    Copyright (c) 1999 The OpenSSL Project.  All rights reserved.
 943 */
 944   {
 945     BIO * bp = NULL;
 946     int status, reason;
 947     ASN1_GENERALIZEDTIME *rev, *thisupd, *nextupd;
 948
 949     DEBUG(D_tls) bp = BIO_new_fp(stderr, BIO_NOCLOSE);
 950
 951     /*OCSP_RESPONSE_print(bp, rsp, 0);   extreme debug: stapling content */
 952
 953     /* Use the chain that verified the server cert to verify the stapled info */
 954     /* DEBUG(D_tls) x509_store_dump_cert_s_names(cbinfo->u_ocsp.client.verify_store); */
 955
 956     if ((i = OCSP_basic_verify(bs, NULL,
 957               cbinfo->u_ocsp.client.verify_store, 0)) <= 0)
 958       {
 959       tls_out.ocsp = OCSP_FAILED;
 960       BIO_printf(bp, "OCSP response verify failure\n");
 961       ERR_print_errors(bp);
 962       i = cbinfo->u_ocsp.client.verify_required ? 0 : 1;
 963       goto out;
 964       }
 965
 966     BIO_printf(bp, "OCSP response well-formed and signed OK\n");
 967
 968       {
 969       STACK_OF(OCSP_SINGLERESP) * sresp = bs->tbsResponseData->responses;
 970       OCSP_SINGLERESP * single;
 971
 972       if (sk_OCSP_SINGLERESP_num(sresp) != 1)
 973         {
 974         tls_out.ocsp = OCSP_FAILED;
 975         log_write(0, LOG_MAIN, "OCSP stapling "
 976             "with multiple responses not handled");
 977         i = cbinfo->u_ocsp.client.verify_required ? 0 : 1;
 978         goto out;
 979         }
 980       single = OCSP_resp_get0(bs, 0);
 981       status = OCSP_single_get0_status(single, &reason, &rev,
 982                   &thisupd, &nextupd);
 983       }
 984
 985     DEBUG(D_tls) time_print(bp, "This OCSP Update", thisupd);
 986     DEBUG(D_tls) if(nextupd) time_print(bp, "Next OCSP Update", nextupd);
 987     if (!OCSP_check_validity(thisupd, nextupd,
 988           EXIM_OCSP_SKEW_SECONDS, EXIM_OCSP_MAX_AGE))
 989       {
 990       tls_out.ocsp = OCSP_FAILED;
 991       DEBUG(D_tls) ERR_print_errors(bp);
 992       log_write(0, LOG_MAIN, "Server OSCP dates invalid");
 993       i = cbinfo->u_ocsp.client.verify_required ? 0 : 1;
 994       }
 995     else
 996       {
 997       DEBUG(D_tls) BIO_printf(bp, "Certificate status: %s\n",
 998                     OCSP_cert_status_str(status));
 999       switch(status)
1000         {
1001         case V_OCSP_CERTSTATUS_GOOD:
1002           tls_out.ocsp = OCSP_VFIED;
1003           i = 1;
1004           break;
1005         case V_OCSP_CERTSTATUS_REVOKED:
1006           tls_out.ocsp = OCSP_FAILED;
1007           log_write(0, LOG_MAIN, "Server certificate revoked%s%s",
1008               reason != -1 ? "; reason: " : "",
1009               reason != -1 ? OCSP_crl_reason_str(reason) : "");
1010           DEBUG(D_tls) time_print(bp, "Revocation Time", rev);
1011           i = cbinfo->u_ocsp.client.verify_required ? 0 : 1;
1012           break;
1013         default:
1014           tls_out.ocsp = OCSP_FAILED;
1015           log_write(0, LOG_MAIN,
1016               "Server certificate status unknown, in OCSP stapling");
1017           i = cbinfo->u_ocsp.client.verify_required ? 0 : 1;
1018           break;
1019         }
1020       }
1021   out:
1022     BIO_free(bp);
1023   }
1024
1025 OCSP_RESPONSE_free(rsp);
1026 return i;
1027 }
1028 #endif  /*!DISABLE_OCSP*/
1029
1030
1031 /*************************************************
1032 *            Initialize for TLS                  *
1033 *************************************************/
1034
1035 /* Called from both server and client code, to do preliminary initialization
1036 of the library.  We allocate and return a context structure.
1037
1038 Arguments:
1039   ctxp            returned SSL context
1040   host            connected host, if client; NULL if server
1041   dhparam         DH parameter file
1042   certificate     certificate file
1043   privatekey      private key
1044   ocsp_file       file of stapling info (server); flag for require ocsp (client)
1045   addr            address if client; NULL if server (for some randomness)
1046   cbp             place to put allocated callback context
1047
1048 Returns:          OK/DEFER/FAIL
1049 */
1050
1051 static int
1052 tls_init(SSL_CTX **ctxp, host_item *host, uschar *dhparam, uschar *certificate,
1053   uschar *privatekey,
1054 #ifndef DISABLE_OCSP
1055   uschar *ocsp_file,
1056 #endif
1057   address_item *addr, tls_ext_ctx_cb ** cbp)
1058 {
1059 long init_options;
1060 int rc;
1061 BOOL okay;
1062 tls_ext_ctx_cb *cbinfo;
1063
1064 cbinfo = store_malloc(sizeof(tls_ext_ctx_cb));
1065 cbinfo->certificate = certificate;
1066 cbinfo->privatekey = privatekey;
1067 #ifndef DISABLE_OCSP
1068 if ((cbinfo->is_server = host==NULL))
1069   {
1070   cbinfo->u_ocsp.server.file = ocsp_file;
1071   cbinfo->u_ocsp.server.file_expanded = NULL;
1072   cbinfo->u_ocsp.server.response = NULL;
1073   }
1074 else
1075   cbinfo->u_ocsp.client.verify_store = NULL;
1076 #endif
1077 cbinfo->dhparam = dhparam;
1078 cbinfo->server_cipher_list = NULL;
1079 cbinfo->host = host;
1080
1081 SSL_load_error_strings();          /* basic set up */
1082 OpenSSL_add_ssl_algorithms();
1083
1084 #if (OPENSSL_VERSION_NUMBER >= 0x0090800fL) && !defined(OPENSSL_NO_SHA256)
1085 /* SHA256 is becoming ever more popular. This makes sure it gets added to the
1086 list of available digests. */
1087 EVP_add_digest(EVP_sha256());
1088 #endif
1089
1090 /* Create a context.
1091 The OpenSSL docs in 1.0.1b have not been updated to clarify TLS variant
1092 negotiation in the different methods; as far as I can tell, the only
1093 *_{server,client}_method which allows negotiation is SSLv23, which exists even
1094 when OpenSSL is built without SSLv2 support.
1095 By disabling with openssl_options, we can let admins re-enable with the
1096 existing knob. */
1097
1098 *ctxp = SSL_CTX_new((host == NULL)?
1099   SSLv23_server_method() : SSLv23_client_method());
1100
1101 if (*ctxp == NULL) return tls_error(US"SSL_CTX_new", host, NULL);
1102
1103 /* It turns out that we need to seed the random number generator this early in
1104 order to get the full complement of ciphers to work. It took me roughly a day
1105 of work to discover this by experiment.
1106
1107 On systems that have /dev/urandom, SSL may automatically seed itself from
1108 there. Otherwise, we have to make something up as best we can. Double check
1109 afterwards. */
1110
1111 if (!RAND_status())
1112   {
1113   randstuff r;
1114   gettimeofday(&r.tv, NULL);
1115   r.p = getpid();
1116
1117   RAND_seed((uschar *)(&r), sizeof(r));
1118   RAND_seed((uschar *)big_buffer, big_buffer_size);
1119   if (addr != NULL) RAND_seed((uschar *)addr, sizeof(addr));
1120
1121   if (!RAND_status())
1122     return tls_error(US"RAND_status", host,
1123       US"unable to seed random number generator");
1124   }
1125
1126 /* Set up the information callback, which outputs if debugging is at a suitable
1127 level. */
1128
1129 SSL_CTX_set_info_callback(*ctxp, (void (*)())info_callback);
1130
1131 /* Automatically re-try reads/writes after renegotiation. */
1132 (void) SSL_CTX_set_mode(*ctxp, SSL_MODE_AUTO_RETRY);
1133
1134 /* Apply administrator-supplied work-arounds.
