Fix ${extract expansion for use within ${if inlist etc. Bug 1524
[exim.git] / src / src / tls-openssl.c
CommitLineData
059ec3d9
PH
1/*************************************************
2* Exim - an Internet mail transport agent *
3*************************************************/
4
5a66c31b 5/* Copyright (c) University of Cambridge 1995 - 2014 */
059ec3d9
PH
6/* See the file NOTICE for conditions of use and distribution. */
7
f5d78688
JH
8/* Portions Copyright (c) The OpenSSL Project 1999 */
9
059ec3d9
PH
10/* This module provides the TLS (aka SSL) support for Exim using the OpenSSL
11library. It is #included into the tls.c file when that library is used. The
12code herein is based on a patch that was originally contributed by Steve
13Haslam. It was adapted from stunnel, a GPL program by Michal Trojnara.
14
15No cryptographic code is included in Exim. All this module does is to call
16functions from the OpenSSL library. */
17
18
19/* Heading stuff */
20
21#include <openssl/lhash.h>
22#include <openssl/ssl.h>
23#include <openssl/err.h>
24#include <openssl/rand.h>
f2de3a33 25#ifndef DISABLE_OCSP
e51c7be2 26# include <openssl/ocsp.h>
3f7eeb86 27#endif
85098ee7
JH
28#ifdef EXPERIMENTAL_DANE
29# include <danessl.h>
30#endif
31
3f7eeb86 32
f2de3a33
JH
33#ifndef DISABLE_OCSP
34# define EXIM_OCSP_SKEW_SECONDS (300L)
35# define EXIM_OCSP_MAX_AGE (-1L)
3f7eeb86 36#endif
059ec3d9 37
3bcbbbe2 38#if OPENSSL_VERSION_NUMBER >= 0x0090806fL && !defined(OPENSSL_NO_TLSEXT)
e51c7be2 39# define EXIM_HAVE_OPENSSL_TLSEXT
3bcbbbe2
PP
40#endif
41
67791ce4
JH
42#if !defined(EXIM_HAVE_OPENSSL_TLSEXT) && !defined(DISABLE_OCSP)
43# warning "OpenSSL library version too old; define DISABLE_OCSP in Makefile"
44# define DISABLE_OCSP
45#endif
46
059ec3d9
PH
47/* Structure for collecting random data for seeding. */
48
49typedef struct randstuff {
9e3331ea
TK
50 struct timeval tv;
51 pid_t p;
059ec3d9
PH
52} randstuff;
53
54/* Local static variables */
55
a2ff477a
JH
56static BOOL client_verify_callback_called = FALSE;
57static BOOL server_verify_callback_called = FALSE;
059ec3d9
PH
58static const uschar *sid_ctx = US"exim";
59
d4f09789
PP
60/* We have three different contexts to care about.
61
62Simple case: client, `client_ctx`
63 As a client, we can be doing a callout or cut-through delivery while receiving
64 a message. So we have a client context, which should have options initialised
65 from the SMTP Transport.
66
67Server:
68 There are two cases: with and without ServerNameIndication from the client.
69 Given TLS SNI, we can be using different keys, certs and various other
70 configuration settings, because they're re-expanded with $tls_sni set. This
71 allows vhosting with TLS. This SNI is sent in the handshake.
72 A client might not send SNI, so we need a fallback, and an initial setup too.
73 So as a server, we start out using `server_ctx`.
74 If SNI is sent by the client, then we as server, mid-negotiation, try to clone
75 `server_sni` from `server_ctx` and then initialise settings by re-expanding
76 configuration.
77*/
78
817d9f57
JH
79static SSL_CTX *client_ctx = NULL;
80static SSL_CTX *server_ctx = NULL;
81static SSL *client_ssl = NULL;
82static SSL *server_ssl = NULL;
389ca47a 83
35731706 84#ifdef EXIM_HAVE_OPENSSL_TLSEXT
817d9f57 85static SSL_CTX *server_sni = NULL;
35731706 86#endif
059ec3d9
PH
87
88static char ssl_errstring[256];
89
90static int ssl_session_timeout = 200;
a2ff477a
JH
91static BOOL client_verify_optional = FALSE;
92static BOOL server_verify_optional = FALSE;
059ec3d9 93
f5d78688 94static BOOL reexpand_tls_files_for_sni = FALSE;
059ec3d9
PH
95
96
7be682ca
PP
97typedef struct tls_ext_ctx_cb {
98 uschar *certificate;
99 uschar *privatekey;
f2de3a33 100#ifndef DISABLE_OCSP
f5d78688
JH
101 BOOL is_server;
102 union {
103 struct {
104 uschar *file;
105 uschar *file_expanded;
106 OCSP_RESPONSE *response;
107 } server;
108 struct {
44662487
JH
109 X509_STORE *verify_store; /* non-null if status requested */
110 BOOL verify_required;
f5d78688
JH
111 } client;
112 } u_ocsp;
3f7eeb86 113#endif
7be682ca
PP
114 uschar *dhparam;
115 /* these are cached from first expand */
116 uschar *server_cipher_list;
117 /* only passed down to tls_error: */
118 host_item *host;
e51c7be2
JH
119
120#ifdef EXPERIMENTAL_CERTNAMES
121 uschar * verify_cert_hostnames;
122#endif
a7538db1
JH
123#ifdef EXPERIMENTAL_TPDA
124 uschar * event_action;
125#endif
7be682ca
PP
126} tls_ext_ctx_cb;
127
128/* should figure out a cleanup of API to handle state preserved per
129implementation, for various reasons, which can be void * in the APIs.
130For now, we hack around it. */
817d9f57
JH
131tls_ext_ctx_cb *client_static_cbinfo = NULL;
132tls_ext_ctx_cb *server_static_cbinfo = NULL;
7be682ca
PP
133
134static int
983207c1
JH
135setup_certs(SSL_CTX *sctx, uschar *certs, uschar *crl, host_item *host, BOOL optional,
136 int (*cert_vfy_cb)(int, X509_STORE_CTX *) );
059ec3d9 137
3f7eeb86 138/* Callbacks */
3bcbbbe2 139#ifdef EXIM_HAVE_OPENSSL_TLSEXT
3f7eeb86 140static int tls_servername_cb(SSL *s, int *ad ARG_UNUSED, void *arg);
3bcbbbe2 141#endif
f2de3a33 142#ifndef DISABLE_OCSP
f5d78688 143static int tls_server_stapling_cb(SSL *s, void *arg);
3f7eeb86
PP
144#endif
145
059ec3d9
PH
146
147/*************************************************
148* Handle TLS error *
149*************************************************/
150
151/* Called from lots of places when errors occur before actually starting to do
152the TLS handshake, that is, while the session is still in clear. Always returns
153DEFER for a server and FAIL for a client so that most calls can use "return
154tls_error(...)" to do this processing and then give an appropriate return. A
155single function is used for both server and client, because it is called from
156some shared functions.
157
158Argument:
159 prefix text to include in the logged error
160 host NULL if setting up a server;
161 the connected host if setting up a client
7199e1ee 162 msg error message or NULL if we should ask OpenSSL
059ec3d9
PH
163
164Returns: OK/DEFER/FAIL
165*/
166
167static int
7199e1ee 168tls_error(uschar *prefix, host_item *host, uschar *msg)
059ec3d9 169{
7199e1ee
TF
170if (msg == NULL)
171 {
172 ERR_error_string(ERR_get_error(), ssl_errstring);
5ca6d115 173 msg = (uschar *)ssl_errstring;
7199e1ee
TF
174 }
175
059ec3d9
PH
176if (host == NULL)
177 {
7199e1ee 178 uschar *conn_info = smtp_get_connection_info();
5ca6d115 179 if (Ustrncmp(conn_info, US"SMTP ", 5) == 0)
7199e1ee
TF
180 conn_info += 5;
181 log_write(0, LOG_MAIN, "TLS error on %s (%s): %s",
182 conn_info, prefix, msg);
059ec3d9
PH
183 return DEFER;
184 }
185else
186 {
187 log_write(0, LOG_MAIN, "TLS error on connection to %s [%s] (%s): %s",
7199e1ee 188 host->name, host->address, prefix, msg);
059ec3d9
PH
189 return FAIL;
190 }
191}
192
193
194
195/*************************************************
196* Callback to generate RSA key *
197*************************************************/
198
199/*
200Arguments:
201 s SSL connection
202 export not used
203 keylength keylength
204
205Returns: pointer to generated key
206*/
207
208static RSA *
209rsa_callback(SSL *s, int export, int keylength)
210{
211RSA *rsa_key;
212export = export; /* Shut picky compilers up */
213DEBUG(D_tls) debug_printf("Generating %d bit RSA key...\n", keylength);
214rsa_key = RSA_generate_key(keylength, RSA_F4, NULL, NULL);
215if (rsa_key == NULL)
216 {
217 ERR_error_string(ERR_get_error(), ssl_errstring);
218 log_write(0, LOG_MAIN|LOG_PANIC, "TLS error (RSA_generate_key): %s",
219 ssl_errstring);
220 return NULL;
221 }
222return rsa_key;
223}
224
225
226
f5d78688 227/* Extreme debug
f2de3a33 228#ifndef DISABLE_OCSP
f5d78688
JH
229void
230x509_store_dump_cert_s_names(X509_STORE * store)
231{
232STACK_OF(X509_OBJECT) * roots= store->objs;
233int i;
234static uschar name[256];
235
236for(i= 0; i<sk_X509_OBJECT_num(roots); i++)
237 {
238 X509_OBJECT * tmp_obj= sk_X509_OBJECT_value(roots, i);
239 if(tmp_obj->type == X509_LU_X509)
240 {
241 X509 * current_cert= tmp_obj->data.x509;
242 X509_NAME_oneline(X509_get_subject_name(current_cert), CS name, sizeof(name));
243 debug_printf(" %s\n", name);
244 }
245 }
246}
247#endif
248*/
249
059ec3d9
PH
250
251/*************************************************
252* Callback for verification *
253*************************************************/
254
255/* The SSL library does certificate verification if set up to do so. This
256callback has the current yes/no state is in "state". If verification succeeded,
257we set up the tls_peerdn string. If verification failed, what happens depends
258on whether the client is required to present a verifiable certificate or not.
259
260If verification is optional, we change the state to yes, but still log the
261verification error. For some reason (it really would help to have proper
262documentation of OpenSSL), this callback function then gets called again, this
263time with state = 1. In fact, that's useful, because we can set up the peerdn
264value, but we must take care not to set the private verified flag on the second
265time through.
266
267Note: this function is not called if the client fails to present a certificate
268when asked. We get here only if a certificate has been received. Handling of
269optional verification for this case is done when requesting SSL to verify, by
270setting SSL_VERIFY_FAIL_IF_NO_PEER_CERT in the non-optional case.
271
a7538db1
JH
272May be called multiple times for different issues with a certificate, even
273for a given "depth" in the certificate chain.
274
059ec3d9
PH
275Arguments:
276 state current yes/no state as 1/0
277 x509ctx certificate information.
