Revert "Testsuite: tidyup runtest"
[exim.git] / src / src / tls-openssl.c
CommitLineData
059ec3d9
PH
1/*************************************************
2* Exim - an Internet mail transport agent *
3*************************************************/
4
80fea873 5/* Copyright (c) University of Cambridge 1995 - 2016 */
059ec3d9
PH
6/* See the file NOTICE for conditions of use and distribution. */
7
f5d78688
JH
8/* Portions Copyright (c) The OpenSSL Project 1999 */
9
059ec3d9
PH
10/* This module provides the TLS (aka SSL) support for Exim using the OpenSSL
11library. It is #included into the tls.c file when that library is used. The
12code herein is based on a patch that was originally contributed by Steve
13Haslam. It was adapted from stunnel, a GPL program by Michal Trojnara.
14
15No cryptographic code is included in Exim. All this module does is to call
16functions from the OpenSSL library. */
17
18
19/* Heading stuff */
20
21#include <openssl/lhash.h>
22#include <openssl/ssl.h>
23#include <openssl/err.h>
24#include <openssl/rand.h>
10ca4f1c
JH
25#ifndef OPENSSL_NO_ECDH
26# include <openssl/ec.h>
27#endif
f2de3a33 28#ifndef DISABLE_OCSP
e51c7be2 29# include <openssl/ocsp.h>
3f7eeb86 30#endif
85098ee7
JH
31#ifdef EXPERIMENTAL_DANE
32# include <danessl.h>
33#endif
34
3f7eeb86 35
f2de3a33
JH
36#ifndef DISABLE_OCSP
37# define EXIM_OCSP_SKEW_SECONDS (300L)
38# define EXIM_OCSP_MAX_AGE (-1L)
3f7eeb86 39#endif
059ec3d9 40
3bcbbbe2 41#if OPENSSL_VERSION_NUMBER >= 0x0090806fL && !defined(OPENSSL_NO_TLSEXT)
e51c7be2 42# define EXIM_HAVE_OPENSSL_TLSEXT
3bcbbbe2 43#endif
c8dfb21d
JH
44#if OPENSSL_VERSION_NUMBER >= 0x00908000L
45# define EXIM_HAVE_RSA_GENKEY_EX
46#endif
47#if OPENSSL_VERSION_NUMBER >= 0x10100000L
48# define EXIM_HAVE_OCSP_RESP_COUNT
49#else
50# define EXIM_HAVE_EPHEM_RSA_KEX
51# define EXIM_HAVE_RAND_PSEUDO
52#endif
53#if (OPENSSL_VERSION_NUMBER >= 0x0090800fL) && !defined(OPENSSL_NO_SHA256)
54# define EXIM_HAVE_SHA256
55#endif
34e3241d
PP
56
57/*
58 * X509_check_host provides sane certificate hostname checking, but was added
59 * to OpenSSL late, after other projects forked off the code-base. So in
60 * addition to guarding against the base version number, beware that LibreSSL
61 * does not (at this time) support this function.
62 *
63 * If LibreSSL gains a different API, perhaps via libtls, then we'll probably
64 * opt to disentangle and ask a LibreSSL user to provide glue for a third
65 * crypto provider for libtls instead of continuing to tie the OpenSSL glue
66 * into even twistier knots. If LibreSSL gains the same API, we can just
67 * change this guard and punt the issue for a while longer.
68 */
69#ifndef LIBRESSL_VERSION_NUMBER
70# if OPENSSL_VERSION_NUMBER >= 0x010100000L
71# define EXIM_HAVE_OPENSSL_CHECKHOST
72# endif
73# if OPENSSL_VERSION_NUMBER >= 0x010000000L \
2dfb468b 74 && (OPENSSL_VERSION_NUMBER & 0x0000ff000L) >= 0x000002000L
34e3241d
PP
75# define EXIM_HAVE_OPENSSL_CHECKHOST
76# endif
11aa88b0 77#endif
10ca4f1c 78
11aa88b0
RA
79#if !defined(LIBRESSL_VERSION_NUMBER) \
80 || LIBRESSL_VERSION_NUMBER >= 0x20010000L
10ca4f1c
JH
81# if !defined(OPENSSL_NO_ECDH)
82# if OPENSSL_VERSION_NUMBER >= 0x0090800fL
83# define EXIM_HAVE_ECDH
84# endif
85# if OPENSSL_VERSION_NUMBER >= 0x10002000L
c8dfb21d
JH
86# if OPENSSL_VERSION_NUMBER < 0x10100000L
87# define EXIM_HAVE_OPENSSL_ECDH_AUTO
88# endif
10ca4f1c
JH
89# define EXIM_HAVE_OPENSSL_EC_NIST2NID
90# endif
91# endif
2dfb468b 92#endif
3bcbbbe2 93
67791ce4
JH
94#if !defined(EXIM_HAVE_OPENSSL_TLSEXT) && !defined(DISABLE_OCSP)
95# warning "OpenSSL library version too old; define DISABLE_OCSP in Makefile"
96# define DISABLE_OCSP
97#endif
98
059ec3d9
PH
99/* Structure for collecting random data for seeding. */
100
101typedef struct randstuff {
9e3331ea
TK
102 struct timeval tv;
103 pid_t p;
059ec3d9
PH
104} randstuff;
105
106/* Local static variables */
107
a2ff477a
JH
108static BOOL client_verify_callback_called = FALSE;
109static BOOL server_verify_callback_called = FALSE;
059ec3d9
PH
110static const uschar *sid_ctx = US"exim";
111
d4f09789
PP
112/* We have three different contexts to care about.
113
114Simple case: client, `client_ctx`
115 As a client, we can be doing a callout or cut-through delivery while receiving
116 a message. So we have a client context, which should have options initialised
117 from the SMTP Transport.
118
119Server:
120 There are two cases: with and without ServerNameIndication from the client.
121 Given TLS SNI, we can be using different keys, certs and various other
122 configuration settings, because they're re-expanded with $tls_sni set. This
123 allows vhosting with TLS. This SNI is sent in the handshake.
124 A client might not send SNI, so we need a fallback, and an initial setup too.
125 So as a server, we start out using `server_ctx`.
126 If SNI is sent by the client, then we as server, mid-negotiation, try to clone
127 `server_sni` from `server_ctx` and then initialise settings by re-expanding
128 configuration.
129*/
130
817d9f57
JH
131static SSL_CTX *client_ctx = NULL;
132static SSL_CTX *server_ctx = NULL;
133static SSL *client_ssl = NULL;
134static SSL *server_ssl = NULL;
389ca47a 135
35731706 136#ifdef EXIM_HAVE_OPENSSL_TLSEXT
817d9f57 137static SSL_CTX *server_sni = NULL;
35731706 138#endif
059ec3d9
PH
139
140static char ssl_errstring[256];
141
142static int ssl_session_timeout = 200;
a2ff477a
JH
143static BOOL client_verify_optional = FALSE;
144static BOOL server_verify_optional = FALSE;
059ec3d9 145
f5d78688 146static BOOL reexpand_tls_files_for_sni = FALSE;
059ec3d9
PH
147
148
7be682ca
PP
149typedef struct tls_ext_ctx_cb {
150 uschar *certificate;
151 uschar *privatekey;
f2de3a33 152#ifndef DISABLE_OCSP
f5d78688
JH
153 BOOL is_server;
154 union {
155 struct {
156 uschar *file;
157 uschar *file_expanded;
158 OCSP_RESPONSE *response;
159 } server;
160 struct {
44662487 161 X509_STORE *verify_store; /* non-null if status requested */
ee5b1e28 162 STACK_OF(X509) *verify_stack;
44662487 163 BOOL verify_required;
f5d78688
JH
164 } client;
165 } u_ocsp;
3f7eeb86 166#endif
7be682ca
PP
167 uschar *dhparam;
168 /* these are cached from first expand */
169 uschar *server_cipher_list;
170 /* only passed down to tls_error: */
171 host_item *host;
55414b25 172 const uschar * verify_cert_hostnames;
0cbf2b82 173#ifndef DISABLE_EVENT
a7538db1
JH
174 uschar * event_action;
175#endif
7be682ca
PP
176} tls_ext_ctx_cb;
177
178/* should figure out a cleanup of API to handle state preserved per
179implementation, for various reasons, which can be void * in the APIs.
180For now, we hack around it. */
817d9f57
JH
181tls_ext_ctx_cb *client_static_cbinfo = NULL;
182tls_ext_ctx_cb *server_static_cbinfo = NULL;
7be682ca
PP
183
184static int
983207c1
JH
185setup_certs(SSL_CTX *sctx, uschar *certs, uschar *crl, host_item *host, BOOL optional,
186 int (*cert_vfy_cb)(int, X509_STORE_CTX *) );
059ec3d9 187
3f7eeb86 188/* Callbacks */
3bcbbbe2 189#ifdef EXIM_HAVE_OPENSSL_TLSEXT
3f7eeb86 190static int tls_servername_cb(SSL *s, int *ad ARG_UNUSED, void *arg);
3bcbbbe2 191#endif
f2de3a33 192#ifndef DISABLE_OCSP
f5d78688 193static int tls_server_stapling_cb(SSL *s, void *arg);
3f7eeb86
PP
194#endif
195
059ec3d9
PH
196
197/*************************************************
198* Handle TLS error *
199*************************************************/
200
201/* Called from lots of places when errors occur before actually starting to do
202the TLS handshake, that is, while the session is still in clear. Always returns
203DEFER for a server and FAIL for a client so that most calls can use "return
204tls_error(...)" to do this processing and then give an appropriate return. A
205single function is used for both server and client, because it is called from
206some shared functions.
207
208Argument:
209 prefix text to include in the logged error
210 host NULL if setting up a server;
211 the connected host if setting up a client
7199e1ee 212 msg error message or NULL if we should ask OpenSSL
059ec3d9
PH
213
214Returns: OK/DEFER/FAIL
215*/
216
217static int
23bb6982 218tls_error(uschar * prefix, const host_item * host, uschar * msg)
059ec3d9 219{
c562fd30 220if (!msg)
7199e1ee
TF
221 {
222 ERR_error_string(ERR_get_error(), ssl_errstring);
5ca6d115 223 msg = (uschar *)ssl_errstring;
7199e1ee
TF
224 }
225
c562fd30
JH
226if (host)
227 {
228 log_write(0, LOG_MAIN, "H=%s [%s] TLS error on connection (%s): %s",
229 host->name, host->address, prefix, msg);
230 return FAIL;
231 }
232else
059ec3d9 233 {
7199e1ee 234 uschar *conn_info = smtp_get_connection_info();
5ca6d115 235 if (Ustrncmp(conn_info, US"SMTP ", 5) == 0)
7199e1ee 236 conn_info += 5;
c562fd30 237 /* I'd like to get separated H= here, but too hard for now */
7199e1ee
TF
238 log_write(0, LOG_MAIN, "TLS error on %s (%s): %s",
239 conn_info, prefix, msg);
059ec3d9
PH
240 return DEFER;
241 }
059ec3d9
PH
242}
243
244
245
c8dfb21d 246#ifdef EXIM_HAVE_EPHEM_RSA_KEX
059ec3d9
PH
247/*************************************************
248* Callback to generate RSA key *
249*************************************************/
250
251/*
252Arguments:
253 s SSL connection
254 export not used
255 keylength keylength
256
257Returns: pointer to generated key
258*/
259
260static RSA *
261rsa_callback(SSL *s, int export, int keylength)
262{
263RSA *rsa_key;
c8dfb21d
JH
264#ifdef EXIM_HAVE_RSA_GENKEY_EX
265BIGNUM *bn = BN_new();
266#endif
267
059ec3d9
PH
268export = export; /* Shut picky compilers up */
269DEBUG(D_tls) debug_printf("Generating %d bit RSA key...\n", keylength);
c8dfb21d
JH
270
271#ifdef EXIM_HAVE_RSA_GENKEY_EX
272if ( !BN_set_word(bn, (unsigned long)RSA_F4)
f2cb6292 273 || !(rsa_key = RSA_new())
c8dfb21d
JH
274 || !RSA_generate_key_ex(rsa_key, keylength, bn, NULL)
275 )
276#else
23bb6982 277if (!(rsa_key = RSA_generate_key(keylength, RSA_F4, NULL, NULL)))
c8dfb21d
JH
278#endif
279
059ec3d9
PH
280 {
281 ERR_error_string(ERR_get_error(), ssl_errstring);
282 log_write(0, LOG_MAIN|LOG_PANIC, "TLS error (RSA_generate_key): %s",
283 ssl_errstring);
284 return NULL;
285 }
286return rsa_key;
287}
c8dfb21d 288#endif
059ec3d9
PH
289
290
291
f5d78688 292/* Extreme debug
f2de3a33 293#ifndef DISABLE_OCSP
f5d78688
JH
294void
295x509_store_dump_cert_s_names(X509_STORE * store)
296{
297STACK_OF(X509_OBJECT) * roots= store->objs;
298int i;
299static uschar name[256];
300
301for(i= 0; i<sk_X509_OBJECT_num(roots); i++)
302 {
303 X509_OBJECT * tmp_obj= sk_X509_OBJECT_value(roots, i);
304 if(tmp_obj->type == X509_LU_X509)
305 {
306 X509 * current_cert= tmp_obj->data.x509;
307 X509_NAME_oneline(X509_get_subject_name(current_cert), CS name, sizeof(name));
f69979cf 308 name[sizeof(name)-1] = '\0';
f5d78688
JH
309 debug_printf(" %s\n", name);
310 }
311 }
312}
313#endif
314*/
315
059ec3d9 316
0cbf2b82 317#ifndef DISABLE_EVENT
f69979cf
JH
318static int
319verify_event(tls_support * tlsp, X509 * cert, int depth, const uschar * dn,
320 BOOL *calledp, const BOOL *optionalp, const uschar * what)
321{
322uschar * ev;
323uschar * yield;
324X509 * old_cert;
325
326ev = tlsp == &tls_out ? client_static_cbinfo->event_action : event_action;
327if (ev)
328 {
aaba7d03 329 DEBUG(D_tls) debug_printf("verify_event: %s %d\n", what, depth);
f69979cf
JH
330 old_cert = tlsp->peercert;
331 tlsp->peercert = X509_dup(cert);
332 /* NB we do not bother setting peerdn */
333 if ((yield = event_raise(ev, US"tls:cert", string_sprintf("%d", depth))))
334 {
335 log_write(0, LOG_MAIN, "[%s] %s verify denied by event-action: "
336 "depth=%d cert=%s: %s",
337 tlsp == &tls_out ? deliver_host_address : sender_host_address,
338 what, depth, dn, yield);
339 *calledp = TRUE;
340 if (!*optionalp)
341 {
342 if (old_cert) tlsp->peercert = old_cert; /* restore 1st failing cert */
343 return 1; /* reject (leaving peercert set) */
344 }
345 DEBUG(D_tls) debug_printf("Event-action verify failure overridden "
346 "(host in tls_try_verify_hosts)\n");
347 }
348 X509_free(tlsp->peercert);
349 tlsp->peercert = old_cert;
350 }
351return 0;
352}
353#endif
354
059ec3d9
PH
355/*************************************************
356* Callback for verification *
357*************************************************/
358
359/* The SSL library does certificate verification if set up to do so. This
360callback has the current yes/no state is in "state". If verification succeeded,
f69979cf
JH
361we set the certificate-verified flag. If verification failed, what happens
362depends on whether the client is required to present a verifiable certificate
363or not.
059ec3d9
PH
364
365If verification is optional, we change the state to yes, but still log the
366verification error. For some reason (it really would help to have proper
367documentation of OpenSSL), this callback function then gets called again, this
f69979cf
JH
368time with state = 1. We must take care not to set the private verified flag on
369the second time through.
059ec3d9
PH
370
371Note: this function is not called if the client fails to present a certificate
372when asked. We get here only if a certificate has been received. Handling of
373optional verification for this case is done when requesting SSL to verify, by
374setting SSL_VERIFY_FAIL_IF_NO_PEER_CERT in the non-optional case.
375
a7538db1
JH
376May be called multiple times for different issues with a certificate, even
377for a given "depth" in the certificate chain.
378
059ec3d9 379Arguments:
f2f2c91b
JH
380 preverify_ok current yes/no state as 1/0
381 x509ctx certificate information.
