Fix needless OCSP request under DANE
[exim.git] / src / src / tls-openssl.c
CommitLineData
059ec3d9
PH
1/*************************************************
2* Exim - an Internet mail transport agent *
3*************************************************/
4
5a66c31b 5/* Copyright (c) University of Cambridge 1995 - 2014 */
059ec3d9
PH
6/* See the file NOTICE for conditions of use and distribution. */
7
f5d78688
JH
8/* Portions Copyright (c) The OpenSSL Project 1999 */
9
059ec3d9
PH
10/* This module provides the TLS (aka SSL) support for Exim using the OpenSSL
11library. It is #included into the tls.c file when that library is used. The
12code herein is based on a patch that was originally contributed by Steve
13Haslam. It was adapted from stunnel, a GPL program by Michal Trojnara.
14
15No cryptographic code is included in Exim. All this module does is to call
16functions from the OpenSSL library. */
17
18
19/* Heading stuff */
20
21#include <openssl/lhash.h>
22#include <openssl/ssl.h>
23#include <openssl/err.h>
24#include <openssl/rand.h>
f2de3a33 25#ifndef DISABLE_OCSP
e51c7be2 26# include <openssl/ocsp.h>
3f7eeb86 27#endif
85098ee7
JH
28#ifdef EXPERIMENTAL_DANE
29# include <danessl.h>
30#endif
31
3f7eeb86 32
f2de3a33
JH
33#ifndef DISABLE_OCSP
34# define EXIM_OCSP_SKEW_SECONDS (300L)
35# define EXIM_OCSP_MAX_AGE (-1L)
3f7eeb86 36#endif
059ec3d9 37
3bcbbbe2 38#if OPENSSL_VERSION_NUMBER >= 0x0090806fL && !defined(OPENSSL_NO_TLSEXT)
e51c7be2 39# define EXIM_HAVE_OPENSSL_TLSEXT
3bcbbbe2
PP
40#endif
41
67791ce4
JH
42#if !defined(EXIM_HAVE_OPENSSL_TLSEXT) && !defined(DISABLE_OCSP)
43# warning "OpenSSL library version too old; define DISABLE_OCSP in Makefile"
44# define DISABLE_OCSP
45#endif
46
059ec3d9
PH
47/* Structure for collecting random data for seeding. */
48
49typedef struct randstuff {
9e3331ea
TK
50 struct timeval tv;
51 pid_t p;
059ec3d9
PH
52} randstuff;
53
54/* Local static variables */
55
a2ff477a
JH
56static BOOL client_verify_callback_called = FALSE;
57static BOOL server_verify_callback_called = FALSE;
059ec3d9
PH
58static const uschar *sid_ctx = US"exim";
59
d4f09789
PP
60/* We have three different contexts to care about.
61
62Simple case: client, `client_ctx`
63 As a client, we can be doing a callout or cut-through delivery while receiving
64 a message. So we have a client context, which should have options initialised
65 from the SMTP Transport.
66
67Server:
68 There are two cases: with and without ServerNameIndication from the client.
69 Given TLS SNI, we can be using different keys, certs and various other
70 configuration settings, because they're re-expanded with $tls_sni set. This
71 allows vhosting with TLS. This SNI is sent in the handshake.
72 A client might not send SNI, so we need a fallback, and an initial setup too.
73 So as a server, we start out using `server_ctx`.
74 If SNI is sent by the client, then we as server, mid-negotiation, try to clone
75 `server_sni` from `server_ctx` and then initialise settings by re-expanding
76 configuration.
77*/
78
817d9f57
JH
79static SSL_CTX *client_ctx = NULL;
80static SSL_CTX *server_ctx = NULL;
81static SSL *client_ssl = NULL;
82static SSL *server_ssl = NULL;
389ca47a 83
35731706 84#ifdef EXIM_HAVE_OPENSSL_TLSEXT
817d9f57 85static SSL_CTX *server_sni = NULL;
35731706 86#endif
059ec3d9
PH
87
88static char ssl_errstring[256];
89
90static int ssl_session_timeout = 200;
a2ff477a
JH
91static BOOL client_verify_optional = FALSE;
92static BOOL server_verify_optional = FALSE;
059ec3d9 93
f5d78688 94static BOOL reexpand_tls_files_for_sni = FALSE;
059ec3d9
PH
95
96
7be682ca
PP
97typedef struct tls_ext_ctx_cb {
98 uschar *certificate;
99 uschar *privatekey;
f2de3a33 100#ifndef DISABLE_OCSP
f5d78688
JH
101 BOOL is_server;
102 union {
103 struct {
104 uschar *file;
105 uschar *file_expanded;
106 OCSP_RESPONSE *response;
107 } server;
108 struct {
44662487
JH
109 X509_STORE *verify_store; /* non-null if status requested */
110 BOOL verify_required;
f5d78688
JH
111 } client;
112 } u_ocsp;
3f7eeb86 113#endif
7be682ca
PP
114 uschar *dhparam;
115 /* these are cached from first expand */
116 uschar *server_cipher_list;
117 /* only passed down to tls_error: */
118 host_item *host;
e51c7be2
JH
119
120#ifdef EXPERIMENTAL_CERTNAMES
121 uschar * verify_cert_hostnames;
122#endif
a7538db1
JH
123#ifdef EXPERIMENTAL_TPDA
124 uschar * event_action;
125#endif
7be682ca
PP
126} tls_ext_ctx_cb;
127
128/* should figure out a cleanup of API to handle state preserved per
129implementation, for various reasons, which can be void * in the APIs.
130For now, we hack around it. */
817d9f57
JH
131tls_ext_ctx_cb *client_static_cbinfo = NULL;
132tls_ext_ctx_cb *server_static_cbinfo = NULL;
7be682ca
PP
133
134static int
983207c1
JH
135setup_certs(SSL_CTX *sctx, uschar *certs, uschar *crl, host_item *host, BOOL optional,
136 int (*cert_vfy_cb)(int, X509_STORE_CTX *) );
059ec3d9 137
3f7eeb86 138/* Callbacks */
3bcbbbe2 139#ifdef EXIM_HAVE_OPENSSL_TLSEXT
3f7eeb86 140static int tls_servername_cb(SSL *s, int *ad ARG_UNUSED, void *arg);
3bcbbbe2 141#endif
f2de3a33 142#ifndef DISABLE_OCSP
f5d78688 143static int tls_server_stapling_cb(SSL *s, void *arg);
3f7eeb86
PP
144#endif
145
059ec3d9
PH
146
147/*************************************************
148* Handle TLS error *
149*************************************************/
150
151/* Called from lots of places when errors occur before actually starting to do
152the TLS handshake, that is, while the session is still in clear. Always returns
153DEFER for a server and FAIL for a client so that most calls can use "return
154tls_error(...)" to do this processing and then give an appropriate return. A
155single function is used for both server and client, because it is called from
156some shared functions.
157
158Argument:
159 prefix text to include in the logged error
160 host NULL if setting up a server;
161 the connected host if setting up a client
7199e1ee 162 msg error message or NULL if we should ask OpenSSL
059ec3d9
PH
163
164Returns: OK/DEFER/FAIL
165*/
166
167static int
7199e1ee 168tls_error(uschar *prefix, host_item *host, uschar *msg)
059ec3d9 169{
7199e1ee
TF
170if (msg == NULL)
171 {
172 ERR_error_string(ERR_get_error(), ssl_errstring);
5ca6d115 173 msg = (uschar *)ssl_errstring;
7199e1ee
TF
174 }
175
059ec3d9
PH
176if (host == NULL)
177 {
7199e1ee 178 uschar *conn_info = smtp_get_connection_info();
5ca6d115 179 if (Ustrncmp(conn_info, US"SMTP ", 5) == 0)
7199e1ee
TF
180 conn_info += 5;
181 log_write(0, LOG_MAIN, "TLS error on %s (%s): %s",
182 conn_info, prefix, msg);
059ec3d9
PH
183 return DEFER;
184 }
185else
186 {
187 log_write(0, LOG_MAIN, "TLS error on connection to %s [%s] (%s): %s",
7199e1ee 188 host->name, host->address, prefix, msg);
059ec3d9
PH
189 return FAIL;
190 }
191}
192
193
194
195/*************************************************
196* Callback to generate RSA key *
197*************************************************/
198
199/*
200Arguments:
201 s SSL connection
202 export not used
203 keylength keylength
204
205Returns: pointer to generated key
206*/
207
208static RSA *
209rsa_callback(SSL *s, int export, int keylength)
210{
211RSA *rsa_key;
212export = export; /* Shut picky compilers up */
213DEBUG(D_tls) debug_printf("Generating %d bit RSA key...\n", keylength);
214rsa_key = RSA_generate_key(keylength, RSA_F4, NULL, NULL);
215if (rsa_key == NULL)
216 {
217 ERR_error_string(ERR_get_error(), ssl_errstring);
218 log_write(0, LOG_MAIN|LOG_PANIC, "TLS error (RSA_generate_key): %s",
219 ssl_errstring);
220 return NULL;
221 }
222return rsa_key;
223}
224
225
226
f5d78688 227/* Extreme debug
f2de3a33 228#ifndef DISABLE_OCSP
f5d78688
JH
229void
230x509_store_dump_cert_s_names(X509_STORE * store)
231{
232STACK_OF(X509_OBJECT) * roots= store->objs;
233int i;
234static uschar name[256];
235
236for(i= 0; i<sk_X509_OBJECT_num(roots); i++)
237 {
238 X509_OBJECT * tmp_obj= sk_X509_OBJECT_value(roots, i);
239 if(tmp_obj->type == X509_LU_X509)
240 {
241 X509 * current_cert= tmp_obj->data.x509;
242 X509_NAME_oneline(X509_get_subject_name(current_cert), CS name, sizeof(name));
243 debug_printf(" %s\n", name);
244 }
245 }
246}
247#endif
248*/
249
059ec3d9
PH
250
251/*************************************************
252* Callback for verification *
253*************************************************/
254
255/* The SSL library does certificate verification if set up to do so. This
256callback has the current yes/no state is in "state". If verification succeeded,
257we set up the tls_peerdn string. If verification failed, what happens depends
258on whether the client is required to present a verifiable certificate or not.
259
260If verification is optional, we change the state to yes, but still log the
261verification error. For some reason (it really would help to have proper
262documentation of OpenSSL), this callback function then gets called again, this
263time with state = 1. In fact, that's useful, because we can set up the peerdn
264value, but we must take care not to set the private verified flag on the second
265time through.
266
267Note: this function is not called if the client fails to present a certificate
268when asked. We get here only if a certificate has been received. Handling of
269optional verification for this case is done when requesting SSL to verify, by
270setting SSL_VERIFY_FAIL_IF_NO_PEER_CERT in the non-optional case.
271
a7538db1
JH
272May be called multiple times for different issues with a certificate, even
273for a given "depth" in the certificate chain.
274
059ec3d9
PH
275Arguments:
276 state current yes/no state as 1/0
277 x509ctx certificate information.
