OpenSSL: fix bulid on older library versions
[exim.git] / src / src / tls-openssl.c
CommitLineData
059ec3d9
PH
1/*************************************************
2* Exim - an Internet mail transport agent *
3*************************************************/
4
b10c87b3 5/* Copyright (c) University of Cambridge 1995 - 2019 */
059ec3d9
PH
6/* See the file NOTICE for conditions of use and distribution. */
7
f5d78688
JH
8/* Portions Copyright (c) The OpenSSL Project 1999 */
9
059ec3d9
PH
10/* This module provides the TLS (aka SSL) support for Exim using the OpenSSL
11library. It is #included into the tls.c file when that library is used. The
12code herein is based on a patch that was originally contributed by Steve
13Haslam. It was adapted from stunnel, a GPL program by Michal Trojnara.
14
15No cryptographic code is included in Exim. All this module does is to call
16functions from the OpenSSL library. */
17
18
19/* Heading stuff */
20
21#include <openssl/lhash.h>
22#include <openssl/ssl.h>
23#include <openssl/err.h>
24#include <openssl/rand.h>
10ca4f1c
JH
25#ifndef OPENSSL_NO_ECDH
26# include <openssl/ec.h>
27#endif
f2de3a33 28#ifndef DISABLE_OCSP
e51c7be2 29# include <openssl/ocsp.h>
3f7eeb86 30#endif
c0635b6d 31#ifdef SUPPORT_DANE
05e796ad 32# include "danessl.h"
85098ee7
JH
33#endif
34
3f7eeb86 35
f2de3a33
JH
36#ifndef DISABLE_OCSP
37# define EXIM_OCSP_SKEW_SECONDS (300L)
38# define EXIM_OCSP_MAX_AGE (-1L)
3f7eeb86 39#endif
059ec3d9 40
3bcbbbe2 41#if OPENSSL_VERSION_NUMBER >= 0x0090806fL && !defined(OPENSSL_NO_TLSEXT)
e51c7be2 42# define EXIM_HAVE_OPENSSL_TLSEXT
3bcbbbe2 43#endif
c8dfb21d
JH
44#if OPENSSL_VERSION_NUMBER >= 0x00908000L
45# define EXIM_HAVE_RSA_GENKEY_EX
46#endif
47#if OPENSSL_VERSION_NUMBER >= 0x10100000L
48# define EXIM_HAVE_OCSP_RESP_COUNT
b038d456 49# define OPENSSL_AUTO_SHA256
c8dfb21d
JH
50#else
51# define EXIM_HAVE_EPHEM_RSA_KEX
52# define EXIM_HAVE_RAND_PSEUDO
53#endif
54#if (OPENSSL_VERSION_NUMBER >= 0x0090800fL) && !defined(OPENSSL_NO_SHA256)
8442641e 55# define EXIM_HAVE_SHA256
c8dfb21d 56#endif
34e3241d 57
d7978c0f
JH
58/* X509_check_host provides sane certificate hostname checking, but was added
59to OpenSSL late, after other projects forked off the code-base. So in
60addition to guarding against the base version number, beware that LibreSSL
61does not (at this time) support this function.
62
63If LibreSSL gains a different API, perhaps via libtls, then we'll probably
64opt to disentangle and ask a LibreSSL user to provide glue for a third
65crypto provider for libtls instead of continuing to tie the OpenSSL glue
66into even twistier knots. If LibreSSL gains the same API, we can just
67change this guard and punt the issue for a while longer. */
68
34e3241d
PP
69#ifndef LIBRESSL_VERSION_NUMBER
70# if OPENSSL_VERSION_NUMBER >= 0x010100000L
71# define EXIM_HAVE_OPENSSL_CHECKHOST
8420742d 72# define EXIM_HAVE_OPENSSL_DH_BITS
7a8b9519 73# define EXIM_HAVE_OPENSSL_TLS_METHOD
f20cfa4a 74# define EXIM_HAVE_OPENSSL_KEYLOG
f1be21cf 75# define EXIM_HAVE_OPENSSL_CIPHER_GET_ID
b10c87b3 76# define EXIM_HAVE_SESSION_TICKET
e570d136 77# define EXIM_HAVE_OPESSL_TRACE
012dd02e 78# define EXIM_HAVE_OPESSL_GET0_SERIAL
97277c1f
JH
79# ifndef DISABLE_OCSP
80# define EXIM_HAVE_OCSP
81# endif
7434882d
JH
82# else
83# define EXIM_NEED_OPENSSL_INIT
34e3241d
PP
84# endif
85# if OPENSSL_VERSION_NUMBER >= 0x010000000L \
2dfb468b 86 && (OPENSSL_VERSION_NUMBER & 0x0000ff000L) >= 0x000002000L
34e3241d
PP
87# define EXIM_HAVE_OPENSSL_CHECKHOST
88# endif
11aa88b0 89#endif
10ca4f1c 90
11aa88b0
RA
91#if !defined(LIBRESSL_VERSION_NUMBER) \
92 || LIBRESSL_VERSION_NUMBER >= 0x20010000L
10ca4f1c
JH
93# if !defined(OPENSSL_NO_ECDH)
94# if OPENSSL_VERSION_NUMBER >= 0x0090800fL
8442641e 95# define EXIM_HAVE_ECDH
10ca4f1c
JH
96# endif
97# if OPENSSL_VERSION_NUMBER >= 0x10002000L
10ca4f1c
JH
98# define EXIM_HAVE_OPENSSL_EC_NIST2NID
99# endif
100# endif
2dfb468b 101#endif
3bcbbbe2 102
8a40db1c
JH
103#ifndef LIBRESSL_VERSION_NUMBER
104# if OPENSSL_VERSION_NUMBER >= 0x010101000L
105# define OPENSSL_HAVE_KEYLOG_CB
d7f31bb6 106# define OPENSSL_HAVE_NUM_TICKETS
f1be21cf 107# define EXIM_HAVE_OPENSSL_CIPHER_STD_NAME
97277c1f
JH
108# else
109# define OPENSSL_BAD_SRVR_OURCERT
8a40db1c
JH
110# endif
111#endif
112
67791ce4
JH
113#if !defined(EXIM_HAVE_OPENSSL_TLSEXT) && !defined(DISABLE_OCSP)
114# warning "OpenSSL library version too old; define DISABLE_OCSP in Makefile"
115# define DISABLE_OCSP
116#endif
43e2db44
JH
117
118#ifdef EXPERIMENTAL_TLS_RESUME
119# if OPENSSL_VERSION_NUMBER < 0x0101010L
120# error OpenSSL version too old for session-resumption
121# endif
122#endif
67791ce4 123
a6510420
JH
124#ifdef EXIM_HAVE_OPENSSL_CHECKHOST
125# include <openssl/x509v3.h>
126#endif
127
f1be21cf
JH
128#ifndef EXIM_HAVE_OPENSSL_CIPHER_STD_NAME
129# ifndef EXIM_HAVE_OPENSSL_CIPHER_GET_ID
130# define SSL_CIPHER_get_id(c) (c->id)
131# endif
dca6d121
JH
132# ifndef MACRO_PREDEF
133# include "tls-cipher-stdname.c"
134# endif
f1be21cf
JH
135#endif
136
8442641e
JH
137/*************************************************
138* OpenSSL option parse *
139*************************************************/
140
141typedef struct exim_openssl_option {
142 uschar *name;
143 long value;
144} exim_openssl_option;
145/* We could use a macro to expand, but we need the ifdef and not all the
146options document which version they were introduced in. Policylet: include
147all options unless explicitly for DTLS, let the administrator choose which
148to apply.
149
150This list is current as of:
c8b050fd 151 ==> 1.1.1c <==
2043336d
JH
152
153XXX could we autobuild this list, as with predefined-macros?
c8b050fd 154Seems just parsing ssl.h for SSL_OP_.* would be enough (except to exclude DTLS).
2043336d 155Also allow a numeric literal?
8442641e
JH
156*/
157static exim_openssl_option exim_openssl_options[] = {
158/* KEEP SORTED ALPHABETICALLY! */
159#ifdef SSL_OP_ALL
6d95688d 160 { US"all", (long) SSL_OP_ALL },
8442641e 161#endif
c8b050fd
PP
162#ifdef SSL_OP_ALLOW_NO_DHE_KEX
163 { US"allow_no_dhe_kex", SSL_OP_ALLOW_NO_DHE_KEX },
164#endif
8442641e
JH
165#ifdef SSL_OP_ALLOW_UNSAFE_LEGACY_RENEGOTIATION
166 { US"allow_unsafe_legacy_renegotiation", SSL_OP_ALLOW_UNSAFE_LEGACY_RENEGOTIATION },
167#endif
168#ifdef SSL_OP_CIPHER_SERVER_PREFERENCE
169 { US"cipher_server_preference", SSL_OP_CIPHER_SERVER_PREFERENCE },
170#endif
c8b050fd
PP
171#ifdef SSL_OP_CRYPTOPRO_TLSEXT_BUG
172 { US"cryptopro_tlsext_bug", SSL_OP_CRYPTOPRO_TLSEXT_BUG },
173#endif
8442641e
JH
174#ifdef SSL_OP_DONT_INSERT_EMPTY_FRAGMENTS
175 { US"dont_insert_empty_fragments", SSL_OP_DONT_INSERT_EMPTY_FRAGMENTS },
176#endif
c8b050fd
PP
177#ifdef SSL_OP_ENABLE_MIDDLEBOX_COMPAT
178 { US"enable_middlebox_compat", SSL_OP_ENABLE_MIDDLEBOX_COMPAT },
179#endif
8442641e
JH
180#ifdef SSL_OP_EPHEMERAL_RSA
181 { US"ephemeral_rsa", SSL_OP_EPHEMERAL_RSA },
182#endif
183#ifdef SSL_OP_LEGACY_SERVER_CONNECT
184 { US"legacy_server_connect", SSL_OP_LEGACY_SERVER_CONNECT },
185#endif
186#ifdef SSL_OP_MICROSOFT_BIG_SSLV3_BUFFER
187 { US"microsoft_big_sslv3_buffer", SSL_OP_MICROSOFT_BIG_SSLV3_BUFFER },
188#endif
189#ifdef SSL_OP_MICROSOFT_SESS_ID_BUG
190 { US"microsoft_sess_id_bug", SSL_OP_MICROSOFT_SESS_ID_BUG },
191#endif
192#ifdef SSL_OP_MSIE_SSLV2_RSA_PADDING
193 { US"msie_sslv2_rsa_padding", SSL_OP_MSIE_SSLV2_RSA_PADDING },
194#endif
195#ifdef SSL_OP_NETSCAPE_CHALLENGE_BUG
196 { US"netscape_challenge_bug", SSL_OP_NETSCAPE_CHALLENGE_BUG },
197#endif
198#ifdef SSL_OP_NETSCAPE_REUSE_CIPHER_CHANGE_BUG
199 { US"netscape_reuse_cipher_change_bug", SSL_OP_NETSCAPE_REUSE_CIPHER_CHANGE_BUG },
200#endif
c8b050fd
PP
201#ifdef SSL_OP_NO_ANTI_REPLAY
202 { US"no_anti_replay", SSL_OP_NO_ANTI_REPLAY },
203#endif
8442641e
JH
204#ifdef SSL_OP_NO_COMPRESSION
205 { US"no_compression", SSL_OP_NO_COMPRESSION },
206#endif
c8b050fd
PP
207#ifdef SSL_OP_NO_ENCRYPT_THEN_MAC
208 { US"no_encrypt_then_mac", SSL_OP_NO_ENCRYPT_THEN_MAC },
209#endif
2043336d
JH
210#ifdef SSL_OP_NO_RENEGOTIATION
211 { US"no_renegotiation", SSL_OP_NO_RENEGOTIATION },
212#endif
8442641e
JH
213#ifdef SSL_OP_NO_SESSION_RESUMPTION_ON_RENEGOTIATION
214 { US"no_session_resumption_on_renegotiation", SSL_OP_NO_SESSION_RESUMPTION_ON_RENEGOTIATION },
215#endif
216#ifdef SSL_OP_NO_SSLv2
217 { US"no_sslv2", SSL_OP_NO_SSLv2 },
218#endif
219#ifdef SSL_OP_NO_SSLv3
220 { US"no_sslv3", SSL_OP_NO_SSLv3 },
221#endif
222#ifdef SSL_OP_NO_TICKET
223 { US"no_ticket", SSL_OP_NO_TICKET },
224#endif
225#ifdef SSL_OP_NO_TLSv1
226 { US"no_tlsv1", SSL_OP_NO_TLSv1 },
227#endif
228#ifdef SSL_OP_NO_TLSv1_1
229#if SSL_OP_NO_TLSv1_1 == 0x00000400L
230 /* Error in chosen value in 1.0.1a; see first item in CHANGES for 1.0.1b */
231#warning OpenSSL 1.0.1a uses a bad value for SSL_OP_NO_TLSv1_1, ignoring
232#else
233 { US"no_tlsv1_1", SSL_OP_NO_TLSv1_1 },
234#endif
235#endif
236#ifdef SSL_OP_NO_TLSv1_2
237 { US"no_tlsv1_2", SSL_OP_NO_TLSv1_2 },
238#endif
239#ifdef SSL_OP_NO_TLSv1_3
240 { US"no_tlsv1_3", SSL_OP_NO_TLSv1_3 },
241#endif
c8b050fd
PP
242#ifdef SSL_OP_PRIORITIZE_CHACHA
243 { US"prioritize_chacha", SSL_OP_PRIORITIZE_CHACHA },
244#endif
8442641e
JH
245#ifdef SSL_OP_SAFARI_ECDHE_ECDSA_BUG
246 { US"safari_ecdhe_ecdsa_bug", SSL_OP_SAFARI_ECDHE_ECDSA_BUG },
247#endif
248#ifdef SSL_OP_SINGLE_DH_USE
249 { US"single_dh_use", SSL_OP_SINGLE_DH_USE },
250#endif
251#ifdef SSL_OP_SINGLE_ECDH_USE
252 { US"single_ecdh_use", SSL_OP_SINGLE_ECDH_USE },
253#endif
254#ifdef SSL_OP_SSLEAY_080_CLIENT_DH_BUG
255 { US"ssleay_080_client_dh_bug", SSL_OP_SSLEAY_080_CLIENT_DH_BUG },
256#endif
257#ifdef SSL_OP_SSLREF2_REUSE_CERT_TYPE_BUG
258 { US"sslref2_reuse_cert_type_bug", SSL_OP_SSLREF2_REUSE_CERT_TYPE_BUG },
259#endif
260#ifdef SSL_OP_TLS_BLOCK_PADDING_BUG
261 { US"tls_block_padding_bug", SSL_OP_TLS_BLOCK_PADDING_BUG },
262#endif
263#ifdef SSL_OP_TLS_D5_BUG
264 { US"tls_d5_bug", SSL_OP_TLS_D5_BUG },
265#endif
266#ifdef SSL_OP_TLS_ROLLBACK_BUG
267 { US"tls_rollback_bug", SSL_OP_TLS_ROLLBACK_BUG },
268#endif
c8b050fd
PP
269#ifdef SSL_OP_TLSEXT_PADDING
270 { US"tlsext_padding", SSL_OP_TLSEXT_PADDING },
271#endif
8442641e
JH
272};
273
274#ifndef MACRO_PREDEF
275static int exim_openssl_options_size = nelem(exim_openssl_options);
276#endif
277
278#ifdef MACRO_PREDEF
279void
280options_tls(void)
281{
8442641e
JH
282uschar buf[64];
283
d7978c0f 284for (struct exim_openssl_option * o = exim_openssl_options;
8442641e
JH
285 o < exim_openssl_options + nelem(exim_openssl_options); o++)
