Compiler quietening
[exim.git] / src / src / tls-openssl.c
CommitLineData
059ec3d9
PH
1/*************************************************
2* Exim - an Internet mail transport agent *
3*************************************************/
4
5a66c31b 5/* Copyright (c) University of Cambridge 1995 - 2014 */
059ec3d9
PH
6/* See the file NOTICE for conditions of use and distribution. */
7
f5d78688
JH
8/* Portions Copyright (c) The OpenSSL Project 1999 */
9
059ec3d9
PH
10/* This module provides the TLS (aka SSL) support for Exim using the OpenSSL
11library. It is #included into the tls.c file when that library is used. The
12code herein is based on a patch that was originally contributed by Steve
13Haslam. It was adapted from stunnel, a GPL program by Michal Trojnara.
14
15No cryptographic code is included in Exim. All this module does is to call
16functions from the OpenSSL library. */
17
18
19/* Heading stuff */
20
21#include <openssl/lhash.h>
22#include <openssl/ssl.h>
23#include <openssl/err.h>
24#include <openssl/rand.h>
f2de3a33 25#ifndef DISABLE_OCSP
e51c7be2 26# include <openssl/ocsp.h>
3f7eeb86 27#endif
85098ee7
JH
28#ifdef EXPERIMENTAL_DANE
29# include <danessl.h>
30#endif
31
3f7eeb86 32
f2de3a33
JH
33#ifndef DISABLE_OCSP
34# define EXIM_OCSP_SKEW_SECONDS (300L)
35# define EXIM_OCSP_MAX_AGE (-1L)
3f7eeb86 36#endif
059ec3d9 37
3bcbbbe2 38#if OPENSSL_VERSION_NUMBER >= 0x0090806fL && !defined(OPENSSL_NO_TLSEXT)
e51c7be2 39# define EXIM_HAVE_OPENSSL_TLSEXT
3bcbbbe2
PP
40#endif
41
67791ce4
JH
42#if !defined(EXIM_HAVE_OPENSSL_TLSEXT) && !defined(DISABLE_OCSP)
43# warning "OpenSSL library version too old; define DISABLE_OCSP in Makefile"
44# define DISABLE_OCSP
45#endif
46
059ec3d9
PH
47/* Structure for collecting random data for seeding. */
48
49typedef struct randstuff {
9e3331ea
TK
50 struct timeval tv;
51 pid_t p;
059ec3d9
PH
52} randstuff;
53
54/* Local static variables */
55
a2ff477a
JH
56static BOOL client_verify_callback_called = FALSE;
57static BOOL server_verify_callback_called = FALSE;
059ec3d9
PH
58static const uschar *sid_ctx = US"exim";
59
d4f09789
PP
60/* We have three different contexts to care about.
61
62Simple case: client, `client_ctx`
63 As a client, we can be doing a callout or cut-through delivery while receiving
64 a message. So we have a client context, which should have options initialised
65 from the SMTP Transport.
66
67Server:
68 There are two cases: with and without ServerNameIndication from the client.
69 Given TLS SNI, we can be using different keys, certs and various other
70 configuration settings, because they're re-expanded with $tls_sni set. This
71 allows vhosting with TLS. This SNI is sent in the handshake.
72 A client might not send SNI, so we need a fallback, and an initial setup too.
73 So as a server, we start out using `server_ctx`.
74 If SNI is sent by the client, then we as server, mid-negotiation, try to clone
75 `server_sni` from `server_ctx` and then initialise settings by re-expanding
76 configuration.
77*/
78
817d9f57
JH
79static SSL_CTX *client_ctx = NULL;
80static SSL_CTX *server_ctx = NULL;
81static SSL *client_ssl = NULL;
82static SSL *server_ssl = NULL;
389ca47a 83
35731706 84#ifdef EXIM_HAVE_OPENSSL_TLSEXT
817d9f57 85static SSL_CTX *server_sni = NULL;
35731706 86#endif
059ec3d9
PH
87
88static char ssl_errstring[256];
89
90static int ssl_session_timeout = 200;
a2ff477a
JH
91static BOOL client_verify_optional = FALSE;
92static BOOL server_verify_optional = FALSE;
059ec3d9 93
f5d78688 94static BOOL reexpand_tls_files_for_sni = FALSE;
059ec3d9
PH
95
96
7be682ca
PP
97typedef struct tls_ext_ctx_cb {
98 uschar *certificate;
99 uschar *privatekey;
f2de3a33 100#ifndef DISABLE_OCSP
f5d78688
JH
101 BOOL is_server;
102 union {
103 struct {
104 uschar *file;
105 uschar *file_expanded;
106 OCSP_RESPONSE *response;
107 } server;
108 struct {
44662487
JH
109 X509_STORE *verify_store; /* non-null if status requested */
110 BOOL verify_required;
f5d78688
JH
111 } client;
112 } u_ocsp;
3f7eeb86 113#endif
7be682ca
PP
114 uschar *dhparam;
115 /* these are cached from first expand */
116 uschar *server_cipher_list;
117 /* only passed down to tls_error: */
118 host_item *host;
e51c7be2
JH
119
120#ifdef EXPERIMENTAL_CERTNAMES
121 uschar * verify_cert_hostnames;
122#endif
7be682ca
PP
123} tls_ext_ctx_cb;
124
125/* should figure out a cleanup of API to handle state preserved per
126implementation, for various reasons, which can be void * in the APIs.
127For now, we hack around it. */
817d9f57
JH
128tls_ext_ctx_cb *client_static_cbinfo = NULL;
129tls_ext_ctx_cb *server_static_cbinfo = NULL;
7be682ca
PP
130
131static int
983207c1
JH
132setup_certs(SSL_CTX *sctx, uschar *certs, uschar *crl, host_item *host, BOOL optional,
133 int (*cert_vfy_cb)(int, X509_STORE_CTX *) );
059ec3d9 134
3f7eeb86 135/* Callbacks */
3bcbbbe2 136#ifdef EXIM_HAVE_OPENSSL_TLSEXT
3f7eeb86 137static int tls_servername_cb(SSL *s, int *ad ARG_UNUSED, void *arg);
3bcbbbe2 138#endif
f2de3a33 139#ifndef DISABLE_OCSP
f5d78688 140static int tls_server_stapling_cb(SSL *s, void *arg);
3f7eeb86
PP
141#endif
142
059ec3d9
PH
143
144/*************************************************
145* Handle TLS error *
146*************************************************/
147
148/* Called from lots of places when errors occur before actually starting to do
149the TLS handshake, that is, while the session is still in clear. Always returns
150DEFER for a server and FAIL for a client so that most calls can use "return
151tls_error(...)" to do this processing and then give an appropriate return. A
152single function is used for both server and client, because it is called from
153some shared functions.
154
155Argument:
156 prefix text to include in the logged error
157 host NULL if setting up a server;
158 the connected host if setting up a client
7199e1ee 159 msg error message or NULL if we should ask OpenSSL
059ec3d9
PH
160
161Returns: OK/DEFER/FAIL
162*/
163
164static int
7199e1ee 165tls_error(uschar *prefix, host_item *host, uschar *msg)
059ec3d9 166{
7199e1ee
TF
167if (msg == NULL)
168 {
169 ERR_error_string(ERR_get_error(), ssl_errstring);
5ca6d115 170 msg = (uschar *)ssl_errstring;
7199e1ee
TF
171 }
172
059ec3d9
PH
173if (host == NULL)
174 {
7199e1ee 175 uschar *conn_info = smtp_get_connection_info();
5ca6d115 176 if (Ustrncmp(conn_info, US"SMTP ", 5) == 0)
7199e1ee
TF
177 conn_info += 5;
178 log_write(0, LOG_MAIN, "TLS error on %s (%s): %s",
179 conn_info, prefix, msg);
059ec3d9
PH
180 return DEFER;
181 }
182else
183 {
184 log_write(0, LOG_MAIN, "TLS error on connection to %s [%s] (%s): %s",
7199e1ee 185 host->name, host->address, prefix, msg);
059ec3d9
PH
186 return FAIL;
187 }
188}
189
190
191
192/*************************************************
193* Callback to generate RSA key *
194*************************************************/
195
196/*
197Arguments:
198 s SSL connection
199 export not used
200 keylength keylength
201
202Returns: pointer to generated key
203*/
204
205static RSA *
206rsa_callback(SSL *s, int export, int keylength)
207{
208RSA *rsa_key;
209export = export; /* Shut picky compilers up */
210DEBUG(D_tls) debug_printf("Generating %d bit RSA key...\n", keylength);
211rsa_key = RSA_generate_key(keylength, RSA_F4, NULL, NULL);
212if (rsa_key == NULL)
213 {
214 ERR_error_string(ERR_get_error(), ssl_errstring);
215 log_write(0, LOG_MAIN|LOG_PANIC, "TLS error (RSA_generate_key): %s",
216 ssl_errstring);
217 return NULL;
218 }
219return rsa_key;
220}
221
222
223
f5d78688 224/* Extreme debug
f2de3a33 225#ifndef DISABLE_OCSP
f5d78688
JH
226void
227x509_store_dump_cert_s_names(X509_STORE * store)
228{
229STACK_OF(X509_OBJECT) * roots= store->objs;
230int i;
231static uschar name[256];
232
233for(i= 0; i<sk_X509_OBJECT_num(roots); i++)
234 {
235 X509_OBJECT * tmp_obj= sk_X509_OBJECT_value(roots, i);
236 if(tmp_obj->type == X509_LU_X509)
237 {
238 X509 * current_cert= tmp_obj->data.x509;
239 X509_NAME_oneline(X509_get_subject_name(current_cert), CS name, sizeof(name));
240 debug_printf(" %s\n", name);
241 }
242 }
243}
244#endif
245*/
246
059ec3d9
PH
247
248/*************************************************
249* Callback for verification *
250*************************************************/
251
252/* The SSL library does certificate verification if set up to do so. This
253callback has the current yes/no state is in "state". If verification succeeded,
254we set up the tls_peerdn string. If verification failed, what happens depends
255on whether the client is required to present a verifiable certificate or not.
256
257If verification is optional, we change the state to yes, but still log the
258verification error. For some reason (it really would help to have proper
259documentation of OpenSSL), this callback function then gets called again, this
260time with state = 1. In fact, that's useful, because we can set up the peerdn
261value, but we must take care not to set the private verified flag on the second
262time through.
263
264Note: this function is not called if the client fails to present a certificate
265when asked. We get here only if a certificate has been received. Handling of
266optional verification for this case is done when requesting SSL to verify, by
267setting SSL_VERIFY_FAIL_IF_NO_PEER_CERT in the non-optional case.
268
269Arguments:
270 state current yes/no state as 1/0
271 x509ctx certificate information.
a2ff477a 272 client TRUE for client startup, FALSE for server startup
059ec3d9
PH
273
274Returns: 1 if verified, 0 if not
275*/
276
277static int
421aff85
JH
278verify_callback(int state, X509_STORE_CTX *x509ctx,
279 tls_support *tlsp, BOOL *calledp, BOOL *optionalp)
059ec3d9 280{
421aff85 281X509 * cert = X509_STORE_CTX_get_current_cert(x509ctx);
059ec3d9
PH
282static uschar txt[256];
283
e51c7be2 284X509_NAME_oneline(X509_get_subject_name(cert), CS txt, sizeof(txt));
059ec3d9
PH
285
286if (state == 0)
287 {
288 log_write(0, LOG_MAIN, "SSL verify error: depth=%d error=%s cert=%s",
421aff85
JH
289 X509_STORE_CTX_get_error_depth(x509ctx),
290 X509_verify_cert_error_string(X509_STORE_CTX_get_error(x509ctx)),
059ec3d9 291 txt);
a2ff477a
JH
292 tlsp->certificate_verified = FALSE;
293 *calledp = TRUE;
9d1c15ef
JH
294 if (!*optionalp)
295 {
421aff85 296 tlsp->peercert = X509_dup(cert);
9d1c15ef
JH
297 return 0; /* reject */
298 }
059ec3d9
PH
299 DEBUG(D_tls) debug_printf("SSL verify failure overridden (host in "
300 "tls_try_verify_hosts)\n");
059ec3d9
PH
301 }
302
421aff85 303else if (X509_STORE_CTX_get_error_depth(x509ctx) != 0)
059ec3d9 304 {
93dcb1c2 305 DEBUG(D_tls) debug_printf("SSL verify ok: depth=%d SN=%s\n",
421aff85 306 X509_STORE_CTX_get_error_depth(x509ctx), txt);
f2de3a33 307#ifndef DISABLE_OCSP
f5d78688
JH
308 if (tlsp == &tls_out && client_static_cbinfo->u_ocsp.client.verify_store)
309 { /* client, wanting stapling */
310 /* Add the server cert's signing chain as the one
311 for the verification of the OCSP stapled information. */
312
313 if (!X509_STORE_add_cert(client_static_cbinfo->u_ocsp.client.verify_store,
421aff85 314 cert))
f5d78688
JH
315 ERR_clear_error();
316 }
317#endif
059ec3d9
PH
318 }
319else
320 {
e51c7be2
JH
321#ifdef EXPERIMENTAL_CERTNAMES
322 uschar * verify_cert_hostnames;
323#endif
324
a2ff477a 325 tlsp->peerdn = txt;
421aff85 326 tlsp->peercert = X509_dup(cert);
e51c7be2
JH
327
328#ifdef EXPERIMENTAL_CERTNAMES
329 if ( tlsp == &tls_out
330 && ((verify_cert_hostnames = client_static_cbinfo->verify_cert_hostnames)))
331 /* client, wanting hostname check */
332
333# if OPENSSL_VERSION_NUMBER >= 0x010100000L || OPENSSL_VERSION_NUMBER >= 0x010002000L
d8e7834a
JH
334# ifndef X509_CHECK_FLAG_NO_PARTIAL_WILDCARDS
335# define X509_CHECK_FLAG_NO_PARTIAL_WILDCARDS 0
336# endif
e51c7be2
JH
337 {
338 int sep = 0;
339 uschar * list = verify_cert_hostnames;
340 uschar * name;
d8e7834a
JH
341 int rc;
342 while ((name = string_nextinlist(&list, &sep, NULL, 0)))
343 if ((rc = X509_check_host(cert, name, 0,
344 X509_CHECK_FLAG_NO_PARTIAL_WILDCARDS)))
345 {
346 if (rc < 0)
347 {
348 log_write(0, LOG_MAIN, "SSL verify error: internal error\n");
349 name = NULL;
350 }
e51c7be2 351 break;
d8e7834a 352 }
e51c7be2
JH
353 if (!name)
354 {
355 log_write(0, LOG_MAIN,
356 "SSL verify error: certificate name mismatch: \"%s\"\n", txt);
357 return 0; /* reject */
358 }
359 }
360# else
361 if (!tls_is_name_for_cert(verify_cert_hostnames, cert))
362 {
363 log_write(0, LOG_MAIN,
364 "SSL verify error: certificate name mismatch: \"%s\"\n", txt);
365 return 0; /* reject */
366 }
367# endif
e5cccda9 368#endif /*EXPERIMENTAL_CERTNAMES*/
e51c7be2 369
93dcb1c2
JH
370 DEBUG(D_tls) debug_printf("SSL%s verify ok: depth=0 SN=%s\n",
371 *calledp ? "" : " authenticated", txt);
372 if (!*calledp) tlsp->certificate_verified = TRUE;
373 *calledp = TRUE;
059ec3d9
PH
374 }
375
059ec3d9
PH
376return 1; /* accept */
377}
378
a2ff477a
JH
379static int
380verify_callback_client(int state, X509_STORE_CTX *x509ctx)
381{
f5d78688 382return verify_callback(state, x509ctx, &tls_out, &client_verify_callback_called, &client_verify_optional);
a2ff477a
JH
383}
384
385static int
386verify_callback_server(int state, X509_STORE_CTX *x509ctx)
387{
f5d78688 388return verify_callback(state, x509ctx, &tls_in, &server_verify_callback_called, &server_verify_optional);
a2ff477a
JH
389}
390
059ec3d9 391
e5cccda9 392#ifdef EXPERIMENTAL_DANE
53a7196b 393
e5cccda9
JH
394/* This gets called *by* the dane library verify callback, which interposes
395itself.