a2ff477a 278 client TRUE for client startup, FALSE for server startup
059ec3d9
PH
279
280Returns: 1 if verified, 0 if not
281*/
282
283static int
421aff85
JH
284verify_callback(int state, X509_STORE_CTX *x509ctx,
285 tls_support *tlsp, BOOL *calledp, BOOL *optionalp)
059ec3d9 286{
421aff85 287X509 * cert = X509_STORE_CTX_get_current_cert(x509ctx);
a7538db1 288int depth = X509_STORE_CTX_get_error_depth(x509ctx);
059ec3d9
PH
289static uschar txt[256];
290
e51c7be2 291X509_NAME_oneline(X509_get_subject_name(cert), CS txt, sizeof(txt));
059ec3d9
PH
292
293if (state == 0)
294 {
295 log_write(0, LOG_MAIN, "SSL verify error: depth=%d error=%s cert=%s",
a7538db1 296 depth,
421aff85 297 X509_verify_cert_error_string(X509_STORE_CTX_get_error(x509ctx)),
059ec3d9 298 txt);
a2ff477a
JH
299 tlsp->certificate_verified = FALSE;
300 *calledp = TRUE;
9d1c15ef
JH
301 if (!*optionalp)
302 {
421aff85 303 tlsp->peercert = X509_dup(cert);
9d1c15ef
JH
304 return 0; /* reject */
305 }
059ec3d9
PH
306 DEBUG(D_tls) debug_printf("SSL verify failure overridden (host in "
307 "tls_try_verify_hosts)\n");
059ec3d9
PH
308 }
309
a7538db1 310else if (depth != 0)
059ec3d9 311 {
a7538db1 312 DEBUG(D_tls) debug_printf("SSL verify ok: depth=%d SN=%s\n", depth, txt);
f2de3a33 313#ifndef DISABLE_OCSP
f5d78688
JH
314 if (tlsp == &tls_out && client_static_cbinfo->u_ocsp.client.verify_store)
315 { /* client, wanting stapling */
316 /* Add the server cert's signing chain as the one
317 for the verification of the OCSP stapled information. */
318
319 if (!X509_STORE_add_cert(client_static_cbinfo->u_ocsp.client.verify_store,
421aff85 320 cert))
f5d78688
JH
321 ERR_clear_error();
322 }
323#endif
a7538db1
JH
324#ifdef EXPERIMENTAL_TPDA
325 if (tlsp == &tls_out && client_static_cbinfo->event_action)
326 {
327 tlsp->peercert = X509_dup(cert);
328 if (tpda_raise_event(client_static_cbinfo->event_action,
329 US"tls:cert", string_sprintf("%d", depth)) == DEFER)
330 {
331 log_write(0, LOG_MAIN, "SSL verify denied by event-action: "
332 "depth=%d cert=%s", depth, txt);
333 tlsp->certificate_verified = FALSE;
334 *calledp = TRUE;
335 return 0; /* reject */
336 }
337 X509_free(tlsp->peercert);
338 tlsp->peercert = NULL;
339 }
340#endif
059ec3d9
PH
341 }
342else
343 {
e51c7be2
JH
344#ifdef EXPERIMENTAL_CERTNAMES
345 uschar * verify_cert_hostnames;
346#endif
347
a2ff477a 348 tlsp->peerdn = txt;
421aff85 349 tlsp->peercert = X509_dup(cert);
e51c7be2
JH
350
351#ifdef EXPERIMENTAL_CERTNAMES
352 if ( tlsp == &tls_out
353 && ((verify_cert_hostnames = client_static_cbinfo->verify_cert_hostnames)))
354 /* client, wanting hostname check */
355
356# if OPENSSL_VERSION_NUMBER >= 0x010100000L || OPENSSL_VERSION_NUMBER >= 0x010002000L
d8e7834a
JH
357# ifndef X509_CHECK_FLAG_NO_PARTIAL_WILDCARDS
358# define X509_CHECK_FLAG_NO_PARTIAL_WILDCARDS 0
359# endif
e51c7be2
JH
360 {
361 int sep = 0;
362 uschar * list = verify_cert_hostnames;
363 uschar * name;
d8e7834a
JH
364 int rc;
365 while ((name = string_nextinlist(&list, &sep, NULL, 0)))
366 if ((rc = X509_check_host(cert, name, 0,
367 X509_CHECK_FLAG_NO_PARTIAL_WILDCARDS)))
368 {
369 if (rc < 0)
370 {
371 log_write(0, LOG_MAIN, "SSL verify error: internal error\n");
372 name = NULL;
373 }
e51c7be2 374 break;
d8e7834a 375 }
e51c7be2
JH
376 if (!name)
377 {
378 log_write(0, LOG_MAIN,
379 "SSL verify error: certificate name mismatch: \"%s\"\n", txt);
380 return 0; /* reject */
381 }
382 }
383# else
384 if (!tls_is_name_for_cert(verify_cert_hostnames, cert))
385 {
386 log_write(0, LOG_MAIN,
387 "SSL verify error: certificate name mismatch: \"%s\"\n", txt);
388 return 0; /* reject */
389 }
390# endif
e5cccda9 391#endif /*EXPERIMENTAL_CERTNAMES*/
e51c7be2 392
a7538db1
JH
393#ifdef EXPERIMENTAL_TPDA
394 if (tlsp == &tls_out)
395 {
396 if (tpda_raise_event(client_static_cbinfo->event_action,
397 US"tls:cert", US"0") == DEFER)
398 {
399 log_write(0, LOG_MAIN, "SSL verify denied by event-action: "
400 "depth=0 cert=%s", txt);
401 tlsp->certificate_verified = FALSE;
402 *calledp = TRUE;
403 return 0; /* reject */
404 }
405 }
e51c7be2
JH
406#endif
407
93dcb1c2
JH
408 DEBUG(D_tls) debug_printf("SSL%s verify ok: depth=0 SN=%s\n",
409 *calledp ? "" : " authenticated", txt);
410 if (!*calledp) tlsp->certificate_verified = TRUE;
411 *calledp = TRUE;
059ec3d9
PH
412 }
413
a7538db1 414return 1; /* accept, at least for this level */
059ec3d9
PH
415}
416
a2ff477a
JH
417static int
418verify_callback_client(int state, X509_STORE_CTX *x509ctx)
419{
f5d78688 420return verify_callback(state, x509ctx, &tls_out, &client_verify_callback_called, &client_verify_optional);
a2ff477a
JH
421}
422
423static int
424verify_callback_server(int state, X509_STORE_CTX *x509ctx)
425{
f5d78688 426return verify_callback(state, x509ctx, &tls_in, &server_verify_callback_called, &server_verify_optional);
a2ff477a
JH
427}
428
059ec3d9 429
e5cccda9 430#ifdef EXPERIMENTAL_DANE
53a7196b 431
e5cccda9
JH
432/* This gets called *by* the dane library verify callback, which interposes
433itself.
434*/
435static int
436verify_callback_client_dane(int state, X509_STORE_CTX * x509ctx)
437{
438X509 * cert = X509_STORE_CTX_get_current_cert(x509ctx);
439static uschar txt[256];
83b27293
JH
440#ifdef EXPERIMENTAL_TPDA
441int depth = X509_STORE_CTX_get_error_depth(x509ctx);
442#endif
e5cccda9
JH
443
444X509_NAME_oneline(X509_get_subject_name(cert), CS txt, sizeof(txt));
445
446DEBUG(D_tls) debug_printf("verify_callback_client_dane: %s\n", txt);
447tls_out.peerdn = txt;
448tls_out.peercert = X509_dup(cert);
449
83b27293
JH
450#ifdef EXPERIMENTAL_TPDA
451 if (client_static_cbinfo->event_action)
452 {
453 if (tpda_raise_event(client_static_cbinfo->event_action,
454 US"tls:cert", string_sprintf("%d", depth)) == DEFER)
455 {
456 log_write(0, LOG_MAIN, "DANE verify denied by event-action: "
457 "depth=%d cert=%s", depth, txt);
458 tls_out.certificate_verified = FALSE;
459 return 0; /* reject */
460 }
461 if (depth != 0)
462 {
463 X509_free(tls_out.peercert);
464 tls_out.peercert = NULL;
465 }
466 }
467#endif
468
e5cccda9 469if (state == 1)
53a7196b 470 tls_out.dane_verified =
e5cccda9
JH
471 tls_out.certificate_verified = TRUE;
472return 1;
473}
53a7196b
JH
474
475#endif /*EXPERIMENTAL_DANE*/
e5cccda9 476
059ec3d9
PH
477
478/*************************************************
479* Information callback *
480*************************************************/
481
482/* The SSL library functions call this from time to time to indicate what they
7be682ca
PP
483are doing. We copy the string to the debugging output when TLS debugging has
484been requested.
059ec3d9
PH
485
486Arguments:
487 s the SSL connection
488 where
489 ret
490
491Returns: nothing
492*/
493
494static void
495info_callback(SSL *s, int where, int ret)
496{
497where = where;
498ret = ret;
499DEBUG(D_tls) debug_printf("SSL info: %s\n", SSL_state_string_long(s));
500}
501
502
503
504/*************************************************
505* Initialize for DH *
506*************************************************/
507
508/* If dhparam is set, expand it, and load up the parameters for DH encryption.
509
510Arguments:
a799883d 511 dhparam DH parameter file or fixed parameter identity string
7199e1ee 512 host connected host, if client; NULL if server
059ec3d9
PH
513
514Returns: TRUE if OK (nothing to set up, or setup worked)
515*/
516
517static BOOL
a799883d 518init_dh(SSL_CTX *sctx, uschar *dhparam, host_item *host)
059ec3d9 519{
059ec3d9
PH
520BIO *bio;
521DH *dh;
522uschar *dhexpanded;
a799883d 523const char *pem;
059ec3d9
PH
524
525if (!expand_check(dhparam, US"tls_dhparam", &dhexpanded))
526 return FALSE;
527
0df4ab80 528if (!dhexpanded || !*dhexpanded)
a799883d 529 bio = BIO_new_mem_buf(CS std_dh_prime_default(), -1);
a799883d 530else if (dhexpanded[0] == '/')
059ec3d9 531 {
0df4ab80 532 if (!(bio = BIO_new_file(CS dhexpanded, "r")))
059ec3d9 533 {
7199e1ee 534 tls_error(string_sprintf("could not read dhparams file %s", dhexpanded),
a799883d
PP
535 host, US strerror(errno));
536 return FALSE;
059ec3d9 537 }
a799883d
PP
538 }
539else
540 {
541 if (Ustrcmp(dhexpanded, "none") == 0)
059ec3d9 542 {
a799883d
PP
543 DEBUG(D_tls) debug_printf("Requested no DH parameters.\n");
544 return TRUE;
059ec3d9 545 }
a799883d 546
0df4ab80 547 if (!(pem = std_dh_prime_named(dhexpanded)))
a799883d
PP
548 {
549 tls_error(string_sprintf("Unknown standard DH prime \"%s\"", dhexpanded),
550 host, US strerror(errno));
551 return FALSE;
552 }
553 bio = BIO_new_mem_buf(CS pem, -1);
554 }
555
0df4ab80 556if (!(dh = PEM_read_bio_DHparams(bio, NULL, NULL, NULL)))
a799883d 557 {
059ec3d9 558 BIO_free(bio);
a799883d
PP
559 tls_error(string_sprintf("Could not read tls_dhparams \"%s\"", dhexpanded),
560 host, NULL);
561 return FALSE;
562 }
563
564/* Even if it is larger, we silently return success rather than cause things
565 * to fail out, so that a too-large DH will not knock out all TLS; it's a
566 * debatable choice. */
567if ((8*DH_size(dh)) > tls_dh_max_bits)
568 {
569 DEBUG(D_tls)
570 debug_printf("dhparams file %d bits, is > tls_dh_max_bits limit of %d",
571 8*DH_size(dh), tls_dh_max_bits);
572 }
573else
574 {
575 SSL_CTX_set_tmp_dh(sctx, dh);
576 DEBUG(D_tls)
577 debug_printf("Diffie-Hellman initialized from %s with %d-bit prime\n",
578 dhexpanded ? dhexpanded : US"default", 8*DH_size(dh));
059ec3d9
PH
579 }
580
a799883d
PP
581DH_free(dh);
582BIO_free(bio);
583
584return TRUE;
059ec3d9
PH
585}
586
587
588
589
f2de3a33 590#ifndef DISABLE_OCSP
3f7eeb86
PP
591/*************************************************
592* Load OCSP information into state *
593*************************************************/
594
f5d78688 595/* Called to load the server OCSP response from the given file into memory, once
3f7eeb86
PP
596caller has determined this is needed. Checks validity. Debugs a message
597if invalid.
598
599ASSUMES: single response, for single cert.
600
601Arguments:
602 sctx the SSL_CTX* to update
603 cbinfo various parts of session state
604 expanded the filename putatively holding an OCSP response
605
606*/
607
608static void
f5d78688 609ocsp_load_response(SSL_CTX *sctx, tls_ext_ctx_cb *cbinfo, const uschar *expanded)
3f7eeb86
PP
610{
611BIO *bio;
612OCSP_RESPONSE *resp;
613OCSP_BASICRESP *basic_response;
614OCSP_SINGLERESP *single_response;
615ASN1_GENERALIZEDTIME *rev, *thisupd, *nextupd;
616X509_STORE *store;
617unsigned long verify_flags;
618int status, reason, i;
619
f5d78688
JH
620cbinfo->u_ocsp.server.file_expanded = string_copy(expanded);
621if (cbinfo->u_ocsp.server.response)
3f7eeb86 622 {
f5d78688
JH
623 OCSP_RESPONSE_free(cbinfo->u_ocsp.server.response);
624 cbinfo->u_ocsp.server.response = NULL;
3f7eeb86
PP
625 }
626
f5d78688 627bio = BIO_new_file(CS cbinfo->u_ocsp.server.file_expanded, "rb");
3f7eeb86
PP
628if (!bio)
629 {
630 DEBUG(D_tls) debug_printf("Failed to open OCSP response file \"%s\"\n",
f5d78688 631 cbinfo->u_ocsp.server.file_expanded);
3f7eeb86
PP
632 return;
633 }
634
635resp = d2i_OCSP_RESPONSE_bio(bio, NULL);
636BIO_free(bio);
637if (!resp)
638 {
639 DEBUG(D_tls) debug_printf("Error reading OCSP response.\n");
640 return;
641 }
642
643status = OCSP_response_status(resp);
644if (status != OCSP_RESPONSE_STATUS_SUCCESSFUL)
645 {
646 DEBUG(D_tls) debug_printf("OCSP response not valid: %s (%d)\n",
647 OCSP_response_status_str(status), status);
f5d78688 648 goto bad;
3f7eeb86
PP
649 }
650
651basic_response = OCSP_response_get1_basic(resp);
652if (!basic_response)
653 {
654 DEBUG(D_tls)
655 debug_printf("OCSP response parse error: unable to extract basic response.\n");
f5d78688 656 goto bad;
3f7eeb86
PP
657 }
658
659store = SSL_CTX_get_cert_store(sctx);
660verify_flags = OCSP_NOVERIFY; /* check sigs, but not purpose */
661
662/* May need to expose ability to adjust those flags?
663OCSP_NOSIGS OCSP_NOVERIFY OCSP_NOCHAIN OCSP_NOCHECKS OCSP_NOEXPLICIT
664OCSP_TRUSTOTHER OCSP_NOINTERN */
665
666i = OCSP_basic_verify(basic_response, NULL, store, verify_flags);
667if (i <= 0)
668 {
669 DEBUG(D_tls) {
670 ERR_error_string(ERR_get_error(), ssl_errstring);
671 debug_printf("OCSP response verify failure: %s\n", US ssl_errstring);
f5d78688
JH
672 }
673 goto bad;
3f7eeb86
PP
674 }
675
676/* Here's the simplifying assumption: there's only one response, for the
677one certificate we use, and nothing for anything else in a chain. If this
678proves false, we need to extract a cert id from our issued cert
679(tls_certificate) and use that for OCSP_resp_find_status() (which finds the
680right cert in the stack and then calls OCSP_single_get0_status()).