286 {
287 /* Trailing X is workaround for problem with _OPT_OPENSSL_NO_TLSV1
288 being a ".ifdef _OPT_OPENSSL_NO_TLSV1_3" match */
289
290 spf(buf, sizeof(buf), US"_OPT_OPENSSL_%T_X", o->name);
291 builtin_macro_create(buf);
292 }
b10c87b3
JH
293
294# ifdef EXPERIMENTAL_TLS_RESUME
295builtin_macro_create_var(US"_RESUME_DECODE", RESUME_DECODE_STRING );
296# endif
e326959e
JH
297# ifdef SSL_OP_NO_TLSv1_3
298builtin_macro_create(US"_HAVE_TLS1_3");
299# endif
97277c1f
JH
300# ifdef OPENSSL_BAD_SRVR_OURCERT
301builtin_macro_create(US"_TLS_BAD_MULTICERT_IN_OURCERT");
302# endif
303# ifdef EXIM_HAVE_OCSP
304builtin_macro_create(US"_HAVE_TLS_OCSP");
305builtin_macro_create(US"_HAVE_TLS_OCSP_LIST");
306# endif
8442641e
JH
307}
308#else
309
310/******************************************************************************/
311
059ec3d9
PH
312/* Structure for collecting random data for seeding. */
313
314typedef struct randstuff {
9e3331ea
TK
315 struct timeval tv;
316 pid_t p;
059ec3d9
PH
317} randstuff;
318
319/* Local static variables */
320
a2ff477a
JH
321static BOOL client_verify_callback_called = FALSE;
322static BOOL server_verify_callback_called = FALSE;
059ec3d9
PH
323static const uschar *sid_ctx = US"exim";
324
d4f09789
PP
325/* We have three different contexts to care about.
326
327Simple case: client, `client_ctx`
328 As a client, we can be doing a callout or cut-through delivery while receiving
329 a message. So we have a client context, which should have options initialised
74f1a423
JH
330 from the SMTP Transport. We may also concurrently want to make TLS connections
331 to utility daemons, so client-contexts are allocated and passed around in call
332 args rather than using a gobal.
d4f09789
PP
333
334Server:
335 There are two cases: with and without ServerNameIndication from the client.
336 Given TLS SNI, we can be using different keys, certs and various other
337 configuration settings, because they're re-expanded with $tls_sni set. This
338 allows vhosting with TLS. This SNI is sent in the handshake.
339 A client might not send SNI, so we need a fallback, and an initial setup too.
340 So as a server, we start out using `server_ctx`.
341 If SNI is sent by the client, then we as server, mid-negotiation, try to clone
342 `server_sni` from `server_ctx` and then initialise settings by re-expanding
343 configuration.
344*/
345
74f1a423
JH
346typedef struct {
347 SSL_CTX * ctx;
348 SSL * ssl;
c09dbcfb 349 gstring * corked;
74f1a423
JH
350} exim_openssl_client_tls_ctx;
351
817d9f57 352static SSL_CTX *server_ctx = NULL;
817d9f57 353static SSL *server_ssl = NULL;
389ca47a 354
35731706 355#ifdef EXIM_HAVE_OPENSSL_TLSEXT
817d9f57 356static SSL_CTX *server_sni = NULL;
35731706 357#endif
059ec3d9
PH
358
359static char ssl_errstring[256];
360
dea4b568 361static int ssl_session_timeout = 7200; /* Two hours */
a2ff477a
JH
362static BOOL client_verify_optional = FALSE;
363static BOOL server_verify_optional = FALSE;
059ec3d9 364
f5d78688 365static BOOL reexpand_tls_files_for_sni = FALSE;
059ec3d9
PH
366
367
5b2fd993
JH
368typedef struct ocsp_resp {
369 struct ocsp_resp * next;
370 OCSP_RESPONSE * resp;
371} ocsp_resplist;
372
7be682ca 373typedef struct tls_ext_ctx_cb {
b10c87b3 374 tls_support * tlsp;
7be682ca
PP
375 uschar *certificate;
376 uschar *privatekey;
f5d78688 377 BOOL is_server;
a6510420 378#ifndef DISABLE_OCSP
c3033f13 379 STACK_OF(X509) *verify_stack; /* chain for verifying the proof */
f5d78688
JH
380 union {
381 struct {
382 uschar *file;
5b2fd993
JH
383 const uschar *file_expanded;
384 ocsp_resplist *olist;
f5d78688
JH
385 } server;
386 struct {
44662487
JH
387 X509_STORE *verify_store; /* non-null if status requested */
388 BOOL verify_required;
f5d78688
JH
389 } client;
390 } u_ocsp;
3f7eeb86 391#endif
7be682ca
PP
392 uschar *dhparam;
393 /* these are cached from first expand */
394 uschar *server_cipher_list;
395 /* only passed down to tls_error: */
396 host_item *host;
55414b25 397 const uschar * verify_cert_hostnames;
0cbf2b82 398#ifndef DISABLE_EVENT
a7538db1
JH
399 uschar * event_action;
400#endif
7be682ca
PP
401} tls_ext_ctx_cb;
402
403/* should figure out a cleanup of API to handle state preserved per
404implementation, for various reasons, which can be void * in the APIs.
405For now, we hack around it. */
b10c87b3 406tls_ext_ctx_cb *client_static_cbinfo = NULL; /*XXX should not use static; multiple concurrent clients! */
817d9f57 407tls_ext_ctx_cb *server_static_cbinfo = NULL;
7be682ca
PP
408
409static int
983207c1 410setup_certs(SSL_CTX *sctx, uschar *certs, uschar *crl, host_item *host, BOOL optional,
cf0c6164 411 int (*cert_vfy_cb)(int, X509_STORE_CTX *), uschar ** errstr );
059ec3d9 412
3f7eeb86 413/* Callbacks */
3bcbbbe2 414#ifdef EXIM_HAVE_OPENSSL_TLSEXT
3f7eeb86 415static int tls_servername_cb(SSL *s, int *ad ARG_UNUSED, void *arg);
3bcbbbe2 416#endif
f2de3a33 417#ifndef DISABLE_OCSP
f5d78688 418static int tls_server_stapling_cb(SSL *s, void *arg);
3f7eeb86
PP
419#endif
420
059ec3d9 421
b10c87b3 422
4d93129f 423/* Daemon-called, before every connection, key create/rotate */
b10c87b3
JH
424#ifdef EXPERIMENTAL_TLS_RESUME
425static void tk_init(void);
426static int tls_exdata_idx = -1;
427#endif
428
429void
430tls_daemon_init(void)
431{
432#ifdef EXPERIMENTAL_TLS_RESUME
433tk_init();
434#endif
435return;
436}
437
438
059ec3d9
PH
439/*************************************************
440* Handle TLS error *
441*************************************************/
442
443/* Called from lots of places when errors occur before actually starting to do
444the TLS handshake, that is, while the session is still in clear. Always returns
445DEFER for a server and FAIL for a client so that most calls can use "return
446tls_error(...)" to do this processing and then give an appropriate return. A
447single function is used for both server and client, because it is called from
448some shared functions.
449
450Argument:
451 prefix text to include in the logged error
452 host NULL if setting up a server;
453 the connected host if setting up a client
7199e1ee 454 msg error message or NULL if we should ask OpenSSL
cf0c6164 455 errstr pointer to output error message
059ec3d9
PH
456
457Returns: OK/DEFER/FAIL
458*/
459
460static int
cf0c6164 461tls_error(uschar * prefix, const host_item * host, uschar * msg, uschar ** errstr)
059ec3d9 462{
c562fd30 463if (!msg)
7199e1ee 464 {
0abc5a13 465 ERR_error_string_n(ERR_get_error(), ssl_errstring, sizeof(ssl_errstring));
cf0c6164 466 msg = US ssl_errstring;
7199e1ee
TF
467 }
468
5a2a0989
JH
469msg = string_sprintf("(%s): %s", prefix, msg);
470DEBUG(D_tls) debug_printf("TLS error '%s'\n", msg);
471if (errstr) *errstr = msg;
cf0c6164 472return host ? FAIL : DEFER;
059ec3d9
PH
473}
474
475
476
477/*************************************************
478* Callback to generate RSA key *
479*************************************************/
480
481/*
482Arguments:
3ae79556 483 s SSL connection (not used)
059ec3d9
PH
484 export not used
485 keylength keylength
486
487Returns: pointer to generated key
488*/
489
490static RSA *
491rsa_callback(SSL *s, int export, int keylength)
492{
493RSA *rsa_key;
c8dfb21d
JH
494#ifdef EXIM_HAVE_RSA_GENKEY_EX
495BIGNUM *bn = BN_new();
496#endif
497
059ec3d9
PH
498export = export; /* Shut picky compilers up */
499DEBUG(D_tls) debug_printf("Generating %d bit RSA key...\n", keylength);
c8dfb21d
JH
500
501#ifdef EXIM_HAVE_RSA_GENKEY_EX
502if ( !BN_set_word(bn, (unsigned long)RSA_F4)
f2cb6292 503 || !(rsa_key = RSA_new())
c8dfb21d
JH
504 || !RSA_generate_key_ex(rsa_key, keylength, bn, NULL)
505 )
506#else
23bb6982 507if (!(rsa_key = RSA_generate_key(keylength, RSA_F4, NULL, NULL)))
c8dfb21d
JH
508#endif
509
059ec3d9 510 {
0abc5a13 511 ERR_error_string_n(ERR_get_error(), ssl_errstring, sizeof(ssl_errstring));
059ec3d9
PH
512 log_write(0, LOG_MAIN|LOG_PANIC, "TLS error (RSA_generate_key): %s",
513 ssl_errstring);
514 return NULL;
515 }
516return rsa_key;
517}
518
519
520
f5d78688 521/* Extreme debug
f2de3a33 522#ifndef DISABLE_OCSP
f5d78688
JH
523void
524x509_store_dump_cert_s_names(X509_STORE * store)
525{
526STACK_OF(X509_OBJECT) * roots= store->objs;
f5d78688
JH
527static uschar name[256];
528
d7978c0f 529for (int i= 0; i < sk_X509_OBJECT_num(roots); i++)
f5d78688
JH
530 {
531 X509_OBJECT * tmp_obj= sk_X509_OBJECT_value(roots, i);
532 if(tmp_obj->type == X509_LU_X509)
533 {
70e384dd
JH
534 X509_NAME * sn = X509_get_subject_name(tmp_obj->data.x509);
535 if (X509_NAME_oneline(sn, CS name, sizeof(name)))
536 {
537 name[sizeof(name)-1] = '\0';
538 debug_printf(" %s\n", name);
539 }
f5d78688
JH
540 }
541 }
542}
543#endif
544*/
545
059ec3d9 546
0cbf2b82 547#ifndef DISABLE_EVENT
f69979cf
JH
548static int
549verify_event(tls_support * tlsp, X509 * cert, int depth, const uschar * dn,
550 BOOL *calledp, const BOOL *optionalp, const uschar * what)
551{
552uschar * ev;
553uschar * yield;
554X509 * old_cert;
555
556ev = tlsp == &tls_out ? client_static_cbinfo->event_action : event_action;
557if (ev)
558 {
aaba7d03 559 DEBUG(D_tls) debug_printf("verify_event: %s %d\n", what, depth);
f69979cf
JH
560 old_cert = tlsp->peercert;
561 tlsp->peercert = X509_dup(cert);
562 /* NB we do not bother setting peerdn */
563 if ((yield = event_raise(ev, US"tls:cert", string_sprintf("%d", depth))))
564 {
565 log_write(0, LOG_MAIN, "[%s] %s verify denied by event-action: "
566 "depth=%d cert=%s: %s",
567 tlsp == &tls_out ? deliver_host_address : sender_host_address,
568 what, depth, dn, yield);
569 *calledp = TRUE;
570 if (!*optionalp)
571 {
572 if (old_cert) tlsp->peercert = old_cert; /* restore 1st failing cert */
573 return 1; /* reject (leaving peercert set) */
574 }
575 DEBUG(D_tls) debug_printf("Event-action verify failure overridden "
576 "(host in tls_try_verify_hosts)\n");
4a1bd6b9 577 tlsp->verify_override = TRUE;
f69979cf
JH
578 }
579 X509_free(tlsp->peercert);
580 tlsp->peercert = old_cert;
581 }
582return 0;
583}
584#endif
585
059ec3d9
PH
586/*************************************************
587* Callback for verification *
588*************************************************/
589
590/* The SSL library does certificate verification if set up to do so. This
591callback has the current yes/no state is in "state". If verification succeeded,
f69979cf
JH
592we set the certificate-verified flag. If verification failed, what happens
593depends on whether the client is required to present a verifiable certificate
594or not.