382 tlsp per-direction (client vs. server) support data
383 calledp has-been-called flag
384 optionalp verification-is-optional flag
059ec3d9 385
f2f2c91b 386Returns: 0 if verification should fail, otherwise 1
059ec3d9
PH
387*/
388
389static int
f2f2c91b 390verify_callback(int preverify_ok, X509_STORE_CTX *x509ctx,
421aff85 391 tls_support *tlsp, BOOL *calledp, BOOL *optionalp)
059ec3d9 392{
421aff85 393X509 * cert = X509_STORE_CTX_get_current_cert(x509ctx);
a7538db1 394int depth = X509_STORE_CTX_get_error_depth(x509ctx);
f69979cf 395uschar dn[256];
059ec3d9 396
f69979cf
JH
397X509_NAME_oneline(X509_get_subject_name(cert), CS dn, sizeof(dn));
398dn[sizeof(dn)-1] = '\0';
059ec3d9 399
f2f2c91b 400if (preverify_ok == 0)
059ec3d9 401 {
4c01d6ab
JH
402 log_write(0, LOG_MAIN, "[%s] SSL verify error: depth=%d error=%s cert=%s",
403 tlsp == &tls_out ? deliver_host_address : sender_host_address,
a7538db1 404 depth,
421aff85 405 X509_verify_cert_error_string(X509_STORE_CTX_get_error(x509ctx)),
f69979cf 406 dn);
a2ff477a 407 *calledp = TRUE;
9d1c15ef
JH
408 if (!*optionalp)
409 {
f69979cf
JH
410 if (!tlsp->peercert)
411 tlsp->peercert = X509_dup(cert); /* record failing cert */
412 return 0; /* reject */
9d1c15ef 413 }
059ec3d9
PH
414 DEBUG(D_tls) debug_printf("SSL verify failure overridden (host in "
415 "tls_try_verify_hosts)\n");
059ec3d9
PH
416 }
417
a7538db1 418else if (depth != 0)
059ec3d9 419 {
f69979cf 420 DEBUG(D_tls) debug_printf("SSL verify ok: depth=%d SN=%s\n", depth, dn);
f2de3a33 421#ifndef DISABLE_OCSP
f5d78688
JH
422 if (tlsp == &tls_out && client_static_cbinfo->u_ocsp.client.verify_store)
423 { /* client, wanting stapling */
424 /* Add the server cert's signing chain as the one
425 for the verification of the OCSP stapled information. */
94431adb 426
f5d78688 427 if (!X509_STORE_add_cert(client_static_cbinfo->u_ocsp.client.verify_store,
421aff85 428 cert))
f5d78688 429 ERR_clear_error();
ee5b1e28 430 sk_X509_push(client_static_cbinfo->u_ocsp.client.verify_stack, cert);
f5d78688
JH
431 }
432#endif
0cbf2b82 433#ifndef DISABLE_EVENT
f69979cf
JH
434 if (verify_event(tlsp, cert, depth, dn, calledp, optionalp, US"SSL"))
435 return 0; /* reject, with peercert set */
a7538db1 436#endif
059ec3d9
PH
437 }
438else
439 {
55414b25 440 const uschar * verify_cert_hostnames;
e51c7be2 441
e51c7be2
JH
442 if ( tlsp == &tls_out
443 && ((verify_cert_hostnames = client_static_cbinfo->verify_cert_hostnames)))
444 /* client, wanting hostname check */
e51c7be2 445 {
f69979cf 446
740f36d4 447#ifdef EXIM_HAVE_OPENSSL_CHECKHOST
f69979cf
JH
448# ifndef X509_CHECK_FLAG_NO_PARTIAL_WILDCARDS
449# define X509_CHECK_FLAG_NO_PARTIAL_WILDCARDS 0
450# endif
451# ifndef X509_CHECK_FLAG_SINGLE_LABEL_SUBDOMAINS
452# define X509_CHECK_FLAG_SINGLE_LABEL_SUBDOMAINS 0
453# endif
e51c7be2 454 int sep = 0;
55414b25 455 const uschar * list = verify_cert_hostnames;
e51c7be2 456 uschar * name;
d8e7834a
JH
457 int rc;
458 while ((name = string_nextinlist(&list, &sep, NULL, 0)))
f40d5be3 459 if ((rc = X509_check_host(cert, CCS name, 0,
8d692470 460 X509_CHECK_FLAG_NO_PARTIAL_WILDCARDS
740f36d4
JH
461 | X509_CHECK_FLAG_SINGLE_LABEL_SUBDOMAINS,
462 NULL)))
d8e7834a
JH
463 {
464 if (rc < 0)
465 {
93a6fce2 466 log_write(0, LOG_MAIN, "[%s] SSL verify error: internal error",
4c01d6ab 467 tlsp == &tls_out ? deliver_host_address : sender_host_address);
d8e7834a
JH
468 name = NULL;
469 }
e51c7be2 470 break;
d8e7834a 471 }
e51c7be2 472 if (!name)
f69979cf 473#else
e51c7be2 474 if (!tls_is_name_for_cert(verify_cert_hostnames, cert))
f69979cf 475#endif
e51c7be2
JH
476 {
477 log_write(0, LOG_MAIN,
93a6fce2 478 "[%s] SSL verify error: certificate name mismatch: \"%s\"",
4c01d6ab 479 tlsp == &tls_out ? deliver_host_address : sender_host_address,
f69979cf 480 dn);
a3ef7310
JH
481 *calledp = TRUE;
482 if (!*optionalp)
f69979cf
JH
483 {
484 if (!tlsp->peercert)
485 tlsp->peercert = X509_dup(cert); /* record failing cert */
486 return 0; /* reject */
487 }
a3ef7310
JH
488 DEBUG(D_tls) debug_printf("SSL verify failure overridden (host in "
489 "tls_try_verify_hosts)\n");
e51c7be2 490 }
f69979cf 491 }
e51c7be2 492
0cbf2b82 493#ifndef DISABLE_EVENT
f69979cf
JH
494 if (verify_event(tlsp, cert, depth, dn, calledp, optionalp, US"SSL"))
495 return 0; /* reject, with peercert set */
e51c7be2
JH
496#endif
497
93dcb1c2 498 DEBUG(D_tls) debug_printf("SSL%s verify ok: depth=0 SN=%s\n",
f69979cf 499 *calledp ? "" : " authenticated", dn);
93dcb1c2
JH
500 if (!*calledp) tlsp->certificate_verified = TRUE;
501 *calledp = TRUE;
059ec3d9
PH
502 }
503
a7538db1 504return 1; /* accept, at least for this level */
059ec3d9
PH
505}
506
a2ff477a 507static int
f2f2c91b 508verify_callback_client(int preverify_ok, X509_STORE_CTX *x509ctx)
a2ff477a 509{
f2f2c91b
JH
510return verify_callback(preverify_ok, x509ctx, &tls_out,
511 &client_verify_callback_called, &client_verify_optional);
a2ff477a
JH
512}
513
514static int
f2f2c91b 515verify_callback_server(int preverify_ok, X509_STORE_CTX *x509ctx)
a2ff477a 516{
f2f2c91b
JH
517return verify_callback(preverify_ok, x509ctx, &tls_in,
518 &server_verify_callback_called, &server_verify_optional);
a2ff477a
JH
519}
520
059ec3d9 521
e5cccda9 522#ifdef EXPERIMENTAL_DANE
53a7196b 523
e5cccda9
JH
524/* This gets called *by* the dane library verify callback, which interposes
525itself.
526*/
527static int
f2f2c91b 528verify_callback_client_dane(int preverify_ok, X509_STORE_CTX * x509ctx)
e5cccda9
JH
529{
530X509 * cert = X509_STORE_CTX_get_current_cert(x509ctx);
f69979cf 531uschar dn[256];
0cbf2b82 532#ifndef DISABLE_EVENT
83b27293 533int depth = X509_STORE_CTX_get_error_depth(x509ctx);
f69979cf 534BOOL dummy_called, optional = FALSE;
83b27293 535#endif
e5cccda9 536
f69979cf
JH
537X509_NAME_oneline(X509_get_subject_name(cert), CS dn, sizeof(dn));
538dn[sizeof(dn)-1] = '\0';
e5cccda9 539
f2f2c91b
JH
540DEBUG(D_tls) debug_printf("verify_callback_client_dane: %s depth %d %s\n",
541 preverify_ok ? "ok":"BAD", depth, dn);
e5cccda9 542
0cbf2b82 543#ifndef DISABLE_EVENT
f69979cf
JH
544 if (verify_event(&tls_out, cert, depth, dn,
545 &dummy_called, &optional, US"DANE"))
546 return 0; /* reject, with peercert set */
83b27293
JH
547#endif
548
f2f2c91b 549if (preverify_ok == 1)
53a7196b 550 tls_out.dane_verified =
e5cccda9 551 tls_out.certificate_verified = TRUE;
f2f2c91b
JH
552else
553 {
554 int err = X509_STORE_CTX_get_error(x509ctx);
555 DEBUG(D_tls)
556 debug_printf(" - err %d '%s'\n", err, X509_verify_cert_error_string(err));
3c51463e 557 if (err == X509_V_ERR_APPLICATION_VERIFICATION)
f2f2c91b
JH
558 preverify_ok = 1;
559 }
560return preverify_ok;
e5cccda9 561}
53a7196b
JH
562
563#endif /*EXPERIMENTAL_DANE*/
e5cccda9 564
059ec3d9
PH
565
566/*************************************************
567* Information callback *
568*************************************************/
569
570/* The SSL library functions call this from time to time to indicate what they
7be682ca
PP
571are doing. We copy the string to the debugging output when TLS debugging has
572been requested.
059ec3d9
PH
573
574Arguments:
575 s the SSL connection
576 where
577 ret
578
579Returns: nothing
580*/
581
582static void
583info_callback(SSL *s, int where, int ret)
584{
585where = where;
586ret = ret;
587DEBUG(D_tls) debug_printf("SSL info: %s\n", SSL_state_string_long(s));
588}
589
590
591
592/*************************************************
593* Initialize for DH *
594*************************************************/
595
596/* If dhparam is set, expand it, and load up the parameters for DH encryption.
597
598Arguments:
038597d2 599 sctx The current SSL CTX (inbound or outbound)
a799883d 600 dhparam DH parameter file or fixed parameter identity string
7199e1ee 601 host connected host, if client; NULL if server
059ec3d9
PH
602
603Returns: TRUE if OK (nothing to set up, or setup worked)
604*/
605
606static BOOL
b8b1b5cb 607init_dh(SSL_CTX *sctx, uschar *dhparam, const host_item *host)
059ec3d9 608{
059ec3d9
PH
609BIO *bio;
610DH *dh;
611uschar *dhexpanded;
a799883d 612const char *pem;
059ec3d9
PH
613
614if (!expand_check(dhparam, US"tls_dhparam", &dhexpanded))
615 return FALSE;
616
0df4ab80 617if (!dhexpanded || !*dhexpanded)
a799883d 618 bio = BIO_new_mem_buf(CS std_dh_prime_default(), -1);
a799883d 619else if (dhexpanded[0] == '/')
059ec3d9 620 {
0df4ab80 621 if (!(bio = BIO_new_file(CS dhexpanded, "r")))
059ec3d9 622 {
7199e1ee 623 tls_error(string_sprintf("could not read dhparams file %s", dhexpanded),
a799883d
PP
624 host, US strerror(errno));
625 return FALSE;
059ec3d9 626 }
a799883d
PP
627 }
628else
629 {
630 if (Ustrcmp(dhexpanded, "none") == 0)
059ec3d9 631 {
a799883d
PP
632 DEBUG(D_tls) debug_printf("Requested no DH parameters.\n");
633 return TRUE;
059ec3d9 634 }
a799883d 635
0df4ab80 636 if (!(pem = std_dh_prime_named(dhexpanded)))
a799883d
PP
637 {
638 tls_error(string_sprintf("Unknown standard DH prime \"%s\"", dhexpanded),
639 host, US strerror(errno));
640 return FALSE;
641 }
642 bio = BIO_new_mem_buf(CS pem, -1);
643 }
644
0df4ab80 645if (!(dh = PEM_read_bio_DHparams(bio, NULL, NULL, NULL)))
a799883d 646 {
059ec3d9 647 BIO_free(bio);
a799883d
PP
648 tls_error(string_sprintf("Could not read tls_dhparams \"%s\"", dhexpanded),
649 host, NULL);
650 return FALSE;
651 }
652
653/* Even if it is larger, we silently return success rather than cause things
654 * to fail out, so that a too-large DH will not knock out all TLS; it's a
655 * debatable choice. */
656if ((8*DH_size(dh)) > tls_dh_max_bits)
657 {
658 DEBUG(D_tls)
659 debug_printf("dhparams file %d bits, is > tls_dh_max_bits limit of %d",
660 8*DH_size(dh), tls_dh_max_bits);
661 }
662else
663 {
664 SSL_CTX_set_tmp_dh(sctx, dh);
665 DEBUG(D_tls)
666 debug_printf("Diffie-Hellman initialized from %s with %d-bit prime\n",
667 dhexpanded ? dhexpanded : US"default", 8*DH_size(dh));
059ec3d9
PH
668 }
669
a799883d
PP
670DH_free(dh);
671BIO_free(bio);
672
673return TRUE;
059ec3d9
PH
674}
675
676
677
678
038597d2
PP
679/*************************************************
680* Initialize for ECDH *
681*************************************************/
682
683/* Load parameters for ECDH encryption.
684
685For now, we stick to NIST P-256 because: it's simple and easy to configure;
686it avoids any patent issues that might bite redistributors; despite events in
687the news and concerns over curve choices, we're not cryptographers, we're not
688pretending to be, and this is "good enough" to be better than no support,
689protecting against most adversaries. Given another year or two, there might
690be sufficient clarity about a "right" way forward to let us make an informed
691decision, instead of a knee-jerk reaction.
692
693Longer-term, we should look at supporting both various named curves and
694external files generated with "openssl ecparam", much as we do for init_dh().
695We should also support "none" as a value, to explicitly avoid initialisation.
696
697Patches welcome.
698
699Arguments:
700 sctx The current SSL CTX (inbound or outbound)
701 host connected host, if client; NULL if server
702
703Returns: TRUE if OK (nothing to set up, or setup worked)
704*/
705
706static BOOL
10ca4f1c 707init_ecdh(SSL_CTX * sctx, host_item * host)
038597d2 708{
63f0dbe0
JH
709#ifdef OPENSSL_NO_ECDH
710return TRUE;
711#else
712
10ca4f1c
JH
713EC_KEY * ecdh;
714uschar * exp_curve;
715int nid;
716BOOL rv;
717
038597d2
PP
718if (host) /* No ECDH setup for clients, only for servers */
719 return TRUE;
720
10ca4f1c 721# ifndef EXIM_HAVE_ECDH
038597d2
PP
722DEBUG(D_tls)
723 debug_printf("No OpenSSL API to define ECDH parameters, skipping\n");
724return TRUE;
038597d2 725# else
10ca4f1c
JH
726
727if (!expand_check(tls_eccurve, US"tls_eccurve", &exp_curve))
728 return FALSE;
729if (!exp_curve || !*exp_curve)
730 return TRUE;
731
732# ifdef EXIM_HAVE_OPENSSL_ECDH_AUTO
733/* check if new enough library to support auto ECDH temp key parameter selection */
734if (Ustrcmp(exp_curve, "auto") == 0)
038597d2 735 {
10ca4f1c
JH
736 DEBUG(D_tls) debug_printf(
737 "ECDH temp key parameter settings: OpenSSL 1.2+ autoselection\n");
738 SSL_CTX_set_ecdh_auto(sctx, 1);
739 return TRUE;
740 }
741# endif
038597d2 742
10ca4f1c
JH
743DEBUG(D_tls) debug_printf("ECDH: curve '%s'\n", exp_curve);
744if ( (nid = OBJ_sn2nid (CCS exp_curve)) == NID_undef
745# ifdef EXIM_HAVE_OPENSSL_EC_NIST2NID
746 && (nid = EC_curve_nist2nid(CCS exp_curve)) == NID_undef
747# endif
748 )
749 {
750 tls_error(string_sprintf("Unknown curve name tls_eccurve '%s'",
751 exp_curve),
752 host, NULL);
753 return FALSE;
754 }
038597d2 755
10ca4f1c
JH
756if (!(ecdh = EC_KEY_new_by_curve_name(nid)))
757 {
aa7751be 758 tls_error(US"Unable to create ec curve", host, NULL);
10ca4f1c 759 return FALSE;
038597d2 760 }
10ca4f1c
JH
761
762/* The "tmp" in the name here refers to setting a temporary key
763not to the stability of the interface. */
764
765if ((rv = SSL_CTX_set_tmp_ecdh(sctx, ecdh) == 0))
766 tls_error(string_sprintf("Error enabling '%s' curve", exp_curve), host, NULL);
767else
768 DEBUG(D_tls) debug_printf("ECDH: enabled '%s' curve\n", exp_curve);
769
770EC_KEY_free(ecdh);
771return !rv;
772
773# endif /*EXIM_HAVE_ECDH*/
774#endif /*OPENSSL_NO_ECDH*/
038597d2
PP
775}
776
777
778
779
f2de3a33 780#ifndef DISABLE_OCSP
3f7eeb86
PP
781/*************************************************
782* Load OCSP information into state *
783*************************************************/
784
ee5b1e28
JH
785static STACK_OF(X509) *
786cert_stack_from_store(X509_STORE * store)
787{
788STACK_OF(X509_OBJECT) * roots= store->objs;
789STACK_OF(X509) * sk = sk_X509_new_null();
790int i;
791
792for(i = sk_X509_OBJECT_num(roots) - 1; i >= 0; i--)
793 {
794 X509_OBJECT * tmp_obj= sk_X509_OBJECT_value(roots, i);
795 if(tmp_obj->type == X509_LU_X509)
796 {
797 X509 * x = tmp_obj->data.x509;
798 sk_X509_push(sk, x);
799 }
800 }
801return sk;
802}
803
804static void
805cert_stack_free(STACK_OF(X509) * sk)
806{
807while (sk_X509_num(sk) > 0) (void) sk_X509_pop(sk);
808sk_X509_free(sk);
809}
810
811
812
f5d78688 813/* Called to load the server OCSP response from the given file into memory, once
3f7eeb86
PP
814caller has determined this is needed. Checks validity. Debugs a message
815if invalid.