1135 Historically we applied just one requested option,
1136 SSL_OP_DONT_INSERT_EMPTY_FRAGMENTS, but when bug 994 requested a second, we
1137 moved to an administrator-controlled list of options to specify and
1138 grandfathered in the first one as the default value for "openssl_options".
1139
1140 No OpenSSL version number checks: the options we accept depend upon the
1141 availability of the option value macros from OpenSSL.  */
1142
1143 okay = tls_openssl_options_parse(openssl_options, &init_options);
1144 if (!okay)
1145   return tls_error(US"openssl_options parsing failed", host, NULL);
1146
1147 if (init_options)
1148   {
1149   DEBUG(D_tls) debug_printf("setting SSL CTX options: %#lx\n", init_options);
1150   if (!(SSL_CTX_set_options(*ctxp, init_options)))
1151     return tls_error(string_sprintf(
1152           "SSL_CTX_set_option(%#lx)", init_options), host, NULL);
1153   }
1154 else
1155   DEBUG(D_tls) debug_printf("no SSL CTX options to set\n");
1156
1157 /* Initialize with DH parameters if supplied */
1158
1159 if (!init_dh(*ctxp, dhparam, host)) return DEFER;
1160
1161 /* Set up certificate and key (and perhaps OCSP info) */
1162
1163 rc = tls_expand_session_files(*ctxp, cbinfo);
1164 if (rc != OK) return rc;
1165
1166 /* If we need to handle SNI, do so */
1167 #ifdef EXIM_HAVE_OPENSSL_TLSEXT
1168 if (host == NULL)               /* server */
1169   {
1170 # ifndef DISABLE_OCSP
1171   /* We check u_ocsp.server.file, not server.response, because we care about if
1172   the option exists, not what the current expansion might be, as SNI might
1173   change the certificate and OCSP file in use between now and the time the
1174   callback is invoked. */
1175   if (cbinfo->u_ocsp.server.file)
1176     {
1177     SSL_CTX_set_tlsext_status_cb(server_ctx, tls_server_stapling_cb);
1178     SSL_CTX_set_tlsext_status_arg(server_ctx, cbinfo);
1179     }
1180 # endif
1181   /* We always do this, so that $tls_sni is available even if not used in
1182   tls_certificate */
1183   SSL_CTX_set_tlsext_servername_callback(*ctxp, tls_servername_cb);
1184   SSL_CTX_set_tlsext_servername_arg(*ctxp, cbinfo);
1185   }
1186 # ifndef DISABLE_OCSP
1187 else                    /* client */
1188   if(ocsp_file)         /* wanting stapling */
1189     {
1190     if (!(cbinfo->u_ocsp.client.verify_store = X509_STORE_new()))
1191       {
1192       DEBUG(D_tls) debug_printf("failed to create store for stapling verify\n");
1193       return FAIL;
1194       }
1195     SSL_CTX_set_tlsext_status_cb(*ctxp, tls_client_stapling_cb);
1196     SSL_CTX_set_tlsext_status_arg(*ctxp, cbinfo);
1197     }
1198 # endif
1199 #endif
1200
1201 #ifdef EXPERIMENTAL_CERTNAMES
1202 cbinfo->verify_cert_hostnames = NULL;
1203 #endif
1204
1205 /* Set up the RSA callback */
1206
1207 SSL_CTX_set_tmp_rsa_callback(*ctxp, rsa_callback);
1208
1209 /* Finally, set the timeout, and we are done */
1210
1211 SSL_CTX_set_timeout(*ctxp, ssl_session_timeout);
1212 DEBUG(D_tls) debug_printf("Initialized TLS\n");
1213
1214 *cbp = cbinfo;
1215
1216 return OK;
1217 }
1218
1219
1220
1221
1222 /*************************************************
1223 *           Get name of cipher in use            *
1224 *************************************************/
1225
1226 /*
1227 Argument:   pointer to an SSL structure for the connection
1228             buffer to use for answer
1229             size of buffer
1230             pointer to number of bits for cipher
1231 Returns:    nothing
1232 */
1233
1234 static void
1235 construct_cipher_name(SSL *ssl, uschar *cipherbuf, int bsize, int *bits)
1236 {
1237 /* With OpenSSL 1.0.0a, this needs to be const but the documentation doesn't
1238 yet reflect that.  It should be a safe change anyway, even 0.9.8 versions have
1239 the accessor functions use const in the prototype. */
1240 const SSL_CIPHER *c;
1241 const uschar *ver;
1242
1243 ver = (const uschar *)SSL_get_version(ssl);
1244
1245 c = (const SSL_CIPHER *) SSL_get_current_cipher(ssl);
1246 SSL_CIPHER_get_bits(c, bits);
1247
1248 string_format(cipherbuf, bsize, "%s:%s:%u", ver,
1249   SSL_CIPHER_get_name(c), *bits);
1250
1251 DEBUG(D_tls) debug_printf("Cipher: %s\n", cipherbuf);
1252 }
1253
1254
1255
1256
1257
1258 /*************************************************
1259 *        Set up for verifying certificates       *
1260 *************************************************/
1261
1262 /* Called by both client and server startup
1263
1264 Arguments:
1265   sctx          SSL_CTX* to initialise
1266   certs         certs file or NULL
1267   crl           CRL file or NULL
1268   host          NULL in a server; the remote host in a client
1269   optional      TRUE if called from a server for a host in tls_try_verify_hosts;
1270                 otherwise passed as FALSE
1271   cert_vfy_cb   Callback function for certificate verification
1272
1273 Returns:        OK/DEFER/FAIL
1274 */
1275
1276 static int
1277 setup_certs(SSL_CTX *sctx, uschar *certs, uschar *crl, host_item *host, BOOL optional,
1278     int (*cert_vfy_cb)(int, X509_STORE_CTX *) )
1279 {
1280 uschar *expcerts, *expcrl;
1281
1282 if (!expand_check(certs, US"tls_verify_certificates", &expcerts))
1283   return DEFER;
1284
1285 if (expcerts != NULL && *expcerts != '\0')
1286   {
1287   struct stat statbuf;
1288   if (!SSL_CTX_set_default_verify_paths(sctx))
1289     return tls_error(US"SSL_CTX_set_default_verify_paths", host, NULL);
1290
1291   if (Ustat(expcerts, &statbuf) < 0)
1292     {
1293     log_write(0, LOG_MAIN|LOG_PANIC,
1294       "failed to stat %s for certificates", expcerts);
1295     return DEFER;
1296     }
1297   else
1298     {
1299     uschar *file, *dir;
1300     if ((statbuf.st_mode & S_IFMT) == S_IFDIR)
1301       { file = NULL; dir = expcerts; }
1302     else
1303       { file = expcerts; dir = NULL; }
1304
1305     /* If a certificate file is empty, the next function fails with an
1306     unhelpful error message. If we skip it, we get the correct behaviour (no
1307     certificates are recognized, but the error message is still misleading (it
1308     says no certificate was supplied.) But this is better. */
1309
1310     if ((file == NULL || statbuf.st_size > 0) &&
1311           !SSL_CTX_load_verify_locations(sctx, CS file, CS dir))
1312       return tls_error(US"SSL_CTX_load_verify_locations", host, NULL);
1313
1314     if (file != NULL)
1315       {
1316       SSL_CTX_set_client_CA_list(sctx, SSL_load_client_CA_file(CS file));
1317       }
1318     }
1319
1320   /* Handle a certificate revocation list. */
1321
1322   #if OPENSSL_VERSION_NUMBER > 0x00907000L
1323
1324   /* This bit of code is now the version supplied by Lars Mainka. (I have
1325    * merely reformatted it into the Exim code style.)