059ec3d9
PH
595
596If verification is optional, we change the state to yes, but still log the
597verification error. For some reason (it really would help to have proper
598documentation of OpenSSL), this callback function then gets called again, this
f69979cf
JH
599time with state = 1. We must take care not to set the private verified flag on
600the second time through.
059ec3d9
PH
601
602Note: this function is not called if the client fails to present a certificate
603when asked. We get here only if a certificate has been received. Handling of
604optional verification for this case is done when requesting SSL to verify, by
605setting SSL_VERIFY_FAIL_IF_NO_PEER_CERT in the non-optional case.
606
a7538db1
JH
607May be called multiple times for different issues with a certificate, even
608for a given "depth" in the certificate chain.
609
059ec3d9 610Arguments:
f2f2c91b
JH
611 preverify_ok current yes/no state as 1/0
612 x509ctx certificate information.
613 tlsp per-direction (client vs. server) support data
614 calledp has-been-called flag
615 optionalp verification-is-optional flag
059ec3d9 616
f2f2c91b 617Returns: 0 if verification should fail, otherwise 1
059ec3d9
PH
618*/
619
620static int
70e384dd
JH
621verify_callback(int preverify_ok, X509_STORE_CTX * x509ctx,
622 tls_support * tlsp, BOOL * calledp, BOOL * optionalp)
059ec3d9 623{
421aff85 624X509 * cert = X509_STORE_CTX_get_current_cert(x509ctx);
a7538db1 625int depth = X509_STORE_CTX_get_error_depth(x509ctx);
f69979cf 626uschar dn[256];
059ec3d9 627
70e384dd
JH
628if (!X509_NAME_oneline(X509_get_subject_name(cert), CS dn, sizeof(dn)))
629 {
630 DEBUG(D_tls) debug_printf("X509_NAME_oneline() error\n");
631 log_write(0, LOG_MAIN, "[%s] SSL verify error: internal error",
632 tlsp == &tls_out ? deliver_host_address : sender_host_address);
633 return 0;
634 }
f69979cf 635dn[sizeof(dn)-1] = '\0';
059ec3d9 636
f4e62a87 637tlsp->verify_override = FALSE;
f2f2c91b 638if (preverify_ok == 0)
059ec3d9 639 {
f77197ae
JH
640 uschar * extra = verify_mode ? string_sprintf(" (during %c-verify for [%s])",
641 *verify_mode, sender_host_address)
642 : US"";
643 log_write(0, LOG_MAIN, "[%s] SSL verify error%s: depth=%d error=%s cert=%s",
644 tlsp == &tls_out ? deliver_host_address : sender_host_address,
645 extra, depth,
646 X509_verify_cert_error_string(X509_STORE_CTX_get_error(x509ctx)), dn);
a2ff477a 647 *calledp = TRUE;
9d1c15ef
JH
648 if (!*optionalp)
649 {
f69979cf
JH
650 if (!tlsp->peercert)
651 tlsp->peercert = X509_dup(cert); /* record failing cert */
652 return 0; /* reject */
9d1c15ef 653 }
059ec3d9
PH
654 DEBUG(D_tls) debug_printf("SSL verify failure overridden (host in "
655 "tls_try_verify_hosts)\n");
4a1bd6b9 656 tlsp->verify_override = TRUE;
059ec3d9
PH
657 }
658
a7538db1 659else if (depth != 0)
059ec3d9 660 {
f69979cf 661 DEBUG(D_tls) debug_printf("SSL verify ok: depth=%d SN=%s\n", depth, dn);
f2de3a33 662#ifndef DISABLE_OCSP
f5d78688
JH
663 if (tlsp == &tls_out && client_static_cbinfo->u_ocsp.client.verify_store)
664 { /* client, wanting stapling */
665 /* Add the server cert's signing chain as the one
666 for the verification of the OCSP stapled information. */
94431adb 667
f5d78688 668 if (!X509_STORE_add_cert(client_static_cbinfo->u_ocsp.client.verify_store,
421aff85 669 cert))
f5d78688 670 ERR_clear_error();
c3033f13 671 sk_X509_push(client_static_cbinfo->verify_stack, cert);
f5d78688
JH
672 }
673#endif
0cbf2b82 674#ifndef DISABLE_EVENT
f69979cf
JH
675 if (verify_event(tlsp, cert, depth, dn, calledp, optionalp, US"SSL"))
676 return 0; /* reject, with peercert set */
a7538db1 677#endif
059ec3d9
PH
678 }
679else
680 {
55414b25 681 const uschar * verify_cert_hostnames;
e51c7be2 682
e51c7be2
JH
683 if ( tlsp == &tls_out
684 && ((verify_cert_hostnames = client_static_cbinfo->verify_cert_hostnames)))
afdb5e9c 685 /* client, wanting hostname check */
e51c7be2 686 {
f69979cf 687
740f36d4 688#ifdef EXIM_HAVE_OPENSSL_CHECKHOST
f69979cf
JH
689# ifndef X509_CHECK_FLAG_NO_PARTIAL_WILDCARDS
690# define X509_CHECK_FLAG_NO_PARTIAL_WILDCARDS 0
691# endif
692# ifndef X509_CHECK_FLAG_SINGLE_LABEL_SUBDOMAINS
693# define X509_CHECK_FLAG_SINGLE_LABEL_SUBDOMAINS 0
694# endif
e51c7be2 695 int sep = 0;
55414b25 696 const uschar * list = verify_cert_hostnames;
e51c7be2 697 uschar * name;
d8e7834a
JH
698 int rc;
699 while ((name = string_nextinlist(&list, &sep, NULL, 0)))
f40d5be3 700 if ((rc = X509_check_host(cert, CCS name, 0,
8d692470 701 X509_CHECK_FLAG_NO_PARTIAL_WILDCARDS
740f36d4
JH
702 | X509_CHECK_FLAG_SINGLE_LABEL_SUBDOMAINS,
703 NULL)))
d8e7834a
JH
704 {
705 if (rc < 0)
706 {
93a6fce2 707 log_write(0, LOG_MAIN, "[%s] SSL verify error: internal error",
f77197ae 708 tlsp == &tls_out ? deliver_host_address : sender_host_address);
d8e7834a
JH
709 name = NULL;
710 }
e51c7be2 711 break;
d8e7834a 712 }
e51c7be2 713 if (!name)
f69979cf 714#else
e51c7be2 715 if (!tls_is_name_for_cert(verify_cert_hostnames, cert))
f69979cf 716#endif
e51c7be2 717 {
f77197ae
JH
718 uschar * extra = verify_mode
719 ? string_sprintf(" (during %c-verify for [%s])",
720 *verify_mode, sender_host_address)
721 : US"";
e51c7be2 722 log_write(0, LOG_MAIN,
f77197ae
JH
723 "[%s] SSL verify error%s: certificate name mismatch: DN=\"%s\" H=\"%s\"",
724 tlsp == &tls_out ? deliver_host_address : sender_host_address,
725 extra, dn, verify_cert_hostnames);
a3ef7310
JH
726 *calledp = TRUE;
727 if (!*optionalp)
f69979cf
JH
728 {
729 if (!tlsp->peercert)
730 tlsp->peercert = X509_dup(cert); /* record failing cert */
731 return 0; /* reject */
732 }
4a1bd6b9 733 DEBUG(D_tls) debug_printf("SSL verify name failure overridden (host in "
a3ef7310 734 "tls_try_verify_hosts)\n");
4a1bd6b9 735 tlsp->verify_override = TRUE;
e51c7be2 736 }
f69979cf 737 }
e51c7be2 738
0cbf2b82 739#ifndef DISABLE_EVENT
f69979cf
JH
740 if (verify_event(tlsp, cert, depth, dn, calledp, optionalp, US"SSL"))
741 return 0; /* reject, with peercert set */
e51c7be2
JH
742#endif
743
93dcb1c2 744 DEBUG(D_tls) debug_printf("SSL%s verify ok: depth=0 SN=%s\n",
f69979cf 745 *calledp ? "" : " authenticated", dn);
93dcb1c2 746 *calledp = TRUE;
059ec3d9
PH
747 }
748
a7538db1 749return 1; /* accept, at least for this level */
059ec3d9
PH
750}
751
a2ff477a 752static int
f2f2c91b 753verify_callback_client(int preverify_ok, X509_STORE_CTX *x509ctx)
a2ff477a 754{
f2f2c91b
JH
755return verify_callback(preverify_ok, x509ctx, &tls_out,
756 &client_verify_callback_called, &client_verify_optional);
a2ff477a
JH
757}
758
759static int
f2f2c91b 760verify_callback_server(int preverify_ok, X509_STORE_CTX *x509ctx)
a2ff477a 761{
f2f2c91b
JH
762return verify_callback(preverify_ok, x509ctx, &tls_in,
763 &server_verify_callback_called, &server_verify_optional);
a2ff477a
JH
764}
765
059ec3d9 766
c0635b6d 767#ifdef SUPPORT_DANE
53a7196b 768
e5cccda9
JH
769/* This gets called *by* the dane library verify callback, which interposes
770itself.
771*/
772static int
f2f2c91b 773verify_callback_client_dane(int preverify_ok, X509_STORE_CTX * x509ctx)
e5cccda9
JH
774{
775X509 * cert = X509_STORE_CTX_get_current_cert(x509ctx);
f69979cf 776uschar dn[256];
83b27293 777int depth = X509_STORE_CTX_get_error_depth(x509ctx);
5c75db2e 778#ifndef DISABLE_EVENT
f69979cf 779BOOL dummy_called, optional = FALSE;
83b27293 780#endif
e5cccda9 781
70e384dd
JH
782if (!X509_NAME_oneline(X509_get_subject_name(cert), CS dn, sizeof(dn)))
783 {
784 DEBUG(D_tls) debug_printf("X509_NAME_oneline() error\n");
785 log_write(0, LOG_MAIN, "[%s] SSL verify error: internal error",
786 deliver_host_address);
787 return 0;
788 }
f69979cf 789dn[sizeof(dn)-1] = '\0';
e5cccda9 790
f2f2c91b
JH
791DEBUG(D_tls) debug_printf("verify_callback_client_dane: %s depth %d %s\n",
792 preverify_ok ? "ok":"BAD", depth, dn);
e5cccda9 793
0cbf2b82 794#ifndef DISABLE_EVENT
f69979cf
JH
795 if (verify_event(&tls_out, cert, depth, dn,
796 &dummy_called, &optional, US"DANE"))
797 return 0; /* reject, with peercert set */
83b27293
JH
798#endif
799
f2f2c91b 800if (preverify_ok == 1)
6fbf3599 801 {
4a1bd6b9 802 tls_out.dane_verified = TRUE;
6fbf3599
JH
803#ifndef DISABLE_OCSP
804 if (client_static_cbinfo->u_ocsp.client.verify_store)
805 { /* client, wanting stapling */
806 /* Add the server cert's signing chain as the one
807 for the verification of the OCSP stapled information. */
808
809 if (!X509_STORE_add_cert(client_static_cbinfo->u_ocsp.client.verify_store,
810 cert))
811 ERR_clear_error();
812 sk_X509_push(client_static_cbinfo->verify_stack, cert);
813 }
814#endif
815 }
f2f2c91b
JH
816else
817 {
818 int err = X509_STORE_CTX_get_error(x509ctx);
819 DEBUG(D_tls)
820 debug_printf(" - err %d '%s'\n", err, X509_verify_cert_error_string(err));
3c51463e 821 if (err == X509_V_ERR_APPLICATION_VERIFICATION)
f2f2c91b
JH
822 preverify_ok = 1;
823 }
824return preverify_ok;
e5cccda9 825}
53a7196b 826
c0635b6d 827#endif /*SUPPORT_DANE*/
e5cccda9 828
059ec3d9
PH
829
830/*************************************************
831* Information callback *
832*************************************************/
833
834/* The SSL library functions call this from time to time to indicate what they
7be682ca
PP
835are doing. We copy the string to the debugging output when TLS debugging has
836been requested.
