Bug 1216: Add -M (related) to exigrep.
[exim.git] / src / src / tls-openssl.c
CommitLineData
059ec3d9
PH
1/*************************************************
2* Exim - an Internet mail transport agent *
3*************************************************/
4
5a66c31b 5/* Copyright (c) University of Cambridge 1995 - 2014 */
059ec3d9
PH
6/* See the file NOTICE for conditions of use and distribution. */
7
f5d78688
JH
8/* Portions Copyright (c) The OpenSSL Project 1999 */
9
059ec3d9
PH
10/* This module provides the TLS (aka SSL) support for Exim using the OpenSSL
11library. It is #included into the tls.c file when that library is used. The
12code herein is based on a patch that was originally contributed by Steve
13Haslam. It was adapted from stunnel, a GPL program by Michal Trojnara.
14
15No cryptographic code is included in Exim. All this module does is to call
16functions from the OpenSSL library. */
17
18
19/* Heading stuff */
20
21#include <openssl/lhash.h>
22#include <openssl/ssl.h>
23#include <openssl/err.h>
24#include <openssl/rand.h>
f2de3a33 25#ifndef DISABLE_OCSP
e51c7be2 26# include <openssl/ocsp.h>
3f7eeb86 27#endif
85098ee7
JH
28#ifdef EXPERIMENTAL_DANE
29# include <danessl.h>
30#endif
31
3f7eeb86 32
f2de3a33
JH
33#ifndef DISABLE_OCSP
34# define EXIM_OCSP_SKEW_SECONDS (300L)
35# define EXIM_OCSP_MAX_AGE (-1L)
3f7eeb86 36#endif
059ec3d9 37
3bcbbbe2 38#if OPENSSL_VERSION_NUMBER >= 0x0090806fL && !defined(OPENSSL_NO_TLSEXT)
e51c7be2 39# define EXIM_HAVE_OPENSSL_TLSEXT
3bcbbbe2
PP
40#endif
41
67791ce4
JH
42#if !defined(EXIM_HAVE_OPENSSL_TLSEXT) && !defined(DISABLE_OCSP)
43# warning "OpenSSL library version too old; define DISABLE_OCSP in Makefile"
44# define DISABLE_OCSP
45#endif
46
059ec3d9
PH
47/* Structure for collecting random data for seeding. */
48
49typedef struct randstuff {
9e3331ea
TK
50 struct timeval tv;
51 pid_t p;
059ec3d9
PH
52} randstuff;
53
54/* Local static variables */
55
a2ff477a
JH
56static BOOL client_verify_callback_called = FALSE;
57static BOOL server_verify_callback_called = FALSE;
059ec3d9
PH
58static const uschar *sid_ctx = US"exim";
59
d4f09789
PP
60/* We have three different contexts to care about.
61
62Simple case: client, `client_ctx`
63 As a client, we can be doing a callout or cut-through delivery while receiving
64 a message. So we have a client context, which should have options initialised
65 from the SMTP Transport.
66
67Server:
68 There are two cases: with and without ServerNameIndication from the client.
69 Given TLS SNI, we can be using different keys, certs and various other
70 configuration settings, because they're re-expanded with $tls_sni set. This
71 allows vhosting with TLS. This SNI is sent in the handshake.
72 A client might not send SNI, so we need a fallback, and an initial setup too.
73 So as a server, we start out using `server_ctx`.
74 If SNI is sent by the client, then we as server, mid-negotiation, try to clone
75 `server_sni` from `server_ctx` and then initialise settings by re-expanding
76 configuration.
77*/
78
817d9f57
JH
79static SSL_CTX *client_ctx = NULL;
80static SSL_CTX *server_ctx = NULL;
81static SSL *client_ssl = NULL;
82static SSL *server_ssl = NULL;
389ca47a 83
35731706 84#ifdef EXIM_HAVE_OPENSSL_TLSEXT
817d9f57 85static SSL_CTX *server_sni = NULL;
35731706 86#endif
059ec3d9
PH
87
88static char ssl_errstring[256];
89
90static int ssl_session_timeout = 200;
a2ff477a
JH
91static BOOL client_verify_optional = FALSE;
92static BOOL server_verify_optional = FALSE;
059ec3d9 93
f5d78688 94static BOOL reexpand_tls_files_for_sni = FALSE;
059ec3d9
PH
95
96
7be682ca
PP
97typedef struct tls_ext_ctx_cb {
98 uschar *certificate;
99 uschar *privatekey;
f2de3a33 100#ifndef DISABLE_OCSP
f5d78688
JH
101 BOOL is_server;
102 union {
103 struct {
104 uschar *file;
105 uschar *file_expanded;
106 OCSP_RESPONSE *response;
107 } server;
108 struct {
44662487
JH
109 X509_STORE *verify_store; /* non-null if status requested */
110 BOOL verify_required;
f5d78688
JH
111 } client;
112 } u_ocsp;
3f7eeb86 113#endif
7be682ca
PP
114 uschar *dhparam;
115 /* these are cached from first expand */
116 uschar *server_cipher_list;
117 /* only passed down to tls_error: */
118 host_item *host;
e51c7be2
JH
119
120#ifdef EXPERIMENTAL_CERTNAMES
121 uschar * verify_cert_hostnames;
122#endif
a7538db1
JH
123#ifdef EXPERIMENTAL_TPDA
124 uschar * event_action;
125#endif
7be682ca
PP
126} tls_ext_ctx_cb;
127
128/* should figure out a cleanup of API to handle state preserved per
129implementation, for various reasons, which can be void * in the APIs.
130For now, we hack around it. */
817d9f57
JH
131tls_ext_ctx_cb *client_static_cbinfo = NULL;
132tls_ext_ctx_cb *server_static_cbinfo = NULL;
7be682ca
PP
133
134static int
983207c1
JH
135setup_certs(SSL_CTX *sctx, uschar *certs, uschar *crl, host_item *host, BOOL optional,
136 int (*cert_vfy_cb)(int, X509_STORE_CTX *) );
059ec3d9 137
3f7eeb86 138/* Callbacks */
3bcbbbe2 139#ifdef EXIM_HAVE_OPENSSL_TLSEXT
3f7eeb86 140static int tls_servername_cb(SSL *s, int *ad ARG_UNUSED, void *arg);
3bcbbbe2 141#endif
f2de3a33 142#ifndef DISABLE_OCSP
f5d78688 143static int tls_server_stapling_cb(SSL *s, void *arg);
3f7eeb86
PP
144#endif
145
059ec3d9
PH
146
147/*************************************************
148* Handle TLS error *
149*************************************************/
150
151/* Called from lots of places when errors occur before actually starting to do
152the TLS handshake, that is, while the session is still in clear. Always returns
153DEFER for a server and FAIL for a client so that most calls can use "return
154tls_error(...)" to do this processing and then give an appropriate return. A
155single function is used for both server and client, because it is called from
156some shared functions.
157
158Argument:
159 prefix text to include in the logged error
160 host NULL if setting up a server;
161 the connected host if setting up a client
7199e1ee 162 msg error message or NULL if we should ask OpenSSL
059ec3d9
PH
163
164Returns: OK/DEFER/FAIL
165*/
166
167static int
7199e1ee 168tls_error(uschar *prefix, host_item *host, uschar *msg)
059ec3d9 169{
7199e1ee
TF
170if (msg == NULL)
171 {
172 ERR_error_string(ERR_get_error(), ssl_errstring);
5ca6d115 173 msg = (uschar *)ssl_errstring;
7199e1ee
TF
174 }
175
059ec3d9
PH
176if (host == NULL)
177 {
7199e1ee 178 uschar *conn_info = smtp_get_connection_info();
5ca6d115 179 if (Ustrncmp(conn_info, US"SMTP ", 5) == 0)
7199e1ee
TF
180 conn_info += 5;
181 log_write(0, LOG_MAIN, "TLS error on %s (%s): %s",
182 conn_info, prefix, msg);
059ec3d9
PH
183 return DEFER;
184 }
185else
186 {
187 log_write(0, LOG_MAIN, "TLS error on connection to %s [%s] (%s): %s",
7199e1ee 188 host->name, host->address, prefix, msg);
059ec3d9
PH
189 return FAIL;
190 }
191}
192
193
194
195/*************************************************
196* Callback to generate RSA key *
197*************************************************/
198
199/*
200Arguments:
201 s SSL connection
202 export not used
203 keylength keylength
204
205Returns: pointer to generated key
206*/
207
208static RSA *
209rsa_callback(SSL *s, int export, int keylength)
210{
211RSA *rsa_key;
212export = export; /* Shut picky compilers up */
213DEBUG(D_tls) debug_printf("Generating %d bit RSA key...\n", keylength);
214rsa_key = RSA_generate_key(keylength, RSA_F4, NULL, NULL);
215if (rsa_key == NULL)
216 {
217 ERR_error_string(ERR_get_error(), ssl_errstring);
218 log_write(0, LOG_MAIN|LOG_PANIC, "TLS error (RSA_generate_key): %s",
219 ssl_errstring);
220 return NULL;
221 }
222return rsa_key;
223}
224
225
226
f5d78688 227/* Extreme debug
f2de3a33 228#ifndef DISABLE_OCSP
f5d78688
JH
229void
230x509_store_dump_cert_s_names(X509_STORE * store)
231{
232STACK_OF(X509_OBJECT) * roots= store->objs;
233int i;
234static uschar name[256];
235
236for(i= 0; i<sk_X509_OBJECT_num(roots); i++)
237 {
238 X509_OBJECT * tmp_obj= sk_X509_OBJECT_value(roots, i);
239 if(tmp_obj->type == X509_LU_X509)
240 {
241 X509 * current_cert= tmp_obj->data.x509;
242 X509_NAME_oneline(X509_get_subject_name(current_cert), CS name, sizeof(name));
243 debug_printf(" %s\n", name);
244 }
245 }
246}
247#endif
248*/
249
059ec3d9
PH
250
251/*************************************************
252* Callback for verification *
253*************************************************/
254
255/* The SSL library does certificate verification if set up to do so. This
256callback has the current yes/no state is in "state". If verification succeeded,
257we set up the tls_peerdn string. If verification failed, what happens depends
258on whether the client is required to present a verifiable certificate or not.
259
260If verification is optional, we change the state to yes, but still log the
261verification error. For some reason (it really would help to have proper
262documentation of OpenSSL), this callback function then gets called again, this
263time with state = 1. In fact, that's useful, because we can set up the peerdn
264value, but we must take care not to set the private verified flag on the second
265time through.
266
267Note: this function is not called if the client fails to present a certificate
268when asked. We get here only if a certificate has been received. Handling of
269optional verification for this case is done when requesting SSL to verify, by
270setting SSL_VERIFY_FAIL_IF_NO_PEER_CERT in the non-optional case.
271
a7538db1
JH
272May be called multiple times for different issues with a certificate, even
273for a given "depth" in the certificate chain.
274
059ec3d9
PH
275Arguments:
276 state current yes/no state as 1/0
277 x509ctx certificate information.