1326
1327    * "From here I changed the code to add support for multiple crl's
1328    * in pem format in one file or to support hashed directory entries in
1329    * pem format instead of a file. This method now uses the library function
1330    * X509_STORE_load_locations to add the CRL location to the SSL context.
1331    * OpenSSL will then handle the verify against CA certs and CRLs by
1332    * itself in the verify callback." */
1333
1334   if (!expand_check(crl, US"tls_crl", &expcrl)) return DEFER;
1335   if (expcrl != NULL && *expcrl != 0)
1336     {
1337     struct stat statbufcrl;
1338     if (Ustat(expcrl, &statbufcrl) < 0)
1339       {
1340       log_write(0, LOG_MAIN|LOG_PANIC,
1341         "failed to stat %s for certificates revocation lists", expcrl);
1342       return DEFER;
1343       }
1344     else
1345       {
1346       /* is it a file or directory? */
1347       uschar *file, *dir;
1348       X509_STORE *cvstore = SSL_CTX_get_cert_store(sctx);
1349       if ((statbufcrl.st_mode & S_IFMT) == S_IFDIR)
1350         {
1351         file = NULL;
1352         dir = expcrl;
1353         DEBUG(D_tls) debug_printf("SSL CRL value is a directory %s\n", dir);
1354         }
1355       else
1356         {
1357         file = expcrl;
1358         dir = NULL;
1359         DEBUG(D_tls) debug_printf("SSL CRL value is a file %s\n", file);
1360         }
1361       if (X509_STORE_load_locations(cvstore, CS file, CS dir) == 0)
1362         return tls_error(US"X509_STORE_load_locations", host, NULL);
1363
1364       /* setting the flags to check against the complete crl chain */
1365
1366       X509_STORE_set_flags(cvstore,
1367         X509_V_FLAG_CRL_CHECK|X509_V_FLAG_CRL_CHECK_ALL);
1368       }
1369     }
1370
1371   #endif  /* OPENSSL_VERSION_NUMBER > 0x00907000L */
1372
1373   /* If verification is optional, don't fail if no certificate */
1374
1375   SSL_CTX_set_verify(sctx,
1376     SSL_VERIFY_PEER | (optional? 0 : SSL_VERIFY_FAIL_IF_NO_PEER_CERT),
1377     cert_vfy_cb);
1378   }
1379
1380 return OK;
1381 }
1382
1383
1384
1385 /*************************************************
1386 *       Start a TLS session in a server          *
1387 *************************************************/
1388
1389 /* This is called when Exim is running as a server, after having received
1390 the STARTTLS command. It must respond to that command, and then negotiate
1391 a TLS session.
1392
1393 Arguments:
1394   require_ciphers   allowed ciphers
1395
1396 Returns:            OK on success
1397                     DEFER for errors before the start of the negotiation
1398                     FAIL for errors during the negotation; the server can't
1399                       continue running.
1400 */
1401
1402 int
1403 tls_server_start(const uschar *require_ciphers)
1404 {
1405 int rc;
1406 uschar *expciphers;
1407 tls_ext_ctx_cb *cbinfo;
1408 static uschar cipherbuf[256];
1409
1410 /* Check for previous activation */
1411
1412 if (tls_in.active >= 0)
1413   {
1414   tls_error(US"STARTTLS received after TLS started", NULL, US"");
1415   smtp_printf("554 Already in TLS\r\n");
1416   return FAIL;
1417   }
1418
1419 /* Initialize the SSL library. If it fails, it will already have logged
1420 the error. */
1421
1422 rc = tls_init(&server_ctx, NULL, tls_dhparam, tls_certificate, tls_privatekey,
1423 #ifndef DISABLE_OCSP
1424     tls_ocsp_file,
1425 #endif
1426     NULL, &server_static_cbinfo);
1427 if (rc != OK) return rc;
1428 cbinfo = server_static_cbinfo;
1429
1430 if (!expand_check(require_ciphers, US"tls_require_ciphers", &expciphers))
1431   return FAIL;
1432
1433 /* In OpenSSL, cipher components are separated by hyphens. In GnuTLS, they
1434 were historically separated by underscores. So that I can use either form in my
1435 tests, and also for general convenience, we turn underscores into hyphens here.
1436 */
1437
1438 if (expciphers != NULL)
1439   {
1440   uschar *s = expciphers;
1441   while (*s != 0) { if (*s == '_') *s = '-'; s++; }
1442   DEBUG(D_tls) debug_printf("required ciphers: %s\n", expciphers);
1443   if (!SSL_CTX_set_cipher_list(server_ctx, CS expciphers))
1444     return tls_error(US"SSL_CTX_set_cipher_list", NULL, NULL);
1445   cbinfo->server_cipher_list = expciphers;
1446   }
1447
1448 /* If this is a host for which certificate verification is mandatory or
1449 optional, set up appropriately. */
1450
1451 tls_in.certificate_verified = FALSE;
1452 #ifdef EXPERIMENTAL_DANE
1453 tls_in.dane_verified = FALSE;
1454 #endif
1455 server_verify_callback_called = FALSE;
1456
1457 if (verify_check_host(&tls_verify_hosts) == OK)
1458   {
1459   rc = setup_certs(server_ctx, tls_verify_certificates, tls_crl, NULL,
1460                         FALSE, verify_callback_server);
1461   if (rc != OK) return rc;
1462   server_verify_optional = FALSE;
1463   }
1464 else if (verify_check_host(&tls_try_verify_hosts) == OK)
1465   {
1466   rc = setup_certs(server_ctx, tls_verify_certificates, tls_crl, NULL,
1467                         TRUE, verify_callback_server);
1468   if (rc != OK) return rc;
1469   server_verify_optional = TRUE;
1470   }
1471
1472 /* Prepare for new connection */
1473
1474 if ((server_ssl = SSL_new(server_ctx)) == NULL) return tls_error(US"SSL_new", NULL, NULL);
1475
1476 /* Warning: we used to SSL_clear(ssl) here, it was removed.
1477  *
1478  * With the SSL_clear(), we get strange interoperability bugs with
1479  * OpenSSL 1.0.1b and TLS1.1/1.2.  It looks as though this may be a bug in
1480  * OpenSSL itself, as a clear should not lead to inability to follow protocols.
1481  *
1482  * The SSL_clear() call is to let an existing SSL* be reused, typically after
1483  * session shutdown.  In this case, we have a brand new object and there's no
1484  * obvious reason to immediately clear it.  I'm guessing that this was
1485  * originally added because of incomplete initialisation which the clear fixed,
1486  * in some historic release.
1487  */
1488
1489 /* Set context and tell client to go ahead, except in the case of TLS startup
1490 on connection, where outputting anything now upsets the clients and tends to
1491 make them disconnect. We need to have an explicit fflush() here, to force out
1492 the response. Other smtp_printf() calls do not need it, because in non-TLS
1493 mode, the fflush() happens when smtp_getc() is called. */
1494
1495 SSL_set_session_id_context(server_ssl, sid_ctx, Ustrlen(sid_ctx));
1496 if (!tls_in.on_connect)
1497   {
1498   smtp_printf("220 TLS go ahead\r\n");
1499   fflush(smtp_out);
1500   }
1501
1502 /* Now negotiate the TLS session. We put our own timer on it, since it seems
1503 that the OpenSSL library doesn't. */
1504
1505 SSL_set_wfd(server_ssl, fileno(smtp_out));
1506 SSL_set_rfd(server_ssl, fileno(smtp_in));
1507 SSL_set_accept_state(server_ssl);
1508
1509 DEBUG(D_tls) debug_printf("Calling SSL_accept\n");
1510
1511 sigalrm_seen = FALSE;
1512 if (smtp_receive_timeout > 0) alarm(smtp_receive_timeout);
1513 rc = SSL_accept(server_ssl);
1514 alarm(0);
1515
1516 if (rc <= 0)
1517   {
1518   tls_error(US"SSL_accept", NULL, sigalrm_seen ? US"timed out" : NULL);
1519   if (ERR_get_error() == 0)
1520     log_write(0, LOG_MAIN,
1521         "TLS client disconnected cleanly (rejected our certificate?)");
1522   return FAIL;
1523   }
1524
1525 DEBUG(D_tls) debug_printf("SSL_accept was successful\n");
1526
1527 /* TLS has been set up. Adjust the input functions to read via TLS,
1528 and initialize things. */
1529
1530 construct_cipher_name(server_ssl, cipherbuf, sizeof(cipherbuf), &tls_in.bits);
1531 tls_in.cipher = cipherbuf;
1532
1533 DEBUG(D_tls)
1534   {
1535   uschar buf[2048];
1536   if (SSL_get_shared_ciphers(server_ssl, CS buf, sizeof(buf)) != NULL)
1537     debug_printf("Shared ciphers: %s\n", buf);
1538   }
1539
1540 /* Record the certificate we presented */
1541   {
1542   X509 * crt = SSL_get_certificate(server_ssl);
1543   tls_in.ourcert = crt ? X509_dup(crt) : NULL;
1544   }
1545
1546 /* Only used by the server-side tls (tls_in), including tls_getc.