816
817ASSUMES: single response, for single cert.
818
819Arguments:
820 sctx the SSL_CTX* to update
821 cbinfo various parts of session state
822 expanded the filename putatively holding an OCSP response
823
824*/
825
826static void
f5d78688 827ocsp_load_response(SSL_CTX *sctx, tls_ext_ctx_cb *cbinfo, const uschar *expanded)
3f7eeb86 828{
ee5b1e28
JH
829BIO * bio;
830OCSP_RESPONSE * resp;
831OCSP_BASICRESP * basic_response;
832OCSP_SINGLERESP * single_response;
833ASN1_GENERALIZEDTIME * rev, * thisupd, * nextupd;
834X509_STORE * store;
835STACK_OF(X509) * sk;
3f7eeb86
PP
836unsigned long verify_flags;
837int status, reason, i;
838
f5d78688
JH
839cbinfo->u_ocsp.server.file_expanded = string_copy(expanded);
840if (cbinfo->u_ocsp.server.response)
3f7eeb86 841 {
f5d78688
JH
842 OCSP_RESPONSE_free(cbinfo->u_ocsp.server.response);
843 cbinfo->u_ocsp.server.response = NULL;
3f7eeb86
PP
844 }
845
ee5b1e28 846if (!(bio = BIO_new_file(CS cbinfo->u_ocsp.server.file_expanded, "rb")))
3f7eeb86
PP
847 {
848 DEBUG(D_tls) debug_printf("Failed to open OCSP response file \"%s\"\n",
f5d78688 849 cbinfo->u_ocsp.server.file_expanded);
3f7eeb86
PP
850 return;
851 }
852
853resp = d2i_OCSP_RESPONSE_bio(bio, NULL);
854BIO_free(bio);
855if (!resp)
856 {
857 DEBUG(D_tls) debug_printf("Error reading OCSP response.\n");
858 return;
859 }
860
ee5b1e28 861if ((status = OCSP_response_status(resp)) != OCSP_RESPONSE_STATUS_SUCCESSFUL)
3f7eeb86
PP
862 {
863 DEBUG(D_tls) debug_printf("OCSP response not valid: %s (%d)\n",
864 OCSP_response_status_str(status), status);
f5d78688 865 goto bad;
3f7eeb86
PP
866 }
867
ee5b1e28 868if (!(basic_response = OCSP_response_get1_basic(resp)))
3f7eeb86
PP
869 {
870 DEBUG(D_tls)
871 debug_printf("OCSP response parse error: unable to extract basic response.\n");
f5d78688 872 goto bad;
3f7eeb86
PP
873 }
874
875store = SSL_CTX_get_cert_store(sctx);
ee5b1e28 876sk = cert_stack_from_store(store);
3f7eeb86
PP
877verify_flags = OCSP_NOVERIFY; /* check sigs, but not purpose */
878
879/* May need to expose ability to adjust those flags?
880OCSP_NOSIGS OCSP_NOVERIFY OCSP_NOCHAIN OCSP_NOCHECKS OCSP_NOEXPLICIT
881OCSP_TRUSTOTHER OCSP_NOINTERN */
882
ee5b1e28
JH
883/* This does a full verify on the OCSP proof before we load it for serviing
884up; possibly overkill - just date-checks might be nice enough.
885
886OCSP_basic_verify takes a "store" arg, but does not
887use it for the chain verification, which is all we do
888when OCSP_NOVERIFY is set. The content from the wire
889"basic_response" and a cert-stack "sk" are all that is used.
890
891Seperately we might try to replace using OCSP_basic_verify() - which seems to not
892be a public interface into the OpenSSL library (there's no manual entry) -
893But what with? We also use OCSP_basic_verify in the client stapling callback.
894And there we NEED it; we miust verify that status... unless the
895library does it for us anyway? */
896
897if ((i = OCSP_basic_verify(basic_response, sk, NULL, verify_flags)) < 0)
3f7eeb86 898 {
ee5b1e28
JH
899 DEBUG(D_tls)
900 {
3f7eeb86
PP
901 ERR_error_string(ERR_get_error(), ssl_errstring);
902 debug_printf("OCSP response verify failure: %s\n", US ssl_errstring);
f5d78688 903 }
ee5b1e28 904 cert_stack_free(sk);
f5d78688 905 goto bad;
3f7eeb86 906 }
ee5b1e28 907cert_stack_free(sk);
3f7eeb86
PP
908
909/* Here's the simplifying assumption: there's only one response, for the
910one certificate we use, and nothing for anything else in a chain. If this
911proves false, we need to extract a cert id from our issued cert
912(tls_certificate) and use that for OCSP_resp_find_status() (which finds the
913right cert in the stack and then calls OCSP_single_get0_status()).
914
915I'm hoping to avoid reworking a bunch more of how we handle state here. */
ee5b1e28
JH
916
917if (!(single_response = OCSP_resp_get0(basic_response, 0)))
3f7eeb86
PP
918 {
919 DEBUG(D_tls)
920 debug_printf("Unable to get first response from OCSP basic response.\n");
f5d78688 921 goto bad;
3f7eeb86
PP
922 }
923
924status = OCSP_single_get0_status(single_response, &reason, &rev, &thisupd, &nextupd);
f5d78688 925if (status != V_OCSP_CERTSTATUS_GOOD)
3f7eeb86 926 {
f5d78688
JH
927 DEBUG(D_tls) debug_printf("OCSP response bad cert status: %s (%d) %s (%d)\n",
928 OCSP_cert_status_str(status), status,
929 OCSP_crl_reason_str(reason), reason);
930 goto bad;
3f7eeb86
PP
931 }
932
933if (!OCSP_check_validity(thisupd, nextupd, EXIM_OCSP_SKEW_SECONDS, EXIM_OCSP_MAX_AGE))
934 {
935 DEBUG(D_tls) debug_printf("OCSP status invalid times.\n");
f5d78688 936 goto bad;
3f7eeb86
PP
937 }
938
f5d78688 939supply_response:
018058b2 940 cbinfo->u_ocsp.server.response = resp;
f5d78688
JH
941return;
942
943bad:
018058b2
JH
944 if (running_in_test_harness)
945 {
946 extern char ** environ;
947 uschar ** p;
bc3c7bb7 948 if (environ) for (p = USS environ; *p != NULL; p++)
018058b2
JH
949 if (Ustrncmp(*p, "EXIM_TESTHARNESS_DISABLE_OCSPVALIDITYCHECK", 42) == 0)
950 {
951 DEBUG(D_tls) debug_printf("Supplying known bad OCSP response\n");
952 goto supply_response;
953 }
954 }
f5d78688 955return;
3f7eeb86 956}
f2de3a33 957#endif /*!DISABLE_OCSP*/
3f7eeb86
PP
958
959
960
961
23bb6982
JH
962/* Create and install a selfsigned certificate, for use in server mode */
963
964static int
965tls_install_selfsign(SSL_CTX * sctx)
966{
967X509 * x509 = NULL;
968EVP_PKEY * pkey;
969RSA * rsa;
970X509_NAME * name;
971uschar * where;
972
973where = US"allocating pkey";
974if (!(pkey = EVP_PKEY_new()))
975 goto err;
976
977where = US"allocating cert";
978if (!(x509 = X509_new()))
979 goto err;
980
981where = US"generating pkey";
982 /* deprecated, use RSA_generate_key_ex() */
983if (!(rsa = RSA_generate_key(1024, RSA_F4, NULL, NULL)))
984 goto err;
985
986where = US"assiging pkey";
987if (!EVP_PKEY_assign_RSA(pkey, rsa))
988 goto err;
989
990X509_set_version(x509, 2); /* N+1 - version 3 */
991ASN1_INTEGER_set(X509_get_serialNumber(x509), 0);
992X509_gmtime_adj(X509_get_notBefore(x509), 0);
993X509_gmtime_adj(X509_get_notAfter(x509), (long)60 * 60); /* 1 hour */
994X509_set_pubkey(x509, pkey);
995
996name = X509_get_subject_name(x509);
997X509_NAME_add_entry_by_txt(name, "C",
4dc2379a 998 MBSTRING_ASC, CUS "UK", -1, -1, 0);
23bb6982 999X509_NAME_add_entry_by_txt(name, "O",
4dc2379a 1000 MBSTRING_ASC, CUS "Exim Developers", -1, -1, 0);
23bb6982 1001X509_NAME_add_entry_by_txt(name, "CN",
4dc2379a 1002 MBSTRING_ASC, CUS smtp_active_hostname, -1, -1, 0);
23bb6982
JH
1003X509_set_issuer_name(x509, name);
1004
1005where = US"signing cert";
1006if (!X509_sign(x509, pkey, EVP_md5()))
1007 goto err;
1008
1009where = US"installing selfsign cert";
1010if (!SSL_CTX_use_certificate(sctx, x509))
1011 goto err;
1012
1013where = US"installing selfsign key";
1014if (!SSL_CTX_use_PrivateKey(sctx, pkey))
1015 goto err;
1016
1017return OK;
1018
1019err:
1020 (void) tls_error(where, NULL, NULL);
1021 if (x509) X509_free(x509);
1022 if (pkey) EVP_PKEY_free(pkey);
1023 return DEFER;
1024}
1025
1026
1027
1028
059ec3d9 1029/*************************************************
7be682ca
PP
1030* Expand key and cert file specs *
1031*************************************************/
1032
f5d78688 1033/* Called once during tls_init and possibly again during TLS setup, for a
7be682ca
PP
1034new context, if Server Name Indication was used and tls_sni was seen in
1035the certificate string.
1036
1037Arguments:
1038 sctx the SSL_CTX* to update
1039 cbinfo various parts of session state
1040
1041Returns: OK/DEFER/FAIL
1042*/
1043
1044static int
3f7eeb86 1045tls_expand_session_files(SSL_CTX *sctx, tls_ext_ctx_cb *cbinfo)
7be682ca
PP
1046{
1047uschar *expanded;
1048
23bb6982 1049if (!cbinfo->certificate)
7be682ca 1050 {
23bb6982
JH
1051 if (cbinfo->host) /* client */
1052 return OK;
1053 /* server */
1054 if (tls_install_selfsign(sctx) != OK)
1055 return DEFER;
7be682ca 1056 }
23bb6982
JH
1057else
1058 {
1059 if (Ustrstr(cbinfo->certificate, US"tls_sni") ||
1060 Ustrstr(cbinfo->certificate, US"tls_in_sni") ||
1061 Ustrstr(cbinfo->certificate, US"tls_out_sni")
1062 )
1063 reexpand_tls_files_for_sni = TRUE;
7be682ca 1064
23bb6982
JH
1065 if (!expand_check(cbinfo->certificate, US"tls_certificate", &expanded))
1066 return DEFER;
1067
1068 if (expanded != NULL)
1069 {
1070 DEBUG(D_tls) debug_printf("tls_certificate file %s\n", expanded);
1071 if (!SSL_CTX_use_certificate_chain_file(sctx, CS expanded))
1072 return tls_error(string_sprintf(
1073 "SSL_CTX_use_certificate_chain_file file=%s", expanded),
1074 cbinfo->host, NULL);
1075 }
7be682ca 1076
23bb6982
JH
1077 if (cbinfo->privatekey != NULL &&
1078 !expand_check(cbinfo->privatekey, US"tls_privatekey", &expanded))
1079 return DEFER;
7be682ca 1080
23bb6982
JH
1081 /* If expansion was forced to fail, key_expanded will be NULL. If the result
1082 of the expansion is an empty string, ignore it also, and assume the private
1083 key is in the same file as the certificate. */
1084
1085 if (expanded && *expanded)
1086 {
1087 DEBUG(D_tls) debug_printf("tls_privatekey file %s\n", expanded);
1088 if (!SSL_CTX_use_PrivateKey_file(sctx, CS expanded, SSL_FILETYPE_PEM))
1089 return tls_error(string_sprintf(
1090 "SSL_CTX_use_PrivateKey_file file=%s", expanded), cbinfo->host, NULL);
1091 }
7be682ca
PP
1092 }
1093
f2de3a33 1094#ifndef DISABLE_OCSP
f40d5be3 1095if (cbinfo->is_server && cbinfo->u_ocsp.server.file)
3f7eeb86 1096 {
f5d78688 1097 if (!expand_check(cbinfo->u_ocsp.server.file, US"tls_ocsp_file", &expanded))
3f7eeb86
PP
1098 return DEFER;
1099
f40d5be3 1100 if (expanded && *expanded)
3f7eeb86
PP
1101 {
1102 DEBUG(D_tls) debug_printf("tls_ocsp_file %s\n", expanded);
f40d5be3
JH
1103 if ( cbinfo->u_ocsp.server.file_expanded
1104 && (Ustrcmp(expanded, cbinfo->u_ocsp.server.file_expanded) == 0))
3f7eeb86 1105 {
f40d5be3
JH
1106 DEBUG(D_tls) debug_printf(" - value unchanged, using existing values\n");
1107 }
1108 else
1109 {
1110 ocsp_load_response(sctx, cbinfo, expanded);
3f7eeb86
PP
1111 }
1112 }
1113 }
1114#endif
1115
7be682ca
PP
1116return OK;
1117}
1118
1119
1120
1121
1122/*************************************************
1123* Callback to handle SNI *
1124*************************************************/
1125
1126/* Called when acting as server during the TLS session setup if a Server Name
1127Indication extension was sent by the client.
1128
1129API documentation is OpenSSL s_server.c implementation.
1130
1131Arguments:
1132 s SSL* of the current session
1133 ad unknown (part of OpenSSL API) (unused)
1134 arg Callback of "our" registered data
1135
1136Returns: SSL_TLSEXT_ERR_{OK,ALERT_WARNING,ALERT_FATAL,NOACK}
1137*/
1138
3bcbbbe2 1139#ifdef EXIM_HAVE_OPENSSL_TLSEXT
7be682ca 1140static int
7be682ca
PP
1141tls_servername_cb(SSL *s, int *ad ARG_UNUSED, void *arg)
1142{
1143const char *servername = SSL_get_servername(s, TLSEXT_NAMETYPE_host_name);
3f7eeb86 1144tls_ext_ctx_cb *cbinfo = (tls_ext_ctx_cb *) arg;
7be682ca 1145int rc;
3f0945ff 1146int old_pool = store_pool;
7be682ca
PP
1147
1148if (!servername)
1149 return SSL_TLSEXT_ERR_OK;
1150
3f0945ff 1151DEBUG(D_tls) debug_printf("Received TLS SNI \"%s\"%s\n", servername,
7be682ca
PP
1152 reexpand_tls_files_for_sni ? "" : " (unused for certificate selection)");
1153
1154/* Make the extension value available for expansion */
3f0945ff 1155store_pool = POOL_PERM;
817d9f57 1156tls_in.sni = string_copy(US servername);
3f0945ff 1157store_pool = old_pool;
7be682ca
PP
1158
1159if (!reexpand_tls_files_for_sni)
1160 return SSL_TLSEXT_ERR_OK;
1161
1162/* Can't find an SSL_CTX_clone() or equivalent, so we do it manually;
1163not confident that memcpy wouldn't break some internal reference counting.