a2ff477a 278 client TRUE for client startup, FALSE for server startup
059ec3d9
PH
279
280Returns: 1 if verified, 0 if not
281*/
282
283static int
421aff85
JH
284verify_callback(int state, X509_STORE_CTX *x509ctx,
285 tls_support *tlsp, BOOL *calledp, BOOL *optionalp)
059ec3d9 286{
421aff85 287X509 * cert = X509_STORE_CTX_get_current_cert(x509ctx);
a7538db1 288int depth = X509_STORE_CTX_get_error_depth(x509ctx);
059ec3d9
PH
289static uschar txt[256];
290
e51c7be2 291X509_NAME_oneline(X509_get_subject_name(cert), CS txt, sizeof(txt));
059ec3d9
PH
292
293if (state == 0)
294 {
295 log_write(0, LOG_MAIN, "SSL verify error: depth=%d error=%s cert=%s",
a7538db1 296 depth,
421aff85 297 X509_verify_cert_error_string(X509_STORE_CTX_get_error(x509ctx)),
059ec3d9 298 txt);
a2ff477a
JH
299 tlsp->certificate_verified = FALSE;
300 *calledp = TRUE;
9d1c15ef
JH
301 if (!*optionalp)
302 {
421aff85 303 tlsp->peercert = X509_dup(cert);
9d1c15ef
JH
304 return 0; /* reject */
305 }
059ec3d9
PH
306 DEBUG(D_tls) debug_printf("SSL verify failure overridden (host in "
307 "tls_try_verify_hosts)\n");
059ec3d9
PH
308 }
309
a7538db1 310else if (depth != 0)
059ec3d9 311 {
a7538db1 312 DEBUG(D_tls) debug_printf("SSL verify ok: depth=%d SN=%s\n", depth, txt);
f2de3a33 313#ifndef DISABLE_OCSP
f5d78688
JH
314 if (tlsp == &tls_out && client_static_cbinfo->u_ocsp.client.verify_store)
315 { /* client, wanting stapling */
316 /* Add the server cert's signing chain as the one
317 for the verification of the OCSP stapled information. */
318
319 if (!X509_STORE_add_cert(client_static_cbinfo->u_ocsp.client.verify_store,
421aff85 320 cert))
f5d78688
JH
321 ERR_clear_error();
322 }
323#endif
a7538db1
JH
324#ifdef EXPERIMENTAL_TPDA
325 if (tlsp == &tls_out && client_static_cbinfo->event_action)
326 {
327 tlsp->peercert = X509_dup(cert);
328 if (tpda_raise_event(client_static_cbinfo->event_action,
329 US"tls:cert", string_sprintf("%d", depth)) == DEFER)
330 {
331 log_write(0, LOG_MAIN, "SSL verify denied by event-action: "
332 "depth=%d cert=%s", depth, txt);
333 tlsp->certificate_verified = FALSE;
334 *calledp = TRUE;
335 return 0; /* reject */
336 }
337 X509_free(tlsp->peercert);
338 tlsp->peercert = NULL;
339 }
340#endif
059ec3d9
PH
341 }
342else
343 {
e51c7be2
JH
344#ifdef EXPERIMENTAL_CERTNAMES
345 uschar * verify_cert_hostnames;
346#endif
347
a2ff477a 348 tlsp->peerdn = txt;
421aff85 349 tlsp->peercert = X509_dup(cert);
e51c7be2
JH
350
351#ifdef EXPERIMENTAL_CERTNAMES
352 if ( tlsp == &tls_out
353 && ((verify_cert_hostnames = client_static_cbinfo->verify_cert_hostnames)))
354 /* client, wanting hostname check */
355
356# if OPENSSL_VERSION_NUMBER >= 0x010100000L || OPENSSL_VERSION_NUMBER >= 0x010002000L
d8e7834a
JH
357# ifndef X509_CHECK_FLAG_NO_PARTIAL_WILDCARDS
358# define X509_CHECK_FLAG_NO_PARTIAL_WILDCARDS 0
359# endif
e51c7be2
JH
360 {
361 int sep = 0;
362 uschar * list = verify_cert_hostnames;
363 uschar * name;
d8e7834a
JH
364 int rc;
365 while ((name = string_nextinlist(&list, &sep, NULL, 0)))
366 if ((rc = X509_check_host(cert, name, 0,
367 X509_CHECK_FLAG_NO_PARTIAL_WILDCARDS)))
368 {
369 if (rc < 0)
370 {
371 log_write(0, LOG_MAIN, "SSL verify error: internal error\n");
372 name = NULL;
373 }
e51c7be2 374 break;
d8e7834a 375 }
e51c7be2
JH
376 if (!name)
377 {
378 log_write(0, LOG_MAIN,
379 "SSL verify error: certificate name mismatch: \"%s\"\n", txt);
380 return 0; /* reject */
381 }
382 }
383# else
384 if (!tls_is_name_for_cert(verify_cert_hostnames, cert))
385 {
386 log_write(0, LOG_MAIN,
387 "SSL verify error: certificate name mismatch: \"%s\"\n", txt);
388 return 0; /* reject */
389 }
390# endif
e5cccda9 391#endif /*EXPERIMENTAL_CERTNAMES*/
e51c7be2 392
a7538db1
JH
393#ifdef EXPERIMENTAL_TPDA
394 if (tlsp == &tls_out)
395 {
396 if (tpda_raise_event(client_static_cbinfo->event_action,
397 US"tls:cert", US"0") == DEFER)
398 {
399 log_write(0, LOG_MAIN, "SSL verify denied by event-action: "
400 "depth=0 cert=%s", txt);
401 tlsp->certificate_verified = FALSE;
402 *calledp = TRUE;
403 return 0; /* reject */
404 }
405 }
e51c7be2
JH
406#endif
407
93dcb1c2
JH
408 DEBUG(D_tls) debug_printf("SSL%s verify ok: depth=0 SN=%s\n",
409 *calledp ? "" : " authenticated", txt);
410 if (!*calledp) tlsp->certificate_verified = TRUE;
411 *calledp = TRUE;
059ec3d9
PH
412 }
413
a7538db1 414return 1; /* accept, at least for this level */
059ec3d9
PH
415}
416
a2ff477a
JH
417static int
418verify_callback_client(int state, X509_STORE_CTX *x509ctx)
419{
f5d78688 420return verify_callback(state, x509ctx, &tls_out, &client_verify_callback_called, &client_verify_optional);
a2ff477a
JH
421}
422
423static int
424verify_callback_server(int state, X509_STORE_CTX *x509ctx)
425{
f5d78688 426return verify_callback(state, x509ctx, &tls_in, &server_verify_callback_called, &server_verify_optional);
a2ff477a
JH
427}
428
059ec3d9 429
e5cccda9 430#ifdef EXPERIMENTAL_DANE
53a7196b 431
e5cccda9
JH
432/* This gets called *by* the dane library verify callback, which interposes
433itself.
434*/
435static int
436verify_callback_client_dane(int state, X509_STORE_CTX * x509ctx)
437{
438X509 * cert = X509_STORE_CTX_get_current_cert(x509ctx);
439static uschar txt[256];
83b27293
JH
440#ifdef EXPERIMENTAL_TPDA
441int depth = X509_STORE_CTX_get_error_depth(x509ctx);
442#endif
e5cccda9
JH
443
444X509_NAME_oneline(X509_get_subject_name(cert), CS txt, sizeof(txt));
445
446DEBUG(D_tls) debug_printf("verify_callback_client_dane: %s\n", txt);
447tls_out.peerdn = txt;
448tls_out.peercert = X509_dup(cert);
449
83b27293
JH
450#ifdef EXPERIMENTAL_TPDA
451 if (client_static_cbinfo->event_action)
452 {
453 if (tpda_raise_event(client_static_cbinfo->event_action,
454 US"tls:cert", string_sprintf("%d", depth)) == DEFER)
455 {
456 log_write(0, LOG_MAIN, "DANE verify denied by event-action: "
457 "depth=%d cert=%s", depth, txt);
458 tls_out.certificate_verified = FALSE;
459 return 0; /* reject */
460 }
461 if (depth != 0)
462 {
463 X509_free(tls_out.peercert);
464 tls_out.peercert = NULL;
465 }
466 }
467#endif
468
e5cccda9 469if (state == 1)
53a7196b 470 tls_out.dane_verified =
e5cccda9
JH
471 tls_out.certificate_verified = TRUE;
472return 1;
473}
53a7196b
JH
474
475#endif /*EXPERIMENTAL_DANE*/
e5cccda9 476
059ec3d9
PH
477
478/*************************************************
479* Information callback *
480*************************************************/
481
482/* The SSL library functions call this from time to time to indicate what they
7be682ca
PP
483are doing. We copy the string to the debugging output when TLS debugging has
484been requested.
059ec3d9
PH
485
486Arguments:
487 s the SSL connection
488 where
489 ret
490
491Returns: nothing
492*/
493
494static void
495info_callback(SSL *s, int where, int ret)
496{
497where = where;
498ret = ret;
499DEBUG(D_tls) debug_printf("SSL info: %s\n", SSL_state_string_long(s));
500}
501
502
503
504/*************************************************
505* Initialize for DH *
506*************************************************/
507
508/* If dhparam is set, expand it, and load up the parameters for DH encryption.
509
510Arguments:
a799883d 511 dhparam DH parameter file or fixed parameter identity string
7199e1ee 512 host connected host, if client; NULL if server
059ec3d9
PH
513
514Returns: TRUE if OK (nothing to set up, or setup worked)
515*/
516
517static BOOL
a799883d 518init_dh(SSL_CTX *sctx, uschar *dhparam, host_item *host)
059ec3d9 519{
059ec3d9
PH
520BIO *bio;
521DH *dh;
522uschar *dhexpanded;
a799883d 523const char *pem;
059ec3d9
PH
524
525if (!expand_check(dhparam, US"tls_dhparam", &dhexpanded))
526 return FALSE;
527
0df4ab80 528if (!dhexpanded || !*dhexpanded)
a799883d 529 bio = BIO_new_mem_buf(CS std_dh_prime_default(), -1);
a799883d 530else if (dhexpanded[0] == '/')
059ec3d9 531 {
0df4ab80 532 if (!(bio = BIO_new_file(CS dhexpanded, "r")))
059ec3d9 533 {
7199e1ee 534 tls_error(string_sprintf("could not read dhparams file %s", dhexpanded),
a799883d
PP
535 host, US strerror(errno));
536 return FALSE;
059ec3d9 537 }
a799883d
PP
538 }
539else
540 {
541 if (Ustrcmp(dhexpanded, "none") == 0)
059ec3d9 542 {
a799883d
PP
543 DEBUG(D_tls) debug_printf("Requested no DH parameters.\n");
544 return TRUE;
059ec3d9 545 }
a799883d 546
0df4ab80 547 if (!(pem = std_dh_prime_named(dhexpanded)))
a799883d
PP
548 {
549 tls_error(string_sprintf("Unknown standard DH prime \"%s\"", dhexpanded),
550 host, US strerror(errno));
551 return FALSE;
552 }
553 bio = BIO_new_mem_buf(CS pem, -1);
554 }
555
0df4ab80 556if (!(dh = PEM_read_bio_DHparams(bio, NULL, NULL, NULL)))
a799883d 557 {
059ec3d9 558 BIO_free(bio);
a799883d
PP
559 tls_error(string_sprintf("Could not read tls_dhparams \"%s\"", dhexpanded),
560 host, NULL);
561 return FALSE;
562 }
563
564/* Even if it is larger, we silently return success rather than cause things
565 * to fail out, so that a too-large DH will not knock out all TLS; it's a
566 * debatable choice. */
567if ((8*DH_size(dh)) > tls_dh_max_bits)
568 {
569 DEBUG(D_tls)
570 debug_printf("dhparams file %d bits, is > tls_dh_max_bits limit of %d",
571 8*DH_size(dh), tls_dh_max_bits);
572 }
573else
574 {
575 SSL_CTX_set_tmp_dh(sctx, dh);
576 DEBUG(D_tls)
577 debug_printf("Diffie-Hellman initialized from %s with %d-bit prime\n",
578 dhexpanded ? dhexpanded : US"default", 8*DH_size(dh));
059ec3d9
PH
579 }
580
a799883d
PP
581DH_free(dh);
582BIO_free(bio);
583
584return TRUE;
059ec3d9
PH
585}
586
587
588
589
f2de3a33 590#ifndef DISABLE_OCSP
3f7eeb86
PP
591/*************************************************
592* Load OCSP information into state *
593*************************************************/
594
f5d78688 595/* Called to load the server OCSP response from the given file into memory, once
3f7eeb86
PP
596caller has determined this is needed. Checks validity. Debugs a message
597if invalid.
598
599ASSUMES: single response, for single cert.
600
601Arguments:
602 sctx the SSL_CTX* to update
603 cbinfo various parts of session state
604 expanded the filename putatively holding an OCSP response
605
606*/
607
608static void
f5d78688 609ocsp_load_response(SSL_CTX *sctx, tls_ext_ctx_cb *cbinfo, const uschar *expanded)
3f7eeb86
PP
610{
611BIO *bio;
612OCSP_RESPONSE *resp;
613OCSP_BASICRESP *basic_response;
614OCSP_SINGLERESP *single_response;
615ASN1_GENERALIZEDTIME *rev, *thisupd, *nextupd;
616X509_STORE *store;
617unsigned long verify_flags;
618int status, reason, i;
619
f5d78688
JH
620cbinfo->u_ocsp.server.file_expanded = string_copy(expanded);
621if (cbinfo->u_ocsp.server.response)
3f7eeb86 622 {
f5d78688
JH
623 OCSP_RESPONSE_free(cbinfo->u_ocsp.server.response);
624 cbinfo->u_ocsp.server.response = NULL;
3f7eeb86
PP
625 }
626
f5d78688 627bio = BIO_new_file(CS cbinfo->u_ocsp.server.file_expanded, "rb");
3f7eeb86
PP
628if (!bio)
629 {
630 DEBUG(D_tls) debug_printf("Failed to open OCSP response file \"%s\"\n",
f5d78688 631 cbinfo->u_ocsp.server.file_expanded);
3f7eeb86
PP
632 return;
633 }
634
635resp = d2i_OCSP_RESPONSE_bio(bio, NULL);
636BIO_free(bio);
637if (!resp)
638 {
639 DEBUG(D_tls) debug_printf("Error reading OCSP response.\n");
640 return;
641 }
642
643status = OCSP_response_status(resp);
644if (status != OCSP_RESPONSE_STATUS_SUCCESSFUL)
645 {
646 DEBUG(D_tls) debug_printf("OCSP response not valid: %s (%d)\n",
647 OCSP_response_status_str(status), status);
f5d78688 648 goto bad;
3f7eeb86
PP
649 }
650
651basic_response = OCSP_response_get1_basic(resp);
652if (!basic_response)
653 {
654 DEBUG(D_tls)
655 debug_printf("OCSP response parse error: unable to extract basic response.\n");
f5d78688 656 goto bad;
3f7eeb86
PP
657 }
658
659store = SSL_CTX_get_cert_store(sctx);
660verify_flags = OCSP_NOVERIFY; /* check sigs, but not purpose */
661
662/* May need to expose ability to adjust those flags?
663OCSP_NOSIGS OCSP_NOVERIFY OCSP_NOCHAIN OCSP_NOCHECKS OCSP_NOEXPLICIT
664OCSP_TRUSTOTHER OCSP_NOINTERN */
665
666i = OCSP_basic_verify(basic_response, NULL, store, verify_flags);
667if (i <= 0)
668 {
669 DEBUG(D_tls) {
670 ERR_error_string(ERR_get_error(), ssl_errstring);
671 debug_printf("OCSP response verify failure: %s\n", US ssl_errstring);
f5d78688
JH
672 }
673 goto bad;
3f7eeb86
PP
674 }
675
676/* Here's the simplifying assumption: there's only one response, for the
677one certificate we use, and nothing for anything else in a chain. If this
678proves false, we need to extract a cert id from our issued cert
679(tls_certificate) and use that for OCSP_resp_find_status() (which finds the
680right cert in the stack and then calls OCSP_single_get0_status()).