1547    Client-side (tls_out) reads (seem to?) go via
1548    smtp_read_response()/ip_recv().
1549    Hence no need to duplicate for _in and _out.
1550  */
1551 ssl_xfer_buffer = store_malloc(ssl_xfer_buffer_size);
1552 ssl_xfer_buffer_lwm = ssl_xfer_buffer_hwm = 0;
1553 ssl_xfer_eof = ssl_xfer_error = 0;
1554
1555 receive_getc = tls_getc;
1556 receive_ungetc = tls_ungetc;
1557 receive_feof = tls_feof;
1558 receive_ferror = tls_ferror;
1559 receive_smtp_buffered = tls_smtp_buffered;
1560
1561 tls_in.active = fileno(smtp_out);
1562 return OK;
1563 }
1564
1565
1566
1567
1568 static int
1569 tls_client_basic_ctx_init(SSL_CTX * ctx,
1570     host_item * host, smtp_transport_options_block * ob
1571 #ifdef EXPERIMENTAL_CERTNAMES
1572     , tls_ext_ctx_cb * cbinfo
1573 #endif
1574                           )
1575 {
1576 int rc;
1577 /* stick to the old behaviour for compatibility if tls_verify_certificates is
1578    set but both tls_verify_hosts and tls_try_verify_hosts is not set. Check only
1579    the specified host patterns if one of them is defined */
1580
1581 if ((!ob->tls_verify_hosts && !ob->tls_try_verify_hosts) ||
1582     (verify_check_host(&ob->tls_verify_hosts) == OK))
1583   {
1584   if ((rc = setup_certs(ctx, ob->tls_verify_certificates,
1585         ob->tls_crl, host, FALSE, verify_callback_client)) != OK)
1586     return rc;
1587   client_verify_optional = FALSE;
1588
1589 #ifdef EXPERIMENTAL_CERTNAMES
1590   if (ob->tls_verify_cert_hostnames)
1591     {
1592     if (!expand_check(ob->tls_verify_cert_hostnames,
1593                       US"tls_verify_cert_hostnames",
1594                       &cbinfo->verify_cert_hostnames))
1595       return FAIL;
1596     if (cbinfo->verify_cert_hostnames)
1597       DEBUG(D_tls) debug_printf("Cert hostname to check: \"%s\"\n",
1598                       cbinfo->verify_cert_hostnames);
1599     }
1600 #endif
1601   }
1602 else if (verify_check_host(&ob->tls_try_verify_hosts) == OK)
1603   {
1604   if ((rc = setup_certs(ctx, ob->tls_verify_certificates,
1605         ob->tls_crl, host, TRUE, verify_callback_client)) != OK)
1606     return rc;
1607   client_verify_optional = TRUE;
1608   }
1609
1610 return OK;
1611 }
1612
1613
1614 #ifdef EXPERIMENTAL_DANE
1615 static int
1616 tlsa_lookup(host_item * host, dns_answer * dnsa,
1617   BOOL dane_required, BOOL * dane)
1618 {
1619 /* move this out to host.c given the similarity to dns_lookup() ? */
1620 uschar buffer[300];
1621 uschar * fullname = buffer;
1622
1623 /* TLSA lookup string */
1624 (void)sprintf(CS buffer, "_%d._tcp.%.256s", host->port, host->name);
1625
1626 switch (dns_lookup(dnsa, buffer, T_TLSA, &fullname))
1627   {
1628   case DNS_AGAIN:
1629     return DEFER; /* just defer this TLS'd conn */
1630
1631   default:
1632   case DNS_FAIL:
1633     if (dane_required)
1634       {
1635       log_write(0, LOG_MAIN, "DANE error: TLSA lookup failed");
1636       return FAIL;
1637       }
1638     break;
1639
1640   case DNS_SUCCEED:
1641     if (!dns_is_secure(dnsa))
1642       {
1643       log_write(0, LOG_MAIN, "DANE error: TLSA lookup not DNSSEC");
1644       return DEFER;
1645       }
1646     *dane = TRUE;
1647     break;
1648   }
1649 return OK;
1650 }
1651
1652
1653 static int
1654 dane_tlsa_load(SSL * ssl, host_item * host, dns_answer * dnsa)
1655 {
1656 dns_record * rr;
1657 dns_scan dnss;
1658 const char * hostnames[2] = { CS host->name, NULL };
1659 int found = 0;
1660
1661 if (DANESSL_init(ssl, NULL, hostnames) != 1)
1662   return tls_error(US"hostnames load", host, NULL);
1663
1664 for (rr = dns_next_rr(dnsa, &dnss, RESET_ANSWERS);
1665      rr;
1666      rr = dns_next_rr(dnsa, &dnss, RESET_NEXT)
1667     ) if (rr->type == T_TLSA)
1668   {
1669   uschar * p = rr->data;
1670   uint8_t usage, selector, mtype;
1671   const char * mdname;
1672
1673   found++;
1674   usage = *p++;
1675   selector = *p++;
1676   mtype = *p++;
1677
1678   switch (mtype)
1679     {
1680     default:
1681       log_write(0, LOG_MAIN,
1682                 "DANE error: TLSA record w/bad mtype 0x%x", mtype);
1683       return FAIL;
1684     case 0:     mdname = NULL; break;
1685     case 1:     mdname = "sha256"; break;
1686     case 2:     mdname = "sha512"; break;
1687     }
1688
1689   switch (DANESSL_add_tlsa(ssl, usage, selector, mdname, p, rr->size - 3))
1690     {
1691     default:
1692     case 0:     /* action not taken */
1693       return tls_error(US"tlsa load", host, NULL);
1694     case 1:     break;
1695     }
1696   }
1697
1698 if (found)
1699   return OK;
1700
1701 log_write(0, LOG_MAIN, "DANE error: No TLSA records");
1702 return FAIL;
1703 }
1704 #endif  /*EXPERIMENTAL_DANE*/
1705
1706
1707
1708 /*************************************************
1709 *    Start a TLS session in a client             *
1710 *************************************************/
1711
1712 /* Called from the smtp transport after STARTTLS has been accepted.