a2ff477a 278 client TRUE for client startup, FALSE for server startup
059ec3d9
PH
279
280Returns: 1 if verified, 0 if not
281*/
282
283static int
421aff85
JH
284verify_callback(int state, X509_STORE_CTX *x509ctx,
285 tls_support *tlsp, BOOL *calledp, BOOL *optionalp)
059ec3d9 286{
421aff85 287X509 * cert = X509_STORE_CTX_get_current_cert(x509ctx);
a7538db1 288int depth = X509_STORE_CTX_get_error_depth(x509ctx);
059ec3d9
PH
289static uschar txt[256];
290
e51c7be2 291X509_NAME_oneline(X509_get_subject_name(cert), CS txt, sizeof(txt));
059ec3d9
PH
292
293if (state == 0)
294 {
295 log_write(0, LOG_MAIN, "SSL verify error: depth=%d error=%s cert=%s",
a7538db1 296 depth,
421aff85 297 X509_verify_cert_error_string(X509_STORE_CTX_get_error(x509ctx)),
059ec3d9 298 txt);
a2ff477a
JH
299 tlsp->certificate_verified = FALSE;
300 *calledp = TRUE;
9d1c15ef
JH
301 if (!*optionalp)
302 {
421aff85 303 tlsp->peercert = X509_dup(cert);
9d1c15ef
JH
304 return 0; /* reject */
305 }
059ec3d9
PH
306 DEBUG(D_tls) debug_printf("SSL verify failure overridden (host in "
307 "tls_try_verify_hosts)\n");
059ec3d9
PH
308 }
309
a7538db1 310else if (depth != 0)
059ec3d9 311 {
a7538db1 312 DEBUG(D_tls) debug_printf("SSL verify ok: depth=%d SN=%s\n", depth, txt);
f2de3a33 313#ifndef DISABLE_OCSP
f5d78688
JH
314 if (tlsp == &tls_out && client_static_cbinfo->u_ocsp.client.verify_store)
315 { /* client, wanting stapling */
316 /* Add the server cert's signing chain as the one
317 for the verification of the OCSP stapled information. */
318
319 if (!X509_STORE_add_cert(client_static_cbinfo->u_ocsp.client.verify_store,
421aff85 320 cert))
f5d78688
JH
321 ERR_clear_error();
322 }
323#endif
a7538db1
JH
324#ifdef EXPERIMENTAL_TPDA
325 if (tlsp == &tls_out && client_static_cbinfo->event_action)
326 {
327 tlsp->peercert = X509_dup(cert);
328 if (tpda_raise_event(client_static_cbinfo->event_action,
329 US"tls:cert", string_sprintf("%d", depth)) == DEFER)
330 {
331 log_write(0, LOG_MAIN, "SSL verify denied by event-action: "
332 "depth=%d cert=%s", depth, txt);
333 tlsp->certificate_verified = FALSE;
334 *calledp = TRUE;
335 return 0; /* reject */
336 }
337 X509_free(tlsp->peercert);
338 tlsp->peercert = NULL;
339 }
340#endif
059ec3d9
PH
341 }
342else
343 {
e51c7be2
JH
344#ifdef EXPERIMENTAL_CERTNAMES
345 uschar * verify_cert_hostnames;
346#endif
347
a2ff477a 348 tlsp->peerdn = txt;
421aff85 349 tlsp->peercert = X509_dup(cert);
e51c7be2
JH
350
351#ifdef EXPERIMENTAL_CERTNAMES
352 if ( tlsp == &tls_out
353 && ((verify_cert_hostnames = client_static_cbinfo->verify_cert_hostnames)))
354 /* client, wanting hostname check */
355
356# if OPENSSL_VERSION_NUMBER >= 0x010100000L || OPENSSL_VERSION_NUMBER >= 0x010002000L
d8e7834a
JH
357# ifndef X509_CHECK_FLAG_NO_PARTIAL_WILDCARDS
358# define X509_CHECK_FLAG_NO_PARTIAL_WILDCARDS 0
359# endif
e51c7be2
JH
360 {
361 int sep = 0;
362 uschar * list = verify_cert_hostnames;
363 uschar * name;
d8e7834a
JH
364 int rc;
365 while ((name = string_nextinlist(&list, &sep, NULL, 0)))
366 if ((rc = X509_check_host(cert, name, 0,
367 X509_CHECK_FLAG_NO_PARTIAL_WILDCARDS)))
368 {
369 if (rc < 0)
370 {
371 log_write(0, LOG_MAIN, "SSL verify error: internal error\n");
372 name = NULL;
373 }
e51c7be2 374 break;
d8e7834a 375 }
e51c7be2
JH
376 if (!name)
377 {
378 log_write(0, LOG_MAIN,
379 "SSL verify error: certificate name mismatch: \"%s\"\n", txt);
380 return 0; /* reject */
381 }
382 }
383# else
384 if (!tls_is_name_for_cert(verify_cert_hostnames, cert))
385 {
386 log_write(0, LOG_MAIN,
387 "SSL verify error: certificate name mismatch: \"%s\"\n", txt);
388 return 0; /* reject */
389 }
390# endif
e5cccda9 391#endif /*EXPERIMENTAL_CERTNAMES*/
e51c7be2 392
a7538db1
JH
393#ifdef EXPERIMENTAL_TPDA
394 if (tlsp == &tls_out)
395 {
396 if (tpda_raise_event(client_static_cbinfo->event_action,
397 US"tls:cert", US"0") == DEFER)
398 {
399 log_write(0, LOG_MAIN, "SSL verify denied by event-action: "
400 "depth=0 cert=%s", txt);
401 tlsp->certificate_verified = FALSE;
402 *calledp = TRUE;
403 return 0; /* reject */
404 }
405 }
e51c7be2
JH
406#endif
407
93dcb1c2
JH
408 DEBUG(D_tls) debug_printf("SSL%s verify ok: depth=0 SN=%s\n",
409 *calledp ? "" : " authenticated", txt);
410 if (!*calledp) tlsp->certificate_verified = TRUE;
411 *calledp = TRUE;
059ec3d9
PH
412 }
413
a7538db1 414return 1; /* accept, at least for this level */
059ec3d9
PH
415}
416
a2ff477a
JH
417static int
418verify_callback_client(int state, X509_STORE_CTX *x509ctx)
419{
f5d78688 420return verify_callback(state, x509ctx, &tls_out, &client_verify_callback_called, &client_verify_optional);
a2ff477a
JH
421}
422
423static int
424verify_callback_server(int state, X509_STORE_CTX *x509ctx)
425{
f5d78688 426return verify_callback(state, x509ctx, &tls_in, &server_verify_callback_called, &server_verify_optional);
a2ff477a
JH
427}
428
059ec3d9 429
e5cccda9 430#ifdef EXPERIMENTAL_DANE
53a7196b 431
e5cccda9
JH
432/* This gets called *by* the dane library verify callback, which interposes
433itself.
434*/
435static int
436verify_callback_client_dane(int state, X509_STORE_CTX * x509ctx)
437{
438X509 * cert = X509_STORE_CTX_get_current_cert(x509ctx);
439static uschar txt[256];
83b27293
JH
440#ifdef EXPERIMENTAL_TPDA
441int depth = X509_STORE_CTX_get_error_depth(x509ctx);
442#endif
e5cccda9
JH
443
444X509_NAME_oneline(X509_get_subject_name(cert), CS txt, sizeof(txt));
445
446DEBUG(D_tls) debug_printf("verify_callback_client_dane: %s\n", txt);
447tls_out.peerdn = txt;
448tls_out.peercert = X509_dup(cert);
449
83b27293
JH
450#ifdef EXPERIMENTAL_TPDA
451 if (client_static_cbinfo->event_action)
452 {
453 if (tpda_raise_event(client_static_cbinfo->event_action,
454 US"tls:cert", string_sprintf("%d", depth)) == DEFER)
455 {
456 log_write(0, LOG_MAIN, "DANE verify denied by event-action: "
457 "depth=%d cert=%s", depth, txt);
458 tls_out.certificate_verified = FALSE;
459 return 0; /* reject */
460 }
461 if (depth != 0)
462 {
463 X509_free(tls_out.peercert);
464 tls_out.peercert = NULL;
465 }
466 }
467#endif
468
e5cccda9 469if (state == 1)
53a7196b 470 tls_out.dane_verified =
e5cccda9
JH
471 tls_out.certificate_verified = TRUE;
472return 1;
473}
53a7196b
JH
474
475#endif /*EXPERIMENTAL_DANE*/
e5cccda9 476
059ec3d9
PH
477
478/*************************************************
479* Information callback *
480*************************************************/
481
482/* The SSL library functions call this from time to time to indicate what they
7be682ca
PP
483are doing. We copy the string to the debugging output when TLS debugging has
484been requested.
059ec3d9
PH
485
486Arguments:
487 s the SSL connection
488 where
489 ret
490
491Returns: nothing
492*/
493
494static void
495info_callback(SSL *s, int where, int ret)
496{
497where = where;
498ret = ret;
499DEBUG(D_tls) debug_printf("SSL info: %s\n", SSL_state_string_long(s));
500}
501
502
503
504/*************************************************
505* Initialize for DH *
506*************************************************/
507
508/* If dhparam is set, expand it, and load up the parameters for DH encryption.
509
510Arguments:
a799883d 511 dhparam DH parameter file or fixed parameter identity string
7199e1ee 512 host connected host, if client; NULL if server
059ec3d9
PH
513
514Returns: TRUE if OK (nothing to set up, or setup worked)
515*/
516
517static BOOL
a799883d 518init_dh(SSL_CTX *sctx, uschar *dhparam, host_item *host)
059ec3d9 519{
059ec3d9
PH
520BIO *bio;
521DH *dh;
522uschar *dhexpanded;
a799883d 523const char *pem;
059ec3d9
PH
524
525if (!expand_check(dhparam, US"tls_dhparam", &dhexpanded))
526 return FALSE;
527
0df4ab80 528if (!dhexpanded || !*dhexpanded)
a799883d 529 bio = BIO_new_mem_buf(CS std_dh_prime_default(), -1);
a799883d 530else if (dhexpanded[0] == '/')
059ec3d9 531 {
0df4ab80 532 if (!(bio = BIO_new_file(CS dhexpanded, "r")))
059ec3d9 533 {
7199e1ee 534 tls_error(string_sprintf("could not read dhparams file %s", dhexpanded),
a799883d
PP
535 host, US strerror(errno));
536 return FALSE;
059ec3d9 537 }
a799883d
PP
538 }
539else
540 {
541 if (Ustrcmp(dhexpanded, "none") == 0)
059ec3d9 542 {
a799883d
PP
543 DEBUG(D_tls) debug_printf("Requested no DH parameters.\n");
544 return TRUE;
059ec3d9 545 }
a799883d 546
0df4ab80 547 if (!(pem = std_dh_prime_named(dhexpanded)))
a799883d
PP
548 {
549 tls_error(string_sprintf("Unknown standard DH prime \"%s\"", dhexpanded),
550 host, US strerror(errno));
551 return FALSE;
552 }
553 bio = BIO_new_mem_buf(CS pem, -1);
554 }
555
0df4ab80 556if (!(dh = PEM_read_bio_DHparams(bio, NULL, NULL, NULL)))
a799883d 557 {
059ec3d9 558 BIO_free(bio);
a799883d
PP
559 tls_error(string_sprintf("Could not read tls_dhparams \"%s\"", dhexpanded),
560 host, NULL);
561 return FALSE;
562 }
563
564/* Even if it is larger, we silently return success rather than cause things
565 * to fail out, so that a too-large DH will not knock out all TLS; it's a
566 * debatable choice. */
567if ((8*DH_size(dh)) > tls_dh_max_bits)
568 {
569 DEBUG(D_tls)
570 debug_printf("dhparams file %d bits, is > tls_dh_max_bits limit of %d",
571 8*DH_size(dh), tls_dh_max_bits);
572 }
573else
574 {
575 SSL_CTX_set_tmp_dh(sctx, dh);
576 DEBUG(D_tls)
577 debug_printf("Diffie-Hellman initialized from %s with %d-bit prime\n",
578 dhexpanded ? dhexpanded : US"default", 8*DH_size(dh));
059ec3d9
PH
579 }
580
a799883d
PP
581DH_free(dh);
582BIO_free(bio);
583
584return TRUE;
059ec3d9
PH
585}
586
587
588
589
f2de3a33 590#ifndef DISABLE_OCSP
3f7eeb86
PP
591/*************************************************
592* Load OCSP information into state *
593*************************************************/
594
f5d78688 595/* Called to load the server OCSP response from the given file into memory, once
3f7eeb86
PP
596caller has determined this is needed. Checks validity. Debugs a message
597if invalid.
598
599ASSUMES: single response, for single cert.
600
601Arguments:
602 sctx the SSL_CTX* to update
603 cbinfo various parts of session state
604 expanded the filename putatively holding an OCSP response
605
606*/
607
608static void
f5d78688 609ocsp_load_response(SSL_CTX *sctx, tls_ext_ctx_cb *cbinfo, const uschar *expanded)
3f7eeb86
PP
610{
611BIO *bio;
612OCSP_RESPONSE *resp;
613OCSP_BASICRESP *basic_response;
614OCSP_SINGLERESP *single_response;
615ASN1_GENERALIZEDTIME *rev, *thisupd, *nextupd;
616X509_STORE *store;
617unsigned long verify_flags;
618int status, reason, i;
619
f5d78688
JH
620cbinfo->u_ocsp.server.file_expanded = string_copy(expanded);
621if (cbinfo->u_ocsp.server.response)
3f7eeb86 622 {
f5d78688
JH
623 OCSP_RESPONSE_free(cbinfo->u_ocsp.server.response);
624 cbinfo->u_ocsp.server.response = NULL;
3f7eeb86
PP
625 }
626
f5d78688 627bio = BIO_new_file(CS cbinfo->u_ocsp.server.file_expanded, "rb");
3f7eeb86
PP
628if (!bio)
629 {
630 DEBUG(D_tls) debug_printf("Failed to open OCSP response file \"%s\"\n",
f5d78688 631 cbinfo->u_ocsp.server.file_expanded);
3f7eeb86
PP
632 return;
633 }
634
635resp = d2i_OCSP_RESPONSE_bio(bio, NULL);
636BIO_free(bio);
637if (!resp)
638 {
639 DEBUG(D_tls) debug_printf("Error reading OCSP response.\n");
640 return;
641 }
642
643status = OCSP_response_status(resp);
644if (status != OCSP_RESPONSE_STATUS_SUCCESSFUL)
645 {
646 DEBUG(D_tls) debug_printf("OCSP response not valid: %s (%d)\n",
647 OCSP_response_status_str(status), status);
f5d78688 648 goto bad;
3f7eeb86
PP
649 }
650
651basic_response = OCSP_response_get1_basic(resp);
652if (!basic_response)
653 {
654 DEBUG(D_tls)
655 debug_printf("OCSP response parse error: unable to extract basic response.\n");
f5d78688 656 goto bad;
3f7eeb86
PP
657 }
658
659store = SSL_CTX_get_cert_store(sctx);
660verify_flags = OCSP_NOVERIFY; /* check sigs, but not purpose */
661
662/* May need to expose ability to adjust those flags?
663OCSP_NOSIGS OCSP_NOVERIFY OCSP_NOCHAIN OCSP_NOCHECKS OCSP_NOEXPLICIT
664OCSP_TRUSTOTHER OCSP_NOINTERN */
665
666i = OCSP_basic_verify(basic_response, NULL, store, verify_flags);
667if (i <= 0)
668 {
669 DEBUG(D_tls) {
670 ERR_error_string(ERR_get_error(), ssl_errstring);
671 debug_printf("OCSP response verify failure: %s\n", US ssl_errstring);
f5d78688
JH
672 }
673 goto bad;
3f7eeb86
PP
674 }
675
676/* Here's the simplifying assumption: there's only one response, for the
677one certificate we use, and nothing for anything else in a chain. If this
678proves false, we need to extract a cert id from our issued cert
679(tls_certificate) and use that for OCSP_resp_find_status() (which finds the
680right cert in the stack and then calls OCSP_single_get0_status()).
681
682I'm hoping to avoid reworking a bunch more of how we handle state here. */
683single_response = OCSP_resp_get0(basic_response, 0);
684if (!single_response)
685 {
686 DEBUG(D_tls)
687 debug_printf("Unable to get first response from OCSP basic response.\n");
f5d78688 688 goto bad;
3f7eeb86
PP
689 }
690
691status = OCSP_single_get0_status(single_response, &reason, &rev, &thisupd, &nextupd);
f5d78688 692if (status != V_OCSP_CERTSTATUS_GOOD)
3f7eeb86 693 {
f5d78688
JH
694 DEBUG(D_tls) debug_printf("OCSP response bad cert status: %s (%d) %s (%d)\n",
695 OCSP_cert_status_str(status), status,
696 OCSP_crl_reason_str(reason), reason);
697 goto bad;
3f7eeb86
PP
698 }
699
700if (!OCSP_check_validity(thisupd, nextupd, EXIM_OCSP_SKEW_SECONDS, EXIM_OCSP_MAX_AGE))
701 {
702 DEBUG(D_tls) debug_printf("OCSP status invalid times.\n");
f5d78688 703 goto bad;
3f7eeb86
PP
704 }
705
f5d78688 706supply_response:
018058b2 707 cbinfo->u_ocsp.server.response = resp;
f5d78688
JH
708return;
709
710bad:
018058b2
JH
711 if (running_in_test_harness)
712 {
713 extern char ** environ;
714 uschar ** p;
715 for (p = USS environ; *p != NULL; p++)
716 if (Ustrncmp(*p, "EXIM_TESTHARNESS_DISABLE_OCSPVALIDITYCHECK", 42) == 0)
717 {
718 DEBUG(D_tls) debug_printf("Supplying known bad OCSP response\n");
719 goto supply_response;
720 }
721 }
f5d78688 722return;
3f7eeb86 723}
f2de3a33 724#endif /*!DISABLE_OCSP*/
3f7eeb86
PP
725
726
727
728
059ec3d9 729/*************************************************
7be682ca
PP
730* Expand key and cert file specs *
731*************************************************/
732
f5d78688 733/* Called once during tls_init and possibly again during TLS setup, for a
7be682ca
PP
734new context, if Server Name Indication was used and tls_sni was seen in
735the certificate string.