681
682I'm hoping to avoid reworking a bunch more of how we handle state here. */
683single_response = OCSP_resp_get0(basic_response, 0);
684if (!single_response)
685 {
686 DEBUG(D_tls)
687 debug_printf("Unable to get first response from OCSP basic response.\n");
f5d78688 688 goto bad;
3f7eeb86
PP
689 }
690
691status = OCSP_single_get0_status(single_response, &reason, &rev, &thisupd, &nextupd);
f5d78688 692if (status != V_OCSP_CERTSTATUS_GOOD)
3f7eeb86 693 {
f5d78688
JH
694 DEBUG(D_tls) debug_printf("OCSP response bad cert status: %s (%d) %s (%d)\n",
695 OCSP_cert_status_str(status), status,
696 OCSP_crl_reason_str(reason), reason);
697 goto bad;
3f7eeb86
PP
698 }
699
700if (!OCSP_check_validity(thisupd, nextupd, EXIM_OCSP_SKEW_SECONDS, EXIM_OCSP_MAX_AGE))
701 {
702 DEBUG(D_tls) debug_printf("OCSP status invalid times.\n");
f5d78688 703 goto bad;
3f7eeb86
PP
704 }
705
f5d78688 706supply_response:
018058b2 707 cbinfo->u_ocsp.server.response = resp;
f5d78688
JH
708return;
709
710bad:
018058b2
JH
711 if (running_in_test_harness)
712 {
713 extern char ** environ;
714 uschar ** p;
715 for (p = USS environ; *p != NULL; p++)
716 if (Ustrncmp(*p, "EXIM_TESTHARNESS_DISABLE_OCSPVALIDITYCHECK", 42) == 0)
717 {
718 DEBUG(D_tls) debug_printf("Supplying known bad OCSP response\n");
719 goto supply_response;
720 }
721 }
f5d78688 722return;
3f7eeb86 723}
f2de3a33 724#endif /*!DISABLE_OCSP*/
3f7eeb86
PP
725
726
727
728
059ec3d9 729/*************************************************
7be682ca
PP
730* Expand key and cert file specs *
731*************************************************/
732
f5d78688 733/* Called once during tls_init and possibly again during TLS setup, for a
7be682ca
PP
734new context, if Server Name Indication was used and tls_sni was seen in
735the certificate string.
736
737Arguments:
738 sctx the SSL_CTX* to update
739 cbinfo various parts of session state
740
741Returns: OK/DEFER/FAIL
742*/
743
744static int
3f7eeb86 745tls_expand_session_files(SSL_CTX *sctx, tls_ext_ctx_cb *cbinfo)
7be682ca
PP
746{
747uschar *expanded;
748
749if (cbinfo->certificate == NULL)
750 return OK;
751
d9b2312b
JH
752if (Ustrstr(cbinfo->certificate, US"tls_sni") ||
753 Ustrstr(cbinfo->certificate, US"tls_in_sni") ||
754 Ustrstr(cbinfo->certificate, US"tls_out_sni")
755 )
7be682ca
PP
756 reexpand_tls_files_for_sni = TRUE;
757
758if (!expand_check(cbinfo->certificate, US"tls_certificate", &expanded))
759 return DEFER;
760
761if (expanded != NULL)
762 {
763 DEBUG(D_tls) debug_printf("tls_certificate file %s\n", expanded);
764 if (!SSL_CTX_use_certificate_chain_file(sctx, CS expanded))
765 return tls_error(string_sprintf(
766 "SSL_CTX_use_certificate_chain_file file=%s", expanded),
767 cbinfo->host, NULL);
768 }
769
770if (cbinfo->privatekey != NULL &&
771 !expand_check(cbinfo->privatekey, US"tls_privatekey", &expanded))
772 return DEFER;
773
774/* If expansion was forced to fail, key_expanded will be NULL. If the result
775of the expansion is an empty string, ignore it also, and assume the private
776key is in the same file as the certificate. */
777
778if (expanded != NULL && *expanded != 0)
779 {
780 DEBUG(D_tls) debug_printf("tls_privatekey file %s\n", expanded);
781 if (!SSL_CTX_use_PrivateKey_file(sctx, CS expanded, SSL_FILETYPE_PEM))
782 return tls_error(string_sprintf(
783 "SSL_CTX_use_PrivateKey_file file=%s", expanded), cbinfo->host, NULL);
784 }
785
f2de3a33 786#ifndef DISABLE_OCSP
f5d78688 787if (cbinfo->is_server && cbinfo->u_ocsp.server.file != NULL)
3f7eeb86 788 {
f5d78688 789 if (!expand_check(cbinfo->u_ocsp.server.file, US"tls_ocsp_file", &expanded))
3f7eeb86
PP
790 return DEFER;
791
792 if (expanded != NULL && *expanded != 0)
793 {
794 DEBUG(D_tls) debug_printf("tls_ocsp_file %s\n", expanded);
f5d78688
JH
795 if (cbinfo->u_ocsp.server.file_expanded &&
796 (Ustrcmp(expanded, cbinfo->u_ocsp.server.file_expanded) == 0))
3f7eeb86
PP
797 {
798 DEBUG(D_tls)
799 debug_printf("tls_ocsp_file value unchanged, using existing values.\n");
800 } else {
801 ocsp_load_response(sctx, cbinfo, expanded);
802 }
803 }
804 }
805#endif
806
7be682ca
PP
807return OK;
808}
809
810
811
812
813/*************************************************
814* Callback to handle SNI *
815*************************************************/
816
817/* Called when acting as server during the TLS session setup if a Server Name
818Indication extension was sent by the client.
819
820API documentation is OpenSSL s_server.c implementation.
821
822Arguments:
823 s SSL* of the current session
824 ad unknown (part of OpenSSL API) (unused)
825 arg Callback of "our" registered data
826
827Returns: SSL_TLSEXT_ERR_{OK,ALERT_WARNING,ALERT_FATAL,NOACK}
828*/
829
3bcbbbe2 830#ifdef EXIM_HAVE_OPENSSL_TLSEXT
7be682ca 831static int
7be682ca
PP
832tls_servername_cb(SSL *s, int *ad ARG_UNUSED, void *arg)
833{
834const char *servername = SSL_get_servername(s, TLSEXT_NAMETYPE_host_name);
3f7eeb86 835tls_ext_ctx_cb *cbinfo = (tls_ext_ctx_cb *) arg;
7be682ca 836int rc;
3f0945ff 837int old_pool = store_pool;
7be682ca
PP
838
839if (!servername)
840 return SSL_TLSEXT_ERR_OK;
841
3f0945ff 842DEBUG(D_tls) debug_printf("Received TLS SNI \"%s\"%s\n", servername,
7be682ca
PP
843 reexpand_tls_files_for_sni ? "" : " (unused for certificate selection)");
844
845/* Make the extension value available for expansion */
3f0945ff 846store_pool = POOL_PERM;
817d9f57 847tls_in.sni = string_copy(US servername);
3f0945ff 848store_pool = old_pool;
7be682ca
PP
849
850if (!reexpand_tls_files_for_sni)
851 return SSL_TLSEXT_ERR_OK;
852
853/* Can't find an SSL_CTX_clone() or equivalent, so we do it manually;
854not confident that memcpy wouldn't break some internal reference counting.
855Especially since there's a references struct member, which would be off. */
856
0df4ab80 857if (!(server_sni = SSL_CTX_new(SSLv23_server_method())))
7be682ca
PP
858 {
859 ERR_error_string(ERR_get_error(), ssl_errstring);
860 DEBUG(D_tls) debug_printf("SSL_CTX_new() failed: %s\n", ssl_errstring);
861 return SSL_TLSEXT_ERR_NOACK;
862 }
863
864/* Not sure how many of these are actually needed, since SSL object
865already exists. Might even need this selfsame callback, for reneg? */
866
817d9f57
JH
867SSL_CTX_set_info_callback(server_sni, SSL_CTX_get_info_callback(server_ctx));
868SSL_CTX_set_mode(server_sni, SSL_CTX_get_mode(server_ctx));
869SSL_CTX_set_options(server_sni, SSL_CTX_get_options(server_ctx));
870SSL_CTX_set_timeout(server_sni, SSL_CTX_get_timeout(server_ctx));
871SSL_CTX_set_tlsext_servername_callback(server_sni, tls_servername_cb);
872SSL_CTX_set_tlsext_servername_arg(server_sni, cbinfo);
7be682ca 873if (cbinfo->server_cipher_list)
817d9f57 874 SSL_CTX_set_cipher_list(server_sni, CS cbinfo->server_cipher_list);
f2de3a33 875#ifndef DISABLE_OCSP
f5d78688 876if (cbinfo->u_ocsp.server.file)
3f7eeb86 877 {
f5d78688 878 SSL_CTX_set_tlsext_status_cb(server_sni, tls_server_stapling_cb);
14c7b357 879 SSL_CTX_set_tlsext_status_arg(server_sni, cbinfo);
3f7eeb86
PP
880 }
881#endif
7be682ca 882
983207c1 883rc = setup_certs(server_sni, tls_verify_certificates, tls_crl, NULL, FALSE, verify_callback_server);
7be682ca
PP
884if (rc != OK) return SSL_TLSEXT_ERR_NOACK;
885
3f7eeb86
PP
886/* do this after setup_certs, because this can require the certs for verifying
887OCSP information. */
817d9f57 888rc = tls_expand_session_files(server_sni, cbinfo);
7be682ca
PP
889if (rc != OK) return SSL_TLSEXT_ERR_NOACK;
890
0df4ab80
JH
891if (!init_dh(server_sni, cbinfo->dhparam, NULL))
892 return SSL_TLSEXT_ERR_NOACK;
a799883d 893
7be682ca 894DEBUG(D_tls) debug_printf("Switching SSL context.\n");
817d9f57 895SSL_set_SSL_CTX(s, server_sni);
7be682ca
PP
896
897return SSL_TLSEXT_ERR_OK;
898}
3bcbbbe2 899#endif /* EXIM_HAVE_OPENSSL_TLSEXT */
7be682ca
PP
900
901
902
903
f2de3a33 904#ifndef DISABLE_OCSP
f5d78688 905
3f7eeb86
PP
906/*************************************************
907* Callback to handle OCSP Stapling *
908*************************************************/
909
910/* Called when acting as server during the TLS session setup if the client
911requests OCSP information with a Certificate Status Request.
912
913Documentation via openssl s_server.c and the Apache patch from the OpenSSL
914project.
915
916*/
917
918static int
f5d78688 919tls_server_stapling_cb(SSL *s, void *arg)
3f7eeb86
PP
920{
921const tls_ext_ctx_cb *cbinfo = (tls_ext_ctx_cb *) arg;
922uschar *response_der;
923int response_der_len;
924
af4a1bca
JH
925DEBUG(D_tls)
926 debug_printf("Received TLS status request (OCSP stapling); %s response.",
f5d78688
JH
927 cbinfo->u_ocsp.server.response ? "have" : "lack");
928
44662487 929tls_in.ocsp = OCSP_NOT_RESP;
f5d78688 930if (!cbinfo->u_ocsp.server.response)
3f7eeb86
PP
931 return SSL_TLSEXT_ERR_NOACK;
932
933response_der = NULL;
44662487
JH
934response_der_len = i2d_OCSP_RESPONSE(cbinfo->u_ocsp.server.response,
935 &response_der);
3f7eeb86
PP
936if (response_der_len <= 0)
937 return SSL_TLSEXT_ERR_NOACK;
938
5e55c7a9 939SSL_set_tlsext_status_ocsp_resp(server_ssl, response_der, response_der_len);
44662487 940tls_in.ocsp = OCSP_VFIED;
3f7eeb86
PP
941return SSL_TLSEXT_ERR_OK;
942}
943
3f7eeb86 944
f5d78688
JH
945static void
946time_print(BIO * bp, const char * str, ASN1_GENERALIZEDTIME * time)
947{
948BIO_printf(bp, "\t%s: ", str);
949ASN1_GENERALIZEDTIME_print(bp, time);
950BIO_puts(bp, "\n");
951}
952
953static int
954tls_client_stapling_cb(SSL *s, void *arg)
955{
956tls_ext_ctx_cb * cbinfo = arg;
957const unsigned char * p;
958int len;
959OCSP_RESPONSE * rsp;
960OCSP_BASICRESP * bs;
961int i;
962
963DEBUG(D_tls) debug_printf("Received TLS status response (OCSP stapling):");
964len = SSL_get_tlsext_status_ocsp_resp(s, &p);
965if(!p)
966 {
44662487
JH
967 /* Expect this when we requested ocsp but got none */
968 if ( cbinfo->u_ocsp.client.verify_required
969 && log_extra_selector & LX_tls_cipher)
970 log_write(0, LOG_MAIN, "Received TLS status callback, null content");
f5d78688
JH
971 else
972 DEBUG(D_tls) debug_printf(" null\n");
44662487 973 return cbinfo->u_ocsp.client.verify_required ? 0 : 1;
f5d78688 974 }
018058b2 975
f5d78688
JH
976if(!(rsp = d2i_OCSP_RESPONSE(NULL, &p, len)))
977 {
018058b2 978 tls_out.ocsp = OCSP_FAILED;
f5d78688 979 if (log_extra_selector & LX_tls_cipher)
1eca31ca 980 log_write(0, LOG_MAIN, "Received TLS cert status response, parse error");
f5d78688
JH
981 else
982 DEBUG(D_tls) debug_printf(" parse error\n");
983 return 0;
984 }
985
986if(!(bs = OCSP_response_get1_basic(rsp)))
987 {
018058b2 988 tls_out.ocsp = OCSP_FAILED;
f5d78688 989 if (log_extra_selector & LX_tls_cipher)
1eca31ca 990 log_write(0, LOG_MAIN, "Received TLS cert status response, error parsing response");
f5d78688
JH
991 else
992 DEBUG(D_tls) debug_printf(" error parsing response\n");
993 OCSP_RESPONSE_free(rsp);
994 return 0;
995 }
996
997/* We'd check the nonce here if we'd put one in the request. */
998/* However that would defeat cacheability on the server so we don't. */
999
f5d78688
JH
1000/* This section of code reworked from OpenSSL apps source;