681
682I'm hoping to avoid reworking a bunch more of how we handle state here. */
683single_response = OCSP_resp_get0(basic_response, 0);
684if (!single_response)
685 {
686 DEBUG(D_tls)
687 debug_printf("Unable to get first response from OCSP basic response.\n");
f5d78688 688 goto bad;
3f7eeb86
PP
689 }
690
691status = OCSP_single_get0_status(single_response, &reason, &rev, &thisupd, &nextupd);
f5d78688 692if (status != V_OCSP_CERTSTATUS_GOOD)
3f7eeb86 693 {
f5d78688
JH
694 DEBUG(D_tls) debug_printf("OCSP response bad cert status: %s (%d) %s (%d)\n",
695 OCSP_cert_status_str(status), status,
696 OCSP_crl_reason_str(reason), reason);
697 goto bad;
3f7eeb86
PP
698 }
699
700if (!OCSP_check_validity(thisupd, nextupd, EXIM_OCSP_SKEW_SECONDS, EXIM_OCSP_MAX_AGE))
701 {
702 DEBUG(D_tls) debug_printf("OCSP status invalid times.\n");
f5d78688 703 goto bad;
3f7eeb86
PP
704 }
705
f5d78688 706supply_response:
018058b2 707 cbinfo->u_ocsp.server.response = resp;
f5d78688
JH
708return;
709
710bad:
018058b2
JH
711 if (running_in_test_harness)
712 {
713 extern char ** environ;
714 uschar ** p;
715 for (p = USS environ; *p != NULL; p++)
716 if (Ustrncmp(*p, "EXIM_TESTHARNESS_DISABLE_OCSPVALIDITYCHECK", 42) == 0)
717 {
718 DEBUG(D_tls) debug_printf("Supplying known bad OCSP response\n");
719 goto supply_response;
720 }
721 }
f5d78688 722return;
3f7eeb86 723}
f2de3a33 724#endif /*!DISABLE_OCSP*/
3f7eeb86
PP
725
726
727
728
059ec3d9 729/*************************************************
7be682ca
PP
730* Expand key and cert file specs *
731*************************************************/
732
f5d78688 733/* Called once during tls_init and possibly again during TLS setup, for a
7be682ca
PP
734new context, if Server Name Indication was used and tls_sni was seen in
735the certificate string.
736
737Arguments:
738 sctx the SSL_CTX* to update
739 cbinfo various parts of session state
740
741Returns: OK/DEFER/FAIL
742*/
743
744static int
3f7eeb86 745tls_expand_session_files(SSL_CTX *sctx, tls_ext_ctx_cb *cbinfo)
7be682ca
PP
746{
747uschar *expanded;
748
749if (cbinfo->certificate == NULL)
750 return OK;
751
d9b2312b
JH
752if (Ustrstr(cbinfo->certificate, US"tls_sni") ||
753 Ustrstr(cbinfo->certificate, US"tls_in_sni") ||
754 Ustrstr(cbinfo->certificate, US"tls_out_sni")
755 )
7be682ca
PP
756 reexpand_tls_files_for_sni = TRUE;
757
758if (!expand_check(cbinfo->certificate, US"tls_certificate", &expanded))
759 return DEFER;
760
761if (expanded != NULL)
762 {
763 DEBUG(D_tls) debug_printf("tls_certificate file %s\n", expanded);
764 if (!SSL_CTX_use_certificate_chain_file(sctx, CS expanded))
765 return tls_error(string_sprintf(
766 "SSL_CTX_use_certificate_chain_file file=%s", expanded),
767 cbinfo->host, NULL);
768 }
769
770if (cbinfo->privatekey != NULL &&
771 !expand_check(cbinfo->privatekey, US"tls_privatekey", &expanded))
772 return DEFER;
773
774/* If expansion was forced to fail, key_expanded will be NULL. If the result
775of the expansion is an empty string, ignore it also, and assume the private
776key is in the same file as the certificate. */
777
778if (expanded != NULL && *expanded != 0)
779 {
780 DEBUG(D_tls) debug_printf("tls_privatekey file %s\n", expanded);
781 if (!SSL_CTX_use_PrivateKey_file(sctx, CS expanded, SSL_FILETYPE_PEM))
782 return tls_error(string_sprintf(
783 "SSL_CTX_use_PrivateKey_file file=%s", expanded), cbinfo->host, NULL);
784 }
785
f2de3a33 786#ifndef DISABLE_OCSP
f5d78688 787if (cbinfo->is_server && cbinfo->u_ocsp.server.file != NULL)
3f7eeb86 788 {
f5d78688 789 if (!expand_check(cbinfo->u_ocsp.server.file, US"tls_ocsp_file", &expanded))
3f7eeb86
PP
790 return DEFER;
791
792 if (expanded != NULL && *expanded != 0)
793 {
794 DEBUG(D_tls) debug_printf("tls_ocsp_file %s\n", expanded);
f5d78688
JH
795 if (cbinfo->u_ocsp.server.file_expanded &&
796 (Ustrcmp(expanded, cbinfo->u_ocsp.server.file_expanded) == 0))
3f7eeb86
PP
797 {
798 DEBUG(D_tls)
799 debug_printf("tls_ocsp_file value unchanged, using existing values.\n");
800 } else {
801 ocsp_load_response(sctx, cbinfo, expanded);
802 }
803 }
804 }
805#endif
806
7be682ca
PP
807return OK;
808}
809
810
811
812
813/*************************************************
814* Callback to handle SNI *
815*************************************************/
816
817/* Called when acting as server during the TLS session setup if a Server Name
818Indication extension was sent by the client.
819
820API documentation is OpenSSL s_server.c implementation.
821
822Arguments:
823 s SSL* of the current session
824 ad unknown (part of OpenSSL API) (unused)
825 arg Callback of "our" registered data
826
827Returns: SSL_TLSEXT_ERR_{OK,ALERT_WARNING,ALERT_FATAL,NOACK}
828*/
829
3bcbbbe2 830#ifdef EXIM_HAVE_OPENSSL_TLSEXT
7be682ca 831static int
7be682ca
PP
832tls_servername_cb(SSL *s, int *ad ARG_UNUSED, void *arg)
833{
834const char *servername = SSL_get_servername(s, TLSEXT_NAMETYPE_host_name);
3f7eeb86 835tls_ext_ctx_cb *cbinfo = (tls_ext_ctx_cb *) arg;
7be682ca 836int rc;
3f0945ff 837int old_pool = store_pool;
7be682ca
PP
838
839if (!servername)
840 return SSL_TLSEXT_ERR_OK;
841
3f0945ff 842DEBUG(D_tls) debug_printf("Received TLS SNI \"%s\"%s\n", servername,
7be682ca
PP
843 reexpand_tls_files_for_sni ? "" : " (unused for certificate selection)");
844
845/* Make the extension value available for expansion */
3f0945ff 846store_pool = POOL_PERM;
817d9f57 847tls_in.sni = string_copy(US servername);
3f0945ff 848store_pool = old_pool;
7be682ca
PP
849
850if (!reexpand_tls_files_for_sni)
851 return SSL_TLSEXT_ERR_OK;
852
853/* Can't find an SSL_CTX_clone() or equivalent, so we do it manually;
854not confident that memcpy wouldn't break some internal reference counting.
855Especially since there's a references struct member, which would be off. */
856
0df4ab80 857if (!(server_sni = SSL_CTX_new(SSLv23_server_method())))
7be682ca
PP
858 {
859 ERR_error_string(ERR_get_error(), ssl_errstring);
860 DEBUG(D_tls) debug_printf("SSL_CTX_new() failed: %s\n", ssl_errstring);
861 return SSL_TLSEXT_ERR_NOACK;
862 }
863
864/* Not sure how many of these are actually needed, since SSL object
865already exists. Might even need this selfsame callback, for reneg? */
866
817d9f57
JH
867SSL_CTX_set_info_callback(server_sni, SSL_CTX_get_info_callback(server_ctx));
868SSL_CTX_set_mode(server_sni, SSL_CTX_get_mode(server_ctx));
869SSL_CTX_set_options(server_sni, SSL_CTX_get_options(server_ctx));
870SSL_CTX_set_timeout(server_sni, SSL_CTX_get_timeout(server_ctx));
871SSL_CTX_set_tlsext_servername_callback(server_sni, tls_servername_cb);
872SSL_CTX_set_tlsext_servername_arg(server_sni, cbinfo);
7be682ca 873if (cbinfo->server_cipher_list)
817d9f57 874 SSL_CTX_set_cipher_list(server_sni, CS cbinfo->server_cipher_list);
f2de3a33 875#ifndef DISABLE_OCSP
f5d78688 876if (cbinfo->u_ocsp.server.file)
3f7eeb86 877 {
f5d78688 878 SSL_CTX_set_tlsext_status_cb(server_sni, tls_server_stapling_cb);
14c7b357 879 SSL_CTX_set_tlsext_status_arg(server_sni, cbinfo);
3f7eeb86
PP
880 }
881#endif
7be682ca 882
983207c1 883rc = setup_certs(server_sni, tls_verify_certificates, tls_crl, NULL, FALSE, verify_callback_server);
7be682ca
PP
884if (rc != OK) return SSL_TLSEXT_ERR_NOACK;
885
3f7eeb86
PP
886/* do this after setup_certs, because this can require the certs for verifying
887OCSP information. */
817d9f57 888rc = tls_expand_session_files(server_sni, cbinfo);
7be682ca
PP
889if (rc != OK) return SSL_TLSEXT_ERR_NOACK;
890
0df4ab80
JH
891if (!init_dh(server_sni, cbinfo->dhparam, NULL))
892 return SSL_TLSEXT_ERR_NOACK;
a799883d 893
7be682ca 894DEBUG(D_tls) debug_printf("Switching SSL context.\n");
817d9f57 895SSL_set_SSL_CTX(s, server_sni);
7be682ca
PP
896
897return SSL_TLSEXT_ERR_OK;
898}
3bcbbbe2 899#endif /* EXIM_HAVE_OPENSSL_TLSEXT */
7be682ca
PP
900
901
902
903
f2de3a33 904#ifndef DISABLE_OCSP
f5d78688 905
3f7eeb86
PP
906/*************************************************
907* Callback to handle OCSP Stapling *
908*************************************************/
909
910/* Called when acting as server during the TLS session setup if the client
911requests OCSP information with a Certificate Status Request.
912
913Documentation via openssl s_server.c and the Apache patch from the OpenSSL
914project.
915
916*/
917
918static int
f5d78688 919tls_server_stapling_cb(SSL *s, void *arg)
3f7eeb86
PP
920{
921const tls_ext_ctx_cb *cbinfo = (tls_ext_ctx_cb *) arg;
922uschar *response_der;
923int response_der_len;
924
af4a1bca
JH
925DEBUG(D_tls)
926 debug_printf("Received TLS status request (OCSP stapling); %s response.",
f5d78688
JH
927 cbinfo->u_ocsp.server.response ? "have" : "lack");
928
44662487 929tls_in.ocsp = OCSP_NOT_RESP;
f5d78688 930if (!cbinfo->u_ocsp.server.response)
3f7eeb86
PP
931 return SSL_TLSEXT_ERR_NOACK;
932
933response_der = NULL;
44662487
JH
934response_der_len = i2d_OCSP_RESPONSE(cbinfo->u_ocsp.server.response,
935 &response_der);
3f7eeb86
PP
936if (response_der_len <= 0)
937 return SSL_TLSEXT_ERR_NOACK;
938
5e55c7a9 939SSL_set_tlsext_status_ocsp_resp(server_ssl, response_der, response_der_len);
44662487 940tls_in.ocsp = OCSP_VFIED;
3f7eeb86
PP
941return SSL_TLSEXT_ERR_OK;
942}
943
3f7eeb86 944
f5d78688
JH
945static void
946time_print(BIO * bp, const char * str, ASN1_GENERALIZEDTIME * time)
947{
948BIO_printf(bp, "\t%s: ", str);
949ASN1_GENERALIZEDTIME_print(bp, time);
950BIO_puts(bp, "\n");
951}
952
953static int
954tls_client_stapling_cb(SSL *s, void *arg)
955{
956tls_ext_ctx_cb * cbinfo = arg;
957const unsigned char * p;
958int len;
959OCSP_RESPONSE * rsp;
960OCSP_BASICRESP * bs;
961int i;
962
963DEBUG(D_tls) debug_printf("Received TLS status response (OCSP stapling):");
964len = SSL_get_tlsext_status_ocsp_resp(s, &p);
965if(!p)
966 {
44662487
JH
967 /* Expect this when we requested ocsp but got none */
968 if ( cbinfo->u_ocsp.client.verify_required
969 && log_extra_selector & LX_tls_cipher)
970 log_write(0, LOG_MAIN, "Received TLS status callback, null content");
f5d78688
JH
971 else
972 DEBUG(D_tls) debug_printf(" null\n");
44662487 973 return cbinfo->u_ocsp.client.verify_required ? 0 : 1;
f5d78688 974 }
018058b2 975
f5d78688
JH
976if(!(rsp = d2i_OCSP_RESPONSE(NULL, &p, len)))
977 {
018058b2 978 tls_out.ocsp = OCSP_FAILED;
f5d78688 979 if (log_extra_selector & LX_tls_cipher)
1eca31ca 980 log_write(0, LOG_MAIN, "Received TLS cert status response, parse error");
f5d78688
JH
981 else
982 DEBUG(D_tls) debug_printf(" parse error\n");
983 return 0;
984 }
985
986if(!(bs = OCSP_response_get1_basic(rsp)))
987 {
018058b2 988 tls_out.ocsp = OCSP_FAILED;
f5d78688 989 if (log_extra_selector & LX_tls_cipher)
1eca31ca 990 log_write(0, LOG_MAIN, "Received TLS cert status response, error parsing response");
f5d78688
JH
991 else
992 DEBUG(D_tls) debug_printf(" error parsing response\n");
993 OCSP_RESPONSE_free(rsp);
994 return 0;
995 }
996
997/* We'd check the nonce here if we'd put one in the request. */
998/* However that would defeat cacheability on the server so we don't. */
999
f5d78688
JH
1000/* This section of code reworked from OpenSSL apps source;