1713
1714 Argument:
1715   fd               the fd of the connection
1716   host             connected host (for messages)
1717   addr             the first address
1718   ob               smtp transport options
1719
1720 Returns:           OK on success
1721                    FAIL otherwise - note that tls_error() will not give DEFER
1722                      because this is not a server
1723 */
1724
1725 int
1726 tls_client_start(int fd, host_item *host, address_item *addr,
1727   void *v_ob)
1728 {
1729 smtp_transport_options_block * ob = v_ob;
1730 static uschar txt[256];
1731 uschar * expciphers;
1732 X509 * server_cert;
1733 int rc;
1734 static uschar cipherbuf[256];
1735
1736 #ifndef DISABLE_OCSP
1737 BOOL request_ocsp = FALSE;
1738 BOOL require_ocsp = FALSE;
1739 #endif
1740 #ifdef EXPERIMENTAL_DANE
1741 dns_answer tlsa_dnsa;
1742 BOOL dane = FALSE;
1743 BOOL dane_required;
1744 #endif
1745
1746 #ifdef EXPERIMENTAL_DANE
1747 tls_out.dane_verified = FALSE;
1748 dane_required = verify_check_this_host(&ob->hosts_require_dane, NULL,
1749                           host->name, host->address, NULL) == OK;
1750
1751 if (host->dnssec == DS_YES)
1752   {
1753   if(  dane_required
1754     || verify_check_this_host(&ob->hosts_try_dane, NULL,
1755                           host->name, host->address, NULL) == OK
1756     )
1757     if ((rc = tlsa_lookup(host, &tlsa_dnsa, dane_required, &dane)) != OK)
1758       return rc;
1759   }
1760 else if (dane_required)
1761   {
1762   /*XXX a shame we only find this after making tcp & smtp connection */
1763   /* move the test earlier? */
1764   log_write(0, LOG_MAIN, "DANE error: previous lookup not DNSSEC");
1765   return FAIL;
1766   }
1767
1768 #endif
1769
1770 #ifndef DISABLE_OCSP
1771   {
1772   require_ocsp = verify_check_this_host(&ob->hosts_require_ocsp,
1773     NULL, host->name, host->address, NULL) == OK;
1774   request_ocsp = require_ocsp ? TRUE
1775     : verify_check_this_host(&ob->hosts_request_ocsp,
1776         NULL, host->name, host->address, NULL) == OK;
1777   }
1778 #endif
1779
1780 rc = tls_init(&client_ctx, host, NULL,
1781     ob->tls_certificate, ob->tls_privatekey,
1782 #ifndef DISABLE_OCSP
1783     (void *)(long)request_ocsp,
1784 #endif
1785     addr, &client_static_cbinfo);
1786 if (rc != OK) return rc;
1787
1788 tls_out.certificate_verified = FALSE;
1789 client_verify_callback_called = FALSE;
1790
1791 if (!expand_check(ob->tls_require_ciphers, US"tls_require_ciphers",
1792     &expciphers))
1793   return FAIL;
1794
1795 /* In OpenSSL, cipher components are separated by hyphens. In GnuTLS, they
1796 are separated by underscores. So that I can use either form in my tests, and
1797 also for general convenience, we turn underscores into hyphens here. */
1798
1799 if (expciphers != NULL)
1800   {
1801   uschar *s = expciphers;
1802   while (*s != 0) { if (*s == '_') *s = '-'; s++; }
1803   DEBUG(D_tls) debug_printf("required ciphers: %s\n", expciphers);
1804   if (!SSL_CTX_set_cipher_list(client_ctx, CS expciphers))
1805     return tls_error(US"SSL_CTX_set_cipher_list", host, NULL);
1806   }
1807
1808 #ifdef EXPERIMENTAL_DANE
1809 if (dane)
1810   {
1811   SSL_CTX_set_verify(client_ctx, SSL_VERIFY_PEER, verify_callback_client_dane);
1812
1813   if (!DANESSL_library_init())
1814     return tls_error(US"library init", host, NULL);
1815   if (DANESSL_CTX_init(client_ctx) <= 0)
1816     return tls_error(US"context init", host, NULL);
1817   }
1818 else
1819
1820 #endif
1821
1822   if ((rc = tls_client_basic_ctx_init(client_ctx, host, ob
1823 #ifdef EXPERIMENTAL_CERTNAMES
1824                                 , client_static_cbinfo
1825 #endif
1826                                 )) != OK)
1827     return rc;
1828
1829 if ((client_ssl = SSL_new(client_ctx)) == NULL)
1830   return tls_error(US"SSL_new", host, NULL);
1831 SSL_set_session_id_context(client_ssl, sid_ctx, Ustrlen(sid_ctx));
1832 SSL_set_fd(client_ssl, fd);
1833 SSL_set_connect_state(client_ssl);
1834
1835 if (ob->tls_sni)
1836   {
1837   if (!expand_check(ob->tls_sni, US"tls_sni", &tls_out.sni))
1838     return FAIL;
1839   if (tls_out.sni == NULL)
1840     {
1841     DEBUG(D_tls) debug_printf("Setting TLS SNI forced to fail, not sending\n");
1842     }
1843   else if (!Ustrlen(tls_out.sni))
1844     tls_out.sni = NULL;
1845   else
1846     {
1847 #ifdef EXIM_HAVE_OPENSSL_TLSEXT
1848     DEBUG(D_tls) debug_printf("Setting TLS SNI \"%s\"\n", tls_out.sni);
1849     SSL_set_tlsext_host_name(client_ssl, tls_out.sni);
1850 #else
1851     DEBUG(D_tls)
1852       debug_printf("OpenSSL at build-time lacked SNI support, ignoring \"%s\"\n",
1853           tls_out.sni);
1854 #endif
1855     }
1856   }
1857
1858 #ifndef DISABLE_OCSP
1859 /* Request certificate status at connection-time.  If the server
1860 does OCSP stapling we will get the callback (set in tls_init()) */
1861 if (request_ocsp)
1862   {
1863   SSL_set_tlsext_status_type(client_ssl, TLSEXT_STATUSTYPE_ocsp);
1864   client_static_cbinfo->u_ocsp.client.verify_required = require_ocsp;
1865   tls_out.ocsp = OCSP_NOT_RESP;
1866   }
1867 #endif
1868
1869 #ifdef EXPERIMENTAL_DANE
1870 if (dane)
1871   if ((rc = dane_tlsa_load(client_ssl, host, &tlsa_dnsa)) != OK)
1872     return rc;
1873 #endif
1874
1875
1876 /* There doesn't seem to be a built-in timeout on connection. */
1877
1878 DEBUG(D_tls) debug_printf("Calling SSL_connect\n");
1879 sigalrm_seen = FALSE;
1880 alarm(ob->command_timeout);
1881 rc = SSL_connect(client_ssl);
1882 alarm(0);
1883
1884 #ifdef EXPERIMENTAL_DANE
1885 if (dane)
1886   DANESSL_cleanup(client_ssl);
1887 #endif
1888
1889 if (rc <= 0)
1890   return tls_error(US"SSL_connect", host, sigalrm_seen ? US"timed out" : NULL);
1891
1892 DEBUG(D_tls) debug_printf("SSL_connect succeeded\n");
1893
1894 /* Beware anonymous ciphers which lead to server_cert being NULL */
1895 /*XXX server_cert is never freed... use X509_free() */
1896 server_cert = SSL_get_peer_certificate (client_ssl);
1897 if (server_cert)
1898   {
1899   tls_out.peerdn = US X509_NAME_oneline(X509_get_subject_name(server_cert),
1900     CS txt, sizeof(txt));
1901   tls_out.peerdn = txt;         /*XXX a static buffer... */
1902   }
1903 else
1904   tls_out.peerdn = NULL;
1905
1906 construct_cipher_name(client_ssl, cipherbuf, sizeof(cipherbuf), &tls_out.bits);
1907 tls_out.cipher = cipherbuf;
1908
1909 /* Record the certificate we presented */
1910   {
1911   X509 * crt = SSL_get_certificate(client_ssl);
1912   tls_out.ourcert = crt ? X509_dup(crt) : NULL;
1913   }
1914
1915 tls_out.active = fd;
1916 return OK;
1917 }
1918
1919
1920
1921
1922
1923 /*************************************************
1924 *            TLS version of getc                 *
1925 *************************************************/
1926
1927 /* This gets the next byte from the TLS input buffer. If the buffer is empty,
1928 it refills the buffer via the SSL reading function.