1001 The OpenSSL Project retains copyright:
1002 Copyright (c) 1999 The OpenSSL Project. All rights reserved.
1003*/
1004 {
1005 BIO * bp = NULL;
f5d78688
JH
1006 int status, reason;
1007 ASN1_GENERALIZEDTIME *rev, *thisupd, *nextupd;
1008
1009 DEBUG(D_tls) bp = BIO_new_fp(stderr, BIO_NOCLOSE);
1010
1011 /*OCSP_RESPONSE_print(bp, rsp, 0); extreme debug: stapling content */
1012
1013 /* Use the chain that verified the server cert to verify the stapled info */
1014 /* DEBUG(D_tls) x509_store_dump_cert_s_names(cbinfo->u_ocsp.client.verify_store); */
1015
44662487
JH
1016 if ((i = OCSP_basic_verify(bs, NULL,
1017 cbinfo->u_ocsp.client.verify_store, 0)) <= 0)
f5d78688 1018 {
018058b2 1019 tls_out.ocsp = OCSP_FAILED;
1eca31ca
JH
1020 if (log_extra_selector & LX_tls_cipher)
1021 log_write(0, LOG_MAIN, "Received TLS cert status response, itself unverifiable");
f5d78688
JH
1022 BIO_printf(bp, "OCSP response verify failure\n");
1023 ERR_print_errors(bp);
44662487 1024 i = cbinfo->u_ocsp.client.verify_required ? 0 : 1;
f5d78688
JH
1025 goto out;
1026 }
1027
1028 BIO_printf(bp, "OCSP response well-formed and signed OK\n");
1029
1030 {
1031 STACK_OF(OCSP_SINGLERESP) * sresp = bs->tbsResponseData->responses;
1032 OCSP_SINGLERESP * single;
1033
1034 if (sk_OCSP_SINGLERESP_num(sresp) != 1)
1035 {
018058b2 1036 tls_out.ocsp = OCSP_FAILED;
44662487
JH
1037 log_write(0, LOG_MAIN, "OCSP stapling "
1038 "with multiple responses not handled");
1039 i = cbinfo->u_ocsp.client.verify_required ? 0 : 1;
f5d78688
JH
1040 goto out;
1041 }
1042 single = OCSP_resp_get0(bs, 0);
44662487
JH
1043 status = OCSP_single_get0_status(single, &reason, &rev,
1044 &thisupd, &nextupd);
f5d78688
JH
1045 }
1046
f5d78688
JH
1047 DEBUG(D_tls) time_print(bp, "This OCSP Update", thisupd);
1048 DEBUG(D_tls) if(nextupd) time_print(bp, "Next OCSP Update", nextupd);
44662487
JH
1049 if (!OCSP_check_validity(thisupd, nextupd,
1050 EXIM_OCSP_SKEW_SECONDS, EXIM_OCSP_MAX_AGE))
f5d78688 1051 {
018058b2 1052 tls_out.ocsp = OCSP_FAILED;
f5d78688
JH
1053 DEBUG(D_tls) ERR_print_errors(bp);
1054 log_write(0, LOG_MAIN, "Server OSCP dates invalid");
44662487 1055 i = cbinfo->u_ocsp.client.verify_required ? 0 : 1;
f5d78688 1056 }
44662487 1057 else
f5d78688 1058 {
44662487
JH
1059 DEBUG(D_tls) BIO_printf(bp, "Certificate status: %s\n",
1060 OCSP_cert_status_str(status));
1061 switch(status)
1062 {
1063 case V_OCSP_CERTSTATUS_GOOD:
44662487 1064 tls_out.ocsp = OCSP_VFIED;
018058b2 1065 i = 1;
44662487
JH
1066 break;
1067 case V_OCSP_CERTSTATUS_REVOKED:
018058b2 1068 tls_out.ocsp = OCSP_FAILED;
44662487
JH
1069 log_write(0, LOG_MAIN, "Server certificate revoked%s%s",
1070 reason != -1 ? "; reason: " : "",
1071 reason != -1 ? OCSP_crl_reason_str(reason) : "");
1072 DEBUG(D_tls) time_print(bp, "Revocation Time", rev);
1073 i = cbinfo->u_ocsp.client.verify_required ? 0 : 1;
1074 break;
1075 default:
018058b2 1076 tls_out.ocsp = OCSP_FAILED;
44662487
JH
1077 log_write(0, LOG_MAIN,
1078 "Server certificate status unknown, in OCSP stapling");
1079 i = cbinfo->u_ocsp.client.verify_required ? 0 : 1;
1080 break;
1081 }
f5d78688
JH
1082 }
1083 out:
1084 BIO_free(bp);
1085 }
1086
1087OCSP_RESPONSE_free(rsp);
1088return i;
1089}
f2de3a33 1090#endif /*!DISABLE_OCSP*/
3f7eeb86
PP
1091
1092
7be682ca 1093/*************************************************
059ec3d9
PH
1094* Initialize for TLS *
1095*************************************************/
1096
e51c7be2
JH
1097/* Called from both server and client code, to do preliminary initialization
1098of the library. We allocate and return a context structure.
059ec3d9
PH
1099
1100Arguments:
946ecbe0 1101 ctxp returned SSL context
059ec3d9
PH
1102 host connected host, if client; NULL if server
1103 dhparam DH parameter file
1104 certificate certificate file
1105 privatekey private key
f5d78688 1106 ocsp_file file of stapling info (server); flag for require ocsp (client)
059ec3d9 1107 addr address if client; NULL if server (for some randomness)
946ecbe0 1108 cbp place to put allocated callback context
059ec3d9
PH
1109
1110Returns: OK/DEFER/FAIL
1111*/
1112
1113static int
817d9f57 1114tls_init(SSL_CTX **ctxp, host_item *host, uschar *dhparam, uschar *certificate,
3f7eeb86 1115 uschar *privatekey,
f2de3a33 1116#ifndef DISABLE_OCSP
3f7eeb86
PP
1117 uschar *ocsp_file,
1118#endif
817d9f57 1119 address_item *addr, tls_ext_ctx_cb ** cbp)
059ec3d9 1120{
77bb000f 1121long init_options;
7be682ca 1122int rc;
77bb000f 1123BOOL okay;
a7538db1 1124tls_ext_ctx_cb * cbinfo;
7be682ca
PP
1125
1126cbinfo = store_malloc(sizeof(tls_ext_ctx_cb));
1127cbinfo->certificate = certificate;
1128cbinfo->privatekey = privatekey;
f2de3a33 1129#ifndef DISABLE_OCSP
f5d78688
JH
1130if ((cbinfo->is_server = host==NULL))
1131 {
1132 cbinfo->u_ocsp.server.file = ocsp_file;
1133 cbinfo->u_ocsp.server.file_expanded = NULL;
1134 cbinfo->u_ocsp.server.response = NULL;
1135 }
1136else
1137 cbinfo->u_ocsp.client.verify_store = NULL;
3f7eeb86 1138#endif
7be682ca 1139cbinfo->dhparam = dhparam;
0df4ab80 1140cbinfo->server_cipher_list = NULL;
7be682ca 1141cbinfo->host = host;
a7538db1
JH
1142#ifdef EXPERIMENTAL_TPDA
1143cbinfo->event_action = NULL;
1144#endif
77bb000f 1145
059ec3d9
PH
1146SSL_load_error_strings(); /* basic set up */
1147OpenSSL_add_ssl_algorithms();
1148
388d6564 1149#if (OPENSSL_VERSION_NUMBER >= 0x0090800fL) && !defined(OPENSSL_NO_SHA256)
77bb000f 1150/* SHA256 is becoming ever more popular. This makes sure it gets added to the
a0475b69
TK
1151list of available digests. */
1152EVP_add_digest(EVP_sha256());
cf1ef1a9 1153#endif
a0475b69 1154
f0f5a555
PP
1155/* Create a context.
1156The OpenSSL docs in 1.0.1b have not been updated to clarify TLS variant
1157negotiation in the different methods; as far as I can tell, the only
1158*_{server,client}_method which allows negotiation is SSLv23, which exists even
1159when OpenSSL is built without SSLv2 support.
1160By disabling with openssl_options, we can let admins re-enable with the
1161existing knob. */
059ec3d9 1162
817d9f57 1163*ctxp = SSL_CTX_new((host == NULL)?
059ec3d9
PH
1164 SSLv23_server_method() : SSLv23_client_method());
1165
817d9f57 1166if (*ctxp == NULL) return tls_error(US"SSL_CTX_new", host, NULL);
059ec3d9
PH
1167
1168/* It turns out that we need to seed the random number generator this early in
1169order to get the full complement of ciphers to work. It took me roughly a day
1170of work to discover this by experiment.
1171
1172On systems that have /dev/urandom, SSL may automatically seed itself from
1173there. Otherwise, we have to make something up as best we can. Double check
1174afterwards. */
1175
1176if (!RAND_status())
1177 {
1178 randstuff r;
9e3331ea 1179 gettimeofday(&r.tv, NULL);
059ec3d9
PH
1180 r.p = getpid();
1181
1182 RAND_seed((uschar *)(&r), sizeof(r));
1183 RAND_seed((uschar *)big_buffer, big_buffer_size);
1184 if (addr != NULL) RAND_seed((uschar *)addr, sizeof(addr));
1185
1186 if (!RAND_status())
7199e1ee 1187 return tls_error(US"RAND_status", host,
5ca6d115 1188 US"unable to seed random number generator");
059ec3d9
PH
1189 }
1190
1191/* Set up the information callback, which outputs if debugging is at a suitable
1192level. */
1193
817d9f57 1194SSL_CTX_set_info_callback(*ctxp, (void (*)())info_callback);
059ec3d9 1195
c80c5570 1196/* Automatically re-try reads/writes after renegotiation. */
817d9f57 1197(void) SSL_CTX_set_mode(*ctxp, SSL_MODE_AUTO_RETRY);
c80c5570 1198
77bb000f
PP
1199/* Apply administrator-supplied work-arounds.
1200Historically we applied just one requested option,
1201SSL_OP_DONT_INSERT_EMPTY_FRAGMENTS, but when bug 994 requested a second, we
1202moved to an administrator-controlled list of options to specify and
1203grandfathered in the first one as the default value for "openssl_options".
059ec3d9 1204
77bb000f
PP
1205No OpenSSL version number checks: the options we accept depend upon the
1206availability of the option value macros from OpenSSL. */
059ec3d9 1207
77bb000f
PP
1208okay = tls_openssl_options_parse(openssl_options, &init_options);
1209if (!okay)
73a46702 1210 return tls_error(US"openssl_options parsing failed", host, NULL);
77bb000f
PP
1211
1212if (init_options)
1213 {
1214 DEBUG(D_tls) debug_printf("setting SSL CTX options: %#lx\n", init_options);
817d9f57 1215 if (!(SSL_CTX_set_options(*ctxp, init_options)))
77bb000f
PP
1216 return tls_error(string_sprintf(
1217 "SSL_CTX_set_option(%#lx)", init_options), host, NULL);
1218 }
1219else
1220 DEBUG(D_tls) debug_printf("no SSL CTX options to set\n");
059ec3d9
PH
1221
1222/* Initialize with DH parameters if supplied */
1223
817d9f57 1224if (!init_dh(*ctxp, dhparam, host)) return DEFER;
059ec3d9 1225
3f7eeb86 1226/* Set up certificate and key (and perhaps OCSP info) */
059ec3d9 1227
817d9f57 1228rc = tls_expand_session_files(*ctxp, cbinfo);
7be682ca 1229if (rc != OK) return rc;
c91535f3 1230
7be682ca 1231/* If we need to handle SNI, do so */
3bcbbbe2 1232#ifdef EXIM_HAVE_OPENSSL_TLSEXT
f5d78688 1233if (host == NULL) /* server */
3f0945ff 1234 {
f2de3a33 1235# ifndef DISABLE_OCSP
f5d78688 1236 /* We check u_ocsp.server.file, not server.response, because we care about if
3f7eeb86
PP
1237 the option exists, not what the current expansion might be, as SNI might
1238 change the certificate and OCSP file in use between now and the time the
1239 callback is invoked. */
f5d78688 1240 if (cbinfo->u_ocsp.server.file)
3f7eeb86 1241 {
f5d78688 1242 SSL_CTX_set_tlsext_status_cb(server_ctx, tls_server_stapling_cb);
5e55c7a9 1243 SSL_CTX_set_tlsext_status_arg(server_ctx, cbinfo);
3f7eeb86 1244 }
f5d78688 1245# endif
3f0945ff
PP
1246 /* We always do this, so that $tls_sni is available even if not used in
1247 tls_certificate */
817d9f57
JH
1248 SSL_CTX_set_tlsext_servername_callback(*ctxp, tls_servername_cb);
1249 SSL_CTX_set_tlsext_servername_arg(*ctxp, cbinfo);
3f0945ff 1250 }
f2de3a33 1251# ifndef DISABLE_OCSP
f5d78688
JH
1252else /* client */
1253 if(ocsp_file) /* wanting stapling */
1254 {
1255 if (!(cbinfo->u_ocsp.client.verify_store = X509_STORE_new()))
1256 {
1257 DEBUG(D_tls) debug_printf("failed to create store for stapling verify\n");
1258 return FAIL;
1259 }
1260 SSL_CTX_set_tlsext_status_cb(*ctxp, tls_client_stapling_cb);
1261 SSL_CTX_set_tlsext_status_arg(*ctxp, cbinfo);
1262 }
1263# endif
7be682ca 1264#endif
059ec3d9 1265
e51c7be2
JH
1266#ifdef EXPERIMENTAL_CERTNAMES
1267cbinfo->verify_cert_hostnames = NULL;
1268#endif
1269
059ec3d9
PH
1270/* Set up the RSA callback */
1271
817d9f57 1272SSL_CTX_set_tmp_rsa_callback(*ctxp, rsa_callback);
059ec3d9
PH
1273
1274/* Finally, set the timeout, and we are done */
1275
817d9f57 1276SSL_CTX_set_timeout(*ctxp, ssl_session_timeout);
059ec3d9 1277DEBUG(D_tls) debug_printf("Initialized TLS\n");
7be682ca 1278
817d9f57 1279*cbp = cbinfo;
7be682ca 1280
059ec3d9
PH
1281return OK;
1282}
1283
1284
1285
1286
1287/*************************************************
1288* Get name of cipher in use *
1289*************************************************/
1290
817d9f57 1291/*
059ec3d9 1292Argument: pointer to an SSL structure for the connection
817d9f57
JH
1293 buffer to use for answer
1294 size of buffer
1295 pointer to number of bits for cipher
059ec3d9
PH
1296Returns: nothing
1297*/
1298
1299static void
817d9f57 1300construct_cipher_name(SSL *ssl, uschar *cipherbuf, int bsize, int *bits)
059ec3d9 1301{
57b3a7f5
PP
1302/* With OpenSSL 1.0.0a, this needs to be const but the documentation doesn't
1303yet reflect that. It should be a safe change anyway, even 0.9.8 versions have
1304the accessor functions use const in the prototype. */
1305const SSL_CIPHER *c;
d9784128 1306const uschar *ver;
059ec3d9 1307
d9784128 1308ver = (const uschar *)SSL_get_version(ssl);
059ec3d9 1309
57b3a7f5 1310c = (const SSL_CIPHER *) SSL_get_current_cipher(ssl);
817d9f57 1311SSL_CIPHER_get_bits(c, bits);
059ec3d9 1312
817d9f57
JH
1313string_format(cipherbuf, bsize, "%s:%s:%u", ver,
1314 SSL_CIPHER_get_name(c), *bits);
059ec3d9
PH
1315
1316DEBUG(D_tls) debug_printf("Cipher: %s\n", cipherbuf);
1317}
1318
1319
1320
1321
1322
1323/*************************************************
1324* Set up for verifying certificates *
1325*************************************************/
1326
1327/* Called by both client and server startup
1328
1329Arguments:
7be682ca 1330 sctx SSL_CTX* to initialise
059ec3d9
PH
1331 certs certs file or NULL
1332 crl CRL file or NULL
1333 host NULL in a server; the remote host in a client
1334 optional TRUE if called from a server for a host in tls_try_verify_hosts;
1335 otherwise passed as FALSE
983207c1 1336 cert_vfy_cb Callback function for certificate verification
059ec3d9
PH
1337
1338Returns: OK/DEFER/FAIL
1339*/
1340
1341static int
983207c1
JH
1342setup_certs(SSL_CTX *sctx, uschar *certs, uschar *crl, host_item *host, BOOL optional,
1343 int (*cert_vfy_cb)(int, X509_STORE_CTX *) )
059ec3d9
PH
1344{
1345uschar *expcerts, *expcrl;
1346
1347if (!expand_check(certs, US"tls_verify_certificates", &expcerts))
1348 return DEFER;
1349
26e72755 1350if (expcerts != NULL && *expcerts != '\0')
059ec3d9
PH
1351 {
1352 struct stat statbuf;
7be682ca 1353 if (!SSL_CTX_set_default_verify_paths(sctx))
7199e1ee 1354 return tls_error(US"SSL_CTX_set_default_verify_paths", host, NULL);
059ec3d9
PH
1355
1356 if (Ustat(expcerts, &statbuf) < 0)
1357 {
1358 log_write(0, LOG_MAIN|LOG_PANIC,
1359 "failed to stat %s for certificates", expcerts);
1360 return DEFER;
1361 }
1362 else
1363 {
1364 uschar *file, *dir;
1365 if ((statbuf.st_mode & S_IFMT) == S_IFDIR)
1366 { file = NULL; dir = expcerts; }
1367 else
1368 { file = expcerts; dir = NULL; }
1369
1370 /* If a certificate file is empty, the next function fails with an
1371 unhelpful error message. If we skip it, we get the correct behaviour (no
1372 certificates are recognized, but the error message is still misleading (it
1373 says no certificate was supplied.) But this is better. */
1374
1375 if ((file == NULL || statbuf.st_size > 0) &&
7be682ca 1376 !SSL_CTX_load_verify_locations(sctx, CS file, CS dir))
7199e1ee 1377 return tls_error(US"SSL_CTX_load_verify_locations", host, NULL);
059ec3d9 1378
3281c6ea
JH
1379 /* Load the list of CAs for which we will accept certs, for sending
1380 to the client. XXX only for file source, not dir? */
059ec3d9
PH
1381 if (file != NULL)
1382 {
3281c6ea
JH
1383 STACK_OF(X509_NAME) * names = SSL_load_client_CA_file(CS file);
1384DEBUG(D_tls) debug_printf("Added %d certificate authorities.\n",
1385 sk_X509_NAME_num(names));
1386 SSL_CTX_set_client_CA_list(sctx, names);
059ec3d9
PH
1387 }
1388 }
1389
1390 /* Handle a certificate revocation list. */
1391
1392 #if OPENSSL_VERSION_NUMBER > 0x00907000L
1393
8b417f2c
PH
1394 /* This bit of code is now the version supplied by Lars Mainka. (I have
1395 * merely reformatted it into the Exim code style.)