059ec3d9
PH
837
838Arguments:
839 s the SSL connection
840 where
841 ret
842
843Returns: nothing
844*/
845
846static void
847info_callback(SSL *s, int where, int ret)
848{
0abc5a13
JH
849DEBUG(D_tls)
850 {
851 const uschar * str;
852
853 if (where & SSL_ST_CONNECT)
48224640 854 str = US"SSL_connect";
0abc5a13 855 else if (where & SSL_ST_ACCEPT)
48224640 856 str = US"SSL_accept";
0abc5a13 857 else
48224640 858 str = US"SSL info (undefined)";
0abc5a13
JH
859
860 if (where & SSL_CB_LOOP)
861 debug_printf("%s: %s\n", str, SSL_state_string_long(s));
862 else if (where & SSL_CB_ALERT)
863 debug_printf("SSL3 alert %s:%s:%s\n",
48224640 864 str = where & SSL_CB_READ ? US"read" : US"write",
0abc5a13
JH
865 SSL_alert_type_string_long(ret), SSL_alert_desc_string_long(ret));
866 else if (where & SSL_CB_EXIT)
867 if (ret == 0)
868 debug_printf("%s: failed in %s\n", str, SSL_state_string_long(s));
869 else if (ret < 0)
870 debug_printf("%s: error in %s\n", str, SSL_state_string_long(s));
871 else if (where & SSL_CB_HANDSHAKE_START)
872 debug_printf("%s: hshake start: %s\n", str, SSL_state_string_long(s));
873 else if (where & SSL_CB_HANDSHAKE_DONE)
874 debug_printf("%s: hshake done: %s\n", str, SSL_state_string_long(s));
875 }
059ec3d9
PH
876}
877
8238bc7b 878#ifdef OPENSSL_HAVE_KEYLOG_CB
8a40db1c
JH
879static void
880keylog_callback(const SSL *ssl, const char *line)
881{
2e5d9e71
JH
882char * filename;
883FILE * fp;
8a40db1c 884DEBUG(D_tls) debug_printf("%.200s\n", line);
2e5d9e71
JH
885if (!(filename = getenv("SSLKEYLOGFILE"))) return;
886if (!(fp = fopen(filename, "a"))) return;
887fprintf(fp, "%s\n", line);
888fclose(fp);
8a40db1c 889}
8238bc7b 890#endif
8a40db1c 891
059ec3d9 892
b10c87b3
JH
893#ifdef EXPERIMENTAL_TLS_RESUME
894/* Manage the keysets used for encrypting the session tickets, on the server. */
895
896typedef struct { /* Session ticket encryption key */
897 uschar name[16];
898
899 const EVP_CIPHER * aes_cipher;
4d93129f 900 uschar aes_key[32]; /* size needed depends on cipher. aes_128 implies 128/8 = 16? */
b10c87b3
JH
901 const EVP_MD * hmac_hash;
902 uschar hmac_key[16];
903 time_t renew;
904 time_t expire;
905} exim_stek;
906
4d93129f
JH
907static exim_stek exim_tk; /* current key */
908static exim_stek exim_tk_old; /* previous key */
b10c87b3
JH
909
910static void
911tk_init(void)
912{
4d93129f
JH
913time_t t = time(NULL);
914
b10c87b3
JH
915if (exim_tk.name[0])
916 {
4d93129f 917 if (exim_tk.renew >= t) return;
b10c87b3
JH
918 exim_tk_old = exim_tk;
919 }
920
921if (f.running_in_test_harness) ssl_session_timeout = 6;
922
923DEBUG(D_tls) debug_printf("OpenSSL: %s STEK\n", exim_tk.name[0] ? "rotating" : "creating");
924if (RAND_bytes(exim_tk.aes_key, sizeof(exim_tk.aes_key)) <= 0) return;
925if (RAND_bytes(exim_tk.hmac_key, sizeof(exim_tk.hmac_key)) <= 0) return;
926if (RAND_bytes(exim_tk.name+1, sizeof(exim_tk.name)-1) <= 0) return;
927
928exim_tk.name[0] = 'E';
4d93129f 929exim_tk.aes_cipher = EVP_aes_256_cbc();
b10c87b3 930exim_tk.hmac_hash = EVP_sha256();
4d93129f
JH
931exim_tk.expire = t + ssl_session_timeout;
932exim_tk.renew = t + ssl_session_timeout/2;
b10c87b3
JH
933}
934
935static exim_stek *
936tk_current(void)
937{
938if (!exim_tk.name[0]) return NULL;
939return &exim_tk;
940}
941
942static exim_stek *
943tk_find(const uschar * name)
944{
945return memcmp(name, exim_tk.name, sizeof(exim_tk.name)) == 0 ? &exim_tk
946 : memcmp(name, exim_tk_old.name, sizeof(exim_tk_old.name)) == 0 ? &exim_tk_old
947 : NULL;
948}
949
950/* Callback for session tickets, on server */
951static int
952ticket_key_callback(SSL * ssl, uschar key_name[16],
953 uschar * iv, EVP_CIPHER_CTX * ctx, HMAC_CTX * hctx, int enc)
954{
955tls_support * tlsp = server_static_cbinfo->tlsp;
956exim_stek * key;
957
958if (enc)
959 {
960 DEBUG(D_tls) debug_printf("ticket_key_callback: create new session\n");
961 tlsp->resumption |= RESUME_CLIENT_REQUESTED;
962
963 if (RAND_bytes(iv, EVP_MAX_IV_LENGTH) <= 0)
964 return -1; /* insufficient random */
965
966 if (!(key = tk_current())) /* current key doesn't exist or isn't valid */
967 return 0; /* key couldn't be created */
968 memcpy(key_name, key->name, 16);
d70fc283 969 DEBUG(D_tls) debug_printf("STEK expire " TIME_T_FMT "\n", key->expire - time(NULL));
b10c87b3
JH
970
971 /*XXX will want these dependent on the ssl session strength */
972 HMAC_Init_ex(hctx, key->hmac_key, sizeof(key->hmac_key),
973 key->hmac_hash, NULL);
974 EVP_EncryptInit_ex(ctx, key->aes_cipher, NULL, key->aes_key, iv);
975
976 DEBUG(D_tls) debug_printf("ticket created\n");
977 return 1;
978 }
979else
980 {
981 time_t now = time(NULL);
982
983 DEBUG(D_tls) debug_printf("ticket_key_callback: retrieve session\n");
984 tlsp->resumption |= RESUME_CLIENT_SUGGESTED;
985
986 if (!(key = tk_find(key_name)) || key->expire < now)
987 {
988 DEBUG(D_tls)
989 {
990 debug_printf("ticket not usable (%s)\n", key ? "expired" : "not found");
d70fc283 991 if (key) debug_printf("STEK expire " TIME_T_FMT "\n", key->expire - now);
b10c87b3
JH
992 }
993 return 0;
994 }
995
996 HMAC_Init_ex(hctx, key->hmac_key, sizeof(key->hmac_key),
997 key->hmac_hash, NULL);
998 EVP_DecryptInit_ex(ctx, key->aes_cipher, NULL, key->aes_key, iv);
999
d70fc283 1000 DEBUG(D_tls) debug_printf("ticket usable, STEK expire " TIME_T_FMT "\n", key->expire - now);
dea4b568
JH
1001
1002 /* The ticket lifetime and renewal are the same as the STEK lifetime and
1003 renewal, which is overenthusiastic. A factor of, say, 3x longer STEK would
1004 be better. To do that we'd have to encode ticket lifetime in the name as
1005 we don't yet see the restored session. Could check posthandshake for TLS1.3
1006 and trigger a new ticket then, but cannot do that for TLS1.2 */
b10c87b3
JH
1007 return key->renew < now ? 2 : 1;
1008 }
1009}
1010#endif
1011
1012
059ec3d9
PH
1013
1014/*************************************************
1015* Initialize for DH *
1016*************************************************/
1017
1018/* If dhparam is set, expand it, and load up the parameters for DH encryption.
1019
1020Arguments:
038597d2 1021 sctx The current SSL CTX (inbound or outbound)
a799883d 1022 dhparam DH parameter file or fixed parameter identity string
7199e1ee 1023 host connected host, if client; NULL if server
cf0c6164 1024 errstr error string pointer
059ec3d9
PH
1025
1026Returns: TRUE if OK (nothing to set up, or setup worked)
1027*/
1028
1029static BOOL
cf0c6164 1030init_dh(SSL_CTX *sctx, uschar *dhparam, const host_item *host, uschar ** errstr)
059ec3d9 1031{
059ec3d9
PH
1032BIO *bio;
1033DH *dh;
1034uschar *dhexpanded;
a799883d 1035const char *pem;
6600985a 1036int dh_bitsize;
059ec3d9 1037
cf0c6164 1038if (!expand_check(dhparam, US"tls_dhparam", &dhexpanded, errstr))
059ec3d9
PH
1039 return FALSE;
1040
0df4ab80 1041if (!dhexpanded || !*dhexpanded)
a799883d 1042 bio = BIO_new_mem_buf(CS std_dh_prime_default(), -1);
a799883d 1043else if (dhexpanded[0] == '/')
059ec3d9 1044 {
0df4ab80 1045 if (!(bio = BIO_new_file(CS dhexpanded, "r")))
059ec3d9 1046 {
7199e1ee 1047 tls_error(string_sprintf("could not read dhparams file %s", dhexpanded),
cf0c6164 1048 host, US strerror(errno), errstr);
a799883d 1049 return FALSE;
059ec3d9 1050 }
a799883d
PP
1051 }
1052else
1053 {
1054 if (Ustrcmp(dhexpanded, "none") == 0)
059ec3d9 1055 {
a799883d
PP
1056 DEBUG(D_tls) debug_printf("Requested no DH parameters.\n");
1057 return TRUE;
059ec3d9 1058 }
a799883d 1059
0df4ab80 1060 if (!(pem = std_dh_prime_named(dhexpanded)))
a799883d
PP
1061 {
1062 tls_error(string_sprintf("Unknown standard DH prime \"%s\"", dhexpanded),
cf0c6164 1063 host, US strerror(errno), errstr);
a799883d
PP
1064 return FALSE;
1065 }
1066 bio = BIO_new_mem_buf(CS pem, -1);
1067 }
1068
0df4ab80 1069if (!(dh = PEM_read_bio_DHparams(bio, NULL, NULL, NULL)))
a799883d 1070 {
059ec3d9 1071 BIO_free(bio);
a799883d 1072 tls_error(string_sprintf("Could not read tls_dhparams \"%s\"", dhexpanded),
cf0c6164 1073 host, NULL, errstr);
a799883d
PP
1074 return FALSE;
1075 }
1076
6600985a
PP
1077/* note: our default limit of 2236 is not a multiple of 8; the limit comes from
1078 * an NSS limit, and the GnuTLS APIs handle bit-sizes fine, so we went with
1079 * 2236. But older OpenSSL can only report in bytes (octets), not bits.