736
737Arguments:
738 sctx the SSL_CTX* to update
739 cbinfo various parts of session state
740
741Returns: OK/DEFER/FAIL
742*/
743
744static int
3f7eeb86 745tls_expand_session_files(SSL_CTX *sctx, tls_ext_ctx_cb *cbinfo)
7be682ca
PP
746{
747uschar *expanded;
748
749if (cbinfo->certificate == NULL)
750 return OK;
751
d9b2312b
JH
752if (Ustrstr(cbinfo->certificate, US"tls_sni") ||
753 Ustrstr(cbinfo->certificate, US"tls_in_sni") ||
754 Ustrstr(cbinfo->certificate, US"tls_out_sni")
755 )
7be682ca
PP
756 reexpand_tls_files_for_sni = TRUE;
757
758if (!expand_check(cbinfo->certificate, US"tls_certificate", &expanded))
759 return DEFER;
760
761if (expanded != NULL)
762 {
763 DEBUG(D_tls) debug_printf("tls_certificate file %s\n", expanded);
764 if (!SSL_CTX_use_certificate_chain_file(sctx, CS expanded))
765 return tls_error(string_sprintf(
766 "SSL_CTX_use_certificate_chain_file file=%s", expanded),
767 cbinfo->host, NULL);
768 }
769
770if (cbinfo->privatekey != NULL &&
771 !expand_check(cbinfo->privatekey, US"tls_privatekey", &expanded))
772 return DEFER;
773
774/* If expansion was forced to fail, key_expanded will be NULL. If the result
775of the expansion is an empty string, ignore it also, and assume the private
776key is in the same file as the certificate. */
777
778if (expanded != NULL && *expanded != 0)
779 {
780 DEBUG(D_tls) debug_printf("tls_privatekey file %s\n", expanded);
781 if (!SSL_CTX_use_PrivateKey_file(sctx, CS expanded, SSL_FILETYPE_PEM))
782 return tls_error(string_sprintf(
783 "SSL_CTX_use_PrivateKey_file file=%s", expanded), cbinfo->host, NULL);
784 }
785
f2de3a33 786#ifndef DISABLE_OCSP
f5d78688 787if (cbinfo->is_server && cbinfo->u_ocsp.server.file != NULL)
3f7eeb86 788 {
f5d78688 789 if (!expand_check(cbinfo->u_ocsp.server.file, US"tls_ocsp_file", &expanded))
3f7eeb86
PP
790 return DEFER;
791
792 if (expanded != NULL && *expanded != 0)
793 {
794 DEBUG(D_tls) debug_printf("tls_ocsp_file %s\n", expanded);
f5d78688
JH
795 if (cbinfo->u_ocsp.server.file_expanded &&
796 (Ustrcmp(expanded, cbinfo->u_ocsp.server.file_expanded) == 0))
3f7eeb86
PP
797 {
798 DEBUG(D_tls)
799 debug_printf("tls_ocsp_file value unchanged, using existing values.\n");
800 } else {
801 ocsp_load_response(sctx, cbinfo, expanded);
802 }
803 }
804 }
805#endif
806
7be682ca
PP
807return OK;
808}
809
810
811
812
813/*************************************************
814* Callback to handle SNI *
815*************************************************/
816
817/* Called when acting as server during the TLS session setup if a Server Name
818Indication extension was sent by the client.
819
820API documentation is OpenSSL s_server.c implementation.
821
822Arguments:
823 s SSL* of the current session
824 ad unknown (part of OpenSSL API) (unused)
825 arg Callback of "our" registered data
826
827Returns: SSL_TLSEXT_ERR_{OK,ALERT_WARNING,ALERT_FATAL,NOACK}
828*/
829
3bcbbbe2 830#ifdef EXIM_HAVE_OPENSSL_TLSEXT
7be682ca 831static int
7be682ca
PP
832tls_servername_cb(SSL *s, int *ad ARG_UNUSED, void *arg)
833{
834const char *servername = SSL_get_servername(s, TLSEXT_NAMETYPE_host_name);
3f7eeb86 835tls_ext_ctx_cb *cbinfo = (tls_ext_ctx_cb *) arg;
7be682ca 836int rc;
3f0945ff 837int old_pool = store_pool;
7be682ca
PP
838
839if (!servername)
840 return SSL_TLSEXT_ERR_OK;
841
3f0945ff 842DEBUG(D_tls) debug_printf("Received TLS SNI \"%s\"%s\n", servername,
7be682ca
PP
843 reexpand_tls_files_for_sni ? "" : " (unused for certificate selection)");
844
845/* Make the extension value available for expansion */
3f0945ff 846store_pool = POOL_PERM;
817d9f57 847tls_in.sni = string_copy(US servername);
3f0945ff 848store_pool = old_pool;
7be682ca
PP
849
850if (!reexpand_tls_files_for_sni)
851 return SSL_TLSEXT_ERR_OK;
852
853/* Can't find an SSL_CTX_clone() or equivalent, so we do it manually;
854not confident that memcpy wouldn't break some internal reference counting.
855Especially since there's a references struct member, which would be off. */
856
0df4ab80 857if (!(server_sni = SSL_CTX_new(SSLv23_server_method())))
7be682ca
PP
858 {
859 ERR_error_string(ERR_get_error(), ssl_errstring);
860 DEBUG(D_tls) debug_printf("SSL_CTX_new() failed: %s\n", ssl_errstring);
861 return SSL_TLSEXT_ERR_NOACK;
862 }
863
864/* Not sure how many of these are actually needed, since SSL object
865already exists. Might even need this selfsame callback, for reneg? */
866
817d9f57
JH
867SSL_CTX_set_info_callback(server_sni, SSL_CTX_get_info_callback(server_ctx));
868SSL_CTX_set_mode(server_sni, SSL_CTX_get_mode(server_ctx));
869SSL_CTX_set_options(server_sni, SSL_CTX_get_options(server_ctx));
870SSL_CTX_set_timeout(server_sni, SSL_CTX_get_timeout(server_ctx));
871SSL_CTX_set_tlsext_servername_callback(server_sni, tls_servername_cb);
872SSL_CTX_set_tlsext_servername_arg(server_sni, cbinfo);
7be682ca 873if (cbinfo->server_cipher_list)
817d9f57 874 SSL_CTX_set_cipher_list(server_sni, CS cbinfo->server_cipher_list);
f2de3a33 875#ifndef DISABLE_OCSP
f5d78688 876if (cbinfo->u_ocsp.server.file)
3f7eeb86 877 {
f5d78688 878 SSL_CTX_set_tlsext_status_cb(server_sni, tls_server_stapling_cb);
14c7b357 879 SSL_CTX_set_tlsext_status_arg(server_sni, cbinfo);
3f7eeb86
PP
880 }
881#endif
7be682ca 882
983207c1 883rc = setup_certs(server_sni, tls_verify_certificates, tls_crl, NULL, FALSE, verify_callback_server);
7be682ca
PP
884if (rc != OK) return SSL_TLSEXT_ERR_NOACK;
885
3f7eeb86
PP
886/* do this after setup_certs, because this can require the certs for verifying
887OCSP information. */
817d9f57 888rc = tls_expand_session_files(server_sni, cbinfo);
7be682ca
PP
889if (rc != OK) return SSL_TLSEXT_ERR_NOACK;
890
0df4ab80
JH
891if (!init_dh(server_sni, cbinfo->dhparam, NULL))
892 return SSL_TLSEXT_ERR_NOACK;
a799883d 893
7be682ca 894DEBUG(D_tls) debug_printf("Switching SSL context.\n");
817d9f57 895SSL_set_SSL_CTX(s, server_sni);
7be682ca
PP
896
897return SSL_TLSEXT_ERR_OK;
898}
3bcbbbe2 899#endif /* EXIM_HAVE_OPENSSL_TLSEXT */
7be682ca
PP
900
901
902
903
f2de3a33 904#ifndef DISABLE_OCSP
f5d78688 905
3f7eeb86
PP
906/*************************************************
907* Callback to handle OCSP Stapling *
908*************************************************/
909
910/* Called when acting as server during the TLS session setup if the client
911requests OCSP information with a Certificate Status Request.
912
913Documentation via openssl s_server.c and the Apache patch from the OpenSSL
914project.
915
916*/
917
918static int
f5d78688 919tls_server_stapling_cb(SSL *s, void *arg)
3f7eeb86
PP
920{
921const tls_ext_ctx_cb *cbinfo = (tls_ext_ctx_cb *) arg;
922uschar *response_der;
923int response_der_len;
924
af4a1bca
JH
925DEBUG(D_tls)
926 debug_printf("Received TLS status request (OCSP stapling); %s response.",
f5d78688
JH
927 cbinfo->u_ocsp.server.response ? "have" : "lack");
928
44662487 929tls_in.ocsp = OCSP_NOT_RESP;
f5d78688 930if (!cbinfo->u_ocsp.server.response)
3f7eeb86
PP
931 return SSL_TLSEXT_ERR_NOACK;
932
933response_der = NULL;
44662487
JH
934response_der_len = i2d_OCSP_RESPONSE(cbinfo->u_ocsp.server.response,
935 &response_der);
3f7eeb86
PP
936if (response_der_len <= 0)
937 return SSL_TLSEXT_ERR_NOACK;
938
5e55c7a9 939SSL_set_tlsext_status_ocsp_resp(server_ssl, response_der, response_der_len);
44662487 940tls_in.ocsp = OCSP_VFIED;
3f7eeb86
PP
941return SSL_TLSEXT_ERR_OK;
942}
943
3f7eeb86 944
f5d78688
JH
945static void
946time_print(BIO * bp, const char * str, ASN1_GENERALIZEDTIME * time)
947{
948BIO_printf(bp, "\t%s: ", str);
949ASN1_GENERALIZEDTIME_print(bp, time);
950BIO_puts(bp, "\n");
951}
952
953static int
954tls_client_stapling_cb(SSL *s, void *arg)
955{
956tls_ext_ctx_cb * cbinfo = arg;
957const unsigned char * p;
958int len;
959OCSP_RESPONSE * rsp;
960OCSP_BASICRESP * bs;
961int i;
962
963DEBUG(D_tls) debug_printf("Received TLS status response (OCSP stapling):");
964len = SSL_get_tlsext_status_ocsp_resp(s, &p);
965if(!p)
966 {
44662487
JH
967 /* Expect this when we requested ocsp but got none */
968 if ( cbinfo->u_ocsp.client.verify_required
969 && log_extra_selector & LX_tls_cipher)
970 log_write(0, LOG_MAIN, "Received TLS status callback, null content");
f5d78688
JH
971 else
972 DEBUG(D_tls) debug_printf(" null\n");
44662487 973 return cbinfo->u_ocsp.client.verify_required ? 0 : 1;
f5d78688 974 }
018058b2 975
f5d78688
JH
976if(!(rsp = d2i_OCSP_RESPONSE(NULL, &p, len)))
977 {
018058b2 978 tls_out.ocsp = OCSP_FAILED;
f5d78688 979 if (log_extra_selector & LX_tls_cipher)
1eca31ca 980 log_write(0, LOG_MAIN, "Received TLS cert status response, parse error");
f5d78688
JH
981 else
982 DEBUG(D_tls) debug_printf(" parse error\n");
983 return 0;
984 }
985
986if(!(bs = OCSP_response_get1_basic(rsp)))
987 {
018058b2 988 tls_out.ocsp = OCSP_FAILED;
f5d78688 989 if (log_extra_selector & LX_tls_cipher)
1eca31ca 990 log_write(0, LOG_MAIN, "Received TLS cert status response, error parsing response");
f5d78688
JH
991 else
992 DEBUG(D_tls) debug_printf(" error parsing response\n");
993 OCSP_RESPONSE_free(rsp);
994 return 0;
995 }
996
997/* We'd check the nonce here if we'd put one in the request. */
998/* However that would defeat cacheability on the server so we don't. */
999
f5d78688
JH
1000/* This section of code reworked from OpenSSL apps source;
