New ${env {NAME}} expansion. Bug 1604
[exim.git] / src / src / tls-openssl.c
CommitLineData
059ec3d9
PH
1/*************************************************
2* Exim - an Internet mail transport agent *
3*************************************************/
4
5a66c31b 5/* Copyright (c) University of Cambridge 1995 - 2014 */
059ec3d9
PH
6/* See the file NOTICE for conditions of use and distribution. */
7
f5d78688
JH
8/* Portions Copyright (c) The OpenSSL Project 1999 */
9
059ec3d9
PH
10/* This module provides the TLS (aka SSL) support for Exim using the OpenSSL
11library. It is #included into the tls.c file when that library is used. The
12code herein is based on a patch that was originally contributed by Steve
13Haslam. It was adapted from stunnel, a GPL program by Michal Trojnara.
14
15No cryptographic code is included in Exim. All this module does is to call
16functions from the OpenSSL library. */
17
18
19/* Heading stuff */
20
21#include <openssl/lhash.h>
22#include <openssl/ssl.h>
23#include <openssl/err.h>
24#include <openssl/rand.h>
f2de3a33 25#ifndef DISABLE_OCSP
e51c7be2 26# include <openssl/ocsp.h>
3f7eeb86 27#endif
85098ee7
JH
28#ifdef EXPERIMENTAL_DANE
29# include <danessl.h>
30#endif
31
3f7eeb86 32
f2de3a33
JH
33#ifndef DISABLE_OCSP
34# define EXIM_OCSP_SKEW_SECONDS (300L)
35# define EXIM_OCSP_MAX_AGE (-1L)
3f7eeb86 36#endif
059ec3d9 37
3bcbbbe2 38#if OPENSSL_VERSION_NUMBER >= 0x0090806fL && !defined(OPENSSL_NO_TLSEXT)
e51c7be2 39# define EXIM_HAVE_OPENSSL_TLSEXT
3bcbbbe2 40#endif
2dfb468b
JH
41#if OPENSSL_VERSION_NUMBER >= 0x010100000L
42# define EXIM_HAVE_OPENSSL_CHECKHOST
43#endif
44#if OPENSSL_VERSION_NUMBER >= 0x010000000L \
45 && (OPENSSL_VERSION_NUMBER & 0x0000ff000L) >= 0x000002000L
46# define EXIM_HAVE_OPENSSL_CHECKHOST
47#endif
3bcbbbe2 48
67791ce4
JH
49#if !defined(EXIM_HAVE_OPENSSL_TLSEXT) && !defined(DISABLE_OCSP)
50# warning "OpenSSL library version too old; define DISABLE_OCSP in Makefile"
51# define DISABLE_OCSP
52#endif
53
059ec3d9
PH
54/* Structure for collecting random data for seeding. */
55
56typedef struct randstuff {
9e3331ea
TK
57 struct timeval tv;
58 pid_t p;
059ec3d9
PH
59} randstuff;
60
61/* Local static variables */
62
a2ff477a
JH
63static BOOL client_verify_callback_called = FALSE;
64static BOOL server_verify_callback_called = FALSE;
059ec3d9
PH
65static const uschar *sid_ctx = US"exim";
66
d4f09789
PP
67/* We have three different contexts to care about.
68
69Simple case: client, `client_ctx`
70 As a client, we can be doing a callout or cut-through delivery while receiving
71 a message. So we have a client context, which should have options initialised
72 from the SMTP Transport.
73
74Server:
75 There are two cases: with and without ServerNameIndication from the client.
76 Given TLS SNI, we can be using different keys, certs and various other
77 configuration settings, because they're re-expanded with $tls_sni set. This
78 allows vhosting with TLS. This SNI is sent in the handshake.
79 A client might not send SNI, so we need a fallback, and an initial setup too.
80 So as a server, we start out using `server_ctx`.
81 If SNI is sent by the client, then we as server, mid-negotiation, try to clone
82 `server_sni` from `server_ctx` and then initialise settings by re-expanding
83 configuration.
84*/
85
817d9f57
JH
86static SSL_CTX *client_ctx = NULL;
87static SSL_CTX *server_ctx = NULL;
88static SSL *client_ssl = NULL;
89static SSL *server_ssl = NULL;
389ca47a 90
35731706 91#ifdef EXIM_HAVE_OPENSSL_TLSEXT
817d9f57 92static SSL_CTX *server_sni = NULL;
35731706 93#endif
059ec3d9
PH
94
95static char ssl_errstring[256];
96
97static int ssl_session_timeout = 200;
a2ff477a
JH
98static BOOL client_verify_optional = FALSE;
99static BOOL server_verify_optional = FALSE;
059ec3d9 100
f5d78688 101static BOOL reexpand_tls_files_for_sni = FALSE;
059ec3d9
PH
102
103
7be682ca
PP
104typedef struct tls_ext_ctx_cb {
105 uschar *certificate;
106 uschar *privatekey;
f2de3a33 107#ifndef DISABLE_OCSP
f5d78688
JH
108 BOOL is_server;
109 union {
110 struct {
111 uschar *file;
112 uschar *file_expanded;
113 OCSP_RESPONSE *response;
114 } server;
115 struct {
44662487
JH
116 X509_STORE *verify_store; /* non-null if status requested */
117 BOOL verify_required;
f5d78688
JH
118 } client;
119 } u_ocsp;
3f7eeb86 120#endif
7be682ca
PP
121 uschar *dhparam;
122 /* these are cached from first expand */
123 uschar *server_cipher_list;
124 /* only passed down to tls_error: */
125 host_item *host;
55414b25 126 const uschar * verify_cert_hostnames;
774ef2d7 127#ifdef EXPERIMENTAL_EVENT
a7538db1
JH
128 uschar * event_action;
129#endif
7be682ca
PP
130} tls_ext_ctx_cb;
131
132/* should figure out a cleanup of API to handle state preserved per
133implementation, for various reasons, which can be void * in the APIs.
134For now, we hack around it. */
817d9f57
JH
135tls_ext_ctx_cb *client_static_cbinfo = NULL;
136tls_ext_ctx_cb *server_static_cbinfo = NULL;
7be682ca
PP
137
138static int
983207c1
JH
139setup_certs(SSL_CTX *sctx, uschar *certs, uschar *crl, host_item *host, BOOL optional,
140 int (*cert_vfy_cb)(int, X509_STORE_CTX *) );
059ec3d9 141
3f7eeb86 142/* Callbacks */
3bcbbbe2 143#ifdef EXIM_HAVE_OPENSSL_TLSEXT
3f7eeb86 144static int tls_servername_cb(SSL *s, int *ad ARG_UNUSED, void *arg);
3bcbbbe2 145#endif
f2de3a33 146#ifndef DISABLE_OCSP
f5d78688 147static int tls_server_stapling_cb(SSL *s, void *arg);
3f7eeb86
PP
148#endif
149
059ec3d9
PH
150
151/*************************************************
152* Handle TLS error *
153*************************************************/
154
155/* Called from lots of places when errors occur before actually starting to do
156the TLS handshake, that is, while the session is still in clear. Always returns
157DEFER for a server and FAIL for a client so that most calls can use "return
158tls_error(...)" to do this processing and then give an appropriate return. A
159single function is used for both server and client, because it is called from
160some shared functions.
161
162Argument:
163 prefix text to include in the logged error
164 host NULL if setting up a server;
165 the connected host if setting up a client
7199e1ee 166 msg error message or NULL if we should ask OpenSSL
059ec3d9
PH
167
168Returns: OK/DEFER/FAIL
169*/
170
171static int
b8b1b5cb 172tls_error(uschar * prefix, const host_item * host, uschar * msg)
059ec3d9 173{
c562fd30 174if (!msg)
7199e1ee
TF
175 {
176 ERR_error_string(ERR_get_error(), ssl_errstring);
5ca6d115 177 msg = (uschar *)ssl_errstring;
7199e1ee
TF
178 }
179
c562fd30
JH
180if (host)
181 {
182 log_write(0, LOG_MAIN, "H=%s [%s] TLS error on connection (%s): %s",
183 host->name, host->address, prefix, msg);
184 return FAIL;
185 }
186else
059ec3d9 187 {
7199e1ee 188 uschar *conn_info = smtp_get_connection_info();
5ca6d115 189 if (Ustrncmp(conn_info, US"SMTP ", 5) == 0)
7199e1ee 190 conn_info += 5;
c562fd30 191 /* I'd like to get separated H= here, but too hard for now */
7199e1ee
TF
192 log_write(0, LOG_MAIN, "TLS error on %s (%s): %s",
193 conn_info, prefix, msg);
059ec3d9
PH
194 return DEFER;
195 }
059ec3d9
PH
196}
197
198
199
200/*************************************************
201* Callback to generate RSA key *
202*************************************************/
203
204/*
205Arguments:
206 s SSL connection
207 export not used
208 keylength keylength
209
210Returns: pointer to generated key
211*/
212
213static RSA *
214rsa_callback(SSL *s, int export, int keylength)
215{
216RSA *rsa_key;
217export = export; /* Shut picky compilers up */
218DEBUG(D_tls) debug_printf("Generating %d bit RSA key...\n", keylength);
219rsa_key = RSA_generate_key(keylength, RSA_F4, NULL, NULL);
220if (rsa_key == NULL)
221 {
222 ERR_error_string(ERR_get_error(), ssl_errstring);
223 log_write(0, LOG_MAIN|LOG_PANIC, "TLS error (RSA_generate_key): %s",
224 ssl_errstring);
225 return NULL;
226 }
227return rsa_key;
228}
229
230
231
f5d78688 232/* Extreme debug
f2de3a33 233#ifndef DISABLE_OCSP
f5d78688
JH
234void
235x509_store_dump_cert_s_names(X509_STORE * store)
236{
237STACK_OF(X509_OBJECT) * roots= store->objs;
238int i;
239static uschar name[256];
240
241for(i= 0; i<sk_X509_OBJECT_num(roots); i++)
242 {
243 X509_OBJECT * tmp_obj= sk_X509_OBJECT_value(roots, i);
244 if(tmp_obj->type == X509_LU_X509)
245 {
246 X509 * current_cert= tmp_obj->data.x509;
247 X509_NAME_oneline(X509_get_subject_name(current_cert), CS name, sizeof(name));
f69979cf 248 name[sizeof(name)-1] = '\0';
f5d78688
JH
249 debug_printf(" %s\n", name);
250 }
251 }
252}
253#endif
254*/
255
059ec3d9 256
f69979cf
JH
257#ifdef EXPERIMENTAL_EVENT
258static int
259verify_event(tls_support * tlsp, X509 * cert, int depth, const uschar * dn,
260 BOOL *calledp, const BOOL *optionalp, const uschar * what)
261{
262uschar * ev;
263uschar * yield;
264X509 * old_cert;
265
266ev = tlsp == &tls_out ? client_static_cbinfo->event_action : event_action;
267if (ev)
268 {
269 old_cert = tlsp->peercert;
270 tlsp->peercert = X509_dup(cert);
271 /* NB we do not bother setting peerdn */
272 if ((yield = event_raise(ev, US"tls:cert", string_sprintf("%d", depth))))
273 {
274 log_write(0, LOG_MAIN, "[%s] %s verify denied by event-action: "
275 "depth=%d cert=%s: %s",
276 tlsp == &tls_out ? deliver_host_address : sender_host_address,
277 what, depth, dn, yield);
278 *calledp = TRUE;
279 if (!*optionalp)
280 {
281 if (old_cert) tlsp->peercert = old_cert; /* restore 1st failing cert */
282 return 1; /* reject (leaving peercert set) */
283 }
284 DEBUG(D_tls) debug_printf("Event-action verify failure overridden "
285 "(host in tls_try_verify_hosts)\n");
286 }
287 X509_free(tlsp->peercert);
288 tlsp->peercert = old_cert;
289 }
290return 0;
291}
292#endif
293
059ec3d9
PH
294/*************************************************
295* Callback for verification *
296*************************************************/
297
298/* The SSL library does certificate verification if set up to do so. This
299callback has the current yes/no state is in "state". If verification succeeded,
f69979cf
JH
300we set the certificate-verified flag. If verification failed, what happens
301depends on whether the client is required to present a verifiable certificate
302or not.
059ec3d9
PH
303
304If verification is optional, we change the state to yes, but still log the
305verification error. For some reason (it really would help to have proper
306documentation of OpenSSL), this callback function then gets called again, this
f69979cf
JH
307time with state = 1. We must take care not to set the private verified flag on
308the second time through.
059ec3d9
PH
309
310Note: this function is not called if the client fails to present a certificate
311when asked. We get here only if a certificate has been received. Handling of
312optional verification for this case is done when requesting SSL to verify, by
313setting SSL_VERIFY_FAIL_IF_NO_PEER_CERT in the non-optional case.
314
a7538db1
JH
315May be called multiple times for different issues with a certificate, even
316for a given "depth" in the certificate chain.