396*/
397static int
398verify_callback_client_dane(int state, X509_STORE_CTX * x509ctx)
399{
400X509 * cert = X509_STORE_CTX_get_current_cert(x509ctx);
401static uschar txt[256];
402
403X509_NAME_oneline(X509_get_subject_name(cert), CS txt, sizeof(txt));
404
405DEBUG(D_tls) debug_printf("verify_callback_client_dane: %s\n", txt);
406tls_out.peerdn = txt;
407tls_out.peercert = X509_dup(cert);
408
409if (state == 1)
53a7196b 410 tls_out.dane_verified =
e5cccda9
JH
411 tls_out.certificate_verified = TRUE;
412return 1;
413}
53a7196b
JH
414
415#endif /*EXPERIMENTAL_DANE*/
e5cccda9 416
059ec3d9
PH
417
418/*************************************************
419* Information callback *
420*************************************************/
421
422/* The SSL library functions call this from time to time to indicate what they
7be682ca
PP
423are doing. We copy the string to the debugging output when TLS debugging has
424been requested.
059ec3d9
PH
425
426Arguments:
427 s the SSL connection
428 where
429 ret
430
431Returns: nothing
432*/
433
434static void
435info_callback(SSL *s, int where, int ret)
436{
437where = where;
438ret = ret;
439DEBUG(D_tls) debug_printf("SSL info: %s\n", SSL_state_string_long(s));
440}
441
442
443
444/*************************************************
445* Initialize for DH *
446*************************************************/
447
448/* If dhparam is set, expand it, and load up the parameters for DH encryption.
449
450Arguments:
a799883d 451 dhparam DH parameter file or fixed parameter identity string
7199e1ee 452 host connected host, if client; NULL if server
059ec3d9
PH
453
454Returns: TRUE if OK (nothing to set up, or setup worked)
455*/
456
457static BOOL
a799883d 458init_dh(SSL_CTX *sctx, uschar *dhparam, host_item *host)
059ec3d9 459{
059ec3d9
PH
460BIO *bio;
461DH *dh;
462uschar *dhexpanded;
a799883d 463const char *pem;
059ec3d9
PH
464
465if (!expand_check(dhparam, US"tls_dhparam", &dhexpanded))
466 return FALSE;
467
0df4ab80 468if (!dhexpanded || !*dhexpanded)
a799883d 469 bio = BIO_new_mem_buf(CS std_dh_prime_default(), -1);
a799883d 470else if (dhexpanded[0] == '/')
059ec3d9 471 {
0df4ab80 472 if (!(bio = BIO_new_file(CS dhexpanded, "r")))
059ec3d9 473 {
7199e1ee 474 tls_error(string_sprintf("could not read dhparams file %s", dhexpanded),
a799883d
PP
475 host, US strerror(errno));
476 return FALSE;
059ec3d9 477 }
a799883d
PP
478 }
479else
480 {
481 if (Ustrcmp(dhexpanded, "none") == 0)
059ec3d9 482 {
a799883d
PP
483 DEBUG(D_tls) debug_printf("Requested no DH parameters.\n");
484 return TRUE;
059ec3d9 485 }
a799883d 486
0df4ab80 487 if (!(pem = std_dh_prime_named(dhexpanded)))
a799883d
PP
488 {
489 tls_error(string_sprintf("Unknown standard DH prime \"%s\"", dhexpanded),
490 host, US strerror(errno));
491 return FALSE;
492 }
493 bio = BIO_new_mem_buf(CS pem, -1);
494 }
495
0df4ab80 496if (!(dh = PEM_read_bio_DHparams(bio, NULL, NULL, NULL)))
a799883d 497 {
059ec3d9 498 BIO_free(bio);
a799883d
PP
499 tls_error(string_sprintf("Could not read tls_dhparams \"%s\"", dhexpanded),
500 host, NULL);
501 return FALSE;
502 }
503
504/* Even if it is larger, we silently return success rather than cause things
505 * to fail out, so that a too-large DH will not knock out all TLS; it's a
506 * debatable choice. */
507if ((8*DH_size(dh)) > tls_dh_max_bits)
508 {
509 DEBUG(D_tls)
510 debug_printf("dhparams file %d bits, is > tls_dh_max_bits limit of %d",
511 8*DH_size(dh), tls_dh_max_bits);
512 }
513else
514 {
515 SSL_CTX_set_tmp_dh(sctx, dh);
516 DEBUG(D_tls)
517 debug_printf("Diffie-Hellman initialized from %s with %d-bit prime\n",
518 dhexpanded ? dhexpanded : US"default", 8*DH_size(dh));
059ec3d9
PH
519 }
520
a799883d
PP
521DH_free(dh);
522BIO_free(bio);
523
524return TRUE;
059ec3d9
PH
525}
526
527
528
529
f2de3a33 530#ifndef DISABLE_OCSP
3f7eeb86
PP
531/*************************************************
532* Load OCSP information into state *
533*************************************************/
534
f5d78688 535/* Called to load the server OCSP response from the given file into memory, once
3f7eeb86
PP
536caller has determined this is needed. Checks validity. Debugs a message
537if invalid.
538
539ASSUMES: single response, for single cert.
540
541Arguments:
542 sctx the SSL_CTX* to update
543 cbinfo various parts of session state
544 expanded the filename putatively holding an OCSP response
545
546*/
547
548static void
f5d78688 549ocsp_load_response(SSL_CTX *sctx, tls_ext_ctx_cb *cbinfo, const uschar *expanded)
3f7eeb86
PP
550{
551BIO *bio;
552OCSP_RESPONSE *resp;
553OCSP_BASICRESP *basic_response;
554OCSP_SINGLERESP *single_response;
555ASN1_GENERALIZEDTIME *rev, *thisupd, *nextupd;
556X509_STORE *store;
557unsigned long verify_flags;
558int status, reason, i;
559
f5d78688
JH
560cbinfo->u_ocsp.server.file_expanded = string_copy(expanded);
561if (cbinfo->u_ocsp.server.response)
3f7eeb86 562 {
f5d78688
JH
563 OCSP_RESPONSE_free(cbinfo->u_ocsp.server.response);
564 cbinfo->u_ocsp.server.response = NULL;
3f7eeb86
PP
565 }
566
f5d78688 567bio = BIO_new_file(CS cbinfo->u_ocsp.server.file_expanded, "rb");
3f7eeb86
PP
568if (!bio)
569 {
570 DEBUG(D_tls) debug_printf("Failed to open OCSP response file \"%s\"\n",
f5d78688 571 cbinfo->u_ocsp.server.file_expanded);
3f7eeb86
PP
572 return;
573 }
574
575resp = d2i_OCSP_RESPONSE_bio(bio, NULL);
576BIO_free(bio);
577if (!resp)
578 {
579 DEBUG(D_tls) debug_printf("Error reading OCSP response.\n");
580 return;
581 }
582
583status = OCSP_response_status(resp);
584if (status != OCSP_RESPONSE_STATUS_SUCCESSFUL)
585 {
586 DEBUG(D_tls) debug_printf("OCSP response not valid: %s (%d)\n",
587 OCSP_response_status_str(status), status);
f5d78688 588 goto bad;
3f7eeb86
PP
589 }
590
591basic_response = OCSP_response_get1_basic(resp);
592if (!basic_response)
593 {
594 DEBUG(D_tls)
595 debug_printf("OCSP response parse error: unable to extract basic response.\n");
f5d78688 596 goto bad;
3f7eeb86
PP
597 }
598
599store = SSL_CTX_get_cert_store(sctx);
600verify_flags = OCSP_NOVERIFY; /* check sigs, but not purpose */
601
602/* May need to expose ability to adjust those flags?
603OCSP_NOSIGS OCSP_NOVERIFY OCSP_NOCHAIN OCSP_NOCHECKS OCSP_NOEXPLICIT
604OCSP_TRUSTOTHER OCSP_NOINTERN */
605
606i = OCSP_basic_verify(basic_response, NULL, store, verify_flags);
607if (i <= 0)
608 {
609 DEBUG(D_tls) {
610 ERR_error_string(ERR_get_error(), ssl_errstring);
611 debug_printf("OCSP response verify failure: %s\n", US ssl_errstring);
f5d78688
JH
612 }
613 goto bad;
3f7eeb86
PP
614 }
615
616/* Here's the simplifying assumption: there's only one response, for the
617one certificate we use, and nothing for anything else in a chain. If this
618proves false, we need to extract a cert id from our issued cert
619(tls_certificate) and use that for OCSP_resp_find_status() (which finds the
620right cert in the stack and then calls OCSP_single_get0_status()).
621
622I'm hoping to avoid reworking a bunch more of how we handle state here. */
623single_response = OCSP_resp_get0(basic_response, 0);
624if (!single_response)
625 {
626 DEBUG(D_tls)
627 debug_printf("Unable to get first response from OCSP basic response.\n");
f5d78688 628 goto bad;
3f7eeb86
PP
629 }
630
631status = OCSP_single_get0_status(single_response, &reason, &rev, &thisupd, &nextupd);
f5d78688 632if (status != V_OCSP_CERTSTATUS_GOOD)
3f7eeb86 633 {
f5d78688
JH
634 DEBUG(D_tls) debug_printf("OCSP response bad cert status: %s (%d) %s (%d)\n",
635 OCSP_cert_status_str(status), status,
636 OCSP_crl_reason_str(reason), reason);
637 goto bad;
3f7eeb86
PP
638 }
639
640if (!OCSP_check_validity(thisupd, nextupd, EXIM_OCSP_SKEW_SECONDS, EXIM_OCSP_MAX_AGE))
641 {
642 DEBUG(D_tls) debug_printf("OCSP status invalid times.\n");
f5d78688 643 goto bad;
3f7eeb86
PP
644 }
645
f5d78688 646supply_response:
018058b2 647 cbinfo->u_ocsp.server.response = resp;
f5d78688
JH
648return;
649
650bad:
018058b2
JH
651 if (running_in_test_harness)
652 {
653 extern char ** environ;
654 uschar ** p;
655 for (p = USS environ; *p != NULL; p++)
656 if (Ustrncmp(*p, "EXIM_TESTHARNESS_DISABLE_OCSPVALIDITYCHECK", 42) == 0)
657 {
658 DEBUG(D_tls) debug_printf("Supplying known bad OCSP response\n");
659 goto supply_response;
660 }
661 }
f5d78688 662return;
3f7eeb86 663}
f2de3a33 664#endif /*!DISABLE_OCSP*/
3f7eeb86
PP
665
666
667
668
059ec3d9 669/*************************************************
7be682ca
PP
670* Expand key and cert file specs *
671*************************************************/
672
f5d78688 673/* Called once during tls_init and possibly again during TLS setup, for a
7be682ca
PP
674new context, if Server Name Indication was used and tls_sni was seen in
675the certificate string.