1396
1397 * "From here I changed the code to add support for multiple crl's
1398 * in pem format in one file or to support hashed directory entries in
1399 * pem format instead of a file. This method now uses the library function
1400 * X509_STORE_load_locations to add the CRL location to the SSL context.
1401 * OpenSSL will then handle the verify against CA certs and CRLs by
1402 * itself in the verify callback." */
1403
059ec3d9
PH
1404 if (!expand_check(crl, US"tls_crl", &expcrl)) return DEFER;
1405 if (expcrl != NULL && *expcrl != 0)
1406 {
8b417f2c
PH
1407 struct stat statbufcrl;
1408 if (Ustat(expcrl, &statbufcrl) < 0)
1409 {
1410 log_write(0, LOG_MAIN|LOG_PANIC,
1411 "failed to stat %s for certificates revocation lists", expcrl);
1412 return DEFER;
1413 }
1414 else
059ec3d9 1415 {
8b417f2c
PH
1416 /* is it a file or directory? */
1417 uschar *file, *dir;
7be682ca 1418 X509_STORE *cvstore = SSL_CTX_get_cert_store(sctx);
8b417f2c 1419 if ((statbufcrl.st_mode & S_IFMT) == S_IFDIR)
059ec3d9 1420 {
8b417f2c
PH
1421 file = NULL;
1422 dir = expcrl;
1423 DEBUG(D_tls) debug_printf("SSL CRL value is a directory %s\n", dir);
059ec3d9
PH
1424 }
1425 else
1426 {
8b417f2c
PH
1427 file = expcrl;
1428 dir = NULL;
1429 DEBUG(D_tls) debug_printf("SSL CRL value is a file %s\n", file);
059ec3d9 1430 }
8b417f2c 1431 if (X509_STORE_load_locations(cvstore, CS file, CS dir) == 0)
7199e1ee 1432 return tls_error(US"X509_STORE_load_locations", host, NULL);
8b417f2c
PH
1433
1434 /* setting the flags to check against the complete crl chain */
1435
1436 X509_STORE_set_flags(cvstore,
1437 X509_V_FLAG_CRL_CHECK|X509_V_FLAG_CRL_CHECK_ALL);
059ec3d9 1438 }
059ec3d9
PH
1439 }
1440
1441 #endif /* OPENSSL_VERSION_NUMBER > 0x00907000L */
1442
1443 /* If verification is optional, don't fail if no certificate */
1444
7be682ca 1445 SSL_CTX_set_verify(sctx,
059ec3d9 1446 SSL_VERIFY_PEER | (optional? 0 : SSL_VERIFY_FAIL_IF_NO_PEER_CERT),
983207c1 1447 cert_vfy_cb);
059ec3d9
PH
1448 }
1449
1450return OK;
1451}
1452
1453
1454
1455/*************************************************
1456* Start a TLS session in a server *
1457*************************************************/
1458
1459/* This is called when Exim is running as a server, after having received
1460the STARTTLS command. It must respond to that command, and then negotiate
1461a TLS session.
1462
1463Arguments:
1464 require_ciphers allowed ciphers
1465
1466Returns: OK on success
1467 DEFER for errors before the start of the negotiation
1468 FAIL for errors during the negotation; the server can't
1469 continue running.
1470*/
1471
1472int
17c76198 1473tls_server_start(const uschar *require_ciphers)
059ec3d9
PH
1474{
1475int rc;
1476uschar *expciphers;
7be682ca 1477tls_ext_ctx_cb *cbinfo;
817d9f57 1478static uschar cipherbuf[256];
059ec3d9
PH
1479
1480/* Check for previous activation */
1481
817d9f57 1482if (tls_in.active >= 0)
059ec3d9 1483 {
5ca6d115 1484 tls_error(US"STARTTLS received after TLS started", NULL, US"");
059ec3d9
PH
1485 smtp_printf("554 Already in TLS\r\n");
1486 return FAIL;
1487 }
1488
1489/* Initialize the SSL library. If it fails, it will already have logged
1490the error. */
1491
817d9f57 1492rc = tls_init(&server_ctx, NULL, tls_dhparam, tls_certificate, tls_privatekey,
f2de3a33 1493#ifndef DISABLE_OCSP
3f7eeb86
PP
1494 tls_ocsp_file,
1495#endif
817d9f57 1496 NULL, &server_static_cbinfo);
059ec3d9 1497if (rc != OK) return rc;
817d9f57 1498cbinfo = server_static_cbinfo;
059ec3d9
PH
1499
1500if (!expand_check(require_ciphers, US"tls_require_ciphers", &expciphers))
1501 return FAIL;
1502
1503/* In OpenSSL, cipher components are separated by hyphens. In GnuTLS, they
17c76198
PP
1504were historically separated by underscores. So that I can use either form in my
1505tests, and also for general convenience, we turn underscores into hyphens here.
1506*/
059ec3d9
PH
1507
1508if (expciphers != NULL)
1509 {
1510 uschar *s = expciphers;
1511 while (*s != 0) { if (*s == '_') *s = '-'; s++; }
1512 DEBUG(D_tls) debug_printf("required ciphers: %s\n", expciphers);
817d9f57 1513 if (!SSL_CTX_set_cipher_list(server_ctx, CS expciphers))
7199e1ee 1514 return tls_error(US"SSL_CTX_set_cipher_list", NULL, NULL);
7be682ca 1515 cbinfo->server_cipher_list = expciphers;
059ec3d9
PH
1516 }
1517
1518/* If this is a host for which certificate verification is mandatory or
1519optional, set up appropriately. */
1520
817d9f57 1521tls_in.certificate_verified = FALSE;
53a7196b
JH
1522#ifdef EXPERIMENTAL_DANE
1523tls_in.dane_verified = FALSE;
1524#endif
a2ff477a 1525server_verify_callback_called = FALSE;
059ec3d9
PH
1526
1527if (verify_check_host(&tls_verify_hosts) == OK)
1528 {
983207c1
JH
1529 rc = setup_certs(server_ctx, tls_verify_certificates, tls_crl, NULL,
1530 FALSE, verify_callback_server);
059ec3d9 1531 if (rc != OK) return rc;
a2ff477a 1532 server_verify_optional = FALSE;
059ec3d9
PH
1533 }
1534else if (verify_check_host(&tls_try_verify_hosts) == OK)
1535 {
983207c1
JH
1536 rc = setup_certs(server_ctx, tls_verify_certificates, tls_crl, NULL,
1537 TRUE, verify_callback_server);
059ec3d9 1538 if (rc != OK) return rc;
a2ff477a 1539 server_verify_optional = TRUE;
059ec3d9
PH
1540 }
1541
1542/* Prepare for new connection */
1543
817d9f57 1544if ((server_ssl = SSL_new(server_ctx)) == NULL) return tls_error(US"SSL_new", NULL, NULL);
da3ad30d
PP
1545
1546/* Warning: we used to SSL_clear(ssl) here, it was removed.
1547 *
1548 * With the SSL_clear(), we get strange interoperability bugs with
1549 * OpenSSL 1.0.1b and TLS1.1/1.2. It looks as though this may be a bug in
1550 * OpenSSL itself, as a clear should not lead to inability to follow protocols.
1551 *
1552 * The SSL_clear() call is to let an existing SSL* be reused, typically after
1553 * session shutdown. In this case, we have a brand new object and there's no
1554 * obvious reason to immediately clear it. I'm guessing that this was
1555 * originally added because of incomplete initialisation which the clear fixed,
1556 * in some historic release.
1557 */
059ec3d9
PH
1558
1559/* Set context and tell client to go ahead, except in the case of TLS startup
1560on connection, where outputting anything now upsets the clients and tends to
1561make them disconnect. We need to have an explicit fflush() here, to force out
1562the response. Other smtp_printf() calls do not need it, because in non-TLS
1563mode, the fflush() happens when smtp_getc() is called. */
1564
817d9f57
JH
1565SSL_set_session_id_context(server_ssl, sid_ctx, Ustrlen(sid_ctx));
1566if (!tls_in.on_connect)
059ec3d9
PH
1567 {
1568 smtp_printf("220 TLS go ahead\r\n");
1569 fflush(smtp_out);
1570 }
1571
1572/* Now negotiate the TLS session. We put our own timer on it, since it seems
1573that the OpenSSL library doesn't. */
1574
817d9f57
JH
1575SSL_set_wfd(server_ssl, fileno(smtp_out));
1576SSL_set_rfd(server_ssl, fileno(smtp_in));
1577SSL_set_accept_state(server_ssl);
059ec3d9
PH
1578
1579DEBUG(D_tls) debug_printf("Calling SSL_accept\n");
1580
1581sigalrm_seen = FALSE;
1582if (smtp_receive_timeout > 0) alarm(smtp_receive_timeout);
817d9f57 1583rc = SSL_accept(server_ssl);
059ec3d9
PH
1584alarm(0);
1585
1586if (rc <= 0)
1587 {
7199e1ee 1588 tls_error(US"SSL_accept", NULL, sigalrm_seen ? US"timed out" : NULL);
77bb000f
PP
1589 if (ERR_get_error() == 0)
1590 log_write(0, LOG_MAIN,
a053d125 1591 "TLS client disconnected cleanly (rejected our certificate?)");
059ec3d9
PH
1592 return FAIL;
1593 }
1594
1595DEBUG(D_tls) debug_printf("SSL_accept was successful\n");
1596
1597/* TLS has been set up. Adjust the input functions to read via TLS,
1598and initialize things. */
1599
817d9f57
JH
1600construct_cipher_name(server_ssl, cipherbuf, sizeof(cipherbuf), &tls_in.bits);
1601tls_in.cipher = cipherbuf;
059ec3d9
PH
1602
1603DEBUG(D_tls)
1604 {
1605 uschar buf[2048];
817d9f57 1606 if (SSL_get_shared_ciphers(server_ssl, CS buf, sizeof(buf)) != NULL)
059ec3d9
PH
1607 debug_printf("Shared ciphers: %s\n", buf);
1608 }
1609
9d1c15ef
JH
1610/* Record the certificate we presented */
1611 {
1612 X509 * crt = SSL_get_certificate(server_ssl);
1613 tls_in.ourcert = crt ? X509_dup(crt) : NULL;
1614 }
059ec3d9 1615
817d9f57
JH
1616/* Only used by the server-side tls (tls_in), including tls_getc.