317
059ec3d9
PH
318Arguments:
319 state current yes/no state as 1/0
320 x509ctx certificate information.
a2ff477a 321 client TRUE for client startup, FALSE for server startup
059ec3d9
PH
322
323Returns: 1 if verified, 0 if not
324*/
325
326static int
421aff85
JH
327verify_callback(int state, X509_STORE_CTX *x509ctx,
328 tls_support *tlsp, BOOL *calledp, BOOL *optionalp)
059ec3d9 329{
421aff85 330X509 * cert = X509_STORE_CTX_get_current_cert(x509ctx);
a7538db1 331int depth = X509_STORE_CTX_get_error_depth(x509ctx);
f69979cf 332uschar dn[256];
059ec3d9 333
f69979cf
JH
334X509_NAME_oneline(X509_get_subject_name(cert), CS dn, sizeof(dn));
335dn[sizeof(dn)-1] = '\0';
059ec3d9
PH
336
337if (state == 0)
338 {
4c01d6ab
JH
339 log_write(0, LOG_MAIN, "[%s] SSL verify error: depth=%d error=%s cert=%s",
340 tlsp == &tls_out ? deliver_host_address : sender_host_address,
a7538db1 341 depth,
421aff85 342 X509_verify_cert_error_string(X509_STORE_CTX_get_error(x509ctx)),
f69979cf 343 dn);
a2ff477a 344 *calledp = TRUE;
9d1c15ef
JH
345 if (!*optionalp)
346 {
f69979cf
JH
347 if (!tlsp->peercert)
348 tlsp->peercert = X509_dup(cert); /* record failing cert */
349 return 0; /* reject */
9d1c15ef 350 }
059ec3d9
PH
351 DEBUG(D_tls) debug_printf("SSL verify failure overridden (host in "
352 "tls_try_verify_hosts)\n");
059ec3d9
PH
353 }
354
a7538db1 355else if (depth != 0)
059ec3d9 356 {
f69979cf 357 DEBUG(D_tls) debug_printf("SSL verify ok: depth=%d SN=%s\n", depth, dn);
f2de3a33 358#ifndef DISABLE_OCSP
f5d78688
JH
359 if (tlsp == &tls_out && client_static_cbinfo->u_ocsp.client.verify_store)
360 { /* client, wanting stapling */
361 /* Add the server cert's signing chain as the one
362 for the verification of the OCSP stapled information. */
363
364 if (!X509_STORE_add_cert(client_static_cbinfo->u_ocsp.client.verify_store,
421aff85 365 cert))
f5d78688
JH
366 ERR_clear_error();
367 }
368#endif
774ef2d7 369#ifdef EXPERIMENTAL_EVENT
f69979cf
JH
370 if (verify_event(tlsp, cert, depth, dn, calledp, optionalp, US"SSL"))
371 return 0; /* reject, with peercert set */
a7538db1 372#endif
059ec3d9
PH
373 }
374else
375 {
55414b25 376 const uschar * verify_cert_hostnames;
e51c7be2 377
e51c7be2
JH
378 if ( tlsp == &tls_out
379 && ((verify_cert_hostnames = client_static_cbinfo->verify_cert_hostnames)))
380 /* client, wanting hostname check */
e51c7be2 381 {
f69979cf 382
740f36d4 383#ifdef EXIM_HAVE_OPENSSL_CHECKHOST
f69979cf
JH
384# ifndef X509_CHECK_FLAG_NO_PARTIAL_WILDCARDS
385# define X509_CHECK_FLAG_NO_PARTIAL_WILDCARDS 0
386# endif
387# ifndef X509_CHECK_FLAG_SINGLE_LABEL_SUBDOMAINS
388# define X509_CHECK_FLAG_SINGLE_LABEL_SUBDOMAINS 0
389# endif
e51c7be2 390 int sep = 0;
55414b25 391 const uschar * list = verify_cert_hostnames;
e51c7be2 392 uschar * name;
d8e7834a
JH
393 int rc;
394 while ((name = string_nextinlist(&list, &sep, NULL, 0)))
395 if ((rc = X509_check_host(cert, name, 0,
8d692470 396 X509_CHECK_FLAG_NO_PARTIAL_WILDCARDS
740f36d4
JH
397 | X509_CHECK_FLAG_SINGLE_LABEL_SUBDOMAINS,
398 NULL)))
d8e7834a
JH
399 {
400 if (rc < 0)
401 {
93a6fce2 402 log_write(0, LOG_MAIN, "[%s] SSL verify error: internal error",
4c01d6ab 403 tlsp == &tls_out ? deliver_host_address : sender_host_address);
d8e7834a
JH
404 name = NULL;
405 }
e51c7be2 406 break;
d8e7834a 407 }
e51c7be2 408 if (!name)
f69979cf 409#else
e51c7be2 410 if (!tls_is_name_for_cert(verify_cert_hostnames, cert))
f69979cf 411#endif
e51c7be2
JH
412 {
413 log_write(0, LOG_MAIN,
93a6fce2 414 "[%s] SSL verify error: certificate name mismatch: \"%s\"",
4c01d6ab 415 tlsp == &tls_out ? deliver_host_address : sender_host_address,
f69979cf 416 dn);
a3ef7310
JH
417 *calledp = TRUE;
418 if (!*optionalp)
f69979cf
JH
419 {
420 if (!tlsp->peercert)
421 tlsp->peercert = X509_dup(cert); /* record failing cert */
422 return 0; /* reject */
423 }
a3ef7310
JH
424 DEBUG(D_tls) debug_printf("SSL verify failure overridden (host in "
425 "tls_try_verify_hosts)\n");
e51c7be2 426 }
f69979cf 427 }
e51c7be2 428
774ef2d7 429#ifdef EXPERIMENTAL_EVENT
f69979cf
JH
430 if (verify_event(tlsp, cert, depth, dn, calledp, optionalp, US"SSL"))
431 return 0; /* reject, with peercert set */
e51c7be2
JH
432#endif
433
93dcb1c2 434 DEBUG(D_tls) debug_printf("SSL%s verify ok: depth=0 SN=%s\n",
f69979cf 435 *calledp ? "" : " authenticated", dn);
93dcb1c2
JH
436 if (!*calledp) tlsp->certificate_verified = TRUE;
437 *calledp = TRUE;
059ec3d9
PH
438 }
439
a7538db1 440return 1; /* accept, at least for this level */
059ec3d9
PH
441}
442
a2ff477a
JH
443static int
444verify_callback_client(int state, X509_STORE_CTX *x509ctx)
445{
f5d78688 446return verify_callback(state, x509ctx, &tls_out, &client_verify_callback_called, &client_verify_optional);
a2ff477a
JH
447}
448
449static int
450verify_callback_server(int state, X509_STORE_CTX *x509ctx)
451{
f5d78688 452return verify_callback(state, x509ctx, &tls_in, &server_verify_callback_called, &server_verify_optional);
a2ff477a
JH
453}
454
059ec3d9 455
e5cccda9 456#ifdef EXPERIMENTAL_DANE
53a7196b 457
e5cccda9
JH
458/* This gets called *by* the dane library verify callback, which interposes
459itself.
460*/
461static int
462verify_callback_client_dane(int state, X509_STORE_CTX * x509ctx)
463{
464X509 * cert = X509_STORE_CTX_get_current_cert(x509ctx);
f69979cf 465uschar dn[256];
774ef2d7 466#ifdef EXPERIMENTAL_EVENT
83b27293 467int depth = X509_STORE_CTX_get_error_depth(x509ctx);
f69979cf 468BOOL dummy_called, optional = FALSE;
83b27293 469#endif
e5cccda9 470
f69979cf
JH
471X509_NAME_oneline(X509_get_subject_name(cert), CS dn, sizeof(dn));
472dn[sizeof(dn)-1] = '\0';
e5cccda9 473
f69979cf 474DEBUG(D_tls) debug_printf("verify_callback_client_dane: %s\n", dn);
e5cccda9 475
774ef2d7 476#ifdef EXPERIMENTAL_EVENT
f69979cf
JH
477 if (verify_event(&tls_out, cert, depth, dn,
478 &dummy_called, &optional, US"DANE"))
479 return 0; /* reject, with peercert set */
83b27293
JH
480#endif
481
e5cccda9 482if (state == 1)
53a7196b 483 tls_out.dane_verified =
e5cccda9
JH
484 tls_out.certificate_verified = TRUE;
485return 1;
486}
53a7196b
JH
487
488#endif /*EXPERIMENTAL_DANE*/
e5cccda9 489
059ec3d9
PH
490
491/*************************************************
492* Information callback *
493*************************************************/
494
495/* The SSL library functions call this from time to time to indicate what they
7be682ca
PP
496are doing. We copy the string to the debugging output when TLS debugging has
497been requested.
059ec3d9
PH
498
499Arguments:
500 s the SSL connection
501 where
502 ret
503
504Returns: nothing
505*/
506
507static void
508info_callback(SSL *s, int where, int ret)
509{
510where = where;
511ret = ret;
512DEBUG(D_tls) debug_printf("SSL info: %s\n", SSL_state_string_long(s));
513}
514
515
516
517/*************************************************
518* Initialize for DH *
519*************************************************/
520
521/* If dhparam is set, expand it, and load up the parameters for DH encryption.
522
523Arguments:
a799883d 524 dhparam DH parameter file or fixed parameter identity string
7199e1ee 525 host connected host, if client; NULL if server
059ec3d9
PH
526
527Returns: TRUE if OK (nothing to set up, or setup worked)
528*/
529
530static BOOL
b8b1b5cb 531init_dh(SSL_CTX *sctx, uschar *dhparam, const host_item *host)
059ec3d9 532{
059ec3d9
PH
533BIO *bio;
534DH *dh;
535uschar *dhexpanded;
a799883d 536const char *pem;
059ec3d9
PH
537
538if (!expand_check(dhparam, US"tls_dhparam", &dhexpanded))
539 return FALSE;
540
0df4ab80 541if (!dhexpanded || !*dhexpanded)
a799883d 542 bio = BIO_new_mem_buf(CS std_dh_prime_default(), -1);
a799883d 543else if (dhexpanded[0] == '/')
059ec3d9 544 {
0df4ab80 545 if (!(bio = BIO_new_file(CS dhexpanded, "r")))
059ec3d9 546 {
7199e1ee 547 tls_error(string_sprintf("could not read dhparams file %s", dhexpanded),
a799883d
PP
548 host, US strerror(errno));
549 return FALSE;
059ec3d9 550 }
a799883d
PP
551 }
552else
553 {
554 if (Ustrcmp(dhexpanded, "none") == 0)
059ec3d9 555 {
a799883d
PP
556 DEBUG(D_tls) debug_printf("Requested no DH parameters.\n");
557 return TRUE;
059ec3d9 558 }
a799883d 559
0df4ab80 560 if (!(pem = std_dh_prime_named(dhexpanded)))
a799883d
PP
561 {
562 tls_error(string_sprintf("Unknown standard DH prime \"%s\"", dhexpanded),
563 host, US strerror(errno));
564 return FALSE;
565 }
566 bio = BIO_new_mem_buf(CS pem, -1);
567 }
568
0df4ab80 569if (!(dh = PEM_read_bio_DHparams(bio, NULL, NULL, NULL)))
a799883d 570 {
059ec3d9 571 BIO_free(bio);
a799883d
PP
572 tls_error(string_sprintf("Could not read tls_dhparams \"%s\"", dhexpanded),
573 host, NULL);
574 return FALSE;
575 }
576
577/* Even if it is larger, we silently return success rather than cause things
578 * to fail out, so that a too-large DH will not knock out all TLS; it's a
579 * debatable choice. */
580if ((8*DH_size(dh)) > tls_dh_max_bits)
581 {
582 DEBUG(D_tls)
583 debug_printf("dhparams file %d bits, is > tls_dh_max_bits limit of %d",
584 8*DH_size(dh), tls_dh_max_bits);
585 }
586else
587 {
588 SSL_CTX_set_tmp_dh(sctx, dh);
589 DEBUG(D_tls)
590 debug_printf("Diffie-Hellman initialized from %s with %d-bit prime\n",
591 dhexpanded ? dhexpanded : US"default", 8*DH_size(dh));
059ec3d9
PH
592 }
593
a799883d
PP
594DH_free(dh);
595BIO_free(bio);
596
597return TRUE;
059ec3d9
PH
598}
599
600
601
602
f2de3a33 603#ifndef DISABLE_OCSP
3f7eeb86
PP
604/*************************************************
605* Load OCSP information into state *
606*************************************************/
607
f5d78688 608/* Called to load the server OCSP response from the given file into memory, once
3f7eeb86
PP
609caller has determined this is needed. Checks validity. Debugs a message
610if invalid.
611
612ASSUMES: single response, for single cert.
613
614Arguments:
615 sctx the SSL_CTX* to update
616 cbinfo various parts of session state
617 expanded the filename putatively holding an OCSP response
618
619*/
620
621static void
f5d78688 622ocsp_load_response(SSL_CTX *sctx, tls_ext_ctx_cb *cbinfo, const uschar *expanded)
3f7eeb86
PP
623{
624BIO *bio;
625OCSP_RESPONSE *resp;
626OCSP_BASICRESP *basic_response;
627OCSP_SINGLERESP *single_response;
628ASN1_GENERALIZEDTIME *rev, *thisupd, *nextupd;
629X509_STORE *store;
630unsigned long verify_flags;
631int status, reason, i;
632
f5d78688
JH
633cbinfo->u_ocsp.server.file_expanded = string_copy(expanded);
634if (cbinfo->u_ocsp.server.response)
3f7eeb86 635 {
f5d78688
JH
636 OCSP_RESPONSE_free(cbinfo->u_ocsp.server.response);
637 cbinfo->u_ocsp.server.response = NULL;
3f7eeb86
PP
638 }
639
f5d78688 640bio = BIO_new_file(CS cbinfo->u_ocsp.server.file_expanded, "rb");
3f7eeb86
PP
641if (!bio)
642 {
643 DEBUG(D_tls) debug_printf("Failed to open OCSP response file \"%s\"\n",
f5d78688 644 cbinfo->u_ocsp.server.file_expanded);
3f7eeb86
PP
645 return;
646 }
647
648resp = d2i_OCSP_RESPONSE_bio(bio, NULL);
649BIO_free(bio);
650if (!resp)
651 {
652 DEBUG(D_tls) debug_printf("Error reading OCSP response.\n");
653 return;
654 }
655
656status = OCSP_response_status(resp);
657if (status != OCSP_RESPONSE_STATUS_SUCCESSFUL)
658 {
659 DEBUG(D_tls) debug_printf("OCSP response not valid: %s (%d)\n",
660 OCSP_response_status_str(status), status);
f5d78688 661 goto bad;
3f7eeb86
PP
662 }
663
664basic_response = OCSP_response_get1_basic(resp);
665if (!basic_response)
666 {
667 DEBUG(D_tls)
668 debug_printf("OCSP response parse error: unable to extract basic response.\n");
f5d78688 669 goto bad;
3f7eeb86
PP
670 }
671
672store = SSL_CTX_get_cert_store(sctx);
673verify_flags = OCSP_NOVERIFY; /* check sigs, but not purpose */
674
675/* May need to expose ability to adjust those flags?
676OCSP_NOSIGS OCSP_NOVERIFY OCSP_NOCHAIN OCSP_NOCHECKS OCSP_NOEXPLICIT
677OCSP_TRUSTOTHER OCSP_NOINTERN */
678
679i = OCSP_basic_verify(basic_response, NULL, store, verify_flags);
680if (i <= 0)
681 {
682 DEBUG(D_tls) {
683 ERR_error_string(ERR_get_error(), ssl_errstring);
684 debug_printf("OCSP response verify failure: %s\n", US ssl_errstring);
f5d78688
JH
685 }
686 goto bad;
3f7eeb86
PP
687 }
688
689/* Here's the simplifying assumption: there's only one response, for the
690one certificate we use, and nothing for anything else in a chain. If this
691proves false, we need to extract a cert id from our issued cert
692(tls_certificate) and use that for OCSP_resp_find_status() (which finds the
693right cert in the stack and then calls OCSP_single_get0_status()).