1080 * If someone wants to dance at the edge, then they can raise the limit or use
1081 * current libraries. */
1082#ifdef EXIM_HAVE_OPENSSL_DH_BITS
1083/* Added in commit 26c79d5641d; `git describe --contains` says OpenSSL_1_1_0-pre1~1022
1084 * This predates OpenSSL_1_1_0 (before a, b, ...) so is in all 1.1.0 */
1085dh_bitsize = DH_bits(dh);
1086#else
1087dh_bitsize = 8 * DH_size(dh);
1088#endif
1089
a799883d
PP
1090/* Even if it is larger, we silently return success rather than cause things
1091 * to fail out, so that a too-large DH will not knock out all TLS; it's a
1092 * debatable choice. */
6600985a 1093if (dh_bitsize > tls_dh_max_bits)
a799883d
PP
1094 {
1095 DEBUG(D_tls)
170f4904 1096 debug_printf("dhparams file %d bits, is > tls_dh_max_bits limit of %d\n",
6600985a 1097 dh_bitsize, tls_dh_max_bits);
a799883d
PP
1098 }
1099else
1100 {
1101 SSL_CTX_set_tmp_dh(sctx, dh);
1102 DEBUG(D_tls)
1103 debug_printf("Diffie-Hellman initialized from %s with %d-bit prime\n",
6600985a 1104 dhexpanded ? dhexpanded : US"default", dh_bitsize);
059ec3d9
PH
1105 }
1106
a799883d
PP
1107DH_free(dh);
1108BIO_free(bio);
1109
1110return TRUE;
059ec3d9
PH
1111}
1112
1113
1114
1115
038597d2
PP
1116/*************************************************
1117* Initialize for ECDH *
1118*************************************************/
1119
1120/* Load parameters for ECDH encryption.
1121
1122For now, we stick to NIST P-256 because: it's simple and easy to configure;
1123it avoids any patent issues that might bite redistributors; despite events in
1124the news and concerns over curve choices, we're not cryptographers, we're not
1125pretending to be, and this is "good enough" to be better than no support,
1126protecting against most adversaries. Given another year or two, there might
1127be sufficient clarity about a "right" way forward to let us make an informed
1128decision, instead of a knee-jerk reaction.
1129
1130Longer-term, we should look at supporting both various named curves and
1131external files generated with "openssl ecparam", much as we do for init_dh().
1132We should also support "none" as a value, to explicitly avoid initialisation.
1133
1134Patches welcome.
1135
1136Arguments:
1137 sctx The current SSL CTX (inbound or outbound)
1138 host connected host, if client; NULL if server
cf0c6164 1139 errstr error string pointer
038597d2
PP
1140
1141Returns: TRUE if OK (nothing to set up, or setup worked)
1142*/
1143
1144static BOOL
cf0c6164 1145init_ecdh(SSL_CTX * sctx, host_item * host, uschar ** errstr)
038597d2 1146{
63f0dbe0
JH
1147#ifdef OPENSSL_NO_ECDH
1148return TRUE;
1149#else
1150
10ca4f1c
JH
1151EC_KEY * ecdh;
1152uschar * exp_curve;
1153int nid;
1154BOOL rv;
1155
038597d2
PP
1156if (host) /* No ECDH setup for clients, only for servers */
1157 return TRUE;
1158
10ca4f1c 1159# ifndef EXIM_HAVE_ECDH
038597d2
PP
1160DEBUG(D_tls)
1161 debug_printf("No OpenSSL API to define ECDH parameters, skipping\n");
1162return TRUE;
038597d2 1163# else
10ca4f1c 1164
cf0c6164 1165if (!expand_check(tls_eccurve, US"tls_eccurve", &exp_curve, errstr))
10ca4f1c
JH
1166 return FALSE;
1167if (!exp_curve || !*exp_curve)
1168 return TRUE;
1169
8e53a4fc 1170/* "auto" needs to be handled carefully.
4c04137d 1171 * OpenSSL < 1.0.2: we do not select anything, but fallback to prime256v1
8e53a4fc 1172 * OpenSSL < 1.1.0: we have to call SSL_CTX_set_ecdh_auto
4c04137d 1173 * (openssl/ssl.h defines SSL_CTRL_SET_ECDH_AUTO)
8e53a4fc
HSHR
1174 * OpenSSL >= 1.1.0: we do not set anything, the libray does autoselection
1175 * https://github.com/openssl/openssl/commit/fe6ef2472db933f01b59cad82aa925736935984b
1176 */
10ca4f1c 1177if (Ustrcmp(exp_curve, "auto") == 0)
038597d2 1178 {
8e53a4fc 1179#if OPENSSL_VERSION_NUMBER < 0x10002000L
10ca4f1c 1180 DEBUG(D_tls) debug_printf(
8e53a4fc 1181 "ECDH OpenSSL < 1.0.2: temp key parameter settings: overriding \"auto\" with \"prime256v1\"\n");
78a3bbd5 1182 exp_curve = US"prime256v1";
8e53a4fc
HSHR
1183#else
1184# if defined SSL_CTRL_SET_ECDH_AUTO
1185 DEBUG(D_tls) debug_printf(
1186 "ECDH OpenSSL 1.0.2+ temp key parameter settings: autoselection\n");
10ca4f1c
JH
1187 SSL_CTX_set_ecdh_auto(sctx, 1);
1188 return TRUE;
8e53a4fc
HSHR
1189# else
1190 DEBUG(D_tls) debug_printf(
1191 "ECDH OpenSSL 1.1.0+ temp key parameter settings: default selection\n");
1192 return TRUE;
1193# endif
1194#endif
10ca4f1c 1195 }
038597d2 1196
10ca4f1c
JH
1197DEBUG(D_tls) debug_printf("ECDH: curve '%s'\n", exp_curve);
1198if ( (nid = OBJ_sn2nid (CCS exp_curve)) == NID_undef
1199# ifdef EXIM_HAVE_OPENSSL_EC_NIST2NID
1200 && (nid = EC_curve_nist2nid(CCS exp_curve)) == NID_undef
1201# endif
1202 )
1203 {
cf0c6164
JH
1204 tls_error(string_sprintf("Unknown curve name tls_eccurve '%s'", exp_curve),
1205 host, NULL, errstr);
10ca4f1c
JH
1206 return FALSE;
1207 }
038597d2 1208
10ca4f1c
JH
1209if (!(ecdh = EC_KEY_new_by_curve_name(nid)))
1210 {
cf0c6164 1211 tls_error(US"Unable to create ec curve", host, NULL, errstr);
10ca4f1c 1212 return FALSE;
038597d2 1213 }
10ca4f1c
JH
1214
1215/* The "tmp" in the name here refers to setting a temporary key
1216not to the stability of the interface. */
1217
1218if ((rv = SSL_CTX_set_tmp_ecdh(sctx, ecdh) == 0))
cf0c6164 1219 tls_error(string_sprintf("Error enabling '%s' curve", exp_curve), host, NULL, errstr);
10ca4f1c
JH
1220else
1221 DEBUG(D_tls) debug_printf("ECDH: enabled '%s' curve\n", exp_curve);
1222
1223EC_KEY_free(ecdh);
1224return !rv;
1225
1226# endif /*EXIM_HAVE_ECDH*/
1227#endif /*OPENSSL_NO_ECDH*/
038597d2
PP
1228}
1229
1230
1231
1232
f2de3a33 1233#ifndef DISABLE_OCSP
3f7eeb86
PP
1234/*************************************************
1235* Load OCSP information into state *
1236*************************************************/
f5d78688 1237/* Called to load the server OCSP response from the given file into memory, once
3f7eeb86
PP
1238caller has determined this is needed. Checks validity. Debugs a message
1239if invalid.
1240
1241ASSUMES: single response, for single cert.
1242
1243Arguments:
1244 sctx the SSL_CTX* to update
1245 cbinfo various parts of session state
5b2fd993 1246 filename the filename putatively holding an OCSP response
86ede124 1247 is_pem file is PEM format; otherwise is DER
3f7eeb86
PP
1248
1249*/
1250
1251static void
5b2fd993 1252ocsp_load_response(SSL_CTX * sctx, tls_ext_ctx_cb * cbinfo,
86ede124 1253 const uschar * filename, BOOL is_pem)
3f7eeb86 1254{
ee5b1e28
JH
1255BIO * bio;
1256OCSP_RESPONSE * resp;
1257OCSP_BASICRESP * basic_response;
1258OCSP_SINGLERESP * single_response;
1259ASN1_GENERALIZEDTIME * rev, * thisupd, * nextupd;
ee5b1e28 1260STACK_OF(X509) * sk;
3f7eeb86
PP
1261unsigned long verify_flags;
1262int status, reason, i;
1263
86ede124
JH
1264DEBUG(D_tls)
1265 debug_printf("tls_ocsp_file (%s) '%s'\n", is_pem ? "PEM" : "DER", filename);
3f7eeb86 1266
5b2fd993 1267if (!(bio = BIO_new_file(CS filename, "rb")))
3f7eeb86
PP
1268 {
1269 DEBUG(D_tls) debug_printf("Failed to open OCSP response file \"%s\"\n",
5b2fd993 1270 filename);
3f7eeb86
PP
1271 return;
1272 }
1273
86ede124
JH
1274if (is_pem)
1275 {
1276 uschar * data, * freep;
1277 char * dummy;
1278 long len;
1279 if (!PEM_read_bio(bio, &dummy, &dummy, &data, &len))
1280 {
1281 DEBUG(D_tls) debug_printf("Failed to read PEM file \"%s\"\n",
1282 filename);
1283 return;
1284 }
1285debug_printf("read pem file\n");
1286 freep = data;
1287 resp = d2i_OCSP_RESPONSE(NULL, CUSS &data, len);
1288 OPENSSL_free(freep);
1289 }
1290else
1291 resp = d2i_OCSP_RESPONSE_bio(bio, NULL);
3f7eeb86 1292BIO_free(bio);
86ede124 1293
3f7eeb86
PP
1294if (!resp)
1295 {
1296 DEBUG(D_tls) debug_printf("Error reading OCSP response.\n");
1297 return;
1298 }
1299
ee5b1e28 1300if ((status = OCSP_response_status(resp)) != OCSP_RESPONSE_STATUS_SUCCESSFUL)
3f7eeb86
PP
1301 {
1302 DEBUG(D_tls) debug_printf("OCSP response not valid: %s (%d)\n",
1303 OCSP_response_status_str(status), status);
f5d78688 1304 goto bad;
3f7eeb86
PP
1305 }
1306
5b2fd993
JH
1307#ifdef notdef
1308 {
1309 BIO * bp = BIO_new_fp(debug_file, BIO_NOCLOSE);
1310 OCSP_RESPONSE_print(bp, resp, 0); /* extreme debug: stapling content */
1311 BIO_free(bp);
1312 }
1313#endif
1314
ee5b1e28 1315if (!(basic_response = OCSP_response_get1_basic(resp)))
3f7eeb86
PP
1316 {
1317 DEBUG(D_tls)
1318 debug_printf("OCSP response parse error: unable to extract basic response.\n");
f5d78688 1319 goto bad;
3f7eeb86
PP
1320 }
1321
c3033f13 1322sk = cbinfo->verify_stack;
3f7eeb86
PP
1323verify_flags = OCSP_NOVERIFY; /* check sigs, but not purpose */
1324
1325/* May need to expose ability to adjust those flags?
1326OCSP_NOSIGS OCSP_NOVERIFY OCSP_NOCHAIN OCSP_NOCHECKS OCSP_NOEXPLICIT
1327OCSP_TRUSTOTHER OCSP_NOINTERN */
1328
4c04137d 1329/* This does a full verify on the OCSP proof before we load it for serving
ee5b1e28
JH
1330up; possibly overkill - just date-checks might be nice enough.
1331
1332OCSP_basic_verify takes a "store" arg, but does not
1333use it for the chain verification, which is all we do
1334when OCSP_NOVERIFY is set. The content from the wire
1335"basic_response" and a cert-stack "sk" are all that is used.
1336
c3033f13
JH
1337We have a stack, loaded in setup_certs() if tls_verify_certificates
1338was a file (not a directory, or "system"). It is unfortunate we
1339cannot used the connection context store, as that would neatly
1340handle the "system" case too, but there seems to be no library
1341function for getting a stack from a store.
e3555426 1342[ In OpenSSL 1.1 - ? X509_STORE_CTX_get0_chain(ctx) ? ]
c3033f13
JH
1343We do not free the stack since it could be needed a second time for
1344SNI handling.
1345
4c04137d 1346Separately we might try to replace using OCSP_basic_verify() - which seems to not
5ec37a55 1347be a public interface into the OpenSSL library (there's no manual entry) -
ee5b1e28 1348But what with? We also use OCSP_basic_verify in the client stapling callback.
4c04137d 1349And there we NEED it; we must verify that status... unless the
ee5b1e28
JH
1350library does it for us anyway? */
1351
1352if ((i = OCSP_basic_verify(basic_response, sk, NULL, verify_flags)) < 0)
3f7eeb86 1353 {
ee5b1e28
JH
1354 DEBUG(D_tls)
1355 {
0abc5a13 1356 ERR_error_string_n(ERR_get_error(), ssl_errstring, sizeof(ssl_errstring));
3f7eeb86 1357 debug_printf("OCSP response verify failure: %s\n", US ssl_errstring);
f5d78688
JH
1358 }
1359 goto bad;
3f7eeb86
PP
1360 }
1361
1362/* Here's the simplifying assumption: there's only one response, for the
1363one certificate we use, and nothing for anything else in a chain. If this
1364proves false, we need to extract a cert id from our issued cert
1365(tls_certificate) and use that for OCSP_resp_find_status() (which finds the
1366right cert in the stack and then calls OCSP_single_get0_status()).