1929
1930 Arguments:  none
1931 Returns:    the next character or EOF
1932
1933 Only used by the server-side TLS.
1934 */
1935
1936 int
1937 tls_getc(void)
1938 {
1939 if (ssl_xfer_buffer_lwm >= ssl_xfer_buffer_hwm)
1940   {
1941   int error;
1942   int inbytes;
1943
1944   DEBUG(D_tls) debug_printf("Calling SSL_read(%p, %p, %u)\n", server_ssl,
1945     ssl_xfer_buffer, ssl_xfer_buffer_size);
1946
1947   if (smtp_receive_timeout > 0) alarm(smtp_receive_timeout);
1948   inbytes = SSL_read(server_ssl, CS ssl_xfer_buffer, ssl_xfer_buffer_size);
1949   error = SSL_get_error(server_ssl, inbytes);
1950   alarm(0);
1951
1952   /* SSL_ERROR_ZERO_RETURN appears to mean that the SSL session has been
1953   closed down, not that the socket itself has been closed down. Revert to
1954   non-SSL handling. */
1955
1956   if (error == SSL_ERROR_ZERO_RETURN)
1957     {
1958     DEBUG(D_tls) debug_printf("Got SSL_ERROR_ZERO_RETURN\n");
1959
1960     receive_getc = smtp_getc;
1961     receive_ungetc = smtp_ungetc;
1962     receive_feof = smtp_feof;
1963     receive_ferror = smtp_ferror;
1964     receive_smtp_buffered = smtp_buffered;
1965
1966     SSL_free(server_ssl);
1967     server_ssl = NULL;
1968     tls_in.active = -1;
1969     tls_in.bits = 0;
1970     tls_in.cipher = NULL;
1971     tls_in.peerdn = NULL;
1972     tls_in.sni = NULL;
1973
1974     return smtp_getc();
1975     }
1976
1977   /* Handle genuine errors */
1978
1979   else if (error == SSL_ERROR_SSL)
1980     {
1981     ERR_error_string(ERR_get_error(), ssl_errstring);
1982     log_write(0, LOG_MAIN, "TLS error (SSL_read): %s", ssl_errstring);
1983     ssl_xfer_error = 1;
1984     return EOF;
1985     }
1986
1987   else if (error != SSL_ERROR_NONE)
1988     {
1989     DEBUG(D_tls) debug_printf("Got SSL error %d\n", error);
1990     ssl_xfer_error = 1;
1991     return EOF;
1992     }
1993
1994 #ifndef DISABLE_DKIM
1995   dkim_exim_verify_feed(ssl_xfer_buffer, inbytes);
1996 #endif
1997   ssl_xfer_buffer_hwm = inbytes;
1998   ssl_xfer_buffer_lwm = 0;
1999   }
2000
2001 /* Something in the buffer; return next uschar */
2002
2003 return ssl_xfer_buffer[ssl_xfer_buffer_lwm++];
2004 }
2005
2006
2007
2008 /*************************************************
2009 *          Read bytes from TLS channel           *
2010 *************************************************/
2011
2012 /*
2013 Arguments:
2014   buff      buffer of data
2015   len       size of buffer
2016
2017 Returns:    the number of bytes read
2018             -1 after a failed read
2019
2020 Only used by the client-side TLS.
2021 */
2022
2023 int
2024 tls_read(BOOL is_server, uschar *buff, size_t len)
2025 {
2026 SSL *ssl = is_server ? server_ssl : client_ssl;
2027 int inbytes;
2028 int error;
2029
2030 DEBUG(D_tls) debug_printf("Calling SSL_read(%p, %p, %u)\n", ssl,
2031   buff, (unsigned int)len);
2032
2033 inbytes = SSL_read(ssl, CS buff, len);
2034 error = SSL_get_error(ssl, inbytes);
2035
2036 if (error == SSL_ERROR_ZERO_RETURN)
2037   {
2038   DEBUG(D_tls) debug_printf("Got SSL_ERROR_ZERO_RETURN\n");
2039   return -1;
2040   }
2041 else if (error != SSL_ERROR_NONE)
2042   {
2043   return -1;
2044   }
2045
2046 return inbytes;
2047 }
2048
2049
2050
2051
2052
2053 /*************************************************
2054 *         Write bytes down TLS channel           *
2055 *************************************************/
2056
2057 /*
2058 Arguments:
2059   is_server channel specifier
2060   buff      buffer of data
2061   len       number of bytes
2062
2063 Returns:    the number of bytes after a successful write,
2064             -1 after a failed write
2065
2066 Used by both server-side and client-side TLS.
2067 */
2068
2069 int
2070 tls_write(BOOL is_server, const uschar *buff, size_t len)
2071 {
2072 int outbytes;
2073 int error;
2074 int left = len;
2075 SSL *ssl = is_server ? server_ssl : client_ssl;
2076
2077 DEBUG(D_tls) debug_printf("tls_do_write(%p, %d)\n", buff, left);
2078 while (left > 0)
2079   {
2080   DEBUG(D_tls) debug_printf("SSL_write(SSL, %p, %d)\n", buff, left);
2081   outbytes = SSL_write(ssl, CS buff, left);
2082   error = SSL_get_error(ssl, outbytes);
2083   DEBUG(D_tls) debug_printf("outbytes=%d error=%d\n", outbytes, error);
2084   switch (error)
2085     {
2086     case SSL_ERROR_SSL:
2087     ERR_error_string(ERR_get_error(), ssl_errstring);
2088     log_write(0, LOG_MAIN, "TLS error (SSL_write): %s", ssl_errstring);
2089     return -1;
2090
2091     case SSL_ERROR_NONE:
2092     left -= outbytes;
2093     buff += outbytes;
2094     break;
2095
2096     case SSL_ERROR_ZERO_RETURN:
2097     log_write(0, LOG_MAIN, "SSL channel closed on write");
2098     return -1;
2099
2100     case SSL_ERROR_SYSCALL:
2101     log_write(0, LOG_MAIN, "SSL_write: (from %s) syscall: %s",
2102       sender_fullhost ? sender_fullhost : US"<unknown>",
2103       strerror(errno));
2104
2105     default:
2106     log_write(0, LOG_MAIN, "SSL_write error %d", error);
2107     return -1;
2108     }
2109   }
2110 return len;
2111 }
2112
2113
2114
2115 /*************************************************
2116 *         Close down a TLS session               *
2117 *************************************************/
2118
2119 /* This is also called from within a delivery subprocess forked from the
2120 daemon, to shut down the TLS library, without actually doing a shutdown (which
2121 would tamper with the SSL session in the parent process).
2122
2123 Arguments:   TRUE if SSL_shutdown is to be called
2124 Returns:     nothing
2125
2126 Used by both server-side and client-side TLS.
2127 */
2128
2129 void
2130 tls_close(BOOL is_server, BOOL shutdown)
2131 {
2132 SSL **sslp = is_server ? &server_ssl : &client_ssl;
2133 int *fdp = is_server ? &tls_in.active : &tls_out.active;
2134
2135 if (*fdp < 0) return;  /* TLS was not active */
2136
2137 if (shutdown)
2138   {
2139   DEBUG(D_tls) debug_printf("tls_close(): shutting down SSL\n");
2140   SSL_shutdown(*sslp);
2141   }
2142
2143 SSL_free(*sslp);
2144 *sslp = NULL;
2145
2146 *fdp = -1;
2147 }
2148
2149
2150
2151
2152 /*************************************************
2153 *  Let tls_require_ciphers be checked at startup *
2154 *************************************************/
2155
2156 /* The tls_require_ciphers option, if set, must be something which the
2157 library can parse.