676
677Arguments:
678 sctx the SSL_CTX* to update
679 cbinfo various parts of session state
680
681Returns: OK/DEFER/FAIL
682*/
683
684static int
3f7eeb86 685tls_expand_session_files(SSL_CTX *sctx, tls_ext_ctx_cb *cbinfo)
7be682ca
PP
686{
687uschar *expanded;
688
689if (cbinfo->certificate == NULL)
690 return OK;
691
d9b2312b
JH
692if (Ustrstr(cbinfo->certificate, US"tls_sni") ||
693 Ustrstr(cbinfo->certificate, US"tls_in_sni") ||
694 Ustrstr(cbinfo->certificate, US"tls_out_sni")
695 )
7be682ca
PP
696 reexpand_tls_files_for_sni = TRUE;
697
698if (!expand_check(cbinfo->certificate, US"tls_certificate", &expanded))
699 return DEFER;
700
701if (expanded != NULL)
702 {
703 DEBUG(D_tls) debug_printf("tls_certificate file %s\n", expanded);
704 if (!SSL_CTX_use_certificate_chain_file(sctx, CS expanded))
705 return tls_error(string_sprintf(
706 "SSL_CTX_use_certificate_chain_file file=%s", expanded),
707 cbinfo->host, NULL);
708 }
709
710if (cbinfo->privatekey != NULL &&
711 !expand_check(cbinfo->privatekey, US"tls_privatekey", &expanded))
712 return DEFER;
713
714/* If expansion was forced to fail, key_expanded will be NULL. If the result
715of the expansion is an empty string, ignore it also, and assume the private
716key is in the same file as the certificate. */
717
718if (expanded != NULL && *expanded != 0)
719 {
720 DEBUG(D_tls) debug_printf("tls_privatekey file %s\n", expanded);
721 if (!SSL_CTX_use_PrivateKey_file(sctx, CS expanded, SSL_FILETYPE_PEM))
722 return tls_error(string_sprintf(
723 "SSL_CTX_use_PrivateKey_file file=%s", expanded), cbinfo->host, NULL);
724 }
725
f2de3a33 726#ifndef DISABLE_OCSP
f5d78688 727if (cbinfo->is_server && cbinfo->u_ocsp.server.file != NULL)
3f7eeb86 728 {
f5d78688 729 if (!expand_check(cbinfo->u_ocsp.server.file, US"tls_ocsp_file", &expanded))
3f7eeb86
PP
730 return DEFER;
731
732 if (expanded != NULL && *expanded != 0)
733 {
734 DEBUG(D_tls) debug_printf("tls_ocsp_file %s\n", expanded);
f5d78688
JH
735 if (cbinfo->u_ocsp.server.file_expanded &&
736 (Ustrcmp(expanded, cbinfo->u_ocsp.server.file_expanded) == 0))
3f7eeb86
PP
737 {
738 DEBUG(D_tls)
739 debug_printf("tls_ocsp_file value unchanged, using existing values.\n");
740 } else {
741 ocsp_load_response(sctx, cbinfo, expanded);
742 }
743 }
744 }
745#endif
746
7be682ca
PP
747return OK;
748}
749
750
751
752
753/*************************************************
754* Callback to handle SNI *
755*************************************************/
756
757/* Called when acting as server during the TLS session setup if a Server Name
758Indication extension was sent by the client.
759
760API documentation is OpenSSL s_server.c implementation.
761
762Arguments:
763 s SSL* of the current session
764 ad unknown (part of OpenSSL API) (unused)
765 arg Callback of "our" registered data
766
767Returns: SSL_TLSEXT_ERR_{OK,ALERT_WARNING,ALERT_FATAL,NOACK}
768*/
769
3bcbbbe2 770#ifdef EXIM_HAVE_OPENSSL_TLSEXT
7be682ca 771static int
7be682ca
PP
772tls_servername_cb(SSL *s, int *ad ARG_UNUSED, void *arg)
773{
774const char *servername = SSL_get_servername(s, TLSEXT_NAMETYPE_host_name);
3f7eeb86 775tls_ext_ctx_cb *cbinfo = (tls_ext_ctx_cb *) arg;
7be682ca 776int rc;
3f0945ff 777int old_pool = store_pool;
7be682ca
PP
778
779if (!servername)
780 return SSL_TLSEXT_ERR_OK;
781
3f0945ff 782DEBUG(D_tls) debug_printf("Received TLS SNI \"%s\"%s\n", servername,
7be682ca
PP
783 reexpand_tls_files_for_sni ? "" : " (unused for certificate selection)");
784
785/* Make the extension value available for expansion */
3f0945ff 786store_pool = POOL_PERM;
817d9f57 787tls_in.sni = string_copy(US servername);
3f0945ff 788store_pool = old_pool;
7be682ca
PP
789
790if (!reexpand_tls_files_for_sni)
791 return SSL_TLSEXT_ERR_OK;
792
793/* Can't find an SSL_CTX_clone() or equivalent, so we do it manually;
794not confident that memcpy wouldn't break some internal reference counting.
795Especially since there's a references struct member, which would be off. */
796
0df4ab80 797if (!(server_sni = SSL_CTX_new(SSLv23_server_method())))
7be682ca
PP
798 {
799 ERR_error_string(ERR_get_error(), ssl_errstring);
800 DEBUG(D_tls) debug_printf("SSL_CTX_new() failed: %s\n", ssl_errstring);
801 return SSL_TLSEXT_ERR_NOACK;
802 }
803
804/* Not sure how many of these are actually needed, since SSL object
805already exists. Might even need this selfsame callback, for reneg? */
806
817d9f57
JH
807SSL_CTX_set_info_callback(server_sni, SSL_CTX_get_info_callback(server_ctx));
808SSL_CTX_set_mode(server_sni, SSL_CTX_get_mode(server_ctx));
809SSL_CTX_set_options(server_sni, SSL_CTX_get_options(server_ctx));
810SSL_CTX_set_timeout(server_sni, SSL_CTX_get_timeout(server_ctx));
811SSL_CTX_set_tlsext_servername_callback(server_sni, tls_servername_cb);
812SSL_CTX_set_tlsext_servername_arg(server_sni, cbinfo);
7be682ca 813if (cbinfo->server_cipher_list)
817d9f57 814 SSL_CTX_set_cipher_list(server_sni, CS cbinfo->server_cipher_list);
f2de3a33 815#ifndef DISABLE_OCSP
f5d78688 816if (cbinfo->u_ocsp.server.file)
3f7eeb86 817 {
f5d78688 818 SSL_CTX_set_tlsext_status_cb(server_sni, tls_server_stapling_cb);
14c7b357 819 SSL_CTX_set_tlsext_status_arg(server_sni, cbinfo);
3f7eeb86
PP
820 }
821#endif
7be682ca 822
983207c1 823rc = setup_certs(server_sni, tls_verify_certificates, tls_crl, NULL, FALSE, verify_callback_server);
7be682ca
PP
824if (rc != OK) return SSL_TLSEXT_ERR_NOACK;
825
3f7eeb86
PP
826/* do this after setup_certs, because this can require the certs for verifying
827OCSP information. */
817d9f57 828rc = tls_expand_session_files(server_sni, cbinfo);
7be682ca
PP
829if (rc != OK) return SSL_TLSEXT_ERR_NOACK;
830
0df4ab80
JH
831if (!init_dh(server_sni, cbinfo->dhparam, NULL))
832 return SSL_TLSEXT_ERR_NOACK;
a799883d 833
7be682ca 834DEBUG(D_tls) debug_printf("Switching SSL context.\n");
817d9f57 835SSL_set_SSL_CTX(s, server_sni);
7be682ca
PP
836
837return SSL_TLSEXT_ERR_OK;
838}
3bcbbbe2 839#endif /* EXIM_HAVE_OPENSSL_TLSEXT */
7be682ca
PP
840
841
842
843
f2de3a33 844#ifndef DISABLE_OCSP
f5d78688 845
3f7eeb86
PP
846/*************************************************
847* Callback to handle OCSP Stapling *
848*************************************************/
849
850/* Called when acting as server during the TLS session setup if the client
851requests OCSP information with a Certificate Status Request.
852
853Documentation via openssl s_server.c and the Apache patch from the OpenSSL
854project.
855
856*/
857
858static int
f5d78688 859tls_server_stapling_cb(SSL *s, void *arg)
3f7eeb86
PP
860{
861const tls_ext_ctx_cb *cbinfo = (tls_ext_ctx_cb *) arg;
862uschar *response_der;
863int response_der_len;
864
af4a1bca
JH
865DEBUG(D_tls)
866 debug_printf("Received TLS status request (OCSP stapling); %s response.",
f5d78688
JH
867 cbinfo->u_ocsp.server.response ? "have" : "lack");
868
44662487 869tls_in.ocsp = OCSP_NOT_RESP;
f5d78688 870if (!cbinfo->u_ocsp.server.response)
3f7eeb86
PP
871 return SSL_TLSEXT_ERR_NOACK;
872
873response_der = NULL;
44662487
JH
874response_der_len = i2d_OCSP_RESPONSE(cbinfo->u_ocsp.server.response,
875 &response_der);
3f7eeb86
PP
876if (response_der_len <= 0)
877 return SSL_TLSEXT_ERR_NOACK;
878
5e55c7a9 879SSL_set_tlsext_status_ocsp_resp(server_ssl, response_der, response_der_len);
44662487 880tls_in.ocsp = OCSP_VFIED;
3f7eeb86
PP
881return SSL_TLSEXT_ERR_OK;
882}
883
3f7eeb86 884
f5d78688
JH
885static void
886time_print(BIO * bp, const char * str, ASN1_GENERALIZEDTIME * time)
887{
888BIO_printf(bp, "\t%s: ", str);
889ASN1_GENERALIZEDTIME_print(bp, time);
890BIO_puts(bp, "\n");
891}
892
893static int
894tls_client_stapling_cb(SSL *s, void *arg)
895{
896tls_ext_ctx_cb * cbinfo = arg;
897const unsigned char * p;
898int len;
899OCSP_RESPONSE * rsp;
900OCSP_BASICRESP * bs;
901int i;
902
903DEBUG(D_tls) debug_printf("Received TLS status response (OCSP stapling):");
904len = SSL_get_tlsext_status_ocsp_resp(s, &p);
905if(!p)
906 {
44662487
JH
907 /* Expect this when we requested ocsp but got none */
908 if ( cbinfo->u_ocsp.client.verify_required
909 && log_extra_selector & LX_tls_cipher)
910 log_write(0, LOG_MAIN, "Received TLS status callback, null content");
f5d78688
JH
911 else
912 DEBUG(D_tls) debug_printf(" null\n");
44662487 913 return cbinfo->u_ocsp.client.verify_required ? 0 : 1;
f5d78688 914 }
018058b2 915
f5d78688
JH
916if(!(rsp = d2i_OCSP_RESPONSE(NULL, &p, len)))
917 {
018058b2 918 tls_out.ocsp = OCSP_FAILED;
f5d78688
JH
919 if (log_extra_selector & LX_tls_cipher)
920 log_write(0, LOG_MAIN, "Received TLS status response, parse error");
921 else
922 DEBUG(D_tls) debug_printf(" parse error\n");
923 return 0;
924 }
925
926if(!(bs = OCSP_response_get1_basic(rsp)))
927 {
018058b2 928 tls_out.ocsp = OCSP_FAILED;
f5d78688
JH
929 if (log_extra_selector & LX_tls_cipher)
930 log_write(0, LOG_MAIN, "Received TLS status response, error parsing response");
931 else
932 DEBUG(D_tls) debug_printf(" error parsing response\n");
933 OCSP_RESPONSE_free(rsp);
934 return 0;
935 }
936
937/* We'd check the nonce here if we'd put one in the request. */
938/* However that would defeat cacheability on the server so we don't. */
939
f5d78688
JH
940/* This section of code reworked from OpenSSL apps source;