1367
5b2fd993
JH
1368I'm hoping to avoid reworking a bunch more of how we handle state here.
1369
1370XXX that will change when we add support for (TLS1.3) whole-chain stapling
1371*/
ee5b1e28
JH
1372
1373if (!(single_response = OCSP_resp_get0(basic_response, 0)))
3f7eeb86
PP
1374 {
1375 DEBUG(D_tls)
1376 debug_printf("Unable to get first response from OCSP basic response.\n");
f5d78688 1377 goto bad;
3f7eeb86
PP
1378 }
1379
1380status = OCSP_single_get0_status(single_response, &reason, &rev, &thisupd, &nextupd);
f5d78688 1381if (status != V_OCSP_CERTSTATUS_GOOD)
3f7eeb86 1382 {
f5d78688
JH
1383 DEBUG(D_tls) debug_printf("OCSP response bad cert status: %s (%d) %s (%d)\n",
1384 OCSP_cert_status_str(status), status,
1385 OCSP_crl_reason_str(reason), reason);
1386 goto bad;
3f7eeb86
PP
1387 }
1388
1389if (!OCSP_check_validity(thisupd, nextupd, EXIM_OCSP_SKEW_SECONDS, EXIM_OCSP_MAX_AGE))
1390 {
1391 DEBUG(D_tls) debug_printf("OCSP status invalid times.\n");
f5d78688 1392 goto bad;
3f7eeb86
PP
1393 }
1394
f5d78688 1395supply_response:
5b2fd993
JH
1396 /* Add the resp to the list used by tls_server_stapling_cb() */
1397 {
1398 ocsp_resplist ** op = &cbinfo->u_ocsp.server.olist, * oentry;
1399 while (oentry = *op)
1400 op = &oentry->next;
1401 *op = oentry = store_get(sizeof(ocsp_resplist), FALSE);
1402 oentry->next = NULL;
1403 oentry->resp = resp;
1404 }
f5d78688
JH
1405return;
1406
1407bad:
8768d548 1408 if (f.running_in_test_harness)
018058b2
JH
1409 {
1410 extern char ** environ;
d7978c0f 1411 if (environ) for (uschar ** p = USS environ; *p; p++)
018058b2
JH
1412 if (Ustrncmp(*p, "EXIM_TESTHARNESS_DISABLE_OCSPVALIDITYCHECK", 42) == 0)
1413 {
1414 DEBUG(D_tls) debug_printf("Supplying known bad OCSP response\n");
1415 goto supply_response;
1416 }
1417 }
f5d78688 1418return;
3f7eeb86 1419}
5b2fd993
JH
1420
1421
1422static void
1423ocsp_free_response_list(tls_ext_ctx_cb * cbinfo)
1424{
1425for (ocsp_resplist * olist = cbinfo->u_ocsp.server.olist; olist;
1426 olist = olist->next)
1427 OCSP_RESPONSE_free(olist->resp);
1428cbinfo->u_ocsp.server.olist = NULL;
1429}
f2de3a33 1430#endif /*!DISABLE_OCSP*/
3f7eeb86
PP
1431
1432
1433
1434
23bb6982
JH
1435/* Create and install a selfsigned certificate, for use in server mode */
1436
1437static int
cf0c6164 1438tls_install_selfsign(SSL_CTX * sctx, uschar ** errstr)
23bb6982
JH
1439{
1440X509 * x509 = NULL;
1441EVP_PKEY * pkey;
1442RSA * rsa;
1443X509_NAME * name;
1444uschar * where;
1445
1446where = US"allocating pkey";
1447if (!(pkey = EVP_PKEY_new()))
1448 goto err;
1449
1450where = US"allocating cert";
1451if (!(x509 = X509_new()))
1452 goto err;
1453
1454where = US"generating pkey";
6aac3239 1455if (!(rsa = rsa_callback(NULL, 0, 2048)))
23bb6982
JH
1456 goto err;
1457
4c04137d 1458where = US"assigning pkey";
23bb6982
JH
1459if (!EVP_PKEY_assign_RSA(pkey, rsa))
1460 goto err;
1461
1462X509_set_version(x509, 2); /* N+1 - version 3 */
1613fd68 1463ASN1_INTEGER_set(X509_get_serialNumber(x509), 1);
23bb6982
JH
1464X509_gmtime_adj(X509_get_notBefore(x509), 0);
1465X509_gmtime_adj(X509_get_notAfter(x509), (long)60 * 60); /* 1 hour */
1466X509_set_pubkey(x509, pkey);
1467
1468name = X509_get_subject_name(x509);
1469X509_NAME_add_entry_by_txt(name, "C",
4dc2379a 1470 MBSTRING_ASC, CUS "UK", -1, -1, 0);
23bb6982 1471X509_NAME_add_entry_by_txt(name, "O",
4dc2379a 1472 MBSTRING_ASC, CUS "Exim Developers", -1, -1, 0);
23bb6982 1473X509_NAME_add_entry_by_txt(name, "CN",
4dc2379a 1474 MBSTRING_ASC, CUS smtp_active_hostname, -1, -1, 0);
23bb6982
JH
1475X509_set_issuer_name(x509, name);
1476
1477where = US"signing cert";
1478if (!X509_sign(x509, pkey, EVP_md5()))
1479 goto err;
1480
1481where = US"installing selfsign cert";
1482if (!SSL_CTX_use_certificate(sctx, x509))
1483 goto err;
1484
1485where = US"installing selfsign key";
1486if (!SSL_CTX_use_PrivateKey(sctx, pkey))
1487 goto err;
1488
1489return OK;
1490
1491err:
cf0c6164 1492 (void) tls_error(where, NULL, NULL, errstr);
23bb6982
JH
1493 if (x509) X509_free(x509);
1494 if (pkey) EVP_PKEY_free(pkey);
1495 return DEFER;
1496}
1497
1498
1499
1500
ba86e143
JH
1501static int
1502tls_add_certfile(SSL_CTX * sctx, tls_ext_ctx_cb * cbinfo, uschar * file,
1503 uschar ** errstr)
1504{
5b2fd993 1505DEBUG(D_tls) debug_printf("tls_certificate file '%s'\n", file);
ba86e143
JH
1506if (!SSL_CTX_use_certificate_chain_file(sctx, CS file))
1507 return tls_error(string_sprintf(
1508 "SSL_CTX_use_certificate_chain_file file=%s", file),
1509 cbinfo->host, NULL, errstr);
1510return 0;
1511}
1512
1513static int
1514tls_add_pkeyfile(SSL_CTX * sctx, tls_ext_ctx_cb * cbinfo, uschar * file,
1515 uschar ** errstr)
1516{
5b2fd993 1517DEBUG(D_tls) debug_printf("tls_privatekey file '%s'\n", file);
ba86e143
JH
1518if (!SSL_CTX_use_PrivateKey_file(sctx, CS file, SSL_FILETYPE_PEM))
1519 return tls_error(string_sprintf(
1520 "SSL_CTX_use_PrivateKey_file file=%s", file), cbinfo->host, NULL, errstr);
1521return 0;
1522}
1523
1524
059ec3d9 1525/*************************************************
7be682ca
PP
1526* Expand key and cert file specs *
1527*************************************************/
1528
f5d78688 1529/* Called once during tls_init and possibly again during TLS setup, for a
7be682ca
PP
1530new context, if Server Name Indication was used and tls_sni was seen in
1531the certificate string.
1532
1533Arguments:
1534 sctx the SSL_CTX* to update
1535 cbinfo various parts of session state
cf0c6164 1536 errstr error string pointer
7be682ca
PP
1537
1538Returns: OK/DEFER/FAIL
1539*/
1540
1541static int
5b2fd993 1542tls_expand_session_files(SSL_CTX * sctx, tls_ext_ctx_cb * cbinfo,
cf0c6164 1543 uschar ** errstr)
7be682ca 1544{
5b2fd993 1545uschar * expanded;
7be682ca 1546
23bb6982 1547if (!cbinfo->certificate)
7be682ca 1548 {
ba86e143 1549 if (!cbinfo->is_server) /* client */
23bb6982 1550 return OK;
afdb5e9c 1551 /* server */
cf0c6164 1552 if (tls_install_selfsign(sctx, errstr) != OK)
23bb6982 1553 return DEFER;
7be682ca 1554 }
23bb6982
JH
1555else
1556 {
ba86e143
JH
1557 int err;
1558
5b2fd993
JH
1559 if ( !reexpand_tls_files_for_sni
1560 && ( Ustrstr(cbinfo->certificate, US"tls_sni")
1561 || Ustrstr(cbinfo->certificate, US"tls_in_sni")
1562 || Ustrstr(cbinfo->certificate, US"tls_out_sni")
1563 ) )
23bb6982 1564 reexpand_tls_files_for_sni = TRUE;
7be682ca 1565
cf0c6164 1566 if (!expand_check(cbinfo->certificate, US"tls_certificate", &expanded, errstr))
23bb6982
JH
1567 return DEFER;
1568
ba86e143
JH
1569 if (expanded)
1570 if (cbinfo->is_server)
1571 {
1572 const uschar * file_list = expanded;
1573 int sep = 0;
1574 uschar * file;
5b2fd993
JH
1575#ifndef DISABLE_OCSP
1576 const uschar * olist = cbinfo->u_ocsp.server.file;
1577 int osep = 0;
1578 uschar * ofile;
86ede124 1579 BOOL fmt_pem = FALSE;
5b2fd993
JH
1580
1581 if (olist)
1582 if (!expand_check(olist, US"tls_ocsp_file", USS &olist, errstr))
1583 return DEFER;
1584 if (olist && !*olist)
1585 olist = NULL;
1586
1587 if ( cbinfo->u_ocsp.server.file_expanded && olist
1588 && (Ustrcmp(olist, cbinfo->u_ocsp.server.file_expanded) == 0))
1589 {
1590 DEBUG(D_tls) debug_printf(" - value unchanged, using existing values\n");
1591 olist = NULL;
1592 }
1593 else
1594 {
1595 ocsp_free_response_list(cbinfo);
1596 cbinfo->u_ocsp.server.file_expanded = olist;
1597 }
1598#endif
ba86e143
JH
1599
1600 while (file = string_nextinlist(&file_list, &sep, NULL, 0))
5b2fd993 1601 {
ba86e143
JH
1602 if ((err = tls_add_certfile(sctx, cbinfo, file, errstr)))
1603 return err;
5b2fd993
JH
1604
1605#ifndef DISABLE_OCSP
1606 if (olist)
1607 if ((ofile = string_nextinlist(&olist, &osep, NULL, 0)))
86ede124
JH
1608 {
1609 if (Ustrncmp(ofile, US"PEM ", 4) == 0)
1610 {
1611 fmt_pem = TRUE;
1612 ofile += 4;
1613 }
1614 else if (Ustrncmp(ofile, US"DER ", 4) == 0)
1615 {
1616 fmt_pem = FALSE;
1617 ofile += 4;
1618 }
1619 ocsp_load_response(sctx, cbinfo, ofile, fmt_pem);
1620 }
5b2fd993
JH
1621 else
1622 DEBUG(D_tls) debug_printf("ran out of ocsp file list\n");
1623#endif
1624 }
ba86e143
JH
1625 }
1626 else /* would there ever be a need for multiple client certs? */
1627 if ((err = tls_add_certfile(sctx, cbinfo, expanded, errstr)))
1628 return err;
7be682ca 1629
5a2a0989
JH
1630 if ( cbinfo->privatekey
1631 && !expand_check(cbinfo->privatekey, US"tls_privatekey", &expanded, errstr))
23bb6982 1632 return DEFER;
7be682ca 1633
23bb6982
JH
1634 /* If expansion was forced to fail, key_expanded will be NULL. If the result
1635 of the expansion is an empty string, ignore it also, and assume the private
1636 key is in the same file as the certificate. */
1637
1638 if (expanded && *expanded)
ba86e143
JH
1639 if (cbinfo->is_server)
1640 {
1641 const uschar * file_list = expanded;
1642 int sep = 0;
1643 uschar * file;
1644
1645 while (file = string_nextinlist(&file_list, &sep, NULL, 0))
1646 if ((err = tls_add_pkeyfile(sctx, cbinfo, file, errstr)))
1647 return err;
1648 }
1649 else /* would there ever be a need for multiple client certs? */
1650 if ((err = tls_add_pkeyfile(sctx, cbinfo, expanded, errstr)))
1651 return err;
7be682ca
PP
1652 }
1653
1654return OK;
1655}
1656
1657
1658
1659
1660/*************************************************
1661* Callback to handle SNI *
1662*************************************************/
1663
1664/* Called when acting as server during the TLS session setup if a Server Name
1665Indication extension was sent by the client.
1666
1667API documentation is OpenSSL s_server.c implementation.