2158
2159 Returns:     NULL on success, or error message
2160 */
2161
2162 uschar *
2163 tls_validate_require_cipher(void)
2164 {
2165 SSL_CTX *ctx;
2166 uschar *s, *expciphers, *err;
2167
2168 /* this duplicates from tls_init(), we need a better "init just global
2169 state, for no specific purpose" singleton function of our own */
2170
2171 SSL_load_error_strings();
2172 OpenSSL_add_ssl_algorithms();
2173 #if (OPENSSL_VERSION_NUMBER >= 0x0090800fL) && !defined(OPENSSL_NO_SHA256)
2174 /* SHA256 is becoming ever more popular. This makes sure it gets added to the
2175 list of available digests. */
2176 EVP_add_digest(EVP_sha256());
2177 #endif
2178
2179 if (!(tls_require_ciphers && *tls_require_ciphers))
2180   return NULL;
2181
2182 if (!expand_check(tls_require_ciphers, US"tls_require_ciphers", &expciphers))
2183   return US"failed to expand tls_require_ciphers";
2184
2185 if (!(expciphers && *expciphers))
2186   return NULL;
2187
2188 /* normalisation ripped from above */
2189 s = expciphers;
2190 while (*s != 0) { if (*s == '_') *s = '-'; s++; }
2191
2192 err = NULL;
2193
2194 ctx = SSL_CTX_new(SSLv23_server_method());
2195 if (!ctx)
2196   {
2197   ERR_error_string(ERR_get_error(), ssl_errstring);
2198   return string_sprintf("SSL_CTX_new() failed: %s", ssl_errstring);
2199   }
2200
2201 DEBUG(D_tls)
2202   debug_printf("tls_require_ciphers expands to \"%s\"\n", expciphers);
2203
2204 if (!SSL_CTX_set_cipher_list(ctx, CS expciphers))
2205   {
2206   ERR_error_string(ERR_get_error(), ssl_errstring);
2207   err = string_sprintf("SSL_CTX_set_cipher_list(%s) failed", expciphers);
2208   }
2209
2210 SSL_CTX_free(ctx);
2211
2212 return err;
2213 }
2214
2215
2216
2217
2218 /*************************************************
2219 *         Report the library versions.           *
2220 *************************************************/
2221
2222 /* There have historically been some issues with binary compatibility in
2223 OpenSSL libraries; if Exim (like many other applications) is built against
2224 one version of OpenSSL but the run-time linker picks up another version,
2225 it can result in serious failures, including crashing with a SIGSEGV.  So
2226 report the version found by the compiler and the run-time version.
2227
2228 Note: some OS vendors backport security fixes without changing the version
2229 number/string, and the version date remains unchanged.  The _build_ date
2230 will change, so we can more usefully assist with version diagnosis by also
2231 reporting the build date.
2232
2233 Arguments:   a FILE* to print the results to
2234 Returns:     nothing
2235 */
2236
2237 void
2238 tls_version_report(FILE *f)
2239 {
2240 fprintf(f, "Library version: OpenSSL: Compile: %s\n"
2241            "                          Runtime: %s\n"
2242            "                                 : %s\n",
2243            OPENSSL_VERSION_TEXT,
2244            SSLeay_version(SSLEAY_VERSION),
2245            SSLeay_version(SSLEAY_BUILT_ON));
2246 /* third line is 38 characters for the %s and the line is 73 chars long;
2247 the OpenSSL output includes a "built on: " prefix already. */
2248 }
2249
2250
2251
2252
2253 /*************************************************
2254 *            Random number generation            *
2255 *************************************************/
2256
2257 /* Pseudo-random number generation.  The result is not expected to be
2258 cryptographically strong but not so weak that someone will shoot themselves
2259 in the foot using it as a nonce in input in some email header scheme or
2260 whatever weirdness they'll twist this into.  The result should handle fork()
2261 and avoid repeating sequences.  OpenSSL handles that for us.
2262
2263 Arguments:
2264   max       range maximum
2265 Returns     a random number in range [0, max-1]
2266 */
2267
2268 int
2269 vaguely_random_number(int max)
2270 {
2271 unsigned int r;
2272 int i, needed_len;
2273 static pid_t pidlast = 0;
2274 pid_t pidnow;
2275 uschar *p;
2276 uschar smallbuf[sizeof(r)];
2277
2278 if (max <= 1)
2279   return 0;
2280
2281 pidnow = getpid();
2282 if (pidnow != pidlast)
2283   {
2284   /* Although OpenSSL documents that "OpenSSL makes sure that the PRNG state
2285   is unique for each thread", this doesn't apparently apply across processes,
2286   so our own warning from vaguely_random_number_fallback() applies here too.
2287   Fix per PostgreSQL. */
2288   if (pidlast != 0)
2289     RAND_cleanup();
2290   pidlast = pidnow;
2291   }
2292
2293 /* OpenSSL auto-seeds from /dev/random, etc, but this a double-check. */
2294 if (!RAND_status())
2295   {
2296   randstuff r;
2297   gettimeofday(&r.tv, NULL);
2298   r.p = getpid();
2299
2300   RAND_seed((uschar *)(&r), sizeof(r));
2301   }
2302 /* We're after pseudo-random, not random; if we still don't have enough data
2303 in the internal PRNG then our options are limited.  We could sleep and hope
2304 for entropy to come along (prayer technique) but if the system is so depleted
2305 in the first place then something is likely to just keep taking it.  Instead,
2306 we'll just take whatever little bit of pseudo-random we can still manage to
2307 get. */
2308
2309 needed_len = sizeof(r);
2310 /* Don't take 8 times more entropy than needed if int is 8 octets and we were
2311 asked for a number less than 10. */
2312 for (r = max, i = 0; r; ++i)
2313   r >>= 1;
2314 i = (i + 7) / 8;
2315 if (i < needed_len)
2316   needed_len = i;
2317
2318 /* We do not care if crypto-strong */
2319 i = RAND_pseudo_bytes(smallbuf, needed_len);
2320 if (i < 0)
2321   {
2322   DEBUG(D_all)
2323     debug_printf("OpenSSL RAND_pseudo_bytes() not supported by RAND method, using fallback.\n");
2324   return vaguely_random_number_fallback(max);
2325   }
2326
2327 r = 0;
2328 for (p = smallbuf; needed_len; --needed_len, ++p)
2329   {
2330   r *= 256;
2331   r += *p;
2332   }
2333
2334 /* We don't particularly care about weighted results; if someone wants
2335 smooth distribution and cares enough then they should submit a patch then. */
2336 return r % max;
2337 }
2338
2339
2340
2341
2342 /*************************************************
2343 *        OpenSSL option parse                    *
2344 *************************************************/
2345
2346 /* Parse one option for tls_openssl_options_parse below
2347
2348 Arguments:
2349   name    one option name
2350   value   place to store a value for it
2351 Returns   success or failure in parsing
2352 */
2353
2354 struct exim_openssl_option {
2355   uschar *name;
2356   long    value;
2357 };
2358 /* We could use a macro to expand, but we need the ifdef and not all the
2359 options document which version they were introduced in.  Policylet: include
2360 all options unless explicitly for DTLS, let the administrator choose which
2361 to apply.
