Clean & integrate force_command.
[exim.git] / src / src / tls-openssl.c
CommitLineData
059ec3d9
PH
1/*************************************************
2* Exim - an Internet mail transport agent *
3*************************************************/
4
c4ceed07 5/* Copyright (c) University of Cambridge 1995 - 2012 */
059ec3d9
PH
6/* See the file NOTICE for conditions of use and distribution. */
7
8/* This module provides the TLS (aka SSL) support for Exim using the OpenSSL
9library. It is #included into the tls.c file when that library is used. The
10code herein is based on a patch that was originally contributed by Steve
11Haslam. It was adapted from stunnel, a GPL program by Michal Trojnara.
12
13No cryptographic code is included in Exim. All this module does is to call
14functions from the OpenSSL library. */
15
16
17/* Heading stuff */
18
19#include <openssl/lhash.h>
20#include <openssl/ssl.h>
21#include <openssl/err.h>
22#include <openssl/rand.h>
3f7eeb86
PP
23#ifdef EXPERIMENTAL_OCSP
24#include <openssl/ocsp.h>
25#endif
26
27#ifdef EXPERIMENTAL_OCSP
28#define EXIM_OCSP_SKEW_SECONDS (300L)
29#define EXIM_OCSP_MAX_AGE (-1L)
30#endif
059ec3d9 31
3bcbbbe2
PP
32#if OPENSSL_VERSION_NUMBER >= 0x0090806fL && !defined(OPENSSL_NO_TLSEXT)
33#define EXIM_HAVE_OPENSSL_TLSEXT
34#endif
35
059ec3d9
PH
36/* Structure for collecting random data for seeding. */
37
38typedef struct randstuff {
9e3331ea
TK
39 struct timeval tv;
40 pid_t p;
059ec3d9
PH
41} randstuff;
42
43/* Local static variables */
44
a2ff477a
JH
45static BOOL client_verify_callback_called = FALSE;
46static BOOL server_verify_callback_called = FALSE;
059ec3d9
PH
47static const uschar *sid_ctx = US"exim";
48
d4f09789
PP
49/* We have three different contexts to care about.
50
51Simple case: client, `client_ctx`
52 As a client, we can be doing a callout or cut-through delivery while receiving
53 a message. So we have a client context, which should have options initialised
54 from the SMTP Transport.
55
56Server:
57 There are two cases: with and without ServerNameIndication from the client.
58 Given TLS SNI, we can be using different keys, certs and various other
59 configuration settings, because they're re-expanded with $tls_sni set. This
60 allows vhosting with TLS. This SNI is sent in the handshake.
61 A client might not send SNI, so we need a fallback, and an initial setup too.
62 So as a server, we start out using `server_ctx`.
63 If SNI is sent by the client, then we as server, mid-negotiation, try to clone
64 `server_sni` from `server_ctx` and then initialise settings by re-expanding
65 configuration.
66*/
67
817d9f57
JH
68static SSL_CTX *client_ctx = NULL;
69static SSL_CTX *server_ctx = NULL;
70static SSL *client_ssl = NULL;
71static SSL *server_ssl = NULL;
389ca47a 72
35731706 73#ifdef EXIM_HAVE_OPENSSL_TLSEXT
817d9f57 74static SSL_CTX *server_sni = NULL;
35731706 75#endif
059ec3d9
PH
76
77static char ssl_errstring[256];
78
79static int ssl_session_timeout = 200;
a2ff477a
JH
80static BOOL client_verify_optional = FALSE;
81static BOOL server_verify_optional = FALSE;
059ec3d9 82
7be682ca 83static BOOL reexpand_tls_files_for_sni = FALSE;
059ec3d9
PH
84
85
7be682ca
PP
86typedef struct tls_ext_ctx_cb {
87 uschar *certificate;
88 uschar *privatekey;
3f7eeb86
PP
89#ifdef EXPERIMENTAL_OCSP
90 uschar *ocsp_file;
91 uschar *ocsp_file_expanded;
92 OCSP_RESPONSE *ocsp_response;
93#endif
7be682ca
PP
94 uschar *dhparam;
95 /* these are cached from first expand */
96 uschar *server_cipher_list;
97 /* only passed down to tls_error: */
98 host_item *host;
99} tls_ext_ctx_cb;
100
101/* should figure out a cleanup of API to handle state preserved per
102implementation, for various reasons, which can be void * in the APIs.
103For now, we hack around it. */
817d9f57
JH
104tls_ext_ctx_cb *client_static_cbinfo = NULL;
105tls_ext_ctx_cb *server_static_cbinfo = NULL;
7be682ca
PP
106
107static int
a2ff477a 108setup_certs(SSL_CTX *sctx, uschar *certs, uschar *crl, host_item *host, BOOL optional, BOOL client);
059ec3d9 109
3f7eeb86 110/* Callbacks */
3bcbbbe2 111#ifdef EXIM_HAVE_OPENSSL_TLSEXT
3f7eeb86 112static int tls_servername_cb(SSL *s, int *ad ARG_UNUSED, void *arg);
3bcbbbe2 113#endif
3f7eeb86
PP
114#ifdef EXPERIMENTAL_OCSP
115static int tls_stapling_cb(SSL *s, void *arg);
116#endif
117
059ec3d9
PH
118
119/*************************************************
120* Handle TLS error *
121*************************************************/
122
123/* Called from lots of places when errors occur before actually starting to do
124the TLS handshake, that is, while the session is still in clear. Always returns
125DEFER for a server and FAIL for a client so that most calls can use "return
126tls_error(...)" to do this processing and then give an appropriate return. A
127single function is used for both server and client, because it is called from
128some shared functions.
129
130Argument:
131 prefix text to include in the logged error
132 host NULL if setting up a server;
133 the connected host if setting up a client
7199e1ee 134 msg error message or NULL if we should ask OpenSSL
059ec3d9
PH
135
136Returns: OK/DEFER/FAIL
137*/
138
139static int
7199e1ee 140tls_error(uschar *prefix, host_item *host, uschar *msg)
059ec3d9 141{
7199e1ee
TF
142if (msg == NULL)
143 {
144 ERR_error_string(ERR_get_error(), ssl_errstring);
5ca6d115 145 msg = (uschar *)ssl_errstring;
7199e1ee
TF
146 }
147
059ec3d9
PH
148if (host == NULL)
149 {
7199e1ee 150 uschar *conn_info = smtp_get_connection_info();
5ca6d115 151 if (Ustrncmp(conn_info, US"SMTP ", 5) == 0)
7199e1ee
TF
152 conn_info += 5;
153 log_write(0, LOG_MAIN, "TLS error on %s (%s): %s",
154 conn_info, prefix, msg);
059ec3d9
PH
155 return DEFER;
156 }
157else
158 {
159 log_write(0, LOG_MAIN, "TLS error on connection to %s [%s] (%s): %s",
7199e1ee 160 host->name, host->address, prefix, msg);
059ec3d9
PH
161 return FAIL;
162 }
163}
164
165
166
167/*************************************************
168* Callback to generate RSA key *
169*************************************************/
170
171/*
172Arguments:
173 s SSL connection
174 export not used
175 keylength keylength
176
177Returns: pointer to generated key
178*/
179
180static RSA *
181rsa_callback(SSL *s, int export, int keylength)
182{
183RSA *rsa_key;
184export = export; /* Shut picky compilers up */
185DEBUG(D_tls) debug_printf("Generating %d bit RSA key...\n", keylength);
186rsa_key = RSA_generate_key(keylength, RSA_F4, NULL, NULL);
187if (rsa_key == NULL)
188 {
189 ERR_error_string(ERR_get_error(), ssl_errstring);
190 log_write(0, LOG_MAIN|LOG_PANIC, "TLS error (RSA_generate_key): %s",
191 ssl_errstring);
192 return NULL;
193 }
194return rsa_key;
195}
196
197
198
199
200/*************************************************
201* Callback for verification *
202*************************************************/
203
204/* The SSL library does certificate verification if set up to do so. This
205callback has the current yes/no state is in "state". If verification succeeded,
206we set up the tls_peerdn string. If verification failed, what happens depends
207on whether the client is required to present a verifiable certificate or not.
208
209If verification is optional, we change the state to yes, but still log the
210verification error. For some reason (it really would help to have proper
211documentation of OpenSSL), this callback function then gets called again, this
212time with state = 1. In fact, that's useful, because we can set up the peerdn
213value, but we must take care not to set the private verified flag on the second
214time through.
215
216Note: this function is not called if the client fails to present a certificate
217when asked. We get here only if a certificate has been received. Handling of
218optional verification for this case is done when requesting SSL to verify, by
219setting SSL_VERIFY_FAIL_IF_NO_PEER_CERT in the non-optional case.
220
221Arguments:
222 state current yes/no state as 1/0
223 x509ctx certificate information.
a2ff477a 224 client TRUE for client startup, FALSE for server startup
059ec3d9
PH
225
226Returns: 1 if verified, 0 if not
227*/
228
229static int
a2ff477a 230verify_callback(int state, X509_STORE_CTX *x509ctx, BOOL client)
059ec3d9
PH
231{
232static uschar txt[256];
a2ff477a
JH
233tls_support * tlsp;
234BOOL * calledp;
235BOOL * optionalp;
236
237if (client)
238 {
239 tlsp= &tls_out;
240 calledp= &client_verify_callback_called;
241 optionalp= &client_verify_optional;
242 }
243else
244 {
245 tlsp= &tls_in;
246 calledp= &server_verify_callback_called;
247 optionalp= &server_verify_optional;
248 }
059ec3d9
PH
249
250X509_NAME_oneline(X509_get_subject_name(x509ctx->current_cert),
251 CS txt, sizeof(txt));
252
253if (state == 0)
254 {
255 log_write(0, LOG_MAIN, "SSL verify error: depth=%d error=%s cert=%s",
256 x509ctx->error_depth,
257 X509_verify_cert_error_string(x509ctx->error),
258 txt);
a2ff477a
JH
259 tlsp->certificate_verified = FALSE;
260 *calledp = TRUE;
261 if (!*optionalp) return 0; /* reject */
059ec3d9
PH
262 DEBUG(D_tls) debug_printf("SSL verify failure overridden (host in "
263 "tls_try_verify_hosts)\n");
264 return 1; /* accept */
265 }
266
267if (x509ctx->error_depth != 0)
268 {
269 DEBUG(D_tls) debug_printf("SSL verify ok: depth=%d cert=%s\n",
270 x509ctx->error_depth, txt);
271 }
272else
273 {
274 DEBUG(D_tls) debug_printf("SSL%s peer: %s\n",
a2ff477a
JH
275 *calledp ? "" : " authenticated", txt);
276 tlsp->peerdn = txt;
059ec3d9
PH
277 }
278
a2ff477a
JH
279if (!*calledp) tlsp->certificate_verified = TRUE;
280*calledp = TRUE;
059ec3d9
PH
281
282return 1; /* accept */
283}
284
a2ff477a
JH
285static int
286verify_callback_client(int state, X509_STORE_CTX *x509ctx)
287{
288return verify_callback(state, x509ctx, TRUE);
289}
290
291static int
292verify_callback_server(int state, X509_STORE_CTX *x509ctx)
293{
294return verify_callback(state, x509ctx, FALSE);
295}
296
059ec3d9
PH
297
298
299/*************************************************
300* Information callback *
301*************************************************/
302
303/* The SSL library functions call this from time to time to indicate what they
7be682ca
PP
304are doing. We copy the string to the debugging output when TLS debugging has
305been requested.