1164Especially since there's a references struct member, which would be off. */
1165
0df4ab80 1166if (!(server_sni = SSL_CTX_new(SSLv23_server_method())))
7be682ca
PP
1167 {
1168 ERR_error_string(ERR_get_error(), ssl_errstring);
1169 DEBUG(D_tls) debug_printf("SSL_CTX_new() failed: %s\n", ssl_errstring);
1170 return SSL_TLSEXT_ERR_NOACK;
1171 }
1172
1173/* Not sure how many of these are actually needed, since SSL object
1174already exists. Might even need this selfsame callback, for reneg? */
1175
817d9f57
JH
1176SSL_CTX_set_info_callback(server_sni, SSL_CTX_get_info_callback(server_ctx));
1177SSL_CTX_set_mode(server_sni, SSL_CTX_get_mode(server_ctx));
1178SSL_CTX_set_options(server_sni, SSL_CTX_get_options(server_ctx));
1179SSL_CTX_set_timeout(server_sni, SSL_CTX_get_timeout(server_ctx));
1180SSL_CTX_set_tlsext_servername_callback(server_sni, tls_servername_cb);
1181SSL_CTX_set_tlsext_servername_arg(server_sni, cbinfo);
038597d2
PP
1182
1183if ( !init_dh(server_sni, cbinfo->dhparam, NULL)
1184 || !init_ecdh(server_sni, NULL)
1185 )
1186 return SSL_TLSEXT_ERR_NOACK;
1187
7be682ca 1188if (cbinfo->server_cipher_list)
817d9f57 1189 SSL_CTX_set_cipher_list(server_sni, CS cbinfo->server_cipher_list);
f2de3a33 1190#ifndef DISABLE_OCSP
f5d78688 1191if (cbinfo->u_ocsp.server.file)
3f7eeb86 1192 {
f5d78688 1193 SSL_CTX_set_tlsext_status_cb(server_sni, tls_server_stapling_cb);
14c7b357 1194 SSL_CTX_set_tlsext_status_arg(server_sni, cbinfo);
3f7eeb86
PP
1195 }
1196#endif
7be682ca 1197
983207c1 1198rc = setup_certs(server_sni, tls_verify_certificates, tls_crl, NULL, FALSE, verify_callback_server);
7be682ca
PP
1199if (rc != OK) return SSL_TLSEXT_ERR_NOACK;
1200
3f7eeb86
PP
1201/* do this after setup_certs, because this can require the certs for verifying
1202OCSP information. */
038597d2 1203if ((rc = tls_expand_session_files(server_sni, cbinfo)) != OK)
0df4ab80 1204 return SSL_TLSEXT_ERR_NOACK;
a799883d 1205
7be682ca 1206DEBUG(D_tls) debug_printf("Switching SSL context.\n");
817d9f57 1207SSL_set_SSL_CTX(s, server_sni);
7be682ca
PP
1208
1209return SSL_TLSEXT_ERR_OK;
1210}
3bcbbbe2 1211#endif /* EXIM_HAVE_OPENSSL_TLSEXT */
7be682ca
PP
1212
1213
1214
1215
f2de3a33 1216#ifndef DISABLE_OCSP
f5d78688 1217
3f7eeb86
PP
1218/*************************************************
1219* Callback to handle OCSP Stapling *
1220*************************************************/
1221
1222/* Called when acting as server during the TLS session setup if the client
1223requests OCSP information with a Certificate Status Request.
1224
1225Documentation via openssl s_server.c and the Apache patch from the OpenSSL
1226project.
1227
1228*/
1229
1230static int
f5d78688 1231tls_server_stapling_cb(SSL *s, void *arg)
3f7eeb86
PP
1232{
1233const tls_ext_ctx_cb *cbinfo = (tls_ext_ctx_cb *) arg;
1234uschar *response_der;
1235int response_der_len;
1236
af4a1bca 1237DEBUG(D_tls)
b3ef41c9 1238 debug_printf("Received TLS status request (OCSP stapling); %s response\n",
f5d78688
JH
1239 cbinfo->u_ocsp.server.response ? "have" : "lack");
1240
44662487 1241tls_in.ocsp = OCSP_NOT_RESP;
f5d78688 1242if (!cbinfo->u_ocsp.server.response)
3f7eeb86
PP
1243 return SSL_TLSEXT_ERR_NOACK;
1244
1245response_der = NULL;
44662487
JH
1246response_der_len = i2d_OCSP_RESPONSE(cbinfo->u_ocsp.server.response,
1247 &response_der);
3f7eeb86
PP
1248if (response_der_len <= 0)
1249 return SSL_TLSEXT_ERR_NOACK;
1250
5e55c7a9 1251SSL_set_tlsext_status_ocsp_resp(server_ssl, response_der, response_der_len);
44662487 1252tls_in.ocsp = OCSP_VFIED;
3f7eeb86
PP
1253return SSL_TLSEXT_ERR_OK;
1254}
1255
3f7eeb86 1256
f5d78688
JH
1257static void
1258time_print(BIO * bp, const char * str, ASN1_GENERALIZEDTIME * time)
1259{
1260BIO_printf(bp, "\t%s: ", str);
1261ASN1_GENERALIZEDTIME_print(bp, time);
1262BIO_puts(bp, "\n");
1263}
1264
1265static int
1266tls_client_stapling_cb(SSL *s, void *arg)
1267{
1268tls_ext_ctx_cb * cbinfo = arg;
1269const unsigned char * p;
1270int len;
1271OCSP_RESPONSE * rsp;
1272OCSP_BASICRESP * bs;
1273int i;
1274
1275DEBUG(D_tls) debug_printf("Received TLS status response (OCSP stapling):");
1276len = SSL_get_tlsext_status_ocsp_resp(s, &p);
1277if(!p)
1278 {
44662487 1279 /* Expect this when we requested ocsp but got none */
6c6d6e48 1280 if (cbinfo->u_ocsp.client.verify_required && LOGGING(tls_cipher))
44662487 1281 log_write(0, LOG_MAIN, "Received TLS status callback, null content");
f5d78688
JH
1282 else
1283 DEBUG(D_tls) debug_printf(" null\n");
44662487 1284 return cbinfo->u_ocsp.client.verify_required ? 0 : 1;
f5d78688 1285 }
018058b2 1286
f5d78688
JH
1287if(!(rsp = d2i_OCSP_RESPONSE(NULL, &p, len)))
1288 {
018058b2 1289 tls_out.ocsp = OCSP_FAILED;
6c6d6e48 1290 if (LOGGING(tls_cipher))
1eca31ca 1291 log_write(0, LOG_MAIN, "Received TLS cert status response, parse error");
f5d78688
JH
1292 else
1293 DEBUG(D_tls) debug_printf(" parse error\n");
1294 return 0;
1295 }
1296
1297if(!(bs = OCSP_response_get1_basic(rsp)))
1298 {
018058b2 1299 tls_out.ocsp = OCSP_FAILED;
6c6d6e48 1300 if (LOGGING(tls_cipher))
1eca31ca 1301 log_write(0, LOG_MAIN, "Received TLS cert status response, error parsing response");
f5d78688
JH
1302 else
1303 DEBUG(D_tls) debug_printf(" error parsing response\n");
1304 OCSP_RESPONSE_free(rsp);
1305 return 0;
1306 }
1307
1308/* We'd check the nonce here if we'd put one in the request. */
1309/* However that would defeat cacheability on the server so we don't. */
1310
f5d78688
JH
1311/* This section of code reworked from OpenSSL apps source;
1312 The OpenSSL Project retains copyright:
1313 Copyright (c) 1999 The OpenSSL Project. All rights reserved.
1314*/
1315 {
1316 BIO * bp = NULL;
f5d78688
JH
1317 int status, reason;
1318 ASN1_GENERALIZEDTIME *rev, *thisupd, *nextupd;
1319
1320 DEBUG(D_tls) bp = BIO_new_fp(stderr, BIO_NOCLOSE);
1321
1322 /*OCSP_RESPONSE_print(bp, rsp, 0); extreme debug: stapling content */
1323
1324 /* Use the chain that verified the server cert to verify the stapled info */
1325 /* DEBUG(D_tls) x509_store_dump_cert_s_names(cbinfo->u_ocsp.client.verify_store); */
1326
ee5b1e28 1327 if ((i = OCSP_basic_verify(bs, cbinfo->u_ocsp.client.verify_stack,
44662487 1328 cbinfo->u_ocsp.client.verify_store, 0)) <= 0)
f5d78688 1329 {
018058b2 1330 tls_out.ocsp = OCSP_FAILED;
6c6d6e48 1331 if (LOGGING(tls_cipher))
1eca31ca 1332 log_write(0, LOG_MAIN, "Received TLS cert status response, itself unverifiable");
f5d78688
JH
1333 BIO_printf(bp, "OCSP response verify failure\n");
1334 ERR_print_errors(bp);
c8dfb21d 1335 goto failed;
f5d78688
JH
1336 }
1337
1338 BIO_printf(bp, "OCSP response well-formed and signed OK\n");
1339
c8dfb21d
JH
1340 /*XXX So we have a good stapled OCSP status. How do we know
1341 it is for the cert of interest? OpenSSL 1.1.0 has a routine
1342 OCSP_resp_find_status() which matches on a cert id, which presumably
1343 we should use. Making an id needs OCSP_cert_id_new(), which takes
1344 issuerName, issuerKey, serialNumber. Are they all in the cert?
1345
1346 For now, carry on blindly accepting the resp. */
1347
f5d78688 1348 {
f5d78688
JH
1349 OCSP_SINGLERESP * single;
1350
c8dfb21d
JH
1351#ifdef EXIM_HAVE_OCSP_RESP_COUNT
1352 if (OCSP_resp_count(bs) != 1)
1353#else
1354 STACK_OF(OCSP_SINGLERESP) * sresp = bs->tbsResponseData->responses;
f5d78688 1355 if (sk_OCSP_SINGLERESP_num(sresp) != 1)
c8dfb21d 1356#endif
f5d78688 1357 {
018058b2 1358 tls_out.ocsp = OCSP_FAILED;
44662487
JH
1359 log_write(0, LOG_MAIN, "OCSP stapling "
1360 "with multiple responses not handled");
c8dfb21d 1361 goto failed;
f5d78688
JH
1362 }
1363 single = OCSP_resp_get0(bs, 0);
44662487
JH
1364 status = OCSP_single_get0_status(single, &reason, &rev,
1365 &thisupd, &nextupd);
f5d78688
JH
1366 }
1367
f5d78688
JH
1368 DEBUG(D_tls) time_print(bp, "This OCSP Update", thisupd);
1369 DEBUG(D_tls) if(nextupd) time_print(bp, "Next OCSP Update", nextupd);
44662487
JH
1370 if (!OCSP_check_validity(thisupd, nextupd,
1371 EXIM_OCSP_SKEW_SECONDS, EXIM_OCSP_MAX_AGE))
f5d78688 1372 {
018058b2 1373 tls_out.ocsp = OCSP_FAILED;
f5d78688
JH
1374 DEBUG(D_tls) ERR_print_errors(bp);
1375 log_write(0, LOG_MAIN, "Server OSCP dates invalid");
f5d78688 1376 }
44662487 1377 else
f5d78688 1378 {
44662487
JH
1379 DEBUG(D_tls) BIO_printf(bp, "Certificate status: %s\n",
1380 OCSP_cert_status_str(status));
1381 switch(status)
1382 {
1383 case V_OCSP_CERTSTATUS_GOOD:
44662487 1384 tls_out.ocsp = OCSP_VFIED;
018058b2 1385 i = 1;
c8dfb21d 1386 goto good;
44662487 1387 case V_OCSP_CERTSTATUS_REVOKED:
018058b2 1388 tls_out.ocsp = OCSP_FAILED;
44662487
JH
1389 log_write(0, LOG_MAIN, "Server certificate revoked%s%s",
1390 reason != -1 ? "; reason: " : "",
1391 reason != -1 ? OCSP_crl_reason_str(reason) : "");
1392 DEBUG(D_tls) time_print(bp, "Revocation Time", rev);
44662487
JH
1393 break;
1394 default:
018058b2 1395 tls_out.ocsp = OCSP_FAILED;
44662487
JH
1396 log_write(0, LOG_MAIN,
1397 "Server certificate status unknown, in OCSP stapling");
44662487
JH
1398 break;
1399 }
f5d78688 1400 }
c8dfb21d
JH
1401 failed:
1402 i = cbinfo->u_ocsp.client.verify_required ? 0 : 1;
1403 good:
f5d78688
JH
1404 BIO_free(bp);
1405 }
1406
1407OCSP_RESPONSE_free(rsp);
1408return i;
1409}
f2de3a33 1410#endif /*!DISABLE_OCSP*/
3f7eeb86
PP
1411
1412
7be682ca 1413/*************************************************
059ec3d9
PH
1414* Initialize for TLS *
1415*************************************************/
1416
e51c7be2
JH
1417/* Called from both server and client code, to do preliminary initialization
1418of the library. We allocate and return a context structure.
059ec3d9
PH
1419
1420Arguments:
946ecbe0 1421 ctxp returned SSL context
059ec3d9
PH
1422 host connected host, if client; NULL if server
1423 dhparam DH parameter file
1424 certificate certificate file
1425 privatekey private key
f5d78688 1426 ocsp_file file of stapling info (server); flag for require ocsp (client)
059ec3d9 1427 addr address if client; NULL if server (for some randomness)
946ecbe0 1428 cbp place to put allocated callback context
059ec3d9
PH
1429
1430Returns: OK/DEFER/FAIL
1431*/
1432
1433static int
817d9f57 1434tls_init(SSL_CTX **ctxp, host_item *host, uschar *dhparam, uschar *certificate,
3f7eeb86 1435 uschar *privatekey,
f2de3a33 1436#ifndef DISABLE_OCSP
3f7eeb86
PP
1437 uschar *ocsp_file,
1438#endif
817d9f57 1439 address_item *addr, tls_ext_ctx_cb ** cbp)
059ec3d9 1440{
77bb000f 1441long init_options;
7be682ca 1442int rc;
77bb000f 1443BOOL okay;
a7538db1 1444tls_ext_ctx_cb * cbinfo;
7be682ca
PP
1445
1446cbinfo = store_malloc(sizeof(tls_ext_ctx_cb));
1447cbinfo->certificate = certificate;
1448cbinfo->privatekey = privatekey;
f2de3a33 1449#ifndef DISABLE_OCSP
f5d78688
JH
1450if ((cbinfo->is_server = host==NULL))
1451 {
1452 cbinfo->u_ocsp.server.file = ocsp_file;
1453 cbinfo->u_ocsp.server.file_expanded = NULL;
1454 cbinfo->u_ocsp.server.response = NULL;
1455 }
1456else
ee5b1e28 1457 {
f5d78688 1458 cbinfo->u_ocsp.client.verify_store = NULL;
ee5b1e28
JH
1459 cbinfo->u_ocsp.client.verify_stack = NULL;
1460 }
3f7eeb86 1461#endif
7be682ca 1462cbinfo->dhparam = dhparam;
0df4ab80 1463cbinfo->server_cipher_list = NULL;
7be682ca 1464cbinfo->host = host;
0cbf2b82 1465#ifndef DISABLE_EVENT
a7538db1
JH
1466cbinfo->event_action = NULL;
1467#endif
77bb000f 1468
059ec3d9
PH
1469SSL_load_error_strings(); /* basic set up */
1470OpenSSL_add_ssl_algorithms();
1471
c8dfb21d 1472#ifdef EXIM_HAVE_SHA256
77bb000f 1473/* SHA256 is becoming ever more popular. This makes sure it gets added to the
a0475b69
TK
1474list of available digests. */
1475EVP_add_digest(EVP_sha256());
cf1ef1a9 1476#endif
a0475b69 1477
f0f5a555
PP
1478/* Create a context.
1479The OpenSSL docs in 1.0.1b have not been updated to clarify TLS variant
1480negotiation in the different methods; as far as I can tell, the only
1481*_{server,client}_method which allows negotiation is SSLv23, which exists even
1482when OpenSSL is built without SSLv2 support.
1483By disabling with openssl_options, we can let admins re-enable with the
1484existing knob. */
059ec3d9 1485
c8dfb21d 1486*ctxp = SSL_CTX_new(host ? SSLv23_client_method() : SSLv23_server_method());
059ec3d9 1487
c8dfb21d 1488if (!*ctxp) return tls_error(US"SSL_CTX_new", host, NULL);
059ec3d9
PH
1489
1490/* It turns out that we need to seed the random number generator this early in
1491order to get the full complement of ciphers to work. It took me roughly a day
1492of work to discover this by experiment.