694
695I'm hoping to avoid reworking a bunch more of how we handle state here. */
696single_response = OCSP_resp_get0(basic_response, 0);
697if (!single_response)
698 {
699 DEBUG(D_tls)
700 debug_printf("Unable to get first response from OCSP basic response.\n");
f5d78688 701 goto bad;
3f7eeb86
PP
702 }
703
704status = OCSP_single_get0_status(single_response, &reason, &rev, &thisupd, &nextupd);
f5d78688 705if (status != V_OCSP_CERTSTATUS_GOOD)
3f7eeb86 706 {
f5d78688
JH
707 DEBUG(D_tls) debug_printf("OCSP response bad cert status: %s (%d) %s (%d)\n",
708 OCSP_cert_status_str(status), status,
709 OCSP_crl_reason_str(reason), reason);
710 goto bad;
3f7eeb86
PP
711 }
712
713if (!OCSP_check_validity(thisupd, nextupd, EXIM_OCSP_SKEW_SECONDS, EXIM_OCSP_MAX_AGE))
714 {
715 DEBUG(D_tls) debug_printf("OCSP status invalid times.\n");
f5d78688 716 goto bad;
3f7eeb86
PP
717 }
718
f5d78688 719supply_response:
018058b2 720 cbinfo->u_ocsp.server.response = resp;
f5d78688
JH
721return;
722
723bad:
018058b2
JH
724 if (running_in_test_harness)
725 {
726 extern char ** environ;
727 uschar ** p;
728 for (p = USS environ; *p != NULL; p++)
729 if (Ustrncmp(*p, "EXIM_TESTHARNESS_DISABLE_OCSPVALIDITYCHECK", 42) == 0)
730 {
731 DEBUG(D_tls) debug_printf("Supplying known bad OCSP response\n");
732 goto supply_response;
733 }
734 }
f5d78688 735return;
3f7eeb86 736}
f2de3a33 737#endif /*!DISABLE_OCSP*/
3f7eeb86
PP
738
739
740
741
059ec3d9 742/*************************************************
7be682ca
PP
743* Expand key and cert file specs *
744*************************************************/
745
f5d78688 746/* Called once during tls_init and possibly again during TLS setup, for a
7be682ca
PP
747new context, if Server Name Indication was used and tls_sni was seen in
748the certificate string.
749
750Arguments:
751 sctx the SSL_CTX* to update
752 cbinfo various parts of session state
753
754Returns: OK/DEFER/FAIL
755*/
756
757static int
3f7eeb86 758tls_expand_session_files(SSL_CTX *sctx, tls_ext_ctx_cb *cbinfo)
7be682ca
PP
759{
760uschar *expanded;
761
762if (cbinfo->certificate == NULL)
763 return OK;
764
d9b2312b
JH
765if (Ustrstr(cbinfo->certificate, US"tls_sni") ||
766 Ustrstr(cbinfo->certificate, US"tls_in_sni") ||
767 Ustrstr(cbinfo->certificate, US"tls_out_sni")
768 )
7be682ca
PP
769 reexpand_tls_files_for_sni = TRUE;
770
771if (!expand_check(cbinfo->certificate, US"tls_certificate", &expanded))
772 return DEFER;
773
774if (expanded != NULL)
775 {
776 DEBUG(D_tls) debug_printf("tls_certificate file %s\n", expanded);
777 if (!SSL_CTX_use_certificate_chain_file(sctx, CS expanded))
778 return tls_error(string_sprintf(
779 "SSL_CTX_use_certificate_chain_file file=%s", expanded),
780 cbinfo->host, NULL);
781 }
782
783if (cbinfo->privatekey != NULL &&
784 !expand_check(cbinfo->privatekey, US"tls_privatekey", &expanded))
785 return DEFER;
786
787/* If expansion was forced to fail, key_expanded will be NULL. If the result
788of the expansion is an empty string, ignore it also, and assume the private
789key is in the same file as the certificate. */
790
791if (expanded != NULL && *expanded != 0)
792 {
793 DEBUG(D_tls) debug_printf("tls_privatekey file %s\n", expanded);
794 if (!SSL_CTX_use_PrivateKey_file(sctx, CS expanded, SSL_FILETYPE_PEM))
795 return tls_error(string_sprintf(
796 "SSL_CTX_use_PrivateKey_file file=%s", expanded), cbinfo->host, NULL);
797 }
798
f2de3a33 799#ifndef DISABLE_OCSP
f5d78688 800if (cbinfo->is_server && cbinfo->u_ocsp.server.file != NULL)
3f7eeb86 801 {
f5d78688 802 if (!expand_check(cbinfo->u_ocsp.server.file, US"tls_ocsp_file", &expanded))
3f7eeb86
PP
803 return DEFER;
804
805 if (expanded != NULL && *expanded != 0)
806 {
807 DEBUG(D_tls) debug_printf("tls_ocsp_file %s\n", expanded);
f5d78688
JH
808 if (cbinfo->u_ocsp.server.file_expanded &&
809 (Ustrcmp(expanded, cbinfo->u_ocsp.server.file_expanded) == 0))
3f7eeb86
PP
810 {
811 DEBUG(D_tls)
812 debug_printf("tls_ocsp_file value unchanged, using existing values.\n");
813 } else {
814 ocsp_load_response(sctx, cbinfo, expanded);
815 }
816 }
817 }
818#endif
819
7be682ca
PP
820return OK;
821}
822
823
824
825
826/*************************************************
827* Callback to handle SNI *
828*************************************************/
829
830/* Called when acting as server during the TLS session setup if a Server Name
831Indication extension was sent by the client.
832
833API documentation is OpenSSL s_server.c implementation.
834
835Arguments:
836 s SSL* of the current session
837 ad unknown (part of OpenSSL API) (unused)
838 arg Callback of "our" registered data
839
840Returns: SSL_TLSEXT_ERR_{OK,ALERT_WARNING,ALERT_FATAL,NOACK}
841*/
842
3bcbbbe2 843#ifdef EXIM_HAVE_OPENSSL_TLSEXT
7be682ca 844static int
7be682ca
PP
845tls_servername_cb(SSL *s, int *ad ARG_UNUSED, void *arg)
846{
847const char *servername = SSL_get_servername(s, TLSEXT_NAMETYPE_host_name);
3f7eeb86 848tls_ext_ctx_cb *cbinfo = (tls_ext_ctx_cb *) arg;
7be682ca 849int rc;
3f0945ff 850int old_pool = store_pool;
7be682ca
PP
851
852if (!servername)
853 return SSL_TLSEXT_ERR_OK;
854
3f0945ff 855DEBUG(D_tls) debug_printf("Received TLS SNI \"%s\"%s\n", servername,
7be682ca
PP
856 reexpand_tls_files_for_sni ? "" : " (unused for certificate selection)");
857
858/* Make the extension value available for expansion */
3f0945ff 859store_pool = POOL_PERM;
817d9f57 860tls_in.sni = string_copy(US servername);
3f0945ff 861store_pool = old_pool;
7be682ca
PP
862
863if (!reexpand_tls_files_for_sni)
864 return SSL_TLSEXT_ERR_OK;
865
866/* Can't find an SSL_CTX_clone() or equivalent, so we do it manually;
867not confident that memcpy wouldn't break some internal reference counting.
868Especially since there's a references struct member, which would be off. */
869
0df4ab80 870if (!(server_sni = SSL_CTX_new(SSLv23_server_method())))
7be682ca
PP
871 {
872 ERR_error_string(ERR_get_error(), ssl_errstring);
873 DEBUG(D_tls) debug_printf("SSL_CTX_new() failed: %s\n", ssl_errstring);
874 return SSL_TLSEXT_ERR_NOACK;
875 }
876
877/* Not sure how many of these are actually needed, since SSL object
878already exists. Might even need this selfsame callback, for reneg? */
879
817d9f57
JH
880SSL_CTX_set_info_callback(server_sni, SSL_CTX_get_info_callback(server_ctx));
881SSL_CTX_set_mode(server_sni, SSL_CTX_get_mode(server_ctx));
882SSL_CTX_set_options(server_sni, SSL_CTX_get_options(server_ctx));
883SSL_CTX_set_timeout(server_sni, SSL_CTX_get_timeout(server_ctx));
884SSL_CTX_set_tlsext_servername_callback(server_sni, tls_servername_cb);
885SSL_CTX_set_tlsext_servername_arg(server_sni, cbinfo);
7be682ca 886if (cbinfo->server_cipher_list)
817d9f57 887 SSL_CTX_set_cipher_list(server_sni, CS cbinfo->server_cipher_list);
f2de3a33 888#ifndef DISABLE_OCSP
f5d78688 889if (cbinfo->u_ocsp.server.file)
3f7eeb86 890 {
f5d78688 891 SSL_CTX_set_tlsext_status_cb(server_sni, tls_server_stapling_cb);
14c7b357 892 SSL_CTX_set_tlsext_status_arg(server_sni, cbinfo);
3f7eeb86
PP
893 }
894#endif
7be682ca 895
983207c1 896rc = setup_certs(server_sni, tls_verify_certificates, tls_crl, NULL, FALSE, verify_callback_server);
7be682ca
PP
897if (rc != OK) return SSL_TLSEXT_ERR_NOACK;
898
3f7eeb86
PP
899/* do this after setup_certs, because this can require the certs for verifying
900OCSP information. */
817d9f57 901rc = tls_expand_session_files(server_sni, cbinfo);
7be682ca
PP
902if (rc != OK) return SSL_TLSEXT_ERR_NOACK;
903
0df4ab80
JH
904if (!init_dh(server_sni, cbinfo->dhparam, NULL))
905 return SSL_TLSEXT_ERR_NOACK;
a799883d 906
7be682ca 907DEBUG(D_tls) debug_printf("Switching SSL context.\n");
817d9f57 908SSL_set_SSL_CTX(s, server_sni);
7be682ca
PP
909
910return SSL_TLSEXT_ERR_OK;
911}
3bcbbbe2 912#endif /* EXIM_HAVE_OPENSSL_TLSEXT */
7be682ca
PP
913
914
915
916
f2de3a33 917#ifndef DISABLE_OCSP
f5d78688 918
3f7eeb86
PP
919/*************************************************
920* Callback to handle OCSP Stapling *
921*************************************************/
922
923/* Called when acting as server during the TLS session setup if the client
924requests OCSP information with a Certificate Status Request.
925
926Documentation via openssl s_server.c and the Apache patch from the OpenSSL
927project.
928
929*/
930
931static int
f5d78688 932tls_server_stapling_cb(SSL *s, void *arg)
3f7eeb86
PP
933{
934const tls_ext_ctx_cb *cbinfo = (tls_ext_ctx_cb *) arg;
935uschar *response_der;
936int response_der_len;
937
af4a1bca
JH
938DEBUG(D_tls)
939 debug_printf("Received TLS status request (OCSP stapling); %s response.",
f5d78688
JH
940 cbinfo->u_ocsp.server.response ? "have" : "lack");
941
44662487 942tls_in.ocsp = OCSP_NOT_RESP;
f5d78688 943if (!cbinfo->u_ocsp.server.response)
3f7eeb86
PP
944 return SSL_TLSEXT_ERR_NOACK;
945
946response_der = NULL;
44662487
JH
947response_der_len = i2d_OCSP_RESPONSE(cbinfo->u_ocsp.server.response,
948 &response_der);
3f7eeb86
PP
949if (response_der_len <= 0)
950 return SSL_TLSEXT_ERR_NOACK;
951
5e55c7a9 952SSL_set_tlsext_status_ocsp_resp(server_ssl, response_der, response_der_len);
44662487 953tls_in.ocsp = OCSP_VFIED;
3f7eeb86
PP
954return SSL_TLSEXT_ERR_OK;
955}
956
3f7eeb86 957
f5d78688
JH
958static void
959time_print(BIO * bp, const char * str, ASN1_GENERALIZEDTIME * time)
960{
961BIO_printf(bp, "\t%s: ", str);
962ASN1_GENERALIZEDTIME_print(bp, time);
963BIO_puts(bp, "\n");
964}
965
966static int
967tls_client_stapling_cb(SSL *s, void *arg)
968{
969tls_ext_ctx_cb * cbinfo = arg;
970const unsigned char * p;
971int len;
972OCSP_RESPONSE * rsp;
973OCSP_BASICRESP * bs;
974int i;
975
976DEBUG(D_tls) debug_printf("Received TLS status response (OCSP stapling):");
977len = SSL_get_tlsext_status_ocsp_resp(s, &p);
978if(!p)
979 {
44662487
JH
980 /* Expect this when we requested ocsp but got none */
981 if ( cbinfo->u_ocsp.client.verify_required
982 && log_extra_selector & LX_tls_cipher)
983 log_write(0, LOG_MAIN, "Received TLS status callback, null content");
f5d78688
JH
984 else
985 DEBUG(D_tls) debug_printf(" null\n");
44662487 986 return cbinfo->u_ocsp.client.verify_required ? 0 : 1;
f5d78688 987 }
018058b2 988
f5d78688
JH
989if(!(rsp = d2i_OCSP_RESPONSE(NULL, &p, len)))
990 {
018058b2 991 tls_out.ocsp = OCSP_FAILED;
f5d78688 992 if (log_extra_selector & LX_tls_cipher)
1eca31ca 993 log_write(0, LOG_MAIN, "Received TLS cert status response, parse error");
f5d78688
JH
994 else
995 DEBUG(D_tls) debug_printf(" parse error\n");
996 return 0;
997 }
998
999if(!(bs = OCSP_response_get1_basic(rsp)))
1000 {
018058b2 1001 tls_out.ocsp = OCSP_FAILED;
f5d78688 1002 if (log_extra_selector & LX_tls_cipher)
1eca31ca 1003 log_write(0, LOG_MAIN, "Received TLS cert status response, error parsing response");
f5d78688
JH
1004 else
1005 DEBUG(D_tls) debug_printf(" error parsing response\n");
1006 OCSP_RESPONSE_free(rsp);
1007 return 0;
1008 }
1009
1010/* We'd check the nonce here if we'd put one in the request. */
1011/* However that would defeat cacheability on the server so we don't. */
1012
f5d78688
JH
1013/* This section of code reworked from OpenSSL apps source;