1001 The OpenSSL Project retains copyright:
1002 Copyright (c) 1999 The OpenSSL Project. All rights reserved.
1003*/
1004 {
1005 BIO * bp = NULL;
f5d78688
JH
1006 int status, reason;
1007 ASN1_GENERALIZEDTIME *rev, *thisupd, *nextupd;
1008
1009 DEBUG(D_tls) bp = BIO_new_fp(stderr, BIO_NOCLOSE);
1010
1011 /*OCSP_RESPONSE_print(bp, rsp, 0); extreme debug: stapling content */
1012
1013 /* Use the chain that verified the server cert to verify the stapled info */
1014 /* DEBUG(D_tls) x509_store_dump_cert_s_names(cbinfo->u_ocsp.client.verify_store); */
1015
44662487
JH
1016 if ((i = OCSP_basic_verify(bs, NULL,
1017 cbinfo->u_ocsp.client.verify_store, 0)) <= 0)
f5d78688 1018 {
018058b2 1019 tls_out.ocsp = OCSP_FAILED;
1eca31ca
JH
1020 if (log_extra_selector & LX_tls_cipher)
1021 log_write(0, LOG_MAIN, "Received TLS cert status response, itself unverifiable");
f5d78688
JH
1022 BIO_printf(bp, "OCSP response verify failure\n");
1023 ERR_print_errors(bp);
44662487 1024 i = cbinfo->u_ocsp.client.verify_required ? 0 : 1;
f5d78688
JH
1025 goto out;
1026 }
1027
1028 BIO_printf(bp, "OCSP response well-formed and signed OK\n");
1029
1030 {
1031 STACK_OF(OCSP_SINGLERESP) * sresp = bs->tbsResponseData->responses;
1032 OCSP_SINGLERESP * single;
1033
1034 if (sk_OCSP_SINGLERESP_num(sresp) != 1)
1035 {
018058b2 1036 tls_out.ocsp = OCSP_FAILED;
44662487
JH
1037 log_write(0, LOG_MAIN, "OCSP stapling "
1038 "with multiple responses not handled");
1039 i = cbinfo->u_ocsp.client.verify_required ? 0 : 1;
f5d78688
JH
1040 goto out;
1041 }
1042 single = OCSP_resp_get0(bs, 0);
44662487
JH
1043 status = OCSP_single_get0_status(single, &reason, &rev,
1044 &thisupd, &nextupd);
f5d78688
JH
1045 }
1046
f5d78688
JH
1047 DEBUG(D_tls) time_print(bp, "This OCSP Update", thisupd);
1048 DEBUG(D_tls) if(nextupd) time_print(bp, "Next OCSP Update", nextupd);
44662487
JH
1049 if (!OCSP_check_validity(thisupd, nextupd,
1050 EXIM_OCSP_SKEW_SECONDS, EXIM_OCSP_MAX_AGE))
f5d78688 1051 {
018058b2 1052 tls_out.ocsp = OCSP_FAILED;
f5d78688
JH
1053 DEBUG(D_tls) ERR_print_errors(bp);
1054 log_write(0, LOG_MAIN, "Server OSCP dates invalid");
44662487 1055 i = cbinfo->u_ocsp.client.verify_required ? 0 : 1;
f5d78688 1056 }
44662487 1057 else
f5d78688 1058 {
44662487
JH
1059 DEBUG(D_tls) BIO_printf(bp, "Certificate status: %s\n",
1060 OCSP_cert_status_str(status));
1061 switch(status)
1062 {
1063 case V_OCSP_CERTSTATUS_GOOD:
44662487 1064 tls_out.ocsp = OCSP_VFIED;
018058b2 1065 i = 1;
44662487
JH
1066 break;
1067 case V_OCSP_CERTSTATUS_REVOKED:
018058b2 1068 tls_out.ocsp = OCSP_FAILED;
44662487
JH
1069 log_write(0, LOG_MAIN, "Server certificate revoked%s%s",
1070 reason != -1 ? "; reason: " : "",
1071 reason != -1 ? OCSP_crl_reason_str(reason) : "");
1072 DEBUG(D_tls) time_print(bp, "Revocation Time", rev);
1073 i = cbinfo->u_ocsp.client.verify_required ? 0 : 1;
1074 break;
1075 default:
018058b2 1076 tls_out.ocsp = OCSP_FAILED;
44662487
JH
1077 log_write(0, LOG_MAIN,
1078 "Server certificate status unknown, in OCSP stapling");
1079 i = cbinfo->u_ocsp.client.verify_required ? 0 : 1;
1080 break;
1081 }
f5d78688
JH
1082 }
1083 out:
1084 BIO_free(bp);
1085 }
1086
1087OCSP_RESPONSE_free(rsp);
1088return i;
1089}
f2de3a33 1090#endif /*!DISABLE_OCSP*/
3f7eeb86
PP
1091
1092
7be682ca 1093/*************************************************
059ec3d9
PH
1094* Initialize for TLS *
1095*************************************************/
1096
e51c7be2
JH
1097/* Called from both server and client code, to do preliminary initialization
1098of the library. We allocate and return a context structure.
059ec3d9
PH
1099
1100Arguments:
946ecbe0 1101 ctxp returned SSL context
059ec3d9
PH
1102 host connected host, if client; NULL if server
1103 dhparam DH parameter file
1104 certificate certificate file
1105 privatekey private key
f5d78688 1106 ocsp_file file of stapling info (server); flag for require ocsp (client)
059ec3d9 1107 addr address if client; NULL if server (for some randomness)
946ecbe0 1108 cbp place to put allocated callback context
059ec3d9
PH
1109
1110Returns: OK/DEFER/FAIL
1111*/
1112
1113static int
817d9f57 1114tls_init(SSL_CTX **ctxp, host_item *host, uschar *dhparam, uschar *certificate,
3f7eeb86 1115 uschar *privatekey,
f2de3a33 1116#ifndef DISABLE_OCSP
3f7eeb86
PP
1117 uschar *ocsp_file,
1118#endif
817d9f57 1119 address_item *addr, tls_ext_ctx_cb ** cbp)
059ec3d9 1120{
77bb000f 1121long init_options;
7be682ca 1122int rc;
77bb000f 1123BOOL okay;
a7538db1 1124tls_ext_ctx_cb * cbinfo;
7be682ca
PP
1125
1126cbinfo = store_malloc(sizeof(tls_ext_ctx_cb));
1127cbinfo->certificate = certificate;
1128cbinfo->privatekey = privatekey;
f2de3a33 1129#ifndef DISABLE_OCSP
f5d78688
JH
1130if ((cbinfo->is_server = host==NULL))
1131 {
1132 cbinfo->u_ocsp.server.file = ocsp_file;
1133 cbinfo->u_ocsp.server.file_expanded = NULL;
1134 cbinfo->u_ocsp.server.response = NULL;
1135 }
1136else
1137 cbinfo->u_ocsp.client.verify_store = NULL;
3f7eeb86 1138#endif
7be682ca 1139cbinfo->dhparam = dhparam;
0df4ab80 1140cbinfo->server_cipher_list = NULL;
7be682ca 1141cbinfo->host = host;
a7538db1
JH
1142#ifdef EXPERIMENTAL_TPDA
1143cbinfo->event_action = NULL;
1144#endif
77bb000f 1145
059ec3d9
PH
1146SSL_load_error_strings(); /* basic set up */
1147OpenSSL_add_ssl_algorithms();
1148
388d6564 1149#if (OPENSSL_VERSION_NUMBER >= 0x0090800fL) && !defined(OPENSSL_NO_SHA256)
77bb000f 1150/* SHA256 is becoming ever more popular. This makes sure it gets added to the
a0475b69
TK
1151list of available digests. */
1152EVP_add_digest(EVP_sha256());
cf1ef1a9 1153#endif
a0475b69 1154
f0f5a555
PP
1155/* Create a context.
1156The OpenSSL docs in 1.0.1b have not been updated to clarify TLS variant
1157negotiation in the different methods; as far as I can tell, the only
1158*_{server,client}_method which allows negotiation is SSLv23, which exists even
1159when OpenSSL is built without SSLv2 support.
1160By disabling with openssl_options, we can let admins re-enable with the
1161existing knob. */
059ec3d9 1162
817d9f57 1163*ctxp = SSL_CTX_new((host == NULL)?
059ec3d9
PH
1164 SSLv23_server_method() : SSLv23_client_method());
1165
817d9f57 1166if (*ctxp == NULL) return tls_error(US"SSL_CTX_new", host, NULL);
059ec3d9
PH
1167
1168/* It turns out that we need to seed the random number generator this early in
1169order to get the full complement of ciphers to work. It took me roughly a day
1170of work to discover this by experiment.
1171
1172On systems that have /dev/urandom, SSL may automatically seed itself from
1173there. Otherwise, we have to make something up as best we can. Double check
1174afterwards. */
1175
1176if (!RAND_status())
1177 {
1178 randstuff r;
9e3331ea 1179 gettimeofday(&r.tv, NULL);
059ec3d9
PH
1180 r.p = getpid();
1181
1182 RAND_seed((uschar *)(&r), sizeof(r));
1183 RAND_seed((uschar *)big_buffer, big_buffer_size);
1184 if (addr != NULL) RAND_seed((uschar *)addr, sizeof(addr));
1185
1186 if (!RAND_status())
7199e1ee 1187 return tls_error(US"RAND_status", host,
5ca6d115 1188 US"unable to seed random number generator");
059ec3d9
PH
1189 }
1190
1191/* Set up the information callback, which outputs if debugging is at a suitable
1192level. */
1193
817d9f57 1194SSL_CTX_set_info_callback(*ctxp, (void (*)())info_callback);
059ec3d9 1195
c80c5570 1196/* Automatically re-try reads/writes after renegotiation. */
817d9f57 1197(void) SSL_CTX_set_mode(*ctxp, SSL_MODE_AUTO_RETRY);
c80c5570 1198
77bb000f
PP
1199/* Apply administrator-supplied work-arounds.
1200Historically we applied just one requested option,
1201SSL_OP_DONT_INSERT_EMPTY_FRAGMENTS, but when bug 994 requested a second, we
1202moved to an administrator-controlled list of options to specify and
1203grandfathered in the first one as the default value for "openssl_options".
059ec3d9 1204
77bb000f
PP
1205No OpenSSL version number checks: the options we accept depend upon the
1206availability of the option value macros from OpenSSL. */
059ec3d9 1207
77bb000f
PP
1208okay = tls_openssl_options_parse(openssl_options, &init_options);
1209if (!okay)
73a46702 1210 return tls_error(US"openssl_options parsing failed", host, NULL);
77bb000f
PP
1211
1212if (init_options)
1213 {
1214 DEBUG(D_tls) debug_printf("setting SSL CTX options: %#lx\n", init_options);
817d9f57 1215 if (!(SSL_CTX_set_options(*ctxp, init_options)))
77bb000f
PP
1216 return tls_error(string_sprintf(
1217 "SSL_CTX_set_option(%#lx)", init_options), host, NULL);
1218 }
1219else
1220 DEBUG(D_tls) debug_printf("no SSL CTX options to set\n");
059ec3d9
PH
1221
1222/* Initialize with DH parameters if supplied */
1223
817d9f57 1224if (!init_dh(*ctxp, dhparam, host)) return DEFER;
059ec3d9 1225
3f7eeb86 1226/* Set up certificate and key (and perhaps OCSP info) */
059ec3d9 1227
817d9f57 1228rc = tls_expand_session_files(*ctxp, cbinfo);
7be682ca 1229if (rc != OK) return rc;
c91535f3 1230
7be682ca 1231/* If we need to handle SNI, do so */
3bcbbbe2 1232#ifdef EXIM_HAVE_OPENSSL_TLSEXT
f5d78688 1233if (host == NULL) /* server */
3f0945ff 1234 {
f2de3a33 1235# ifndef DISABLE_OCSP
f5d78688 1236 /* We check u_ocsp.server.file, not server.response, because we care about if
3f7eeb86
PP
1237 the option exists, not what the current expansion might be, as SNI might
1238 change the certificate and OCSP file in use between now and the time the
1239 callback is invoked. */
f5d78688 1240 if (cbinfo->u_ocsp.server.file)
3f7eeb86 1241 {
f5d78688 1242 SSL_CTX_set_tlsext_status_cb(server_ctx, tls_server_stapling_cb);
5e55c7a9 1243 SSL_CTX_set_tlsext_status_arg(server_ctx, cbinfo);
3f7eeb86 1244 }
f5d78688 1245# endif
3f0945ff
PP
1246 /* We always do this, so that $tls_sni is available even if not used in
1247 tls_certificate */
817d9f57
JH
1248 SSL_CTX_set_tlsext_servername_callback(*ctxp, tls_servername_cb);
1249 SSL_CTX_set_tlsext_servername_arg(*ctxp, cbinfo);
3f0945ff 1250 }
f2de3a33 1251# ifndef DISABLE_OCSP
f5d78688
JH
1252else /* client */
1253 if(ocsp_file) /* wanting stapling */
1254 {
1255 if (!(cbinfo->u_ocsp.client.verify_store = X509_STORE_new()))
1256 {
1257 DEBUG(D_tls) debug_printf("failed to create store for stapling verify\n");
1258 return FAIL;
1259 }
1260 SSL_CTX_set_tlsext_status_cb(*ctxp, tls_client_stapling_cb);
1261 SSL_CTX_set_tlsext_status_arg(*ctxp, cbinfo);
1262 }
1263# endif
7be682ca 1264#endif
059ec3d9 1265
e51c7be2
JH
1266#ifdef EXPERIMENTAL_CERTNAMES
1267cbinfo->verify_cert_hostnames = NULL;
1268#endif
1269
059ec3d9
PH
1270/* Set up the RSA callback */
1271
817d9f57 1272SSL_CTX_set_tmp_rsa_callback(*ctxp, rsa_callback);
059ec3d9
PH
1273
1274/* Finally, set the timeout, and we are done */
1275
817d9f57 1276SSL_CTX_set_timeout(*ctxp, ssl_session_timeout);
059ec3d9 1277DEBUG(D_tls) debug_printf("Initialized TLS\n");
7be682ca 1278
817d9f57 1279*cbp = cbinfo;
7be682ca 1280
059ec3d9
PH
1281return OK;
1282}
1283
1284
1285
1286
1287/*************************************************
1288* Get name of cipher in use *
1289*************************************************/
1290
817d9f57 1291/*
059ec3d9 1292Argument: pointer to an SSL structure for the connection
817d9f57
JH
1293 buffer to use for answer
1294 size of buffer
1295 pointer to number of bits for cipher
059ec3d9
PH
1296Returns: nothing
1297*/
1298
1299static void
817d9f57 1300construct_cipher_name(SSL *ssl, uschar *cipherbuf, int bsize, int *bits)
059ec3d9 1301{
57b3a7f5
PP
1302/* With OpenSSL 1.0.0a, this needs to be const but the documentation doesn't
1303yet reflect that. It should be a safe change anyway, even 0.9.8 versions have
1304the accessor functions use const in the prototype. */
1305const SSL_CIPHER *c;
d9784128 1306const uschar *ver;
059ec3d9 1307
d9784128 1308ver = (const uschar *)SSL_get_version(ssl);
059ec3d9 1309
57b3a7f5 1310c = (const SSL_CIPHER *) SSL_get_current_cipher(ssl);
817d9f57 1311SSL_CIPHER_get_bits(c, bits);
059ec3d9 1312
817d9f57
JH
1313string_format(cipherbuf, bsize, "%s:%s:%u", ver,
1314 SSL_CIPHER_get_name(c), *bits);
059ec3d9
PH
1315
1316DEBUG(D_tls) debug_printf("Cipher: %s\n", cipherbuf);
1317}
1318
1319
1320
1321
1322
1323/*************************************************
1324* Set up for verifying certificates *
1325*************************************************/
1326
1327/* Called by both client and server startup
1328
1329Arguments:
7be682ca 1330 sctx SSL_CTX* to initialise
059ec3d9
PH
1331 certs certs file or NULL
1332 crl CRL file or NULL
1333 host NULL in a server; the remote host in a client
1334 optional TRUE if called from a server for a host in tls_try_verify_hosts;
1335 otherwise passed as FALSE
983207c1 1336 cert_vfy_cb Callback function for certificate verification
059ec3d9
PH
1337
1338Returns: OK/DEFER/FAIL
1339*/
1340
1341static int
983207c1
JH
1342setup_certs(SSL_CTX *sctx, uschar *certs, uschar *crl, host_item *host, BOOL optional,
1343 int (*cert_vfy_cb)(int, X509_STORE_CTX *) )
059ec3d9
PH
1344{
1345uschar *expcerts, *expcrl;
1346
1347if (!expand_check(certs, US"tls_verify_certificates", &expcerts))
1348 return DEFER;
1349
26e72755 1350if (expcerts != NULL && *expcerts != '\0')
059ec3d9
PH
1351 {
1352 struct stat statbuf;
7be682ca 1353 if (!SSL_CTX_set_default_verify_paths(sctx))
7199e1ee 1354 return tls_error(US"SSL_CTX_set_default_verify_paths", host, NULL);
059ec3d9
PH
1355
1356 if (Ustat(expcerts, &statbuf) < 0)
1357 {
1358 log_write(0, LOG_MAIN|LOG_PANIC,
1359 "failed to stat %s for certificates", expcerts);
1360 return DEFER;
1361 }
1362 else
1363 {
1364 uschar *file, *dir;
1365 if ((statbuf.st_mode & S_IFMT) == S_IFDIR)
1366 { file = NULL; dir = expcerts; }
1367 else
1368 { file = expcerts; dir = NULL; }
1369
1370 /* If a certificate file is empty, the next function fails with an
1371 unhelpful error message. If we skip it, we get the correct behaviour (no
1372 certificates are recognized, but the error message is still misleading (it
1373 says no certificate was supplied.) But this is better. */
1374
1375 if ((file == NULL || statbuf.st_size > 0) &&
7be682ca 1376 !SSL_CTX_load_verify_locations(sctx, CS file, CS dir))
7199e1ee 1377 return tls_error(US"SSL_CTX_load_verify_locations", host, NULL);
059ec3d9
PH
1378
1379 if (file != NULL)
1380 {
7be682ca 1381 SSL_CTX_set_client_CA_list(sctx, SSL_load_client_CA_file(CS file));
059ec3d9
PH
1382 }
1383 }
1384
1385 /* Handle a certificate revocation list. */
1386
1387 #if OPENSSL_VERSION_NUMBER > 0x00907000L
1388
8b417f2c
PH
1389 /* This bit of code is now the version supplied by Lars Mainka. (I have
1390 * merely reformatted it into the Exim code style.)