059ec3d9
PH
306
307Arguments:
308 s the SSL connection
309 where
310 ret
311
312Returns: nothing
313*/
314
315static void
316info_callback(SSL *s, int where, int ret)
317{
318where = where;
319ret = ret;
320DEBUG(D_tls) debug_printf("SSL info: %s\n", SSL_state_string_long(s));
321}
322
323
324
325/*************************************************
326* Initialize for DH *
327*************************************************/
328
329/* If dhparam is set, expand it, and load up the parameters for DH encryption.
330
331Arguments:
a799883d 332 dhparam DH parameter file or fixed parameter identity string
7199e1ee 333 host connected host, if client; NULL if server
059ec3d9
PH
334
335Returns: TRUE if OK (nothing to set up, or setup worked)
336*/
337
338static BOOL
a799883d 339init_dh(SSL_CTX *sctx, uschar *dhparam, host_item *host)
059ec3d9 340{
059ec3d9
PH
341BIO *bio;
342DH *dh;
343uschar *dhexpanded;
a799883d 344const char *pem;
059ec3d9
PH
345
346if (!expand_check(dhparam, US"tls_dhparam", &dhexpanded))
347 return FALSE;
348
a799883d 349if (dhexpanded == NULL || *dhexpanded == '\0')
059ec3d9 350 {
a799883d 351 bio = BIO_new_mem_buf(CS std_dh_prime_default(), -1);
059ec3d9 352 }
a799883d 353else if (dhexpanded[0] == '/')
059ec3d9 354 {
a799883d
PP
355 bio = BIO_new_file(CS dhexpanded, "r");
356 if (bio == NULL)
059ec3d9 357 {
7199e1ee 358 tls_error(string_sprintf("could not read dhparams file %s", dhexpanded),
a799883d
PP
359 host, US strerror(errno));
360 return FALSE;
059ec3d9 361 }
a799883d
PP
362 }
363else
364 {
365 if (Ustrcmp(dhexpanded, "none") == 0)
059ec3d9 366 {
a799883d
PP
367 DEBUG(D_tls) debug_printf("Requested no DH parameters.\n");
368 return TRUE;
059ec3d9 369 }
a799883d
PP
370
371 pem = std_dh_prime_named(dhexpanded);
372 if (!pem)
373 {
374 tls_error(string_sprintf("Unknown standard DH prime \"%s\"", dhexpanded),
375 host, US strerror(errno));
376 return FALSE;
377 }
378 bio = BIO_new_mem_buf(CS pem, -1);
379 }
380
381dh = PEM_read_bio_DHparams(bio, NULL, NULL, NULL);
382if (dh == NULL)
383 {
059ec3d9 384 BIO_free(bio);
a799883d
PP
385 tls_error(string_sprintf("Could not read tls_dhparams \"%s\"", dhexpanded),
386 host, NULL);
387 return FALSE;
388 }
389
390/* Even if it is larger, we silently return success rather than cause things
391 * to fail out, so that a too-large DH will not knock out all TLS; it's a
392 * debatable choice. */
393if ((8*DH_size(dh)) > tls_dh_max_bits)
394 {
395 DEBUG(D_tls)
396 debug_printf("dhparams file %d bits, is > tls_dh_max_bits limit of %d",
397 8*DH_size(dh), tls_dh_max_bits);
398 }
399else
400 {
401 SSL_CTX_set_tmp_dh(sctx, dh);
402 DEBUG(D_tls)
403 debug_printf("Diffie-Hellman initialized from %s with %d-bit prime\n",
404 dhexpanded ? dhexpanded : US"default", 8*DH_size(dh));
059ec3d9
PH
405 }
406
a799883d
PP
407DH_free(dh);
408BIO_free(bio);
409
410return TRUE;
059ec3d9
PH
411}
412
413
414
415
3f7eeb86
PP
416#ifdef EXPERIMENTAL_OCSP
417/*************************************************
418* Load OCSP information into state *
419*************************************************/
420
421/* Called to load the OCSP response from the given file into memory, once
422caller has determined this is needed. Checks validity. Debugs a message
423if invalid.
424
425ASSUMES: single response, for single cert.
426
427Arguments:
428 sctx the SSL_CTX* to update
429 cbinfo various parts of session state
430 expanded the filename putatively holding an OCSP response
431
432*/
433
434static void
435ocsp_load_response(SSL_CTX *sctx,
436 tls_ext_ctx_cb *cbinfo,
437 const uschar *expanded)
438{
439BIO *bio;
440OCSP_RESPONSE *resp;
441OCSP_BASICRESP *basic_response;
442OCSP_SINGLERESP *single_response;
443ASN1_GENERALIZEDTIME *rev, *thisupd, *nextupd;
444X509_STORE *store;
445unsigned long verify_flags;
446int status, reason, i;
447
448cbinfo->ocsp_file_expanded = string_copy(expanded);
449if (cbinfo->ocsp_response)
450 {
451 OCSP_RESPONSE_free(cbinfo->ocsp_response);
452 cbinfo->ocsp_response = NULL;
453 }
454
455bio = BIO_new_file(CS cbinfo->ocsp_file_expanded, "rb");
456if (!bio)
457 {
458 DEBUG(D_tls) debug_printf("Failed to open OCSP response file \"%s\"\n",
459 cbinfo->ocsp_file_expanded);
460 return;
461 }
462
463resp = d2i_OCSP_RESPONSE_bio(bio, NULL);
464BIO_free(bio);
465if (!resp)
466 {
467 DEBUG(D_tls) debug_printf("Error reading OCSP response.\n");
468 return;
469 }
470
471status = OCSP_response_status(resp);
472if (status != OCSP_RESPONSE_STATUS_SUCCESSFUL)
473 {
474 DEBUG(D_tls) debug_printf("OCSP response not valid: %s (%d)\n",
475 OCSP_response_status_str(status), status);
476 return;
477 }
478
479basic_response = OCSP_response_get1_basic(resp);
480if (!basic_response)
481 {
482 DEBUG(D_tls)
483 debug_printf("OCSP response parse error: unable to extract basic response.\n");
484 return;
485 }
486
487store = SSL_CTX_get_cert_store(sctx);
488verify_flags = OCSP_NOVERIFY; /* check sigs, but not purpose */
489
490/* May need to expose ability to adjust those flags?
491OCSP_NOSIGS OCSP_NOVERIFY OCSP_NOCHAIN OCSP_NOCHECKS OCSP_NOEXPLICIT
492OCSP_TRUSTOTHER OCSP_NOINTERN */
493
494i = OCSP_basic_verify(basic_response, NULL, store, verify_flags);
495if (i <= 0)
496 {
497 DEBUG(D_tls) {
498 ERR_error_string(ERR_get_error(), ssl_errstring);
499 debug_printf("OCSP response verify failure: %s\n", US ssl_errstring);
500 }
501 return;
502 }
503
504/* Here's the simplifying assumption: there's only one response, for the
505one certificate we use, and nothing for anything else in a chain. If this
506proves false, we need to extract a cert id from our issued cert
507(tls_certificate) and use that for OCSP_resp_find_status() (which finds the
508right cert in the stack and then calls OCSP_single_get0_status()).
509
510I'm hoping to avoid reworking a bunch more of how we handle state here. */
511single_response = OCSP_resp_get0(basic_response, 0);
512if (!single_response)
513 {
514 DEBUG(D_tls)
515 debug_printf("Unable to get first response from OCSP basic response.\n");
516 return;
517 }
518
519status = OCSP_single_get0_status(single_response, &reason, &rev, &thisupd, &nextupd);
520/* how does this status differ from the one above? */
521if (status != OCSP_RESPONSE_STATUS_SUCCESSFUL)
522 {
523 DEBUG(D_tls) debug_printf("OCSP response not valid (take 2): %s (%d)\n",
524 OCSP_response_status_str(status), status);
525 return;
526 }
527
528if (!OCSP_check_validity(thisupd, nextupd, EXIM_OCSP_SKEW_SECONDS, EXIM_OCSP_MAX_AGE))
529 {
530 DEBUG(D_tls) debug_printf("OCSP status invalid times.\n");
531 return;
532 }
533
534cbinfo->ocsp_response = resp;
535}
536#endif
537
538
539
540
059ec3d9 541/*************************************************
7be682ca
PP
542* Expand key and cert file specs *
543*************************************************/
544
545/* Called once during tls_init and possibly againt during TLS setup, for a
546new context, if Server Name Indication was used and tls_sni was seen in
547the certificate string.