1493
1494On systems that have /dev/urandom, SSL may automatically seed itself from
1495there. Otherwise, we have to make something up as best we can. Double check
1496afterwards. */
1497
1498if (!RAND_status())
1499 {
1500 randstuff r;
9e3331ea 1501 gettimeofday(&r.tv, NULL);
059ec3d9
PH
1502 r.p = getpid();
1503
1504 RAND_seed((uschar *)(&r), sizeof(r));
1505 RAND_seed((uschar *)big_buffer, big_buffer_size);
1506 if (addr != NULL) RAND_seed((uschar *)addr, sizeof(addr));
1507
1508 if (!RAND_status())
7199e1ee 1509 return tls_error(US"RAND_status", host,
5ca6d115 1510 US"unable to seed random number generator");
059ec3d9
PH
1511 }
1512
1513/* Set up the information callback, which outputs if debugging is at a suitable
1514level. */
1515
f69979cf 1516DEBUG(D_tls) SSL_CTX_set_info_callback(*ctxp, (void (*)())info_callback);
059ec3d9 1517
c80c5570 1518/* Automatically re-try reads/writes after renegotiation. */
817d9f57 1519(void) SSL_CTX_set_mode(*ctxp, SSL_MODE_AUTO_RETRY);
c80c5570 1520
77bb000f
PP
1521/* Apply administrator-supplied work-arounds.
1522Historically we applied just one requested option,
1523SSL_OP_DONT_INSERT_EMPTY_FRAGMENTS, but when bug 994 requested a second, we
1524moved to an administrator-controlled list of options to specify and
1525grandfathered in the first one as the default value for "openssl_options".
059ec3d9 1526
77bb000f
PP
1527No OpenSSL version number checks: the options we accept depend upon the
1528availability of the option value macros from OpenSSL. */
059ec3d9 1529
77bb000f
PP
1530okay = tls_openssl_options_parse(openssl_options, &init_options);
1531if (!okay)
73a46702 1532 return tls_error(US"openssl_options parsing failed", host, NULL);
77bb000f
PP
1533
1534if (init_options)
1535 {
1536 DEBUG(D_tls) debug_printf("setting SSL CTX options: %#lx\n", init_options);
817d9f57 1537 if (!(SSL_CTX_set_options(*ctxp, init_options)))
77bb000f
PP
1538 return tls_error(string_sprintf(
1539 "SSL_CTX_set_option(%#lx)", init_options), host, NULL);
1540 }
1541else
1542 DEBUG(D_tls) debug_printf("no SSL CTX options to set\n");
059ec3d9
PH
1543
1544/* Initialize with DH parameters if supplied */
10ca4f1c 1545/* Initialize ECDH temp key parameter selection */
059ec3d9 1546
038597d2
PP
1547if ( !init_dh(*ctxp, dhparam, host)
1548 || !init_ecdh(*ctxp, host)
1549 )
1550 return DEFER;
059ec3d9 1551
3f7eeb86 1552/* Set up certificate and key (and perhaps OCSP info) */
059ec3d9 1553
23bb6982
JH
1554if ((rc = tls_expand_session_files(*ctxp, cbinfo)) != OK)
1555 return rc;
c91535f3 1556
7be682ca 1557/* If we need to handle SNI, do so */
3bcbbbe2 1558#ifdef EXIM_HAVE_OPENSSL_TLSEXT
f5d78688 1559if (host == NULL) /* server */
3f0945ff 1560 {
f2de3a33 1561# ifndef DISABLE_OCSP
f5d78688 1562 /* We check u_ocsp.server.file, not server.response, because we care about if
3f7eeb86
PP
1563 the option exists, not what the current expansion might be, as SNI might
1564 change the certificate and OCSP file in use between now and the time the
1565 callback is invoked. */
f5d78688 1566 if (cbinfo->u_ocsp.server.file)
3f7eeb86 1567 {
f5d78688 1568 SSL_CTX_set_tlsext_status_cb(server_ctx, tls_server_stapling_cb);
5e55c7a9 1569 SSL_CTX_set_tlsext_status_arg(server_ctx, cbinfo);
3f7eeb86 1570 }
f5d78688 1571# endif
3f0945ff
PP
1572 /* We always do this, so that $tls_sni is available even if not used in
1573 tls_certificate */
817d9f57
JH
1574 SSL_CTX_set_tlsext_servername_callback(*ctxp, tls_servername_cb);
1575 SSL_CTX_set_tlsext_servername_arg(*ctxp, cbinfo);
3f0945ff 1576 }
f2de3a33 1577# ifndef DISABLE_OCSP
f5d78688
JH
1578else /* client */
1579 if(ocsp_file) /* wanting stapling */
1580 {
1581 if (!(cbinfo->u_ocsp.client.verify_store = X509_STORE_new()))
1582 {
1583 DEBUG(D_tls) debug_printf("failed to create store for stapling verify\n");
1584 return FAIL;
1585 }
ee5b1e28
JH
1586 if (!(cbinfo->u_ocsp.client.verify_stack = sk_X509_new_null()))
1587 {
1588 DEBUG(D_tls) debug_printf("failed to create stack for stapling verify\n");
1589 return FAIL;
1590 }
f5d78688
JH
1591 SSL_CTX_set_tlsext_status_cb(*ctxp, tls_client_stapling_cb);
1592 SSL_CTX_set_tlsext_status_arg(*ctxp, cbinfo);
1593 }
1594# endif
7be682ca 1595#endif
059ec3d9 1596
e51c7be2 1597cbinfo->verify_cert_hostnames = NULL;
e51c7be2 1598
c8dfb21d 1599#ifdef EXIM_HAVE_EPHEM_RSA_KEX
059ec3d9 1600/* Set up the RSA callback */
817d9f57 1601SSL_CTX_set_tmp_rsa_callback(*ctxp, rsa_callback);
c8dfb21d 1602#endif
059ec3d9
PH
1603
1604/* Finally, set the timeout, and we are done */
1605
817d9f57 1606SSL_CTX_set_timeout(*ctxp, ssl_session_timeout);
059ec3d9 1607DEBUG(D_tls) debug_printf("Initialized TLS\n");
7be682ca 1608
817d9f57 1609*cbp = cbinfo;
7be682ca 1610
059ec3d9
PH
1611return OK;
1612}
1613
1614
1615
1616
1617/*************************************************
1618* Get name of cipher in use *
1619*************************************************/
1620
817d9f57 1621/*
059ec3d9 1622Argument: pointer to an SSL structure for the connection
817d9f57
JH
1623 buffer to use for answer
1624 size of buffer
1625 pointer to number of bits for cipher
059ec3d9
PH
1626Returns: nothing
1627*/
1628
1629static void
817d9f57 1630construct_cipher_name(SSL *ssl, uschar *cipherbuf, int bsize, int *bits)
059ec3d9 1631{
57b3a7f5
PP
1632/* With OpenSSL 1.0.0a, this needs to be const but the documentation doesn't
1633yet reflect that. It should be a safe change anyway, even 0.9.8 versions have
1634the accessor functions use const in the prototype. */
1635const SSL_CIPHER *c;
d9784128 1636const uschar *ver;
059ec3d9 1637
d9784128 1638ver = (const uschar *)SSL_get_version(ssl);
059ec3d9 1639
57b3a7f5 1640c = (const SSL_CIPHER *) SSL_get_current_cipher(ssl);
817d9f57 1641SSL_CIPHER_get_bits(c, bits);
059ec3d9 1642
817d9f57
JH
1643string_format(cipherbuf, bsize, "%s:%s:%u", ver,
1644 SSL_CIPHER_get_name(c), *bits);
059ec3d9
PH
1645
1646DEBUG(D_tls) debug_printf("Cipher: %s\n", cipherbuf);
1647}
1648
1649
f69979cf
JH
1650static void
1651peer_cert(SSL * ssl, tls_support * tlsp, uschar * peerdn, unsigned bsize)
1652{
1653/*XXX we might consider a list-of-certs variable for the cert chain.
1654SSL_get_peer_cert_chain(SSL*). We'd need a new variable type and support
1655in list-handling functions, also consider the difference between the entire
1656chain and the elements sent by the peer. */
1657
1658/* Will have already noted peercert on a verify fail; possibly not the leaf */
1659if (!tlsp->peercert)
1660 tlsp->peercert = SSL_get_peer_certificate(ssl);
1661/* Beware anonymous ciphers which lead to server_cert being NULL */
1662if (tlsp->peercert)
1663 {
1664 X509_NAME_oneline(X509_get_subject_name(tlsp->peercert), CS peerdn, bsize);
1665 peerdn[bsize-1] = '\0';
1666 tlsp->peerdn = peerdn; /*XXX a static buffer... */
1667 }
1668else
1669 tlsp->peerdn = NULL;
1670}
1671
1672
059ec3d9
PH
1673
1674
1675
1676/*************************************************
1677* Set up for verifying certificates *
1678*************************************************/
1679
1680/* Called by both client and server startup
1681
1682Arguments:
7be682ca 1683 sctx SSL_CTX* to initialise
059ec3d9
PH
1684 certs certs file or NULL
1685 crl CRL file or NULL
1686 host NULL in a server; the remote host in a client
1687 optional TRUE if called from a server for a host in tls_try_verify_hosts;
1688 otherwise passed as FALSE
983207c1 1689 cert_vfy_cb Callback function for certificate verification
059ec3d9
PH
1690
1691Returns: OK/DEFER/FAIL
1692*/
1693
1694static int
983207c1
JH
1695setup_certs(SSL_CTX *sctx, uschar *certs, uschar *crl, host_item *host, BOOL optional,
1696 int (*cert_vfy_cb)(int, X509_STORE_CTX *) )
059ec3d9
PH
1697{
1698uschar *expcerts, *expcrl;
1699
1700if (!expand_check(certs, US"tls_verify_certificates", &expcerts))
1701 return DEFER;
1702
10a831a3 1703if (expcerts && *expcerts)
059ec3d9 1704 {
10a831a3
JH
1705 /* Tell the library to use its compiled-in location for the system default
1706 CA bundle. Then add the ones specified in the config, if any. */
cb1d7830 1707
10a831a3
JH
1708 if (!SSL_CTX_set_default_verify_paths(sctx))
1709 return tls_error(US"SSL_CTX_set_default_verify_paths", host, NULL);
1710
1711 if (Ustrcmp(expcerts, "system") != 0)
059ec3d9 1712 {
cb1d7830
JH
1713 struct stat statbuf;
1714
cb1d7830
JH
1715 if (Ustat(expcerts, &statbuf) < 0)
1716 {
1717 log_write(0, LOG_MAIN|LOG_PANIC,
1718 "failed to stat %s for certificates", expcerts);
1719 return DEFER;
1720 }
059ec3d9 1721 else
059ec3d9 1722 {
cb1d7830
JH
1723 uschar *file, *dir;
1724 if ((statbuf.st_mode & S_IFMT) == S_IFDIR)
1725 { file = NULL; dir = expcerts; }
1726 else
1727 { file = expcerts; dir = NULL; }
1728
1729 /* If a certificate file is empty, the next function fails with an
1730 unhelpful error message. If we skip it, we get the correct behaviour (no
1731 certificates are recognized, but the error message is still misleading (it
1732 says no certificate was supplied.) But this is better. */
1733
f2f2c91b
JH
1734 if ( (!file || statbuf.st_size > 0)
1735 && !SSL_CTX_load_verify_locations(sctx, CS file, CS dir))
cb1d7830
JH
1736 return tls_error(US"SSL_CTX_load_verify_locations", host, NULL);
1737
1738 /* Load the list of CAs for which we will accept certs, for sending
1739 to the client. This is only for the one-file tls_verify_certificates
1740 variant.
1741 If a list isn't loaded into the server, but
1742 some verify locations are set, the server end appears to make
1743 a wildcard reqest for client certs.
10a831a3 1744 Meanwhile, the client library as default behaviour *ignores* the list
cb1d7830
JH
1745 we send over the wire - see man SSL_CTX_set_client_cert_cb.
1746 Because of this, and that the dir variant is likely only used for
1747 the public-CA bundle (not for a private CA), not worth fixing.
1748 */
f2f2c91b 1749 if (file)
cb1d7830
JH
1750 {
1751 STACK_OF(X509_NAME) * names = SSL_load_client_CA_file(CS file);
f2f2c91b
JH
1752
1753 DEBUG(D_tls) debug_printf("Added %d certificate authorities.\n",
cb1d7830
JH
1754 sk_X509_NAME_num(names));
1755 SSL_CTX_set_client_CA_list(sctx, names);
1756 }
059ec3d9
PH
1757 }
1758 }
1759
1760 /* Handle a certificate revocation list. */
1761
10a831a3 1762#if OPENSSL_VERSION_NUMBER > 0x00907000L
059ec3d9 1763
8b417f2c 1764 /* This bit of code is now the version supplied by Lars Mainka. (I have
10a831a3 1765 merely reformatted it into the Exim code style.)
8b417f2c 1766
10a831a3
JH
1767 "From here I changed the code to add support for multiple crl's
1768 in pem format in one file or to support hashed directory entries in
1769 pem format instead of a file. This method now uses the library function
1770 X509_STORE_load_locations to add the CRL location to the SSL context.
1771 OpenSSL will then handle the verify against CA certs and CRLs by
1772 itself in the verify callback." */
8b417f2c 1773
059ec3d9 1774 if (!expand_check(crl, US"tls_crl", &expcrl)) return DEFER;
10a831a3 1775 if (expcrl && *expcrl)
059ec3d9 1776 {
8b417f2c
PH
1777 struct stat statbufcrl;
1778 if (Ustat(expcrl, &statbufcrl) < 0)
1779 {
1780 log_write(0, LOG_MAIN|LOG_PANIC,
1781 "failed to stat %s for certificates revocation lists", expcrl);
1782 return DEFER;
1783 }
1784 else
059ec3d9 1785 {
8b417f2c
PH
1786 /* is it a file or directory? */
1787 uschar *file, *dir;
7be682ca 1788 X509_STORE *cvstore = SSL_CTX_get_cert_store(sctx);
8b417f2c 1789 if ((statbufcrl.st_mode & S_IFMT) == S_IFDIR)
059ec3d9 1790 {
8b417f2c
PH
1791 file = NULL;
1792 dir = expcrl;
1793 DEBUG(D_tls) debug_printf("SSL CRL value is a directory %s\n", dir);
059ec3d9
PH
1794 }
1795 else
1796 {
8b417f2c
PH
1797 file = expcrl;
1798 dir = NULL;
1799 DEBUG(D_tls) debug_printf("SSL CRL value is a file %s\n", file);
059ec3d9 1800 }
8b417f2c 1801 if (X509_STORE_load_locations(cvstore, CS file, CS dir) == 0)
7199e1ee 1802 return tls_error(US"X509_STORE_load_locations", host, NULL);
8b417f2c
PH
1803
1804 /* setting the flags to check against the complete crl chain */
1805
1806 X509_STORE_set_flags(cvstore,
1807 X509_V_FLAG_CRL_CHECK|X509_V_FLAG_CRL_CHECK_ALL);
059ec3d9 1808 }
059ec3d9
PH
1809 }
1810
10a831a3 1811#endif /* OPENSSL_VERSION_NUMBER > 0x00907000L */
059ec3d9
PH
1812
1813 /* If verification is optional, don't fail if no certificate */
1814
7be682ca 1815 SSL_CTX_set_verify(sctx,
059ec3d9 1816 SSL_VERIFY_PEER | (optional? 0 : SSL_VERIFY_FAIL_IF_NO_PEER_CERT),
983207c1 1817 cert_vfy_cb);
059ec3d9
PH
1818 }
1819
1820return OK;
1821}
1822
1823
1824
1825/*************************************************
1826* Start a TLS session in a server *
1827*************************************************/
1828
1829/* This is called when Exim is running as a server, after having received
1830the STARTTLS command. It must respond to that command, and then negotiate
1831a TLS session.
1832
1833Arguments:
1834 require_ciphers allowed ciphers
1835
1836Returns: OK on success
1837 DEFER for errors before the start of the negotiation
1838 FAIL for errors during the negotation; the server can't
1839 continue running.