1001 The OpenSSL Project retains copyright:
1002 Copyright (c) 1999 The OpenSSL Project. All rights reserved.
1003*/
1004 {
1005 BIO * bp = NULL;
f5d78688
JH
1006 int status, reason;
1007 ASN1_GENERALIZEDTIME *rev, *thisupd, *nextupd;
1008
1009 DEBUG(D_tls) bp = BIO_new_fp(stderr, BIO_NOCLOSE);
1010
1011 /*OCSP_RESPONSE_print(bp, rsp, 0); extreme debug: stapling content */
1012
1013 /* Use the chain that verified the server cert to verify the stapled info */
1014 /* DEBUG(D_tls) x509_store_dump_cert_s_names(cbinfo->u_ocsp.client.verify_store); */
1015
44662487
JH
1016 if ((i = OCSP_basic_verify(bs, NULL,
1017 cbinfo->u_ocsp.client.verify_store, 0)) <= 0)
f5d78688 1018 {
018058b2 1019 tls_out.ocsp = OCSP_FAILED;
1eca31ca
JH
1020 if (log_extra_selector & LX_tls_cipher)
1021 log_write(0, LOG_MAIN, "Received TLS cert status response, itself unverifiable");
f5d78688
JH
1022 BIO_printf(bp, "OCSP response verify failure\n");
1023 ERR_print_errors(bp);
44662487 1024 i = cbinfo->u_ocsp.client.verify_required ? 0 : 1;
f5d78688
JH
1025 goto out;
1026 }
1027
1028 BIO_printf(bp, "OCSP response well-formed and signed OK\n");
1029
1030 {
1031 STACK_OF(OCSP_SINGLERESP) * sresp = bs->tbsResponseData->responses;
1032 OCSP_SINGLERESP * single;
1033
1034 if (sk_OCSP_SINGLERESP_num(sresp) != 1)
1035 {
018058b2 1036 tls_out.ocsp = OCSP_FAILED;
44662487
JH
1037 log_write(0, LOG_MAIN, "OCSP stapling "
1038 "with multiple responses not handled");
1039 i = cbinfo->u_ocsp.client.verify_required ? 0 : 1;
f5d78688
JH
1040 goto out;
1041 }
1042 single = OCSP_resp_get0(bs, 0);
44662487
JH
1043 status = OCSP_single_get0_status(single, &reason, &rev,
1044 &thisupd, &nextupd);
f5d78688
JH
1045 }
1046
f5d78688
JH
1047 DEBUG(D_tls) time_print(bp, "This OCSP Update", thisupd);
1048 DEBUG(D_tls) if(nextupd) time_print(bp, "Next OCSP Update", nextupd);
44662487
JH
1049 if (!OCSP_check_validity(thisupd, nextupd,
1050 EXIM_OCSP_SKEW_SECONDS, EXIM_OCSP_MAX_AGE))
f5d78688 1051 {
018058b2 1052 tls_out.ocsp = OCSP_FAILED;
f5d78688
JH
1053 DEBUG(D_tls) ERR_print_errors(bp);
1054 log_write(0, LOG_MAIN, "Server OSCP dates invalid");
44662487 1055 i = cbinfo->u_ocsp.client.verify_required ? 0 : 1;
f5d78688 1056 }
44662487 1057 else
f5d78688 1058 {
44662487
JH
1059 DEBUG(D_tls) BIO_printf(bp, "Certificate status: %s\n",
1060 OCSP_cert_status_str(status));
1061 switch(status)
1062 {
1063 case V_OCSP_CERTSTATUS_GOOD:
44662487 1064 tls_out.ocsp = OCSP_VFIED;
018058b2 1065 i = 1;
44662487
JH
1066 break;
1067 case V_OCSP_CERTSTATUS_REVOKED:
018058b2 1068 tls_out.ocsp = OCSP_FAILED;
44662487
JH
1069 log_write(0, LOG_MAIN, "Server certificate revoked%s%s",
1070 reason != -1 ? "; reason: " : "",
1071 reason != -1 ? OCSP_crl_reason_str(reason) : "");
1072 DEBUG(D_tls) time_print(bp, "Revocation Time", rev);
1073 i = cbinfo->u_ocsp.client.verify_required ? 0 : 1;
1074 break;
1075 default:
018058b2 1076 tls_out.ocsp = OCSP_FAILED;
44662487
JH
1077 log_write(0, LOG_MAIN,
1078 "Server certificate status unknown, in OCSP stapling");
1079 i = cbinfo->u_ocsp.client.verify_required ? 0 : 1;
1080 break;
1081 }
f5d78688
JH
1082 }
1083 out:
1084 BIO_free(bp);
1085 }
1086
1087OCSP_RESPONSE_free(rsp);
1088return i;
1089}
f2de3a33 1090#endif /*!DISABLE_OCSP*/
3f7eeb86
PP
1091
1092
7be682ca 1093/*************************************************
059ec3d9
PH
1094* Initialize for TLS *
1095*************************************************/
1096
e51c7be2
JH
1097/* Called from both server and client code, to do preliminary initialization
1098of the library. We allocate and return a context structure.
059ec3d9
PH
1099
1100Arguments:
946ecbe0 1101 ctxp returned SSL context
059ec3d9
PH
1102 host connected host, if client; NULL if server
1103 dhparam DH parameter file
1104 certificate certificate file
1105 privatekey private key
f5d78688 1106 ocsp_file file of stapling info (server); flag for require ocsp (client)
059ec3d9 1107 addr address if client; NULL if server (for some randomness)
946ecbe0 1108 cbp place to put allocated callback context
059ec3d9
PH
1109
1110Returns: OK/DEFER/FAIL
1111*/
1112
1113static int
817d9f57 1114tls_init(SSL_CTX **ctxp, host_item *host, uschar *dhparam, uschar *certificate,
3f7eeb86 1115 uschar *privatekey,
f2de3a33 1116#ifndef DISABLE_OCSP
3f7eeb86
PP
1117 uschar *ocsp_file,
1118#endif
817d9f57 1119 address_item *addr, tls_ext_ctx_cb ** cbp)
059ec3d9 1120{
77bb000f 1121long init_options;
7be682ca 1122int rc;
77bb000f 1123BOOL okay;
a7538db1 1124tls_ext_ctx_cb * cbinfo;
7be682ca
PP
1125
1126cbinfo = store_malloc(sizeof(tls_ext_ctx_cb));
1127cbinfo->certificate = certificate;
1128cbinfo->privatekey = privatekey;
f2de3a33 1129#ifndef DISABLE_OCSP
f5d78688
JH
1130if ((cbinfo->is_server = host==NULL))
1131 {
1132 cbinfo->u_ocsp.server.file = ocsp_file;
1133 cbinfo->u_ocsp.server.file_expanded = NULL;
1134 cbinfo->u_ocsp.server.response = NULL;
1135 }
1136else
1137 cbinfo->u_ocsp.client.verify_store = NULL;
3f7eeb86 1138#endif
7be682ca 1139cbinfo->dhparam = dhparam;
0df4ab80 1140cbinfo->server_cipher_list = NULL;
7be682ca 1141cbinfo->host = host;
a7538db1
JH
1142#ifdef EXPERIMENTAL_TPDA
1143cbinfo->event_action = NULL;
1144#endif
77bb000f 1145
059ec3d9
PH
1146SSL_load_error_strings(); /* basic set up */
1147OpenSSL_add_ssl_algorithms();
1148
388d6564 1149#if (OPENSSL_VERSION_NUMBER >= 0x0090800fL) && !defined(OPENSSL_NO_SHA256)
77bb000f 1150/* SHA256 is becoming ever more popular. This makes sure it gets added to the
a0475b69
TK
1151list of available digests. */
1152EVP_add_digest(EVP_sha256());
cf1ef1a9 1153#endif
a0475b69 1154
f0f5a555
PP
1155/* Create a context.
1156The OpenSSL docs in 1.0.1b have not been updated to clarify TLS variant
1157negotiation in the different methods; as far as I can tell, the only
1158*_{server,client}_method which allows negotiation is SSLv23, which exists even
1159when OpenSSL is built without SSLv2 support.
1160By disabling with openssl_options, we can let admins re-enable with the
1161existing knob. */
059ec3d9 1162
817d9f57 1163*ctxp = SSL_CTX_new((host == NULL)?
059ec3d9
PH
1164 SSLv23_server_method() : SSLv23_client_method());
1165
817d9f57 1166if (*ctxp == NULL) return tls_error(US"SSL_CTX_new", host, NULL);
059ec3d9
PH
1167
1168/* It turns out that we need to seed the random number generator this early in
1169order to get the full complement of ciphers to work. It took me roughly a day
1170of work to discover this by experiment.
1171
1172On systems that have /dev/urandom, SSL may automatically seed itself from
1173there. Otherwise, we have to make something up as best we can. Double check
1174afterwards. */
1175
1176if (!RAND_status())
1177 {
1178 randstuff r;
9e3331ea 1179 gettimeofday(&r.tv, NULL);
059ec3d9
PH
1180 r.p = getpid();
1181
1182 RAND_seed((uschar *)(&r), sizeof(r));
1183 RAND_seed((uschar *)big_buffer, big_buffer_size);
1184 if (addr != NULL) RAND_seed((uschar *)addr, sizeof(addr));
1185
1186 if (!RAND_status())
7199e1ee 1187 return tls_error(US"RAND_status", host,
5ca6d115 1188 US"unable to seed random number generator");
059ec3d9
PH
1189 }
1190
1191/* Set up the information callback, which outputs if debugging is at a suitable
1192level. */
1193
817d9f57 1194SSL_CTX_set_info_callback(*ctxp, (void (*)())info_callback);
059ec3d9 1195
c80c5570 1196/* Automatically re-try reads/writes after renegotiation. */
817d9f57 1197(void) SSL_CTX_set_mode(*ctxp, SSL_MODE_AUTO_RETRY);
c80c5570 1198
77bb000f
PP
1199/* Apply administrator-supplied work-arounds.
1200Historically we applied just one requested option,
1201SSL_OP_DONT_INSERT_EMPTY_FRAGMENTS, but when bug 994 requested a second, we
1202moved to an administrator-controlled list of options to specify and
1203grandfathered in the first one as the default value for "openssl_options".
059ec3d9 1204
77bb000f
PP
1205No OpenSSL version number checks: the options we accept depend upon the
1206availability of the option value macros from OpenSSL. */
059ec3d9 1207
77bb000f
PP
1208okay = tls_openssl_options_parse(openssl_options, &init_options);
1209if (!okay)
73a46702 1210 return tls_error(US"openssl_options parsing failed", host, NULL);
77bb000f
PP
1211
1212if (init_options)
1213 {
1214 DEBUG(D_tls) debug_printf("setting SSL CTX options: %#lx\n", init_options);
817d9f57 1215 if (!(SSL_CTX_set_options(*ctxp, init_options)))
77bb000f
PP
1216 return tls_error(string_sprintf(
1217 "SSL_CTX_set_option(%#lx)", init_options), host, NULL);
1218 }
1219else
1220 DEBUG(D_tls) debug_printf("no SSL CTX options to set\n");
059ec3d9
PH
1221
1222/* Initialize with DH parameters if supplied */
1223
817d9f57 1224if (!init_dh(*ctxp, dhparam, host)) return DEFER;
059ec3d9 1225
3f7eeb86 1226/* Set up certificate and key (and perhaps OCSP info) */
059ec3d9 1227
817d9f57 1228rc = tls_expand_session_files(*ctxp, cbinfo);
7be682ca 1229if (rc != OK) return rc;
c91535f3 1230
7be682ca 1231/* If we need to handle SNI, do so */
3bcbbbe2 1232#ifdef EXIM_HAVE_OPENSSL_TLSEXT
f5d78688 1233if (host == NULL) /* server */
3f0945ff 1234 {
f2de3a33 1235# ifndef DISABLE_OCSP
f5d78688 1236 /* We check u_ocsp.server.file, not server.response, because we care about if
3f7eeb86
PP
1237 the option exists, not what the current expansion might be, as SNI might
1238 change the certificate and OCSP file in use between now and the time the
1239 callback is invoked. */
f5d78688 1240 if (cbinfo->u_ocsp.server.file)
3f7eeb86 1241 {
f5d78688 1242 SSL_CTX_set_tlsext_status_cb(server_ctx, tls_server_stapling_cb);
5e55c7a9 1243 SSL_CTX_set_tlsext_status_arg(server_ctx, cbinfo);
3f7eeb86 1244 }
f5d78688 1245# endif
3f0945ff
PP
1246 /* We always do this, so that $tls_sni is available even if not used in
1247 tls_certificate */
817d9f57
JH
1248 SSL_CTX_set_tlsext_servername_callback(*ctxp, tls_servername_cb);
1249 SSL_CTX_set_tlsext_servername_arg(*ctxp, cbinfo);
3f0945ff 1250 }
f2de3a33 1251# ifndef DISABLE_OCSP
f5d78688
JH
1252else /* client */
1253 if(ocsp_file) /* wanting stapling */
1254 {
1255 if (!(cbinfo->u_ocsp.client.verify_store = X509_STORE_new()))
1256 {
1257 DEBUG(D_tls) debug_printf("failed to create store for stapling verify\n");
1258 return FAIL;
1259 }
1260 SSL_CTX_set_tlsext_status_cb(*ctxp, tls_client_stapling_cb);
1261 SSL_CTX_set_tlsext_status_arg(*ctxp, cbinfo);
1262 }
1263# endif
7be682ca 1264#endif
059ec3d9 1265
e51c7be2
JH
1266#ifdef EXPERIMENTAL_CERTNAMES
1267cbinfo->verify_cert_hostnames = NULL;
1268#endif
1269
059ec3d9
PH
1270/* Set up the RSA callback */
1271
817d9f57 1272SSL_CTX_set_tmp_rsa_callback(*ctxp, rsa_callback);
059ec3d9
PH
1273
1274/* Finally, set the timeout, and we are done */
1275
817d9f57 1276SSL_CTX_set_timeout(*ctxp, ssl_session_timeout);
059ec3d9 1277DEBUG(D_tls) debug_printf("Initialized TLS\n");
7be682ca 1278
817d9f57 1279*cbp = cbinfo;
7be682ca 1280
059ec3d9
PH
1281return OK;
1282}
1283
1284
1285
1286
1287/*************************************************
1288* Get name of cipher in use *
1289*************************************************/
1290
817d9f57 1291/*
059ec3d9 1292Argument: pointer to an SSL structure for the connection
817d9f57
JH
1293 buffer to use for answer
1294 size of buffer
1295 pointer to number of bits for cipher
059ec3d9
PH
1296Returns: nothing
1297*/
1298
1299static void
817d9f57 1300construct_cipher_name(SSL *ssl, uschar *cipherbuf, int bsize, int *bits)
059ec3d9 1301{
57b3a7f5
PP
1302/* With OpenSSL 1.0.0a, this needs to be const but the documentation doesn't
1303yet reflect that. It should be a safe change anyway, even 0.9.8 versions have
1304the accessor functions use const in the prototype. */
1305const SSL_CIPHER *c;
d9784128 1306const uschar *ver;
059ec3d9 1307
d9784128 1308ver = (const uschar *)SSL_get_version(ssl);
059ec3d9 1309
57b3a7f5 1310c = (const SSL_CIPHER *) SSL_get_current_cipher(ssl);
817d9f57 1311SSL_CIPHER_get_bits(c, bits);
059ec3d9 1312
817d9f57
JH
1313string_format(cipherbuf, bsize, "%s:%s:%u", ver,
1314 SSL_CIPHER_get_name(c), *bits);
059ec3d9
PH
1315
1316DEBUG(D_tls) debug_printf("Cipher: %s\n", cipherbuf);
1317}
1318
1319
1320
1321
1322
1323/*************************************************
1324* Set up for verifying certificates *
1325*************************************************/
1326
1327/* Called by both client and server startup
1328
1329Arguments:
7be682ca 1330 sctx SSL_CTX* to initialise
059ec3d9
PH
1331 certs certs file or NULL
1332 crl CRL file or NULL
1333 host NULL in a server; the remote host in a client
1334 optional TRUE if called from a server for a host in tls_try_verify_hosts;
1335 otherwise passed as FALSE
983207c1 1336 cert_vfy_cb Callback function for certificate verification
059ec3d9
PH
1337
1338Returns: OK/DEFER/FAIL
1339*/
1340
1341static int
983207c1
JH
1342setup_certs(SSL_CTX *sctx, uschar *certs, uschar *crl, host_item *host, BOOL optional,
1343 int (*cert_vfy_cb)(int, X509_STORE_CTX *) )
059ec3d9
PH
1344{
1345uschar *expcerts, *expcrl;
1346
1347if (!expand_check(certs, US"tls_verify_certificates", &expcerts))
1348 return DEFER;
1349
26e72755 1350if (expcerts != NULL && *expcerts != '\0')
059ec3d9
PH
1351 {
1352 struct stat statbuf;
7be682ca 1353 if (!SSL_CTX_set_default_verify_paths(sctx))
7199e1ee 1354 return tls_error(US"SSL_CTX_set_default_verify_paths", host, NULL);
059ec3d9
PH
1355
1356 if (Ustat(expcerts, &statbuf) < 0)
1357 {
1358 log_write(0, LOG_MAIN|LOG_PANIC,
1359 "failed to stat %s for certificates", expcerts);
1360 return DEFER;
1361 }
1362 else
1363 {
1364 uschar *file, *dir;
1365 if ((statbuf.st_mode & S_IFMT) == S_IFDIR)
1366 { file = NULL; dir = expcerts; }
1367 else
1368 { file = expcerts; dir = NULL; }
1369
1370 /* If a certificate file is empty, the next function fails with an
1371 unhelpful error message. If we skip it, we get the correct behaviour (no
1372 certificates are recognized, but the error message is still misleading (it
1373 says no certificate was supplied.) But this is better. */
1374
1375 if ((file == NULL || statbuf.st_size > 0) &&
7be682ca 1376 !SSL_CTX_load_verify_locations(sctx, CS file, CS dir))
7199e1ee 1377 return tls_error(US"SSL_CTX_load_verify_locations", host, NULL);
059ec3d9 1378
3281c6ea
JH
1379 /* Load the list of CAs for which we will accept certs, for sending
1380 to the client. XXX only for file source, not dir? */
059ec3d9
PH
1381 if (file != NULL)
1382 {
3281c6ea
JH
1383 STACK_OF(X509_NAME) * names = SSL_load_client_CA_file(CS file);
1384DEBUG(D_tls) debug_printf("Added %d certificate authorities.\n",
1385 sk_X509_NAME_num(names));
1386 SSL_CTX_set_client_CA_list(sctx, names);
059ec3d9
PH
1387 }
1388 }
1389
1390 /* Handle a certificate revocation list. */
1391
1392 #if OPENSSL_VERSION_NUMBER > 0x00907000L
1393
8b417f2c
PH
1394 /* This bit of code is now the version supplied by Lars Mainka. (I have
1395 * merely reformatted it into the Exim code style.)