548
549Arguments:
550 sctx the SSL_CTX* to update
551 cbinfo various parts of session state
552
553Returns: OK/DEFER/FAIL
554*/
555
556static int
3f7eeb86 557tls_expand_session_files(SSL_CTX *sctx, tls_ext_ctx_cb *cbinfo)
7be682ca
PP
558{
559uschar *expanded;
560
561if (cbinfo->certificate == NULL)
562 return OK;
563
d9b2312b
JH
564if (Ustrstr(cbinfo->certificate, US"tls_sni") ||
565 Ustrstr(cbinfo->certificate, US"tls_in_sni") ||
566 Ustrstr(cbinfo->certificate, US"tls_out_sni")
567 )
7be682ca
PP
568 reexpand_tls_files_for_sni = TRUE;
569
570if (!expand_check(cbinfo->certificate, US"tls_certificate", &expanded))
571 return DEFER;
572
573if (expanded != NULL)
574 {
575 DEBUG(D_tls) debug_printf("tls_certificate file %s\n", expanded);
576 if (!SSL_CTX_use_certificate_chain_file(sctx, CS expanded))
577 return tls_error(string_sprintf(
578 "SSL_CTX_use_certificate_chain_file file=%s", expanded),
579 cbinfo->host, NULL);
580 }
581
582if (cbinfo->privatekey != NULL &&
583 !expand_check(cbinfo->privatekey, US"tls_privatekey", &expanded))
584 return DEFER;
585
586/* If expansion was forced to fail, key_expanded will be NULL. If the result
587of the expansion is an empty string, ignore it also, and assume the private
588key is in the same file as the certificate. */
589
590if (expanded != NULL && *expanded != 0)
591 {
592 DEBUG(D_tls) debug_printf("tls_privatekey file %s\n", expanded);
593 if (!SSL_CTX_use_PrivateKey_file(sctx, CS expanded, SSL_FILETYPE_PEM))
594 return tls_error(string_sprintf(
595 "SSL_CTX_use_PrivateKey_file file=%s", expanded), cbinfo->host, NULL);
596 }
597
3f7eeb86
PP
598#ifdef EXPERIMENTAL_OCSP
599if (cbinfo->ocsp_file != NULL)
600 {
601 if (!expand_check(cbinfo->ocsp_file, US"tls_ocsp_file", &expanded))
602 return DEFER;
603
604 if (expanded != NULL && *expanded != 0)
605 {
606 DEBUG(D_tls) debug_printf("tls_ocsp_file %s\n", expanded);
607 if (cbinfo->ocsp_file_expanded &&
608 (Ustrcmp(expanded, cbinfo->ocsp_file_expanded) == 0))
609 {
610 DEBUG(D_tls)
611 debug_printf("tls_ocsp_file value unchanged, using existing values.\n");
612 } else {
613 ocsp_load_response(sctx, cbinfo, expanded);
614 }
615 }
616 }
617#endif
618
7be682ca
PP
619return OK;
620}
621
622
623
624
625/*************************************************
626* Callback to handle SNI *
627*************************************************/
628
629/* Called when acting as server during the TLS session setup if a Server Name
630Indication extension was sent by the client.
631
632API documentation is OpenSSL s_server.c implementation.
633
634Arguments:
635 s SSL* of the current session
636 ad unknown (part of OpenSSL API) (unused)
637 arg Callback of "our" registered data
638
639Returns: SSL_TLSEXT_ERR_{OK,ALERT_WARNING,ALERT_FATAL,NOACK}
640*/
641
3bcbbbe2 642#ifdef EXIM_HAVE_OPENSSL_TLSEXT
7be682ca 643static int
7be682ca
PP
644tls_servername_cb(SSL *s, int *ad ARG_UNUSED, void *arg)
645{
646const char *servername = SSL_get_servername(s, TLSEXT_NAMETYPE_host_name);
3f7eeb86 647tls_ext_ctx_cb *cbinfo = (tls_ext_ctx_cb *) arg;
7be682ca 648int rc;
3f0945ff 649int old_pool = store_pool;
7be682ca
PP
650
651if (!servername)
652 return SSL_TLSEXT_ERR_OK;
653
3f0945ff 654DEBUG(D_tls) debug_printf("Received TLS SNI \"%s\"%s\n", servername,
7be682ca
PP
655 reexpand_tls_files_for_sni ? "" : " (unused for certificate selection)");
656
657/* Make the extension value available for expansion */
3f0945ff 658store_pool = POOL_PERM;
817d9f57 659tls_in.sni = string_copy(US servername);
3f0945ff 660store_pool = old_pool;
7be682ca
PP
661
662if (!reexpand_tls_files_for_sni)
663 return SSL_TLSEXT_ERR_OK;
664
665/* Can't find an SSL_CTX_clone() or equivalent, so we do it manually;
666not confident that memcpy wouldn't break some internal reference counting.
667Especially since there's a references struct member, which would be off. */
668
817d9f57
JH
669server_sni = SSL_CTX_new(SSLv23_server_method());
670if (!server_sni)
7be682ca
PP
671 {
672 ERR_error_string(ERR_get_error(), ssl_errstring);
673 DEBUG(D_tls) debug_printf("SSL_CTX_new() failed: %s\n", ssl_errstring);
674 return SSL_TLSEXT_ERR_NOACK;
675 }
676
677/* Not sure how many of these are actually needed, since SSL object
678already exists. Might even need this selfsame callback, for reneg? */
679
817d9f57
JH
680SSL_CTX_set_info_callback(server_sni, SSL_CTX_get_info_callback(server_ctx));
681SSL_CTX_set_mode(server_sni, SSL_CTX_get_mode(server_ctx));
682SSL_CTX_set_options(server_sni, SSL_CTX_get_options(server_ctx));
683SSL_CTX_set_timeout(server_sni, SSL_CTX_get_timeout(server_ctx));
684SSL_CTX_set_tlsext_servername_callback(server_sni, tls_servername_cb);
685SSL_CTX_set_tlsext_servername_arg(server_sni, cbinfo);
7be682ca 686if (cbinfo->server_cipher_list)
817d9f57 687 SSL_CTX_set_cipher_list(server_sni, CS cbinfo->server_cipher_list);
3f7eeb86
PP
688#ifdef EXPERIMENTAL_OCSP
689if (cbinfo->ocsp_file)
690 {
817d9f57 691 SSL_CTX_set_tlsext_status_cb(server_sni, tls_stapling_cb);
14c7b357 692 SSL_CTX_set_tlsext_status_arg(server_sni, cbinfo);
3f7eeb86
PP
693 }
694#endif
7be682ca 695
a2ff477a 696rc = setup_certs(server_sni, tls_verify_certificates, tls_crl, NULL, FALSE, FALSE);
7be682ca
PP
697if (rc != OK) return SSL_TLSEXT_ERR_NOACK;
698
3f7eeb86
PP
699/* do this after setup_certs, because this can require the certs for verifying
700OCSP information. */
817d9f57 701rc = tls_expand_session_files(server_sni, cbinfo);
7be682ca
PP
702if (rc != OK) return SSL_TLSEXT_ERR_NOACK;
703
389ca47a 704rc = init_dh(server_sni, cbinfo->dhparam, NULL);
a799883d
PP
705if (rc != OK) return SSL_TLSEXT_ERR_NOACK;
706
7be682ca 707DEBUG(D_tls) debug_printf("Switching SSL context.\n");
817d9f57 708SSL_set_SSL_CTX(s, server_sni);
7be682ca
PP
709
710return SSL_TLSEXT_ERR_OK;
711}
3bcbbbe2 712#endif /* EXIM_HAVE_OPENSSL_TLSEXT */
7be682ca
PP
713
714
715
716
3f7eeb86
PP
717#ifdef EXPERIMENTAL_OCSP
718/*************************************************
719* Callback to handle OCSP Stapling *
720*************************************************/
721
722/* Called when acting as server during the TLS session setup if the client
723requests OCSP information with a Certificate Status Request.
724
725Documentation via openssl s_server.c and the Apache patch from the OpenSSL
726project.
727
728*/
729
730static int
731tls_stapling_cb(SSL *s, void *arg)
732{
733const tls_ext_ctx_cb *cbinfo = (tls_ext_ctx_cb *) arg;
734uschar *response_der;
735int response_der_len;
736
737DEBUG(D_tls) debug_printf("Received TLS status request (OCSP stapling); %s response.\n",
738 cbinfo->ocsp_response ? "have" : "lack");
739if (!cbinfo->ocsp_response)
740 return SSL_TLSEXT_ERR_NOACK;
741
742response_der = NULL;
743response_der_len = i2d_OCSP_RESPONSE(cbinfo->ocsp_response, &response_der);
744if (response_der_len <= 0)
745 return SSL_TLSEXT_ERR_NOACK;
746
5e55c7a9 747SSL_set_tlsext_status_ocsp_resp(server_ssl, response_der, response_der_len);
3f7eeb86
PP
748return SSL_TLSEXT_ERR_OK;
749}
750
751#endif /* EXPERIMENTAL_OCSP */
752
753
754
755
7be682ca 756/*************************************************
059ec3d9
PH
757* Initialize for TLS *
758*************************************************/
759
760/* Called from both server and client code, to do preliminary initialization of
761the library.
762
763Arguments:
764 host connected host, if client; NULL if server
765 dhparam DH parameter file
766 certificate certificate file
767 privatekey private key
768 addr address if client; NULL if server (for some randomness)
769
770Returns: OK/DEFER/FAIL
771*/
772
773static int
817d9f57 774tls_init(SSL_CTX **ctxp, host_item *host, uschar *dhparam, uschar *certificate,
3f7eeb86
PP
775 uschar *privatekey,
776#ifdef EXPERIMENTAL_OCSP
777 uschar *ocsp_file,
778#endif
817d9f57 779 address_item *addr, tls_ext_ctx_cb ** cbp)
059ec3d9 780{
77bb000f 781long init_options;
7be682ca 782int rc;
77bb000f 783BOOL okay;
7be682ca
PP
784tls_ext_ctx_cb *cbinfo;
785
786cbinfo = store_malloc(sizeof(tls_ext_ctx_cb));
787cbinfo->certificate = certificate;
788cbinfo->privatekey = privatekey;
3f7eeb86
PP
789#ifdef EXPERIMENTAL_OCSP
790cbinfo->ocsp_file = ocsp_file;
6de1067a
JH
791cbinfo->ocsp_file_expanded = NULL;
792cbinfo->ocsp_response = NULL;
3f7eeb86 793#endif
7be682ca
PP
794cbinfo->dhparam = dhparam;
795cbinfo->host = host;
77bb000f 796
059ec3d9
PH
797SSL_load_error_strings(); /* basic set up */
798OpenSSL_add_ssl_algorithms();
799
388d6564 800#if (OPENSSL_VERSION_NUMBER >= 0x0090800fL) && !defined(OPENSSL_NO_SHA256)
77bb000f 801/* SHA256 is becoming ever more popular. This makes sure it gets added to the
a0475b69
TK
802list of available digests. */
803EVP_add_digest(EVP_sha256());
cf1ef1a9 804#endif
a0475b69 805
f0f5a555
PP
806/* Create a context.