1391
1392 * "From here I changed the code to add support for multiple crl's
1393 * in pem format in one file or to support hashed directory entries in
1394 * pem format instead of a file. This method now uses the library function
1395 * X509_STORE_load_locations to add the CRL location to the SSL context.
1396 * OpenSSL will then handle the verify against CA certs and CRLs by
1397 * itself in the verify callback." */
1398
059ec3d9
PH
1399 if (!expand_check(crl, US"tls_crl", &expcrl)) return DEFER;
1400 if (expcrl != NULL && *expcrl != 0)
1401 {
8b417f2c
PH
1402 struct stat statbufcrl;
1403 if (Ustat(expcrl, &statbufcrl) < 0)
1404 {
1405 log_write(0, LOG_MAIN|LOG_PANIC,
1406 "failed to stat %s for certificates revocation lists", expcrl);
1407 return DEFER;
1408 }
1409 else
059ec3d9 1410 {
8b417f2c
PH
1411 /* is it a file or directory? */
1412 uschar *file, *dir;
7be682ca 1413 X509_STORE *cvstore = SSL_CTX_get_cert_store(sctx);
8b417f2c 1414 if ((statbufcrl.st_mode & S_IFMT) == S_IFDIR)
059ec3d9 1415 {
8b417f2c
PH
1416 file = NULL;
1417 dir = expcrl;
1418 DEBUG(D_tls) debug_printf("SSL CRL value is a directory %s\n", dir);
059ec3d9
PH
1419 }
1420 else
1421 {
8b417f2c
PH
1422 file = expcrl;
1423 dir = NULL;
1424 DEBUG(D_tls) debug_printf("SSL CRL value is a file %s\n", file);
059ec3d9 1425 }
8b417f2c 1426 if (X509_STORE_load_locations(cvstore, CS file, CS dir) == 0)
7199e1ee 1427 return tls_error(US"X509_STORE_load_locations", host, NULL);
8b417f2c
PH
1428
1429 /* setting the flags to check against the complete crl chain */
1430
1431 X509_STORE_set_flags(cvstore,
1432 X509_V_FLAG_CRL_CHECK|X509_V_FLAG_CRL_CHECK_ALL);
059ec3d9 1433 }
059ec3d9
PH
1434 }
1435
1436 #endif /* OPENSSL_VERSION_NUMBER > 0x00907000L */
1437
1438 /* If verification is optional, don't fail if no certificate */
1439
7be682ca 1440 SSL_CTX_set_verify(sctx,
059ec3d9 1441 SSL_VERIFY_PEER | (optional? 0 : SSL_VERIFY_FAIL_IF_NO_PEER_CERT),
983207c1 1442 cert_vfy_cb);
059ec3d9
PH
1443 }
1444
1445return OK;
1446}
1447
1448
1449
1450/*************************************************
1451* Start a TLS session in a server *
1452*************************************************/
1453
1454/* This is called when Exim is running as a server, after having received
1455the STARTTLS command. It must respond to that command, and then negotiate
1456a TLS session.
1457
1458Arguments:
1459 require_ciphers allowed ciphers
1460
1461Returns: OK on success
1462 DEFER for errors before the start of the negotiation
1463 FAIL for errors during the negotation; the server can't
1464 continue running.
1465*/
1466
1467int
17c76198 1468tls_server_start(const uschar *require_ciphers)
059ec3d9
PH
1469{
1470int rc;
1471uschar *expciphers;
7be682ca 1472tls_ext_ctx_cb *cbinfo;
817d9f57 1473static uschar cipherbuf[256];
059ec3d9
PH
1474
1475/* Check for previous activation */
1476
817d9f57 1477if (tls_in.active >= 0)
059ec3d9 1478 {
5ca6d115 1479 tls_error(US"STARTTLS received after TLS started", NULL, US"");
059ec3d9
PH
1480 smtp_printf("554 Already in TLS\r\n");
1481 return FAIL;
1482 }
1483
1484/* Initialize the SSL library. If it fails, it will already have logged
1485the error. */
1486
817d9f57 1487rc = tls_init(&server_ctx, NULL, tls_dhparam, tls_certificate, tls_privatekey,
f2de3a33 1488#ifndef DISABLE_OCSP
3f7eeb86
PP
1489 tls_ocsp_file,
1490#endif
817d9f57 1491 NULL, &server_static_cbinfo);
059ec3d9 1492if (rc != OK) return rc;
817d9f57 1493cbinfo = server_static_cbinfo;
059ec3d9
PH
1494
1495if (!expand_check(require_ciphers, US"tls_require_ciphers", &expciphers))
1496 return FAIL;
1497
1498/* In OpenSSL, cipher components are separated by hyphens. In GnuTLS, they
17c76198
PP
1499were historically separated by underscores. So that I can use either form in my
1500tests, and also for general convenience, we turn underscores into hyphens here.
1501*/
059ec3d9
PH
1502
1503if (expciphers != NULL)
1504 {
1505 uschar *s = expciphers;
1506 while (*s != 0) { if (*s == '_') *s = '-'; s++; }
1507 DEBUG(D_tls) debug_printf("required ciphers: %s\n", expciphers);
817d9f57 1508 if (!SSL_CTX_set_cipher_list(server_ctx, CS expciphers))
7199e1ee 1509 return tls_error(US"SSL_CTX_set_cipher_list", NULL, NULL);
7be682ca 1510 cbinfo->server_cipher_list = expciphers;
059ec3d9
PH
1511 }
1512
1513/* If this is a host for which certificate verification is mandatory or
1514optional, set up appropriately. */
1515
817d9f57 1516tls_in.certificate_verified = FALSE;
53a7196b
JH
1517#ifdef EXPERIMENTAL_DANE
1518tls_in.dane_verified = FALSE;
1519#endif
a2ff477a 1520server_verify_callback_called = FALSE;
059ec3d9
PH
1521
1522if (verify_check_host(&tls_verify_hosts) == OK)
1523 {
983207c1
JH
1524 rc = setup_certs(server_ctx, tls_verify_certificates, tls_crl, NULL,
1525 FALSE, verify_callback_server);
059ec3d9 1526 if (rc != OK) return rc;
a2ff477a 1527 server_verify_optional = FALSE;
059ec3d9
PH
1528 }
1529else if (verify_check_host(&tls_try_verify_hosts) == OK)
1530 {
983207c1
JH
1531 rc = setup_certs(server_ctx, tls_verify_certificates, tls_crl, NULL,
1532 TRUE, verify_callback_server);
059ec3d9 1533 if (rc != OK) return rc;
a2ff477a 1534 server_verify_optional = TRUE;
059ec3d9
PH
1535 }
1536
1537/* Prepare for new connection */
1538
817d9f57 1539if ((server_ssl = SSL_new(server_ctx)) == NULL) return tls_error(US"SSL_new", NULL, NULL);
da3ad30d
PP
1540
1541/* Warning: we used to SSL_clear(ssl) here, it was removed.
1542 *
1543 * With the SSL_clear(), we get strange interoperability bugs with
1544 * OpenSSL 1.0.1b and TLS1.1/1.2. It looks as though this may be a bug in
1545 * OpenSSL itself, as a clear should not lead to inability to follow protocols.
1546 *
1547 * The SSL_clear() call is to let an existing SSL* be reused, typically after
1548 * session shutdown. In this case, we have a brand new object and there's no
1549 * obvious reason to immediately clear it. I'm guessing that this was
1550 * originally added because of incomplete initialisation which the clear fixed,
1551 * in some historic release.
1552 */
059ec3d9
PH
1553
1554/* Set context and tell client to go ahead, except in the case of TLS startup
1555on connection, where outputting anything now upsets the clients and tends to
1556make them disconnect. We need to have an explicit fflush() here, to force out
1557the response. Other smtp_printf() calls do not need it, because in non-TLS
1558mode, the fflush() happens when smtp_getc() is called. */
1559
817d9f57
JH
1560SSL_set_session_id_context(server_ssl, sid_ctx, Ustrlen(sid_ctx));
1561if (!tls_in.on_connect)
059ec3d9
PH
1562 {
1563 smtp_printf("220 TLS go ahead\r\n");
1564 fflush(smtp_out);
1565 }
1566
1567/* Now negotiate the TLS session. We put our own timer on it, since it seems
1568that the OpenSSL library doesn't. */
1569
817d9f57
JH
1570SSL_set_wfd(server_ssl, fileno(smtp_out));
1571SSL_set_rfd(server_ssl, fileno(smtp_in));
1572SSL_set_accept_state(server_ssl);
059ec3d9
PH
1573
1574DEBUG(D_tls) debug_printf("Calling SSL_accept\n");
1575
1576sigalrm_seen = FALSE;
1577if (smtp_receive_timeout > 0) alarm(smtp_receive_timeout);
817d9f57 1578rc = SSL_accept(server_ssl);
059ec3d9
PH
1579alarm(0);
1580
1581if (rc <= 0)
1582 {
7199e1ee 1583 tls_error(US"SSL_accept", NULL, sigalrm_seen ? US"timed out" : NULL);
77bb000f
PP
1584 if (ERR_get_error() == 0)
1585 log_write(0, LOG_MAIN,
a053d125 1586 "TLS client disconnected cleanly (rejected our certificate?)");
059ec3d9
PH
1587 return FAIL;
1588 }
1589
1590DEBUG(D_tls) debug_printf("SSL_accept was successful\n");
1591
1592/* TLS has been set up. Adjust the input functions to read via TLS,
1593and initialize things. */
1594
817d9f57
JH
1595construct_cipher_name(server_ssl, cipherbuf, sizeof(cipherbuf), &tls_in.bits);
1596tls_in.cipher = cipherbuf;
059ec3d9
PH
1597
1598DEBUG(D_tls)
1599 {
1600 uschar buf[2048];
817d9f57 1601 if (SSL_get_shared_ciphers(server_ssl, CS buf, sizeof(buf)) != NULL)
059ec3d9
PH
1602 debug_printf("Shared ciphers: %s\n", buf);
1603 }
1604
9d1c15ef
JH
1605/* Record the certificate we presented */
1606 {
1607 X509 * crt = SSL_get_certificate(server_ssl);
1608 tls_in.ourcert = crt ? X509_dup(crt) : NULL;
1609 }
059ec3d9 1610
817d9f57
JH
1611/* Only used by the server-side tls (tls_in), including tls_getc.
1612 Client-side (tls_out) reads (seem to?) go via
1613 smtp_read_response()/ip_recv().