1396
1397 * "From here I changed the code to add support for multiple crl's
1398 * in pem format in one file or to support hashed directory entries in
1399 * pem format instead of a file. This method now uses the library function
1400 * X509_STORE_load_locations to add the CRL location to the SSL context.
1401 * OpenSSL will then handle the verify against CA certs and CRLs by
1402 * itself in the verify callback." */
1403
059ec3d9
PH
1404 if (!expand_check(crl, US"tls_crl", &expcrl)) return DEFER;
1405 if (expcrl != NULL && *expcrl != 0)
1406 {
8b417f2c
PH
1407 struct stat statbufcrl;
1408 if (Ustat(expcrl, &statbufcrl) < 0)
1409 {
1410 log_write(0, LOG_MAIN|LOG_PANIC,
1411 "failed to stat %s for certificates revocation lists", expcrl);
1412 return DEFER;
1413 }
1414 else
059ec3d9 1415 {
8b417f2c
PH
1416 /* is it a file or directory? */
1417 uschar *file, *dir;
7be682ca 1418 X509_STORE *cvstore = SSL_CTX_get_cert_store(sctx);
8b417f2c 1419 if ((statbufcrl.st_mode & S_IFMT) == S_IFDIR)
059ec3d9 1420 {
8b417f2c
PH
1421 file = NULL;
1422 dir = expcrl;
1423 DEBUG(D_tls) debug_printf("SSL CRL value is a directory %s\n", dir);
059ec3d9
PH
1424 }
1425 else
1426 {
8b417f2c
PH
1427 file = expcrl;
1428 dir = NULL;
1429 DEBUG(D_tls) debug_printf("SSL CRL value is a file %s\n", file);
059ec3d9 1430 }
8b417f2c 1431 if (X509_STORE_load_locations(cvstore, CS file, CS dir) == 0)
7199e1ee 1432 return tls_error(US"X509_STORE_load_locations", host, NULL);
8b417f2c
PH
1433
1434 /* setting the flags to check against the complete crl chain */
1435
1436 X509_STORE_set_flags(cvstore,
1437 X509_V_FLAG_CRL_CHECK|X509_V_FLAG_CRL_CHECK_ALL);
059ec3d9 1438 }
059ec3d9
PH
1439 }
1440
1441 #endif /* OPENSSL_VERSION_NUMBER > 0x00907000L */
1442
1443 /* If verification is optional, don't fail if no certificate */
1444
7be682ca 1445 SSL_CTX_set_verify(sctx,
059ec3d9 1446 SSL_VERIFY_PEER | (optional? 0 : SSL_VERIFY_FAIL_IF_NO_PEER_CERT),
983207c1 1447 cert_vfy_cb);
059ec3d9
PH
1448 }
1449
1450return OK;
1451}
1452
1453
1454
1455/*************************************************
1456* Start a TLS session in a server *
1457*************************************************/
1458
1459/* This is called when Exim is running as a server, after having received
1460the STARTTLS command. It must respond to that command, and then negotiate
1461a TLS session.
1462
1463Arguments:
1464 require_ciphers allowed ciphers
1465
1466Returns: OK on success
1467 DEFER for errors before the start of the negotiation
1468 FAIL for errors during the negotation; the server can't
1469 continue running.
1470*/
1471
1472int
17c76198 1473tls_server_start(const uschar *require_ciphers)
059ec3d9
PH
1474{
1475int rc;
1476uschar *expciphers;
7be682ca 1477tls_ext_ctx_cb *cbinfo;
817d9f57 1478static uschar cipherbuf[256];
059ec3d9
PH
1479
1480/* Check for previous activation */
1481
817d9f57 1482if (tls_in.active >= 0)
059ec3d9 1483 {
5ca6d115 1484 tls_error(US"STARTTLS received after TLS started", NULL, US"");
059ec3d9
PH
1485 smtp_printf("554 Already in TLS\r\n");
1486 return FAIL;
1487 }
1488
1489/* Initialize the SSL library. If it fails, it will already have logged
1490the error. */
1491
817d9f57 1492rc = tls_init(&server_ctx, NULL, tls_dhparam, tls_certificate, tls_privatekey,
f2de3a33 1493#ifndef DISABLE_OCSP
3f7eeb86
PP
1494 tls_ocsp_file,
1495#endif
817d9f57 1496 NULL, &server_static_cbinfo);
059ec3d9 1497if (rc != OK) return rc;
817d9f57 1498cbinfo = server_static_cbinfo;
059ec3d9
PH
1499
1500if (!expand_check(require_ciphers, US"tls_require_ciphers", &expciphers))
1501 return FAIL;
1502
1503/* In OpenSSL, cipher components are separated by hyphens. In GnuTLS, they
17c76198
PP
1504were historically separated by underscores. So that I can use either form in my
1505tests, and also for general convenience, we turn underscores into hyphens here.
1506*/
059ec3d9
PH
1507
1508if (expciphers != NULL)
1509 {
1510 uschar *s = expciphers;
1511 while (*s != 0) { if (*s == '_') *s = '-'; s++; }
1512 DEBUG(D_tls) debug_printf("required ciphers: %s\n", expciphers);
817d9f57 1513 if (!SSL_CTX_set_cipher_list(server_ctx, CS expciphers))
7199e1ee 1514 return tls_error(US"SSL_CTX_set_cipher_list", NULL, NULL);
7be682ca 1515 cbinfo->server_cipher_list = expciphers;
059ec3d9
PH
1516 }
1517
1518/* If this is a host for which certificate verification is mandatory or
1519optional, set up appropriately. */
1520
817d9f57 1521tls_in.certificate_verified = FALSE;
53a7196b
JH
1522#ifdef EXPERIMENTAL_DANE
1523tls_in.dane_verified = FALSE;
1524#endif
a2ff477a 1525server_verify_callback_called = FALSE;
059ec3d9
PH
1526
1527if (verify_check_host(&tls_verify_hosts) == OK)
1528 {
983207c1
JH
1529 rc = setup_certs(server_ctx, tls_verify_certificates, tls_crl, NULL,
1530 FALSE, verify_callback_server);
059ec3d9 1531 if (rc != OK) return rc;
a2ff477a 1532 server_verify_optional = FALSE;
059ec3d9
PH
1533 }
1534else if (verify_check_host(&tls_try_verify_hosts) == OK)
1535 {
983207c1
JH
1536 rc = setup_certs(server_ctx, tls_verify_certificates, tls_crl, NULL,
1537 TRUE, verify_callback_server);
059ec3d9 1538 if (rc != OK) return rc;
a2ff477a 1539 server_verify_optional = TRUE;
059ec3d9
PH
1540 }
1541
1542/* Prepare for new connection */
1543
817d9f57 1544if ((server_ssl = SSL_new(server_ctx)) == NULL) return tls_error(US"SSL_new", NULL, NULL);
da3ad30d
PP
1545
1546/* Warning: we used to SSL_clear(ssl) here, it was removed.
1547 *
1548 * With the SSL_clear(), we get strange interoperability bugs with
1549 * OpenSSL 1.0.1b and TLS1.1/1.2. It looks as though this may be a bug in
1550 * OpenSSL itself, as a clear should not lead to inability to follow protocols.
1551 *
1552 * The SSL_clear() call is to let an existing SSL* be reused, typically after
1553 * session shutdown. In this case, we have a brand new object and there's no
1554 * obvious reason to immediately clear it. I'm guessing that this was
1555 * originally added because of incomplete initialisation which the clear fixed,
1556 * in some historic release.
1557 */
059ec3d9
PH
1558
1559/* Set context and tell client to go ahead, except in the case of TLS startup
1560on connection, where outputting anything now upsets the clients and tends to
1561make them disconnect. We need to have an explicit fflush() here, to force out
1562the response. Other smtp_printf() calls do not need it, because in non-TLS
1563mode, the fflush() happens when smtp_getc() is called. */
1564
817d9f57
JH
1565SSL_set_session_id_context(server_ssl, sid_ctx, Ustrlen(sid_ctx));
1566if (!tls_in.on_connect)
059ec3d9
PH
1567 {
1568 smtp_printf("220 TLS go ahead\r\n");
1569 fflush(smtp_out);
1570 }
1571
1572/* Now negotiate the TLS session. We put our own timer on it, since it seems
1573that the OpenSSL library doesn't. */
1574
817d9f57
JH
1575SSL_set_wfd(server_ssl, fileno(smtp_out));
1576SSL_set_rfd(server_ssl, fileno(smtp_in));
1577SSL_set_accept_state(server_ssl);
059ec3d9
PH
1578
1579DEBUG(D_tls) debug_printf("Calling SSL_accept\n");
1580
1581sigalrm_seen = FALSE;
1582if (smtp_receive_timeout > 0) alarm(smtp_receive_timeout);
817d9f57 1583rc = SSL_accept(server_ssl);
059ec3d9
PH
1584alarm(0);
1585
1586if (rc <= 0)
1587 {
7199e1ee 1588 tls_error(US"SSL_accept", NULL, sigalrm_seen ? US"timed out" : NULL);
77bb000f
PP
1589 if (ERR_get_error() == 0)
1590 log_write(0, LOG_MAIN,
a053d125 1591 "TLS client disconnected cleanly (rejected our certificate?)");
059ec3d9
PH
1592 return FAIL;
1593 }
1594
1595DEBUG(D_tls) debug_printf("SSL_accept was successful\n");
1596
1597/* TLS has been set up. Adjust the input functions to read via TLS,
1598and initialize things. */
1599
817d9f57
JH
1600construct_cipher_name(server_ssl, cipherbuf, sizeof(cipherbuf), &tls_in.bits);
1601tls_in.cipher = cipherbuf;
059ec3d9
PH
1602
1603DEBUG(D_tls)
1604 {
1605 uschar buf[2048];
817d9f57 1606 if (SSL_get_shared_ciphers(server_ssl, CS buf, sizeof(buf)) != NULL)
059ec3d9
PH
1607 debug_printf("Shared ciphers: %s\n", buf);
1608 }
1609
9d1c15ef
JH
1610/* Record the certificate we presented */
1611 {
1612 X509 * crt = SSL_get_certificate(server_ssl);
1613 tls_in.ourcert = crt ? X509_dup(crt) : NULL;
1614 }
059ec3d9 1615
817d9f57
JH
1616/* Only used by the server-side tls (tls_in), including tls_getc.