807The OpenSSL docs in 1.0.1b have not been updated to clarify TLS variant
808negotiation in the different methods; as far as I can tell, the only
809*_{server,client}_method which allows negotiation is SSLv23, which exists even
810when OpenSSL is built without SSLv2 support.
811By disabling with openssl_options, we can let admins re-enable with the
812existing knob. */
059ec3d9 813
817d9f57 814*ctxp = SSL_CTX_new((host == NULL)?
059ec3d9
PH
815 SSLv23_server_method() : SSLv23_client_method());
816
817d9f57 817if (*ctxp == NULL) return tls_error(US"SSL_CTX_new", host, NULL);
059ec3d9
PH
818
819/* It turns out that we need to seed the random number generator this early in
820order to get the full complement of ciphers to work. It took me roughly a day
821of work to discover this by experiment.
822
823On systems that have /dev/urandom, SSL may automatically seed itself from
824there. Otherwise, we have to make something up as best we can. Double check
825afterwards. */
826
827if (!RAND_status())
828 {
829 randstuff r;
9e3331ea 830 gettimeofday(&r.tv, NULL);
059ec3d9
PH
831 r.p = getpid();
832
833 RAND_seed((uschar *)(&r), sizeof(r));
834 RAND_seed((uschar *)big_buffer, big_buffer_size);
835 if (addr != NULL) RAND_seed((uschar *)addr, sizeof(addr));
836
837 if (!RAND_status())
7199e1ee 838 return tls_error(US"RAND_status", host,
5ca6d115 839 US"unable to seed random number generator");
059ec3d9
PH
840 }
841
842/* Set up the information callback, which outputs if debugging is at a suitable
843level. */
844
817d9f57 845SSL_CTX_set_info_callback(*ctxp, (void (*)())info_callback);
059ec3d9 846
c80c5570 847/* Automatically re-try reads/writes after renegotiation. */
817d9f57 848(void) SSL_CTX_set_mode(*ctxp, SSL_MODE_AUTO_RETRY);
c80c5570 849
77bb000f
PP
850/* Apply administrator-supplied work-arounds.
851Historically we applied just one requested option,
852SSL_OP_DONT_INSERT_EMPTY_FRAGMENTS, but when bug 994 requested a second, we
853moved to an administrator-controlled list of options to specify and
854grandfathered in the first one as the default value for "openssl_options".
059ec3d9 855
77bb000f
PP
856No OpenSSL version number checks: the options we accept depend upon the
857availability of the option value macros from OpenSSL. */
059ec3d9 858
77bb000f
PP
859okay = tls_openssl_options_parse(openssl_options, &init_options);
860if (!okay)
73a46702 861 return tls_error(US"openssl_options parsing failed", host, NULL);
77bb000f
PP
862
863if (init_options)
864 {
865 DEBUG(D_tls) debug_printf("setting SSL CTX options: %#lx\n", init_options);
817d9f57 866 if (!(SSL_CTX_set_options(*ctxp, init_options)))
77bb000f
PP
867 return tls_error(string_sprintf(
868 "SSL_CTX_set_option(%#lx)", init_options), host, NULL);
869 }
870else
871 DEBUG(D_tls) debug_printf("no SSL CTX options to set\n");
059ec3d9
PH
872
873/* Initialize with DH parameters if supplied */
874
817d9f57 875if (!init_dh(*ctxp, dhparam, host)) return DEFER;
059ec3d9 876
3f7eeb86 877/* Set up certificate and key (and perhaps OCSP info) */
059ec3d9 878
817d9f57 879rc = tls_expand_session_files(*ctxp, cbinfo);
7be682ca 880if (rc != OK) return rc;
c91535f3 881
7be682ca 882/* If we need to handle SNI, do so */
3bcbbbe2 883#ifdef EXIM_HAVE_OPENSSL_TLSEXT
3f0945ff
PP
884if (host == NULL)
885 {
3f7eeb86
PP
886#ifdef EXPERIMENTAL_OCSP
887 /* We check ocsp_file, not ocsp_response, because we care about if
888 the option exists, not what the current expansion might be, as SNI might
889 change the certificate and OCSP file in use between now and the time the
890 callback is invoked. */
891 if (cbinfo->ocsp_file)
892 {
5e55c7a9
PP
893 SSL_CTX_set_tlsext_status_cb(server_ctx, tls_stapling_cb);
894 SSL_CTX_set_tlsext_status_arg(server_ctx, cbinfo);
3f7eeb86
PP
895 }
896#endif
3f0945ff
PP
897 /* We always do this, so that $tls_sni is available even if not used in
898 tls_certificate */
817d9f57
JH
899 SSL_CTX_set_tlsext_servername_callback(*ctxp, tls_servername_cb);
900 SSL_CTX_set_tlsext_servername_arg(*ctxp, cbinfo);
3f0945ff 901 }
7be682ca 902#endif
059ec3d9
PH
903
904/* Set up the RSA callback */
905
817d9f57 906SSL_CTX_set_tmp_rsa_callback(*ctxp, rsa_callback);
059ec3d9
PH
907
908/* Finally, set the timeout, and we are done */
909
817d9f57 910SSL_CTX_set_timeout(*ctxp, ssl_session_timeout);
059ec3d9 911DEBUG(D_tls) debug_printf("Initialized TLS\n");
7be682ca 912
817d9f57 913*cbp = cbinfo;
7be682ca 914
059ec3d9
PH
915return OK;
916}
917
918
919
920
921/*************************************************
922* Get name of cipher in use *
923*************************************************/
924
817d9f57 925/*
059ec3d9 926Argument: pointer to an SSL structure for the connection
817d9f57
JH
927 buffer to use for answer
928 size of buffer
929 pointer to number of bits for cipher
059ec3d9
PH
930Returns: nothing
931*/
932
933static void
817d9f57 934construct_cipher_name(SSL *ssl, uschar *cipherbuf, int bsize, int *bits)
059ec3d9 935{
57b3a7f5
PP
936/* With OpenSSL 1.0.0a, this needs to be const but the documentation doesn't
937yet reflect that. It should be a safe change anyway, even 0.9.8 versions have
938the accessor functions use const in the prototype. */
939const SSL_CIPHER *c;
059ec3d9 940uschar *ver;
059ec3d9
PH
941
942switch (ssl->session->ssl_version)
943 {
944 case SSL2_VERSION:
945 ver = US"SSLv2";
946 break;
947
948 case SSL3_VERSION:
949 ver = US"SSLv3";
950 break;
951
952 case TLS1_VERSION:
953 ver = US"TLSv1";
954 break;
955
c80c5570
PP
956#ifdef TLS1_1_VERSION
957 case TLS1_1_VERSION:
958 ver = US"TLSv1.1";
959 break;
960#endif
961
962#ifdef TLS1_2_VERSION
963 case TLS1_2_VERSION:
964 ver = US"TLSv1.2";
965 break;
966#endif
967
059ec3d9
PH
968 default:
969 ver = US"UNKNOWN";
970 }
971
57b3a7f5 972c = (const SSL_CIPHER *) SSL_get_current_cipher(ssl);
817d9f57 973SSL_CIPHER_get_bits(c, bits);
059ec3d9 974
817d9f57
JH
975string_format(cipherbuf, bsize, "%s:%s:%u", ver,
976 SSL_CIPHER_get_name(c), *bits);
059ec3d9
PH
977
978DEBUG(D_tls) debug_printf("Cipher: %s\n", cipherbuf);
979}
980
981
982
983
984
985/*************************************************
986* Set up for verifying certificates *
987*************************************************/
988
989/* Called by both client and server startup
990
991Arguments:
7be682ca 992 sctx SSL_CTX* to initialise
059ec3d9
PH
993 certs certs file or NULL
994 crl CRL file or NULL
995 host NULL in a server; the remote host in a client
996 optional TRUE if called from a server for a host in tls_try_verify_hosts;
997 otherwise passed as FALSE
a2ff477a 998 client TRUE if called for client startup, FALSE for server startup
059ec3d9
PH
999
1000Returns: OK/DEFER/FAIL
1001*/
1002
1003static int
a2ff477a 1004setup_certs(SSL_CTX *sctx, uschar *certs, uschar *crl, host_item *host, BOOL optional, BOOL client)
059ec3d9
PH
1005{
1006uschar *expcerts, *expcrl;
1007
1008if (!expand_check(certs, US"tls_verify_certificates", &expcerts))
1009 return DEFER;
1010
26e72755 1011if (expcerts != NULL && *expcerts != '\0')
059ec3d9
PH
1012 {
1013 struct stat statbuf;
7be682ca 1014 if (!SSL_CTX_set_default_verify_paths(sctx))
7199e1ee 1015 return tls_error(US"SSL_CTX_set_default_verify_paths", host, NULL);
059ec3d9
PH
1016
1017 if (Ustat(expcerts, &statbuf) < 0)
1018 {
1019 log_write(0, LOG_MAIN|LOG_PANIC,
1020 "failed to stat %s for certificates", expcerts);
1021 return DEFER;
1022 }
1023 else
1024 {
1025 uschar *file, *dir;
1026 if ((statbuf.st_mode & S_IFMT) == S_IFDIR)
1027 { file = NULL; dir = expcerts; }
1028 else
1029 { file = expcerts; dir = NULL; }
1030
1031 /* If a certificate file is empty, the next function fails with an
1032 unhelpful error message. If we skip it, we get the correct behaviour (no
1033 certificates are recognized, but the error message is still misleading (it
1034 says no certificate was supplied.) But this is better. */
1035
1036 if ((file == NULL || statbuf.st_size > 0) &&
7be682ca 1037 !SSL_CTX_load_verify_locations(sctx, CS file, CS dir))
7199e1ee 1038 return tls_error(US"SSL_CTX_load_verify_locations", host, NULL);
059ec3d9
PH
1039
1040 if (file != NULL)
1041 {
7be682ca 1042 SSL_CTX_set_client_CA_list(sctx, SSL_load_client_CA_file(CS file));
059ec3d9
PH
1043 }
1044 }
1045
1046 /* Handle a certificate revocation list. */
1047
1048 #if OPENSSL_VERSION_NUMBER > 0x00907000L
1049
8b417f2c
PH
1050 /* This bit of code is now the version supplied by Lars Mainka. (I have
1051 * merely reformatted it into the Exim code style.)