1614 Hence no need to duplicate for _in and _out.
1615 */
059ec3d9
PH
1616ssl_xfer_buffer = store_malloc(ssl_xfer_buffer_size);
1617ssl_xfer_buffer_lwm = ssl_xfer_buffer_hwm = 0;
1618ssl_xfer_eof = ssl_xfer_error = 0;
1619
1620receive_getc = tls_getc;
1621receive_ungetc = tls_ungetc;
1622receive_feof = tls_feof;
1623receive_ferror = tls_ferror;
58eb016e 1624receive_smtp_buffered = tls_smtp_buffered;
059ec3d9 1625
817d9f57 1626tls_in.active = fileno(smtp_out);
059ec3d9
PH
1627return OK;
1628}
1629
1630
1631
1632
043b1248
JH
1633static int
1634tls_client_basic_ctx_init(SSL_CTX * ctx,
1635 host_item * host, smtp_transport_options_block * ob
1636#ifdef EXPERIMENTAL_CERTNAMES
1637 , tls_ext_ctx_cb * cbinfo
1638#endif
1639 )
1640{
1641int rc;
1642/* stick to the old behaviour for compatibility if tls_verify_certificates is
1643 set but both tls_verify_hosts and tls_try_verify_hosts is not set. Check only
1644 the specified host patterns if one of them is defined */
1645
1646if ((!ob->tls_verify_hosts && !ob->tls_try_verify_hosts) ||
1647 (verify_check_host(&ob->tls_verify_hosts) == OK))
1648 {
1649 if ((rc = setup_certs(ctx, ob->tls_verify_certificates,
1650 ob->tls_crl, host, FALSE, verify_callback_client)) != OK)
1651 return rc;
1652 client_verify_optional = FALSE;
1653
1654#ifdef EXPERIMENTAL_CERTNAMES
1655 if (ob->tls_verify_cert_hostnames)
1656 {
1657 if (!expand_check(ob->tls_verify_cert_hostnames,
1658 US"tls_verify_cert_hostnames",
1659 &cbinfo->verify_cert_hostnames))
1660 return FAIL;
1661 if (cbinfo->verify_cert_hostnames)
1662 DEBUG(D_tls) debug_printf("Cert hostname to check: \"%s\"\n",
1663 cbinfo->verify_cert_hostnames);
1664 }
1665#endif
1666 }
1667else if (verify_check_host(&ob->tls_try_verify_hosts) == OK)
1668 {
1669 if ((rc = setup_certs(ctx, ob->tls_verify_certificates,
1670 ob->tls_crl, host, TRUE, verify_callback_client)) != OK)
1671 return rc;
1672 client_verify_optional = TRUE;
1673 }
1674
1675return OK;
1676}
059ec3d9 1677
fde080a4
JH
1678
1679#ifdef EXPERIMENTAL_DANE
1680static int
1681tlsa_lookup(host_item * host, dns_answer * dnsa,
1682 BOOL dane_required, BOOL * dane)
1683{
1684/* move this out to host.c given the similarity to dns_lookup() ? */
1685uschar buffer[300];
1686uschar * fullname = buffer;
1687
1688/* TLSA lookup string */
1689(void)sprintf(CS buffer, "_%d._tcp.%.256s", host->port, host->name);
1690
1691switch (dns_lookup(dnsa, buffer, T_TLSA, &fullname))
1692 {
1693 case DNS_AGAIN:
1694 return DEFER; /* just defer this TLS'd conn */
1695
1696 default:
1697 case DNS_FAIL:
1698 if (dane_required)
1699 {
1700 log_write(0, LOG_MAIN, "DANE error: TLSA lookup failed");
1701 return FAIL;
1702 }
1703 break;
1704
1705 case DNS_SUCCEED:
1706 if (!dns_is_secure(dnsa))
1707 {
1708 log_write(0, LOG_MAIN, "DANE error: TLSA lookup not DNSSEC");
1709 return DEFER;
1710 }
1711 *dane = TRUE;
1712 break;
1713 }
1714return OK;
1715}
1716
1717
1718static int
1719dane_tlsa_load(SSL * ssl, host_item * host, dns_answer * dnsa)
1720{
1721dns_record * rr;
1722dns_scan dnss;
1723const char * hostnames[2] = { CS host->name, NULL };
1724int found = 0;
1725
1726if (DANESSL_init(ssl, NULL, hostnames) != 1)
1727 return tls_error(US"hostnames load", host, NULL);
1728
1729for (rr = dns_next_rr(dnsa, &dnss, RESET_ANSWERS);
1730 rr;
1731 rr = dns_next_rr(dnsa, &dnss, RESET_NEXT)
1732 ) if (rr->type == T_TLSA)
1733 {
1734 uschar * p = rr->data;
1735 uint8_t usage, selector, mtype;
1736 const char * mdname;
1737
1738 found++;
1739 usage = *p++;
1740 selector = *p++;
1741 mtype = *p++;
1742
1743 switch (mtype)
1744 {
1745 default:
1746 log_write(0, LOG_MAIN,
1747 "DANE error: TLSA record w/bad mtype 0x%x", mtype);
1748 return FAIL;
1749 case 0: mdname = NULL; break;
1750 case 1: mdname = "sha256"; break;
1751 case 2: mdname = "sha512"; break;
1752 }
1753
1754 switch (DANESSL_add_tlsa(ssl, usage, selector, mdname, p, rr->size - 3))
1755 {
1756 default:
1757 case 0: /* action not taken */
1758 return tls_error(US"tlsa load", host, NULL);
1759 case 1: break;
1760 }
594706ea
JH
1761
1762 tls_out.tlsa_usage |= 1<<usage;
fde080a4
JH
1763 }
1764
1765if (found)
1766 return OK;
1767
1768log_write(0, LOG_MAIN, "DANE error: No TLSA records");
1769return FAIL;
1770}
1771#endif /*EXPERIMENTAL_DANE*/
1772
1773
1774
059ec3d9
PH
1775/*************************************************
1776* Start a TLS session in a client *
1777*************************************************/
1778
1779/* Called from the smtp transport after STARTTLS has been accepted.
1780
1781Argument:
1782 fd the fd of the connection
1783 host connected host (for messages)
83da1223 1784 addr the first address
a7538db1 1785 tb transport (always smtp)
059ec3d9
PH
1786
1787Returns: OK on success
1788 FAIL otherwise - note that tls_error() will not give DEFER
1789 because this is not a server
1790*/
1791
1792int
f5d78688 1793tls_client_start(int fd, host_item *host, address_item *addr,
a7538db1 1794 transport_instance *tb)
059ec3d9 1795{
a7538db1
JH
1796smtp_transport_options_block * ob =
1797 (smtp_transport_options_block *)tb->options_block;
059ec3d9 1798static uschar txt[256];
868f5672
JH
1799uschar * expciphers;
1800X509 * server_cert;
059ec3d9 1801int rc;
817d9f57 1802static uschar cipherbuf[256];
043b1248
JH
1803
1804#ifndef DISABLE_OCSP
043b1248 1805BOOL request_ocsp = FALSE;
6634ac8d 1806BOOL require_ocsp = FALSE;
043b1248
JH
1807#endif
1808#ifdef EXPERIMENTAL_DANE
868f5672
JH
1809dns_answer tlsa_dnsa;
1810BOOL dane = FALSE;
1811BOOL dane_required;
043b1248
JH
1812#endif
1813
1814#ifdef EXPERIMENTAL_DANE
fde080a4 1815tls_out.dane_verified = FALSE;
594706ea 1816tls_out.tlsa_usage = 0;
868f5672
JH
1817dane_required = verify_check_this_host(&ob->hosts_require_dane, NULL,
1818 host->name, host->address, NULL) == OK;
868f5672
JH
1819
1820if (host->dnssec == DS_YES)
1821 {
1822 if( dane_required
1823 || verify_check_this_host(&ob->hosts_try_dane, NULL,
1824 host->name, host->address, NULL) == OK
1825 )
fde080a4
JH
1826 if ((rc = tlsa_lookup(host, &tlsa_dnsa, dane_required, &dane)) != OK)
1827 return rc;
868f5672 1828 }
7a31d643 1829else if (dane_required)
868f5672 1830 {
cf2b569e 1831 /*XXX a shame we only find this after making tcp & smtp connection */
b4161d10 1832 /* move the test earlier? */
7a31d643 1833 log_write(0, LOG_MAIN, "DANE error: previous lookup not DNSSEC");
868f5672
JH
1834 return FAIL;
1835 }
043b1248
JH
1836#endif
1837
f2de3a33 1838#ifndef DISABLE_OCSP
043b1248 1839 {
fca41d5a
JH
1840 if ((require_ocsp = verify_check_this_host(&ob->hosts_require_ocsp,
1841 NULL, host->name, host->address, NULL) == OK))
1842 request_ocsp = TRUE;
1843 else
1844 {
1845# ifdef EXPERIMENTAL_DANE
1846 if ( dane
1847 && ob->hosts_request_ocsp[0] == '*'
1848 && ob->hosts_request_ocsp[1] == '\0'
1849 )
1850 {
1851 /* Unchanged from default. Use a safer one under DANE */
1852 request_ocsp = TRUE;
1853 ob->hosts_request_ocsp = US"${if or { {= {0}{$tls_out_tlsa_usage}} "
1854 " {= {4}{$tls_out_tlsa_usage}} } "
1855 " {*}{}}";
1856 }
1857 else
1858# endif
1859 request_ocsp = verify_check_this_host(&ob->hosts_request_ocsp,
1860 NULL, host->name, host->address, NULL) == OK;
1861 }
043b1248 1862 }
f5d78688 1863#endif
059ec3d9 1864
65867078
JH
1865rc = tls_init(&client_ctx, host, NULL,
1866 ob->tls_certificate, ob->tls_privatekey,
f2de3a33 1867#ifndef DISABLE_OCSP
44662487 1868 (void *)(long)request_ocsp,
3f7eeb86 1869#endif
817d9f57 1870 addr, &client_static_cbinfo);
059ec3d9
PH
1871if (rc != OK) return rc;
1872
817d9f57 1873tls_out.certificate_verified = FALSE;
a2ff477a 1874client_verify_callback_called = FALSE;
059ec3d9 1875
65867078
JH
1876if (!expand_check(ob->tls_require_ciphers, US"tls_require_ciphers",
1877 &expciphers))
059ec3d9
PH
1878 return FAIL;
1879
1880/* In OpenSSL, cipher components are separated by hyphens. In GnuTLS, they
1881are separated by underscores. So that I can use either form in my tests, and
1882also for general convenience, we turn underscores into hyphens here. */
1883
1884if (expciphers != NULL)
1885 {
1886 uschar *s = expciphers;
1887 while (*s != 0) { if (*s == '_') *s = '-'; s++; }
1888 DEBUG(D_tls) debug_printf("required ciphers: %s\n", expciphers);
817d9f57 1889 if (!SSL_CTX_set_cipher_list(client_ctx, CS expciphers))
7199e1ee 1890 return tls_error(US"SSL_CTX_set_cipher_list", host, NULL);
059ec3d9
PH
1891 }
1892
043b1248 1893#ifdef EXPERIMENTAL_DANE
868f5672 1894if (dane)
a63be306 1895 {
e5cccda9
JH
1896 SSL_CTX_set_verify(client_ctx, SSL_VERIFY_PEER, verify_callback_client_dane);
1897
043b1248 1898 if (!DANESSL_library_init())
b4161d10 1899 return tls_error(US"library init", host, NULL);
043b1248 1900 if (DANESSL_CTX_init(client_ctx) <= 0)
b4161d10 1901 return tls_error(US"context init", host, NULL);
043b1248
JH
1902 }
1903else
e51c7be2 1904
043b1248
JH
1905#endif
1906
1907 if ((rc = tls_client_basic_ctx_init(client_ctx, host, ob
e51c7be2 1908#ifdef EXPERIMENTAL_CERTNAMES
043b1248 1909 , client_static_cbinfo
e51c7be2 1910#endif
043b1248 1911 )) != OK)
65867078 1912 return rc;
059ec3d9 1913
65867078
JH
1914if ((client_ssl = SSL_new(client_ctx)) == NULL)
1915 return tls_error(US"SSL_new", host, NULL);
817d9f57
JH
1916SSL_set_session_id_context(client_ssl, sid_ctx, Ustrlen(sid_ctx));
1917SSL_set_fd(client_ssl, fd);
1918SSL_set_connect_state(client_ssl);
059ec3d9 1919
65867078 1920if (ob->tls_sni)
3f0945ff 1921 {
65867078 1922 if (!expand_check(ob->tls_sni, US"tls_sni", &tls_out.sni))
3f0945ff 1923 return FAIL;
ec4b68e5 1924 if (tls_out.sni == NULL)
2c9a0e86
PP
1925 {
1926 DEBUG(D_tls) debug_printf("Setting TLS SNI forced to fail, not sending\n");
1927 }
ec4b68e5 1928 else if (!Ustrlen(tls_out.sni))
817d9f57 1929 tls_out.sni = NULL;
3f0945ff
PP
1930 else
1931 {
35731706 1932#ifdef EXIM_HAVE_OPENSSL_TLSEXT
817d9f57
JH
1933 DEBUG(D_tls) debug_printf("Setting TLS SNI \"%s\"\n", tls_out.sni);
1934 SSL_set_tlsext_host_name(client_ssl, tls_out.sni);
35731706
PP
1935#else
1936 DEBUG(D_tls)
1937 debug_printf("OpenSSL at build-time lacked SNI support, ignoring \"%s\"\n",
02d9264f 1938 tls_out.sni);
35731706 1939#endif
3f0945ff
PP
1940 }
1941 }
1942
594706ea
JH
1943#ifdef EXPERIMENTAL_DANE
1944if (dane)
1945 if ((rc = dane_tlsa_load(client_ssl, host, &tlsa_dnsa)) != OK)
1946 return rc;
1947#endif
1948
f2de3a33 1949#ifndef DISABLE_OCSP
f5d78688
JH
1950/* Request certificate status at connection-time. If the server
1951does OCSP stapling we will get the callback (set in tls_init()) */
b50c8b84 1952# ifdef EXPERIMENTAL_DANE
44662487
JH
1953if (request_ocsp)
1954 {
594706ea
JH
1955 const uschar * s;
1956 if ( (s = ob->hosts_require_ocsp) && Ustrstr(s, US"tls_out_tlsa_usage")
1957 || (s = ob->hosts_request_ocsp) && Ustrstr(s, US"tls_out_tlsa_usage")
1958 )
1959 { /* Re-eval now $tls_out_tlsa_usage is populated. If
1960 this means we avoid the OCSP request, we wasted the setup
1961 cost in tls_init(). */
1962 require_ocsp = verify_check_this_host(&ob->hosts_require_ocsp,
1963 NULL, host->name, host->address, NULL) == OK;
1964 request_ocsp = require_ocsp ? TRUE
1965 : verify_check_this_host(&ob->hosts_request_ocsp,
1966 NULL, host->name, host->address, NULL) == OK;
1967 }
1968 }
b50c8b84
JH
1969# endif
1970
594706ea
JH
1971if (request_ocsp)
1972 {
f5d78688 1973 SSL_set_tlsext_status_type(client_ssl, TLSEXT_STATUSTYPE_ocsp);
44662487
JH
1974 client_static_cbinfo->u_ocsp.client.verify_required = require_ocsp;
1975 tls_out.ocsp = OCSP_NOT_RESP;
1976 }
f5d78688
JH
1977#endif
1978
a7538db1
JH
1979#ifdef EXPERIMENTAL_TPDA
1980client_static_cbinfo->event_action = tb->tpda_event_action;
1981#endif
043b1248 1982
83b27293
JH
1983#ifdef EXPERIMENTAL_TPDA
1984client_static_cbinfo->event_action = tb->tpda_event_action;
1985#endif
1986
059ec3d9
PH
1987/* There doesn't seem to be a built-in timeout on connection. */
1988
1989DEBUG(D_tls) debug_printf("Calling SSL_connect\n");
1990sigalrm_seen = FALSE;
65867078 1991alarm(ob->command_timeout);
817d9f57 1992rc = SSL_connect(client_ssl);
059ec3d9
PH
1993alarm(0);
1994
043b1248 1995#ifdef EXPERIMENTAL_DANE
12ee8cf9 1996if (dane)
fde080a4 1997 DANESSL_cleanup(client_ssl);
043b1248
JH
1998#endif
1999
059ec3d9 2000if (rc <= 0)
7199e1ee 2001 return tls_error(US"SSL_connect", host, sigalrm_seen ? US"timed out" : NULL);
059ec3d9
PH
2002
2003DEBUG(D_tls) debug_printf("SSL_connect succeeded\n");
2004
453a6645 2005/* Beware anonymous ciphers which lead to server_cert being NULL */
9d1c15ef 2006/*XXX server_cert is never freed... use X509_free() */
817d9f57 2007server_cert = SSL_get_peer_certificate (client_ssl);
453a6645
PP
2008if (server_cert)
2009 {
817d9f57 2010 tls_out.peerdn = US X509_NAME_oneline(X509_get_subject_name(server_cert),
453a6645 2011 CS txt, sizeof(txt));
9d1c15ef 2012 tls_out.peerdn = txt; /*XXX a static buffer... */
453a6645
PP
2013 }
2014else
817d9f57 2015 tls_out.peerdn = NULL;
059ec3d9 2016
817d9f57
JH
2017construct_cipher_name(client_ssl, cipherbuf, sizeof(cipherbuf), &tls_out.bits);
2018tls_out.cipher = cipherbuf;
059ec3d9 2019
9d1c15ef
JH
2020/* Record the certificate we presented */
2021 {
2022 X509 * crt = SSL_get_certificate(client_ssl);
2023 tls_out.ourcert = crt ? X509_dup(crt) : NULL;
2024 }
2025
817d9f57 2026tls_out.active = fd;
059ec3d9
PH
2027return OK;
2028}
2029
2030
2031
2032
2033
2034/*************************************************
2035* TLS version of getc *
2036*************************************************/
2037
2038/* This gets the next byte from the TLS input buffer. If the buffer is empty,
2039it refills the buffer via the SSL reading function.