1668
1669Arguments:
1670 s SSL* of the current session
1671 ad unknown (part of OpenSSL API) (unused)
1672 arg Callback of "our" registered data
1673
1674Returns: SSL_TLSEXT_ERR_{OK,ALERT_WARNING,ALERT_FATAL,NOACK}
b10c87b3
JH
1675
1676XXX might need to change to using ClientHello callback,
1677per https://www.openssl.org/docs/manmaster/man3/SSL_client_hello_cb_fn.html
7be682ca
PP
1678*/
1679
3bcbbbe2 1680#ifdef EXIM_HAVE_OPENSSL_TLSEXT
7be682ca 1681static int
7be682ca
PP
1682tls_servername_cb(SSL *s, int *ad ARG_UNUSED, void *arg)
1683{
1684const char *servername = SSL_get_servername(s, TLSEXT_NAMETYPE_host_name);
3f7eeb86 1685tls_ext_ctx_cb *cbinfo = (tls_ext_ctx_cb *) arg;
7be682ca 1686int rc;
3f0945ff 1687int old_pool = store_pool;
cf0c6164 1688uschar * dummy_errstr;
7be682ca
PP
1689
1690if (!servername)
1691 return SSL_TLSEXT_ERR_OK;
1692
3f0945ff 1693DEBUG(D_tls) debug_printf("Received TLS SNI \"%s\"%s\n", servername,
7be682ca
PP
1694 reexpand_tls_files_for_sni ? "" : " (unused for certificate selection)");
1695
1696/* Make the extension value available for expansion */
3f0945ff 1697store_pool = POOL_PERM;
89a80675 1698tls_in.sni = string_copy_taint(US servername, TRUE);
3f0945ff 1699store_pool = old_pool;
7be682ca
PP
1700
1701if (!reexpand_tls_files_for_sni)
1702 return SSL_TLSEXT_ERR_OK;
1703
1704/* Can't find an SSL_CTX_clone() or equivalent, so we do it manually;
1705not confident that memcpy wouldn't break some internal reference counting.
1706Especially since there's a references struct member, which would be off. */
1707
7a8b9519
JH
1708#ifdef EXIM_HAVE_OPENSSL_TLS_METHOD
1709if (!(server_sni = SSL_CTX_new(TLS_server_method())))
1710#else
0df4ab80 1711if (!(server_sni = SSL_CTX_new(SSLv23_server_method())))
7a8b9519 1712#endif
7be682ca 1713 {
0abc5a13 1714 ERR_error_string_n(ERR_get_error(), ssl_errstring, sizeof(ssl_errstring));
7be682ca 1715 DEBUG(D_tls) debug_printf("SSL_CTX_new() failed: %s\n", ssl_errstring);
5a2a0989 1716 goto bad;
7be682ca
PP
1717 }
1718
1719/* Not sure how many of these are actually needed, since SSL object
1720already exists. Might even need this selfsame callback, for reneg? */
1721
817d9f57
JH
1722SSL_CTX_set_info_callback(server_sni, SSL_CTX_get_info_callback(server_ctx));
1723SSL_CTX_set_mode(server_sni, SSL_CTX_get_mode(server_ctx));
1724SSL_CTX_set_options(server_sni, SSL_CTX_get_options(server_ctx));
1725SSL_CTX_set_timeout(server_sni, SSL_CTX_get_timeout(server_ctx));
1726SSL_CTX_set_tlsext_servername_callback(server_sni, tls_servername_cb);
1727SSL_CTX_set_tlsext_servername_arg(server_sni, cbinfo);
038597d2 1728
cf0c6164
JH
1729if ( !init_dh(server_sni, cbinfo->dhparam, NULL, &dummy_errstr)
1730 || !init_ecdh(server_sni, NULL, &dummy_errstr)
038597d2 1731 )
5a2a0989 1732 goto bad;
038597d2 1733
ca954d7f
JH
1734if ( cbinfo->server_cipher_list
1735 && !SSL_CTX_set_cipher_list(server_sni, CS cbinfo->server_cipher_list))
5a2a0989 1736 goto bad;
ca954d7f 1737
f2de3a33 1738#ifndef DISABLE_OCSP
f5d78688 1739if (cbinfo->u_ocsp.server.file)
3f7eeb86 1740 {
f5d78688 1741 SSL_CTX_set_tlsext_status_cb(server_sni, tls_server_stapling_cb);
14c7b357 1742 SSL_CTX_set_tlsext_status_arg(server_sni, cbinfo);
3f7eeb86
PP
1743 }
1744#endif
7be682ca 1745
c3033f13 1746if ((rc = setup_certs(server_sni, tls_verify_certificates, tls_crl, NULL, FALSE,
cf0c6164 1747 verify_callback_server, &dummy_errstr)) != OK)
5a2a0989 1748 goto bad;
7be682ca 1749
3f7eeb86
PP
1750/* do this after setup_certs, because this can require the certs for verifying
1751OCSP information. */
cf0c6164 1752if ((rc = tls_expand_session_files(server_sni, cbinfo, &dummy_errstr)) != OK)
5a2a0989 1753 goto bad;
a799883d 1754
7be682ca 1755DEBUG(D_tls) debug_printf("Switching SSL context.\n");
817d9f57 1756SSL_set_SSL_CTX(s, server_sni);
7be682ca 1757return SSL_TLSEXT_ERR_OK;
5a2a0989
JH
1758
1759bad: return SSL_TLSEXT_ERR_ALERT_FATAL;
7be682ca 1760}
3bcbbbe2 1761#endif /* EXIM_HAVE_OPENSSL_TLSEXT */
7be682ca
PP
1762
1763
1764
1765
f2de3a33 1766#ifndef DISABLE_OCSP
f5d78688 1767
3f7eeb86
PP
1768/*************************************************
1769* Callback to handle OCSP Stapling *
1770*************************************************/
1771
1772/* Called when acting as server during the TLS session setup if the client
1773requests OCSP information with a Certificate Status Request.
1774
1775Documentation via openssl s_server.c and the Apache patch from the OpenSSL
1776project.
1777
1778*/
1779
1780static int
f5d78688 1781tls_server_stapling_cb(SSL *s, void *arg)
3f7eeb86 1782{
5b2fd993
JH
1783const tls_ext_ctx_cb * cbinfo = (tls_ext_ctx_cb *) arg;
1784ocsp_resplist * olist = cbinfo->u_ocsp.server.olist;
1785uschar * response_der; /*XXX blob */
3f7eeb86
PP
1786int response_der_len;
1787
af4a1bca 1788DEBUG(D_tls)
5b2fd993
JH
1789 debug_printf("Received TLS status request (OCSP stapling); %s response list\n",
1790 olist ? "have" : "lack");
f5d78688 1791
44662487 1792tls_in.ocsp = OCSP_NOT_RESP;
5b2fd993 1793if (!olist)
3f7eeb86
PP
1794 return SSL_TLSEXT_ERR_NOACK;
1795
012dd02e 1796#ifdef EXIM_HAVE_OPESSL_GET0_SERIAL
5b2fd993
JH
1797 {
1798 const X509 * cert_sent = SSL_get_certificate(s);
1799 const ASN1_INTEGER * cert_serial = X509_get0_serialNumber(cert_sent);
1800 const BIGNUM * cert_bn = ASN1_INTEGER_to_BN(cert_serial, NULL);
1801 const X509_NAME * cert_issuer = X509_get_issuer_name(cert_sent);
1802 uschar * chash;
1803 uint chash_len;
1804
1805 for (; olist; olist = olist->next)
1806 {
1807 OCSP_BASICRESP * bs = OCSP_response_get1_basic(olist->resp);
1808 const OCSP_SINGLERESP * single = OCSP_resp_get0(bs, 0);
1809 const OCSP_CERTID * cid = OCSP_SINGLERESP_get0_id(single);
1810 ASN1_INTEGER * res_cert_serial;
1811 const BIGNUM * resp_bn;
1812 ASN1_OCTET_STRING * res_cert_iNameHash;
1813
1814
1815 (void) OCSP_id_get0_info(&res_cert_iNameHash, NULL, NULL, &res_cert_serial,
1816 (OCSP_CERTID *) cid);
1817 resp_bn = ASN1_INTEGER_to_BN(res_cert_serial, NULL);
1818
1819 DEBUG(D_tls)
1820 {
1821 debug_printf("cert serial: %s\n", BN_bn2hex(cert_bn));
1822 debug_printf("resp serial: %s\n", BN_bn2hex(resp_bn));
1823 }
1824
1825 if (BN_cmp(cert_bn, resp_bn) == 0)
1826 {
1827 DEBUG(D_tls) debug_printf("matched serial for ocsp\n");
1828
1829 /*XXX TODO: check the rest of the list for duplicate matches.
1830 If any, need to also check the Issuer Name hash.
1831 Without this, we will provide the wrong status in the case of
1832 duplicate id. */
1833
1834 break;
1835 }
1836 DEBUG(D_tls) debug_printf("not match serial for ocsp\n");
1837 }
1838 if (!olist)
1839 {
1840 DEBUG(D_tls) debug_printf("failed to find match for ocsp\n");
1841 return SSL_TLSEXT_ERR_NOACK;
1842 }
1843 }
012dd02e
JH
1844#else
1845if (olist->next)
1846 {
1847 DEBUG(D_tls) debug_printf("OpenSSL version too early to support multi-leaf OCSP\n");
1848 return SSL_TLSEXT_ERR_NOACK;
1849 }
1850#endif
5b2fd993
JH
1851
1852/*XXX could we do the i2d earlier, rather than during the callback? */
3f7eeb86 1853response_der = NULL;
5b2fd993 1854response_der_len = i2d_OCSP_RESPONSE(olist->resp, &response_der);
3f7eeb86
PP
1855if (response_der_len <= 0)
1856 return SSL_TLSEXT_ERR_NOACK;
1857
5e55c7a9 1858SSL_set_tlsext_status_ocsp_resp(server_ssl, response_der, response_der_len);
44662487 1859tls_in.ocsp = OCSP_VFIED;
3f7eeb86
PP
1860return SSL_TLSEXT_ERR_OK;
1861}
1862
3f7eeb86 1863
f5d78688
JH
1864static void
1865time_print(BIO * bp, const char * str, ASN1_GENERALIZEDTIME * time)
1866{
1867BIO_printf(bp, "\t%s: ", str);
1868ASN1_GENERALIZEDTIME_print(bp, time);
1869BIO_puts(bp, "\n");
1870}
1871
1872static int
1873tls_client_stapling_cb(SSL *s, void *arg)
1874{
1875tls_ext_ctx_cb * cbinfo = arg;
1876const unsigned char * p;
1877int len;
1878OCSP_RESPONSE * rsp;
1879OCSP_BASICRESP * bs;
1880int i;
1881
14003634 1882DEBUG(D_tls) debug_printf("Received TLS status callback (OCSP stapling):\n");
f5d78688
JH
1883len = SSL_get_tlsext_status_ocsp_resp(s, &p);
1884if(!p)
1885 {
44662487 1886 /* Expect this when we requested ocsp but got none */
6c6d6e48 1887 if (cbinfo->u_ocsp.client.verify_required && LOGGING(tls_cipher))
14003634 1888 log_write(0, LOG_MAIN, "Required TLS certificate status not received");
f5d78688
JH
1889 else
1890 DEBUG(D_tls) debug_printf(" null\n");
44662487 1891 return cbinfo->u_ocsp.client.verify_required ? 0 : 1;
f5d78688 1892 }
018058b2 1893
c82de233
JH
1894if (!(rsp = d2i_OCSP_RESPONSE(NULL, &p, len)))
1895 {
1896 tls_out.ocsp = OCSP_FAILED; /*XXX should use tlsp-> to permit concurrent outbound */
6c6d6e48 1897 if (LOGGING(tls_cipher))
1eca31ca 1898 log_write(0, LOG_MAIN, "Received TLS cert status response, parse error");
f5d78688
JH
1899 else
1900 DEBUG(D_tls) debug_printf(" parse error\n");
1901 return 0;
c82de233 1902 }
f5d78688 1903
c82de233 1904if (!(bs = OCSP_response_get1_basic(rsp)))
f5d78688 1905 {
018058b2 1906 tls_out.ocsp = OCSP_FAILED;
6c6d6e48 1907 if (LOGGING(tls_cipher))
1eca31ca 1908 log_write(0, LOG_MAIN, "Received TLS cert status response, error parsing response");
f5d78688
JH
1909 else
1910 DEBUG(D_tls) debug_printf(" error parsing response\n");
1911 OCSP_RESPONSE_free(rsp);
1912 return 0;
1913 }
1914
1915/* We'd check the nonce here if we'd put one in the request. */
1916/* However that would defeat cacheability on the server so we don't. */
1917
f5d78688
JH
1918/* This section of code reworked from OpenSSL apps source;