1840*/
1841
1842int
17c76198 1843tls_server_start(const uschar *require_ciphers)
059ec3d9
PH
1844{
1845int rc;
1846uschar *expciphers;
7be682ca 1847tls_ext_ctx_cb *cbinfo;
f69979cf 1848static uschar peerdn[256];
817d9f57 1849static uschar cipherbuf[256];
059ec3d9
PH
1850
1851/* Check for previous activation */
1852
817d9f57 1853if (tls_in.active >= 0)
059ec3d9 1854 {
5ca6d115 1855 tls_error(US"STARTTLS received after TLS started", NULL, US"");
059ec3d9
PH
1856 smtp_printf("554 Already in TLS\r\n");
1857 return FAIL;
1858 }
1859
1860/* Initialize the SSL library. If it fails, it will already have logged
1861the error. */
1862
817d9f57 1863rc = tls_init(&server_ctx, NULL, tls_dhparam, tls_certificate, tls_privatekey,
f2de3a33 1864#ifndef DISABLE_OCSP
3f7eeb86
PP
1865 tls_ocsp_file,
1866#endif
817d9f57 1867 NULL, &server_static_cbinfo);
059ec3d9 1868if (rc != OK) return rc;
817d9f57 1869cbinfo = server_static_cbinfo;
059ec3d9
PH
1870
1871if (!expand_check(require_ciphers, US"tls_require_ciphers", &expciphers))
1872 return FAIL;
1873
1874/* In OpenSSL, cipher components are separated by hyphens. In GnuTLS, they
17c76198
PP
1875were historically separated by underscores. So that I can use either form in my
1876tests, and also for general convenience, we turn underscores into hyphens here.
1877*/
059ec3d9
PH
1878
1879if (expciphers != NULL)
1880 {
1881 uschar *s = expciphers;
1882 while (*s != 0) { if (*s == '_') *s = '-'; s++; }
1883 DEBUG(D_tls) debug_printf("required ciphers: %s\n", expciphers);
817d9f57 1884 if (!SSL_CTX_set_cipher_list(server_ctx, CS expciphers))
7199e1ee 1885 return tls_error(US"SSL_CTX_set_cipher_list", NULL, NULL);
7be682ca 1886 cbinfo->server_cipher_list = expciphers;
059ec3d9
PH
1887 }
1888
1889/* If this is a host for which certificate verification is mandatory or
1890optional, set up appropriately. */
1891
817d9f57 1892tls_in.certificate_verified = FALSE;
53a7196b
JH
1893#ifdef EXPERIMENTAL_DANE
1894tls_in.dane_verified = FALSE;
1895#endif
a2ff477a 1896server_verify_callback_called = FALSE;
059ec3d9
PH
1897
1898if (verify_check_host(&tls_verify_hosts) == OK)
1899 {
983207c1
JH
1900 rc = setup_certs(server_ctx, tls_verify_certificates, tls_crl, NULL,
1901 FALSE, verify_callback_server);
059ec3d9 1902 if (rc != OK) return rc;
a2ff477a 1903 server_verify_optional = FALSE;
059ec3d9
PH
1904 }
1905else if (verify_check_host(&tls_try_verify_hosts) == OK)
1906 {
983207c1
JH
1907 rc = setup_certs(server_ctx, tls_verify_certificates, tls_crl, NULL,
1908 TRUE, verify_callback_server);
059ec3d9 1909 if (rc != OK) return rc;
a2ff477a 1910 server_verify_optional = TRUE;
059ec3d9
PH
1911 }
1912
1913/* Prepare for new connection */
1914
817d9f57 1915if ((server_ssl = SSL_new(server_ctx)) == NULL) return tls_error(US"SSL_new", NULL, NULL);
da3ad30d
PP
1916
1917/* Warning: we used to SSL_clear(ssl) here, it was removed.
1918 *
1919 * With the SSL_clear(), we get strange interoperability bugs with
1920 * OpenSSL 1.0.1b and TLS1.1/1.2. It looks as though this may be a bug in
1921 * OpenSSL itself, as a clear should not lead to inability to follow protocols.
1922 *
1923 * The SSL_clear() call is to let an existing SSL* be reused, typically after
1924 * session shutdown. In this case, we have a brand new object and there's no
1925 * obvious reason to immediately clear it. I'm guessing that this was
1926 * originally added because of incomplete initialisation which the clear fixed,
1927 * in some historic release.
1928 */
059ec3d9
PH
1929
1930/* Set context and tell client to go ahead, except in the case of TLS startup
1931on connection, where outputting anything now upsets the clients and tends to
1932make them disconnect. We need to have an explicit fflush() here, to force out
1933the response. Other smtp_printf() calls do not need it, because in non-TLS
1934mode, the fflush() happens when smtp_getc() is called. */
1935
817d9f57
JH
1936SSL_set_session_id_context(server_ssl, sid_ctx, Ustrlen(sid_ctx));
1937if (!tls_in.on_connect)
059ec3d9
PH
1938 {
1939 smtp_printf("220 TLS go ahead\r\n");
1940 fflush(smtp_out);
1941 }
1942
1943/* Now negotiate the TLS session. We put our own timer on it, since it seems
1944that the OpenSSL library doesn't. */
1945
817d9f57
JH
1946SSL_set_wfd(server_ssl, fileno(smtp_out));
1947SSL_set_rfd(server_ssl, fileno(smtp_in));
1948SSL_set_accept_state(server_ssl);
059ec3d9
PH
1949
1950DEBUG(D_tls) debug_printf("Calling SSL_accept\n");
1951
1952sigalrm_seen = FALSE;
1953if (smtp_receive_timeout > 0) alarm(smtp_receive_timeout);
817d9f57 1954rc = SSL_accept(server_ssl);
059ec3d9
PH
1955alarm(0);
1956
1957if (rc <= 0)
1958 {
7199e1ee 1959 tls_error(US"SSL_accept", NULL, sigalrm_seen ? US"timed out" : NULL);
77bb000f
PP
1960 if (ERR_get_error() == 0)
1961 log_write(0, LOG_MAIN,
a053d125 1962 "TLS client disconnected cleanly (rejected our certificate?)");
059ec3d9
PH
1963 return FAIL;
1964 }
1965
1966DEBUG(D_tls) debug_printf("SSL_accept was successful\n");
1967
1968/* TLS has been set up. Adjust the input functions to read via TLS,
1969and initialize things. */
1970
f69979cf
JH
1971peer_cert(server_ssl, &tls_in, peerdn, sizeof(peerdn));
1972
817d9f57
JH
1973construct_cipher_name(server_ssl, cipherbuf, sizeof(cipherbuf), &tls_in.bits);
1974tls_in.cipher = cipherbuf;
059ec3d9
PH
1975
1976DEBUG(D_tls)
1977 {
1978 uschar buf[2048];
817d9f57 1979 if (SSL_get_shared_ciphers(server_ssl, CS buf, sizeof(buf)) != NULL)
059ec3d9
PH
1980 debug_printf("Shared ciphers: %s\n", buf);
1981 }
1982
9d1c15ef
JH
1983/* Record the certificate we presented */
1984 {
1985 X509 * crt = SSL_get_certificate(server_ssl);
1986 tls_in.ourcert = crt ? X509_dup(crt) : NULL;
1987 }
059ec3d9 1988
817d9f57
JH
1989/* Only used by the server-side tls (tls_in), including tls_getc.
1990 Client-side (tls_out) reads (seem to?) go via
1991 smtp_read_response()/ip_recv().
1992 Hence no need to duplicate for _in and _out.
1993 */
059ec3d9
PH
1994ssl_xfer_buffer = store_malloc(ssl_xfer_buffer_size);
1995ssl_xfer_buffer_lwm = ssl_xfer_buffer_hwm = 0;
1996ssl_xfer_eof = ssl_xfer_error = 0;
1997
1998receive_getc = tls_getc;
584e96c6 1999receive_get_cache = tls_get_cache;
059ec3d9
PH
2000receive_ungetc = tls_ungetc;
2001receive_feof = tls_feof;
2002receive_ferror = tls_ferror;
58eb016e 2003receive_smtp_buffered = tls_smtp_buffered;
059ec3d9 2004
817d9f57 2005tls_in.active = fileno(smtp_out);
059ec3d9
PH
2006return OK;
2007}
2008
2009
2010
2011
043b1248
JH
2012static int
2013tls_client_basic_ctx_init(SSL_CTX * ctx,
01a4a5c5 2014 host_item * host, smtp_transport_options_block * ob, tls_ext_ctx_cb * cbinfo
043b1248
JH
2015 )
2016{
2017int rc;
94431adb 2018/* stick to the old behaviour for compatibility if tls_verify_certificates is
043b1248
JH
2019 set but both tls_verify_hosts and tls_try_verify_hosts is not set. Check only
2020 the specified host patterns if one of them is defined */
2021
610ff438
JH
2022if ( ( !ob->tls_verify_hosts
2023 && (!ob->tls_try_verify_hosts || !*ob->tls_try_verify_hosts)
2024 )
5130845b 2025 || (verify_check_given_host(&ob->tls_verify_hosts, host) == OK)
aa2a70ba 2026 )
043b1248 2027 client_verify_optional = FALSE;
5130845b 2028else if (verify_check_given_host(&ob->tls_try_verify_hosts, host) == OK)
aa2a70ba
JH
2029 client_verify_optional = TRUE;
2030else
2031 return OK;
2032
2033if ((rc = setup_certs(ctx, ob->tls_verify_certificates,
2034 ob->tls_crl, host, client_verify_optional, verify_callback_client)) != OK)
2035 return rc;
043b1248 2036
5130845b 2037if (verify_check_given_host(&ob->tls_verify_cert_hostnames, host) == OK)
043b1248 2038 {
4af0d74a 2039 cbinfo->verify_cert_hostnames =
8c5d388a 2040#ifdef SUPPORT_I18N
4af0d74a
JH
2041 string_domain_utf8_to_alabel(host->name, NULL);
2042#else
2043 host->name;
2044#endif
aa2a70ba
JH
2045 DEBUG(D_tls) debug_printf("Cert hostname to check: \"%s\"\n",
2046 cbinfo->verify_cert_hostnames);
043b1248 2047 }
043b1248
JH
2048return OK;
2049}
059ec3d9 2050
fde080a4
JH
2051
2052#ifdef EXPERIMENTAL_DANE
2053static int
fde080a4
JH
2054dane_tlsa_load(SSL * ssl, host_item * host, dns_answer * dnsa)
2055{
2056dns_record * rr;
2057dns_scan dnss;
2058const char * hostnames[2] = { CS host->name, NULL };
2059int found = 0;
2060
2061if (DANESSL_init(ssl, NULL, hostnames) != 1)
2062 return tls_error(US"hostnames load", host, NULL);
2063
2064for (rr = dns_next_rr(dnsa, &dnss, RESET_ANSWERS);
2065 rr;
2066 rr = dns_next_rr(dnsa, &dnss, RESET_NEXT)
2067 ) if (rr->type == T_TLSA)
2068 {
2069 uschar * p = rr->data;
2070 uint8_t usage, selector, mtype;
2071 const char * mdname;
2072
fde080a4 2073 usage = *p++;
133d2546
JH
2074
2075 /* Only DANE-TA(2) and DANE-EE(3) are supported */
2076 if (usage != 2 && usage != 3) continue;
2077
fde080a4
JH
2078 selector = *p++;
2079 mtype = *p++;
2080
2081 switch (mtype)
2082 {
133d2546
JH
2083 default: continue; /* Only match-types 0, 1, 2 are supported */
2084 case 0: mdname = NULL; break;
2085 case 1: mdname = "sha256"; break;
2086 case 2: mdname = "sha512"; break;
fde080a4
JH
2087 }
2088
133d2546 2089 found++;
fde080a4
JH
2090 switch (DANESSL_add_tlsa(ssl, usage, selector, mdname, p, rr->size - 3))
2091 {
2092 default:
fde080a4 2093 return tls_error(US"tlsa load", host, NULL);
c035b645 2094 case 0: /* action not taken */
fde080a4
JH
2095 case 1: break;
2096 }
594706ea
JH
2097
2098 tls_out.tlsa_usage |= 1<<usage;
fde080a4
JH
2099 }
2100
2101if (found)
2102 return OK;
2103
133d2546 2104log_write(0, LOG_MAIN, "DANE error: No usable TLSA records");
6ebd79ec 2105return DEFER;
fde080a4
JH
2106}
2107#endif /*EXPERIMENTAL_DANE*/
2108
2109
2110
059ec3d9
PH
2111/*************************************************
2112* Start a TLS session in a client *
2113*************************************************/
2114
2115/* Called from the smtp transport after STARTTLS has been accepted.