2040
2041Arguments: none
2042Returns: the next character or EOF
817d9f57
JH
2043
2044Only used by the server-side TLS.
059ec3d9
PH
2045*/
2046
2047int
2048tls_getc(void)
2049{
2050if (ssl_xfer_buffer_lwm >= ssl_xfer_buffer_hwm)
2051 {
2052 int error;
2053 int inbytes;
2054
817d9f57 2055 DEBUG(D_tls) debug_printf("Calling SSL_read(%p, %p, %u)\n", server_ssl,
c80c5570 2056 ssl_xfer_buffer, ssl_xfer_buffer_size);
059ec3d9
PH
2057
2058 if (smtp_receive_timeout > 0) alarm(smtp_receive_timeout);
817d9f57
JH
2059 inbytes = SSL_read(server_ssl, CS ssl_xfer_buffer, ssl_xfer_buffer_size);
2060 error = SSL_get_error(server_ssl, inbytes);
059ec3d9
PH
2061 alarm(0);
2062
2063 /* SSL_ERROR_ZERO_RETURN appears to mean that the SSL session has been
2064 closed down, not that the socket itself has been closed down. Revert to
2065 non-SSL handling. */
2066
2067 if (error == SSL_ERROR_ZERO_RETURN)
2068 {
2069 DEBUG(D_tls) debug_printf("Got SSL_ERROR_ZERO_RETURN\n");
2070
2071 receive_getc = smtp_getc;
2072 receive_ungetc = smtp_ungetc;
2073 receive_feof = smtp_feof;
2074 receive_ferror = smtp_ferror;
58eb016e 2075 receive_smtp_buffered = smtp_buffered;
059ec3d9 2076
817d9f57
JH
2077 SSL_free(server_ssl);
2078 server_ssl = NULL;
2079 tls_in.active = -1;
2080 tls_in.bits = 0;
2081 tls_in.cipher = NULL;
2082 tls_in.peerdn = NULL;
2083 tls_in.sni = NULL;
059ec3d9
PH
2084
2085 return smtp_getc();
2086 }
2087
2088 /* Handle genuine errors */
2089
ba084640
PP
2090 else if (error == SSL_ERROR_SSL)
2091 {
2092 ERR_error_string(ERR_get_error(), ssl_errstring);
89dd51cd 2093 log_write(0, LOG_MAIN, "TLS error (SSL_read): %s", ssl_errstring);
ba084640
PP
2094 ssl_xfer_error = 1;
2095 return EOF;
2096 }
2097
059ec3d9
PH
2098 else if (error != SSL_ERROR_NONE)
2099 {
2100 DEBUG(D_tls) debug_printf("Got SSL error %d\n", error);
2101 ssl_xfer_error = 1;
2102 return EOF;
2103 }
c80c5570 2104
80a47a2c
TK
2105#ifndef DISABLE_DKIM
2106 dkim_exim_verify_feed(ssl_xfer_buffer, inbytes);
2107#endif
059ec3d9
PH
2108 ssl_xfer_buffer_hwm = inbytes;
2109 ssl_xfer_buffer_lwm = 0;
2110 }
2111
2112/* Something in the buffer; return next uschar */
2113
2114return ssl_xfer_buffer[ssl_xfer_buffer_lwm++];
2115}
2116
2117
2118
2119/*************************************************
2120* Read bytes from TLS channel *
2121*************************************************/
2122
2123/*
2124Arguments:
2125 buff buffer of data
2126 len size of buffer
2127
2128Returns: the number of bytes read
2129 -1 after a failed read
817d9f57
JH
2130
2131Only used by the client-side TLS.
059ec3d9
PH
2132*/
2133
2134int
389ca47a 2135tls_read(BOOL is_server, uschar *buff, size_t len)
059ec3d9 2136{
389ca47a 2137SSL *ssl = is_server ? server_ssl : client_ssl;
059ec3d9
PH
2138int inbytes;
2139int error;
2140
389ca47a 2141DEBUG(D_tls) debug_printf("Calling SSL_read(%p, %p, %u)\n", ssl,
c80c5570 2142 buff, (unsigned int)len);
059ec3d9 2143
389ca47a
JH
2144inbytes = SSL_read(ssl, CS buff, len);
2145error = SSL_get_error(ssl, inbytes);
059ec3d9
PH
2146
2147if (error == SSL_ERROR_ZERO_RETURN)
2148 {
2149 DEBUG(D_tls) debug_printf("Got SSL_ERROR_ZERO_RETURN\n");
2150 return -1;
2151 }
2152else if (error != SSL_ERROR_NONE)
2153 {
2154 return -1;
2155 }
2156
2157return inbytes;
2158}
2159
2160
2161
2162
2163
2164/*************************************************
2165* Write bytes down TLS channel *
2166*************************************************/
2167
2168/*
2169Arguments:
817d9f57 2170 is_server channel specifier
059ec3d9
PH
2171 buff buffer of data
2172 len number of bytes
2173
2174Returns: the number of bytes after a successful write,
2175 -1 after a failed write
817d9f57
JH
2176
2177Used by both server-side and client-side TLS.
059ec3d9
PH
2178*/
2179
2180int
817d9f57 2181tls_write(BOOL is_server, const uschar *buff, size_t len)
059ec3d9
PH
2182{
2183int outbytes;
2184int error;
2185int left = len;
817d9f57 2186SSL *ssl = is_server ? server_ssl : client_ssl;
059ec3d9 2187
c80c5570 2188DEBUG(D_tls) debug_printf("tls_do_write(%p, %d)\n", buff, left);
059ec3d9
PH
2189while (left > 0)
2190 {
c80c5570 2191 DEBUG(D_tls) debug_printf("SSL_write(SSL, %p, %d)\n", buff, left);
059ec3d9
PH
2192 outbytes = SSL_write(ssl, CS buff, left);
2193 error = SSL_get_error(ssl, outbytes);
2194 DEBUG(D_tls) debug_printf("outbytes=%d error=%d\n", outbytes, error);
2195 switch (error)
2196 {
2197 case SSL_ERROR_SSL:
2198 ERR_error_string(ERR_get_error(), ssl_errstring);
2199 log_write(0, LOG_MAIN, "TLS error (SSL_write): %s", ssl_errstring);
2200 return -1;
2201
2202 case SSL_ERROR_NONE:
2203 left -= outbytes;
2204 buff += outbytes;
2205 break;
2206
2207 case SSL_ERROR_ZERO_RETURN:
2208 log_write(0, LOG_MAIN, "SSL channel closed on write");
2209 return -1;
2210
817d9f57
JH
2211 case SSL_ERROR_SYSCALL:
2212 log_write(0, LOG_MAIN, "SSL_write: (from %s) syscall: %s",
2213 sender_fullhost ? sender_fullhost : US"<unknown>",
2214 strerror(errno));
2215
059ec3d9
PH
2216 default:
2217 log_write(0, LOG_MAIN, "SSL_write error %d", error);
2218 return -1;
2219 }
2220 }
2221return len;
2222}
2223
2224
2225
2226/*************************************************
2227* Close down a TLS session *
2228*************************************************/
2229
2230/* This is also called from within a delivery subprocess forked from the
2231daemon, to shut down the TLS library, without actually doing a shutdown (which
2232would tamper with the SSL session in the parent process).
2233
2234Arguments: TRUE if SSL_shutdown is to be called
2235Returns: nothing
817d9f57
JH
2236
2237Used by both server-side and client-side TLS.
059ec3d9
PH
2238*/
2239
2240void
817d9f57 2241tls_close(BOOL is_server, BOOL shutdown)
059ec3d9 2242{
817d9f57 2243SSL **sslp = is_server ? &server_ssl : &client_ssl;
389ca47a 2244int *fdp = is_server ? &tls_in.active : &tls_out.active;
817d9f57
JH
2245
2246if (*fdp < 0) return; /* TLS was not active */
059ec3d9
PH
2247
2248if (shutdown)
2249 {
2250 DEBUG(D_tls) debug_printf("tls_close(): shutting down SSL\n");
817d9f57 2251 SSL_shutdown(*sslp);
059ec3d9
PH
2252 }
2253
817d9f57
JH
2254SSL_free(*sslp);
2255*sslp = NULL;
059ec3d9 2256
817d9f57 2257*fdp = -1;
059ec3d9
PH
2258}
2259
36f12725
NM
2260
2261
2262
2263/*************************************************
3375e053
PP
2264* Let tls_require_ciphers be checked at startup *
2265*************************************************/
2266
2267/* The tls_require_ciphers option, if set, must be something which the
2268library can parse.
2269
2270Returns: NULL on success, or error message
2271*/
2272
2273uschar *
2274tls_validate_require_cipher(void)
2275{
2276SSL_CTX *ctx;
2277uschar *s, *expciphers, *err;
2278
2279/* this duplicates from tls_init(), we need a better "init just global
2280state, for no specific purpose" singleton function of our own */
2281
2282SSL_load_error_strings();
2283OpenSSL_add_ssl_algorithms();
2284#if (OPENSSL_VERSION_NUMBER >= 0x0090800fL) && !defined(OPENSSL_NO_SHA256)
2285/* SHA256 is becoming ever more popular. This makes sure it gets added to the
2286list of available digests. */
2287EVP_add_digest(EVP_sha256());
2288#endif
2289
2290if (!(tls_require_ciphers && *tls_require_ciphers))
2291 return NULL;
2292
2293if (!expand_check(tls_require_ciphers, US"tls_require_ciphers", &expciphers))
2294 return US"failed to expand tls_require_ciphers";
2295
2296if (!(expciphers && *expciphers))
2297 return NULL;
2298
2299/* normalisation ripped from above */
2300s = expciphers;
2301while (*s != 0) { if (*s == '_') *s = '-'; s++; }
2302
2303err = NULL;
2304
2305ctx = SSL_CTX_new(SSLv23_server_method());
2306if (!ctx)
2307 {
2308 ERR_error_string(ERR_get_error(), ssl_errstring);
2309 return string_sprintf("SSL_CTX_new() failed: %s", ssl_errstring);
2310 }
2311
2312DEBUG(D_tls)
2313 debug_printf("tls_require_ciphers expands to \"%s\"\n", expciphers);
2314
2315if (!SSL_CTX_set_cipher_list(ctx, CS expciphers))
2316 {
2317 ERR_error_string(ERR_get_error(), ssl_errstring);
2318 err = string_sprintf("SSL_CTX_set_cipher_list(%s) failed", expciphers);
2319 }
2320
2321SSL_CTX_free(ctx);
2322
2323return err;
2324}
2325
2326
2327
2328
2329/*************************************************
36f12725
NM
2330* Report the library versions. *
2331*************************************************/
2332
2333/* There have historically been some issues with binary compatibility in
2334OpenSSL libraries; if Exim (like many other applications) is built against
2335one version of OpenSSL but the run-time linker picks up another version,
2336it can result in serious failures, including crashing with a SIGSEGV. So
2337report the version found by the compiler and the run-time version.
2338
f64a1e23
PP
2339Note: some OS vendors backport security fixes without changing the version
2340number/string, and the version date remains unchanged. The _build_ date
2341will change, so we can more usefully assist with version diagnosis by also
2342reporting the build date.