1014 The OpenSSL Project retains copyright:
1015 Copyright (c) 1999 The OpenSSL Project. All rights reserved.
1016*/
1017 {
1018 BIO * bp = NULL;
f5d78688
JH
1019 int status, reason;
1020 ASN1_GENERALIZEDTIME *rev, *thisupd, *nextupd;
1021
1022 DEBUG(D_tls) bp = BIO_new_fp(stderr, BIO_NOCLOSE);
1023
1024 /*OCSP_RESPONSE_print(bp, rsp, 0); extreme debug: stapling content */
1025
1026 /* Use the chain that verified the server cert to verify the stapled info */
1027 /* DEBUG(D_tls) x509_store_dump_cert_s_names(cbinfo->u_ocsp.client.verify_store); */
1028
44662487
JH
1029 if ((i = OCSP_basic_verify(bs, NULL,
1030 cbinfo->u_ocsp.client.verify_store, 0)) <= 0)
f5d78688 1031 {
018058b2 1032 tls_out.ocsp = OCSP_FAILED;
1eca31ca
JH
1033 if (log_extra_selector & LX_tls_cipher)
1034 log_write(0, LOG_MAIN, "Received TLS cert status response, itself unverifiable");
f5d78688
JH
1035 BIO_printf(bp, "OCSP response verify failure\n");
1036 ERR_print_errors(bp);
44662487 1037 i = cbinfo->u_ocsp.client.verify_required ? 0 : 1;
f5d78688
JH
1038 goto out;
1039 }
1040
1041 BIO_printf(bp, "OCSP response well-formed and signed OK\n");
1042
1043 {
1044 STACK_OF(OCSP_SINGLERESP) * sresp = bs->tbsResponseData->responses;
1045 OCSP_SINGLERESP * single;
1046
1047 if (sk_OCSP_SINGLERESP_num(sresp) != 1)
1048 {
018058b2 1049 tls_out.ocsp = OCSP_FAILED;
44662487
JH
1050 log_write(0, LOG_MAIN, "OCSP stapling "
1051 "with multiple responses not handled");
1052 i = cbinfo->u_ocsp.client.verify_required ? 0 : 1;
f5d78688
JH
1053 goto out;
1054 }
1055 single = OCSP_resp_get0(bs, 0);
44662487
JH
1056 status = OCSP_single_get0_status(single, &reason, &rev,
1057 &thisupd, &nextupd);
f5d78688
JH
1058 }
1059
f5d78688
JH
1060 DEBUG(D_tls) time_print(bp, "This OCSP Update", thisupd);
1061 DEBUG(D_tls) if(nextupd) time_print(bp, "Next OCSP Update", nextupd);
44662487
JH
1062 if (!OCSP_check_validity(thisupd, nextupd,
1063 EXIM_OCSP_SKEW_SECONDS, EXIM_OCSP_MAX_AGE))
f5d78688 1064 {
018058b2 1065 tls_out.ocsp = OCSP_FAILED;
f5d78688
JH
1066 DEBUG(D_tls) ERR_print_errors(bp);
1067 log_write(0, LOG_MAIN, "Server OSCP dates invalid");
44662487 1068 i = cbinfo->u_ocsp.client.verify_required ? 0 : 1;
f5d78688 1069 }
44662487 1070 else
f5d78688 1071 {
44662487
JH
1072 DEBUG(D_tls) BIO_printf(bp, "Certificate status: %s\n",
1073 OCSP_cert_status_str(status));
1074 switch(status)
1075 {
1076 case V_OCSP_CERTSTATUS_GOOD:
44662487 1077 tls_out.ocsp = OCSP_VFIED;
018058b2 1078 i = 1;
44662487
JH
1079 break;
1080 case V_OCSP_CERTSTATUS_REVOKED:
018058b2 1081 tls_out.ocsp = OCSP_FAILED;
44662487
JH
1082 log_write(0, LOG_MAIN, "Server certificate revoked%s%s",
1083 reason != -1 ? "; reason: " : "",
1084 reason != -1 ? OCSP_crl_reason_str(reason) : "");
1085 DEBUG(D_tls) time_print(bp, "Revocation Time", rev);
1086 i = cbinfo->u_ocsp.client.verify_required ? 0 : 1;
1087 break;
1088 default:
018058b2 1089 tls_out.ocsp = OCSP_FAILED;
44662487
JH
1090 log_write(0, LOG_MAIN,
1091 "Server certificate status unknown, in OCSP stapling");
1092 i = cbinfo->u_ocsp.client.verify_required ? 0 : 1;
1093 break;
1094 }
f5d78688
JH
1095 }
1096 out:
1097 BIO_free(bp);
1098 }
1099
1100OCSP_RESPONSE_free(rsp);
1101return i;
1102}
f2de3a33 1103#endif /*!DISABLE_OCSP*/
3f7eeb86
PP
1104
1105
7be682ca 1106/*************************************************
059ec3d9
PH
1107* Initialize for TLS *
1108*************************************************/
1109
e51c7be2
JH
1110/* Called from both server and client code, to do preliminary initialization
1111of the library. We allocate and return a context structure.
059ec3d9
PH
1112
1113Arguments:
946ecbe0 1114 ctxp returned SSL context
059ec3d9
PH
1115 host connected host, if client; NULL if server
1116 dhparam DH parameter file
1117 certificate certificate file
1118 privatekey private key
f5d78688 1119 ocsp_file file of stapling info (server); flag for require ocsp (client)
059ec3d9 1120 addr address if client; NULL if server (for some randomness)
946ecbe0 1121 cbp place to put allocated callback context
059ec3d9
PH
1122
1123Returns: OK/DEFER/FAIL
1124*/
1125
1126static int
817d9f57 1127tls_init(SSL_CTX **ctxp, host_item *host, uschar *dhparam, uschar *certificate,
3f7eeb86 1128 uschar *privatekey,
f2de3a33 1129#ifndef DISABLE_OCSP
3f7eeb86
PP
1130 uschar *ocsp_file,
1131#endif
817d9f57 1132 address_item *addr, tls_ext_ctx_cb ** cbp)
059ec3d9 1133{
77bb000f 1134long init_options;
7be682ca 1135int rc;
77bb000f 1136BOOL okay;
a7538db1 1137tls_ext_ctx_cb * cbinfo;
7be682ca
PP
1138
1139cbinfo = store_malloc(sizeof(tls_ext_ctx_cb));
1140cbinfo->certificate = certificate;
1141cbinfo->privatekey = privatekey;
f2de3a33 1142#ifndef DISABLE_OCSP
f5d78688
JH
1143if ((cbinfo->is_server = host==NULL))
1144 {
1145 cbinfo->u_ocsp.server.file = ocsp_file;
1146 cbinfo->u_ocsp.server.file_expanded = NULL;
1147 cbinfo->u_ocsp.server.response = NULL;
1148 }
1149else
1150 cbinfo->u_ocsp.client.verify_store = NULL;
3f7eeb86 1151#endif
7be682ca 1152cbinfo->dhparam = dhparam;
0df4ab80 1153cbinfo->server_cipher_list = NULL;
7be682ca 1154cbinfo->host = host;
774ef2d7 1155#ifdef EXPERIMENTAL_EVENT
a7538db1
JH
1156cbinfo->event_action = NULL;
1157#endif
77bb000f 1158
059ec3d9
PH
1159SSL_load_error_strings(); /* basic set up */
1160OpenSSL_add_ssl_algorithms();
1161
388d6564 1162#if (OPENSSL_VERSION_NUMBER >= 0x0090800fL) && !defined(OPENSSL_NO_SHA256)
77bb000f 1163/* SHA256 is becoming ever more popular. This makes sure it gets added to the
a0475b69
TK
1164list of available digests. */
1165EVP_add_digest(EVP_sha256());
cf1ef1a9 1166#endif
a0475b69 1167
f0f5a555
PP
1168/* Create a context.
1169The OpenSSL docs in 1.0.1b have not been updated to clarify TLS variant
1170negotiation in the different methods; as far as I can tell, the only
1171*_{server,client}_method which allows negotiation is SSLv23, which exists even
1172when OpenSSL is built without SSLv2 support.
1173By disabling with openssl_options, we can let admins re-enable with the
1174existing knob. */
059ec3d9 1175
817d9f57 1176*ctxp = SSL_CTX_new((host == NULL)?
059ec3d9
PH
1177 SSLv23_server_method() : SSLv23_client_method());
1178
817d9f57 1179if (*ctxp == NULL) return tls_error(US"SSL_CTX_new", host, NULL);
059ec3d9
PH
1180
1181/* It turns out that we need to seed the random number generator this early in
1182order to get the full complement of ciphers to work. It took me roughly a day
1183of work to discover this by experiment.
1184
1185On systems that have /dev/urandom, SSL may automatically seed itself from
1186there. Otherwise, we have to make something up as best we can. Double check
1187afterwards. */
1188
1189if (!RAND_status())
1190 {
1191 randstuff r;
9e3331ea 1192 gettimeofday(&r.tv, NULL);
059ec3d9
PH
1193 r.p = getpid();
1194
1195 RAND_seed((uschar *)(&r), sizeof(r));
1196 RAND_seed((uschar *)big_buffer, big_buffer_size);
1197 if (addr != NULL) RAND_seed((uschar *)addr, sizeof(addr));
1198
1199 if (!RAND_status())
7199e1ee 1200 return tls_error(US"RAND_status", host,
5ca6d115 1201 US"unable to seed random number generator");
059ec3d9
PH
1202 }
1203
1204/* Set up the information callback, which outputs if debugging is at a suitable
1205level. */
1206
f69979cf 1207DEBUG(D_tls) SSL_CTX_set_info_callback(*ctxp, (void (*)())info_callback);
059ec3d9 1208
c80c5570 1209/* Automatically re-try reads/writes after renegotiation. */
817d9f57 1210(void) SSL_CTX_set_mode(*ctxp, SSL_MODE_AUTO_RETRY);
c80c5570 1211
77bb000f
PP
1212/* Apply administrator-supplied work-arounds.
1213Historically we applied just one requested option,
1214SSL_OP_DONT_INSERT_EMPTY_FRAGMENTS, but when bug 994 requested a second, we
1215moved to an administrator-controlled list of options to specify and
1216grandfathered in the first one as the default value for "openssl_options".
059ec3d9 1217
77bb000f
PP
1218No OpenSSL version number checks: the options we accept depend upon the
1219availability of the option value macros from OpenSSL. */
059ec3d9 1220
77bb000f
PP
1221okay = tls_openssl_options_parse(openssl_options, &init_options);
1222if (!okay)
73a46702 1223 return tls_error(US"openssl_options parsing failed", host, NULL);
77bb000f
PP
1224
1225if (init_options)
1226 {
1227 DEBUG(D_tls) debug_printf("setting SSL CTX options: %#lx\n", init_options);
817d9f57 1228 if (!(SSL_CTX_set_options(*ctxp, init_options)))
77bb000f
PP
1229 return tls_error(string_sprintf(
1230 "SSL_CTX_set_option(%#lx)", init_options), host, NULL);
1231 }
1232else
1233 DEBUG(D_tls) debug_printf("no SSL CTX options to set\n");
059ec3d9
PH
1234
1235/* Initialize with DH parameters if supplied */
1236
817d9f57 1237if (!init_dh(*ctxp, dhparam, host)) return DEFER;
059ec3d9 1238
3f7eeb86 1239/* Set up certificate and key (and perhaps OCSP info) */
059ec3d9 1240
817d9f57 1241rc = tls_expand_session_files(*ctxp, cbinfo);
7be682ca 1242if (rc != OK) return rc;
c91535f3 1243
7be682ca 1244/* If we need to handle SNI, do so */
3bcbbbe2 1245#ifdef EXIM_HAVE_OPENSSL_TLSEXT
f5d78688 1246if (host == NULL) /* server */
3f0945ff 1247 {
f2de3a33 1248# ifndef DISABLE_OCSP
f5d78688 1249 /* We check u_ocsp.server.file, not server.response, because we care about if
3f7eeb86
PP
1250 the option exists, not what the current expansion might be, as SNI might
1251 change the certificate and OCSP file in use between now and the time the
1252 callback is invoked. */
f5d78688 1253 if (cbinfo->u_ocsp.server.file)
3f7eeb86 1254 {
f5d78688 1255 SSL_CTX_set_tlsext_status_cb(server_ctx, tls_server_stapling_cb);
5e55c7a9 1256 SSL_CTX_set_tlsext_status_arg(server_ctx, cbinfo);
3f7eeb86 1257 }
f5d78688 1258# endif
3f0945ff
PP
1259 /* We always do this, so that $tls_sni is available even if not used in
1260 tls_certificate */
817d9f57
JH
1261 SSL_CTX_set_tlsext_servername_callback(*ctxp, tls_servername_cb);
1262 SSL_CTX_set_tlsext_servername_arg(*ctxp, cbinfo);
3f0945ff 1263 }
f2de3a33 1264# ifndef DISABLE_OCSP
f5d78688
JH
1265else /* client */
1266 if(ocsp_file) /* wanting stapling */
1267 {
1268 if (!(cbinfo->u_ocsp.client.verify_store = X509_STORE_new()))
1269 {
1270 DEBUG(D_tls) debug_printf("failed to create store for stapling verify\n");
1271 return FAIL;
1272 }
1273 SSL_CTX_set_tlsext_status_cb(*ctxp, tls_client_stapling_cb);
1274 SSL_CTX_set_tlsext_status_arg(*ctxp, cbinfo);
1275 }
1276# endif
7be682ca 1277#endif
059ec3d9 1278
e51c7be2 1279cbinfo->verify_cert_hostnames = NULL;
e51c7be2 1280
059ec3d9
PH
1281/* Set up the RSA callback */
1282
817d9f57 1283SSL_CTX_set_tmp_rsa_callback(*ctxp, rsa_callback);
059ec3d9
PH
1284
1285/* Finally, set the timeout, and we are done */
1286
817d9f57 1287SSL_CTX_set_timeout(*ctxp, ssl_session_timeout);
059ec3d9 1288DEBUG(D_tls) debug_printf("Initialized TLS\n");
7be682ca 1289
817d9f57 1290*cbp = cbinfo;
7be682ca 1291
059ec3d9
PH
1292return OK;
1293}
1294
1295
1296
1297
1298/*************************************************
1299* Get name of cipher in use *
1300*************************************************/
1301
817d9f57 1302/*
059ec3d9 1303Argument: pointer to an SSL structure for the connection
817d9f57
JH
1304 buffer to use for answer
1305 size of buffer
1306 pointer to number of bits for cipher
059ec3d9
PH
1307Returns: nothing
1308*/
1309
1310static void
817d9f57 1311construct_cipher_name(SSL *ssl, uschar *cipherbuf, int bsize, int *bits)
059ec3d9 1312{
57b3a7f5
PP
1313/* With OpenSSL 1.0.0a, this needs to be const but the documentation doesn't
1314yet reflect that. It should be a safe change anyway, even 0.9.8 versions have
1315the accessor functions use const in the prototype. */
1316const SSL_CIPHER *c;
d9784128 1317const uschar *ver;
059ec3d9 1318
d9784128 1319ver = (const uschar *)SSL_get_version(ssl);
059ec3d9 1320
57b3a7f5 1321c = (const SSL_CIPHER *) SSL_get_current_cipher(ssl);
817d9f57 1322SSL_CIPHER_get_bits(c, bits);
059ec3d9 1323
817d9f57
JH
1324string_format(cipherbuf, bsize, "%s:%s:%u", ver,
1325 SSL_CIPHER_get_name(c), *bits);
059ec3d9
PH
1326
1327DEBUG(D_tls) debug_printf("Cipher: %s\n", cipherbuf);
1328}
1329
1330
f69979cf
JH
1331static void
1332peer_cert(SSL * ssl, tls_support * tlsp, uschar * peerdn, unsigned bsize)
1333{
1334/*XXX we might consider a list-of-certs variable for the cert chain.