2116
2117Argument:
2118 fd the fd of the connection
2119 host connected host (for messages)
83da1223 2120 addr the first address
a7538db1 2121 tb transport (always smtp)
0e66b3b6 2122 tlsa_dnsa tlsa lookup, if DANE, else null
059ec3d9
PH
2123
2124Returns: OK on success
2125 FAIL otherwise - note that tls_error() will not give DEFER
2126 because this is not a server
2127*/
2128
2129int
f5d78688 2130tls_client_start(int fd, host_item *host, address_item *addr,
0e66b3b6
JH
2131 transport_instance *tb
2132#ifdef EXPERIMENTAL_DANE
2133 , dns_answer * tlsa_dnsa
2134#endif
2135 )
059ec3d9 2136{
a7538db1
JH
2137smtp_transport_options_block * ob =
2138 (smtp_transport_options_block *)tb->options_block;
f69979cf 2139static uschar peerdn[256];
868f5672 2140uschar * expciphers;
059ec3d9 2141int rc;
817d9f57 2142static uschar cipherbuf[256];
043b1248
JH
2143
2144#ifndef DISABLE_OCSP
043b1248 2145BOOL request_ocsp = FALSE;
6634ac8d 2146BOOL require_ocsp = FALSE;
043b1248 2147#endif
043b1248
JH
2148
2149#ifdef EXPERIMENTAL_DANE
594706ea 2150tls_out.tlsa_usage = 0;
043b1248
JH
2151#endif
2152
f2de3a33 2153#ifndef DISABLE_OCSP
043b1248 2154 {
4f59c424
JH
2155# ifdef EXPERIMENTAL_DANE
2156 if ( tlsa_dnsa
2157 && ob->hosts_request_ocsp[0] == '*'
2158 && ob->hosts_request_ocsp[1] == '\0'
2159 )
2160 {
2161 /* Unchanged from default. Use a safer one under DANE */
2162 request_ocsp = TRUE;
2163 ob->hosts_request_ocsp = US"${if or { {= {0}{$tls_out_tlsa_usage}} "
2164 " {= {4}{$tls_out_tlsa_usage}} } "
2165 " {*}{}}";
2166 }
2167# endif
2168
5130845b
JH
2169 if ((require_ocsp =
2170 verify_check_given_host(&ob->hosts_require_ocsp, host) == OK))
fca41d5a
JH
2171 request_ocsp = TRUE;
2172 else
fca41d5a 2173# ifdef EXPERIMENTAL_DANE
4f59c424 2174 if (!request_ocsp)
fca41d5a 2175# endif
5130845b
JH
2176 request_ocsp =
2177 verify_check_given_host(&ob->hosts_request_ocsp, host) == OK;
043b1248 2178 }
f5d78688 2179#endif
059ec3d9 2180
65867078
JH
2181rc = tls_init(&client_ctx, host, NULL,
2182 ob->tls_certificate, ob->tls_privatekey,
f2de3a33 2183#ifndef DISABLE_OCSP
44662487 2184 (void *)(long)request_ocsp,
3f7eeb86 2185#endif
817d9f57 2186 addr, &client_static_cbinfo);
059ec3d9
PH
2187if (rc != OK) return rc;
2188
817d9f57 2189tls_out.certificate_verified = FALSE;
a2ff477a 2190client_verify_callback_called = FALSE;
059ec3d9 2191
65867078
JH
2192if (!expand_check(ob->tls_require_ciphers, US"tls_require_ciphers",
2193 &expciphers))
059ec3d9
PH
2194 return FAIL;
2195
2196/* In OpenSSL, cipher components are separated by hyphens. In GnuTLS, they
2197are separated by underscores. So that I can use either form in my tests, and
2198also for general convenience, we turn underscores into hyphens here. */
2199
2200if (expciphers != NULL)
2201 {
2202 uschar *s = expciphers;
2203 while (*s != 0) { if (*s == '_') *s = '-'; s++; }
2204 DEBUG(D_tls) debug_printf("required ciphers: %s\n", expciphers);
817d9f57 2205 if (!SSL_CTX_set_cipher_list(client_ctx, CS expciphers))
7199e1ee 2206 return tls_error(US"SSL_CTX_set_cipher_list", host, NULL);
059ec3d9
PH
2207 }
2208
043b1248 2209#ifdef EXPERIMENTAL_DANE
0e66b3b6 2210if (tlsa_dnsa)
a63be306 2211 {
02af313d
JH
2212 SSL_CTX_set_verify(client_ctx,
2213 SSL_VERIFY_PEER | SSL_VERIFY_FAIL_IF_NO_PEER_CERT,
2214 verify_callback_client_dane);
e5cccda9 2215
043b1248 2216 if (!DANESSL_library_init())
b4161d10 2217 return tls_error(US"library init", host, NULL);
043b1248 2218 if (DANESSL_CTX_init(client_ctx) <= 0)
b4161d10 2219 return tls_error(US"context init", host, NULL);
043b1248
JH
2220 }
2221else
e51c7be2 2222
043b1248
JH
2223#endif
2224
01a4a5c5
JH
2225 if ((rc = tls_client_basic_ctx_init(client_ctx, host, ob, client_static_cbinfo))
2226 != OK)
65867078 2227 return rc;
059ec3d9 2228
65867078
JH
2229if ((client_ssl = SSL_new(client_ctx)) == NULL)
2230 return tls_error(US"SSL_new", host, NULL);
817d9f57
JH
2231SSL_set_session_id_context(client_ssl, sid_ctx, Ustrlen(sid_ctx));
2232SSL_set_fd(client_ssl, fd);
2233SSL_set_connect_state(client_ssl);
059ec3d9 2234
65867078 2235if (ob->tls_sni)
3f0945ff 2236 {
65867078 2237 if (!expand_check(ob->tls_sni, US"tls_sni", &tls_out.sni))
3f0945ff 2238 return FAIL;
ec4b68e5 2239 if (tls_out.sni == NULL)
2c9a0e86
PP
2240 {
2241 DEBUG(D_tls) debug_printf("Setting TLS SNI forced to fail, not sending\n");
2242 }
ec4b68e5 2243 else if (!Ustrlen(tls_out.sni))
817d9f57 2244 tls_out.sni = NULL;
3f0945ff
PP
2245 else
2246 {
35731706 2247#ifdef EXIM_HAVE_OPENSSL_TLSEXT
817d9f57
JH
2248 DEBUG(D_tls) debug_printf("Setting TLS SNI \"%s\"\n", tls_out.sni);
2249 SSL_set_tlsext_host_name(client_ssl, tls_out.sni);
35731706 2250#else
66802652 2251 log_write(0, LOG_MAIN, "SNI unusable with this OpenSSL library version; ignoring \"%s\"\n",
02d9264f 2252 tls_out.sni);
35731706 2253#endif
3f0945ff
PP
2254 }
2255 }
2256
594706ea 2257#ifdef EXPERIMENTAL_DANE
0e66b3b6
JH
2258if (tlsa_dnsa)
2259 if ((rc = dane_tlsa_load(client_ssl, host, tlsa_dnsa)) != OK)
594706ea
JH
2260 return rc;
2261#endif
2262
f2de3a33 2263#ifndef DISABLE_OCSP
f5d78688
JH
2264/* Request certificate status at connection-time. If the server
2265does OCSP stapling we will get the callback (set in tls_init()) */
b50c8b84 2266# ifdef EXPERIMENTAL_DANE
44662487
JH
2267if (request_ocsp)
2268 {
594706ea 2269 const uschar * s;
41afb5cb
JH
2270 if ( ((s = ob->hosts_require_ocsp) && Ustrstr(s, US"tls_out_tlsa_usage"))
2271 || ((s = ob->hosts_request_ocsp) && Ustrstr(s, US"tls_out_tlsa_usage"))
594706ea
JH
2272 )
2273 { /* Re-eval now $tls_out_tlsa_usage is populated. If
2274 this means we avoid the OCSP request, we wasted the setup
2275 cost in tls_init(). */
5130845b
JH
2276 require_ocsp = verify_check_given_host(&ob->hosts_require_ocsp, host) == OK;
2277 request_ocsp = require_ocsp
2278 || verify_check_given_host(&ob->hosts_request_ocsp, host) == OK;
594706ea
JH
2279 }
2280 }
b50c8b84
JH
2281# endif
2282
594706ea
JH
2283if (request_ocsp)
2284 {
f5d78688 2285 SSL_set_tlsext_status_type(client_ssl, TLSEXT_STATUSTYPE_ocsp);
44662487
JH
2286 client_static_cbinfo->u_ocsp.client.verify_required = require_ocsp;
2287 tls_out.ocsp = OCSP_NOT_RESP;
2288 }
f5d78688
JH
2289#endif
2290
0cbf2b82 2291#ifndef DISABLE_EVENT
774ef2d7 2292client_static_cbinfo->event_action = tb->event_action;
a7538db1 2293#endif
043b1248 2294
059ec3d9
PH
2295/* There doesn't seem to be a built-in timeout on connection. */
2296
2297DEBUG(D_tls) debug_printf("Calling SSL_connect\n");
2298sigalrm_seen = FALSE;
65867078 2299alarm(ob->command_timeout);
817d9f57 2300rc = SSL_connect(client_ssl);
059ec3d9
PH
2301alarm(0);
2302
043b1248 2303#ifdef EXPERIMENTAL_DANE
0e66b3b6 2304if (tlsa_dnsa)
fde080a4 2305 DANESSL_cleanup(client_ssl);
043b1248
JH
2306#endif
2307
059ec3d9 2308if (rc <= 0)
7199e1ee 2309 return tls_error(US"SSL_connect", host, sigalrm_seen ? US"timed out" : NULL);
059ec3d9
PH
2310
2311DEBUG(D_tls) debug_printf("SSL_connect succeeded\n");
2312
f69979cf 2313peer_cert(client_ssl, &tls_out, peerdn, sizeof(peerdn));
059ec3d9 2314
817d9f57
JH
2315construct_cipher_name(client_ssl, cipherbuf, sizeof(cipherbuf), &tls_out.bits);
2316tls_out.cipher = cipherbuf;
059ec3d9 2317
9d1c15ef
JH
2318/* Record the certificate we presented */
2319 {
2320 X509 * crt = SSL_get_certificate(client_ssl);
2321 tls_out.ourcert = crt ? X509_dup(crt) : NULL;
2322 }
2323
817d9f57 2324tls_out.active = fd;
059ec3d9
PH
2325return OK;
2326}
2327
2328
2329
2330
2331
2332/*************************************************
2333* TLS version of getc *
2334*************************************************/
2335
2336/* This gets the next byte from the TLS input buffer. If the buffer is empty,
2337it refills the buffer via the SSL reading function.
2338
2339Arguments: none
2340Returns: the next character or EOF
817d9f57
JH
2341
2342Only used by the server-side TLS.
059ec3d9
PH
2343*/
2344
2345int
2346tls_getc(void)
2347{
2348if (ssl_xfer_buffer_lwm >= ssl_xfer_buffer_hwm)
2349 {
2350 int error;
2351 int inbytes;
2352
817d9f57 2353 DEBUG(D_tls) debug_printf("Calling SSL_read(%p, %p, %u)\n", server_ssl,
c80c5570 2354 ssl_xfer_buffer, ssl_xfer_buffer_size);
059ec3d9
PH
2355
2356 if (smtp_receive_timeout > 0) alarm(smtp_receive_timeout);
817d9f57
JH
2357 inbytes = SSL_read(server_ssl, CS ssl_xfer_buffer, ssl_xfer_buffer_size);
2358 error = SSL_get_error(server_ssl, inbytes);
059ec3d9
PH
2359 alarm(0);
2360
2361 /* SSL_ERROR_ZERO_RETURN appears to mean that the SSL session has been
2362 closed down, not that the socket itself has been closed down. Revert to
2363 non-SSL handling. */
2364
2365 if (error == SSL_ERROR_ZERO_RETURN)
2366 {
2367 DEBUG(D_tls) debug_printf("Got SSL_ERROR_ZERO_RETURN\n");
2368
2369 receive_getc = smtp_getc;
584e96c6 2370 receive_get_cache = smtp_get_cache;
059ec3d9
PH
2371 receive_ungetc = smtp_ungetc;
2372 receive_feof = smtp_feof;
2373 receive_ferror = smtp_ferror;
58eb016e 2374 receive_smtp_buffered = smtp_buffered;
059ec3d9 2375
817d9f57
JH
2376 SSL_free(server_ssl);
2377 server_ssl = NULL;
2378 tls_in.active = -1;
2379 tls_in.bits = 0;
2380 tls_in.cipher = NULL;
2381 tls_in.peerdn = NULL;
2382 tls_in.sni = NULL;
059ec3d9
PH
2383
2384 return smtp_getc();
2385 }
2386
2387 /* Handle genuine errors */
2388
ba084640
PP
2389 else if (error == SSL_ERROR_SSL)
2390 {
2391 ERR_error_string(ERR_get_error(), ssl_errstring);
89dd51cd 2392 log_write(0, LOG_MAIN, "TLS error (SSL_read): %s", ssl_errstring);
ba084640
PP
2393 ssl_xfer_error = 1;
2394 return EOF;
2395 }
2396
059ec3d9
PH
2397 else if (error != SSL_ERROR_NONE)
2398 {
2399 DEBUG(D_tls) debug_printf("Got SSL error %d\n", error);
2400 ssl_xfer_error = 1;
2401 return EOF;
2402 }
c80c5570 2403
80a47a2c
TK
2404#ifndef DISABLE_DKIM
2405 dkim_exim_verify_feed(ssl_xfer_buffer, inbytes);
2406#endif
059ec3d9
PH
2407 ssl_xfer_buffer_hwm = inbytes;
2408 ssl_xfer_buffer_lwm = 0;
2409 }
2410
2411/* Something in the buffer; return next uschar */
2412
2413return ssl_xfer_buffer[ssl_xfer_buffer_lwm++];
2414}
2415
584e96c6
JH
2416void
2417tls_get_cache()
2418{
9960d1e5 2419#ifndef DISABLE_DKIM
584e96c6
JH
2420int n = ssl_xfer_buffer_hwm - ssl_xfer_buffer_lwm;
2421if (n > 0)
2422 dkim_exim_verify_feed(ssl_xfer_buffer+ssl_xfer_buffer_lwm, n);
584e96c6 2423#endif
9960d1e5 2424}
584e96c6 2425
059ec3d9
PH
2426
2427
2428/*************************************************
2429* Read bytes from TLS channel *
2430*************************************************/
2431
2432/*
2433Arguments:
2434 buff buffer of data
2435 len size of buffer
2436
2437Returns: the number of bytes read
2438 -1 after a failed read
817d9f57
JH
2439
2440Only used by the client-side TLS.
059ec3d9
PH
2441*/
2442
2443int
389ca47a 2444tls_read(BOOL is_server, uschar *buff, size_t len)
059ec3d9 2445{
389ca47a 2446SSL *ssl = is_server ? server_ssl : client_ssl;
059ec3d9
PH
2447int inbytes;
2448int error;
2449
389ca47a 2450DEBUG(D_tls) debug_printf("Calling SSL_read(%p, %p, %u)\n", ssl,
c80c5570 2451 buff, (unsigned int)len);
059ec3d9 2452
389ca47a
JH
2453inbytes = SSL_read(ssl, CS buff, len);
2454error = SSL_get_error(ssl, inbytes);
059ec3d9
PH
2455
2456if (error == SSL_ERROR_ZERO_RETURN)
2457 {
2458 DEBUG(D_tls) debug_printf("Got SSL_ERROR_ZERO_RETURN\n");
2459 return -1;
2460 }
2461else if (error != SSL_ERROR_NONE)
2462 {
2463 return -1;
2464 }
2465
2466return inbytes;
2467}
2468
2469
2470
2471
2472
2473/*************************************************
2474* Write bytes down TLS channel *
2475*************************************************/
2476
2477/*
2478Arguments:
817d9f57 2479 is_server channel specifier
059ec3d9
PH
2480 buff buffer of data
2481 len number of bytes
2482
2483Returns: the number of bytes after a successful write,
2484 -1 after a failed write
817d9f57
JH
2485
2486Used by both server-side and client-side TLS.
059ec3d9
PH
2487*/
2488
2489int
817d9f57 2490tls_write(BOOL is_server, const uschar *buff, size_t len)
059ec3d9
PH
2491{
2492int outbytes;
2493int error;
2494int left = len;
817d9f57 2495SSL *ssl = is_server ? server_ssl : client_ssl;
059ec3d9 2496
c80c5570 2497DEBUG(D_tls) debug_printf("tls_do_write(%p, %d)\n", buff, left);
059ec3d9
PH
2498while (left > 0)
2499 {
c80c5570 2500 DEBUG(D_tls) debug_printf("SSL_write(SSL, %p, %d)\n", buff, left);
059ec3d9
PH
2501 outbytes = SSL_write(ssl, CS buff, left);
2502 error = SSL_get_error(ssl, outbytes);
2503 DEBUG(D_tls) debug_printf("outbytes=%d error=%d\n", outbytes, error);
2504 switch (error)
2505 {
2506 case SSL_ERROR_SSL:
96f5fe4c
JH
2507 ERR_error_string(ERR_get_error(), ssl_errstring);
2508 log_write(0, LOG_MAIN, "TLS error (SSL_write): %s", ssl_errstring);
2509 return -1;
059ec3d9
PH
2510
2511 case SSL_ERROR_NONE:
96f5fe4c
JH
2512 left -= outbytes;
2513 buff += outbytes;
2514 break;
059ec3d9
PH
2515
2516 case SSL_ERROR_ZERO_RETURN:
96f5fe4c
JH
2517 log_write(0, LOG_MAIN, "SSL channel closed on write");
2518 return -1;
059ec3d9 2519
817d9f57 2520 case SSL_ERROR_SYSCALL:
96f5fe4c
JH
2521 log_write(0, LOG_MAIN, "SSL_write: (from %s) syscall: %s",
2522 sender_fullhost ? sender_fullhost : US"<unknown>",
2523 strerror(errno));
2524 return -1;
817d9f57 2525
059ec3d9 2526 default:
96f5fe4c
JH
2527 log_write(0, LOG_MAIN, "SSL_write error %d", error);
2528 return -1;
059ec3d9
PH
2529 }
2530 }
2531return len;
2532}
2533
2534
2535
2536/*************************************************
2537* Close down a TLS session *
2538*************************************************/
2539
2540/* This is also called from within a delivery subprocess forked from the
2541daemon, to shut down the TLS library, without actually doing a shutdown (which
2542would tamper with the SSL session in the parent process).
2543
2544Arguments: TRUE if SSL_shutdown is to be called
2545Returns: nothing
817d9f57
JH
2546
2547Used by both server-side and client-side TLS.
059ec3d9
PH
2548*/
2549
2550void
817d9f57 2551tls_close(BOOL is_server, BOOL shutdown)
059ec3d9 2552{
817d9f57 2553SSL **sslp = is_server ? &server_ssl : &client_ssl;
389ca47a 2554int *fdp = is_server ? &tls_in.active : &tls_out.active;
817d9f57
JH
2555
2556if (*fdp < 0) return; /* TLS was not active */
059ec3d9
PH
2557
2558if (shutdown)
2559 {
ec8b777a 2560 DEBUG(D_tls) debug_printf("tls_close(): shutting down SSL\n");
817d9f57 2561 SSL_shutdown(*sslp);
059ec3d9
PH
2562 }
2563
817d9f57
JH
2564SSL_free(*sslp);
2565*sslp = NULL;
059ec3d9 2566
817d9f57 2567*fdp = -1;
059ec3d9
PH
2568}
2569
36f12725
NM
2570
2571
2572
2573/*************************************************
3375e053
PP
2574* Let tls_require_ciphers be checked at startup *
2575*************************************************/
2576
2577/* The tls_require_ciphers option, if set, must be something which the
2578library can parse.