2362
2363 This list is current as of:
2364   ==>  1.0.1b  <==
2365 Plus SSL_OP_SAFARI_ECDHE_ECDSA_BUG from 2013-June patch/discussion on openssl-dev
2366 */
2367 static struct exim_openssl_option exim_openssl_options[] = {
2368 /* KEEP SORTED ALPHABETICALLY! */
2369 #ifdef SSL_OP_ALL
2370   { US"all", SSL_OP_ALL },
2371 #endif
2372 #ifdef SSL_OP_ALLOW_UNSAFE_LEGACY_RENEGOTIATION
2373   { US"allow_unsafe_legacy_renegotiation", SSL_OP_ALLOW_UNSAFE_LEGACY_RENEGOTIATION },
2374 #endif
2375 #ifdef SSL_OP_CIPHER_SERVER_PREFERENCE
2376   { US"cipher_server_preference", SSL_OP_CIPHER_SERVER_PREFERENCE },
2377 #endif
2378 #ifdef SSL_OP_DONT_INSERT_EMPTY_FRAGMENTS
2379   { US"dont_insert_empty_fragments", SSL_OP_DONT_INSERT_EMPTY_FRAGMENTS },
2380 #endif
2381 #ifdef SSL_OP_EPHEMERAL_RSA
2382   { US"ephemeral_rsa", SSL_OP_EPHEMERAL_RSA },
2383 #endif
2384 #ifdef SSL_OP_LEGACY_SERVER_CONNECT
2385   { US"legacy_server_connect", SSL_OP_LEGACY_SERVER_CONNECT },
2386 #endif
2387 #ifdef SSL_OP_MICROSOFT_BIG_SSLV3_BUFFER
2388   { US"microsoft_big_sslv3_buffer", SSL_OP_MICROSOFT_BIG_SSLV3_BUFFER },
2389 #endif
2390 #ifdef SSL_OP_MICROSOFT_SESS_ID_BUG
2391   { US"microsoft_sess_id_bug", SSL_OP_MICROSOFT_SESS_ID_BUG },
2392 #endif
2393 #ifdef SSL_OP_MSIE_SSLV2_RSA_PADDING
2394   { US"msie_sslv2_rsa_padding", SSL_OP_MSIE_SSLV2_RSA_PADDING },
2395 #endif
2396 #ifdef SSL_OP_NETSCAPE_CHALLENGE_BUG
2397   { US"netscape_challenge_bug", SSL_OP_NETSCAPE_CHALLENGE_BUG },
2398 #endif
2399 #ifdef SSL_OP_NETSCAPE_REUSE_CIPHER_CHANGE_BUG
2400   { US"netscape_reuse_cipher_change_bug", SSL_OP_NETSCAPE_REUSE_CIPHER_CHANGE_BUG },
2401 #endif
2402 #ifdef SSL_OP_NO_COMPRESSION
2403   { US"no_compression", SSL_OP_NO_COMPRESSION },
2404 #endif
2405 #ifdef SSL_OP_NO_SESSION_RESUMPTION_ON_RENEGOTIATION
2406   { US"no_session_resumption_on_renegotiation", SSL_OP_NO_SESSION_RESUMPTION_ON_RENEGOTIATION },
2407 #endif
2408 #ifdef SSL_OP_NO_SSLv2
2409   { US"no_sslv2", SSL_OP_NO_SSLv2 },
2410 #endif
2411 #ifdef SSL_OP_NO_SSLv3
2412   { US"no_sslv3", SSL_OP_NO_SSLv3 },
2413 #endif
2414 #ifdef SSL_OP_NO_TICKET
2415   { US"no_ticket", SSL_OP_NO_TICKET },
2416 #endif
2417 #ifdef SSL_OP_NO_TLSv1
2418   { US"no_tlsv1", SSL_OP_NO_TLSv1 },
2419 #endif
2420 #ifdef SSL_OP_NO_TLSv1_1
2421 #if SSL_OP_NO_TLSv1_1 == 0x00000400L
2422   /* Error in chosen value in 1.0.1a; see first item in CHANGES for 1.0.1b */
2423 #warning OpenSSL 1.0.1a uses a bad value for SSL_OP_NO_TLSv1_1, ignoring
2424 #else
2425   { US"no_tlsv1_1", SSL_OP_NO_TLSv1_1 },
2426 #endif
2427 #endif
2428 #ifdef SSL_OP_NO_TLSv1_2
2429   { US"no_tlsv1_2", SSL_OP_NO_TLSv1_2 },
2430 #endif
2431 #ifdef SSL_OP_SAFARI_ECDHE_ECDSA_BUG
2432   { US"safari_ecdhe_ecdsa_bug", SSL_OP_SAFARI_ECDHE_ECDSA_BUG },
2433 #endif
2434 #ifdef SSL_OP_SINGLE_DH_USE
2435   { US"single_dh_use", SSL_OP_SINGLE_DH_USE },
2436 #endif
2437 #ifdef SSL_OP_SINGLE_ECDH_USE
2438   { US"single_ecdh_use", SSL_OP_SINGLE_ECDH_USE },
2439 #endif
2440 #ifdef SSL_OP_SSLEAY_080_CLIENT_DH_BUG
2441   { US"ssleay_080_client_dh_bug", SSL_OP_SSLEAY_080_CLIENT_DH_BUG },
2442 #endif
2443 #ifdef SSL_OP_SSLREF2_REUSE_CERT_TYPE_BUG
2444   { US"sslref2_reuse_cert_type_bug", SSL_OP_SSLREF2_REUSE_CERT_TYPE_BUG },
2445 #endif
2446 #ifdef SSL_OP_TLS_BLOCK_PADDING_BUG
2447   { US"tls_block_padding_bug", SSL_OP_TLS_BLOCK_PADDING_BUG },
2448 #endif
2449 #ifdef SSL_OP_TLS_D5_BUG
2450   { US"tls_d5_bug", SSL_OP_TLS_D5_BUG },
2451 #endif
2452 #ifdef SSL_OP_TLS_ROLLBACK_BUG
2453   { US"tls_rollback_bug", SSL_OP_TLS_ROLLBACK_BUG },
2454 #endif
2455 };
2456 static int exim_openssl_options_size =
2457   sizeof(exim_openssl_options)/sizeof(struct exim_openssl_option);
2458
2459
2460 static BOOL
2461 tls_openssl_one_option_parse(uschar *name, long *value)
2462 {
2463 int first = 0;
2464 int last = exim_openssl_options_size;
2465 while (last > first)
2466   {
2467   int middle = (first + last)/2;
2468   int c = Ustrcmp(name, exim_openssl_options[middle].name);
2469   if (c == 0)
2470     {
2471     *value = exim_openssl_options[middle].value;
2472     return TRUE;
2473     }
2474   else if (c > 0)
2475     first = middle + 1;
2476   else
2477     last = middle;
2478   }
2479 return FALSE;
2480 }
2481
2482
2483
2484
2485 /*************************************************
2486 *        OpenSSL option parsing logic            *
2487 *************************************************/
2488
2489 /* OpenSSL has a number of compatibility options which an administrator might
2490 reasonably wish to set.  Interpret a list similarly to decode_bits(), so that
2491 we look like log_selector.
2492
2493 Arguments:
2494   option_spec  the administrator-supplied string of options
2495   results      ptr to long storage for the options bitmap
2496 Returns        success or failure
2497 */
2498
2499 BOOL
2500 tls_openssl_options_parse(uschar *option_spec, long *results)
2501 {
2502 long result, item;
2503 uschar *s, *end;
2504 uschar keep_c;
2505 BOOL adding, item_parsed;
2506
2507 result = 0L;
2508 /* Prior to 4.80 we or'd in SSL_OP_DONT_INSERT_EMPTY_FRAGMENTS; removed
2509  * from default because it increases BEAST susceptibility. */
2510 #ifdef SSL_OP_NO_SSLv2
2511 result |= SSL_OP_NO_SSLv2;
2512 #endif
2513
2514 if (option_spec == NULL)
2515   {
2516   *results = result;
2517   return TRUE;
2518   }
2519
2520 for (s=option_spec; *s != '\0'; /**/)
2521   {
2522   while (isspace(*s)) ++s;
2523   if (*s == '\0')
2524     break;
2525   if (*s != '+' && *s != '-')
2526     {
2527     DEBUG(D_tls) debug_printf("malformed openssl option setting: "
2528         "+ or - expected but found \"%s\"\n", s);
2529     return FALSE;
2530     }
2531   adding = *s++ == '+';
2532   for (end = s; (*end != '\0') && !isspace(*end); ++end) /**/ ;
2533   keep_c = *end;
2534   *end = '\0';
2535   item_parsed = tls_openssl_one_option_parse(s, &item);
2536   if (!item_parsed)
2537     {
2538     DEBUG(D_tls) debug_printf("openssl option setting unrecognised: \"%s\"\n", s);
2539     return FALSE;
2540     }
2541   DEBUG(D_tls) debug_printf("openssl option, %s from %lx: %lx (%s)\n",
2542       adding ? "adding" : "removing", result, item, s);
2543   if (adding)
2544     result |= item;
2545   else
2546     result &= ~item;
2547   *end = keep_c;
2548   s = end;
2549   }
2550
2551 *results = result;
2552 return TRUE;
2553 }
2554
2555 /* vi: aw ai sw=2
2556 */
2557 /* End of tls-openssl.c */