1335SSL_get_peer_cert_chain(SSL*). We'd need a new variable type and support
1336in list-handling functions, also consider the difference between the entire
1337chain and the elements sent by the peer. */
1338
1339/* Will have already noted peercert on a verify fail; possibly not the leaf */
1340if (!tlsp->peercert)
1341 tlsp->peercert = SSL_get_peer_certificate(ssl);
1342/* Beware anonymous ciphers which lead to server_cert being NULL */
1343if (tlsp->peercert)
1344 {
1345 X509_NAME_oneline(X509_get_subject_name(tlsp->peercert), CS peerdn, bsize);
1346 peerdn[bsize-1] = '\0';
1347 tlsp->peerdn = peerdn; /*XXX a static buffer... */
1348 }
1349else
1350 tlsp->peerdn = NULL;
1351}
1352
1353
059ec3d9
PH
1354
1355
1356
1357/*************************************************
1358* Set up for verifying certificates *
1359*************************************************/
1360
1361/* Called by both client and server startup
1362
1363Arguments:
7be682ca 1364 sctx SSL_CTX* to initialise
059ec3d9
PH
1365 certs certs file or NULL
1366 crl CRL file or NULL
1367 host NULL in a server; the remote host in a client
1368 optional TRUE if called from a server for a host in tls_try_verify_hosts;
1369 otherwise passed as FALSE
983207c1 1370 cert_vfy_cb Callback function for certificate verification
059ec3d9
PH
1371
1372Returns: OK/DEFER/FAIL
1373*/
1374
1375static int
983207c1
JH
1376setup_certs(SSL_CTX *sctx, uschar *certs, uschar *crl, host_item *host, BOOL optional,
1377 int (*cert_vfy_cb)(int, X509_STORE_CTX *) )
059ec3d9
PH
1378{
1379uschar *expcerts, *expcrl;
1380
1381if (!expand_check(certs, US"tls_verify_certificates", &expcerts))
1382 return DEFER;
1383
26e72755 1384if (expcerts != NULL && *expcerts != '\0')
059ec3d9 1385 {
cb1d7830 1386 if (Ustrcmp(expcerts, "system") == 0)
059ec3d9 1387 {
cb1d7830
JH
1388 /* Tell the library to use its compiled-in location for the system default
1389 CA bundle, only */
1390
1391 if (!SSL_CTX_set_default_verify_paths(sctx))
1392 return tls_error(US"SSL_CTX_set_default_verify_paths", host, NULL);
059ec3d9
PH
1393 }
1394 else
1395 {
cb1d7830
JH
1396 struct stat statbuf;
1397
1398 /* Tell the library to use its compiled-in location for the system default
1399 CA bundle. Those given by the exim config are additional to these */
1400
1401 if (!SSL_CTX_set_default_verify_paths(sctx))
1402 return tls_error(US"SSL_CTX_set_default_verify_paths", host, NULL);
1403
1404 if (Ustat(expcerts, &statbuf) < 0)
1405 {
1406 log_write(0, LOG_MAIN|LOG_PANIC,
1407 "failed to stat %s for certificates", expcerts);
1408 return DEFER;
1409 }
059ec3d9 1410 else
059ec3d9 1411 {
cb1d7830
JH
1412 uschar *file, *dir;
1413 if ((statbuf.st_mode & S_IFMT) == S_IFDIR)
1414 { file = NULL; dir = expcerts; }
1415 else
1416 { file = expcerts; dir = NULL; }
1417
1418 /* If a certificate file is empty, the next function fails with an
1419 unhelpful error message. If we skip it, we get the correct behaviour (no
1420 certificates are recognized, but the error message is still misleading (it
1421 says no certificate was supplied.) But this is better. */
1422
1423 if ((file == NULL || statbuf.st_size > 0) &&
1424 !SSL_CTX_load_verify_locations(sctx, CS file, CS dir))
1425 return tls_error(US"SSL_CTX_load_verify_locations", host, NULL);
1426
1427 /* Load the list of CAs for which we will accept certs, for sending
1428 to the client. This is only for the one-file tls_verify_certificates
1429 variant.
1430 If a list isn't loaded into the server, but
1431 some verify locations are set, the server end appears to make
1432 a wildcard reqest for client certs.
1433 Meanwhile, the client library as deafult behaviour *ignores* the list
1434 we send over the wire - see man SSL_CTX_set_client_cert_cb.
1435 Because of this, and that the dir variant is likely only used for
1436 the public-CA bundle (not for a private CA), not worth fixing.
1437 */
1438 if (file != NULL)
1439 {
1440 STACK_OF(X509_NAME) * names = SSL_load_client_CA_file(CS file);
1441 DEBUG(D_tls) debug_printf("Added %d certificate authorities.\n",
1442 sk_X509_NAME_num(names));
1443 SSL_CTX_set_client_CA_list(sctx, names);
1444 }
059ec3d9
PH
1445 }
1446 }
1447
1448 /* Handle a certificate revocation list. */
1449
1450 #if OPENSSL_VERSION_NUMBER > 0x00907000L
1451
8b417f2c
PH
1452 /* This bit of code is now the version supplied by Lars Mainka. (I have
1453 * merely reformatted it into the Exim code style.)
1454
1455 * "From here I changed the code to add support for multiple crl's
1456 * in pem format in one file or to support hashed directory entries in
1457 * pem format instead of a file. This method now uses the library function
1458 * X509_STORE_load_locations to add the CRL location to the SSL context.
1459 * OpenSSL will then handle the verify against CA certs and CRLs by
1460 * itself in the verify callback." */
1461
059ec3d9
PH
1462 if (!expand_check(crl, US"tls_crl", &expcrl)) return DEFER;
1463 if (expcrl != NULL && *expcrl != 0)
1464 {
8b417f2c
PH
1465 struct stat statbufcrl;
1466 if (Ustat(expcrl, &statbufcrl) < 0)
1467 {
1468 log_write(0, LOG_MAIN|LOG_PANIC,
1469 "failed to stat %s for certificates revocation lists", expcrl);
1470 return DEFER;
1471 }
1472 else
059ec3d9 1473 {
8b417f2c
PH
1474 /* is it a file or directory? */
1475 uschar *file, *dir;
7be682ca 1476 X509_STORE *cvstore = SSL_CTX_get_cert_store(sctx);
8b417f2c 1477 if ((statbufcrl.st_mode & S_IFMT) == S_IFDIR)
059ec3d9 1478 {
8b417f2c
PH
1479 file = NULL;
1480 dir = expcrl;
1481 DEBUG(D_tls) debug_printf("SSL CRL value is a directory %s\n", dir);
059ec3d9
PH
1482 }
1483 else
1484 {
8b417f2c
PH
1485 file = expcrl;
1486 dir = NULL;
1487 DEBUG(D_tls) debug_printf("SSL CRL value is a file %s\n", file);
059ec3d9 1488 }
8b417f2c 1489 if (X509_STORE_load_locations(cvstore, CS file, CS dir) == 0)
7199e1ee 1490 return tls_error(US"X509_STORE_load_locations", host, NULL);
8b417f2c
PH
1491
1492 /* setting the flags to check against the complete crl chain */
1493
1494 X509_STORE_set_flags(cvstore,
1495 X509_V_FLAG_CRL_CHECK|X509_V_FLAG_CRL_CHECK_ALL);
059ec3d9 1496 }
059ec3d9
PH
1497 }
1498
1499 #endif /* OPENSSL_VERSION_NUMBER > 0x00907000L */
1500
1501 /* If verification is optional, don't fail if no certificate */
1502
7be682ca 1503 SSL_CTX_set_verify(sctx,
059ec3d9 1504 SSL_VERIFY_PEER | (optional? 0 : SSL_VERIFY_FAIL_IF_NO_PEER_CERT),
983207c1 1505 cert_vfy_cb);
059ec3d9
PH
1506 }
1507
1508return OK;
1509}
1510
1511
1512
1513/*************************************************
1514* Start a TLS session in a server *
1515*************************************************/
1516
1517/* This is called when Exim is running as a server, after having received
1518the STARTTLS command. It must respond to that command, and then negotiate
1519a TLS session.
1520
1521Arguments:
1522 require_ciphers allowed ciphers
1523
1524Returns: OK on success
1525 DEFER for errors before the start of the negotiation
1526 FAIL for errors during the negotation; the server can't
1527 continue running.
1528*/
1529
1530int
17c76198 1531tls_server_start(const uschar *require_ciphers)
059ec3d9
PH
1532{
1533int rc;
1534uschar *expciphers;
7be682ca 1535tls_ext_ctx_cb *cbinfo;
f69979cf 1536static uschar peerdn[256];
817d9f57 1537static uschar cipherbuf[256];
059ec3d9
PH
1538
1539/* Check for previous activation */
1540
817d9f57 1541if (tls_in.active >= 0)
059ec3d9 1542 {
5ca6d115 1543 tls_error(US"STARTTLS received after TLS started", NULL, US"");
059ec3d9
PH
1544 smtp_printf("554 Already in TLS\r\n");
1545 return FAIL;
1546 }
1547
1548/* Initialize the SSL library. If it fails, it will already have logged
1549the error. */
1550
817d9f57 1551rc = tls_init(&server_ctx, NULL, tls_dhparam, tls_certificate, tls_privatekey,
f2de3a33 1552#ifndef DISABLE_OCSP
3f7eeb86
PP
1553 tls_ocsp_file,
1554#endif
817d9f57 1555 NULL, &server_static_cbinfo);
059ec3d9 1556if (rc != OK) return rc;
817d9f57 1557cbinfo = server_static_cbinfo;
059ec3d9
PH
1558
1559if (!expand_check(require_ciphers, US"tls_require_ciphers", &expciphers))
1560 return FAIL;
1561
1562/* In OpenSSL, cipher components are separated by hyphens. In GnuTLS, they
17c76198
PP
1563were historically separated by underscores. So that I can use either form in my
1564tests, and also for general convenience, we turn underscores into hyphens here.
1565*/
059ec3d9
PH
1566
1567if (expciphers != NULL)
1568 {
1569 uschar *s = expciphers;
1570 while (*s != 0) { if (*s == '_') *s = '-'; s++; }
1571 DEBUG(D_tls) debug_printf("required ciphers: %s\n", expciphers);
817d9f57 1572 if (!SSL_CTX_set_cipher_list(server_ctx, CS expciphers))
7199e1ee 1573 return tls_error(US"SSL_CTX_set_cipher_list", NULL, NULL);
7be682ca 1574 cbinfo->server_cipher_list = expciphers;
059ec3d9
PH
1575 }
1576
1577/* If this is a host for which certificate verification is mandatory or
1578optional, set up appropriately. */
1579
817d9f57 1580tls_in.certificate_verified = FALSE;
53a7196b
JH
1581#ifdef EXPERIMENTAL_DANE
1582tls_in.dane_verified = FALSE;
1583#endif
a2ff477a 1584server_verify_callback_called = FALSE;
059ec3d9
PH
1585
1586if (verify_check_host(&tls_verify_hosts) == OK)
1587 {
983207c1
JH
1588 rc = setup_certs(server_ctx, tls_verify_certificates, tls_crl, NULL,
1589 FALSE, verify_callback_server);
059ec3d9 1590 if (rc != OK) return rc;
a2ff477a 1591 server_verify_optional = FALSE;
059ec3d9
PH
1592 }
1593else if (verify_check_host(&tls_try_verify_hosts) == OK)
1594 {
983207c1
JH
1595 rc = setup_certs(server_ctx, tls_verify_certificates, tls_crl, NULL,
1596 TRUE, verify_callback_server);
059ec3d9 1597 if (rc != OK) return rc;
a2ff477a 1598 server_verify_optional = TRUE;
059ec3d9
PH
1599 }
1600
1601/* Prepare for new connection */
1602
817d9f57 1603if ((server_ssl = SSL_new(server_ctx)) == NULL) return tls_error(US"SSL_new", NULL, NULL);
da3ad30d
PP
1604
1605/* Warning: we used to SSL_clear(ssl) here, it was removed.
1606 *
1607 * With the SSL_clear(), we get strange interoperability bugs with
1608 * OpenSSL 1.0.1b and TLS1.1/1.2. It looks as though this may be a bug in
1609 * OpenSSL itself, as a clear should not lead to inability to follow protocols.
1610 *
1611 * The SSL_clear() call is to let an existing SSL* be reused, typically after
1612 * session shutdown. In this case, we have a brand new object and there's no
1613 * obvious reason to immediately clear it. I'm guessing that this was
1614 * originally added because of incomplete initialisation which the clear fixed,
1615 * in some historic release.