1052
1053 * "From here I changed the code to add support for multiple crl's
1054 * in pem format in one file or to support hashed directory entries in
1055 * pem format instead of a file. This method now uses the library function
1056 * X509_STORE_load_locations to add the CRL location to the SSL context.
1057 * OpenSSL will then handle the verify against CA certs and CRLs by
1058 * itself in the verify callback." */
1059
059ec3d9
PH
1060 if (!expand_check(crl, US"tls_crl", &expcrl)) return DEFER;
1061 if (expcrl != NULL && *expcrl != 0)
1062 {
8b417f2c
PH
1063 struct stat statbufcrl;
1064 if (Ustat(expcrl, &statbufcrl) < 0)
1065 {
1066 log_write(0, LOG_MAIN|LOG_PANIC,
1067 "failed to stat %s for certificates revocation lists", expcrl);
1068 return DEFER;
1069 }
1070 else
059ec3d9 1071 {
8b417f2c
PH
1072 /* is it a file or directory? */
1073 uschar *file, *dir;
7be682ca 1074 X509_STORE *cvstore = SSL_CTX_get_cert_store(sctx);
8b417f2c 1075 if ((statbufcrl.st_mode & S_IFMT) == S_IFDIR)
059ec3d9 1076 {
8b417f2c
PH
1077 file = NULL;
1078 dir = expcrl;
1079 DEBUG(D_tls) debug_printf("SSL CRL value is a directory %s\n", dir);
059ec3d9
PH
1080 }
1081 else
1082 {
8b417f2c
PH
1083 file = expcrl;
1084 dir = NULL;
1085 DEBUG(D_tls) debug_printf("SSL CRL value is a file %s\n", file);
059ec3d9 1086 }
8b417f2c 1087 if (X509_STORE_load_locations(cvstore, CS file, CS dir) == 0)
7199e1ee 1088 return tls_error(US"X509_STORE_load_locations", host, NULL);
8b417f2c
PH
1089
1090 /* setting the flags to check against the complete crl chain */
1091
1092 X509_STORE_set_flags(cvstore,
1093 X509_V_FLAG_CRL_CHECK|X509_V_FLAG_CRL_CHECK_ALL);
059ec3d9 1094 }
059ec3d9
PH
1095 }
1096
1097 #endif /* OPENSSL_VERSION_NUMBER > 0x00907000L */
1098
1099 /* If verification is optional, don't fail if no certificate */
1100
7be682ca 1101 SSL_CTX_set_verify(sctx,
059ec3d9 1102 SSL_VERIFY_PEER | (optional? 0 : SSL_VERIFY_FAIL_IF_NO_PEER_CERT),
a2ff477a 1103 client ? verify_callback_client : verify_callback_server);
059ec3d9
PH
1104 }
1105
1106return OK;
1107}
1108
1109
1110
1111/*************************************************
1112* Start a TLS session in a server *
1113*************************************************/
1114
1115/* This is called when Exim is running as a server, after having received
1116the STARTTLS command. It must respond to that command, and then negotiate
1117a TLS session.
1118
1119Arguments:
1120 require_ciphers allowed ciphers
1121
1122Returns: OK on success
1123 DEFER for errors before the start of the negotiation
1124 FAIL for errors during the negotation; the server can't
1125 continue running.
1126*/
1127
1128int
17c76198 1129tls_server_start(const uschar *require_ciphers)
059ec3d9
PH
1130{
1131int rc;
1132uschar *expciphers;
7be682ca 1133tls_ext_ctx_cb *cbinfo;
817d9f57 1134static uschar cipherbuf[256];
059ec3d9
PH
1135
1136/* Check for previous activation */
1137
817d9f57 1138if (tls_in.active >= 0)
059ec3d9 1139 {
5ca6d115 1140 tls_error(US"STARTTLS received after TLS started", NULL, US"");
059ec3d9
PH
1141 smtp_printf("554 Already in TLS\r\n");
1142 return FAIL;
1143 }
1144
1145/* Initialize the SSL library. If it fails, it will already have logged
1146the error. */
1147
817d9f57 1148rc = tls_init(&server_ctx, NULL, tls_dhparam, tls_certificate, tls_privatekey,
3f7eeb86
PP
1149#ifdef EXPERIMENTAL_OCSP
1150 tls_ocsp_file,
1151#endif
817d9f57 1152 NULL, &server_static_cbinfo);
059ec3d9 1153if (rc != OK) return rc;
817d9f57 1154cbinfo = server_static_cbinfo;
059ec3d9
PH
1155
1156if (!expand_check(require_ciphers, US"tls_require_ciphers", &expciphers))
1157 return FAIL;
1158
1159/* In OpenSSL, cipher components are separated by hyphens. In GnuTLS, they
17c76198
PP
1160were historically separated by underscores. So that I can use either form in my
1161tests, and also for general convenience, we turn underscores into hyphens here.
1162*/
059ec3d9
PH
1163
1164if (expciphers != NULL)
1165 {
1166 uschar *s = expciphers;
1167 while (*s != 0) { if (*s == '_') *s = '-'; s++; }
1168 DEBUG(D_tls) debug_printf("required ciphers: %s\n", expciphers);
817d9f57 1169 if (!SSL_CTX_set_cipher_list(server_ctx, CS expciphers))
7199e1ee 1170 return tls_error(US"SSL_CTX_set_cipher_list", NULL, NULL);
7be682ca 1171 cbinfo->server_cipher_list = expciphers;
059ec3d9
PH
1172 }
1173
1174/* If this is a host for which certificate verification is mandatory or
1175optional, set up appropriately. */
1176
817d9f57 1177tls_in.certificate_verified = FALSE;
a2ff477a 1178server_verify_callback_called = FALSE;
059ec3d9
PH
1179
1180if (verify_check_host(&tls_verify_hosts) == OK)
1181 {
a2ff477a 1182 rc = setup_certs(server_ctx, tls_verify_certificates, tls_crl, NULL, FALSE, FALSE);
059ec3d9 1183 if (rc != OK) return rc;
a2ff477a 1184 server_verify_optional = FALSE;
059ec3d9
PH
1185 }
1186else if (verify_check_host(&tls_try_verify_hosts) == OK)
1187 {
a2ff477a 1188 rc = setup_certs(server_ctx, tls_verify_certificates, tls_crl, NULL, TRUE, FALSE);
059ec3d9 1189 if (rc != OK) return rc;
a2ff477a 1190 server_verify_optional = TRUE;
059ec3d9
PH
1191 }
1192
1193/* Prepare for new connection */
1194
817d9f57 1195if ((server_ssl = SSL_new(server_ctx)) == NULL) return tls_error(US"SSL_new", NULL, NULL);
da3ad30d
PP
1196
1197/* Warning: we used to SSL_clear(ssl) here, it was removed.
1198 *
1199 * With the SSL_clear(), we get strange interoperability bugs with
1200 * OpenSSL 1.0.1b and TLS1.1/1.2. It looks as though this may be a bug in
1201 * OpenSSL itself, as a clear should not lead to inability to follow protocols.
1202 *
1203 * The SSL_clear() call is to let an existing SSL* be reused, typically after
1204 * session shutdown. In this case, we have a brand new object and there's no
1205 * obvious reason to immediately clear it. I'm guessing that this was
1206 * originally added because of incomplete initialisation which the clear fixed,
1207 * in some historic release.
1208 */
059ec3d9
PH
1209
1210/* Set context and tell client to go ahead, except in the case of TLS startup
1211on connection, where outputting anything now upsets the clients and tends to
1212make them disconnect. We need to have an explicit fflush() here, to force out
1213the response. Other smtp_printf() calls do not need it, because in non-TLS
1214mode, the fflush() happens when smtp_getc() is called. */
1215
817d9f57
JH
1216SSL_set_session_id_context(server_ssl, sid_ctx, Ustrlen(sid_ctx));
1217if (!tls_in.on_connect)
059ec3d9
PH
1218 {
1219 smtp_printf("220 TLS go ahead\r\n");
1220 fflush(smtp_out);
1221 }
1222
1223/* Now negotiate the TLS session. We put our own timer on it, since it seems
1224that the OpenSSL library doesn't. */
1225
817d9f57
JH
1226SSL_set_wfd(server_ssl, fileno(smtp_out));
1227SSL_set_rfd(server_ssl, fileno(smtp_in));
1228SSL_set_accept_state(server_ssl);
059ec3d9
PH
1229
1230DEBUG(D_tls) debug_printf("Calling SSL_accept\n");
1231
1232sigalrm_seen = FALSE;
1233if (smtp_receive_timeout > 0) alarm(smtp_receive_timeout);
817d9f57 1234rc = SSL_accept(server_ssl);
059ec3d9
PH
1235alarm(0);
1236
1237if (rc <= 0)
1238 {
7199e1ee 1239 tls_error(US"SSL_accept", NULL, sigalrm_seen ? US"timed out" : NULL);
77bb000f
PP
1240 if (ERR_get_error() == 0)
1241 log_write(0, LOG_MAIN,
a053d125 1242 "TLS client disconnected cleanly (rejected our certificate?)");
059ec3d9
PH
1243 return FAIL;
1244 }
1245
1246DEBUG(D_tls) debug_printf("SSL_accept was successful\n");
1247
1248/* TLS has been set up. Adjust the input functions to read via TLS,
1249and initialize things. */
1250
817d9f57
JH
1251construct_cipher_name(server_ssl, cipherbuf, sizeof(cipherbuf), &tls_in.bits);
1252tls_in.cipher = cipherbuf;
059ec3d9
PH
1253
1254DEBUG(D_tls)
1255 {
1256 uschar buf[2048];
817d9f57 1257 if (SSL_get_shared_ciphers(server_ssl, CS buf, sizeof(buf)) != NULL)
059ec3d9
PH
1258 debug_printf("Shared ciphers: %s\n", buf);
1259 }
1260
1261
817d9f57
JH
1262/* Only used by the server-side tls (tls_in), including tls_getc.
1263 Client-side (tls_out) reads (seem to?) go via
1264 smtp_read_response()/ip_recv().