1617 Client-side (tls_out) reads (seem to?) go via
1618 smtp_read_response()/ip_recv().
1619 Hence no need to duplicate for _in and _out.
1620 */
059ec3d9
PH
1621ssl_xfer_buffer = store_malloc(ssl_xfer_buffer_size);
1622ssl_xfer_buffer_lwm = ssl_xfer_buffer_hwm = 0;
1623ssl_xfer_eof = ssl_xfer_error = 0;
1624
1625receive_getc = tls_getc;
1626receive_ungetc = tls_ungetc;
1627receive_feof = tls_feof;
1628receive_ferror = tls_ferror;
58eb016e 1629receive_smtp_buffered = tls_smtp_buffered;
059ec3d9 1630
817d9f57 1631tls_in.active = fileno(smtp_out);
059ec3d9
PH
1632return OK;
1633}
1634
1635
1636
1637
043b1248
JH
1638static int
1639tls_client_basic_ctx_init(SSL_CTX * ctx,
1640 host_item * host, smtp_transport_options_block * ob
1641#ifdef EXPERIMENTAL_CERTNAMES
1642 , tls_ext_ctx_cb * cbinfo
1643#endif
1644 )
1645{
1646int rc;
1647/* stick to the old behaviour for compatibility if tls_verify_certificates is
1648 set but both tls_verify_hosts and tls_try_verify_hosts is not set. Check only
1649 the specified host patterns if one of them is defined */
1650
1651if ((!ob->tls_verify_hosts && !ob->tls_try_verify_hosts) ||
1652 (verify_check_host(&ob->tls_verify_hosts) == OK))
1653 {
1654 if ((rc = setup_certs(ctx, ob->tls_verify_certificates,
1655 ob->tls_crl, host, FALSE, verify_callback_client)) != OK)
1656 return rc;
1657 client_verify_optional = FALSE;
1658
1659#ifdef EXPERIMENTAL_CERTNAMES
1660 if (ob->tls_verify_cert_hostnames)
1661 {
1662 if (!expand_check(ob->tls_verify_cert_hostnames,
1663 US"tls_verify_cert_hostnames",
1664 &cbinfo->verify_cert_hostnames))
1665 return FAIL;
1666 if (cbinfo->verify_cert_hostnames)
1667 DEBUG(D_tls) debug_printf("Cert hostname to check: \"%s\"\n",
1668 cbinfo->verify_cert_hostnames);
1669 }
1670#endif
1671 }
1672else if (verify_check_host(&ob->tls_try_verify_hosts) == OK)
1673 {
1674 if ((rc = setup_certs(ctx, ob->tls_verify_certificates,
1675 ob->tls_crl, host, TRUE, verify_callback_client)) != OK)
1676 return rc;
1677 client_verify_optional = TRUE;
1678 }
1679
1680return OK;
1681}
059ec3d9 1682
fde080a4
JH
1683
1684#ifdef EXPERIMENTAL_DANE
1685static int
fde080a4
JH
1686dane_tlsa_load(SSL * ssl, host_item * host, dns_answer * dnsa)
1687{
1688dns_record * rr;
1689dns_scan dnss;
1690const char * hostnames[2] = { CS host->name, NULL };
1691int found = 0;
1692
1693if (DANESSL_init(ssl, NULL, hostnames) != 1)
1694 return tls_error(US"hostnames load", host, NULL);
1695
1696for (rr = dns_next_rr(dnsa, &dnss, RESET_ANSWERS);
1697 rr;
1698 rr = dns_next_rr(dnsa, &dnss, RESET_NEXT)
1699 ) if (rr->type == T_TLSA)
1700 {
1701 uschar * p = rr->data;
1702 uint8_t usage, selector, mtype;
1703 const char * mdname;
1704
1705 found++;
1706 usage = *p++;
1707 selector = *p++;
1708 mtype = *p++;
1709
1710 switch (mtype)
1711 {
1712 default:
1713 log_write(0, LOG_MAIN,
1714 "DANE error: TLSA record w/bad mtype 0x%x", mtype);
1715 return FAIL;
1716 case 0: mdname = NULL; break;
1717 case 1: mdname = "sha256"; break;
1718 case 2: mdname = "sha512"; break;
1719 }
1720
1721 switch (DANESSL_add_tlsa(ssl, usage, selector, mdname, p, rr->size - 3))
1722 {
1723 default:
1724 case 0: /* action not taken */
1725 return tls_error(US"tlsa load", host, NULL);
1726 case 1: break;
1727 }
594706ea
JH
1728
1729 tls_out.tlsa_usage |= 1<<usage;
fde080a4
JH
1730 }
1731
1732if (found)
1733 return OK;
1734
1735log_write(0, LOG_MAIN, "DANE error: No TLSA records");
1736return FAIL;
1737}
1738#endif /*EXPERIMENTAL_DANE*/
1739
1740
1741
059ec3d9
PH
1742/*************************************************
1743* Start a TLS session in a client *
1744*************************************************/
1745
1746/* Called from the smtp transport after STARTTLS has been accepted.
1747
1748Argument:
1749 fd the fd of the connection
1750 host connected host (for messages)
83da1223 1751 addr the first address
a7538db1 1752 tb transport (always smtp)
0e66b3b6 1753 tlsa_dnsa tlsa lookup, if DANE, else null
059ec3d9
PH
1754
1755Returns: OK on success
1756 FAIL otherwise - note that tls_error() will not give DEFER
1757 because this is not a server
1758*/
1759
1760int
f5d78688 1761tls_client_start(int fd, host_item *host, address_item *addr,
0e66b3b6
JH
1762 transport_instance *tb
1763#ifdef EXPERIMENTAL_DANE
1764 , dns_answer * tlsa_dnsa
1765#endif
1766 )
059ec3d9 1767{
a7538db1
JH
1768smtp_transport_options_block * ob =
1769 (smtp_transport_options_block *)tb->options_block;
059ec3d9 1770static uschar txt[256];
868f5672
JH
1771uschar * expciphers;
1772X509 * server_cert;
059ec3d9 1773int rc;
817d9f57 1774static uschar cipherbuf[256];
043b1248
JH
1775
1776#ifndef DISABLE_OCSP
043b1248 1777BOOL request_ocsp = FALSE;
6634ac8d 1778BOOL require_ocsp = FALSE;
043b1248 1779#endif
043b1248
JH
1780
1781#ifdef EXPERIMENTAL_DANE
594706ea 1782tls_out.tlsa_usage = 0;
043b1248
JH
1783#endif
1784
f2de3a33 1785#ifndef DISABLE_OCSP
043b1248 1786 {
fca41d5a
JH
1787 if ((require_ocsp = verify_check_this_host(&ob->hosts_require_ocsp,
1788 NULL, host->name, host->address, NULL) == OK))
1789 request_ocsp = TRUE;
1790 else
1791 {
1792# ifdef EXPERIMENTAL_DANE
0e66b3b6 1793 if ( tlsa_dnsa
fca41d5a
JH
1794 && ob->hosts_request_ocsp[0] == '*'
1795 && ob->hosts_request_ocsp[1] == '\0'
1796 )
1797 {
1798 /* Unchanged from default. Use a safer one under DANE */
1799 request_ocsp = TRUE;
1800 ob->hosts_request_ocsp = US"${if or { {= {0}{$tls_out_tlsa_usage}} "
1801 " {= {4}{$tls_out_tlsa_usage}} } "
1802 " {*}{}}";
1803 }
1804 else
1805# endif
1806 request_ocsp = verify_check_this_host(&ob->hosts_request_ocsp,
1807 NULL, host->name, host->address, NULL) == OK;
1808 }
043b1248 1809 }
f5d78688 1810#endif
059ec3d9 1811
65867078
JH
1812rc = tls_init(&client_ctx, host, NULL,
1813 ob->tls_certificate, ob->tls_privatekey,
f2de3a33 1814#ifndef DISABLE_OCSP
44662487 1815 (void *)(long)request_ocsp,
3f7eeb86 1816#endif
817d9f57 1817 addr, &client_static_cbinfo);
059ec3d9
PH
1818if (rc != OK) return rc;
1819
817d9f57 1820tls_out.certificate_verified = FALSE;
a2ff477a 1821client_verify_callback_called = FALSE;
059ec3d9 1822
65867078
JH
1823if (!expand_check(ob->tls_require_ciphers, US"tls_require_ciphers",
1824 &expciphers))
059ec3d9
PH
1825 return FAIL;
1826
1827/* In OpenSSL, cipher components are separated by hyphens. In GnuTLS, they
1828are separated by underscores. So that I can use either form in my tests, and
1829also for general convenience, we turn underscores into hyphens here. */
1830
1831if (expciphers != NULL)
1832 {
1833 uschar *s = expciphers;
1834 while (*s != 0) { if (*s == '_') *s = '-'; s++; }
1835 DEBUG(D_tls) debug_printf("required ciphers: %s\n", expciphers);
817d9f57 1836 if (!SSL_CTX_set_cipher_list(client_ctx, CS expciphers))
7199e1ee 1837 return tls_error(US"SSL_CTX_set_cipher_list", host, NULL);
059ec3d9
PH
1838 }
1839
043b1248 1840#ifdef EXPERIMENTAL_DANE
0e66b3b6 1841if (tlsa_dnsa)
a63be306 1842 {
e5cccda9
JH
1843 SSL_CTX_set_verify(client_ctx, SSL_VERIFY_PEER, verify_callback_client_dane);
1844
043b1248 1845 if (!DANESSL_library_init())
b4161d10 1846 return tls_error(US"library init", host, NULL);
043b1248 1847 if (DANESSL_CTX_init(client_ctx) <= 0)
b4161d10 1848 return tls_error(US"context init", host, NULL);
043b1248
JH
1849 }
1850else
e51c7be2 1851
043b1248
JH
1852#endif
1853
1854 if ((rc = tls_client_basic_ctx_init(client_ctx, host, ob
e51c7be2 1855#ifdef EXPERIMENTAL_CERTNAMES
043b1248 1856 , client_static_cbinfo
e51c7be2 1857#endif
043b1248 1858 )) != OK)
65867078 1859 return rc;
059ec3d9 1860
65867078
JH
1861if ((client_ssl = SSL_new(client_ctx)) == NULL)
1862 return tls_error(US"SSL_new", host, NULL);
817d9f57
JH
1863SSL_set_session_id_context(client_ssl, sid_ctx, Ustrlen(sid_ctx));
1864SSL_set_fd(client_ssl, fd);
1865SSL_set_connect_state(client_ssl);
059ec3d9 1866
65867078 1867if (ob->tls_sni)
3f0945ff 1868 {
65867078 1869 if (!expand_check(ob->tls_sni, US"tls_sni", &tls_out.sni))
3f0945ff 1870 return FAIL;
ec4b68e5 1871 if (tls_out.sni == NULL)
2c9a0e86
PP
1872 {
1873 DEBUG(D_tls) debug_printf("Setting TLS SNI forced to fail, not sending\n");
1874 }
ec4b68e5 1875 else if (!Ustrlen(tls_out.sni))
817d9f57 1876 tls_out.sni = NULL;
3f0945ff
PP
1877 else
1878 {
35731706 1879#ifdef EXIM_HAVE_OPENSSL_TLSEXT
817d9f57
JH
1880 DEBUG(D_tls) debug_printf("Setting TLS SNI \"%s\"\n", tls_out.sni);
1881 SSL_set_tlsext_host_name(client_ssl, tls_out.sni);
35731706
PP
1882#else
1883 DEBUG(D_tls)
1884 debug_printf("OpenSSL at build-time lacked SNI support, ignoring \"%s\"\n",
02d9264f 1885 tls_out.sni);
35731706 1886#endif
3f0945ff
PP
1887 }
1888 }
1889
594706ea 1890#ifdef EXPERIMENTAL_DANE
0e66b3b6
JH
1891if (tlsa_dnsa)
1892 if ((rc = dane_tlsa_load(client_ssl, host, tlsa_dnsa)) != OK)
594706ea
JH
1893 return rc;
1894#endif
1895
f2de3a33 1896#ifndef DISABLE_OCSP
f5d78688
JH
1897/* Request certificate status at connection-time. If the server
1898does OCSP stapling we will get the callback (set in tls_init()) */
b50c8b84 1899# ifdef EXPERIMENTAL_DANE
44662487
JH
1900if (request_ocsp)
1901 {
594706ea 1902 const uschar * s;
41afb5cb
JH
1903 if ( ((s = ob->hosts_require_ocsp) && Ustrstr(s, US"tls_out_tlsa_usage"))
1904 || ((s = ob->hosts_request_ocsp) && Ustrstr(s, US"tls_out_tlsa_usage"))
594706ea
JH
1905 )
1906 { /* Re-eval now $tls_out_tlsa_usage is populated. If
1907 this means we avoid the OCSP request, we wasted the setup
1908 cost in tls_init(). */
1909 require_ocsp = verify_check_this_host(&ob->hosts_require_ocsp,
1910 NULL, host->name, host->address, NULL) == OK;
1911 request_ocsp = require_ocsp ? TRUE
1912 : verify_check_this_host(&ob->hosts_request_ocsp,
1913 NULL, host->name, host->address, NULL) == OK;
1914 }
1915 }
b50c8b84
JH
1916# endif
1917
594706ea
JH
1918if (request_ocsp)
1919 {
f5d78688 1920 SSL_set_tlsext_status_type(client_ssl, TLSEXT_STATUSTYPE_ocsp);
44662487
JH
1921 client_static_cbinfo->u_ocsp.client.verify_required = require_ocsp;
1922 tls_out.ocsp = OCSP_NOT_RESP;
1923 }
f5d78688
JH
1924#endif
1925
a7538db1
JH
1926#ifdef EXPERIMENTAL_TPDA
1927client_static_cbinfo->event_action = tb->tpda_event_action;
1928#endif
043b1248 1929
059ec3d9
PH
1930/* There doesn't seem to be a built-in timeout on connection. */
1931
1932DEBUG(D_tls) debug_printf("Calling SSL_connect\n");
1933sigalrm_seen = FALSE;
65867078 1934alarm(ob->command_timeout);
817d9f57 1935rc = SSL_connect(client_ssl);
059ec3d9
PH
1936alarm(0);
1937
043b1248 1938#ifdef EXPERIMENTAL_DANE
0e66b3b6 1939if (tlsa_dnsa)
fde080a4 1940 DANESSL_cleanup(client_ssl);
043b1248
JH
1941#endif
1942
059ec3d9 1943if (rc <= 0)
7199e1ee 1944 return tls_error(US"SSL_connect", host, sigalrm_seen ? US"timed out" : NULL);
059ec3d9
PH
1945
1946DEBUG(D_tls) debug_printf("SSL_connect succeeded\n");
1947
453a6645 1948/* Beware anonymous ciphers which lead to server_cert being NULL */
9d1c15ef 1949/*XXX server_cert is never freed... use X509_free() */
817d9f57 1950server_cert = SSL_get_peer_certificate (client_ssl);
453a6645
PP
1951if (server_cert)
1952 {
817d9f57 1953 tls_out.peerdn = US X509_NAME_oneline(X509_get_subject_name(server_cert),
453a6645 1954 CS txt, sizeof(txt));
9d1c15ef 1955 tls_out.peerdn = txt; /*XXX a static buffer... */
453a6645
PP
1956 }
1957else
817d9f57 1958 tls_out.peerdn = NULL;
059ec3d9 1959
817d9f57
JH
1960construct_cipher_name(client_ssl, cipherbuf, sizeof(cipherbuf), &tls_out.bits);
1961tls_out.cipher = cipherbuf;
059ec3d9 1962
9d1c15ef
JH
1963/* Record the certificate we presented */
1964 {
1965 X509 * crt = SSL_get_certificate(client_ssl);
1966 tls_out.ourcert = crt ? X509_dup(crt) : NULL;
1967 }
1968
817d9f57 1969tls_out.active = fd;
059ec3d9
PH
1970return OK;
1971}
1972
1973
1974
1975
1976
1977/*************************************************
1978* TLS version of getc *
1979*************************************************/
1980
1981/* This gets the next byte from the TLS input buffer. If the buffer is empty,
1982it refills the buffer via the SSL reading function.