941 The OpenSSL Project retains copyright:
942 Copyright (c) 1999 The OpenSSL Project. All rights reserved.
943*/
944 {
945 BIO * bp = NULL;
f5d78688
JH
946 int status, reason;
947 ASN1_GENERALIZEDTIME *rev, *thisupd, *nextupd;
948
949 DEBUG(D_tls) bp = BIO_new_fp(stderr, BIO_NOCLOSE);
950
951 /*OCSP_RESPONSE_print(bp, rsp, 0); extreme debug: stapling content */
952
953 /* Use the chain that verified the server cert to verify the stapled info */
954 /* DEBUG(D_tls) x509_store_dump_cert_s_names(cbinfo->u_ocsp.client.verify_store); */
955
44662487
JH
956 if ((i = OCSP_basic_verify(bs, NULL,
957 cbinfo->u_ocsp.client.verify_store, 0)) <= 0)
f5d78688 958 {
018058b2 959 tls_out.ocsp = OCSP_FAILED;
f5d78688
JH
960 BIO_printf(bp, "OCSP response verify failure\n");
961 ERR_print_errors(bp);
44662487 962 i = cbinfo->u_ocsp.client.verify_required ? 0 : 1;
f5d78688
JH
963 goto out;
964 }
965
966 BIO_printf(bp, "OCSP response well-formed and signed OK\n");
967
968 {
969 STACK_OF(OCSP_SINGLERESP) * sresp = bs->tbsResponseData->responses;
970 OCSP_SINGLERESP * single;
971
972 if (sk_OCSP_SINGLERESP_num(sresp) != 1)
973 {
018058b2 974 tls_out.ocsp = OCSP_FAILED;
44662487
JH
975 log_write(0, LOG_MAIN, "OCSP stapling "
976 "with multiple responses not handled");
977 i = cbinfo->u_ocsp.client.verify_required ? 0 : 1;
f5d78688
JH
978 goto out;
979 }
980 single = OCSP_resp_get0(bs, 0);
44662487
JH
981 status = OCSP_single_get0_status(single, &reason, &rev,
982 &thisupd, &nextupd);
f5d78688
JH
983 }
984
f5d78688
JH
985 DEBUG(D_tls) time_print(bp, "This OCSP Update", thisupd);
986 DEBUG(D_tls) if(nextupd) time_print(bp, "Next OCSP Update", nextupd);
44662487
JH
987 if (!OCSP_check_validity(thisupd, nextupd,
988 EXIM_OCSP_SKEW_SECONDS, EXIM_OCSP_MAX_AGE))
f5d78688 989 {
018058b2 990 tls_out.ocsp = OCSP_FAILED;
f5d78688
JH
991 DEBUG(D_tls) ERR_print_errors(bp);
992 log_write(0, LOG_MAIN, "Server OSCP dates invalid");
44662487 993 i = cbinfo->u_ocsp.client.verify_required ? 0 : 1;
f5d78688 994 }
44662487 995 else
f5d78688 996 {
44662487
JH
997 DEBUG(D_tls) BIO_printf(bp, "Certificate status: %s\n",
998 OCSP_cert_status_str(status));
999 switch(status)
1000 {
1001 case V_OCSP_CERTSTATUS_GOOD:
44662487 1002 tls_out.ocsp = OCSP_VFIED;
018058b2 1003 i = 1;
44662487
JH
1004 break;
1005 case V_OCSP_CERTSTATUS_REVOKED:
018058b2 1006 tls_out.ocsp = OCSP_FAILED;
44662487
JH
1007 log_write(0, LOG_MAIN, "Server certificate revoked%s%s",
1008 reason != -1 ? "; reason: " : "",
1009 reason != -1 ? OCSP_crl_reason_str(reason) : "");
1010 DEBUG(D_tls) time_print(bp, "Revocation Time", rev);
1011 i = cbinfo->u_ocsp.client.verify_required ? 0 : 1;
1012 break;
1013 default:
018058b2 1014 tls_out.ocsp = OCSP_FAILED;
44662487
JH
1015 log_write(0, LOG_MAIN,
1016 "Server certificate status unknown, in OCSP stapling");
1017 i = cbinfo->u_ocsp.client.verify_required ? 0 : 1;
1018 break;
1019 }
f5d78688
JH
1020 }
1021 out:
1022 BIO_free(bp);
1023 }
1024
1025OCSP_RESPONSE_free(rsp);
1026return i;
1027}
f2de3a33 1028#endif /*!DISABLE_OCSP*/
3f7eeb86
PP
1029
1030
7be682ca 1031/*************************************************
059ec3d9
PH
1032* Initialize for TLS *
1033*************************************************/
1034
e51c7be2
JH
1035/* Called from both server and client code, to do preliminary initialization
1036of the library. We allocate and return a context structure.
059ec3d9
PH
1037
1038Arguments:
946ecbe0 1039 ctxp returned SSL context
059ec3d9
PH
1040 host connected host, if client; NULL if server
1041 dhparam DH parameter file
1042 certificate certificate file
1043 privatekey private key
f5d78688 1044 ocsp_file file of stapling info (server); flag for require ocsp (client)
059ec3d9 1045 addr address if client; NULL if server (for some randomness)
946ecbe0 1046 cbp place to put allocated callback context
059ec3d9
PH
1047
1048Returns: OK/DEFER/FAIL
1049*/
1050
1051static int
817d9f57 1052tls_init(SSL_CTX **ctxp, host_item *host, uschar *dhparam, uschar *certificate,
3f7eeb86 1053 uschar *privatekey,
f2de3a33 1054#ifndef DISABLE_OCSP
3f7eeb86
PP
1055 uschar *ocsp_file,
1056#endif
817d9f57 1057 address_item *addr, tls_ext_ctx_cb ** cbp)
059ec3d9 1058{
77bb000f 1059long init_options;
7be682ca 1060int rc;
77bb000f 1061BOOL okay;
7be682ca
PP
1062tls_ext_ctx_cb *cbinfo;
1063
1064cbinfo = store_malloc(sizeof(tls_ext_ctx_cb));
1065cbinfo->certificate = certificate;
1066cbinfo->privatekey = privatekey;
f2de3a33 1067#ifndef DISABLE_OCSP
f5d78688
JH
1068if ((cbinfo->is_server = host==NULL))
1069 {
1070 cbinfo->u_ocsp.server.file = ocsp_file;
1071 cbinfo->u_ocsp.server.file_expanded = NULL;
1072 cbinfo->u_ocsp.server.response = NULL;
1073 }
1074else
1075 cbinfo->u_ocsp.client.verify_store = NULL;
3f7eeb86 1076#endif
7be682ca 1077cbinfo->dhparam = dhparam;
0df4ab80 1078cbinfo->server_cipher_list = NULL;
7be682ca 1079cbinfo->host = host;
77bb000f 1080
059ec3d9
PH
1081SSL_load_error_strings(); /* basic set up */
1082OpenSSL_add_ssl_algorithms();
1083
388d6564 1084#if (OPENSSL_VERSION_NUMBER >= 0x0090800fL) && !defined(OPENSSL_NO_SHA256)
77bb000f 1085/* SHA256 is becoming ever more popular. This makes sure it gets added to the
a0475b69
TK
1086list of available digests. */
1087EVP_add_digest(EVP_sha256());
cf1ef1a9 1088#endif
a0475b69 1089
f0f5a555
PP
1090/* Create a context.
1091The OpenSSL docs in 1.0.1b have not been updated to clarify TLS variant
1092negotiation in the different methods; as far as I can tell, the only
1093*_{server,client}_method which allows negotiation is SSLv23, which exists even
1094when OpenSSL is built without SSLv2 support.
1095By disabling with openssl_options, we can let admins re-enable with the
1096existing knob. */
059ec3d9 1097
817d9f57 1098*ctxp = SSL_CTX_new((host == NULL)?
059ec3d9
PH
1099 SSLv23_server_method() : SSLv23_client_method());
1100
817d9f57 1101if (*ctxp == NULL) return tls_error(US"SSL_CTX_new", host, NULL);
059ec3d9
PH
1102
1103/* It turns out that we need to seed the random number generator this early in
1104order to get the full complement of ciphers to work. It took me roughly a day
1105of work to discover this by experiment.
1106
1107On systems that have /dev/urandom, SSL may automatically seed itself from
1108there. Otherwise, we have to make something up as best we can. Double check
1109afterwards. */
1110
1111if (!RAND_status())
1112 {
1113 randstuff r;
9e3331ea 1114 gettimeofday(&r.tv, NULL);
059ec3d9
PH
1115 r.p = getpid();
1116
1117 RAND_seed((uschar *)(&r), sizeof(r));
1118 RAND_seed((uschar *)big_buffer, big_buffer_size);
1119 if (addr != NULL) RAND_seed((uschar *)addr, sizeof(addr));
1120
1121 if (!RAND_status())
7199e1ee 1122 return tls_error(US"RAND_status", host,
5ca6d115 1123 US"unable to seed random number generator");
059ec3d9
PH
1124 }
1125
1126/* Set up the information callback, which outputs if debugging is at a suitable
1127level. */
1128
817d9f57 1129SSL_CTX_set_info_callback(*ctxp, (void (*)())info_callback);
059ec3d9 1130
c80c5570 1131/* Automatically re-try reads/writes after renegotiation. */
817d9f57 1132(void) SSL_CTX_set_mode(*ctxp, SSL_MODE_AUTO_RETRY);
c80c5570 1133
77bb000f
PP
1134/* Apply administrator-supplied work-arounds.
1135Historically we applied just one requested option,
1136SSL_OP_DONT_INSERT_EMPTY_FRAGMENTS, but when bug 994 requested a second, we
1137moved to an administrator-controlled list of options to specify and
1138grandfathered in the first one as the default value for "openssl_options".
059ec3d9 1139
77bb000f
PP
1140No OpenSSL version number checks: the options we accept depend upon the
1141availability of the option value macros from OpenSSL. */
059ec3d9 1142
77bb000f
PP
1143okay = tls_openssl_options_parse(openssl_options, &init_options);
1144if (!okay)
73a46702 1145 return tls_error(US"openssl_options parsing failed", host, NULL);
77bb000f
PP
1146
1147if (init_options)
1148 {
1149 DEBUG(D_tls) debug_printf("setting SSL CTX options: %#lx\n", init_options);
817d9f57 1150 if (!(SSL_CTX_set_options(*ctxp, init_options)))
77bb000f
PP
1151 return tls_error(string_sprintf(
1152 "SSL_CTX_set_option(%#lx)", init_options), host, NULL);
1153 }
1154else
1155 DEBUG(D_tls) debug_printf("no SSL CTX options to set\n");
059ec3d9
PH
1156
1157/* Initialize with DH parameters if supplied */
1158
817d9f57 1159if (!init_dh(*ctxp, dhparam, host)) return DEFER;
059ec3d9 1160
3f7eeb86 1161/* Set up certificate and key (and perhaps OCSP info) */
059ec3d9 1162
817d9f57 1163rc = tls_expand_session_files(*ctxp, cbinfo);
7be682ca 1164if (rc != OK) return rc;
c91535f3 1165
7be682ca 1166/* If we need to handle SNI, do so */
3bcbbbe2 1167#ifdef EXIM_HAVE_OPENSSL_TLSEXT
f5d78688 1168if (host == NULL) /* server */
3f0945ff 1169 {
f2de3a33 1170# ifndef DISABLE_OCSP
f5d78688 1171 /* We check u_ocsp.server.file, not server.response, because we care about if
3f7eeb86
PP
1172 the option exists, not what the current expansion might be, as SNI might
1173 change the certificate and OCSP file in use between now and the time the
1174 callback is invoked. */
f5d78688 1175 if (cbinfo->u_ocsp.server.file)
3f7eeb86 1176 {
f5d78688 1177 SSL_CTX_set_tlsext_status_cb(server_ctx, tls_server_stapling_cb);
5e55c7a9 1178 SSL_CTX_set_tlsext_status_arg(server_ctx, cbinfo);
3f7eeb86 1179 }
f5d78688 1180# endif
3f0945ff
PP
1181 /* We always do this, so that $tls_sni is available even if not used in
1182 tls_certificate */
817d9f57
JH
1183 SSL_CTX_set_tlsext_servername_callback(*ctxp, tls_servername_cb);
1184 SSL_CTX_set_tlsext_servername_arg(*ctxp, cbinfo);
3f0945ff 1185 }
f2de3a33 1186# ifndef DISABLE_OCSP
f5d78688
JH
1187else /* client */
1188 if(ocsp_file) /* wanting stapling */
1189 {
1190 if (!(cbinfo->u_ocsp.client.verify_store = X509_STORE_new()))
1191 {
1192 DEBUG(D_tls) debug_printf("failed to create store for stapling verify\n");
1193 return FAIL;
1194 }
1195 SSL_CTX_set_tlsext_status_cb(*ctxp, tls_client_stapling_cb);
1196 SSL_CTX_set_tlsext_status_arg(*ctxp, cbinfo);
1197 }
1198# endif
7be682ca 1199#endif
059ec3d9 1200
e51c7be2
JH
1201#ifdef EXPERIMENTAL_CERTNAMES
1202cbinfo->verify_cert_hostnames = NULL;
1203#endif
1204
059ec3d9
PH
1205/* Set up the RSA callback */
1206
817d9f57 1207SSL_CTX_set_tmp_rsa_callback(*ctxp, rsa_callback);
059ec3d9
PH
1208
1209/* Finally, set the timeout, and we are done */
1210
817d9f57 1211SSL_CTX_set_timeout(*ctxp, ssl_session_timeout);
059ec3d9 1212DEBUG(D_tls) debug_printf("Initialized TLS\n");
7be682ca 1213
817d9f57 1214*cbp = cbinfo;
7be682ca 1215
059ec3d9
PH
1216return OK;
1217}
1218
1219
1220
1221
1222/*************************************************
1223* Get name of cipher in use *
1224*************************************************/
1225
817d9f57 1226/*
059ec3d9 1227Argument: pointer to an SSL structure for the connection
817d9f57
JH
1228 buffer to use for answer
1229 size of buffer
1230 pointer to number of bits for cipher
059ec3d9
PH
1231Returns: nothing
1232*/
1233
1234static void
817d9f57 1235construct_cipher_name(SSL *ssl, uschar *cipherbuf, int bsize, int *bits)
059ec3d9 1236{
57b3a7f5
PP
1237/* With OpenSSL 1.0.0a, this needs to be const but the documentation doesn't
1238yet reflect that. It should be a safe change anyway, even 0.9.8 versions have
1239the accessor functions use const in the prototype. */
1240const SSL_CIPHER *c;
d9784128 1241const uschar *ver;
059ec3d9 1242
d9784128 1243ver = (const uschar *)SSL_get_version(ssl);
059ec3d9 1244
57b3a7f5 1245c = (const SSL_CIPHER *) SSL_get_current_cipher(ssl);
817d9f57 1246SSL_CIPHER_get_bits(c, bits);
059ec3d9 1247
817d9f57
JH
1248string_format(cipherbuf, bsize, "%s:%s:%u", ver,
1249 SSL_CIPHER_get_name(c), *bits);
059ec3d9
PH
1250
1251DEBUG(D_tls) debug_printf("Cipher: %s\n", cipherbuf);
1252}
1253
1254
1255
1256
1257
1258/*************************************************
1259* Set up for verifying certificates *
1260*************************************************/
1261
1262/* Called by both client and server startup
1263
1264Arguments:
7be682ca 1265 sctx SSL_CTX* to initialise
059ec3d9
PH
1266 certs certs file or NULL
1267 crl CRL file or NULL
1268 host NULL in a server; the remote host in a client
1269 optional TRUE if called from a server for a host in tls_try_verify_hosts;
1270 otherwise passed as FALSE
983207c1 1271 cert_vfy_cb Callback function for certificate verification
059ec3d9
PH
1272
1273Returns: OK/DEFER/FAIL
1274*/
1275
1276static int
983207c1
JH
1277setup_certs(SSL_CTX *sctx, uschar *certs, uschar *crl, host_item *host, BOOL optional,
1278 int (*cert_vfy_cb)(int, X509_STORE_CTX *) )
059ec3d9
PH
1279{
1280uschar *expcerts, *expcrl;
1281
1282if (!expand_check(certs, US"tls_verify_certificates", &expcerts))
1283 return DEFER;
1284
26e72755 1285if (expcerts != NULL && *expcerts != '\0')
059ec3d9
PH
1286 {
1287 struct stat statbuf;
7be682ca 1288 if (!SSL_CTX_set_default_verify_paths(sctx))
7199e1ee 1289 return tls_error(US"SSL_CTX_set_default_verify_paths", host, NULL);
059ec3d9
PH
1290
1291 if (Ustat(expcerts, &statbuf) < 0)
1292 {
1293 log_write(0, LOG_MAIN|LOG_PANIC,
1294 "failed to stat %s for certificates", expcerts);
1295 return DEFER;
1296 }
1297 else
1298 {
1299 uschar *file, *dir;
1300 if ((statbuf.st_mode & S_IFMT) == S_IFDIR)
1301 { file = NULL; dir = expcerts; }
1302 else
1303 { file = expcerts; dir = NULL; }
1304
1305 /* If a certificate file is empty, the next function fails with an
1306 unhelpful error message. If we skip it, we get the correct behaviour (no
1307 certificates are recognized, but the error message is still misleading (it
1308 says no certificate was supplied.) But this is better. */
1309
1310 if ((file == NULL || statbuf.st_size > 0) &&
7be682ca 1311 !SSL_CTX_load_verify_locations(sctx, CS file, CS dir))
7199e1ee 1312 return tls_error(US"SSL_CTX_load_verify_locations", host, NULL);
059ec3d9
PH
1313
1314 if (file != NULL)
1315 {
7be682ca 1316 SSL_CTX_set_client_CA_list(sctx, SSL_load_client_CA_file(CS file));
059ec3d9
PH
1317 }
1318 }
1319
1320 /* Handle a certificate revocation list. */
1321
1322 #if OPENSSL_VERSION_NUMBER > 0x00907000L
1323
8b417f2c
PH
1324 /* This bit of code is now the version supplied by Lars Mainka. (I have
1325 * merely reformatted it into the Exim code style.)