2579
2580Returns: NULL on success, or error message
2581*/
2582
2583uschar *
2584tls_validate_require_cipher(void)
2585{
2586SSL_CTX *ctx;
2587uschar *s, *expciphers, *err;
2588
2589/* this duplicates from tls_init(), we need a better "init just global
2590state, for no specific purpose" singleton function of our own */
2591
2592SSL_load_error_strings();
2593OpenSSL_add_ssl_algorithms();
2594#if (OPENSSL_VERSION_NUMBER >= 0x0090800fL) && !defined(OPENSSL_NO_SHA256)
2595/* SHA256 is becoming ever more popular. This makes sure it gets added to the
2596list of available digests. */
2597EVP_add_digest(EVP_sha256());
2598#endif
2599
2600if (!(tls_require_ciphers && *tls_require_ciphers))
2601 return NULL;
2602
2603if (!expand_check(tls_require_ciphers, US"tls_require_ciphers", &expciphers))
2604 return US"failed to expand tls_require_ciphers";
2605
2606if (!(expciphers && *expciphers))
2607 return NULL;
2608
2609/* normalisation ripped from above */
2610s = expciphers;
2611while (*s != 0) { if (*s == '_') *s = '-'; s++; }
2612
2613err = NULL;
2614
2615ctx = SSL_CTX_new(SSLv23_server_method());
2616if (!ctx)
2617 {
2618 ERR_error_string(ERR_get_error(), ssl_errstring);
2619 return string_sprintf("SSL_CTX_new() failed: %s", ssl_errstring);
2620 }
2621
2622DEBUG(D_tls)
2623 debug_printf("tls_require_ciphers expands to \"%s\"\n", expciphers);
2624
2625if (!SSL_CTX_set_cipher_list(ctx, CS expciphers))
2626 {
2627 ERR_error_string(ERR_get_error(), ssl_errstring);
2628 err = string_sprintf("SSL_CTX_set_cipher_list(%s) failed", expciphers);
2629 }
2630
2631SSL_CTX_free(ctx);
2632
2633return err;
2634}
2635
2636
2637
2638
2639/*************************************************
36f12725
NM
2640* Report the library versions. *
2641*************************************************/
2642
2643/* There have historically been some issues with binary compatibility in
2644OpenSSL libraries; if Exim (like many other applications) is built against
2645one version of OpenSSL but the run-time linker picks up another version,
2646it can result in serious failures, including crashing with a SIGSEGV. So
2647report the version found by the compiler and the run-time version.
2648
f64a1e23
PP
2649Note: some OS vendors backport security fixes without changing the version
2650number/string, and the version date remains unchanged. The _build_ date
2651will change, so we can more usefully assist with version diagnosis by also
2652reporting the build date.
2653
36f12725
NM
2654Arguments: a FILE* to print the results to
2655Returns: nothing
2656*/
2657
2658void
2659tls_version_report(FILE *f)
2660{
754a0503 2661fprintf(f, "Library version: OpenSSL: Compile: %s\n"
f64a1e23
PP
2662 " Runtime: %s\n"
2663 " : %s\n",
754a0503 2664 OPENSSL_VERSION_TEXT,
f64a1e23
PP
2665 SSLeay_version(SSLEAY_VERSION),
2666 SSLeay_version(SSLEAY_BUILT_ON));
2667/* third line is 38 characters for the %s and the line is 73 chars long;
2668the OpenSSL output includes a "built on: " prefix already. */
36f12725
NM
2669}
2670
9e3331ea
TK
2671
2672
2673
2674/*************************************************
17c76198 2675* Random number generation *
9e3331ea
TK
2676*************************************************/
2677
2678/* Pseudo-random number generation. The result is not expected to be
2679cryptographically strong but not so weak that someone will shoot themselves
2680in the foot using it as a nonce in input in some email header scheme or
2681whatever weirdness they'll twist this into. The result should handle fork()
2682and avoid repeating sequences. OpenSSL handles that for us.
2683
2684Arguments:
2685 max range maximum
2686Returns a random number in range [0, max-1]
2687*/
2688
2689int
17c76198 2690vaguely_random_number(int max)
9e3331ea
TK
2691{
2692unsigned int r;
2693int i, needed_len;
de6135a0
PP
2694static pid_t pidlast = 0;
2695pid_t pidnow;
9e3331ea
TK
2696uschar *p;
2697uschar smallbuf[sizeof(r)];
2698
2699if (max <= 1)
2700 return 0;
2701
de6135a0
PP
2702pidnow = getpid();
2703if (pidnow != pidlast)
2704 {
2705 /* Although OpenSSL documents that "OpenSSL makes sure that the PRNG state
2706 is unique for each thread", this doesn't apparently apply across processes,
2707 so our own warning from vaguely_random_number_fallback() applies here too.
2708 Fix per PostgreSQL. */
2709 if (pidlast != 0)
2710 RAND_cleanup();
2711 pidlast = pidnow;
2712 }
2713
9e3331ea
TK
2714/* OpenSSL auto-seeds from /dev/random, etc, but this a double-check. */
2715if (!RAND_status())
2716 {
2717 randstuff r;
2718 gettimeofday(&r.tv, NULL);
2719 r.p = getpid();
2720
2721 RAND_seed((uschar *)(&r), sizeof(r));
2722 }
2723/* We're after pseudo-random, not random; if we still don't have enough data
2724in the internal PRNG then our options are limited. We could sleep and hope
2725for entropy to come along (prayer technique) but if the system is so depleted
2726in the first place then something is likely to just keep taking it. Instead,
2727we'll just take whatever little bit of pseudo-random we can still manage to
2728get. */
2729
2730needed_len = sizeof(r);
2731/* Don't take 8 times more entropy than needed if int is 8 octets and we were
2732asked for a number less than 10. */
2733for (r = max, i = 0; r; ++i)
2734 r >>= 1;
2735i = (i + 7) / 8;
2736if (i < needed_len)
2737 needed_len = i;
2738
c8dfb21d 2739#ifdef EXIM_HAVE_RAND_PSEUDO
9e3331ea 2740/* We do not care if crypto-strong */
17c76198 2741i = RAND_pseudo_bytes(smallbuf, needed_len);
c8dfb21d
JH
2742#else
2743i = RAND_bytes(smallbuf, needed_len);
2744#endif
2745
17c76198
PP
2746if (i < 0)
2747 {
2748 DEBUG(D_all)
2749 debug_printf("OpenSSL RAND_pseudo_bytes() not supported by RAND method, using fallback.\n");
2750 return vaguely_random_number_fallback(max);
2751 }
2752
9e3331ea
TK
2753r = 0;
2754for (p = smallbuf; needed_len; --needed_len, ++p)
2755 {
2756 r *= 256;
2757 r += *p;
2758 }
2759
2760/* We don't particularly care about weighted results; if someone wants
2761smooth distribution and cares enough then they should submit a patch then. */
2762return r % max;
2763}
2764
77bb000f
PP
2765
2766
2767
2768/*************************************************
2769* OpenSSL option parse *
2770*************************************************/
2771
2772/* Parse one option for tls_openssl_options_parse below
2773
2774Arguments:
2775 name one option name
2776 value place to store a value for it
2777Returns success or failure in parsing
2778*/
2779
2780struct exim_openssl_option {
2781 uschar *name;
2782 long value;
2783};
2784/* We could use a macro to expand, but we need the ifdef and not all the
2785options document which version they were introduced in. Policylet: include
2786all options unless explicitly for DTLS, let the administrator choose which
2787to apply.
2788
2789This list is current as of:
e2fbf4a2
PP
2790 ==> 1.0.1b <==
2791Plus SSL_OP_SAFARI_ECDHE_ECDSA_BUG from 2013-June patch/discussion on openssl-dev
2792*/
77bb000f
PP
2793static struct exim_openssl_option exim_openssl_options[] = {
2794/* KEEP SORTED ALPHABETICALLY! */
2795#ifdef SSL_OP_ALL
73a46702 2796 { US"all", SSL_OP_ALL },
77bb000f
PP
2797#endif
2798#ifdef SSL_OP_ALLOW_UNSAFE_LEGACY_RENEGOTIATION
73a46702 2799 { US"allow_unsafe_legacy_renegotiation", SSL_OP_ALLOW_UNSAFE_LEGACY_RENEGOTIATION },
77bb000f
PP
2800#endif
2801#ifdef SSL_OP_CIPHER_SERVER_PREFERENCE
73a46702 2802 { US"cipher_server_preference", SSL_OP_CIPHER_SERVER_PREFERENCE },
77bb000f
PP
2803#endif
2804#ifdef SSL_OP_DONT_INSERT_EMPTY_FRAGMENTS
73a46702 2805 { US"dont_insert_empty_fragments", SSL_OP_DONT_INSERT_EMPTY_FRAGMENTS },
77bb000f
PP
2806#endif
2807#ifdef SSL_OP_EPHEMERAL_RSA
73a46702 2808 { US"ephemeral_rsa", SSL_OP_EPHEMERAL_RSA },
77bb000f
PP
2809#endif
2810#ifdef SSL_OP_LEGACY_SERVER_CONNECT
73a46702 2811 { US"legacy_server_connect", SSL_OP_LEGACY_SERVER_CONNECT },
77bb000f
PP
2812#endif
2813#ifdef SSL_OP_MICROSOFT_BIG_SSLV3_BUFFER
73a46702 2814 { US"microsoft_big_sslv3_buffer", SSL_OP_MICROSOFT_BIG_SSLV3_BUFFER },
77bb000f
PP
2815#endif
2816#ifdef SSL_OP_MICROSOFT_SESS_ID_BUG
73a46702 2817 { US"microsoft_sess_id_bug", SSL_OP_MICROSOFT_SESS_ID_BUG },
77bb000f
PP
2818#endif
2819#ifdef SSL_OP_MSIE_SSLV2_RSA_PADDING
73a46702 2820 { US"msie_sslv2_rsa_padding", SSL_OP_MSIE_SSLV2_RSA_PADDING },
77bb000f
PP
2821#endif
2822#ifdef SSL_OP_NETSCAPE_CHALLENGE_BUG
73a46702 2823 { US"netscape_challenge_bug", SSL_OP_NETSCAPE_CHALLENGE_BUG },
77bb000f
PP
2824#endif
2825#ifdef SSL_OP_NETSCAPE_REUSE_CIPHER_CHANGE_BUG
73a46702 2826 { US"netscape_reuse_cipher_change_bug", SSL_OP_NETSCAPE_REUSE_CIPHER_CHANGE_BUG },
77bb000f 2827#endif
c80c5570
PP
2828#ifdef SSL_OP_NO_COMPRESSION
2829 { US"no_compression", SSL_OP_NO_COMPRESSION },
2830#endif
77bb000f 2831#ifdef SSL_OP_NO_SESSION_RESUMPTION_ON_RENEGOTIATION
73a46702 2832 { US"no_session_resumption_on_renegotiation", SSL_OP_NO_SESSION_RESUMPTION_ON_RENEGOTIATION },
77bb000f 2833#endif
c0c7b2da
PP
2834#ifdef SSL_OP_NO_SSLv2
2835 { US"no_sslv2", SSL_OP_NO_SSLv2 },
2836#endif
2837#ifdef SSL_OP_NO_SSLv3
2838 { US"no_sslv3", SSL_OP_NO_SSLv3 },
2839#endif
2840#ifdef SSL_OP_NO_TICKET
2841 { US"no_ticket", SSL_OP_NO_TICKET },
2842#endif
2843#ifdef SSL_OP_NO_TLSv1
2844 { US"no_tlsv1", SSL_OP_NO_TLSv1 },
2845#endif
c80c5570
PP
2846#ifdef SSL_OP_NO_TLSv1_1
2847#if SSL_OP_NO_TLSv1_1 == 0x00000400L
2848 /* Error in chosen value in 1.0.1a; see first item in CHANGES for 1.0.1b */
2849#warning OpenSSL 1.0.1a uses a bad value for SSL_OP_NO_TLSv1_1, ignoring
2850#else
2851 { US"no_tlsv1_1", SSL_OP_NO_TLSv1_1 },
2852#endif
2853#endif
2854#ifdef SSL_OP_NO_TLSv1_2
2855 { US"no_tlsv1_2", SSL_OP_NO_TLSv1_2 },
2856#endif
e2fbf4a2
PP
2857#ifdef SSL_OP_SAFARI_ECDHE_ECDSA_BUG
2858 { US"safari_ecdhe_ecdsa_bug", SSL_OP_SAFARI_ECDHE_ECDSA_BUG },
2859#endif
77bb000f 2860#ifdef SSL_OP_SINGLE_DH_USE
73a46702 2861 { US"single_dh_use", SSL_OP_SINGLE_DH_USE },
77bb000f
PP
2862#endif
2863#ifdef SSL_OP_SINGLE_ECDH_USE
73a46702 2864 { US"single_ecdh_use", SSL_OP_SINGLE_ECDH_USE },
77bb000f
PP
2865#endif
2866#ifdef SSL_OP_SSLEAY_080_CLIENT_DH_BUG
73a46702 2867 { US"ssleay_080_client_dh_bug", SSL_OP_SSLEAY_080_CLIENT_DH_BUG },
77bb000f
PP
2868#endif
2869#ifdef SSL_OP_SSLREF2_REUSE_CERT_TYPE_BUG
73a46702 2870 { US"sslref2_reuse_cert_type_bug", SSL_OP_SSLREF2_REUSE_CERT_TYPE_BUG },
77bb000f
PP
2871#endif
2872#ifdef SSL_OP_TLS_BLOCK_PADDING_BUG
73a46702 2873 { US"tls_block_padding_bug", SSL_OP_TLS_BLOCK_PADDING_BUG },
77bb000f
PP
2874#endif
2875#ifdef SSL_OP_TLS_D5_BUG
73a46702 2876 { US"tls_d5_bug", SSL_OP_TLS_D5_BUG },
77bb000f
PP
2877#endif
2878#ifdef SSL_OP_TLS_ROLLBACK_BUG
73a46702 2879 { US"tls_rollback_bug", SSL_OP_TLS_ROLLBACK_BUG },
77bb000f
PP
2880#endif
2881};
2882static int exim_openssl_options_size =
2883 sizeof(exim_openssl_options)/sizeof(struct exim_openssl_option);
2884
c80c5570 2885
77bb000f
PP
2886static BOOL
2887tls_openssl_one_option_parse(uschar *name, long *value)
2888{
2889int first = 0;
2890int last = exim_openssl_options_size;
2891while (last > first)
2892 {
2893 int middle = (first + last)/2;
2894 int c = Ustrcmp(name, exim_openssl_options[middle].name);
2895 if (c == 0)
2896 {
2897 *value = exim_openssl_options[middle].value;
2898 return TRUE;
2899 }
2900 else if (c > 0)
2901 first = middle + 1;
2902 else
2903 last = middle;
2904 }
2905return FALSE;
2906}
2907
2908
2909
2910
2911/*************************************************
2912* OpenSSL option parsing logic *
2913*************************************************/
2914
2915/* OpenSSL has a number of compatibility options which an administrator might
2916reasonably wish to set. Interpret a list similarly to decode_bits(), so that
2917we look like log_selector.
2918
2919Arguments:
2920 option_spec the administrator-supplied string of options
2921 results ptr to long storage for the options bitmap
2922Returns success or failure
2923*/
2924
2925BOOL
2926tls_openssl_options_parse(uschar *option_spec, long *results)
2927{
2928long result, item;
2929uschar *s, *end;
2930uschar keep_c;
2931BOOL adding, item_parsed;
2932
0e944a0d 2933result = 0L;
b1770b6e 2934/* Prior to 4.80 we or'd in SSL_OP_DONT_INSERT_EMPTY_FRAGMENTS; removed
da3ad30d 2935 * from default because it increases BEAST susceptibility. */
f0f5a555
PP
2936#ifdef SSL_OP_NO_SSLv2
2937result |= SSL_OP_NO_SSLv2;
2938#endif
a57b6200
JH
2939#ifdef SSL_OP_SINGLE_DH_USE
2940result |= SSL_OP_SINGLE_DH_USE;
2941#endif
77bb000f
PP
2942
2943if (option_spec == NULL)
2944 {
2945 *results = result;
2946 return TRUE;
2947 }
2948
2949for (s=option_spec; *s != '\0'; /**/)
2950 {
2951 while (isspace(*s)) ++s;
2952 if (*s == '\0')
2953 break;
2954 if (*s != '+' && *s != '-')
2955 {
2956 DEBUG(D_tls) debug_printf("malformed openssl option setting: "
0e944a0d 2957 "+ or - expected but found \"%s\"\n", s);
77bb000f
PP
2958 return FALSE;
2959 }
2960 adding = *s++ == '+';
2961 for (end = s; (*end != '\0') && !isspace(*end); ++end) /**/ ;
2962 keep_c = *end;
2963 *end = '\0';
2964 item_parsed = tls_openssl_one_option_parse(s, &item);
96f5fe4c 2965 *end = keep_c;
77bb000f
PP
2966 if (!item_parsed)
2967 {
0e944a0d 2968 DEBUG(D_tls) debug_printf("openssl option setting unrecognised: \"%s\"\n", s);
77bb000f
PP
2969 return FALSE;
2970 }
2971 DEBUG(D_tls) debug_printf("openssl option, %s from %lx: %lx (%s)\n",
2972 adding ? "adding" : "removing", result, item, s);
2973 if (adding)
2974 result |= item;
2975 else
2976 result &= ~item;
77bb000f
PP
2977 s = end;
2978 }
2979
2980*results = result;
2981return TRUE;
2982}
2983
9d1c15ef
JH
2984/* vi: aw ai sw=2
2985*/
059ec3d9 2986/* End of tls-openssl.c */