1616 */
059ec3d9
PH
1617
1618/* Set context and tell client to go ahead, except in the case of TLS startup
1619on connection, where outputting anything now upsets the clients and tends to
1620make them disconnect. We need to have an explicit fflush() here, to force out
1621the response. Other smtp_printf() calls do not need it, because in non-TLS
1622mode, the fflush() happens when smtp_getc() is called. */
1623
817d9f57
JH
1624SSL_set_session_id_context(server_ssl, sid_ctx, Ustrlen(sid_ctx));
1625if (!tls_in.on_connect)
059ec3d9
PH
1626 {
1627 smtp_printf("220 TLS go ahead\r\n");
1628 fflush(smtp_out);
1629 }
1630
1631/* Now negotiate the TLS session. We put our own timer on it, since it seems
1632that the OpenSSL library doesn't. */
1633
817d9f57
JH
1634SSL_set_wfd(server_ssl, fileno(smtp_out));
1635SSL_set_rfd(server_ssl, fileno(smtp_in));
1636SSL_set_accept_state(server_ssl);
059ec3d9
PH
1637
1638DEBUG(D_tls) debug_printf("Calling SSL_accept\n");
1639
1640sigalrm_seen = FALSE;
1641if (smtp_receive_timeout > 0) alarm(smtp_receive_timeout);
817d9f57 1642rc = SSL_accept(server_ssl);
059ec3d9
PH
1643alarm(0);
1644
1645if (rc <= 0)
1646 {
7199e1ee 1647 tls_error(US"SSL_accept", NULL, sigalrm_seen ? US"timed out" : NULL);
77bb000f
PP
1648 if (ERR_get_error() == 0)
1649 log_write(0, LOG_MAIN,
a053d125 1650 "TLS client disconnected cleanly (rejected our certificate?)");
059ec3d9
PH
1651 return FAIL;
1652 }
1653
1654DEBUG(D_tls) debug_printf("SSL_accept was successful\n");
1655
1656/* TLS has been set up. Adjust the input functions to read via TLS,
1657and initialize things. */
1658
f69979cf
JH
1659peer_cert(server_ssl, &tls_in, peerdn, sizeof(peerdn));
1660
817d9f57
JH
1661construct_cipher_name(server_ssl, cipherbuf, sizeof(cipherbuf), &tls_in.bits);
1662tls_in.cipher = cipherbuf;
059ec3d9
PH
1663
1664DEBUG(D_tls)
1665 {
1666 uschar buf[2048];
817d9f57 1667 if (SSL_get_shared_ciphers(server_ssl, CS buf, sizeof(buf)) != NULL)
059ec3d9
PH
1668 debug_printf("Shared ciphers: %s\n", buf);
1669 }
1670
9d1c15ef
JH
1671/* Record the certificate we presented */
1672 {
1673 X509 * crt = SSL_get_certificate(server_ssl);
1674 tls_in.ourcert = crt ? X509_dup(crt) : NULL;
1675 }
059ec3d9 1676
817d9f57
JH
1677/* Only used by the server-side tls (tls_in), including tls_getc.
1678 Client-side (tls_out) reads (seem to?) go via
1679 smtp_read_response()/ip_recv().
1680 Hence no need to duplicate for _in and _out.
1681 */
059ec3d9
PH
1682ssl_xfer_buffer = store_malloc(ssl_xfer_buffer_size);
1683ssl_xfer_buffer_lwm = ssl_xfer_buffer_hwm = 0;
1684ssl_xfer_eof = ssl_xfer_error = 0;
1685
1686receive_getc = tls_getc;
1687receive_ungetc = tls_ungetc;
1688receive_feof = tls_feof;
1689receive_ferror = tls_ferror;
58eb016e 1690receive_smtp_buffered = tls_smtp_buffered;
059ec3d9 1691
817d9f57 1692tls_in.active = fileno(smtp_out);
059ec3d9
PH
1693return OK;
1694}
1695
1696
1697
1698
043b1248
JH
1699static int
1700tls_client_basic_ctx_init(SSL_CTX * ctx,
01a4a5c5 1701 host_item * host, smtp_transport_options_block * ob, tls_ext_ctx_cb * cbinfo
043b1248
JH
1702 )
1703{
1704int rc;
1705/* stick to the old behaviour for compatibility if tls_verify_certificates is
1706 set but both tls_verify_hosts and tls_try_verify_hosts is not set. Check only
1707 the specified host patterns if one of them is defined */
1708
610ff438
JH
1709if ( ( !ob->tls_verify_hosts
1710 && (!ob->tls_try_verify_hosts || !*ob->tls_try_verify_hosts)
1711 )
5130845b 1712 || (verify_check_given_host(&ob->tls_verify_hosts, host) == OK)
aa2a70ba 1713 )
043b1248 1714 client_verify_optional = FALSE;
5130845b 1715else if (verify_check_given_host(&ob->tls_try_verify_hosts, host) == OK)
aa2a70ba
JH
1716 client_verify_optional = TRUE;
1717else
1718 return OK;
1719
1720if ((rc = setup_certs(ctx, ob->tls_verify_certificates,
1721 ob->tls_crl, host, client_verify_optional, verify_callback_client)) != OK)
1722 return rc;
043b1248 1723
5130845b 1724if (verify_check_given_host(&ob->tls_verify_cert_hostnames, host) == OK)
043b1248 1725 {
4af0d74a
JH
1726 cbinfo->verify_cert_hostnames =
1727#ifdef EXPERIMENTAL_INTERNATIONAL
1728 string_domain_utf8_to_alabel(host->name, NULL);
1729#else
1730 host->name;
1731#endif
aa2a70ba
JH
1732 DEBUG(D_tls) debug_printf("Cert hostname to check: \"%s\"\n",
1733 cbinfo->verify_cert_hostnames);
043b1248 1734 }
043b1248
JH
1735return OK;
1736}
059ec3d9 1737
fde080a4
JH
1738
1739#ifdef EXPERIMENTAL_DANE
1740static int
fde080a4
JH
1741dane_tlsa_load(SSL * ssl, host_item * host, dns_answer * dnsa)
1742{
1743dns_record * rr;
1744dns_scan dnss;
1745const char * hostnames[2] = { CS host->name, NULL };
1746int found = 0;
1747
1748if (DANESSL_init(ssl, NULL, hostnames) != 1)
1749 return tls_error(US"hostnames load", host, NULL);
1750
1751for (rr = dns_next_rr(dnsa, &dnss, RESET_ANSWERS);
1752 rr;
1753 rr = dns_next_rr(dnsa, &dnss, RESET_NEXT)
1754 ) if (rr->type == T_TLSA)
1755 {
1756 uschar * p = rr->data;
1757 uint8_t usage, selector, mtype;
1758 const char * mdname;
1759
fde080a4 1760 usage = *p++;
133d2546
JH
1761
1762 /* Only DANE-TA(2) and DANE-EE(3) are supported */
1763 if (usage != 2 && usage != 3) continue;
1764
fde080a4
JH
1765 selector = *p++;
1766 mtype = *p++;
1767
1768 switch (mtype)
1769 {
133d2546
JH
1770 default: continue; /* Only match-types 0, 1, 2 are supported */
1771 case 0: mdname = NULL; break;
1772 case 1: mdname = "sha256"; break;
1773 case 2: mdname = "sha512"; break;
fde080a4
JH
1774 }
1775
133d2546 1776 found++;
fde080a4
JH
1777 switch (DANESSL_add_tlsa(ssl, usage, selector, mdname, p, rr->size - 3))
1778 {
1779 default:
1780 case 0: /* action not taken */
1781 return tls_error(US"tlsa load", host, NULL);
1782 case 1: break;
1783 }
594706ea
JH
1784
1785 tls_out.tlsa_usage |= 1<<usage;
fde080a4
JH
1786 }
1787
1788if (found)
1789 return OK;
1790
133d2546 1791log_write(0, LOG_MAIN, "DANE error: No usable TLSA records");
6ebd79ec 1792return DEFER;
fde080a4
JH
1793}
1794#endif /*EXPERIMENTAL_DANE*/
1795
1796
1797
059ec3d9
PH
1798/*************************************************
1799* Start a TLS session in a client *
1800*************************************************/
1801
1802/* Called from the smtp transport after STARTTLS has been accepted.
1803
1804Argument:
1805 fd the fd of the connection
1806 host connected host (for messages)
83da1223 1807 addr the first address
a7538db1 1808 tb transport (always smtp)
0e66b3b6 1809 tlsa_dnsa tlsa lookup, if DANE, else null
059ec3d9
PH
1810
1811Returns: OK on success
1812 FAIL otherwise - note that tls_error() will not give DEFER
1813 because this is not a server
1814*/
1815
1816int
f5d78688 1817tls_client_start(int fd, host_item *host, address_item *addr,
0e66b3b6
JH
1818 transport_instance *tb
1819#ifdef EXPERIMENTAL_DANE
1820 , dns_answer * tlsa_dnsa
1821#endif
1822 )
059ec3d9 1823{
a7538db1
JH
1824smtp_transport_options_block * ob =
1825 (smtp_transport_options_block *)tb->options_block;
f69979cf 1826static uschar peerdn[256];
868f5672 1827uschar * expciphers;
059ec3d9 1828int rc;
817d9f57 1829static uschar cipherbuf[256];
043b1248
JH
1830
1831#ifndef DISABLE_OCSP
043b1248 1832BOOL request_ocsp = FALSE;
6634ac8d 1833BOOL require_ocsp = FALSE;
043b1248 1834#endif
043b1248
JH
1835
1836#ifdef EXPERIMENTAL_DANE
594706ea 1837tls_out.tlsa_usage = 0;
043b1248
JH
1838#endif
1839
f2de3a33 1840#ifndef DISABLE_OCSP
043b1248 1841 {
4f59c424
JH
1842# ifdef EXPERIMENTAL_DANE
1843 if ( tlsa_dnsa
1844 && ob->hosts_request_ocsp[0] == '*'
1845 && ob->hosts_request_ocsp[1] == '\0'
1846 )
1847 {
1848 /* Unchanged from default. Use a safer one under DANE */
1849 request_ocsp = TRUE;
1850 ob->hosts_request_ocsp = US"${if or { {= {0}{$tls_out_tlsa_usage}} "
1851 " {= {4}{$tls_out_tlsa_usage}} } "
1852 " {*}{}}";
1853 }
1854# endif
1855
5130845b
JH
1856 if ((require_ocsp =
1857 verify_check_given_host(&ob->hosts_require_ocsp, host) == OK))
fca41d5a
JH
1858 request_ocsp = TRUE;
1859 else
fca41d5a 1860# ifdef EXPERIMENTAL_DANE
4f59c424 1861 if (!request_ocsp)
fca41d5a 1862# endif
5130845b
JH
1863 request_ocsp =
1864 verify_check_given_host(&ob->hosts_request_ocsp, host) == OK;
043b1248 1865 }
f5d78688 1866#endif
059ec3d9 1867
65867078
JH
1868rc = tls_init(&client_ctx, host, NULL,
1869 ob->tls_certificate, ob->tls_privatekey,
f2de3a33 1870#ifndef DISABLE_OCSP
44662487 1871 (void *)(long)request_ocsp,
3f7eeb86 1872#endif
817d9f57 1873 addr, &client_static_cbinfo);
059ec3d9
PH
1874if (rc != OK) return rc;
1875
817d9f57 1876tls_out.certificate_verified = FALSE;
a2ff477a 1877client_verify_callback_called = FALSE;
059ec3d9 1878
65867078
JH
1879if (!expand_check(ob->tls_require_ciphers, US"tls_require_ciphers",
1880 &expciphers))
059ec3d9
PH
1881 return FAIL;
1882
1883/* In OpenSSL, cipher components are separated by hyphens. In GnuTLS, they
1884are separated by underscores. So that I can use either form in my tests, and
1885also for general convenience, we turn underscores into hyphens here. */
1886
1887if (expciphers != NULL)
1888 {
1889 uschar *s = expciphers;
1890 while (*s != 0) { if (*s == '_') *s = '-'; s++; }
1891 DEBUG(D_tls) debug_printf("required ciphers: %s\n", expciphers);
817d9f57 1892 if (!SSL_CTX_set_cipher_list(client_ctx, CS expciphers))
7199e1ee 1893 return tls_error(US"SSL_CTX_set_cipher_list", host, NULL);
059ec3d9
PH
1894 }
1895
043b1248 1896#ifdef EXPERIMENTAL_DANE
0e66b3b6 1897if (tlsa_dnsa)
a63be306 1898 {
02af313d
JH
1899 SSL_CTX_set_verify(client_ctx,
1900 SSL_VERIFY_PEER | SSL_VERIFY_FAIL_IF_NO_PEER_CERT,
1901 verify_callback_client_dane);
e5cccda9 1902
043b1248 1903 if (!DANESSL_library_init())
b4161d10 1904 return tls_error(US"library init", host, NULL);
043b1248 1905 if (DANESSL_CTX_init(client_ctx) <= 0)
b4161d10 1906 return tls_error(US"context init", host, NULL);
043b1248
JH
1907 }
1908else
e51c7be2 1909
043b1248
JH
1910#endif
1911
01a4a5c5
JH
1912 if ((rc = tls_client_basic_ctx_init(client_ctx, host, ob, client_static_cbinfo))
1913 != OK)
65867078 1914 return rc;
059ec3d9 1915
65867078
JH
1916if ((client_ssl = SSL_new(client_ctx)) == NULL)
1917 return tls_error(US"SSL_new", host, NULL);
817d9f57
JH
1918SSL_set_session_id_context(client_ssl, sid_ctx, Ustrlen(sid_ctx));
1919SSL_set_fd(client_ssl, fd);
1920SSL_set_connect_state(client_ssl);
059ec3d9 1921
65867078 1922if (ob->tls_sni)
3f0945ff 1923 {
65867078 1924 if (!expand_check(ob->tls_sni, US"tls_sni", &tls_out.sni))
3f0945ff 1925 return FAIL;
ec4b68e5 1926 if (tls_out.sni == NULL)
2c9a0e86
PP
1927 {
1928 DEBUG(D_tls) debug_printf("Setting TLS SNI forced to fail, not sending\n");
1929 }
ec4b68e5 1930 else if (!Ustrlen(tls_out.sni))
817d9f57 1931 tls_out.sni = NULL;
3f0945ff
PP
1932 else
1933 {
35731706 1934#ifdef EXIM_HAVE_OPENSSL_TLSEXT
817d9f57
JH
1935 DEBUG(D_tls) debug_printf("Setting TLS SNI \"%s\"\n", tls_out.sni);
1936 SSL_set_tlsext_host_name(client_ssl, tls_out.sni);
35731706
PP
1937#else
1938 DEBUG(D_tls)
1939 debug_printf("OpenSSL at build-time lacked SNI support, ignoring \"%s\"\n",
02d9264f 1940 tls_out.sni);
35731706 1941#endif
3f0945ff
PP
1942 }
1943 }
1944
594706ea 1945#ifdef EXPERIMENTAL_DANE
0e66b3b6
JH
1946if (tlsa_dnsa)
1947 if ((rc = dane_tlsa_load(client_ssl, host, tlsa_dnsa)) != OK)
594706ea
JH
1948 return rc;
1949#endif
1950
f2de3a33 1951#ifndef DISABLE_OCSP
f5d78688
JH
1952/* Request certificate status at connection-time. If the server
1953does OCSP stapling we will get the callback (set in tls_init()) */
b50c8b84 1954# ifdef EXPERIMENTAL_DANE
44662487
JH
1955if (request_ocsp)
1956 {
594706ea 1957 const uschar * s;
41afb5cb
JH
1958 if ( ((s = ob->hosts_require_ocsp) && Ustrstr(s, US"tls_out_tlsa_usage"))
1959 || ((s = ob->hosts_request_ocsp) && Ustrstr(s, US"tls_out_tlsa_usage"))
594706ea
JH
1960 )
1961 { /* Re-eval now $tls_out_tlsa_usage is populated. If
1962 this means we avoid the OCSP request, we wasted the setup
1963 cost in tls_init(). */
5130845b
JH
1964 require_ocsp = verify_check_given_host(&ob->hosts_require_ocsp, host) == OK;
1965 request_ocsp = require_ocsp
1966 || verify_check_given_host(&ob->hosts_request_ocsp, host) == OK;
594706ea
JH
1967 }
1968 }
b50c8b84
JH
1969# endif
1970
594706ea
JH
1971if (request_ocsp)
1972 {
f5d78688 1973 SSL_set_tlsext_status_type(client_ssl, TLSEXT_STATUSTYPE_ocsp);
44662487
JH
1974 client_static_cbinfo->u_ocsp.client.verify_required = require_ocsp;
1975 tls_out.ocsp = OCSP_NOT_RESP;
1976 }
f5d78688
JH
1977#endif
1978
774ef2d7
JH
1979#ifdef EXPERIMENTAL_EVENT
1980client_static_cbinfo->event_action = tb->event_action;
a7538db1 1981#endif
043b1248 1982
059ec3d9
PH
1983/* There doesn't seem to be a built-in timeout on connection. */
1984
1985DEBUG(D_tls) debug_printf("Calling SSL_connect\n");
1986sigalrm_seen = FALSE;
65867078 1987alarm(ob->command_timeout);
817d9f57 1988rc = SSL_connect(client_ssl);
059ec3d9
PH
1989alarm(0);
1990
043b1248 1991#ifdef EXPERIMENTAL_DANE
0e66b3b6 1992if (tlsa_dnsa)
fde080a4 1993 DANESSL_cleanup(client_ssl);
043b1248
JH
1994#endif
1995
059ec3d9 1996if (rc <= 0)
7199e1ee 1997 return tls_error(US"SSL_connect", host, sigalrm_seen ? US"timed out" : NULL);
059ec3d9
PH
1998
1999DEBUG(D_tls) debug_printf("SSL_connect succeeded\n");
2000
f69979cf 2001peer_cert(client_ssl, &tls_out, peerdn, sizeof(peerdn));
059ec3d9 2002
817d9f57
JH
2003construct_cipher_name(client_ssl, cipherbuf, sizeof(cipherbuf), &tls_out.bits);
2004tls_out.cipher = cipherbuf;
059ec3d9 2005
9d1c15ef
JH
2006/* Record the certificate we presented */
2007 {
2008 X509 * crt = SSL_get_certificate(client_ssl);
2009 tls_out.ourcert = crt ? X509_dup(crt) : NULL;
2010 }
2011
817d9f57 2012tls_out.active = fd;
059ec3d9
PH
2013return OK;
2014}
2015
2016
2017
2018
2019
2020/*************************************************
2021* TLS version of getc *
2022*************************************************/
2023
2024/* This gets the next byte from the TLS input buffer. If the buffer is empty,
2025it refills the buffer via the SSL reading function.