1265 Hence no need to duplicate for _in and _out.
1266 */
059ec3d9
PH
1267ssl_xfer_buffer = store_malloc(ssl_xfer_buffer_size);
1268ssl_xfer_buffer_lwm = ssl_xfer_buffer_hwm = 0;
1269ssl_xfer_eof = ssl_xfer_error = 0;
1270
1271receive_getc = tls_getc;
1272receive_ungetc = tls_ungetc;
1273receive_feof = tls_feof;
1274receive_ferror = tls_ferror;
58eb016e 1275receive_smtp_buffered = tls_smtp_buffered;
059ec3d9 1276
817d9f57 1277tls_in.active = fileno(smtp_out);
059ec3d9
PH
1278return OK;
1279}
1280
1281
1282
1283
1284
1285/*************************************************
1286* Start a TLS session in a client *
1287*************************************************/
1288
1289/* Called from the smtp transport after STARTTLS has been accepted.
1290
1291Argument:
1292 fd the fd of the connection
1293 host connected host (for messages)
83da1223 1294 addr the first address
059ec3d9
PH
1295 dhparam DH parameter file
1296 certificate certificate file
1297 privatekey private key file
3f0945ff 1298 sni TLS SNI to send to remote host
059ec3d9
PH
1299 verify_certs file for certificate verify
1300 crl file containing CRL
1301 require_ciphers list of allowed ciphers
54c90be1
PP
1302 dh_min_bits minimum number of bits acceptable in server's DH prime
1303 (unused in OpenSSL)
83da1223 1304 timeout startup timeout
059ec3d9
PH
1305
1306Returns: OK on success
1307 FAIL otherwise - note that tls_error() will not give DEFER
1308 because this is not a server
1309*/
1310
1311int
1312tls_client_start(int fd, host_item *host, address_item *addr, uschar *dhparam,
3f0945ff
PP
1313 uschar *certificate, uschar *privatekey, uschar *sni,
1314 uschar *verify_certs, uschar *crl,
54c90be1 1315 uschar *require_ciphers, int dh_min_bits ARG_UNUSED, int timeout)
059ec3d9
PH
1316{
1317static uschar txt[256];
1318uschar *expciphers;
1319X509* server_cert;
1320int rc;
817d9f57 1321static uschar cipherbuf[256];
059ec3d9 1322
817d9f57 1323rc = tls_init(&client_ctx, host, dhparam, certificate, privatekey,
3f7eeb86
PP
1324#ifdef EXPERIMENTAL_OCSP
1325 NULL,
1326#endif
817d9f57 1327 addr, &client_static_cbinfo);
059ec3d9
PH
1328if (rc != OK) return rc;
1329
817d9f57 1330tls_out.certificate_verified = FALSE;
a2ff477a 1331client_verify_callback_called = FALSE;
059ec3d9
PH
1332
1333if (!expand_check(require_ciphers, US"tls_require_ciphers", &expciphers))
1334 return FAIL;
1335
1336/* In OpenSSL, cipher components are separated by hyphens. In GnuTLS, they
1337are separated by underscores. So that I can use either form in my tests, and
1338also for general convenience, we turn underscores into hyphens here. */
1339
1340if (expciphers != NULL)
1341 {
1342 uschar *s = expciphers;
1343 while (*s != 0) { if (*s == '_') *s = '-'; s++; }
1344 DEBUG(D_tls) debug_printf("required ciphers: %s\n", expciphers);
817d9f57 1345 if (!SSL_CTX_set_cipher_list(client_ctx, CS expciphers))
7199e1ee 1346 return tls_error(US"SSL_CTX_set_cipher_list", host, NULL);
059ec3d9
PH
1347 }
1348
a2ff477a 1349rc = setup_certs(client_ctx, verify_certs, crl, host, FALSE, TRUE);
059ec3d9
PH
1350if (rc != OK) return rc;
1351
817d9f57
JH
1352if ((client_ssl = SSL_new(client_ctx)) == NULL) return tls_error(US"SSL_new", host, NULL);
1353SSL_set_session_id_context(client_ssl, sid_ctx, Ustrlen(sid_ctx));
1354SSL_set_fd(client_ssl, fd);
1355SSL_set_connect_state(client_ssl);
059ec3d9 1356
3f0945ff
PP
1357if (sni)
1358 {
817d9f57 1359 if (!expand_check(sni, US"tls_sni", &tls_out.sni))
3f0945ff 1360 return FAIL;
ec4b68e5 1361 if (tls_out.sni == NULL)
2c9a0e86
PP
1362 {
1363 DEBUG(D_tls) debug_printf("Setting TLS SNI forced to fail, not sending\n");
1364 }
ec4b68e5 1365 else if (!Ustrlen(tls_out.sni))
817d9f57 1366 tls_out.sni = NULL;
3f0945ff
PP
1367 else
1368 {
35731706 1369#ifdef EXIM_HAVE_OPENSSL_TLSEXT
817d9f57
JH
1370 DEBUG(D_tls) debug_printf("Setting TLS SNI \"%s\"\n", tls_out.sni);
1371 SSL_set_tlsext_host_name(client_ssl, tls_out.sni);
35731706
PP
1372#else
1373 DEBUG(D_tls)
1374 debug_printf("OpenSSL at build-time lacked SNI support, ignoring \"%s\"\n",
02d9264f 1375 tls_out.sni);
35731706 1376#endif
3f0945ff
PP
1377 }
1378 }
1379
059ec3d9
PH
1380/* There doesn't seem to be a built-in timeout on connection. */
1381
1382DEBUG(D_tls) debug_printf("Calling SSL_connect\n");
1383sigalrm_seen = FALSE;
1384alarm(timeout);
817d9f57 1385rc = SSL_connect(client_ssl);
059ec3d9
PH
1386alarm(0);
1387
1388if (rc <= 0)
7199e1ee 1389 return tls_error(US"SSL_connect", host, sigalrm_seen ? US"timed out" : NULL);
059ec3d9
PH
1390
1391DEBUG(D_tls) debug_printf("SSL_connect succeeded\n");
1392
453a6645 1393/* Beware anonymous ciphers which lead to server_cert being NULL */
817d9f57 1394server_cert = SSL_get_peer_certificate (client_ssl);
453a6645
PP
1395if (server_cert)
1396 {
817d9f57 1397 tls_out.peerdn = US X509_NAME_oneline(X509_get_subject_name(server_cert),
453a6645 1398 CS txt, sizeof(txt));
817d9f57 1399 tls_out.peerdn = txt;
453a6645
PP
1400 }
1401else
817d9f57 1402 tls_out.peerdn = NULL;
059ec3d9 1403
817d9f57
JH
1404construct_cipher_name(client_ssl, cipherbuf, sizeof(cipherbuf), &tls_out.bits);
1405tls_out.cipher = cipherbuf;
059ec3d9 1406
817d9f57 1407tls_out.active = fd;
059ec3d9
PH
1408return OK;
1409}
1410
1411
1412
1413
1414
1415/*************************************************
1416* TLS version of getc *
1417*************************************************/
1418
1419/* This gets the next byte from the TLS input buffer. If the buffer is empty,
1420it refills the buffer via the SSL reading function.
1421
1422Arguments: none
1423Returns: the next character or EOF
817d9f57
JH
1424
1425Only used by the server-side TLS.
059ec3d9
PH
1426*/
1427
1428int
1429tls_getc(void)
1430{
1431if (ssl_xfer_buffer_lwm >= ssl_xfer_buffer_hwm)
1432 {
1433 int error;
1434 int inbytes;
1435
817d9f57 1436 DEBUG(D_tls) debug_printf("Calling SSL_read(%p, %p, %u)\n", server_ssl,
c80c5570 1437 ssl_xfer_buffer, ssl_xfer_buffer_size);
059ec3d9
PH
1438
1439 if (smtp_receive_timeout > 0) alarm(smtp_receive_timeout);
817d9f57
JH
1440 inbytes = SSL_read(server_ssl, CS ssl_xfer_buffer, ssl_xfer_buffer_size);
1441 error = SSL_get_error(server_ssl, inbytes);
059ec3d9
PH
1442 alarm(0);
1443
1444 /* SSL_ERROR_ZERO_RETURN appears to mean that the SSL session has been
1445 closed down, not that the socket itself has been closed down. Revert to
1446 non-SSL handling. */
1447
1448 if (error == SSL_ERROR_ZERO_RETURN)
1449 {
1450 DEBUG(D_tls) debug_printf("Got SSL_ERROR_ZERO_RETURN\n");
1451
1452 receive_getc = smtp_getc;
1453 receive_ungetc = smtp_ungetc;
1454 receive_feof = smtp_feof;
1455 receive_ferror = smtp_ferror;
58eb016e 1456 receive_smtp_buffered = smtp_buffered;
059ec3d9 1457
817d9f57
JH
1458 SSL_free(server_ssl);
1459 server_ssl = NULL;
1460 tls_in.active = -1;
1461 tls_in.bits = 0;
1462 tls_in.cipher = NULL;
1463 tls_in.peerdn = NULL;
1464 tls_in.sni = NULL;
059ec3d9
PH
1465
1466 return smtp_getc();
1467 }
1468
1469 /* Handle genuine errors */
1470
ba084640
PP
1471 else if (error == SSL_ERROR_SSL)
1472 {
1473 ERR_error_string(ERR_get_error(), ssl_errstring);
89dd51cd 1474 log_write(0, LOG_MAIN, "TLS error (SSL_read): %s", ssl_errstring);
ba084640
PP
1475 ssl_xfer_error = 1;
1476 return EOF;
1477 }
1478
059ec3d9
PH
1479 else if (error != SSL_ERROR_NONE)
1480 {
1481 DEBUG(D_tls) debug_printf("Got SSL error %d\n", error);
1482 ssl_xfer_error = 1;
1483 return EOF;
1484 }
c80c5570 1485
80a47a2c
TK
1486#ifndef DISABLE_DKIM
1487 dkim_exim_verify_feed(ssl_xfer_buffer, inbytes);
1488#endif
059ec3d9
PH
1489 ssl_xfer_buffer_hwm = inbytes;
1490 ssl_xfer_buffer_lwm = 0;
1491 }
1492
1493/* Something in the buffer; return next uschar */
1494
1495return ssl_xfer_buffer[ssl_xfer_buffer_lwm++];
1496}
1497
1498
1499
1500/*************************************************
1501* Read bytes from TLS channel *
1502*************************************************/
1503
1504/*
1505Arguments:
1506 buff buffer of data
1507 len size of buffer
1508
1509Returns: the number of bytes read
1510 -1 after a failed read
817d9f57
JH
1511
1512Only used by the client-side TLS.