1326
1327 * "From here I changed the code to add support for multiple crl's
1328 * in pem format in one file or to support hashed directory entries in
1329 * pem format instead of a file. This method now uses the library function
1330 * X509_STORE_load_locations to add the CRL location to the SSL context.
1331 * OpenSSL will then handle the verify against CA certs and CRLs by
1332 * itself in the verify callback." */
1333
059ec3d9
PH
1334 if (!expand_check(crl, US"tls_crl", &expcrl)) return DEFER;
1335 if (expcrl != NULL && *expcrl != 0)
1336 {
8b417f2c
PH
1337 struct stat statbufcrl;
1338 if (Ustat(expcrl, &statbufcrl) < 0)
1339 {
1340 log_write(0, LOG_MAIN|LOG_PANIC,
1341 "failed to stat %s for certificates revocation lists", expcrl);
1342 return DEFER;
1343 }
1344 else
059ec3d9 1345 {
8b417f2c
PH
1346 /* is it a file or directory? */
1347 uschar *file, *dir;
7be682ca 1348 X509_STORE *cvstore = SSL_CTX_get_cert_store(sctx);
8b417f2c 1349 if ((statbufcrl.st_mode & S_IFMT) == S_IFDIR)
059ec3d9 1350 {
8b417f2c
PH
1351 file = NULL;
1352 dir = expcrl;
1353 DEBUG(D_tls) debug_printf("SSL CRL value is a directory %s\n", dir);
059ec3d9
PH
1354 }
1355 else
1356 {
8b417f2c
PH
1357 file = expcrl;
1358 dir = NULL;
1359 DEBUG(D_tls) debug_printf("SSL CRL value is a file %s\n", file);
059ec3d9 1360 }
8b417f2c 1361 if (X509_STORE_load_locations(cvstore, CS file, CS dir) == 0)
7199e1ee 1362 return tls_error(US"X509_STORE_load_locations", host, NULL);
8b417f2c
PH
1363
1364 /* setting the flags to check against the complete crl chain */
1365
1366 X509_STORE_set_flags(cvstore,
1367 X509_V_FLAG_CRL_CHECK|X509_V_FLAG_CRL_CHECK_ALL);
059ec3d9 1368 }
059ec3d9
PH
1369 }
1370
1371 #endif /* OPENSSL_VERSION_NUMBER > 0x00907000L */
1372
1373 /* If verification is optional, don't fail if no certificate */
1374
7be682ca 1375 SSL_CTX_set_verify(sctx,
059ec3d9 1376 SSL_VERIFY_PEER | (optional? 0 : SSL_VERIFY_FAIL_IF_NO_PEER_CERT),
983207c1 1377 cert_vfy_cb);
059ec3d9
PH
1378 }
1379
1380return OK;
1381}
1382
1383
1384
1385/*************************************************
1386* Start a TLS session in a server *
1387*************************************************/
1388
1389/* This is called when Exim is running as a server, after having received
1390the STARTTLS command. It must respond to that command, and then negotiate
1391a TLS session.
1392
1393Arguments:
1394 require_ciphers allowed ciphers
1395
1396Returns: OK on success
1397 DEFER for errors before the start of the negotiation
1398 FAIL for errors during the negotation; the server can't
1399 continue running.
1400*/
1401
1402int
17c76198 1403tls_server_start(const uschar *require_ciphers)
059ec3d9
PH
1404{
1405int rc;
1406uschar *expciphers;
7be682ca 1407tls_ext_ctx_cb *cbinfo;
817d9f57 1408static uschar cipherbuf[256];
059ec3d9
PH
1409
1410/* Check for previous activation */
1411
817d9f57 1412if (tls_in.active >= 0)
059ec3d9 1413 {
5ca6d115 1414 tls_error(US"STARTTLS received after TLS started", NULL, US"");
059ec3d9
PH
1415 smtp_printf("554 Already in TLS\r\n");
1416 return FAIL;
1417 }
1418
1419/* Initialize the SSL library. If it fails, it will already have logged
1420the error. */
1421
817d9f57 1422rc = tls_init(&server_ctx, NULL, tls_dhparam, tls_certificate, tls_privatekey,
f2de3a33 1423#ifndef DISABLE_OCSP
3f7eeb86
PP
1424 tls_ocsp_file,
1425#endif
817d9f57 1426 NULL, &server_static_cbinfo);
059ec3d9 1427if (rc != OK) return rc;
817d9f57 1428cbinfo = server_static_cbinfo;
059ec3d9
PH
1429
1430if (!expand_check(require_ciphers, US"tls_require_ciphers", &expciphers))
1431 return FAIL;
1432
1433/* In OpenSSL, cipher components are separated by hyphens. In GnuTLS, they
17c76198
PP
1434were historically separated by underscores. So that I can use either form in my
1435tests, and also for general convenience, we turn underscores into hyphens here.
1436*/
059ec3d9
PH
1437
1438if (expciphers != NULL)
1439 {
1440 uschar *s = expciphers;
1441 while (*s != 0) { if (*s == '_') *s = '-'; s++; }
1442 DEBUG(D_tls) debug_printf("required ciphers: %s\n", expciphers);
817d9f57 1443 if (!SSL_CTX_set_cipher_list(server_ctx, CS expciphers))
7199e1ee 1444 return tls_error(US"SSL_CTX_set_cipher_list", NULL, NULL);
7be682ca 1445 cbinfo->server_cipher_list = expciphers;
059ec3d9
PH
1446 }
1447
1448/* If this is a host for which certificate verification is mandatory or
1449optional, set up appropriately. */
1450
817d9f57 1451tls_in.certificate_verified = FALSE;
53a7196b
JH
1452#ifdef EXPERIMENTAL_DANE
1453tls_in.dane_verified = FALSE;
1454#endif
a2ff477a 1455server_verify_callback_called = FALSE;
059ec3d9
PH
1456
1457if (verify_check_host(&tls_verify_hosts) == OK)
1458 {
983207c1
JH
1459 rc = setup_certs(server_ctx, tls_verify_certificates, tls_crl, NULL,
1460 FALSE, verify_callback_server);
059ec3d9 1461 if (rc != OK) return rc;
a2ff477a 1462 server_verify_optional = FALSE;
059ec3d9
PH
1463 }
1464else if (verify_check_host(&tls_try_verify_hosts) == OK)
1465 {
983207c1
JH
1466 rc = setup_certs(server_ctx, tls_verify_certificates, tls_crl, NULL,
1467 TRUE, verify_callback_server);
059ec3d9 1468 if (rc != OK) return rc;
a2ff477a 1469 server_verify_optional = TRUE;
059ec3d9
PH
1470 }
1471
1472/* Prepare for new connection */
1473
817d9f57 1474if ((server_ssl = SSL_new(server_ctx)) == NULL) return tls_error(US"SSL_new", NULL, NULL);
da3ad30d
PP
1475
1476/* Warning: we used to SSL_clear(ssl) here, it was removed.
1477 *
1478 * With the SSL_clear(), we get strange interoperability bugs with
1479 * OpenSSL 1.0.1b and TLS1.1/1.2. It looks as though this may be a bug in
1480 * OpenSSL itself, as a clear should not lead to inability to follow protocols.
1481 *
1482 * The SSL_clear() call is to let an existing SSL* be reused, typically after
1483 * session shutdown. In this case, we have a brand new object and there's no
1484 * obvious reason to immediately clear it. I'm guessing that this was
1485 * originally added because of incomplete initialisation which the clear fixed,
1486 * in some historic release.
1487 */
059ec3d9
PH
1488
1489/* Set context and tell client to go ahead, except in the case of TLS startup
1490on connection, where outputting anything now upsets the clients and tends to
1491make them disconnect. We need to have an explicit fflush() here, to force out
1492the response. Other smtp_printf() calls do not need it, because in non-TLS
1493mode, the fflush() happens when smtp_getc() is called. */
1494
817d9f57
JH
1495SSL_set_session_id_context(server_ssl, sid_ctx, Ustrlen(sid_ctx));
1496if (!tls_in.on_connect)
059ec3d9
PH
1497 {
1498 smtp_printf("220 TLS go ahead\r\n");
1499 fflush(smtp_out);
1500 }
1501
1502/* Now negotiate the TLS session. We put our own timer on it, since it seems
1503that the OpenSSL library doesn't. */
1504
817d9f57
JH
1505SSL_set_wfd(server_ssl, fileno(smtp_out));
1506SSL_set_rfd(server_ssl, fileno(smtp_in));
1507SSL_set_accept_state(server_ssl);
059ec3d9
PH
1508
1509DEBUG(D_tls) debug_printf("Calling SSL_accept\n");
1510
1511sigalrm_seen = FALSE;
1512if (smtp_receive_timeout > 0) alarm(smtp_receive_timeout);
817d9f57 1513rc = SSL_accept(server_ssl);
059ec3d9
PH
1514alarm(0);
1515
1516if (rc <= 0)
1517 {
7199e1ee 1518 tls_error(US"SSL_accept", NULL, sigalrm_seen ? US"timed out" : NULL);
77bb000f
PP
1519 if (ERR_get_error() == 0)
1520 log_write(0, LOG_MAIN,
a053d125 1521 "TLS client disconnected cleanly (rejected our certificate?)");
059ec3d9
PH
1522 return FAIL;
1523 }
1524
1525DEBUG(D_tls) debug_printf("SSL_accept was successful\n");
1526
1527/* TLS has been set up. Adjust the input functions to read via TLS,
1528and initialize things. */
1529
817d9f57
JH
1530construct_cipher_name(server_ssl, cipherbuf, sizeof(cipherbuf), &tls_in.bits);
1531tls_in.cipher = cipherbuf;
059ec3d9
PH
1532
1533DEBUG(D_tls)
1534 {
1535 uschar buf[2048];
817d9f57 1536 if (SSL_get_shared_ciphers(server_ssl, CS buf, sizeof(buf)) != NULL)
059ec3d9
PH
1537 debug_printf("Shared ciphers: %s\n", buf);
1538 }
1539
9d1c15ef
JH
1540/* Record the certificate we presented */
1541 {
1542 X509 * crt = SSL_get_certificate(server_ssl);
1543 tls_in.ourcert = crt ? X509_dup(crt) : NULL;
1544 }
059ec3d9 1545
817d9f57
JH
1546/* Only used by the server-side tls (tls_in), including tls_getc.
1547 Client-side (tls_out) reads (seem to?) go via
1548 smtp_read_response()/ip_recv().