2026
2027Arguments: none
2028Returns: the next character or EOF
817d9f57
JH
2029
2030Only used by the server-side TLS.
059ec3d9
PH
2031*/
2032
2033int
2034tls_getc(void)
2035{
2036if (ssl_xfer_buffer_lwm >= ssl_xfer_buffer_hwm)
2037 {
2038 int error;
2039 int inbytes;
2040
817d9f57 2041 DEBUG(D_tls) debug_printf("Calling SSL_read(%p, %p, %u)\n", server_ssl,
c80c5570 2042 ssl_xfer_buffer, ssl_xfer_buffer_size);
059ec3d9
PH
2043
2044 if (smtp_receive_timeout > 0) alarm(smtp_receive_timeout);
817d9f57
JH
2045 inbytes = SSL_read(server_ssl, CS ssl_xfer_buffer, ssl_xfer_buffer_size);
2046 error = SSL_get_error(server_ssl, inbytes);
059ec3d9
PH
2047 alarm(0);
2048
2049 /* SSL_ERROR_ZERO_RETURN appears to mean that the SSL session has been
2050 closed down, not that the socket itself has been closed down. Revert to
2051 non-SSL handling. */
2052
2053 if (error == SSL_ERROR_ZERO_RETURN)
2054 {
2055 DEBUG(D_tls) debug_printf("Got SSL_ERROR_ZERO_RETURN\n");
2056
2057 receive_getc = smtp_getc;
2058 receive_ungetc = smtp_ungetc;
2059 receive_feof = smtp_feof;
2060 receive_ferror = smtp_ferror;
58eb016e 2061 receive_smtp_buffered = smtp_buffered;
059ec3d9 2062
817d9f57
JH
2063 SSL_free(server_ssl);
2064 server_ssl = NULL;
2065 tls_in.active = -1;
2066 tls_in.bits = 0;
2067 tls_in.cipher = NULL;
2068 tls_in.peerdn = NULL;
2069 tls_in.sni = NULL;
059ec3d9
PH
2070
2071 return smtp_getc();
2072 }
2073
2074 /* Handle genuine errors */
2075
ba084640
PP
2076 else if (error == SSL_ERROR_SSL)
2077 {
2078 ERR_error_string(ERR_get_error(), ssl_errstring);
89dd51cd 2079 log_write(0, LOG_MAIN, "TLS error (SSL_read): %s", ssl_errstring);
ba084640
PP
2080 ssl_xfer_error = 1;
2081 return EOF;
2082 }
2083
059ec3d9
PH
2084 else if (error != SSL_ERROR_NONE)
2085 {
2086 DEBUG(D_tls) debug_printf("Got SSL error %d\n", error);
2087 ssl_xfer_error = 1;
2088 return EOF;
2089 }
c80c5570 2090
80a47a2c
TK
2091#ifndef DISABLE_DKIM
2092 dkim_exim_verify_feed(ssl_xfer_buffer, inbytes);
2093#endif
059ec3d9
PH
2094 ssl_xfer_buffer_hwm = inbytes;
2095 ssl_xfer_buffer_lwm = 0;
2096 }
2097
2098/* Something in the buffer; return next uschar */
2099
2100return ssl_xfer_buffer[ssl_xfer_buffer_lwm++];
2101}
2102
2103
2104
2105/*************************************************
2106* Read bytes from TLS channel *
2107*************************************************/
2108
2109/*
2110Arguments:
2111 buff buffer of data
2112 len size of buffer
2113
2114Returns: the number of bytes read
2115 -1 after a failed read
817d9f57
JH
2116
2117Only used by the client-side TLS.
059ec3d9
PH
2118*/
2119
2120int
389ca47a 2121tls_read(BOOL is_server, uschar *buff, size_t len)
059ec3d9 2122{
389ca47a 2123SSL *ssl = is_server ? server_ssl : client_ssl;
059ec3d9
PH
2124int inbytes;
2125int error;
2126
389ca47a 2127DEBUG(D_tls) debug_printf("Calling SSL_read(%p, %p, %u)\n", ssl,
c80c5570 2128 buff, (unsigned int)len);
059ec3d9 2129
389ca47a
JH
2130inbytes = SSL_read(ssl, CS buff, len);
2131error = SSL_get_error(ssl, inbytes);
059ec3d9
PH
2132
2133if (error == SSL_ERROR_ZERO_RETURN)
2134 {
2135 DEBUG(D_tls) debug_printf("Got SSL_ERROR_ZERO_RETURN\n");
2136 return -1;
2137 }
2138else if (error != SSL_ERROR_NONE)
2139 {
2140 return -1;
2141 }
2142
2143return inbytes;
2144}
2145
2146
2147
2148
2149
2150/*************************************************
2151* Write bytes down TLS channel *
2152*************************************************/
2153
2154/*
2155Arguments:
817d9f57 2156 is_server channel specifier
059ec3d9
PH
2157 buff buffer of data
2158 len number of bytes
2159
2160Returns: the number of bytes after a successful write,
2161 -1 after a failed write
817d9f57
JH
2162
2163Used by both server-side and client-side TLS.
059ec3d9
PH
2164*/
2165
2166int
817d9f57 2167tls_write(BOOL is_server, const uschar *buff, size_t len)
059ec3d9
PH
2168{
2169int outbytes;
2170int error;
2171int left = len;
817d9f57 2172SSL *ssl = is_server ? server_ssl : client_ssl;
059ec3d9 2173
c80c5570 2174DEBUG(D_tls) debug_printf("tls_do_write(%p, %d)\n", buff, left);
059ec3d9
PH
2175while (left > 0)
2176 {
c80c5570 2177 DEBUG(D_tls) debug_printf("SSL_write(SSL, %p, %d)\n", buff, left);
059ec3d9
PH
2178 outbytes = SSL_write(ssl, CS buff, left);
2179 error = SSL_get_error(ssl, outbytes);
2180 DEBUG(D_tls) debug_printf("outbytes=%d error=%d\n", outbytes, error);
2181 switch (error)
2182 {
2183 case SSL_ERROR_SSL:
2184 ERR_error_string(ERR_get_error(), ssl_errstring);
2185 log_write(0, LOG_MAIN, "TLS error (SSL_write): %s", ssl_errstring);
2186 return -1;
2187
2188 case SSL_ERROR_NONE:
2189 left -= outbytes;
2190 buff += outbytes;
2191 break;
2192
2193 case SSL_ERROR_ZERO_RETURN:
2194 log_write(0, LOG_MAIN, "SSL channel closed on write");
2195 return -1;
2196
817d9f57
JH
2197 case SSL_ERROR_SYSCALL:
2198 log_write(0, LOG_MAIN, "SSL_write: (from %s) syscall: %s",
2199 sender_fullhost ? sender_fullhost : US"<unknown>",
2200 strerror(errno));
2201
059ec3d9
PH
2202 default:
2203 log_write(0, LOG_MAIN, "SSL_write error %d", error);
2204 return -1;
2205 }
2206 }
2207return len;
2208}
2209
2210
2211
2212/*************************************************
2213* Close down a TLS session *
2214*************************************************/
2215
2216/* This is also called from within a delivery subprocess forked from the
2217daemon, to shut down the TLS library, without actually doing a shutdown (which
2218would tamper with the SSL session in the parent process).
2219
2220Arguments: TRUE if SSL_shutdown is to be called
2221Returns: nothing
817d9f57
JH
2222
2223Used by both server-side and client-side TLS.
059ec3d9
PH
2224*/
2225
2226void
817d9f57 2227tls_close(BOOL is_server, BOOL shutdown)
059ec3d9 2228{
817d9f57 2229SSL **sslp = is_server ? &server_ssl : &client_ssl;
389ca47a 2230int *fdp = is_server ? &tls_in.active : &tls_out.active;
817d9f57
JH
2231
2232if (*fdp < 0) return; /* TLS was not active */
059ec3d9
PH
2233
2234if (shutdown)
2235 {
2236 DEBUG(D_tls) debug_printf("tls_close(): shutting down SSL\n");
817d9f57 2237 SSL_shutdown(*sslp);
059ec3d9
PH
2238 }
2239
817d9f57
JH
2240SSL_free(*sslp);
2241*sslp = NULL;
059ec3d9 2242
817d9f57 2243*fdp = -1;
059ec3d9
PH
2244}
2245
36f12725
NM
2246
2247
2248
2249/*************************************************
3375e053
PP
2250* Let tls_require_ciphers be checked at startup *
2251*************************************************/
2252
2253/* The tls_require_ciphers option, if set, must be something which the
2254library can parse.
2255
2256Returns: NULL on success, or error message
2257*/
2258
2259uschar *
2260tls_validate_require_cipher(void)
2261{
2262SSL_CTX *ctx;
2263uschar *s, *expciphers, *err;
2264
2265/* this duplicates from tls_init(), we need a better "init just global
2266state, for no specific purpose" singleton function of our own */
2267
2268SSL_load_error_strings();
2269OpenSSL_add_ssl_algorithms();
2270#if (OPENSSL_VERSION_NUMBER >= 0x0090800fL) && !defined(OPENSSL_NO_SHA256)
2271/* SHA256 is becoming ever more popular. This makes sure it gets added to the
2272list of available digests. */
2273EVP_add_digest(EVP_sha256());
2274#endif
2275
2276if (!(tls_require_ciphers && *tls_require_ciphers))
2277 return NULL;
2278
2279if (!expand_check(tls_require_ciphers, US"tls_require_ciphers", &expciphers))
2280 return US"failed to expand tls_require_ciphers";
2281
2282if (!(expciphers && *expciphers))
2283 return NULL;
2284
2285/* normalisation ripped from above */
2286s = expciphers;
2287while (*s != 0) { if (*s == '_') *s = '-'; s++; }
2288
2289err = NULL;
2290
2291ctx = SSL_CTX_new(SSLv23_server_method());
2292if (!ctx)
2293 {
2294 ERR_error_string(ERR_get_error(), ssl_errstring);
2295 return string_sprintf("SSL_CTX_new() failed: %s", ssl_errstring);
2296 }
2297
2298DEBUG(D_tls)
2299 debug_printf("tls_require_ciphers expands to \"%s\"\n", expciphers);
2300
2301if (!SSL_CTX_set_cipher_list(ctx, CS expciphers))
2302 {
2303 ERR_error_string(ERR_get_error(), ssl_errstring);
2304 err = string_sprintf("SSL_CTX_set_cipher_list(%s) failed", expciphers);
2305 }
2306
2307SSL_CTX_free(ctx);
2308
2309return err;
2310}
2311
2312
2313
2314
2315/*************************************************
36f12725
NM
2316* Report the library versions. *
2317*************************************************/
2318
2319/* There have historically been some issues with binary compatibility in
2320OpenSSL libraries; if Exim (like many other applications) is built against
2321one version of OpenSSL but the run-time linker picks up another version,
2322it can result in serious failures, including crashing with a SIGSEGV. So
2323report the version found by the compiler and the run-time version.
2324
f64a1e23
PP
2325Note: some OS vendors backport security fixes without changing the version
2326number/string, and the version date remains unchanged. The _build_ date
2327will change, so we can more usefully assist with version diagnosis by also
2328reporting the build date.