2343
36f12725
NM
2344Arguments: a FILE* to print the results to
2345Returns: nothing
2346*/
2347
2348void
2349tls_version_report(FILE *f)
2350{
754a0503 2351fprintf(f, "Library version: OpenSSL: Compile: %s\n"
f64a1e23
PP
2352 " Runtime: %s\n"
2353 " : %s\n",
754a0503 2354 OPENSSL_VERSION_TEXT,
f64a1e23
PP
2355 SSLeay_version(SSLEAY_VERSION),
2356 SSLeay_version(SSLEAY_BUILT_ON));
2357/* third line is 38 characters for the %s and the line is 73 chars long;
2358the OpenSSL output includes a "built on: " prefix already. */
36f12725
NM
2359}
2360
9e3331ea
TK
2361
2362
2363
2364/*************************************************
17c76198 2365* Random number generation *
9e3331ea
TK
2366*************************************************/
2367
2368/* Pseudo-random number generation. The result is not expected to be
2369cryptographically strong but not so weak that someone will shoot themselves
2370in the foot using it as a nonce in input in some email header scheme or
2371whatever weirdness they'll twist this into. The result should handle fork()
2372and avoid repeating sequences. OpenSSL handles that for us.
2373
2374Arguments:
2375 max range maximum
2376Returns a random number in range [0, max-1]
2377*/
2378
2379int
17c76198 2380vaguely_random_number(int max)
9e3331ea
TK
2381{
2382unsigned int r;
2383int i, needed_len;
de6135a0
PP
2384static pid_t pidlast = 0;
2385pid_t pidnow;
9e3331ea
TK
2386uschar *p;
2387uschar smallbuf[sizeof(r)];
2388
2389if (max <= 1)
2390 return 0;
2391
de6135a0
PP
2392pidnow = getpid();
2393if (pidnow != pidlast)
2394 {
2395 /* Although OpenSSL documents that "OpenSSL makes sure that the PRNG state
2396 is unique for each thread", this doesn't apparently apply across processes,
2397 so our own warning from vaguely_random_number_fallback() applies here too.
2398 Fix per PostgreSQL. */
2399 if (pidlast != 0)
2400 RAND_cleanup();
2401 pidlast = pidnow;
2402 }
2403
9e3331ea
TK
2404/* OpenSSL auto-seeds from /dev/random, etc, but this a double-check. */
2405if (!RAND_status())
2406 {
2407 randstuff r;
2408 gettimeofday(&r.tv, NULL);
2409 r.p = getpid();
2410
2411 RAND_seed((uschar *)(&r), sizeof(r));
2412 }
2413/* We're after pseudo-random, not random; if we still don't have enough data
2414in the internal PRNG then our options are limited. We could sleep and hope
2415for entropy to come along (prayer technique) but if the system is so depleted
2416in the first place then something is likely to just keep taking it. Instead,
2417we'll just take whatever little bit of pseudo-random we can still manage to
2418get. */
2419
2420needed_len = sizeof(r);
2421/* Don't take 8 times more entropy than needed if int is 8 octets and we were
2422asked for a number less than 10. */
2423for (r = max, i = 0; r; ++i)
2424 r >>= 1;
2425i = (i + 7) / 8;
2426if (i < needed_len)
2427 needed_len = i;
2428
2429/* We do not care if crypto-strong */
17c76198
PP
2430i = RAND_pseudo_bytes(smallbuf, needed_len);
2431if (i < 0)
2432 {
2433 DEBUG(D_all)
2434 debug_printf("OpenSSL RAND_pseudo_bytes() not supported by RAND method, using fallback.\n");
2435 return vaguely_random_number_fallback(max);
2436 }
2437
9e3331ea
TK
2438r = 0;
2439for (p = smallbuf; needed_len; --needed_len, ++p)
2440 {
2441 r *= 256;
2442 r += *p;
2443 }
2444
2445/* We don't particularly care about weighted results; if someone wants
2446smooth distribution and cares enough then they should submit a patch then. */
2447return r % max;
2448}
2449
77bb000f
PP
2450
2451
2452
2453/*************************************************
2454* OpenSSL option parse *
2455*************************************************/
2456
2457/* Parse one option for tls_openssl_options_parse below
2458
2459Arguments:
2460 name one option name
2461 value place to store a value for it
2462Returns success or failure in parsing
2463*/
2464
2465struct exim_openssl_option {
2466 uschar *name;
2467 long value;
2468};
2469/* We could use a macro to expand, but we need the ifdef and not all the
2470options document which version they were introduced in. Policylet: include
2471all options unless explicitly for DTLS, let the administrator choose which
2472to apply.
2473
2474This list is current as of:
e2fbf4a2
PP
2475 ==> 1.0.1b <==
2476Plus SSL_OP_SAFARI_ECDHE_ECDSA_BUG from 2013-June patch/discussion on openssl-dev
2477*/
77bb000f
PP
2478static struct exim_openssl_option exim_openssl_options[] = {
2479/* KEEP SORTED ALPHABETICALLY! */
2480#ifdef SSL_OP_ALL
73a46702 2481 { US"all", SSL_OP_ALL },
77bb000f
PP
2482#endif
2483#ifdef SSL_OP_ALLOW_UNSAFE_LEGACY_RENEGOTIATION
73a46702 2484 { US"allow_unsafe_legacy_renegotiation", SSL_OP_ALLOW_UNSAFE_LEGACY_RENEGOTIATION },
77bb000f
PP
2485#endif
2486#ifdef SSL_OP_CIPHER_SERVER_PREFERENCE
73a46702 2487 { US"cipher_server_preference", SSL_OP_CIPHER_SERVER_PREFERENCE },
77bb000f
PP
2488#endif
2489#ifdef SSL_OP_DONT_INSERT_EMPTY_FRAGMENTS
73a46702 2490 { US"dont_insert_empty_fragments", SSL_OP_DONT_INSERT_EMPTY_FRAGMENTS },
77bb000f
PP
2491#endif
2492#ifdef SSL_OP_EPHEMERAL_RSA
73a46702 2493 { US"ephemeral_rsa", SSL_OP_EPHEMERAL_RSA },
77bb000f
PP
2494#endif
2495#ifdef SSL_OP_LEGACY_SERVER_CONNECT
73a46702 2496 { US"legacy_server_connect", SSL_OP_LEGACY_SERVER_CONNECT },
77bb000f
PP
2497#endif
2498#ifdef SSL_OP_MICROSOFT_BIG_SSLV3_BUFFER
73a46702 2499 { US"microsoft_big_sslv3_buffer", SSL_OP_MICROSOFT_BIG_SSLV3_BUFFER },
77bb000f
PP
2500#endif
2501#ifdef SSL_OP_MICROSOFT_SESS_ID_BUG
73a46702 2502 { US"microsoft_sess_id_bug", SSL_OP_MICROSOFT_SESS_ID_BUG },
77bb000f
PP
2503#endif
2504#ifdef SSL_OP_MSIE_SSLV2_RSA_PADDING
73a46702 2505 { US"msie_sslv2_rsa_padding", SSL_OP_MSIE_SSLV2_RSA_PADDING },
77bb000f
PP
2506#endif
2507#ifdef SSL_OP_NETSCAPE_CHALLENGE_BUG
73a46702 2508 { US"netscape_challenge_bug", SSL_OP_NETSCAPE_CHALLENGE_BUG },
77bb000f
PP
2509#endif
2510#ifdef SSL_OP_NETSCAPE_REUSE_CIPHER_CHANGE_BUG
73a46702 2511 { US"netscape_reuse_cipher_change_bug", SSL_OP_NETSCAPE_REUSE_CIPHER_CHANGE_BUG },
77bb000f 2512#endif
c80c5570
PP
2513#ifdef SSL_OP_NO_COMPRESSION
2514 { US"no_compression", SSL_OP_NO_COMPRESSION },
2515#endif
77bb000f 2516#ifdef SSL_OP_NO_SESSION_RESUMPTION_ON_RENEGOTIATION
73a46702 2517 { US"no_session_resumption_on_renegotiation", SSL_OP_NO_SESSION_RESUMPTION_ON_RENEGOTIATION },
77bb000f 2518#endif
c0c7b2da
PP
2519#ifdef SSL_OP_NO_SSLv2
2520 { US"no_sslv2", SSL_OP_NO_SSLv2 },
2521#endif
2522#ifdef SSL_OP_NO_SSLv3
2523 { US"no_sslv3", SSL_OP_NO_SSLv3 },
2524#endif
2525#ifdef SSL_OP_NO_TICKET
2526 { US"no_ticket", SSL_OP_NO_TICKET },
2527#endif
2528#ifdef SSL_OP_NO_TLSv1
2529 { US"no_tlsv1", SSL_OP_NO_TLSv1 },
2530#endif
c80c5570
PP
2531#ifdef SSL_OP_NO_TLSv1_1
2532#if SSL_OP_NO_TLSv1_1 == 0x00000400L
2533 /* Error in chosen value in 1.0.1a; see first item in CHANGES for 1.0.1b */
2534#warning OpenSSL 1.0.1a uses a bad value for SSL_OP_NO_TLSv1_1, ignoring
2535#else
2536 { US"no_tlsv1_1", SSL_OP_NO_TLSv1_1 },
2537#endif
2538#endif
2539#ifdef SSL_OP_NO_TLSv1_2
2540 { US"no_tlsv1_2", SSL_OP_NO_TLSv1_2 },
2541#endif
e2fbf4a2
PP
2542#ifdef SSL_OP_SAFARI_ECDHE_ECDSA_BUG
2543 { US"safari_ecdhe_ecdsa_bug", SSL_OP_SAFARI_ECDHE_ECDSA_BUG },
2544#endif
77bb000f 2545#ifdef SSL_OP_SINGLE_DH_USE
73a46702 2546 { US"single_dh_use", SSL_OP_SINGLE_DH_USE },
77bb000f
PP
2547#endif
2548#ifdef SSL_OP_SINGLE_ECDH_USE
73a46702 2549 { US"single_ecdh_use", SSL_OP_SINGLE_ECDH_USE },
77bb000f
PP
2550#endif
2551#ifdef SSL_OP_SSLEAY_080_CLIENT_DH_BUG
73a46702 2552 { US"ssleay_080_client_dh_bug", SSL_OP_SSLEAY_080_CLIENT_DH_BUG },
77bb000f
PP
2553#endif
2554#ifdef SSL_OP_SSLREF2_REUSE_CERT_TYPE_BUG
73a46702 2555 { US"sslref2_reuse_cert_type_bug", SSL_OP_SSLREF2_REUSE_CERT_TYPE_BUG },
77bb000f
PP
2556#endif
2557#ifdef SSL_OP_TLS_BLOCK_PADDING_BUG
73a46702 2558 { US"tls_block_padding_bug", SSL_OP_TLS_BLOCK_PADDING_BUG },
77bb000f
PP
2559#endif
2560#ifdef SSL_OP_TLS_D5_BUG
73a46702 2561 { US"tls_d5_bug", SSL_OP_TLS_D5_BUG },
77bb000f
PP
2562#endif
2563#ifdef SSL_OP_TLS_ROLLBACK_BUG
73a46702 2564 { US"tls_rollback_bug", SSL_OP_TLS_ROLLBACK_BUG },
77bb000f
PP
2565#endif
2566};
2567static int exim_openssl_options_size =
2568 sizeof(exim_openssl_options)/sizeof(struct exim_openssl_option);
2569
c80c5570 2570
77bb000f
PP
2571static BOOL
2572tls_openssl_one_option_parse(uschar *name, long *value)
2573{
2574int first = 0;
2575int last = exim_openssl_options_size;
2576while (last > first)
2577 {
2578 int middle = (first + last)/2;
2579 int c = Ustrcmp(name, exim_openssl_options[middle].name);
2580 if (c == 0)
2581 {
2582 *value = exim_openssl_options[middle].value;
2583 return TRUE;
2584 }
2585 else if (c > 0)
2586 first = middle + 1;
2587 else
2588 last = middle;
2589 }
2590return FALSE;
2591}
2592
2593
2594
2595
2596/*************************************************
2597* OpenSSL option parsing logic *
2598*************************************************/
2599
2600/* OpenSSL has a number of compatibility options which an administrator might
2601reasonably wish to set. Interpret a list similarly to decode_bits(), so that
2602we look like log_selector.
2603
2604Arguments:
2605 option_spec the administrator-supplied string of options
2606 results ptr to long storage for the options bitmap
2607Returns success or failure
2608*/
2609
2610BOOL
2611tls_openssl_options_parse(uschar *option_spec, long *results)
2612{
2613long result, item;
2614uschar *s, *end;
2615uschar keep_c;
2616BOOL adding, item_parsed;
2617
0e944a0d 2618result = 0L;
b1770b6e 2619/* Prior to 4.80 we or'd in SSL_OP_DONT_INSERT_EMPTY_FRAGMENTS; removed
da3ad30d 2620 * from default because it increases BEAST susceptibility. */
f0f5a555
PP
2621#ifdef SSL_OP_NO_SSLv2
2622result |= SSL_OP_NO_SSLv2;
2623#endif
77bb000f
PP
2624
2625if (option_spec == NULL)
2626 {
2627 *results = result;
2628 return TRUE;
2629 }
2630
2631for (s=option_spec; *s != '\0'; /**/)
2632 {
2633 while (isspace(*s)) ++s;
2634 if (*s == '\0')
2635 break;
2636 if (*s != '+' && *s != '-')
2637 {
2638 DEBUG(D_tls) debug_printf("malformed openssl option setting: "
0e944a0d 2639 "+ or - expected but found \"%s\"\n", s);
77bb000f
PP
2640 return FALSE;
2641 }
2642 adding = *s++ == '+';
2643 for (end = s; (*end != '\0') && !isspace(*end); ++end) /**/ ;
2644 keep_c = *end;
2645 *end = '\0';
2646 item_parsed = tls_openssl_one_option_parse(s, &item);
2647 if (!item_parsed)
2648 {
0e944a0d 2649 DEBUG(D_tls) debug_printf("openssl option setting unrecognised: \"%s\"\n", s);
77bb000f
PP
2650 return FALSE;
2651 }
2652 DEBUG(D_tls) debug_printf("openssl option, %s from %lx: %lx (%s)\n",
2653 adding ? "adding" : "removing", result, item, s);
2654 if (adding)
2655 result |= item;
2656 else
2657 result &= ~item;
2658 *end = keep_c;
2659 s = end;
2660 }
2661
2662*results = result;
2663return TRUE;
2664}
2665
9d1c15ef
JH
2666/* vi: aw ai sw=2
2667*/
059ec3d9 2668/* End of tls-openssl.c */