1617 Client-side (tls_out) reads (seem to?) go via
1618 smtp_read_response()/ip_recv().
1619 Hence no need to duplicate for _in and _out.
1620 */
059ec3d9
PH
1621ssl_xfer_buffer = store_malloc(ssl_xfer_buffer_size);
1622ssl_xfer_buffer_lwm = ssl_xfer_buffer_hwm = 0;
1623ssl_xfer_eof = ssl_xfer_error = 0;
1624
1625receive_getc = tls_getc;
1626receive_ungetc = tls_ungetc;
1627receive_feof = tls_feof;
1628receive_ferror = tls_ferror;
58eb016e 1629receive_smtp_buffered = tls_smtp_buffered;
059ec3d9 1630
817d9f57 1631tls_in.active = fileno(smtp_out);
059ec3d9
PH
1632return OK;
1633}
1634
1635
1636
1637
043b1248
JH
1638static int
1639tls_client_basic_ctx_init(SSL_CTX * ctx,
1640 host_item * host, smtp_transport_options_block * ob
1641#ifdef EXPERIMENTAL_CERTNAMES
1642 , tls_ext_ctx_cb * cbinfo
1643#endif
1644 )
1645{
1646int rc;
1647/* stick to the old behaviour for compatibility if tls_verify_certificates is
1648 set but both tls_verify_hosts and tls_try_verify_hosts is not set. Check only
1649 the specified host patterns if one of them is defined */
1650
1651if ((!ob->tls_verify_hosts && !ob->tls_try_verify_hosts) ||
1652 (verify_check_host(&ob->tls_verify_hosts) == OK))
1653 {
1654 if ((rc = setup_certs(ctx, ob->tls_verify_certificates,
1655 ob->tls_crl, host, FALSE, verify_callback_client)) != OK)
1656 return rc;
1657 client_verify_optional = FALSE;
1658
1659#ifdef EXPERIMENTAL_CERTNAMES
1660 if (ob->tls_verify_cert_hostnames)
1661 {
1662 if (!expand_check(ob->tls_verify_cert_hostnames,
1663 US"tls_verify_cert_hostnames",
1664 &cbinfo->verify_cert_hostnames))
1665 return FAIL;
1666 if (cbinfo->verify_cert_hostnames)
1667 DEBUG(D_tls) debug_printf("Cert hostname to check: \"%s\"\n",
1668 cbinfo->verify_cert_hostnames);
1669 }
1670#endif
1671 }
1672else if (verify_check_host(&ob->tls_try_verify_hosts) == OK)
1673 {
1674 if ((rc = setup_certs(ctx, ob->tls_verify_certificates,
1675 ob->tls_crl, host, TRUE, verify_callback_client)) != OK)
1676 return rc;
1677 client_verify_optional = TRUE;
1678 }
1679
1680return OK;
1681}
059ec3d9 1682
fde080a4
JH
1683
1684#ifdef EXPERIMENTAL_DANE
1685static int
fde080a4
JH
1686dane_tlsa_load(SSL * ssl, host_item * host, dns_answer * dnsa)
1687{
1688dns_record * rr;
1689dns_scan dnss;
1690const char * hostnames[2] = { CS host->name, NULL };
1691int found = 0;
1692
1693if (DANESSL_init(ssl, NULL, hostnames) != 1)
1694 return tls_error(US"hostnames load", host, NULL);
1695
1696for (rr = dns_next_rr(dnsa, &dnss, RESET_ANSWERS);
1697 rr;
1698 rr = dns_next_rr(dnsa, &dnss, RESET_NEXT)
1699 ) if (rr->type == T_TLSA)
1700 {
1701 uschar * p = rr->data;
1702 uint8_t usage, selector, mtype;
1703 const char * mdname;
1704
1705 found++;
1706 usage = *p++;
1707 selector = *p++;
1708 mtype = *p++;
1709
1710 switch (mtype)
1711 {
1712 default:
1713 log_write(0, LOG_MAIN,
1714 "DANE error: TLSA record w/bad mtype 0x%x", mtype);
1715 return FAIL;
1716 case 0: mdname = NULL; break;
1717 case 1: mdname = "sha256"; break;
1718 case 2: mdname = "sha512"; break;
1719 }
1720
1721 switch (DANESSL_add_tlsa(ssl, usage, selector, mdname, p, rr->size - 3))
1722 {
1723 default:
1724 case 0: /* action not taken */
1725 return tls_error(US"tlsa load", host, NULL);
1726 case 1: break;
1727 }
594706ea
JH
1728
1729 tls_out.tlsa_usage |= 1<<usage;
fde080a4
JH
1730 }
1731
1732if (found)
1733 return OK;
1734
1735log_write(0, LOG_MAIN, "DANE error: No TLSA records");
1736return FAIL;
1737}
1738#endif /*EXPERIMENTAL_DANE*/
1739
1740
1741
059ec3d9
PH
1742/*************************************************
1743* Start a TLS session in a client *
1744*************************************************/
1745
1746/* Called from the smtp transport after STARTTLS has been accepted.
1747
1748Argument:
1749 fd the fd of the connection
1750 host connected host (for messages)
83da1223 1751 addr the first address
a7538db1 1752 tb transport (always smtp)
0e66b3b6 1753 tlsa_dnsa tlsa lookup, if DANE, else null
059ec3d9
PH
1754
1755Returns: OK on success
1756 FAIL otherwise - note that tls_error() will not give DEFER
1757 because this is not a server
1758*/
1759
1760int
f5d78688 1761tls_client_start(int fd, host_item *host, address_item *addr,
0e66b3b6
JH
1762 transport_instance *tb
1763#ifdef EXPERIMENTAL_DANE
1764 , dns_answer * tlsa_dnsa
1765#endif
1766 )
059ec3d9 1767{
a7538db1
JH
1768smtp_transport_options_block * ob =
1769 (smtp_transport_options_block *)tb->options_block;
059ec3d9 1770static uschar txt[256];
868f5672
JH
1771uschar * expciphers;
1772X509 * server_cert;
059ec3d9 1773int rc;
817d9f57 1774static uschar cipherbuf[256];
043b1248
JH
1775
1776#ifndef DISABLE_OCSP
043b1248 1777BOOL request_ocsp = FALSE;
6634ac8d 1778BOOL require_ocsp = FALSE;
043b1248 1779#endif
043b1248
JH
1780
1781#ifdef EXPERIMENTAL_DANE
594706ea 1782tls_out.tlsa_usage = 0;
043b1248
JH
1783#endif
1784
f2de3a33 1785#ifndef DISABLE_OCSP
043b1248 1786 {
4f59c424
JH
1787# ifdef EXPERIMENTAL_DANE
1788 if ( tlsa_dnsa
1789 && ob->hosts_request_ocsp[0] == '*'
1790 && ob->hosts_request_ocsp[1] == '\0'
1791 )
1792 {
1793 /* Unchanged from default. Use a safer one under DANE */
1794 request_ocsp = TRUE;
1795 ob->hosts_request_ocsp = US"${if or { {= {0}{$tls_out_tlsa_usage}} "
1796 " {= {4}{$tls_out_tlsa_usage}} } "
1797 " {*}{}}";
1798 }
1799# endif
1800
fca41d5a
JH
1801 if ((require_ocsp = verify_check_this_host(&ob->hosts_require_ocsp,
1802 NULL, host->name, host->address, NULL) == OK))
1803 request_ocsp = TRUE;
1804 else
fca41d5a 1805# ifdef EXPERIMENTAL_DANE
4f59c424 1806 if (!request_ocsp)
fca41d5a
JH
1807# endif
1808 request_ocsp = verify_check_this_host(&ob->hosts_request_ocsp,
1809 NULL, host->name, host->address, NULL) == OK;
043b1248 1810 }
f5d78688 1811#endif
059ec3d9 1812
65867078
JH
1813rc = tls_init(&client_ctx, host, NULL,
1814 ob->tls_certificate, ob->tls_privatekey,
f2de3a33 1815#ifndef DISABLE_OCSP
44662487 1816 (void *)(long)request_ocsp,
3f7eeb86 1817#endif
817d9f57 1818 addr, &client_static_cbinfo);
059ec3d9
PH
1819if (rc != OK) return rc;
1820
817d9f57 1821tls_out.certificate_verified = FALSE;
a2ff477a 1822client_verify_callback_called = FALSE;
059ec3d9 1823
65867078
JH
1824if (!expand_check(ob->tls_require_ciphers, US"tls_require_ciphers",
1825 &expciphers))
059ec3d9
PH
1826 return FAIL;
1827
1828/* In OpenSSL, cipher components are separated by hyphens. In GnuTLS, they
1829are separated by underscores. So that I can use either form in my tests, and
1830also for general convenience, we turn underscores into hyphens here. */
1831
1832if (expciphers != NULL)
1833 {
1834 uschar *s = expciphers;
1835 while (*s != 0) { if (*s == '_') *s = '-'; s++; }
1836 DEBUG(D_tls) debug_printf("required ciphers: %s\n", expciphers);
817d9f57 1837 if (!SSL_CTX_set_cipher_list(client_ctx, CS expciphers))
7199e1ee 1838 return tls_error(US"SSL_CTX_set_cipher_list", host, NULL);
059ec3d9
PH
1839 }
1840
043b1248 1841#ifdef EXPERIMENTAL_DANE
0e66b3b6 1842if (tlsa_dnsa)
a63be306 1843 {
e5cccda9
JH
1844 SSL_CTX_set_verify(client_ctx, SSL_VERIFY_PEER, verify_callback_client_dane);
1845
043b1248 1846 if (!DANESSL_library_init())
b4161d10 1847 return tls_error(US"library init", host, NULL);
043b1248 1848 if (DANESSL_CTX_init(client_ctx) <= 0)
b4161d10 1849 return tls_error(US"context init", host, NULL);
043b1248
JH
1850 }
1851else
e51c7be2 1852
043b1248
JH
1853#endif
1854
1855 if ((rc = tls_client_basic_ctx_init(client_ctx, host, ob
e51c7be2 1856#ifdef EXPERIMENTAL_CERTNAMES
043b1248 1857 , client_static_cbinfo
e51c7be2 1858#endif
043b1248 1859 )) != OK)
65867078 1860 return rc;
059ec3d9 1861
65867078
JH
1862if ((client_ssl = SSL_new(client_ctx)) == NULL)
1863 return tls_error(US"SSL_new", host, NULL);
817d9f57
JH
1864SSL_set_session_id_context(client_ssl, sid_ctx, Ustrlen(sid_ctx));
1865SSL_set_fd(client_ssl, fd);
1866SSL_set_connect_state(client_ssl);
059ec3d9 1867
65867078 1868if (ob->tls_sni)
3f0945ff 1869 {
65867078 1870 if (!expand_check(ob->tls_sni, US"tls_sni", &tls_out.sni))
3f0945ff 1871 return FAIL;
ec4b68e5 1872 if (tls_out.sni == NULL)
2c9a0e86
PP
1873 {
1874 DEBUG(D_tls) debug_printf("Setting TLS SNI forced to fail, not sending\n");
1875 }
ec4b68e5 1876 else if (!Ustrlen(tls_out.sni))
817d9f57 1877 tls_out.sni = NULL;
3f0945ff
PP
1878 else
1879 {
35731706 1880#ifdef EXIM_HAVE_OPENSSL_TLSEXT
817d9f57
JH
1881 DEBUG(D_tls) debug_printf("Setting TLS SNI \"%s\"\n", tls_out.sni);
1882 SSL_set_tlsext_host_name(client_ssl, tls_out.sni);
35731706
PP
1883#else
1884 DEBUG(D_tls)
1885 debug_printf("OpenSSL at build-time lacked SNI support, ignoring \"%s\"\n",
02d9264f 1886 tls_out.sni);
35731706 1887#endif
3f0945ff
PP
1888 }
1889 }
1890
594706ea 1891#ifdef EXPERIMENTAL_DANE
0e66b3b6
JH
1892if (tlsa_dnsa)
1893 if ((rc = dane_tlsa_load(client_ssl, host, tlsa_dnsa)) != OK)
594706ea
JH
1894 return rc;
1895#endif
1896
f2de3a33 1897#ifndef DISABLE_OCSP
f5d78688
JH
1898/* Request certificate status at connection-time. If the server
1899does OCSP stapling we will get the callback (set in tls_init()) */
b50c8b84 1900# ifdef EXPERIMENTAL_DANE
44662487
JH
1901if (request_ocsp)
1902 {
594706ea 1903 const uschar * s;
41afb5cb
JH
1904 if ( ((s = ob->hosts_require_ocsp) && Ustrstr(s, US"tls_out_tlsa_usage"))
1905 || ((s = ob->hosts_request_ocsp) && Ustrstr(s, US"tls_out_tlsa_usage"))
594706ea
JH
1906 )
1907 { /* Re-eval now $tls_out_tlsa_usage is populated. If
1908 this means we avoid the OCSP request, we wasted the setup
1909 cost in tls_init(). */
1910 require_ocsp = verify_check_this_host(&ob->hosts_require_ocsp,
1911 NULL, host->name, host->address, NULL) == OK;
1912 request_ocsp = require_ocsp ? TRUE
1913 : verify_check_this_host(&ob->hosts_request_ocsp,
1914 NULL, host->name, host->address, NULL) == OK;
1915 }
1916 }
b50c8b84
JH
1917# endif
1918
594706ea
JH
1919if (request_ocsp)
1920 {
f5d78688 1921 SSL_set_tlsext_status_type(client_ssl, TLSEXT_STATUSTYPE_ocsp);
44662487
JH
1922 client_static_cbinfo->u_ocsp.client.verify_required = require_ocsp;
1923 tls_out.ocsp = OCSP_NOT_RESP;
1924 }
f5d78688
JH
1925#endif
1926
a7538db1
JH
1927#ifdef EXPERIMENTAL_TPDA
1928client_static_cbinfo->event_action = tb->tpda_event_action;
1929#endif
043b1248 1930
059ec3d9
PH
1931/* There doesn't seem to be a built-in timeout on connection. */
1932
1933DEBUG(D_tls) debug_printf("Calling SSL_connect\n");
1934sigalrm_seen = FALSE;
65867078 1935alarm(ob->command_timeout);
817d9f57 1936rc = SSL_connect(client_ssl);
059ec3d9
PH
1937alarm(0);
1938
043b1248 1939#ifdef EXPERIMENTAL_DANE
0e66b3b6 1940if (tlsa_dnsa)
fde080a4 1941 DANESSL_cleanup(client_ssl);
043b1248
JH
1942#endif
1943
059ec3d9 1944if (rc <= 0)
7199e1ee 1945 return tls_error(US"SSL_connect", host, sigalrm_seen ? US"timed out" : NULL);
059ec3d9
PH
1946
1947DEBUG(D_tls) debug_printf("SSL_connect succeeded\n");
1948
453a6645 1949/* Beware anonymous ciphers which lead to server_cert being NULL */
9d1c15ef 1950/*XXX server_cert is never freed... use X509_free() */
817d9f57 1951server_cert = SSL_get_peer_certificate (client_ssl);
453a6645
PP
1952if (server_cert)
1953 {
817d9f57 1954 tls_out.peerdn = US X509_NAME_oneline(X509_get_subject_name(server_cert),
453a6645 1955 CS txt, sizeof(txt));
9d1c15ef 1956 tls_out.peerdn = txt; /*XXX a static buffer... */
453a6645
PP
1957 }
1958else
817d9f57 1959 tls_out.peerdn = NULL;
059ec3d9 1960
817d9f57
JH
1961construct_cipher_name(client_ssl, cipherbuf, sizeof(cipherbuf), &tls_out.bits);
1962tls_out.cipher = cipherbuf;
059ec3d9 1963
9d1c15ef
JH
1964/* Record the certificate we presented */
1965 {
1966 X509 * crt = SSL_get_certificate(client_ssl);
1967 tls_out.ourcert = crt ? X509_dup(crt) : NULL;
1968 }
1969
817d9f57 1970tls_out.active = fd;
059ec3d9
PH
1971return OK;
1972}
1973
1974
1975
1976
1977
1978/*************************************************
1979* TLS version of getc *
1980*************************************************/
1981
1982/* This gets the next byte from the TLS input buffer. If the buffer is empty,
1983it refills the buffer via the SSL reading function.