1549 Hence no need to duplicate for _in and _out.
1550 */
059ec3d9
PH
1551ssl_xfer_buffer = store_malloc(ssl_xfer_buffer_size);
1552ssl_xfer_buffer_lwm = ssl_xfer_buffer_hwm = 0;
1553ssl_xfer_eof = ssl_xfer_error = 0;
1554
1555receive_getc = tls_getc;
1556receive_ungetc = tls_ungetc;
1557receive_feof = tls_feof;
1558receive_ferror = tls_ferror;
58eb016e 1559receive_smtp_buffered = tls_smtp_buffered;
059ec3d9 1560
817d9f57 1561tls_in.active = fileno(smtp_out);
059ec3d9
PH
1562return OK;
1563}
1564
1565
1566
1567
043b1248
JH
1568static int
1569tls_client_basic_ctx_init(SSL_CTX * ctx,
1570 host_item * host, smtp_transport_options_block * ob
1571#ifdef EXPERIMENTAL_CERTNAMES
1572 , tls_ext_ctx_cb * cbinfo
1573#endif
1574 )
1575{
1576int rc;
1577/* stick to the old behaviour for compatibility if tls_verify_certificates is
1578 set but both tls_verify_hosts and tls_try_verify_hosts is not set. Check only
1579 the specified host patterns if one of them is defined */
1580
1581if ((!ob->tls_verify_hosts && !ob->tls_try_verify_hosts) ||
1582 (verify_check_host(&ob->tls_verify_hosts) == OK))
1583 {
1584 if ((rc = setup_certs(ctx, ob->tls_verify_certificates,
1585 ob->tls_crl, host, FALSE, verify_callback_client)) != OK)
1586 return rc;
1587 client_verify_optional = FALSE;
1588
1589#ifdef EXPERIMENTAL_CERTNAMES
1590 if (ob->tls_verify_cert_hostnames)
1591 {
1592 if (!expand_check(ob->tls_verify_cert_hostnames,
1593 US"tls_verify_cert_hostnames",
1594 &cbinfo->verify_cert_hostnames))
1595 return FAIL;
1596 if (cbinfo->verify_cert_hostnames)
1597 DEBUG(D_tls) debug_printf("Cert hostname to check: \"%s\"\n",
1598 cbinfo->verify_cert_hostnames);
1599 }
1600#endif
1601 }
1602else if (verify_check_host(&ob->tls_try_verify_hosts) == OK)
1603 {
1604 if ((rc = setup_certs(ctx, ob->tls_verify_certificates,
1605 ob->tls_crl, host, TRUE, verify_callback_client)) != OK)
1606 return rc;
1607 client_verify_optional = TRUE;
1608 }
1609
1610return OK;
1611}
059ec3d9
PH
1612
1613/*************************************************
1614* Start a TLS session in a client *
1615*************************************************/
1616
1617/* Called from the smtp transport after STARTTLS has been accepted.
1618
1619Argument:
1620 fd the fd of the connection
1621 host connected host (for messages)
83da1223 1622 addr the first address
65867078 1623 ob smtp transport options
059ec3d9
PH
1624
1625Returns: OK on success
1626 FAIL otherwise - note that tls_error() will not give DEFER
1627 because this is not a server
1628*/
1629
1630int
f5d78688 1631tls_client_start(int fd, host_item *host, address_item *addr,
65867078 1632 void *v_ob)
059ec3d9 1633{
65867078 1634smtp_transport_options_block * ob = v_ob;
059ec3d9 1635static uschar txt[256];
868f5672
JH
1636uschar * expciphers;
1637X509 * server_cert;
059ec3d9 1638int rc;
817d9f57 1639static uschar cipherbuf[256];
043b1248
JH
1640
1641#ifndef DISABLE_OCSP
043b1248 1642BOOL request_ocsp = FALSE;
6634ac8d 1643BOOL require_ocsp = FALSE;
043b1248
JH
1644#endif
1645#ifdef EXPERIMENTAL_DANE
868f5672
JH
1646dns_answer tlsa_dnsa;
1647BOOL dane = FALSE;
1648BOOL dane_required;
043b1248
JH
1649#endif
1650
1651#ifdef EXPERIMENTAL_DANE
868f5672
JH
1652dane_required = verify_check_this_host(&ob->hosts_require_dane, NULL,
1653 host->name, host->address, NULL) == OK;
868f5672
JH
1654
1655if (host->dnssec == DS_YES)
1656 {
1657 if( dane_required
1658 || verify_check_this_host(&ob->hosts_try_dane, NULL,
1659 host->name, host->address, NULL) == OK
1660 )
1661 {
1662 /* move this out to host.c given the similarity to dns_lookup() ? */
1663 uschar buffer[300];
868f5672
JH
1664 uschar * fullname = buffer;
1665
1666 /* TLSA lookup string */
7a31d643 1667 (void)sprintf(CS buffer, "_%d._tcp.%.256s", host->port,
868f5672
JH
1668 host->name);
1669
1670 switch (rc = dns_lookup(&tlsa_dnsa, buffer, T_TLSA, &fullname))
1671 {
1672 case DNS_AGAIN:
1673 return DEFER; /* just defer this TLS'd conn */
1674
1675 default:
1676 case DNS_FAIL:
1677 if (dane_required)
1678 {
7a31d643 1679 log_write(0, LOG_MAIN, "DANE error: TLSA lookup failed");
868f5672
JH
1680 return FAIL;
1681 }
1682 break;
1683
1684 case DNS_SUCCEED:
1685 if (!dns_is_secure(&tlsa_dnsa))
1686 {
7a31d643 1687 log_write(0, LOG_MAIN, "DANE error: TLSA lookup not DNSSEC");
868f5672
JH
1688 return DEFER;
1689 }
1690 dane = TRUE;
1691 break;
1692 }
1693 }
1694 }
7a31d643 1695else if (dane_required)
868f5672 1696 {
cf2b569e 1697 /*XXX a shame we only find this after making tcp & smtp connection */
b4161d10 1698 /* move the test earlier? */
7a31d643 1699 log_write(0, LOG_MAIN, "DANE error: previous lookup not DNSSEC");
868f5672
JH
1700 return FAIL;
1701 }
043b1248 1702
043b1248
JH
1703#endif
1704
f2de3a33 1705#ifndef DISABLE_OCSP
043b1248
JH
1706 {
1707 require_ocsp = verify_check_this_host(&ob->hosts_require_ocsp,
1708 NULL, host->name, host->address, NULL) == OK;
1709 request_ocsp = require_ocsp ? TRUE
1710 : verify_check_this_host(&ob->hosts_request_ocsp,
1711 NULL, host->name, host->address, NULL) == OK;
1712 }
f5d78688 1713#endif
059ec3d9 1714
65867078
JH
1715rc = tls_init(&client_ctx, host, NULL,
1716 ob->tls_certificate, ob->tls_privatekey,
f2de3a33 1717#ifndef DISABLE_OCSP
44662487 1718 (void *)(long)request_ocsp,
3f7eeb86 1719#endif
817d9f57 1720 addr, &client_static_cbinfo);
059ec3d9
PH
1721if (rc != OK) return rc;
1722
817d9f57 1723tls_out.certificate_verified = FALSE;
53a7196b
JH
1724#ifdef EXPERIMENTAL_DANE
1725tls_out.dane_verified = FALSE;
1726#endif
a2ff477a 1727client_verify_callback_called = FALSE;
059ec3d9 1728
65867078
JH
1729if (!expand_check(ob->tls_require_ciphers, US"tls_require_ciphers",
1730 &expciphers))
059ec3d9
PH
1731 return FAIL;
1732
1733/* In OpenSSL, cipher components are separated by hyphens. In GnuTLS, they
1734are separated by underscores. So that I can use either form in my tests, and
1735also for general convenience, we turn underscores into hyphens here. */
1736
1737if (expciphers != NULL)
1738 {
1739 uschar *s = expciphers;
1740 while (*s != 0) { if (*s == '_') *s = '-'; s++; }
1741 DEBUG(D_tls) debug_printf("required ciphers: %s\n", expciphers);
817d9f57 1742 if (!SSL_CTX_set_cipher_list(client_ctx, CS expciphers))
7199e1ee 1743 return tls_error(US"SSL_CTX_set_cipher_list", host, NULL);
059ec3d9
PH
1744 }
1745
043b1248 1746#ifdef EXPERIMENTAL_DANE
868f5672 1747if (dane)
a63be306 1748 {
e5cccda9
JH
1749 SSL_CTX_set_verify(client_ctx, SSL_VERIFY_PEER, verify_callback_client_dane);
1750
043b1248 1751 if (!DANESSL_library_init())
b4161d10 1752 return tls_error(US"library init", host, NULL);
043b1248 1753 if (DANESSL_CTX_init(client_ctx) <= 0)
b4161d10 1754 return tls_error(US"context init", host, NULL);
043b1248
JH
1755 }
1756else
e51c7be2 1757
043b1248
JH
1758#endif
1759
1760 if ((rc = tls_client_basic_ctx_init(client_ctx, host, ob
e51c7be2 1761#ifdef EXPERIMENTAL_CERTNAMES
043b1248 1762 , client_static_cbinfo
e51c7be2 1763#endif
043b1248 1764 )) != OK)
65867078 1765 return rc;
059ec3d9 1766
65867078
JH
1767if ((client_ssl = SSL_new(client_ctx)) == NULL)
1768 return tls_error(US"SSL_new", host, NULL);
817d9f57
JH
1769SSL_set_session_id_context(client_ssl, sid_ctx, Ustrlen(sid_ctx));
1770SSL_set_fd(client_ssl, fd);
1771SSL_set_connect_state(client_ssl);
059ec3d9 1772
65867078 1773if (ob->tls_sni)
3f0945ff 1774 {
65867078 1775 if (!expand_check(ob->tls_sni, US"tls_sni", &tls_out.sni))
3f0945ff 1776 return FAIL;
ec4b68e5 1777 if (tls_out.sni == NULL)
2c9a0e86
PP
1778 {
1779 DEBUG(D_tls) debug_printf("Setting TLS SNI forced to fail, not sending\n");
1780 }
ec4b68e5 1781 else if (!Ustrlen(tls_out.sni))
817d9f57 1782 tls_out.sni = NULL;
3f0945ff
PP
1783 else
1784 {
35731706 1785#ifdef EXIM_HAVE_OPENSSL_TLSEXT
817d9f57
JH
1786 DEBUG(D_tls) debug_printf("Setting TLS SNI \"%s\"\n", tls_out.sni);
1787 SSL_set_tlsext_host_name(client_ssl, tls_out.sni);
35731706
PP
1788#else
1789 DEBUG(D_tls)
1790 debug_printf("OpenSSL at build-time lacked SNI support, ignoring \"%s\"\n",
02d9264f 1791 tls_out.sni);
35731706 1792#endif
3f0945ff
PP
1793 }
1794 }
1795
f2de3a33 1796#ifndef DISABLE_OCSP
f5d78688
JH
1797/* Request certificate status at connection-time. If the server
1798does OCSP stapling we will get the callback (set in tls_init()) */
44662487
JH
1799if (request_ocsp)
1800 {
f5d78688 1801 SSL_set_tlsext_status_type(client_ssl, TLSEXT_STATUSTYPE_ocsp);
44662487
JH
1802 client_static_cbinfo->u_ocsp.client.verify_required = require_ocsp;
1803 tls_out.ocsp = OCSP_NOT_RESP;
1804 }
f5d78688
JH
1805#endif
1806
043b1248 1807#ifdef EXPERIMENTAL_DANE
868f5672 1808if (dane)
043b1248 1809 {
868f5672
JH
1810 dns_record * rr;
1811 dns_scan dnss;
85098ee7 1812 const char * hostnames[2] = { CS host->name, NULL };
36b894a6 1813 int found = 0;
868f5672
JH
1814
1815 if (DANESSL_init(client_ssl, NULL, hostnames) != 1)
b4161d10 1816 return tls_error(US"hostnames load", host, NULL);
043b1248 1817
868f5672
JH
1818 for (rr = dns_next_rr(&tlsa_dnsa, &dnss, RESET_ANSWERS);
1819 rr;
1820 rr = dns_next_rr(&tlsa_dnsa, &dnss, RESET_NEXT)
1821 ) if (rr->type == T_TLSA)
1822 {
1823 uschar * p = rr->data;
1824 int usage, selector, mtype;
1825 const char * mdname;
1826
36b894a6
JH
1827 found++;
1828 usage = *p++;
1829 selector = *p++;
1830 mtype = *p++;
868f5672
JH
1831
1832 switch (mtype)
1833 {
36b894a6
JH
1834 default:
1835 log_write(0, LOG_MAIN, "DANE error: TLSA record w/bad mtype 0x%x", mtype);
1836 return FAIL;
868f5672 1837 case 0: mdname = NULL; break;
401a8935
JH
1838 case 1: mdname = "sha256"; break;
1839 case 2: mdname = "sha512"; break;
868f5672
JH
1840 }
1841
1842 switch (DANESSL_add_tlsa(client_ssl,
1843 (uint8_t) usage, (uint8_t) selector,
1844 mdname, p, rr->size - (p - rr->data)))
1845 {
1846 default:
b4161d10
JH
1847 case 0: /* action not taken */
1848 return tls_error(US"tlsa load", host, NULL);
868f5672
JH
1849 case 1: break;
1850 }
1851 }
36b894a6
JH
1852
1853 if (!found)
1854 {
1855 log_write(0, LOG_MAIN, "DANE error: No TLSA records");
1856 return FAIL;
1857 }
043b1248
JH
1858 }
1859#endif
1860
1861
059ec3d9
PH
1862/* There doesn't seem to be a built-in timeout on connection. */
1863
1864DEBUG(D_tls) debug_printf("Calling SSL_connect\n");
1865sigalrm_seen = FALSE;
65867078 1866alarm(ob->command_timeout);
817d9f57 1867rc = SSL_connect(client_ssl);
059ec3d9
PH
1868alarm(0);
1869
043b1248 1870#ifdef EXPERIMENTAL_DANE
12ee8cf9
JH
1871if (dane)
1872 DANESSL_cleanup(client_ssl); /*XXX earliest possible callpoint. Too early? */
043b1248
JH
1873#endif
1874
059ec3d9 1875if (rc <= 0)
7199e1ee 1876 return tls_error(US"SSL_connect", host, sigalrm_seen ? US"timed out" : NULL);
059ec3d9
PH
1877
1878DEBUG(D_tls) debug_printf("SSL_connect succeeded\n");
1879
453a6645 1880/* Beware anonymous ciphers which lead to server_cert being NULL */
9d1c15ef 1881/*XXX server_cert is never freed... use X509_free() */
817d9f57 1882server_cert = SSL_get_peer_certificate (client_ssl);
453a6645
PP
1883if (server_cert)
1884 {
817d9f57 1885 tls_out.peerdn = US X509_NAME_oneline(X509_get_subject_name(server_cert),
453a6645 1886 CS txt, sizeof(txt));
9d1c15ef 1887 tls_out.peerdn = txt; /*XXX a static buffer... */
453a6645
PP
1888 }
1889else
817d9f57 1890 tls_out.peerdn = NULL;
059ec3d9 1891
817d9f57
JH
1892construct_cipher_name(client_ssl, cipherbuf, sizeof(cipherbuf), &tls_out.bits);
1893tls_out.cipher = cipherbuf;
059ec3d9 1894
9d1c15ef
JH
1895/* Record the certificate we presented */
1896 {
1897 X509 * crt = SSL_get_certificate(client_ssl);
1898 tls_out.ourcert = crt ? X509_dup(crt) : NULL;
1899 }
1900
817d9f57 1901tls_out.active = fd;
059ec3d9
PH
1902return OK;
1903}
1904
1905
1906
1907
1908
1909/*************************************************
1910* TLS version of getc *
1911*************************************************/
1912
1913/* This gets the next byte from the TLS input buffer. If the buffer is empty,
1914it refills the buffer via the SSL reading function.