1983
1984Arguments: none
1985Returns: the next character or EOF
817d9f57
JH
1986
1987Only used by the server-side TLS.
059ec3d9
PH
1988*/
1989
1990int
1991tls_getc(void)
1992{
1993if (ssl_xfer_buffer_lwm >= ssl_xfer_buffer_hwm)
1994 {
1995 int error;
1996 int inbytes;
1997
817d9f57 1998 DEBUG(D_tls) debug_printf("Calling SSL_read(%p, %p, %u)\n", server_ssl,
c80c5570 1999 ssl_xfer_buffer, ssl_xfer_buffer_size);
059ec3d9
PH
2000
2001 if (smtp_receive_timeout > 0) alarm(smtp_receive_timeout);
817d9f57
JH
2002 inbytes = SSL_read(server_ssl, CS ssl_xfer_buffer, ssl_xfer_buffer_size);
2003 error = SSL_get_error(server_ssl, inbytes);
059ec3d9
PH
2004 alarm(0);
2005
2006 /* SSL_ERROR_ZERO_RETURN appears to mean that the SSL session has been
2007 closed down, not that the socket itself has been closed down. Revert to
2008 non-SSL handling. */
2009
2010 if (error == SSL_ERROR_ZERO_RETURN)
2011 {
2012 DEBUG(D_tls) debug_printf("Got SSL_ERROR_ZERO_RETURN\n");
2013
2014 receive_getc = smtp_getc;
2015 receive_ungetc = smtp_ungetc;
2016 receive_feof = smtp_feof;
2017 receive_ferror = smtp_ferror;
58eb016e 2018 receive_smtp_buffered = smtp_buffered;
059ec3d9 2019
817d9f57
JH
2020 SSL_free(server_ssl);
2021 server_ssl = NULL;
2022 tls_in.active = -1;
2023 tls_in.bits = 0;
2024 tls_in.cipher = NULL;
2025 tls_in.peerdn = NULL;
2026 tls_in.sni = NULL;
059ec3d9
PH
2027
2028 return smtp_getc();
2029 }
2030
2031 /* Handle genuine errors */
2032
ba084640
PP
2033 else if (error == SSL_ERROR_SSL)
2034 {
2035 ERR_error_string(ERR_get_error(), ssl_errstring);
89dd51cd 2036 log_write(0, LOG_MAIN, "TLS error (SSL_read): %s", ssl_errstring);
ba084640
PP
2037 ssl_xfer_error = 1;
2038 return EOF;
2039 }
2040
059ec3d9
PH
2041 else if (error != SSL_ERROR_NONE)
2042 {
2043 DEBUG(D_tls) debug_printf("Got SSL error %d\n", error);
2044 ssl_xfer_error = 1;
2045 return EOF;
2046 }
c80c5570 2047
80a47a2c
TK
2048#ifndef DISABLE_DKIM
2049 dkim_exim_verify_feed(ssl_xfer_buffer, inbytes);
2050#endif
059ec3d9
PH
2051 ssl_xfer_buffer_hwm = inbytes;
2052 ssl_xfer_buffer_lwm = 0;
2053 }
2054
2055/* Something in the buffer; return next uschar */
2056
2057return ssl_xfer_buffer[ssl_xfer_buffer_lwm++];
2058}
2059
2060
2061
2062/*************************************************
2063* Read bytes from TLS channel *
2064*************************************************/
2065
2066/*
2067Arguments:
2068 buff buffer of data
2069 len size of buffer
2070
2071Returns: the number of bytes read
2072 -1 after a failed read
817d9f57
JH
2073
2074Only used by the client-side TLS.
059ec3d9
PH
2075*/
2076
2077int
389ca47a 2078tls_read(BOOL is_server, uschar *buff, size_t len)
059ec3d9 2079{
389ca47a 2080SSL *ssl = is_server ? server_ssl : client_ssl;
059ec3d9
PH
2081int inbytes;
2082int error;
2083
389ca47a 2084DEBUG(D_tls) debug_printf("Calling SSL_read(%p, %p, %u)\n", ssl,
c80c5570 2085 buff, (unsigned int)len);
059ec3d9 2086
389ca47a
JH
2087inbytes = SSL_read(ssl, CS buff, len);
2088error = SSL_get_error(ssl, inbytes);
059ec3d9
PH
2089
2090if (error == SSL_ERROR_ZERO_RETURN)
2091 {
2092 DEBUG(D_tls) debug_printf("Got SSL_ERROR_ZERO_RETURN\n");
2093 return -1;
2094 }
2095else if (error != SSL_ERROR_NONE)
2096 {
2097 return -1;
2098 }
2099
2100return inbytes;
2101}
2102
2103
2104
2105
2106
2107/*************************************************
2108* Write bytes down TLS channel *
2109*************************************************/
2110
2111/*
2112Arguments:
817d9f57 2113 is_server channel specifier
059ec3d9
PH
2114 buff buffer of data
2115 len number of bytes
2116
2117Returns: the number of bytes after a successful write,
2118 -1 after a failed write
817d9f57
JH
2119
2120Used by both server-side and client-side TLS.
059ec3d9
PH
2121*/
2122
2123int
817d9f57 2124tls_write(BOOL is_server, const uschar *buff, size_t len)
059ec3d9
PH
2125{
2126int outbytes;
2127int error;
2128int left = len;
817d9f57 2129SSL *ssl = is_server ? server_ssl : client_ssl;
059ec3d9 2130
c80c5570 2131DEBUG(D_tls) debug_printf("tls_do_write(%p, %d)\n", buff, left);
059ec3d9
PH
2132while (left > 0)
2133 {
c80c5570 2134 DEBUG(D_tls) debug_printf("SSL_write(SSL, %p, %d)\n", buff, left);
059ec3d9
PH
2135 outbytes = SSL_write(ssl, CS buff, left);
2136 error = SSL_get_error(ssl, outbytes);
2137 DEBUG(D_tls) debug_printf("outbytes=%d error=%d\n", outbytes, error);
2138 switch (error)
2139 {
2140 case SSL_ERROR_SSL:
2141 ERR_error_string(ERR_get_error(), ssl_errstring);
2142 log_write(0, LOG_MAIN, "TLS error (SSL_write): %s", ssl_errstring);
2143 return -1;
2144
2145 case SSL_ERROR_NONE:
2146 left -= outbytes;
2147 buff += outbytes;
2148 break;
2149
2150 case SSL_ERROR_ZERO_RETURN:
2151 log_write(0, LOG_MAIN, "SSL channel closed on write");
2152 return -1;
2153
817d9f57
JH
2154 case SSL_ERROR_SYSCALL:
2155 log_write(0, LOG_MAIN, "SSL_write: (from %s) syscall: %s",
2156 sender_fullhost ? sender_fullhost : US"<unknown>",
2157 strerror(errno));
2158
059ec3d9
PH
2159 default:
2160 log_write(0, LOG_MAIN, "SSL_write error %d", error);
2161 return -1;
2162 }
2163 }
2164return len;
2165}
2166
2167
2168
2169/*************************************************
2170* Close down a TLS session *
2171*************************************************/
2172
2173/* This is also called from within a delivery subprocess forked from the
2174daemon, to shut down the TLS library, without actually doing a shutdown (which
2175would tamper with the SSL session in the parent process).
2176
2177Arguments: TRUE if SSL_shutdown is to be called
2178Returns: nothing
817d9f57
JH
2179
2180Used by both server-side and client-side TLS.
059ec3d9
PH
2181*/
2182
2183void
817d9f57 2184tls_close(BOOL is_server, BOOL shutdown)
059ec3d9 2185{
817d9f57 2186SSL **sslp = is_server ? &server_ssl : &client_ssl;
389ca47a 2187int *fdp = is_server ? &tls_in.active : &tls_out.active;
817d9f57
JH
2188
2189if (*fdp < 0) return; /* TLS was not active */
059ec3d9
PH
2190
2191if (shutdown)
2192 {
2193 DEBUG(D_tls) debug_printf("tls_close(): shutting down SSL\n");
817d9f57 2194 SSL_shutdown(*sslp);
059ec3d9
PH
2195 }
2196
817d9f57
JH
2197SSL_free(*sslp);
2198*sslp = NULL;
059ec3d9 2199
817d9f57 2200*fdp = -1;
059ec3d9
PH
2201}
2202
36f12725
NM
2203
2204
2205
2206/*************************************************
3375e053
PP
2207* Let tls_require_ciphers be checked at startup *
2208*************************************************/
2209
2210/* The tls_require_ciphers option, if set, must be something which the
2211library can parse.
2212
2213Returns: NULL on success, or error message
2214*/
2215
2216uschar *
2217tls_validate_require_cipher(void)
2218{
2219SSL_CTX *ctx;
2220uschar *s, *expciphers, *err;
2221
2222/* this duplicates from tls_init(), we need a better "init just global
2223state, for no specific purpose" singleton function of our own */
2224
2225SSL_load_error_strings();
2226OpenSSL_add_ssl_algorithms();
2227#if (OPENSSL_VERSION_NUMBER >= 0x0090800fL) && !defined(OPENSSL_NO_SHA256)
2228/* SHA256 is becoming ever more popular. This makes sure it gets added to the
2229list of available digests. */
2230EVP_add_digest(EVP_sha256());
2231#endif
2232
2233if (!(tls_require_ciphers && *tls_require_ciphers))
2234 return NULL;
2235
2236if (!expand_check(tls_require_ciphers, US"tls_require_ciphers", &expciphers))
2237 return US"failed to expand tls_require_ciphers";
2238
2239if (!(expciphers && *expciphers))
2240 return NULL;
2241
2242/* normalisation ripped from above */
2243s = expciphers;
2244while (*s != 0) { if (*s == '_') *s = '-'; s++; }
2245
2246err = NULL;
2247
2248ctx = SSL_CTX_new(SSLv23_server_method());
2249if (!ctx)
2250 {
2251 ERR_error_string(ERR_get_error(), ssl_errstring);
2252 return string_sprintf("SSL_CTX_new() failed: %s", ssl_errstring);
2253 }
2254
2255DEBUG(D_tls)
2256 debug_printf("tls_require_ciphers expands to \"%s\"\n", expciphers);
2257
2258if (!SSL_CTX_set_cipher_list(ctx, CS expciphers))
2259 {
2260 ERR_error_string(ERR_get_error(), ssl_errstring);
2261 err = string_sprintf("SSL_CTX_set_cipher_list(%s) failed", expciphers);
2262 }
2263
2264SSL_CTX_free(ctx);
2265
2266return err;
2267}
2268
2269
2270
2271
2272/*************************************************
36f12725
NM
2273* Report the library versions. *
2274*************************************************/
2275
2276/* There have historically been some issues with binary compatibility in
2277OpenSSL libraries; if Exim (like many other applications) is built against
2278one version of OpenSSL but the run-time linker picks up another version,
2279it can result in serious failures, including crashing with a SIGSEGV. So
2280report the version found by the compiler and the run-time version.
2281
f64a1e23
PP
2282Note: some OS vendors backport security fixes without changing the version
2283number/string, and the version date remains unchanged. The _build_ date
2284will change, so we can more usefully assist with version diagnosis by also
2285reporting the build date.