1984
1985Arguments: none
1986Returns: the next character or EOF
817d9f57
JH
1987
1988Only used by the server-side TLS.
059ec3d9
PH
1989*/
1990
1991int
1992tls_getc(void)
1993{
1994if (ssl_xfer_buffer_lwm >= ssl_xfer_buffer_hwm)
1995 {
1996 int error;
1997 int inbytes;
1998
817d9f57 1999 DEBUG(D_tls) debug_printf("Calling SSL_read(%p, %p, %u)\n", server_ssl,
c80c5570 2000 ssl_xfer_buffer, ssl_xfer_buffer_size);
059ec3d9
PH
2001
2002 if (smtp_receive_timeout > 0) alarm(smtp_receive_timeout);
817d9f57
JH
2003 inbytes = SSL_read(server_ssl, CS ssl_xfer_buffer, ssl_xfer_buffer_size);
2004 error = SSL_get_error(server_ssl, inbytes);
059ec3d9
PH
2005 alarm(0);
2006
2007 /* SSL_ERROR_ZERO_RETURN appears to mean that the SSL session has been
2008 closed down, not that the socket itself has been closed down. Revert to
2009 non-SSL handling. */
2010
2011 if (error == SSL_ERROR_ZERO_RETURN)
2012 {
2013 DEBUG(D_tls) debug_printf("Got SSL_ERROR_ZERO_RETURN\n");
2014
2015 receive_getc = smtp_getc;
2016 receive_ungetc = smtp_ungetc;
2017 receive_feof = smtp_feof;
2018 receive_ferror = smtp_ferror;
58eb016e 2019 receive_smtp_buffered = smtp_buffered;
059ec3d9 2020
817d9f57
JH
2021 SSL_free(server_ssl);
2022 server_ssl = NULL;
2023 tls_in.active = -1;
2024 tls_in.bits = 0;
2025 tls_in.cipher = NULL;
2026 tls_in.peerdn = NULL;
2027 tls_in.sni = NULL;
059ec3d9
PH
2028
2029 return smtp_getc();
2030 }
2031
2032 /* Handle genuine errors */
2033
ba084640
PP
2034 else if (error == SSL_ERROR_SSL)
2035 {
2036 ERR_error_string(ERR_get_error(), ssl_errstring);
89dd51cd 2037 log_write(0, LOG_MAIN, "TLS error (SSL_read): %s", ssl_errstring);
ba084640
PP
2038 ssl_xfer_error = 1;
2039 return EOF;
2040 }
2041
059ec3d9
PH
2042 else if (error != SSL_ERROR_NONE)
2043 {
2044 DEBUG(D_tls) debug_printf("Got SSL error %d\n", error);
2045 ssl_xfer_error = 1;
2046 return EOF;
2047 }
c80c5570 2048
80a47a2c
TK
2049#ifndef DISABLE_DKIM
2050 dkim_exim_verify_feed(ssl_xfer_buffer, inbytes);
2051#endif
059ec3d9
PH
2052 ssl_xfer_buffer_hwm = inbytes;
2053 ssl_xfer_buffer_lwm = 0;
2054 }
2055
2056/* Something in the buffer; return next uschar */
2057
2058return ssl_xfer_buffer[ssl_xfer_buffer_lwm++];
2059}
2060
2061
2062
2063/*************************************************
2064* Read bytes from TLS channel *
2065*************************************************/
2066
2067/*
2068Arguments:
2069 buff buffer of data
2070 len size of buffer
2071
2072Returns: the number of bytes read
2073 -1 after a failed read
817d9f57
JH
2074
2075Only used by the client-side TLS.
059ec3d9
PH
2076*/
2077
2078int
389ca47a 2079tls_read(BOOL is_server, uschar *buff, size_t len)
059ec3d9 2080{
389ca47a 2081SSL *ssl = is_server ? server_ssl : client_ssl;
059ec3d9
PH
2082int inbytes;
2083int error;
2084
389ca47a 2085DEBUG(D_tls) debug_printf("Calling SSL_read(%p, %p, %u)\n", ssl,
c80c5570 2086 buff, (unsigned int)len);
059ec3d9 2087
389ca47a
JH
2088inbytes = SSL_read(ssl, CS buff, len);
2089error = SSL_get_error(ssl, inbytes);
059ec3d9
PH
2090
2091if (error == SSL_ERROR_ZERO_RETURN)
2092 {
2093 DEBUG(D_tls) debug_printf("Got SSL_ERROR_ZERO_RETURN\n");
2094 return -1;
2095 }
2096else if (error != SSL_ERROR_NONE)
2097 {
2098 return -1;
2099 }
2100
2101return inbytes;
2102}
2103
2104
2105
2106
2107
2108/*************************************************
2109* Write bytes down TLS channel *
2110*************************************************/
2111
2112/*
2113Arguments:
817d9f57 2114 is_server channel specifier
059ec3d9
PH
2115 buff buffer of data
2116 len number of bytes
2117
2118Returns: the number of bytes after a successful write,
2119 -1 after a failed write
817d9f57
JH
2120
2121Used by both server-side and client-side TLS.
059ec3d9
PH
2122*/
2123
2124int
817d9f57 2125tls_write(BOOL is_server, const uschar *buff, size_t len)
059ec3d9
PH
2126{
2127int outbytes;
2128int error;
2129int left = len;
817d9f57 2130SSL *ssl = is_server ? server_ssl : client_ssl;
059ec3d9 2131
c80c5570 2132DEBUG(D_tls) debug_printf("tls_do_write(%p, %d)\n", buff, left);
059ec3d9
PH
2133while (left > 0)
2134 {
c80c5570 2135 DEBUG(D_tls) debug_printf("SSL_write(SSL, %p, %d)\n", buff, left);
059ec3d9
PH
2136 outbytes = SSL_write(ssl, CS buff, left);
2137 error = SSL_get_error(ssl, outbytes);
2138 DEBUG(D_tls) debug_printf("outbytes=%d error=%d\n", outbytes, error);
2139 switch (error)
2140 {
2141 case SSL_ERROR_SSL:
2142 ERR_error_string(ERR_get_error(), ssl_errstring);
2143 log_write(0, LOG_MAIN, "TLS error (SSL_write): %s", ssl_errstring);
2144 return -1;
2145
2146 case SSL_ERROR_NONE:
2147 left -= outbytes;
2148 buff += outbytes;
2149 break;
2150
2151 case SSL_ERROR_ZERO_RETURN:
2152 log_write(0, LOG_MAIN, "SSL channel closed on write");
2153 return -1;
2154
817d9f57
JH
2155 case SSL_ERROR_SYSCALL:
2156 log_write(0, LOG_MAIN, "SSL_write: (from %s) syscall: %s",
2157 sender_fullhost ? sender_fullhost : US"<unknown>",
2158 strerror(errno));
2159
059ec3d9
PH
2160 default:
2161 log_write(0, LOG_MAIN, "SSL_write error %d", error);
2162 return -1;
2163 }
2164 }
2165return len;
2166}
2167
2168
2169
2170/*************************************************
2171* Close down a TLS session *
2172*************************************************/
2173
2174/* This is also called from within a delivery subprocess forked from the
2175daemon, to shut down the TLS library, without actually doing a shutdown (which
2176would tamper with the SSL session in the parent process).
2177
2178Arguments: TRUE if SSL_shutdown is to be called
2179Returns: nothing
817d9f57
JH
2180
2181Used by both server-side and client-side TLS.
059ec3d9
PH
2182*/
2183
2184void
817d9f57 2185tls_close(BOOL is_server, BOOL shutdown)
059ec3d9 2186{
817d9f57 2187SSL **sslp = is_server ? &server_ssl : &client_ssl;
389ca47a 2188int *fdp = is_server ? &tls_in.active : &tls_out.active;
817d9f57
JH
2189
2190if (*fdp < 0) return; /* TLS was not active */
059ec3d9
PH
2191
2192if (shutdown)
2193 {
2194 DEBUG(D_tls) debug_printf("tls_close(): shutting down SSL\n");
817d9f57 2195 SSL_shutdown(*sslp);
059ec3d9
PH
2196 }
2197
817d9f57
JH
2198SSL_free(*sslp);
2199*sslp = NULL;
059ec3d9 2200
817d9f57 2201*fdp = -1;
059ec3d9
PH
2202}
2203
36f12725
NM
2204
2205
2206
2207/*************************************************
3375e053
PP
2208* Let tls_require_ciphers be checked at startup *
2209*************************************************/
2210
2211/* The tls_require_ciphers option, if set, must be something which the
2212library can parse.
2213
2214Returns: NULL on success, or error message
2215*/
2216
2217uschar *
2218tls_validate_require_cipher(void)
2219{
2220SSL_CTX *ctx;
2221uschar *s, *expciphers, *err;
2222
2223/* this duplicates from tls_init(), we need a better "init just global
2224state, for no specific purpose" singleton function of our own */
2225
2226SSL_load_error_strings();
2227OpenSSL_add_ssl_algorithms();
2228#if (OPENSSL_VERSION_NUMBER >= 0x0090800fL) && !defined(OPENSSL_NO_SHA256)
2229/* SHA256 is becoming ever more popular. This makes sure it gets added to the
2230list of available digests. */
2231EVP_add_digest(EVP_sha256());
2232#endif
2233
2234if (!(tls_require_ciphers && *tls_require_ciphers))
2235 return NULL;
2236
2237if (!expand_check(tls_require_ciphers, US"tls_require_ciphers", &expciphers))
2238 return US"failed to expand tls_require_ciphers";
2239
2240if (!(expciphers && *expciphers))
2241 return NULL;
2242
2243/* normalisation ripped from above */
2244s = expciphers;
2245while (*s != 0) { if (*s == '_') *s = '-'; s++; }
2246
2247err = NULL;
2248
2249ctx = SSL_CTX_new(SSLv23_server_method());
2250if (!ctx)
2251 {
2252 ERR_error_string(ERR_get_error(), ssl_errstring);
2253 return string_sprintf("SSL_CTX_new() failed: %s", ssl_errstring);
2254 }
2255
2256DEBUG(D_tls)
2257 debug_printf("tls_require_ciphers expands to \"%s\"\n", expciphers);
2258
2259if (!SSL_CTX_set_cipher_list(ctx, CS expciphers))
2260 {
2261 ERR_error_string(ERR_get_error(), ssl_errstring);
2262 err = string_sprintf("SSL_CTX_set_cipher_list(%s) failed", expciphers);
2263 }
2264
2265SSL_CTX_free(ctx);
2266
2267return err;
2268}
2269
2270
2271
2272
2273/*************************************************
36f12725
NM
2274* Report the library versions. *
2275*************************************************/
2276
2277/* There have historically been some issues with binary compatibility in
2278OpenSSL libraries; if Exim (like many other applications) is built against
2279one version of OpenSSL but the run-time linker picks up another version,
2280it can result in serious failures, including crashing with a SIGSEGV. So
2281report the version found by the compiler and the run-time version.
2282
f64a1e23
PP
2283Note: some OS vendors backport security fixes without changing the version
2284number/string, and the version date remains unchanged. The _build_ date
2285will change, so we can more usefully assist with version diagnosis by also
2286reporting the build date.