1915
1916Arguments: none
1917Returns: the next character or EOF
817d9f57
JH
1918
1919Only used by the server-side TLS.
059ec3d9
PH
1920*/
1921
1922int
1923tls_getc(void)
1924{
1925if (ssl_xfer_buffer_lwm >= ssl_xfer_buffer_hwm)
1926 {
1927 int error;
1928 int inbytes;
1929
817d9f57 1930 DEBUG(D_tls) debug_printf("Calling SSL_read(%p, %p, %u)\n", server_ssl,
c80c5570 1931 ssl_xfer_buffer, ssl_xfer_buffer_size);
059ec3d9
PH
1932
1933 if (smtp_receive_timeout > 0) alarm(smtp_receive_timeout);
817d9f57
JH
1934 inbytes = SSL_read(server_ssl, CS ssl_xfer_buffer, ssl_xfer_buffer_size);
1935 error = SSL_get_error(server_ssl, inbytes);
059ec3d9
PH
1936 alarm(0);
1937
1938 /* SSL_ERROR_ZERO_RETURN appears to mean that the SSL session has been
1939 closed down, not that the socket itself has been closed down. Revert to
1940 non-SSL handling. */
1941
1942 if (error == SSL_ERROR_ZERO_RETURN)
1943 {
1944 DEBUG(D_tls) debug_printf("Got SSL_ERROR_ZERO_RETURN\n");
1945
1946 receive_getc = smtp_getc;
1947 receive_ungetc = smtp_ungetc;
1948 receive_feof = smtp_feof;
1949 receive_ferror = smtp_ferror;
58eb016e 1950 receive_smtp_buffered = smtp_buffered;
059ec3d9 1951
817d9f57
JH
1952 SSL_free(server_ssl);
1953 server_ssl = NULL;
1954 tls_in.active = -1;
1955 tls_in.bits = 0;
1956 tls_in.cipher = NULL;
1957 tls_in.peerdn = NULL;
1958 tls_in.sni = NULL;
059ec3d9
PH
1959
1960 return smtp_getc();
1961 }
1962
1963 /* Handle genuine errors */
1964
ba084640
PP
1965 else if (error == SSL_ERROR_SSL)
1966 {
1967 ERR_error_string(ERR_get_error(), ssl_errstring);
89dd51cd 1968 log_write(0, LOG_MAIN, "TLS error (SSL_read): %s", ssl_errstring);
ba084640
PP
1969 ssl_xfer_error = 1;
1970 return EOF;
1971 }
1972
059ec3d9
PH
1973 else if (error != SSL_ERROR_NONE)
1974 {
1975 DEBUG(D_tls) debug_printf("Got SSL error %d\n", error);
1976 ssl_xfer_error = 1;
1977 return EOF;
1978 }
c80c5570 1979
80a47a2c
TK
1980#ifndef DISABLE_DKIM
1981 dkim_exim_verify_feed(ssl_xfer_buffer, inbytes);
1982#endif
059ec3d9
PH
1983 ssl_xfer_buffer_hwm = inbytes;
1984 ssl_xfer_buffer_lwm = 0;
1985 }
1986
1987/* Something in the buffer; return next uschar */
1988
1989return ssl_xfer_buffer[ssl_xfer_buffer_lwm++];
1990}
1991
1992
1993
1994/*************************************************
1995* Read bytes from TLS channel *
1996*************************************************/
1997
1998/*
1999Arguments:
2000 buff buffer of data
2001 len size of buffer
2002
2003Returns: the number of bytes read
2004 -1 after a failed read
817d9f57
JH
2005
2006Only used by the client-side TLS.
059ec3d9
PH
2007*/
2008
2009int
389ca47a 2010tls_read(BOOL is_server, uschar *buff, size_t len)
059ec3d9 2011{
389ca47a 2012SSL *ssl = is_server ? server_ssl : client_ssl;
059ec3d9
PH
2013int inbytes;
2014int error;
2015
389ca47a 2016DEBUG(D_tls) debug_printf("Calling SSL_read(%p, %p, %u)\n", ssl,
c80c5570 2017 buff, (unsigned int)len);
059ec3d9 2018
389ca47a
JH
2019inbytes = SSL_read(ssl, CS buff, len);
2020error = SSL_get_error(ssl, inbytes);
059ec3d9
PH
2021
2022if (error == SSL_ERROR_ZERO_RETURN)
2023 {
2024 DEBUG(D_tls) debug_printf("Got SSL_ERROR_ZERO_RETURN\n");
2025 return -1;
2026 }
2027else if (error != SSL_ERROR_NONE)
2028 {
2029 return -1;
2030 }
2031
2032return inbytes;
2033}
2034
2035
2036
2037
2038
2039/*************************************************
2040* Write bytes down TLS channel *
2041*************************************************/
2042
2043/*
2044Arguments:
817d9f57 2045 is_server channel specifier
059ec3d9
PH
2046 buff buffer of data
2047 len number of bytes
2048
2049Returns: the number of bytes after a successful write,
2050 -1 after a failed write
817d9f57
JH
2051
2052Used by both server-side and client-side TLS.
059ec3d9
PH
2053*/
2054
2055int
817d9f57 2056tls_write(BOOL is_server, const uschar *buff, size_t len)
059ec3d9
PH
2057{
2058int outbytes;
2059int error;
2060int left = len;
817d9f57 2061SSL *ssl = is_server ? server_ssl : client_ssl;
059ec3d9 2062
c80c5570 2063DEBUG(D_tls) debug_printf("tls_do_write(%p, %d)\n", buff, left);
059ec3d9
PH
2064while (left > 0)
2065 {
c80c5570 2066 DEBUG(D_tls) debug_printf("SSL_write(SSL, %p, %d)\n", buff, left);
059ec3d9
PH
2067 outbytes = SSL_write(ssl, CS buff, left);
2068 error = SSL_get_error(ssl, outbytes);
2069 DEBUG(D_tls) debug_printf("outbytes=%d error=%d\n", outbytes, error);
2070 switch (error)
2071 {
2072 case SSL_ERROR_SSL:
2073 ERR_error_string(ERR_get_error(), ssl_errstring);
2074 log_write(0, LOG_MAIN, "TLS error (SSL_write): %s", ssl_errstring);
2075 return -1;
2076
2077 case SSL_ERROR_NONE:
2078 left -= outbytes;
2079 buff += outbytes;
2080 break;
2081
2082 case SSL_ERROR_ZERO_RETURN:
2083 log_write(0, LOG_MAIN, "SSL channel closed on write");
2084 return -1;
2085
817d9f57
JH
2086 case SSL_ERROR_SYSCALL:
2087 log_write(0, LOG_MAIN, "SSL_write: (from %s) syscall: %s",
2088 sender_fullhost ? sender_fullhost : US"<unknown>",
2089 strerror(errno));
2090
059ec3d9
PH
2091 default:
2092 log_write(0, LOG_MAIN, "SSL_write error %d", error);
2093 return -1;
2094 }
2095 }
2096return len;
2097}
2098
2099
2100
2101/*************************************************
2102* Close down a TLS session *
2103*************************************************/
2104
2105/* This is also called from within a delivery subprocess forked from the
2106daemon, to shut down the TLS library, without actually doing a shutdown (which
2107would tamper with the SSL session in the parent process).
2108
2109Arguments: TRUE if SSL_shutdown is to be called
2110Returns: nothing
817d9f57
JH
2111
2112Used by both server-side and client-side TLS.
059ec3d9
PH
2113*/
2114
2115void
817d9f57 2116tls_close(BOOL is_server, BOOL shutdown)
059ec3d9 2117{
817d9f57 2118SSL **sslp = is_server ? &server_ssl : &client_ssl;
389ca47a 2119int *fdp = is_server ? &tls_in.active : &tls_out.active;
817d9f57
JH
2120
2121if (*fdp < 0) return; /* TLS was not active */
059ec3d9
PH
2122
2123if (shutdown)
2124 {
2125 DEBUG(D_tls) debug_printf("tls_close(): shutting down SSL\n");
817d9f57 2126 SSL_shutdown(*sslp);
059ec3d9
PH
2127 }
2128
817d9f57
JH
2129SSL_free(*sslp);
2130*sslp = NULL;
059ec3d9 2131
817d9f57 2132*fdp = -1;
059ec3d9
PH
2133}
2134
36f12725
NM
2135
2136
2137
2138/*************************************************
3375e053
PP
2139* Let tls_require_ciphers be checked at startup *
2140*************************************************/
2141
2142/* The tls_require_ciphers option, if set, must be something which the
2143library can parse.
2144
2145Returns: NULL on success, or error message
2146*/
2147
2148uschar *
2149tls_validate_require_cipher(void)
2150{
2151SSL_CTX *ctx;
2152uschar *s, *expciphers, *err;
2153
2154/* this duplicates from tls_init(), we need a better "init just global
2155state, for no specific purpose" singleton function of our own */
2156
2157SSL_load_error_strings();
2158OpenSSL_add_ssl_algorithms();
2159#if (OPENSSL_VERSION_NUMBER >= 0x0090800fL) && !defined(OPENSSL_NO_SHA256)
2160/* SHA256 is becoming ever more popular. This makes sure it gets added to the
2161list of available digests. */
2162EVP_add_digest(EVP_sha256());
2163#endif
2164
2165if (!(tls_require_ciphers && *tls_require_ciphers))
2166 return NULL;
2167
2168if (!expand_check(tls_require_ciphers, US"tls_require_ciphers", &expciphers))
2169 return US"failed to expand tls_require_ciphers";
2170
2171if (!(expciphers && *expciphers))
2172 return NULL;
2173
2174/* normalisation ripped from above */
2175s = expciphers;
2176while (*s != 0) { if (*s == '_') *s = '-'; s++; }
2177
2178err = NULL;
2179
2180ctx = SSL_CTX_new(SSLv23_server_method());
2181if (!ctx)
2182 {
2183 ERR_error_string(ERR_get_error(), ssl_errstring);
2184 return string_sprintf("SSL_CTX_new() failed: %s", ssl_errstring);
2185 }
2186
2187DEBUG(D_tls)
2188 debug_printf("tls_require_ciphers expands to \"%s\"\n", expciphers);
2189
2190if (!SSL_CTX_set_cipher_list(ctx, CS expciphers))
2191 {
2192 ERR_error_string(ERR_get_error(), ssl_errstring);
2193 err = string_sprintf("SSL_CTX_set_cipher_list(%s) failed", expciphers);
2194 }
2195
2196SSL_CTX_free(ctx);
2197
2198return err;
2199}
2200
2201
2202
2203
2204/*************************************************
36f12725
NM
2205* Report the library versions. *
2206*************************************************/
2207
2208/* There have historically been some issues with binary compatibility in
2209OpenSSL libraries; if Exim (like many other applications) is built against
2210one version of OpenSSL but the run-time linker picks up another version,
2211it can result in serious failures, including crashing with a SIGSEGV. So
2212report the version found by the compiler and the run-time version.
2213
f64a1e23
PP
2214Note: some OS vendors backport security fixes without changing the version
2215number/string, and the version date remains unchanged. The _build_ date
2216will change, so we can more usefully assist with version diagnosis by also
2217reporting the build date.
2218
36f12725
NM
2219Arguments: a FILE* to print the results to
2220Returns: nothing
2221*/
2222
2223void
2224tls_version_report(FILE *f)
2225{
754a0503 2226fprintf(f, "Library version: OpenSSL: Compile: %s\n"
f64a1e23
PP
2227 " Runtime: %s\n"
2228 " : %s\n",
754a0503 2229 OPENSSL_VERSION_TEXT,
f64a1e23
PP
2230 SSLeay_version(SSLEAY_VERSION),
2231 SSLeay_version(SSLEAY_BUILT_ON));
2232/* third line is 38 characters for the %s and the line is 73 chars long;
2233the OpenSSL output includes a "built on: " prefix already. */
36f12725
NM
2234}
2235
9e3331ea
TK
2236
2237
2238
2239/*************************************************
17c76198 2240* Random number generation *
9e3331ea
TK
2241*************************************************/
2242
2243/* Pseudo-random number generation. The result is not expected to be
2244cryptographically strong but not so weak that someone will shoot themselves
2245in the foot using it as a nonce in input in some email header scheme or
2246whatever weirdness they'll twist this into. The result should handle fork()
2247and avoid repeating sequences. OpenSSL handles that for us.