059ec3d9
PH
1513*/
1514
1515int
389ca47a 1516tls_read(BOOL is_server, uschar *buff, size_t len)
059ec3d9 1517{
389ca47a 1518SSL *ssl = is_server ? server_ssl : client_ssl;
059ec3d9
PH
1519int inbytes;
1520int error;
1521
389ca47a 1522DEBUG(D_tls) debug_printf("Calling SSL_read(%p, %p, %u)\n", ssl,
c80c5570 1523 buff, (unsigned int)len);
059ec3d9 1524
389ca47a
JH
1525inbytes = SSL_read(ssl, CS buff, len);
1526error = SSL_get_error(ssl, inbytes);
059ec3d9
PH
1527
1528if (error == SSL_ERROR_ZERO_RETURN)
1529 {
1530 DEBUG(D_tls) debug_printf("Got SSL_ERROR_ZERO_RETURN\n");
1531 return -1;
1532 }
1533else if (error != SSL_ERROR_NONE)
1534 {
1535 return -1;
1536 }
1537
1538return inbytes;
1539}
1540
1541
1542
1543
1544
1545/*************************************************
1546* Write bytes down TLS channel *
1547*************************************************/
1548
1549/*
1550Arguments:
817d9f57 1551 is_server channel specifier
059ec3d9
PH
1552 buff buffer of data
1553 len number of bytes
1554
1555Returns: the number of bytes after a successful write,
1556 -1 after a failed write
817d9f57
JH
1557
1558Used by both server-side and client-side TLS.
059ec3d9
PH
1559*/
1560
1561int
817d9f57 1562tls_write(BOOL is_server, const uschar *buff, size_t len)
059ec3d9
PH
1563{
1564int outbytes;
1565int error;
1566int left = len;
817d9f57 1567SSL *ssl = is_server ? server_ssl : client_ssl;
059ec3d9 1568
c80c5570 1569DEBUG(D_tls) debug_printf("tls_do_write(%p, %d)\n", buff, left);
059ec3d9
PH
1570while (left > 0)
1571 {
c80c5570 1572 DEBUG(D_tls) debug_printf("SSL_write(SSL, %p, %d)\n", buff, left);
059ec3d9
PH
1573 outbytes = SSL_write(ssl, CS buff, left);
1574 error = SSL_get_error(ssl, outbytes);
1575 DEBUG(D_tls) debug_printf("outbytes=%d error=%d\n", outbytes, error);
1576 switch (error)
1577 {
1578 case SSL_ERROR_SSL:
1579 ERR_error_string(ERR_get_error(), ssl_errstring);
1580 log_write(0, LOG_MAIN, "TLS error (SSL_write): %s", ssl_errstring);
1581 return -1;
1582
1583 case SSL_ERROR_NONE:
1584 left -= outbytes;
1585 buff += outbytes;
1586 break;
1587
1588 case SSL_ERROR_ZERO_RETURN:
1589 log_write(0, LOG_MAIN, "SSL channel closed on write");
1590 return -1;
1591
817d9f57
JH
1592 case SSL_ERROR_SYSCALL:
1593 log_write(0, LOG_MAIN, "SSL_write: (from %s) syscall: %s",
1594 sender_fullhost ? sender_fullhost : US"<unknown>",
1595 strerror(errno));
1596
059ec3d9
PH
1597 default:
1598 log_write(0, LOG_MAIN, "SSL_write error %d", error);
1599 return -1;
1600 }
1601 }
1602return len;
1603}
1604
1605
1606
1607/*************************************************
1608* Close down a TLS session *
1609*************************************************/
1610
1611/* This is also called from within a delivery subprocess forked from the
1612daemon, to shut down the TLS library, without actually doing a shutdown (which
1613would tamper with the SSL session in the parent process).
1614
1615Arguments: TRUE if SSL_shutdown is to be called
1616Returns: nothing
817d9f57
JH
1617
1618Used by both server-side and client-side TLS.
059ec3d9
PH
1619*/
1620
1621void
817d9f57 1622tls_close(BOOL is_server, BOOL shutdown)
059ec3d9 1623{
817d9f57 1624SSL **sslp = is_server ? &server_ssl : &client_ssl;
389ca47a 1625int *fdp = is_server ? &tls_in.active : &tls_out.active;
817d9f57
JH
1626
1627if (*fdp < 0) return; /* TLS was not active */
059ec3d9
PH
1628
1629if (shutdown)
1630 {
1631 DEBUG(D_tls) debug_printf("tls_close(): shutting down SSL\n");
817d9f57 1632 SSL_shutdown(*sslp);
059ec3d9
PH
1633 }
1634
817d9f57
JH
1635SSL_free(*sslp);
1636*sslp = NULL;
059ec3d9 1637
817d9f57 1638*fdp = -1;
059ec3d9
PH
1639}
1640
36f12725
NM
1641
1642
1643
1644/*************************************************
3375e053
PP
1645* Let tls_require_ciphers be checked at startup *
1646*************************************************/
1647
1648/* The tls_require_ciphers option, if set, must be something which the
1649library can parse.
1650
1651Returns: NULL on success, or error message
1652*/
1653
1654uschar *
1655tls_validate_require_cipher(void)
1656{
1657SSL_CTX *ctx;
1658uschar *s, *expciphers, *err;
1659
1660/* this duplicates from tls_init(), we need a better "init just global
1661state, for no specific purpose" singleton function of our own */
1662
1663SSL_load_error_strings();
1664OpenSSL_add_ssl_algorithms();
1665#if (OPENSSL_VERSION_NUMBER >= 0x0090800fL) && !defined(OPENSSL_NO_SHA256)
1666/* SHA256 is becoming ever more popular. This makes sure it gets added to the
1667list of available digests. */
1668EVP_add_digest(EVP_sha256());
1669#endif
1670
1671if (!(tls_require_ciphers && *tls_require_ciphers))
1672 return NULL;
1673
1674if (!expand_check(tls_require_ciphers, US"tls_require_ciphers", &expciphers))
1675 return US"failed to expand tls_require_ciphers";
1676
1677if (!(expciphers && *expciphers))
1678 return NULL;
1679
1680/* normalisation ripped from above */
1681s = expciphers;
1682while (*s != 0) { if (*s == '_') *s = '-'; s++; }
1683
1684err = NULL;
1685
1686ctx = SSL_CTX_new(SSLv23_server_method());
1687if (!ctx)
1688 {
1689 ERR_error_string(ERR_get_error(), ssl_errstring);
1690 return string_sprintf("SSL_CTX_new() failed: %s", ssl_errstring);
1691 }
1692
1693DEBUG(D_tls)
1694 debug_printf("tls_require_ciphers expands to \"%s\"\n", expciphers);
1695
1696if (!SSL_CTX_set_cipher_list(ctx, CS expciphers))
1697 {
1698 ERR_error_string(ERR_get_error(), ssl_errstring);
1699 err = string_sprintf("SSL_CTX_set_cipher_list(%s) failed", expciphers);
1700 }
1701
1702SSL_CTX_free(ctx);
1703
1704return err;
1705}
1706
1707
1708
1709
1710/*************************************************
36f12725
NM
1711* Report the library versions. *
1712*************************************************/
1713
1714/* There have historically been some issues with binary compatibility in
1715OpenSSL libraries; if Exim (like many other applications) is built against
1716one version of OpenSSL but the run-time linker picks up another version,
1717it can result in serious failures, including crashing with a SIGSEGV. So
1718report the version found by the compiler and the run-time version.
1719
1720Arguments: a FILE* to print the results to
1721Returns: nothing
1722*/
1723
1724void
1725tls_version_report(FILE *f)
1726{
754a0503
PP
1727fprintf(f, "Library version: OpenSSL: Compile: %s\n"
1728 " Runtime: %s\n",
1729 OPENSSL_VERSION_TEXT,
1730 SSLeay_version(SSLEAY_VERSION));
36f12725
NM
1731}
1732
9e3331ea
TK
1733
1734
1735
1736/*************************************************
17c76198 1737* Random number generation *
9e3331ea
TK
1738*************************************************/
1739
1740/* Pseudo-random number generation. The result is not expected to be
1741cryptographically strong but not so weak that someone will shoot themselves
1742in the foot using it as a nonce in input in some email header scheme or
1743whatever weirdness they'll twist this into. The result should handle fork()
1744and avoid repeating sequences. OpenSSL handles that for us.
1745
1746Arguments:
1747 max range maximum
1748Returns a random number in range [0, max-1]
1749*/
1750
1751int
17c76198 1752vaguely_random_number(int max)
9e3331ea
TK
1753{
1754unsigned int r;
1755int i, needed_len;
1756uschar *p;
1757uschar smallbuf[sizeof(r)];
1758
1759if (max <= 1)
1760 return 0;
1761
1762/* OpenSSL auto-seeds from /dev/random, etc, but this a double-check. */
1763if (!RAND_status())
1764 {
1765 randstuff r;
1766 gettimeofday(&r.tv, NULL);
1767 r.p = getpid();
1768
1769 RAND_seed((uschar *)(&r), sizeof(r));
1770 }
1771/* We're after pseudo-random, not random; if we still don't have enough data
1772in the internal PRNG then our options are limited. We could sleep and hope
1773for entropy to come along (prayer technique) but if the system is so depleted
1774in the first place then something is likely to just keep taking it. Instead,
1775we'll just take whatever little bit of pseudo-random we can still manage to
1776get. */
1777
1778needed_len = sizeof(r);
1779/* Don't take 8 times more entropy than needed if int is 8 octets and we were
1780asked for a number less than 10. */
1781for (r = max, i = 0; r; ++i)
1782 r >>= 1;
1783i = (i + 7) / 8;
1784if (i < needed_len)
1785 needed_len = i;
1786
1787/* We do not care if crypto-strong */
17c76198
PP
1788i = RAND_pseudo_bytes(smallbuf, needed_len);
1789if (i < 0)
1790 {
1791 DEBUG(D_all)
1792 debug_printf("OpenSSL RAND_pseudo_bytes() not supported by RAND method, using fallback.\n");
1793 return vaguely_random_number_fallback(max);
1794 }
1795
9e3331ea
TK
1796r = 0;
1797for (p = smallbuf; needed_len; --needed_len, ++p)
1798 {
1799 r *= 256;
1800 r += *p;
1801 }
1802
1803/* We don't particularly care about weighted results; if someone wants
1804smooth distribution and cares enough then they should submit a patch then. */
1805return r % max;
1806}
1807
77bb000f
PP
1808
1809
1810
1811/*************************************************
1812* OpenSSL option parse *
1813*************************************************/
1814
1815/* Parse one option for tls_openssl_options_parse below
1816
1817Arguments:
1818 name one option name
1819 value place to store a value for it
1820Returns success or failure in parsing
1821*/
1822
1823struct exim_openssl_option {
1824 uschar *name;
1825 long value;
1826};
1827/* We could use a macro to expand, but we need the ifdef and not all the
1828options document which version they were introduced in. Policylet: include
1829all options unless explicitly for DTLS, let the administrator choose which
1830to apply.