2287
36f12725
NM
2288Arguments: a FILE* to print the results to
2289Returns: nothing
2290*/
2291
2292void
2293tls_version_report(FILE *f)
2294{
754a0503 2295fprintf(f, "Library version: OpenSSL: Compile: %s\n"
f64a1e23
PP
2296 " Runtime: %s\n"
2297 " : %s\n",
754a0503 2298 OPENSSL_VERSION_TEXT,
f64a1e23
PP
2299 SSLeay_version(SSLEAY_VERSION),
2300 SSLeay_version(SSLEAY_BUILT_ON));
2301/* third line is 38 characters for the %s and the line is 73 chars long;
2302the OpenSSL output includes a "built on: " prefix already. */
36f12725
NM
2303}
2304
9e3331ea
TK
2305
2306
2307
2308/*************************************************
17c76198 2309* Random number generation *
9e3331ea
TK
2310*************************************************/
2311
2312/* Pseudo-random number generation. The result is not expected to be
2313cryptographically strong but not so weak that someone will shoot themselves
2314in the foot using it as a nonce in input in some email header scheme or
2315whatever weirdness they'll twist this into. The result should handle fork()
2316and avoid repeating sequences. OpenSSL handles that for us.
2317
2318Arguments:
2319 max range maximum
2320Returns a random number in range [0, max-1]
2321*/
2322
2323int
17c76198 2324vaguely_random_number(int max)
9e3331ea
TK
2325{
2326unsigned int r;
2327int i, needed_len;
de6135a0
PP
2328static pid_t pidlast = 0;
2329pid_t pidnow;
9e3331ea
TK
2330uschar *p;
2331uschar smallbuf[sizeof(r)];
2332
2333if (max <= 1)
2334 return 0;
2335
de6135a0
PP
2336pidnow = getpid();
2337if (pidnow != pidlast)
2338 {
2339 /* Although OpenSSL documents that "OpenSSL makes sure that the PRNG state
2340 is unique for each thread", this doesn't apparently apply across processes,
2341 so our own warning from vaguely_random_number_fallback() applies here too.
2342 Fix per PostgreSQL. */
2343 if (pidlast != 0)
2344 RAND_cleanup();
2345 pidlast = pidnow;
2346 }
2347
9e3331ea
TK
2348/* OpenSSL auto-seeds from /dev/random, etc, but this a double-check. */
2349if (!RAND_status())
2350 {
2351 randstuff r;
2352 gettimeofday(&r.tv, NULL);
2353 r.p = getpid();
2354
2355 RAND_seed((uschar *)(&r), sizeof(r));
2356 }
2357/* We're after pseudo-random, not random; if we still don't have enough data
2358in the internal PRNG then our options are limited. We could sleep and hope
2359for entropy to come along (prayer technique) but if the system is so depleted
2360in the first place then something is likely to just keep taking it. Instead,
2361we'll just take whatever little bit of pseudo-random we can still manage to
2362get. */
2363
2364needed_len = sizeof(r);
2365/* Don't take 8 times more entropy than needed if int is 8 octets and we were
2366asked for a number less than 10. */
2367for (r = max, i = 0; r; ++i)
2368 r >>= 1;
2369i = (i + 7) / 8;
2370if (i < needed_len)
2371 needed_len = i;
2372
2373/* We do not care if crypto-strong */
17c76198
PP
2374i = RAND_pseudo_bytes(smallbuf, needed_len);
2375if (i < 0)
2376 {
2377 DEBUG(D_all)
2378 debug_printf("OpenSSL RAND_pseudo_bytes() not supported by RAND method, using fallback.\n");
2379 return vaguely_random_number_fallback(max);
2380 }
2381
9e3331ea
TK
2382r = 0;
2383for (p = smallbuf; needed_len; --needed_len, ++p)
2384 {
2385 r *= 256;
2386 r += *p;
2387 }
2388
2389/* We don't particularly care about weighted results; if someone wants
2390smooth distribution and cares enough then they should submit a patch then. */
2391return r % max;
2392}
2393
77bb000f
PP
2394
2395
2396
2397/*************************************************
2398* OpenSSL option parse *
2399*************************************************/
2400
2401/* Parse one option for tls_openssl_options_parse below
2402
2403Arguments:
2404 name one option name
2405 value place to store a value for it
2406Returns success or failure in parsing
2407*/
2408
2409struct exim_openssl_option {
2410 uschar *name;
2411 long value;
2412};
2413/* We could use a macro to expand, but we need the ifdef and not all the
2414options document which version they were introduced in. Policylet: include
2415all options unless explicitly for DTLS, let the administrator choose which
2416to apply.
2417
2418This list is current as of:
e2fbf4a2
PP
2419 ==> 1.0.1b <==
2420Plus SSL_OP_SAFARI_ECDHE_ECDSA_BUG from 2013-June patch/discussion on openssl-dev
2421*/
77bb000f
PP
2422static struct exim_openssl_option exim_openssl_options[] = {
2423/* KEEP SORTED ALPHABETICALLY! */
2424#ifdef SSL_OP_ALL
73a46702 2425 { US"all", SSL_OP_ALL },
77bb000f
PP
2426#endif
2427#ifdef SSL_OP_ALLOW_UNSAFE_LEGACY_RENEGOTIATION
73a46702 2428 { US"allow_unsafe_legacy_renegotiation", SSL_OP_ALLOW_UNSAFE_LEGACY_RENEGOTIATION },
77bb000f
PP
2429#endif
2430#ifdef SSL_OP_CIPHER_SERVER_PREFERENCE
73a46702 2431 { US"cipher_server_preference", SSL_OP_CIPHER_SERVER_PREFERENCE },
77bb000f
PP
2432#endif
2433#ifdef SSL_OP_DONT_INSERT_EMPTY_FRAGMENTS
73a46702 2434 { US"dont_insert_empty_fragments", SSL_OP_DONT_INSERT_EMPTY_FRAGMENTS },
77bb000f
PP
2435#endif
2436#ifdef SSL_OP_EPHEMERAL_RSA
73a46702 2437 { US"ephemeral_rsa", SSL_OP_EPHEMERAL_RSA },
77bb000f
PP
2438#endif
2439#ifdef SSL_OP_LEGACY_SERVER_CONNECT
73a46702 2440 { US"legacy_server_connect", SSL_OP_LEGACY_SERVER_CONNECT },
77bb000f
PP
2441#endif
2442#ifdef SSL_OP_MICROSOFT_BIG_SSLV3_BUFFER
73a46702 2443 { US"microsoft_big_sslv3_buffer", SSL_OP_MICROSOFT_BIG_SSLV3_BUFFER },
77bb000f
PP
2444#endif
2445#ifdef SSL_OP_MICROSOFT_SESS_ID_BUG
73a46702 2446 { US"microsoft_sess_id_bug", SSL_OP_MICROSOFT_SESS_ID_BUG },
77bb000f
PP
2447#endif
2448#ifdef SSL_OP_MSIE_SSLV2_RSA_PADDING
73a46702 2449 { US"msie_sslv2_rsa_padding", SSL_OP_MSIE_SSLV2_RSA_PADDING },
77bb000f
PP
2450#endif
2451#ifdef SSL_OP_NETSCAPE_CHALLENGE_BUG
73a46702 2452 { US"netscape_challenge_bug", SSL_OP_NETSCAPE_CHALLENGE_BUG },
77bb000f
PP
2453#endif
2454#ifdef SSL_OP_NETSCAPE_REUSE_CIPHER_CHANGE_BUG
73a46702 2455 { US"netscape_reuse_cipher_change_bug", SSL_OP_NETSCAPE_REUSE_CIPHER_CHANGE_BUG },
77bb000f 2456#endif
c80c5570
PP
2457#ifdef SSL_OP_NO_COMPRESSION
2458 { US"no_compression", SSL_OP_NO_COMPRESSION },
2459#endif
77bb000f 2460#ifdef SSL_OP_NO_SESSION_RESUMPTION_ON_RENEGOTIATION
73a46702 2461 { US"no_session_resumption_on_renegotiation", SSL_OP_NO_SESSION_RESUMPTION_ON_RENEGOTIATION },
77bb000f 2462#endif
c0c7b2da
PP
2463#ifdef SSL_OP_NO_SSLv2
2464 { US"no_sslv2", SSL_OP_NO_SSLv2 },
2465#endif
2466#ifdef SSL_OP_NO_SSLv3
2467 { US"no_sslv3", SSL_OP_NO_SSLv3 },
2468#endif
2469#ifdef SSL_OP_NO_TICKET
2470 { US"no_ticket", SSL_OP_NO_TICKET },
2471#endif
2472#ifdef SSL_OP_NO_TLSv1
2473 { US"no_tlsv1", SSL_OP_NO_TLSv1 },
2474#endif
c80c5570
PP
2475#ifdef SSL_OP_NO_TLSv1_1
2476#if SSL_OP_NO_TLSv1_1 == 0x00000400L
2477 /* Error in chosen value in 1.0.1a; see first item in CHANGES for 1.0.1b */
2478#warning OpenSSL 1.0.1a uses a bad value for SSL_OP_NO_TLSv1_1, ignoring
2479#else
2480 { US"no_tlsv1_1", SSL_OP_NO_TLSv1_1 },
2481#endif
2482#endif
2483#ifdef SSL_OP_NO_TLSv1_2
2484 { US"no_tlsv1_2", SSL_OP_NO_TLSv1_2 },
2485#endif
e2fbf4a2
PP
2486#ifdef SSL_OP_SAFARI_ECDHE_ECDSA_BUG
2487 { US"safari_ecdhe_ecdsa_bug", SSL_OP_SAFARI_ECDHE_ECDSA_BUG },
2488#endif
77bb000f 2489#ifdef SSL_OP_SINGLE_DH_USE
73a46702 2490 { US"single_dh_use", SSL_OP_SINGLE_DH_USE },
77bb000f
PP
2491#endif
2492#ifdef SSL_OP_SINGLE_ECDH_USE
73a46702 2493 { US"single_ecdh_use", SSL_OP_SINGLE_ECDH_USE },
77bb000f
PP
2494#endif
2495#ifdef SSL_OP_SSLEAY_080_CLIENT_DH_BUG
73a46702 2496 { US"ssleay_080_client_dh_bug", SSL_OP_SSLEAY_080_CLIENT_DH_BUG },
77bb000f
PP
2497#endif
2498#ifdef SSL_OP_SSLREF2_REUSE_CERT_TYPE_BUG
73a46702 2499 { US"sslref2_reuse_cert_type_bug", SSL_OP_SSLREF2_REUSE_CERT_TYPE_BUG },
77bb000f
PP
2500#endif
2501#ifdef SSL_OP_TLS_BLOCK_PADDING_BUG
73a46702 2502 { US"tls_block_padding_bug", SSL_OP_TLS_BLOCK_PADDING_BUG },
77bb000f
PP
2503#endif
2504#ifdef SSL_OP_TLS_D5_BUG
73a46702 2505 { US"tls_d5_bug", SSL_OP_TLS_D5_BUG },
77bb000f
PP
2506#endif
2507#ifdef SSL_OP_TLS_ROLLBACK_BUG
73a46702 2508 { US"tls_rollback_bug", SSL_OP_TLS_ROLLBACK_BUG },
77bb000f
PP
2509#endif
2510};
2511static int exim_openssl_options_size =
2512 sizeof(exim_openssl_options)/sizeof(struct exim_openssl_option);
2513
c80c5570 2514
77bb000f
PP
2515static BOOL
2516tls_openssl_one_option_parse(uschar *name, long *value)
2517{
2518int first = 0;
2519int last = exim_openssl_options_size;
2520while (last > first)
2521 {
2522 int middle = (first + last)/2;
2523 int c = Ustrcmp(name, exim_openssl_options[middle].name);
2524 if (c == 0)
2525 {
2526 *value = exim_openssl_options[middle].value;
2527 return TRUE;
2528 }
2529 else if (c > 0)
2530 first = middle + 1;
2531 else
2532 last = middle;
2533 }
2534return FALSE;
2535}
2536
2537
2538
2539
2540/*************************************************
2541* OpenSSL option parsing logic *
2542*************************************************/
2543
2544/* OpenSSL has a number of compatibility options which an administrator might
2545reasonably wish to set. Interpret a list similarly to decode_bits(), so that
2546we look like log_selector.
2547
2548Arguments:
2549 option_spec the administrator-supplied string of options
2550 results ptr to long storage for the options bitmap
2551Returns success or failure
2552*/
2553
2554BOOL
2555tls_openssl_options_parse(uschar *option_spec, long *results)
2556{
2557long result, item;
2558uschar *s, *end;
2559uschar keep_c;
2560BOOL adding, item_parsed;
2561
0e944a0d 2562result = 0L;
b1770b6e 2563/* Prior to 4.80 we or'd in SSL_OP_DONT_INSERT_EMPTY_FRAGMENTS; removed
da3ad30d 2564 * from default because it increases BEAST susceptibility. */
f0f5a555
PP
2565#ifdef SSL_OP_NO_SSLv2
2566result |= SSL_OP_NO_SSLv2;
2567#endif
77bb000f
PP
2568
2569if (option_spec == NULL)
2570 {
2571 *results = result;
2572 return TRUE;
2573 }
2574
2575for (s=option_spec; *s != '\0'; /**/)
2576 {
2577 while (isspace(*s)) ++s;
2578 if (*s == '\0')
2579 break;
2580 if (*s != '+' && *s != '-')
2581 {
2582 DEBUG(D_tls) debug_printf("malformed openssl option setting: "
0e944a0d 2583 "+ or - expected but found \"%s\"\n", s);
77bb000f
PP
2584 return FALSE;
2585 }
2586 adding = *s++ == '+';
2587 for (end = s; (*end != '\0') && !isspace(*end); ++end) /**/ ;
2588 keep_c = *end;
2589 *end = '\0';
2590 item_parsed = tls_openssl_one_option_parse(s, &item);
2591 if (!item_parsed)
2592 {
0e944a0d 2593 DEBUG(D_tls) debug_printf("openssl option setting unrecognised: \"%s\"\n", s);
77bb000f
PP
2594 return FALSE;
2595 }
2596 DEBUG(D_tls) debug_printf("openssl option, %s from %lx: %lx (%s)\n",
2597 adding ? "adding" : "removing", result, item, s);
2598 if (adding)
2599 result |= item;
2600 else
2601 result &= ~item;
2602 *end = keep_c;
2603 s = end;
2604 }
2605
2606*results = result;
2607return TRUE;
2608}
2609
9d1c15ef
JH
2610/* vi: aw ai sw=2
2611*/
059ec3d9 2612/* End of tls-openssl.c */