2248
2249Arguments:
2250 max range maximum
2251Returns a random number in range [0, max-1]
2252*/
2253
2254int
17c76198 2255vaguely_random_number(int max)
9e3331ea
TK
2256{
2257unsigned int r;
2258int i, needed_len;
de6135a0
PP
2259static pid_t pidlast = 0;
2260pid_t pidnow;
9e3331ea
TK
2261uschar *p;
2262uschar smallbuf[sizeof(r)];
2263
2264if (max <= 1)
2265 return 0;
2266
de6135a0
PP
2267pidnow = getpid();
2268if (pidnow != pidlast)
2269 {
2270 /* Although OpenSSL documents that "OpenSSL makes sure that the PRNG state
2271 is unique for each thread", this doesn't apparently apply across processes,
2272 so our own warning from vaguely_random_number_fallback() applies here too.
2273 Fix per PostgreSQL. */
2274 if (pidlast != 0)
2275 RAND_cleanup();
2276 pidlast = pidnow;
2277 }
2278
9e3331ea
TK
2279/* OpenSSL auto-seeds from /dev/random, etc, but this a double-check. */
2280if (!RAND_status())
2281 {
2282 randstuff r;
2283 gettimeofday(&r.tv, NULL);
2284 r.p = getpid();
2285
2286 RAND_seed((uschar *)(&r), sizeof(r));
2287 }
2288/* We're after pseudo-random, not random; if we still don't have enough data
2289in the internal PRNG then our options are limited. We could sleep and hope
2290for entropy to come along (prayer technique) but if the system is so depleted
2291in the first place then something is likely to just keep taking it. Instead,
2292we'll just take whatever little bit of pseudo-random we can still manage to
2293get. */
2294
2295needed_len = sizeof(r);
2296/* Don't take 8 times more entropy than needed if int is 8 octets and we were
2297asked for a number less than 10. */
2298for (r = max, i = 0; r; ++i)
2299 r >>= 1;
2300i = (i + 7) / 8;
2301if (i < needed_len)
2302 needed_len = i;
2303
2304/* We do not care if crypto-strong */
17c76198
PP
2305i = RAND_pseudo_bytes(smallbuf, needed_len);
2306if (i < 0)
2307 {
2308 DEBUG(D_all)
2309 debug_printf("OpenSSL RAND_pseudo_bytes() not supported by RAND method, using fallback.\n");
2310 return vaguely_random_number_fallback(max);
2311 }
2312
9e3331ea
TK
2313r = 0;
2314for (p = smallbuf; needed_len; --needed_len, ++p)
2315 {
2316 r *= 256;
2317 r += *p;
2318 }
2319
2320/* We don't particularly care about weighted results; if someone wants
2321smooth distribution and cares enough then they should submit a patch then. */
2322return r % max;
2323}
2324
77bb000f
PP
2325
2326
2327
2328/*************************************************
2329* OpenSSL option parse *
2330*************************************************/
2331
2332/* Parse one option for tls_openssl_options_parse below
2333
2334Arguments:
2335 name one option name
2336 value place to store a value for it
2337Returns success or failure in parsing
2338*/
2339
2340struct exim_openssl_option {
2341 uschar *name;
2342 long value;
2343};
2344/* We could use a macro to expand, but we need the ifdef and not all the
2345options document which version they were introduced in. Policylet: include
2346all options unless explicitly for DTLS, let the administrator choose which
2347to apply.
2348
2349This list is current as of:
e2fbf4a2
PP
2350 ==> 1.0.1b <==
2351Plus SSL_OP_SAFARI_ECDHE_ECDSA_BUG from 2013-June patch/discussion on openssl-dev
2352*/
77bb000f
PP
2353static struct exim_openssl_option exim_openssl_options[] = {
2354/* KEEP SORTED ALPHABETICALLY! */
2355#ifdef SSL_OP_ALL
73a46702 2356 { US"all", SSL_OP_ALL },
77bb000f
PP
2357#endif
2358#ifdef SSL_OP_ALLOW_UNSAFE_LEGACY_RENEGOTIATION
73a46702 2359 { US"allow_unsafe_legacy_renegotiation", SSL_OP_ALLOW_UNSAFE_LEGACY_RENEGOTIATION },
77bb000f
PP
2360#endif
2361#ifdef SSL_OP_CIPHER_SERVER_PREFERENCE
73a46702 2362 { US"cipher_server_preference", SSL_OP_CIPHER_SERVER_PREFERENCE },
77bb000f
PP
2363#endif
2364#ifdef SSL_OP_DONT_INSERT_EMPTY_FRAGMENTS
73a46702 2365 { US"dont_insert_empty_fragments", SSL_OP_DONT_INSERT_EMPTY_FRAGMENTS },
77bb000f
PP
2366#endif
2367#ifdef SSL_OP_EPHEMERAL_RSA
73a46702 2368 { US"ephemeral_rsa", SSL_OP_EPHEMERAL_RSA },
77bb000f
PP
2369#endif
2370#ifdef SSL_OP_LEGACY_SERVER_CONNECT
73a46702 2371 { US"legacy_server_connect", SSL_OP_LEGACY_SERVER_CONNECT },
77bb000f
PP
2372#endif
2373#ifdef SSL_OP_MICROSOFT_BIG_SSLV3_BUFFER
73a46702 2374 { US"microsoft_big_sslv3_buffer", SSL_OP_MICROSOFT_BIG_SSLV3_BUFFER },
77bb000f
PP
2375#endif
2376#ifdef SSL_OP_MICROSOFT_SESS_ID_BUG
73a46702 2377 { US"microsoft_sess_id_bug", SSL_OP_MICROSOFT_SESS_ID_BUG },
77bb000f
PP
2378#endif
2379#ifdef SSL_OP_MSIE_SSLV2_RSA_PADDING
73a46702 2380 { US"msie_sslv2_rsa_padding", SSL_OP_MSIE_SSLV2_RSA_PADDING },
77bb000f
PP
2381#endif
2382#ifdef SSL_OP_NETSCAPE_CHALLENGE_BUG
73a46702 2383 { US"netscape_challenge_bug", SSL_OP_NETSCAPE_CHALLENGE_BUG },
77bb000f
PP
2384#endif
2385#ifdef SSL_OP_NETSCAPE_REUSE_CIPHER_CHANGE_BUG
73a46702 2386 { US"netscape_reuse_cipher_change_bug", SSL_OP_NETSCAPE_REUSE_CIPHER_CHANGE_BUG },
77bb000f 2387#endif
c80c5570
PP
2388#ifdef SSL_OP_NO_COMPRESSION
2389 { US"no_compression", SSL_OP_NO_COMPRESSION },
2390#endif
77bb000f 2391#ifdef SSL_OP_NO_SESSION_RESUMPTION_ON_RENEGOTIATION
73a46702 2392 { US"no_session_resumption_on_renegotiation", SSL_OP_NO_SESSION_RESUMPTION_ON_RENEGOTIATION },
77bb000f 2393#endif
c0c7b2da
PP
2394#ifdef SSL_OP_NO_SSLv2
2395 { US"no_sslv2", SSL_OP_NO_SSLv2 },
2396#endif
2397#ifdef SSL_OP_NO_SSLv3
2398 { US"no_sslv3", SSL_OP_NO_SSLv3 },
2399#endif
2400#ifdef SSL_OP_NO_TICKET
2401 { US"no_ticket", SSL_OP_NO_TICKET },
2402#endif
2403#ifdef SSL_OP_NO_TLSv1
2404 { US"no_tlsv1", SSL_OP_NO_TLSv1 },
2405#endif
c80c5570
PP
2406#ifdef SSL_OP_NO_TLSv1_1
2407#if SSL_OP_NO_TLSv1_1 == 0x00000400L
2408 /* Error in chosen value in 1.0.1a; see first item in CHANGES for 1.0.1b */
2409#warning OpenSSL 1.0.1a uses a bad value for SSL_OP_NO_TLSv1_1, ignoring
2410#else
2411 { US"no_tlsv1_1", SSL_OP_NO_TLSv1_1 },
2412#endif
2413#endif
2414#ifdef SSL_OP_NO_TLSv1_2
2415 { US"no_tlsv1_2", SSL_OP_NO_TLSv1_2 },
2416#endif
e2fbf4a2
PP
2417#ifdef SSL_OP_SAFARI_ECDHE_ECDSA_BUG
2418 { US"safari_ecdhe_ecdsa_bug", SSL_OP_SAFARI_ECDHE_ECDSA_BUG },
2419#endif
77bb000f 2420#ifdef SSL_OP_SINGLE_DH_USE
73a46702 2421 { US"single_dh_use", SSL_OP_SINGLE_DH_USE },
77bb000f
PP
2422#endif
2423#ifdef SSL_OP_SINGLE_ECDH_USE
73a46702 2424 { US"single_ecdh_use", SSL_OP_SINGLE_ECDH_USE },
77bb000f
PP
2425#endif
2426#ifdef SSL_OP_SSLEAY_080_CLIENT_DH_BUG
73a46702 2427 { US"ssleay_080_client_dh_bug", SSL_OP_SSLEAY_080_CLIENT_DH_BUG },
77bb000f
PP
2428#endif
2429#ifdef SSL_OP_SSLREF2_REUSE_CERT_TYPE_BUG
73a46702 2430 { US"sslref2_reuse_cert_type_bug", SSL_OP_SSLREF2_REUSE_CERT_TYPE_BUG },
77bb000f
PP
2431#endif
2432#ifdef SSL_OP_TLS_BLOCK_PADDING_BUG
73a46702 2433 { US"tls_block_padding_bug", SSL_OP_TLS_BLOCK_PADDING_BUG },
77bb000f
PP
2434#endif
2435#ifdef SSL_OP_TLS_D5_BUG
73a46702 2436 { US"tls_d5_bug", SSL_OP_TLS_D5_BUG },
77bb000f
PP
2437#endif
2438#ifdef SSL_OP_TLS_ROLLBACK_BUG
73a46702 2439 { US"tls_rollback_bug", SSL_OP_TLS_ROLLBACK_BUG },
77bb000f
PP
2440#endif
2441};
2442static int exim_openssl_options_size =
2443 sizeof(exim_openssl_options)/sizeof(struct exim_openssl_option);
2444
c80c5570 2445
77bb000f
PP
2446static BOOL
2447tls_openssl_one_option_parse(uschar *name, long *value)
2448{
2449int first = 0;
2450int last = exim_openssl_options_size;
2451while (last > first)
2452 {
2453 int middle = (first + last)/2;
2454 int c = Ustrcmp(name, exim_openssl_options[middle].name);
2455 if (c == 0)
2456 {
2457 *value = exim_openssl_options[middle].value;
2458 return TRUE;
2459 }
2460 else if (c > 0)
2461 first = middle + 1;
2462 else
2463 last = middle;
2464 }
2465return FALSE;
2466}
2467
2468
2469
2470
2471/*************************************************
2472* OpenSSL option parsing logic *
2473*************************************************/
2474
2475/* OpenSSL has a number of compatibility options which an administrator might
2476reasonably wish to set. Interpret a list similarly to decode_bits(), so that
2477we look like log_selector.
2478
2479Arguments:
2480 option_spec the administrator-supplied string of options
2481 results ptr to long storage for the options bitmap
2482Returns success or failure
2483*/
2484
2485BOOL
2486tls_openssl_options_parse(uschar *option_spec, long *results)
2487{
2488long result, item;
2489uschar *s, *end;
2490uschar keep_c;
2491BOOL adding, item_parsed;
2492
0e944a0d 2493result = 0L;
b1770b6e 2494/* Prior to 4.80 we or'd in SSL_OP_DONT_INSERT_EMPTY_FRAGMENTS; removed
da3ad30d 2495 * from default because it increases BEAST susceptibility. */
f0f5a555
PP
2496#ifdef SSL_OP_NO_SSLv2
2497result |= SSL_OP_NO_SSLv2;
2498#endif
77bb000f
PP
2499
2500if (option_spec == NULL)
2501 {
2502 *results = result;
2503 return TRUE;
2504 }
2505
2506for (s=option_spec; *s != '\0'; /**/)
2507 {
2508 while (isspace(*s)) ++s;
2509 if (*s == '\0')
2510 break;
2511 if (*s != '+' && *s != '-')
2512 {
2513 DEBUG(D_tls) debug_printf("malformed openssl option setting: "
0e944a0d 2514 "+ or - expected but found \"%s\"\n", s);
77bb000f
PP
2515 return FALSE;
2516 }
2517 adding = *s++ == '+';
2518 for (end = s; (*end != '\0') && !isspace(*end); ++end) /**/ ;
2519 keep_c = *end;
2520 *end = '\0';
2521 item_parsed = tls_openssl_one_option_parse(s, &item);
2522 if (!item_parsed)
2523 {
0e944a0d 2524 DEBUG(D_tls) debug_printf("openssl option setting unrecognised: \"%s\"\n", s);
77bb000f
PP
2525 return FALSE;
2526 }
2527 DEBUG(D_tls) debug_printf("openssl option, %s from %lx: %lx (%s)\n",
2528 adding ? "adding" : "removing", result, item, s);
2529 if (adding)
2530 result |= item;
2531 else
2532 result &= ~item;
2533 *end = keep_c;
2534 s = end;
2535 }
2536
2537*results = result;
2538return TRUE;
2539}
2540
9d1c15ef
JH
2541/* vi: aw ai sw=2
2542*/
059ec3d9 2543/* End of tls-openssl.c */