1831
1832This list is current as of:
c80c5570 1833 ==> 1.0.1b <== */
77bb000f
PP
1834static struct exim_openssl_option exim_openssl_options[] = {
1835/* KEEP SORTED ALPHABETICALLY! */
1836#ifdef SSL_OP_ALL
73a46702 1837 { US"all", SSL_OP_ALL },
77bb000f
PP
1838#endif
1839#ifdef SSL_OP_ALLOW_UNSAFE_LEGACY_RENEGOTIATION
73a46702 1840 { US"allow_unsafe_legacy_renegotiation", SSL_OP_ALLOW_UNSAFE_LEGACY_RENEGOTIATION },
77bb000f
PP
1841#endif
1842#ifdef SSL_OP_CIPHER_SERVER_PREFERENCE
73a46702 1843 { US"cipher_server_preference", SSL_OP_CIPHER_SERVER_PREFERENCE },
77bb000f
PP
1844#endif
1845#ifdef SSL_OP_DONT_INSERT_EMPTY_FRAGMENTS
73a46702 1846 { US"dont_insert_empty_fragments", SSL_OP_DONT_INSERT_EMPTY_FRAGMENTS },
77bb000f
PP
1847#endif
1848#ifdef SSL_OP_EPHEMERAL_RSA
73a46702 1849 { US"ephemeral_rsa", SSL_OP_EPHEMERAL_RSA },
77bb000f
PP
1850#endif
1851#ifdef SSL_OP_LEGACY_SERVER_CONNECT
73a46702 1852 { US"legacy_server_connect", SSL_OP_LEGACY_SERVER_CONNECT },
77bb000f
PP
1853#endif
1854#ifdef SSL_OP_MICROSOFT_BIG_SSLV3_BUFFER
73a46702 1855 { US"microsoft_big_sslv3_buffer", SSL_OP_MICROSOFT_BIG_SSLV3_BUFFER },
77bb000f
PP
1856#endif
1857#ifdef SSL_OP_MICROSOFT_SESS_ID_BUG
73a46702 1858 { US"microsoft_sess_id_bug", SSL_OP_MICROSOFT_SESS_ID_BUG },
77bb000f
PP
1859#endif
1860#ifdef SSL_OP_MSIE_SSLV2_RSA_PADDING
73a46702 1861 { US"msie_sslv2_rsa_padding", SSL_OP_MSIE_SSLV2_RSA_PADDING },
77bb000f
PP
1862#endif
1863#ifdef SSL_OP_NETSCAPE_CHALLENGE_BUG
73a46702 1864 { US"netscape_challenge_bug", SSL_OP_NETSCAPE_CHALLENGE_BUG },
77bb000f
PP
1865#endif
1866#ifdef SSL_OP_NETSCAPE_REUSE_CIPHER_CHANGE_BUG
73a46702 1867 { US"netscape_reuse_cipher_change_bug", SSL_OP_NETSCAPE_REUSE_CIPHER_CHANGE_BUG },
77bb000f 1868#endif
c80c5570
PP
1869#ifdef SSL_OP_NO_COMPRESSION
1870 { US"no_compression", SSL_OP_NO_COMPRESSION },
1871#endif
77bb000f 1872#ifdef SSL_OP_NO_SESSION_RESUMPTION_ON_RENEGOTIATION
73a46702 1873 { US"no_session_resumption_on_renegotiation", SSL_OP_NO_SESSION_RESUMPTION_ON_RENEGOTIATION },
77bb000f 1874#endif
c0c7b2da
PP
1875#ifdef SSL_OP_NO_SSLv2
1876 { US"no_sslv2", SSL_OP_NO_SSLv2 },
1877#endif
1878#ifdef SSL_OP_NO_SSLv3
1879 { US"no_sslv3", SSL_OP_NO_SSLv3 },
1880#endif
1881#ifdef SSL_OP_NO_TICKET
1882 { US"no_ticket", SSL_OP_NO_TICKET },
1883#endif
1884#ifdef SSL_OP_NO_TLSv1
1885 { US"no_tlsv1", SSL_OP_NO_TLSv1 },
1886#endif
c80c5570
PP
1887#ifdef SSL_OP_NO_TLSv1_1
1888#if SSL_OP_NO_TLSv1_1 == 0x00000400L
1889 /* Error in chosen value in 1.0.1a; see first item in CHANGES for 1.0.1b */
1890#warning OpenSSL 1.0.1a uses a bad value for SSL_OP_NO_TLSv1_1, ignoring
1891#else
1892 { US"no_tlsv1_1", SSL_OP_NO_TLSv1_1 },
1893#endif
1894#endif
1895#ifdef SSL_OP_NO_TLSv1_2
1896 { US"no_tlsv1_2", SSL_OP_NO_TLSv1_2 },
1897#endif
77bb000f 1898#ifdef SSL_OP_SINGLE_DH_USE
73a46702 1899 { US"single_dh_use", SSL_OP_SINGLE_DH_USE },
77bb000f
PP
1900#endif
1901#ifdef SSL_OP_SINGLE_ECDH_USE
73a46702 1902 { US"single_ecdh_use", SSL_OP_SINGLE_ECDH_USE },
77bb000f
PP
1903#endif
1904#ifdef SSL_OP_SSLEAY_080_CLIENT_DH_BUG
73a46702 1905 { US"ssleay_080_client_dh_bug", SSL_OP_SSLEAY_080_CLIENT_DH_BUG },
77bb000f
PP
1906#endif
1907#ifdef SSL_OP_SSLREF2_REUSE_CERT_TYPE_BUG
73a46702 1908 { US"sslref2_reuse_cert_type_bug", SSL_OP_SSLREF2_REUSE_CERT_TYPE_BUG },
77bb000f
PP
1909#endif
1910#ifdef SSL_OP_TLS_BLOCK_PADDING_BUG
73a46702 1911 { US"tls_block_padding_bug", SSL_OP_TLS_BLOCK_PADDING_BUG },
77bb000f
PP
1912#endif
1913#ifdef SSL_OP_TLS_D5_BUG
73a46702 1914 { US"tls_d5_bug", SSL_OP_TLS_D5_BUG },
77bb000f
PP
1915#endif
1916#ifdef SSL_OP_TLS_ROLLBACK_BUG
73a46702 1917 { US"tls_rollback_bug", SSL_OP_TLS_ROLLBACK_BUG },
77bb000f
PP
1918#endif
1919};
1920static int exim_openssl_options_size =
1921 sizeof(exim_openssl_options)/sizeof(struct exim_openssl_option);
1922
c80c5570 1923
77bb000f
PP
1924static BOOL
1925tls_openssl_one_option_parse(uschar *name, long *value)
1926{
1927int first = 0;
1928int last = exim_openssl_options_size;
1929while (last > first)
1930 {
1931 int middle = (first + last)/2;
1932 int c = Ustrcmp(name, exim_openssl_options[middle].name);
1933 if (c == 0)
1934 {
1935 *value = exim_openssl_options[middle].value;
1936 return TRUE;
1937 }
1938 else if (c > 0)
1939 first = middle + 1;
1940 else
1941 last = middle;
1942 }
1943return FALSE;
1944}
1945
1946
1947
1948
1949/*************************************************
1950* OpenSSL option parsing logic *
1951*************************************************/
1952
1953/* OpenSSL has a number of compatibility options which an administrator might
1954reasonably wish to set. Interpret a list similarly to decode_bits(), so that
1955we look like log_selector.
1956
1957Arguments:
1958 option_spec the administrator-supplied string of options
1959 results ptr to long storage for the options bitmap
1960Returns success or failure
1961*/
1962
1963BOOL
1964tls_openssl_options_parse(uschar *option_spec, long *results)
1965{
1966long result, item;
1967uschar *s, *end;
1968uschar keep_c;
1969BOOL adding, item_parsed;
1970
0e944a0d 1971result = 0L;
b1770b6e 1972/* Prior to 4.80 we or'd in SSL_OP_DONT_INSERT_EMPTY_FRAGMENTS; removed
da3ad30d 1973 * from default because it increases BEAST susceptibility. */
f0f5a555
PP
1974#ifdef SSL_OP_NO_SSLv2
1975result |= SSL_OP_NO_SSLv2;
1976#endif
77bb000f
PP
1977
1978if (option_spec == NULL)
1979 {
1980 *results = result;
1981 return TRUE;
1982 }
1983
1984for (s=option_spec; *s != '\0'; /**/)
1985 {
1986 while (isspace(*s)) ++s;
1987 if (*s == '\0')
1988 break;
1989 if (*s != '+' && *s != '-')
1990 {
1991 DEBUG(D_tls) debug_printf("malformed openssl option setting: "
0e944a0d 1992 "+ or - expected but found \"%s\"\n", s);
77bb000f
PP
1993 return FALSE;
1994 }
1995 adding = *s++ == '+';
1996 for (end = s; (*end != '\0') && !isspace(*end); ++end) /**/ ;
1997 keep_c = *end;
1998 *end = '\0';
1999 item_parsed = tls_openssl_one_option_parse(s, &item);
2000 if (!item_parsed)
2001 {
0e944a0d 2002 DEBUG(D_tls) debug_printf("openssl option setting unrecognised: \"%s\"\n", s);
77bb000f
PP
2003 return FALSE;
2004 }
2005 DEBUG(D_tls) debug_printf("openssl option, %s from %lx: %lx (%s)\n",
2006 adding ? "adding" : "removing", result, item, s);
2007 if (adding)
2008 result |= item;
2009 else
2010 result &= ~item;
2011 *end = keep_c;
2012 s = end;
2013 }
2014
2015*results = result;
2016return TRUE;
2017}
2018
059ec3d9 2019/* End of tls-openssl.c */