2286
36f12725
NM
2287Arguments: a FILE* to print the results to
2288Returns: nothing
2289*/
2290
2291void
2292tls_version_report(FILE *f)
2293{
754a0503 2294fprintf(f, "Library version: OpenSSL: Compile: %s\n"
f64a1e23
PP
2295 " Runtime: %s\n"
2296 " : %s\n",
754a0503 2297 OPENSSL_VERSION_TEXT,
f64a1e23
PP
2298 SSLeay_version(SSLEAY_VERSION),
2299 SSLeay_version(SSLEAY_BUILT_ON));
2300/* third line is 38 characters for the %s and the line is 73 chars long;
2301the OpenSSL output includes a "built on: " prefix already. */
36f12725
NM
2302}
2303
9e3331ea
TK
2304
2305
2306
2307/*************************************************
17c76198 2308* Random number generation *
9e3331ea
TK
2309*************************************************/
2310
2311/* Pseudo-random number generation. The result is not expected to be
2312cryptographically strong but not so weak that someone will shoot themselves
2313in the foot using it as a nonce in input in some email header scheme or
2314whatever weirdness they'll twist this into. The result should handle fork()
2315and avoid repeating sequences. OpenSSL handles that for us.
2316
2317Arguments:
2318 max range maximum
2319Returns a random number in range [0, max-1]
2320*/
2321
2322int
17c76198 2323vaguely_random_number(int max)
9e3331ea
TK
2324{
2325unsigned int r;
2326int i, needed_len;
de6135a0
PP
2327static pid_t pidlast = 0;
2328pid_t pidnow;
9e3331ea
TK
2329uschar *p;
2330uschar smallbuf[sizeof(r)];
2331
2332if (max <= 1)
2333 return 0;
2334
de6135a0
PP
2335pidnow = getpid();
2336if (pidnow != pidlast)
2337 {
2338 /* Although OpenSSL documents that "OpenSSL makes sure that the PRNG state
2339 is unique for each thread", this doesn't apparently apply across processes,
2340 so our own warning from vaguely_random_number_fallback() applies here too.
2341 Fix per PostgreSQL. */
2342 if (pidlast != 0)
2343 RAND_cleanup();
2344 pidlast = pidnow;
2345 }
2346
9e3331ea
TK
2347/* OpenSSL auto-seeds from /dev/random, etc, but this a double-check. */
2348if (!RAND_status())
2349 {
2350 randstuff r;
2351 gettimeofday(&r.tv, NULL);
2352 r.p = getpid();
2353
2354 RAND_seed((uschar *)(&r), sizeof(r));
2355 }
2356/* We're after pseudo-random, not random; if we still don't have enough data
2357in the internal PRNG then our options are limited. We could sleep and hope
2358for entropy to come along (prayer technique) but if the system is so depleted
2359in the first place then something is likely to just keep taking it. Instead,
2360we'll just take whatever little bit of pseudo-random we can still manage to
2361get. */
2362
2363needed_len = sizeof(r);
2364/* Don't take 8 times more entropy than needed if int is 8 octets and we were
2365asked for a number less than 10. */
2366for (r = max, i = 0; r; ++i)
2367 r >>= 1;
2368i = (i + 7) / 8;
2369if (i < needed_len)
2370 needed_len = i;
2371
2372/* We do not care if crypto-strong */
17c76198
PP
2373i = RAND_pseudo_bytes(smallbuf, needed_len);
2374if (i < 0)
2375 {
2376 DEBUG(D_all)
2377 debug_printf("OpenSSL RAND_pseudo_bytes() not supported by RAND method, using fallback.\n");
2378 return vaguely_random_number_fallback(max);
2379 }
2380
9e3331ea
TK
2381r = 0;
2382for (p = smallbuf; needed_len; --needed_len, ++p)
2383 {
2384 r *= 256;
2385 r += *p;
2386 }
2387
2388/* We don't particularly care about weighted results; if someone wants
2389smooth distribution and cares enough then they should submit a patch then. */
2390return r % max;
2391}
2392
77bb000f
PP
2393
2394
2395
2396/*************************************************
2397* OpenSSL option parse *
2398*************************************************/
2399
2400/* Parse one option for tls_openssl_options_parse below
2401
2402Arguments:
2403 name one option name
2404 value place to store a value for it
2405Returns success or failure in parsing
2406*/
2407
2408struct exim_openssl_option {
2409 uschar *name;
2410 long value;
2411};
2412/* We could use a macro to expand, but we need the ifdef and not all the
2413options document which version they were introduced in. Policylet: include
2414all options unless explicitly for DTLS, let the administrator choose which
2415to apply.
2416
2417This list is current as of:
e2fbf4a2
PP
2418 ==> 1.0.1b <==
2419Plus SSL_OP_SAFARI_ECDHE_ECDSA_BUG from 2013-June patch/discussion on openssl-dev
2420*/
77bb000f
PP
2421static struct exim_openssl_option exim_openssl_options[] = {
2422/* KEEP SORTED ALPHABETICALLY! */
2423#ifdef SSL_OP_ALL
73a46702 2424 { US"all", SSL_OP_ALL },
77bb000f
PP
2425#endif
2426#ifdef SSL_OP_ALLOW_UNSAFE_LEGACY_RENEGOTIATION
73a46702 2427 { US"allow_unsafe_legacy_renegotiation", SSL_OP_ALLOW_UNSAFE_LEGACY_RENEGOTIATION },
77bb000f
PP
2428#endif
2429#ifdef SSL_OP_CIPHER_SERVER_PREFERENCE
73a46702 2430 { US"cipher_server_preference", SSL_OP_CIPHER_SERVER_PREFERENCE },
77bb000f
PP
2431#endif
2432#ifdef SSL_OP_DONT_INSERT_EMPTY_FRAGMENTS
73a46702 2433 { US"dont_insert_empty_fragments", SSL_OP_DONT_INSERT_EMPTY_FRAGMENTS },
77bb000f
PP
2434#endif
2435#ifdef SSL_OP_EPHEMERAL_RSA
73a46702 2436 { US"ephemeral_rsa", SSL_OP_EPHEMERAL_RSA },
77bb000f
PP
2437#endif
2438#ifdef SSL_OP_LEGACY_SERVER_CONNECT
73a46702 2439 { US"legacy_server_connect", SSL_OP_LEGACY_SERVER_CONNECT },
77bb000f
PP
2440#endif
2441#ifdef SSL_OP_MICROSOFT_BIG_SSLV3_BUFFER
73a46702 2442 { US"microsoft_big_sslv3_buffer", SSL_OP_MICROSOFT_BIG_SSLV3_BUFFER },
77bb000f
PP
2443#endif
2444#ifdef SSL_OP_MICROSOFT_SESS_ID_BUG
73a46702 2445 { US"microsoft_sess_id_bug", SSL_OP_MICROSOFT_SESS_ID_BUG },
77bb000f
PP
2446#endif
2447#ifdef SSL_OP_MSIE_SSLV2_RSA_PADDING
73a46702 2448 { US"msie_sslv2_rsa_padding", SSL_OP_MSIE_SSLV2_RSA_PADDING },
77bb000f
PP
2449#endif
2450#ifdef SSL_OP_NETSCAPE_CHALLENGE_BUG
73a46702 2451 { US"netscape_challenge_bug", SSL_OP_NETSCAPE_CHALLENGE_BUG },
77bb000f
PP
2452#endif
2453#ifdef SSL_OP_NETSCAPE_REUSE_CIPHER_CHANGE_BUG
73a46702 2454 { US"netscape_reuse_cipher_change_bug", SSL_OP_NETSCAPE_REUSE_CIPHER_CHANGE_BUG },
77bb000f 2455#endif
c80c5570
PP
2456#ifdef SSL_OP_NO_COMPRESSION
2457 { US"no_compression", SSL_OP_NO_COMPRESSION },
2458#endif
77bb000f 2459#ifdef SSL_OP_NO_SESSION_RESUMPTION_ON_RENEGOTIATION
73a46702 2460 { US"no_session_resumption_on_renegotiation", SSL_OP_NO_SESSION_RESUMPTION_ON_RENEGOTIATION },
77bb000f 2461#endif
c0c7b2da
PP
2462#ifdef SSL_OP_NO_SSLv2
2463 { US"no_sslv2", SSL_OP_NO_SSLv2 },
2464#endif
2465#ifdef SSL_OP_NO_SSLv3
2466 { US"no_sslv3", SSL_OP_NO_SSLv3 },
2467#endif
2468#ifdef SSL_OP_NO_TICKET
2469 { US"no_ticket", SSL_OP_NO_TICKET },
2470#endif
2471#ifdef SSL_OP_NO_TLSv1
2472 { US"no_tlsv1", SSL_OP_NO_TLSv1 },
2473#endif
c80c5570
PP
2474#ifdef SSL_OP_NO_TLSv1_1
2475#if SSL_OP_NO_TLSv1_1 == 0x00000400L
2476 /* Error in chosen value in 1.0.1a; see first item in CHANGES for 1.0.1b */
2477#warning OpenSSL 1.0.1a uses a bad value for SSL_OP_NO_TLSv1_1, ignoring
2478#else
2479 { US"no_tlsv1_1", SSL_OP_NO_TLSv1_1 },
2480#endif
2481#endif
2482#ifdef SSL_OP_NO_TLSv1_2
2483 { US"no_tlsv1_2", SSL_OP_NO_TLSv1_2 },
2484#endif
e2fbf4a2
PP
2485#ifdef SSL_OP_SAFARI_ECDHE_ECDSA_BUG
2486 { US"safari_ecdhe_ecdsa_bug", SSL_OP_SAFARI_ECDHE_ECDSA_BUG },
2487#endif
77bb000f 2488#ifdef SSL_OP_SINGLE_DH_USE
73a46702 2489 { US"single_dh_use", SSL_OP_SINGLE_DH_USE },
77bb000f
PP
2490#endif
2491#ifdef SSL_OP_SINGLE_ECDH_USE
73a46702 2492 { US"single_ecdh_use", SSL_OP_SINGLE_ECDH_USE },
77bb000f
PP
2493#endif
2494#ifdef SSL_OP_SSLEAY_080_CLIENT_DH_BUG
73a46702 2495 { US"ssleay_080_client_dh_bug", SSL_OP_SSLEAY_080_CLIENT_DH_BUG },
77bb000f
PP
2496#endif
2497#ifdef SSL_OP_SSLREF2_REUSE_CERT_TYPE_BUG
73a46702 2498 { US"sslref2_reuse_cert_type_bug", SSL_OP_SSLREF2_REUSE_CERT_TYPE_BUG },
77bb000f
PP
2499#endif
2500#ifdef SSL_OP_TLS_BLOCK_PADDING_BUG
73a46702 2501 { US"tls_block_padding_bug", SSL_OP_TLS_BLOCK_PADDING_BUG },
77bb000f
PP
2502#endif
2503#ifdef SSL_OP_TLS_D5_BUG
73a46702 2504 { US"tls_d5_bug", SSL_OP_TLS_D5_BUG },
77bb000f
PP
2505#endif
2506#ifdef SSL_OP_TLS_ROLLBACK_BUG
73a46702 2507 { US"tls_rollback_bug", SSL_OP_TLS_ROLLBACK_BUG },
77bb000f
PP
2508#endif
2509};
2510static int exim_openssl_options_size =
2511 sizeof(exim_openssl_options)/sizeof(struct exim_openssl_option);
2512
c80c5570 2513
77bb000f
PP
2514static BOOL
2515tls_openssl_one_option_parse(uschar *name, long *value)
2516{
2517int first = 0;
2518int last = exim_openssl_options_size;
2519while (last > first)
2520 {
2521 int middle = (first + last)/2;
2522 int c = Ustrcmp(name, exim_openssl_options[middle].name);
2523 if (c == 0)
2524 {
2525 *value = exim_openssl_options[middle].value;
2526 return TRUE;
2527 }
2528 else if (c > 0)
2529 first = middle + 1;
2530 else
2531 last = middle;
2532 }
2533return FALSE;
2534}
2535
2536
2537
2538
2539/*************************************************
2540* OpenSSL option parsing logic *
2541*************************************************/
2542
2543/* OpenSSL has a number of compatibility options which an administrator might
2544reasonably wish to set. Interpret a list similarly to decode_bits(), so that
2545we look like log_selector.
2546
2547Arguments:
2548 option_spec the administrator-supplied string of options
2549 results ptr to long storage for the options bitmap
2550Returns success or failure
2551*/
2552
2553BOOL
2554tls_openssl_options_parse(uschar *option_spec, long *results)
2555{
2556long result, item;
2557uschar *s, *end;
2558uschar keep_c;
2559BOOL adding, item_parsed;
2560
0e944a0d 2561result = 0L;
b1770b6e 2562/* Prior to 4.80 we or'd in SSL_OP_DONT_INSERT_EMPTY_FRAGMENTS; removed
da3ad30d 2563 * from default because it increases BEAST susceptibility. */
f0f5a555
PP
2564#ifdef SSL_OP_NO_SSLv2
2565result |= SSL_OP_NO_SSLv2;
2566#endif
77bb000f
PP
2567
2568if (option_spec == NULL)
2569 {
2570 *results = result;
2571 return TRUE;
2572 }
2573
2574for (s=option_spec; *s != '\0'; /**/)
2575 {
2576 while (isspace(*s)) ++s;
2577 if (*s == '\0')
2578 break;
2579 if (*s != '+' && *s != '-')
2580 {
2581 DEBUG(D_tls) debug_printf("malformed openssl option setting: "
0e944a0d 2582 "+ or - expected but found \"%s\"\n", s);
77bb000f
PP
2583 return FALSE;
2584 }
2585 adding = *s++ == '+';
2586 for (end = s; (*end != '\0') && !isspace(*end); ++end) /**/ ;
2587 keep_c = *end;
2588 *end = '\0';
2589 item_parsed = tls_openssl_one_option_parse(s, &item);
2590 if (!item_parsed)
2591 {
0e944a0d 2592 DEBUG(D_tls) debug_printf("openssl option setting unrecognised: \"%s\"\n", s);
77bb000f
PP
2593 return FALSE;
2594 }
2595 DEBUG(D_tls) debug_printf("openssl option, %s from %lx: %lx (%s)\n",
2596 adding ? "adding" : "removing", result, item, s);
2597 if (adding)
2598 result |= item;
2599 else
2600 result &= ~item;
2601 *end = keep_c;
2602 s = end;
2603 }
2604
2605*results = result;
2606return TRUE;
2607}
2608
9d1c15ef
JH
2609/* vi: aw ai sw=2
2610*/
059ec3d9 2611/* End of tls-openssl.c */