2329
36f12725
NM
2330Arguments: a FILE* to print the results to
2331Returns: nothing
2332*/
2333
2334void
2335tls_version_report(FILE *f)
2336{
754a0503 2337fprintf(f, "Library version: OpenSSL: Compile: %s\n"
f64a1e23
PP
2338 " Runtime: %s\n"
2339 " : %s\n",
754a0503 2340 OPENSSL_VERSION_TEXT,
f64a1e23
PP
2341 SSLeay_version(SSLEAY_VERSION),
2342 SSLeay_version(SSLEAY_BUILT_ON));
2343/* third line is 38 characters for the %s and the line is 73 chars long;
2344the OpenSSL output includes a "built on: " prefix already. */
36f12725
NM
2345}
2346
9e3331ea
TK
2347
2348
2349
2350/*************************************************
17c76198 2351* Random number generation *
9e3331ea
TK
2352*************************************************/
2353
2354/* Pseudo-random number generation. The result is not expected to be
2355cryptographically strong but not so weak that someone will shoot themselves
2356in the foot using it as a nonce in input in some email header scheme or
2357whatever weirdness they'll twist this into. The result should handle fork()
2358and avoid repeating sequences. OpenSSL handles that for us.
2359
2360Arguments:
2361 max range maximum
2362Returns a random number in range [0, max-1]
2363*/
2364
2365int
17c76198 2366vaguely_random_number(int max)
9e3331ea
TK
2367{
2368unsigned int r;
2369int i, needed_len;
de6135a0
PP
2370static pid_t pidlast = 0;
2371pid_t pidnow;
9e3331ea
TK
2372uschar *p;
2373uschar smallbuf[sizeof(r)];
2374
2375if (max <= 1)
2376 return 0;
2377
de6135a0
PP
2378pidnow = getpid();
2379if (pidnow != pidlast)
2380 {
2381 /* Although OpenSSL documents that "OpenSSL makes sure that the PRNG state
2382 is unique for each thread", this doesn't apparently apply across processes,
2383 so our own warning from vaguely_random_number_fallback() applies here too.
2384 Fix per PostgreSQL. */
2385 if (pidlast != 0)
2386 RAND_cleanup();
2387 pidlast = pidnow;
2388 }
2389
9e3331ea
TK
2390/* OpenSSL auto-seeds from /dev/random, etc, but this a double-check. */
2391if (!RAND_status())
2392 {
2393 randstuff r;
2394 gettimeofday(&r.tv, NULL);
2395 r.p = getpid();
2396
2397 RAND_seed((uschar *)(&r), sizeof(r));
2398 }
2399/* We're after pseudo-random, not random; if we still don't have enough data
2400in the internal PRNG then our options are limited. We could sleep and hope
2401for entropy to come along (prayer technique) but if the system is so depleted
2402in the first place then something is likely to just keep taking it. Instead,
2403we'll just take whatever little bit of pseudo-random we can still manage to
2404get. */
2405
2406needed_len = sizeof(r);
2407/* Don't take 8 times more entropy than needed if int is 8 octets and we were
2408asked for a number less than 10. */
2409for (r = max, i = 0; r; ++i)
2410 r >>= 1;
2411i = (i + 7) / 8;
2412if (i < needed_len)
2413 needed_len = i;
2414
2415/* We do not care if crypto-strong */
17c76198
PP
2416i = RAND_pseudo_bytes(smallbuf, needed_len);
2417if (i < 0)
2418 {
2419 DEBUG(D_all)
2420 debug_printf("OpenSSL RAND_pseudo_bytes() not supported by RAND method, using fallback.\n");
2421 return vaguely_random_number_fallback(max);
2422 }
2423
9e3331ea
TK
2424r = 0;
2425for (p = smallbuf; needed_len; --needed_len, ++p)
2426 {
2427 r *= 256;
2428 r += *p;
2429 }
2430
2431/* We don't particularly care about weighted results; if someone wants
2432smooth distribution and cares enough then they should submit a patch then. */
2433return r % max;
2434}
2435
77bb000f
PP
2436
2437
2438
2439/*************************************************
2440* OpenSSL option parse *
2441*************************************************/
2442
2443/* Parse one option for tls_openssl_options_parse below
2444
2445Arguments:
2446 name one option name
2447 value place to store a value for it
2448Returns success or failure in parsing
2449*/
2450
2451struct exim_openssl_option {
2452 uschar *name;
2453 long value;
2454};
2455/* We could use a macro to expand, but we need the ifdef and not all the
2456options document which version they were introduced in. Policylet: include
2457all options unless explicitly for DTLS, let the administrator choose which
2458to apply.
2459
2460This list is current as of:
e2fbf4a2
PP
2461 ==> 1.0.1b <==
2462Plus SSL_OP_SAFARI_ECDHE_ECDSA_BUG from 2013-June patch/discussion on openssl-dev
2463*/
77bb000f
PP
2464static struct exim_openssl_option exim_openssl_options[] = {
2465/* KEEP SORTED ALPHABETICALLY! */
2466#ifdef SSL_OP_ALL
73a46702 2467 { US"all", SSL_OP_ALL },
77bb000f
PP
2468#endif
2469#ifdef SSL_OP_ALLOW_UNSAFE_LEGACY_RENEGOTIATION
73a46702 2470 { US"allow_unsafe_legacy_renegotiation", SSL_OP_ALLOW_UNSAFE_LEGACY_RENEGOTIATION },
77bb000f
PP
2471#endif
2472#ifdef SSL_OP_CIPHER_SERVER_PREFERENCE
73a46702 2473 { US"cipher_server_preference", SSL_OP_CIPHER_SERVER_PREFERENCE },
77bb000f
PP
2474#endif
2475#ifdef SSL_OP_DONT_INSERT_EMPTY_FRAGMENTS
73a46702 2476 { US"dont_insert_empty_fragments", SSL_OP_DONT_INSERT_EMPTY_FRAGMENTS },
77bb000f
PP
2477#endif
2478#ifdef SSL_OP_EPHEMERAL_RSA
73a46702 2479 { US"ephemeral_rsa", SSL_OP_EPHEMERAL_RSA },
77bb000f
PP
2480#endif
2481#ifdef SSL_OP_LEGACY_SERVER_CONNECT
73a46702 2482 { US"legacy_server_connect", SSL_OP_LEGACY_SERVER_CONNECT },
77bb000f
PP
2483#endif
2484#ifdef SSL_OP_MICROSOFT_BIG_SSLV3_BUFFER
73a46702 2485 { US"microsoft_big_sslv3_buffer", SSL_OP_MICROSOFT_BIG_SSLV3_BUFFER },
77bb000f
PP
2486#endif
2487#ifdef SSL_OP_MICROSOFT_SESS_ID_BUG
73a46702 2488 { US"microsoft_sess_id_bug", SSL_OP_MICROSOFT_SESS_ID_BUG },
77bb000f
PP
2489#endif
2490#ifdef SSL_OP_MSIE_SSLV2_RSA_PADDING
73a46702 2491 { US"msie_sslv2_rsa_padding", SSL_OP_MSIE_SSLV2_RSA_PADDING },
77bb000f
PP
2492#endif
2493#ifdef SSL_OP_NETSCAPE_CHALLENGE_BUG
73a46702 2494 { US"netscape_challenge_bug", SSL_OP_NETSCAPE_CHALLENGE_BUG },
77bb000f
PP
2495#endif
2496#ifdef SSL_OP_NETSCAPE_REUSE_CIPHER_CHANGE_BUG
73a46702 2497 { US"netscape_reuse_cipher_change_bug", SSL_OP_NETSCAPE_REUSE_CIPHER_CHANGE_BUG },
77bb000f 2498#endif
c80c5570
PP
2499#ifdef SSL_OP_NO_COMPRESSION
2500 { US"no_compression", SSL_OP_NO_COMPRESSION },
2501#endif
77bb000f 2502#ifdef SSL_OP_NO_SESSION_RESUMPTION_ON_RENEGOTIATION
73a46702 2503 { US"no_session_resumption_on_renegotiation", SSL_OP_NO_SESSION_RESUMPTION_ON_RENEGOTIATION },
77bb000f 2504#endif
c0c7b2da
PP
2505#ifdef SSL_OP_NO_SSLv2
2506 { US"no_sslv2", SSL_OP_NO_SSLv2 },
2507#endif
2508#ifdef SSL_OP_NO_SSLv3
2509 { US"no_sslv3", SSL_OP_NO_SSLv3 },
2510#endif
2511#ifdef SSL_OP_NO_TICKET
2512 { US"no_ticket", SSL_OP_NO_TICKET },
2513#endif
2514#ifdef SSL_OP_NO_TLSv1
2515 { US"no_tlsv1", SSL_OP_NO_TLSv1 },
2516#endif
c80c5570
PP
2517#ifdef SSL_OP_NO_TLSv1_1
2518#if SSL_OP_NO_TLSv1_1 == 0x00000400L
2519 /* Error in chosen value in 1.0.1a; see first item in CHANGES for 1.0.1b */
2520#warning OpenSSL 1.0.1a uses a bad value for SSL_OP_NO_TLSv1_1, ignoring
2521#else
2522 { US"no_tlsv1_1", SSL_OP_NO_TLSv1_1 },
2523#endif
2524#endif
2525#ifdef SSL_OP_NO_TLSv1_2
2526 { US"no_tlsv1_2", SSL_OP_NO_TLSv1_2 },
2527#endif
e2fbf4a2
PP
2528#ifdef SSL_OP_SAFARI_ECDHE_ECDSA_BUG
2529 { US"safari_ecdhe_ecdsa_bug", SSL_OP_SAFARI_ECDHE_ECDSA_BUG },
2530#endif
77bb000f 2531#ifdef SSL_OP_SINGLE_DH_USE
73a46702 2532 { US"single_dh_use", SSL_OP_SINGLE_DH_USE },
77bb000f
PP
2533#endif
2534#ifdef SSL_OP_SINGLE_ECDH_USE
73a46702 2535 { US"single_ecdh_use", SSL_OP_SINGLE_ECDH_USE },
77bb000f
PP
2536#endif
2537#ifdef SSL_OP_SSLEAY_080_CLIENT_DH_BUG
73a46702 2538 { US"ssleay_080_client_dh_bug", SSL_OP_SSLEAY_080_CLIENT_DH_BUG },
77bb000f
PP
2539#endif
2540#ifdef SSL_OP_SSLREF2_REUSE_CERT_TYPE_BUG
73a46702 2541 { US"sslref2_reuse_cert_type_bug", SSL_OP_SSLREF2_REUSE_CERT_TYPE_BUG },
77bb000f
PP
2542#endif
2543#ifdef SSL_OP_TLS_BLOCK_PADDING_BUG
73a46702 2544 { US"tls_block_padding_bug", SSL_OP_TLS_BLOCK_PADDING_BUG },
77bb000f
PP
2545#endif
2546#ifdef SSL_OP_TLS_D5_BUG
73a46702 2547 { US"tls_d5_bug", SSL_OP_TLS_D5_BUG },
77bb000f
PP
2548#endif
2549#ifdef SSL_OP_TLS_ROLLBACK_BUG
73a46702 2550 { US"tls_rollback_bug", SSL_OP_TLS_ROLLBACK_BUG },
77bb000f
PP
2551#endif
2552};
2553static int exim_openssl_options_size =
2554 sizeof(exim_openssl_options)/sizeof(struct exim_openssl_option);
2555
c80c5570 2556
77bb000f
PP
2557static BOOL
2558tls_openssl_one_option_parse(uschar *name, long *value)
2559{
2560int first = 0;
2561int last = exim_openssl_options_size;
2562while (last > first)
2563 {
2564 int middle = (first + last)/2;
2565 int c = Ustrcmp(name, exim_openssl_options[middle].name);
2566 if (c == 0)
2567 {
2568 *value = exim_openssl_options[middle].value;
2569 return TRUE;
2570 }
2571 else if (c > 0)
2572 first = middle + 1;
2573 else
2574 last = middle;
2575 }
2576return FALSE;
2577}
2578
2579
2580
2581
2582/*************************************************
2583* OpenSSL option parsing logic *
2584*************************************************/
2585
2586/* OpenSSL has a number of compatibility options which an administrator might
2587reasonably wish to set. Interpret a list similarly to decode_bits(), so that
2588we look like log_selector.
2589
2590Arguments:
2591 option_spec the administrator-supplied string of options
2592 results ptr to long storage for the options bitmap
2593Returns success or failure
2594*/
2595
2596BOOL
2597tls_openssl_options_parse(uschar *option_spec, long *results)
2598{
2599long result, item;
2600uschar *s, *end;
2601uschar keep_c;
2602BOOL adding, item_parsed;
2603
0e944a0d 2604result = 0L;
b1770b6e 2605/* Prior to 4.80 we or'd in SSL_OP_DONT_INSERT_EMPTY_FRAGMENTS; removed
da3ad30d 2606 * from default because it increases BEAST susceptibility. */
f0f5a555
PP
2607#ifdef SSL_OP_NO_SSLv2
2608result |= SSL_OP_NO_SSLv2;
2609#endif
77bb000f
PP
2610
2611if (option_spec == NULL)
2612 {
2613 *results = result;
2614 return TRUE;
2615 }
2616
2617for (s=option_spec; *s != '\0'; /**/)
2618 {
2619 while (isspace(*s)) ++s;
2620 if (*s == '\0')
2621 break;
2622 if (*s != '+' && *s != '-')
2623 {
2624 DEBUG(D_tls) debug_printf("malformed openssl option setting: "
0e944a0d 2625 "+ or - expected but found \"%s\"\n", s);
77bb000f
PP
2626 return FALSE;
2627 }
2628 adding = *s++ == '+';
2629 for (end = s; (*end != '\0') && !isspace(*end); ++end) /**/ ;
2630 keep_c = *end;
2631 *end = '\0';
2632 item_parsed = tls_openssl_one_option_parse(s, &item);
2633 if (!item_parsed)
2634 {
0e944a0d 2635 DEBUG(D_tls) debug_printf("openssl option setting unrecognised: \"%s\"\n", s);
77bb000f
PP
2636 return FALSE;
2637 }
2638 DEBUG(D_tls) debug_printf("openssl option, %s from %lx: %lx (%s)\n",
2639 adding ? "adding" : "removing", result, item, s);
2640 if (adding)
2641 result |= item;
2642 else
2643 result &= ~item;
2644 *end = keep_c;
2645 s = end;
2646 }
2647
2648*results = result;
2649return TRUE;
2650}
2651
9d1c15ef
JH
2652/* vi: aw ai sw=2
2653*/
059ec3d9 2654/* End of tls-openssl.c */