1919 The OpenSSL Project retains copyright:
1920 Copyright (c) 1999 The OpenSSL Project. All rights reserved.
1921*/
1922 {
1923 BIO * bp = NULL;
86ede124
JH
1924#ifndef EXIM_HAVE_OCSP_RESP_COUNT
1925 STACK_OF(OCSP_SINGLERESP) * sresp = bs->tbsResponseData->responses;
1926#endif
f5d78688 1927
57887ecc 1928 DEBUG(D_tls) bp = BIO_new_fp(debug_file, BIO_NOCLOSE);
f5d78688
JH
1929
1930 /*OCSP_RESPONSE_print(bp, rsp, 0); extreme debug: stapling content */
1931
1932 /* Use the chain that verified the server cert to verify the stapled info */
1933 /* DEBUG(D_tls) x509_store_dump_cert_s_names(cbinfo->u_ocsp.client.verify_store); */
1934
c3033f13 1935 if ((i = OCSP_basic_verify(bs, cbinfo->verify_stack,
86ede124
JH
1936 cbinfo->u_ocsp.client.verify_store, OCSP_NOEXPLICIT)) <= 0)
1937 if (ERR_peek_error())
1938 {
1939 tls_out.ocsp = OCSP_FAILED;
1940 if (LOGGING(tls_cipher)) log_write(0, LOG_MAIN,
1941 "Received TLS cert status response, itself unverifiable: %s",
1942 ERR_reason_error_string(ERR_peek_error()));
1943 BIO_printf(bp, "OCSP response verify failure\n");
1944 ERR_print_errors(bp);
1945 OCSP_RESPONSE_print(bp, rsp, 0);
1946 goto failed;
1947 }
1948 else
1949 DEBUG(D_tls) debug_printf("no explicit trust for OCSP signing"
1950 " in the root CA certificate; ignoring\n");
f5d78688 1951
86ede124 1952 DEBUG(D_tls) debug_printf("OCSP response well-formed and signed OK\n");
f5d78688 1953
c8dfb21d
JH
1954 /*XXX So we have a good stapled OCSP status. How do we know
1955 it is for the cert of interest? OpenSSL 1.1.0 has a routine
1956 OCSP_resp_find_status() which matches on a cert id, which presumably
1957 we should use. Making an id needs OCSP_cert_id_new(), which takes
1958 issuerName, issuerKey, serialNumber. Are they all in the cert?
1959
1960 For now, carry on blindly accepting the resp. */
1961
86ede124 1962 for (int idx =
c8dfb21d 1963#ifdef EXIM_HAVE_OCSP_RESP_COUNT
86ede124 1964 OCSP_resp_count(bs) - 1;
c8dfb21d 1965#else
86ede124 1966 sk_OCSP_SINGLERESP_num(sresp) - 1;
c8dfb21d 1967#endif
86ede124
JH
1968 idx >= 0; idx--)
1969 {
1970 OCSP_SINGLERESP * single = OCSP_resp_get0(bs, idx);
1971 int status, reason;
1972 ASN1_GENERALIZEDTIME * rev, * thisupd, * nextupd;
1973
1974 /*XXX so I can see putting a loop in here to handle a rsp with >1 singleresp
1975 - but what happens with a GnuTLS-style input?
1976
1977 we could do with a debug label for each singleresp
1978 - it has a certID with a serialNumber, but I see no API to get that
1979 */
44662487
JH
1980 status = OCSP_single_get0_status(single, &reason, &rev,
1981 &thisupd, &nextupd);
f5d78688 1982
86ede124
JH
1983 DEBUG(D_tls) time_print(bp, "This OCSP Update", thisupd);
1984 DEBUG(D_tls) if(nextupd) time_print(bp, "Next OCSP Update", nextupd);
1985 if (!OCSP_check_validity(thisupd, nextupd,
1986 EXIM_OCSP_SKEW_SECONDS, EXIM_OCSP_MAX_AGE))
1987 {
1988 tls_out.ocsp = OCSP_FAILED;
1989 DEBUG(D_tls) ERR_print_errors(bp);
1990 log_write(0, LOG_MAIN, "Server OSCP dates invalid");
1991 goto failed;
1992 }
1993
44662487
JH
1994 DEBUG(D_tls) BIO_printf(bp, "Certificate status: %s\n",
1995 OCSP_cert_status_str(status));
1996 switch(status)
1997 {
1998 case V_OCSP_CERTSTATUS_GOOD:
86ede124 1999 continue; /* the idx loop */
44662487
JH
2000 case V_OCSP_CERTSTATUS_REVOKED:
2001 log_write(0, LOG_MAIN, "Server certificate revoked%s%s",
2002 reason != -1 ? "; reason: " : "",
2003 reason != -1 ? OCSP_crl_reason_str(reason) : "");
2004 DEBUG(D_tls) time_print(bp, "Revocation Time", rev);
44662487
JH
2005 break;
2006 default:
2007 log_write(0, LOG_MAIN,
2008 "Server certificate status unknown, in OCSP stapling");
44662487
JH
2009 break;
2010 }
86ede124
JH
2011
2012 goto failed;
f5d78688 2013 }
86ede124
JH
2014
2015 i = 1;
2016 tls_out.ocsp = OCSP_VFIED;
2017 goto good;
2018
c8dfb21d 2019 failed:
86ede124 2020 tls_out.ocsp = OCSP_FAILED;
c8dfb21d
JH
2021 i = cbinfo->u_ocsp.client.verify_required ? 0 : 1;
2022 good:
f5d78688
JH
2023 BIO_free(bp);
2024 }
2025
2026OCSP_RESPONSE_free(rsp);
2027return i;
2028}
f2de3a33 2029#endif /*!DISABLE_OCSP*/
3f7eeb86
PP
2030
2031
7be682ca 2032/*************************************************
059ec3d9
PH
2033* Initialize for TLS *
2034*************************************************/
2035
b038d456
JH
2036static void
2037tls_openssl_init(void)
2038{
2039#ifdef EXIM_NEED_OPENSSL_INIT
2040SSL_load_error_strings(); /* basic set up */
2041OpenSSL_add_ssl_algorithms();
2042#endif
2043
2044#if defined(EXIM_HAVE_SHA256) && !defined(OPENSSL_AUTO_SHA256)
2045/* SHA256 is becoming ever more popular. This makes sure it gets added to the
2046list of available digests. */
2047EVP_add_digest(EVP_sha256());
2048#endif
2049}
2050
2051
2052
e51c7be2
JH
2053/* Called from both server and client code, to do preliminary initialization
2054of the library. We allocate and return a context structure.
059ec3d9
PH
2055
2056Arguments:
946ecbe0 2057 ctxp returned SSL context
059ec3d9
PH
2058 host connected host, if client; NULL if server
2059 dhparam DH parameter file
2060 certificate certificate file
2061 privatekey private key
f5d78688 2062 ocsp_file file of stapling info (server); flag for require ocsp (client)
059ec3d9 2063 addr address if client; NULL if server (for some randomness)
946ecbe0 2064 cbp place to put allocated callback context
cf0c6164 2065 errstr error string pointer
059ec3d9
PH
2066
2067Returns: OK/DEFER/FAIL
2068*/
2069
2070static int
817d9f57 2071tls_init(SSL_CTX **ctxp, host_item *host, uschar *dhparam, uschar *certificate,
3f7eeb86 2072 uschar *privatekey,
f2de3a33 2073#ifndef DISABLE_OCSP
5b2fd993 2074 uschar *ocsp_file,
3f7eeb86 2075#endif
b10c87b3
JH
2076 address_item *addr, tls_ext_ctx_cb ** cbp,
2077 tls_support * tlsp,
2078 uschar ** errstr)
059ec3d9 2079{
7006ee24 2080SSL_CTX * ctx;
77bb000f 2081long init_options;
7be682ca 2082int rc;
a7538db1 2083tls_ext_ctx_cb * cbinfo;
7be682ca
PP
2084
2085cbinfo = store_malloc(sizeof(tls_ext_ctx_cb));
b10c87b3 2086cbinfo->tlsp = tlsp;
7be682ca
PP
2087cbinfo->certificate = certificate;
2088cbinfo->privatekey = privatekey;
a6510420 2089cbinfo->is_server = host==NULL;
f2de3a33 2090#ifndef DISABLE_OCSP
c3033f13 2091cbinfo->verify_stack = NULL;
a6510420 2092if (!host)
f5d78688
JH
2093 {
2094 cbinfo->u_ocsp.server.file = ocsp_file;
2095 cbinfo->u_ocsp.server.file_expanded = NULL;
5b2fd993 2096 cbinfo->u_ocsp.server.olist = NULL;
f5d78688
JH
2097 }
2098else
2099 cbinfo->u_ocsp.client.verify_store = NULL;
3f7eeb86 2100#endif
7be682ca 2101cbinfo->dhparam = dhparam;
0df4ab80 2102cbinfo->server_cipher_list = NULL;
7be682ca 2103cbinfo->host = host;
0cbf2b82 2104#ifndef DISABLE_EVENT
a7538db1
JH
2105cbinfo->event_action = NULL;
2106#endif
77bb000f 2107
b038d456 2108tls_openssl_init();
a0475b69 2109
f0f5a555
PP
2110/* Create a context.
2111The OpenSSL docs in 1.0.1b have not been updated to clarify TLS variant
2112negotiation in the different methods; as far as I can tell, the only
2113*_{server,client}_method which allows negotiation is SSLv23, which exists even
2114when OpenSSL is built without SSLv2 support.
2115By disabling with openssl_options, we can let admins re-enable with the
2116existing knob. */
059ec3d9 2117
7a8b9519
JH
2118#ifdef EXIM_HAVE_OPENSSL_TLS_METHOD
2119if (!(ctx = SSL_CTX_new(host ? TLS_client_method() : TLS_server_method())))
2120#else
7006ee24 2121if (!(ctx = SSL_CTX_new(host ? SSLv23_client_method() : SSLv23_server_method())))
7a8b9519 2122#endif
7006ee24 2123 return tls_error(US"SSL_CTX_new", host, NULL, errstr);
059ec3d9
PH
2124
2125/* It turns out that we need to seed the random number generator this early in
2126order to get the full complement of ciphers to work. It took me roughly a day
2127of work to discover this by experiment.
2128
2129On systems that have /dev/urandom, SSL may automatically seed itself from
2130there. Otherwise, we have to make something up as best we can. Double check
2131afterwards. */
2132
2133if (!RAND_status())
2134 {
2135 randstuff r;
9e3331ea 2136 gettimeofday(&r.tv, NULL);
059ec3d9
PH
2137 r.p = getpid();
2138
5903c6ff
JH
2139 RAND_seed(US (&r), sizeof(r));
2140 RAND_seed(US big_buffer, big_buffer_size);
2141 if (addr != NULL) RAND_seed(US addr, sizeof(addr));
059ec3d9
PH
2142
2143 if (!RAND_status())
7199e1ee 2144 return tls_error(US"RAND_status", host,
cf0c6164 2145 US"unable to seed random number generator", errstr);
059ec3d9
PH
2146 }
2147
2148/* Set up the information callback, which outputs if debugging is at a suitable
2149level. */
2150
b10c87b3
JH
2151DEBUG(D_tls)
2152 {
2153 SSL_CTX_set_info_callback(ctx, (void (*)())info_callback);
e570d136
JH
2154#if defined(EXIM_HAVE_OPESSL_TRACE) && !defined(OPENSSL_NO_SSL_TRACE)
2155 /* this needs a debug build of OpenSSL */
b10c87b3
JH
2156 SSL_CTX_set_msg_callback(ctx, (void (*)())SSL_trace);
2157#endif
8a40db1c 2158#ifdef OPENSSL_HAVE_KEYLOG_CB
b10c87b3 2159 SSL_CTX_set_keylog_callback(ctx, (void (*)())keylog_callback);
8a40db1c 2160#endif
b10c87b3 2161 }
059ec3d9 2162
c80c5570 2163/* Automatically re-try reads/writes after renegotiation. */
7006ee24 2164(void) SSL_CTX_set_mode(ctx, SSL_MODE_AUTO_RETRY);
c80c5570 2165
77bb000f
PP
2166/* Apply administrator-supplied work-arounds.
2167Historically we applied just one requested option,
2168SSL_OP_DONT_INSERT_EMPTY_FRAGMENTS, but when bug 994 requested a second, we
2169moved to an administrator-controlled list of options to specify and
2170grandfathered in the first one as the default value for "openssl_options".
059ec3d9 2171
77bb000f
PP
2172No OpenSSL version number checks: the options we accept depend upon the
2173availability of the option value macros from OpenSSL. */
059ec3d9 2174
7006ee24 2175if (!tls_openssl_options_parse(openssl_options, &init_options))
cf0c6164 2176 return tls_error(US"openssl_options parsing failed", host, NULL, errstr);
77bb000f 2177
b10c87b3
JH
2178#ifdef EXPERIMENTAL_TLS_RESUME
2179tlsp->resumption = RESUME_SUPPORTED;
2180#endif
77bb000f
PP
2181if (init_options)
2182 {
b10c87b3
JH
2183#ifdef EXPERIMENTAL_TLS_RESUME
2184 /* Should the server offer session resumption? */
2185 if (!host && verify_check_host(&tls_resumption_hosts) == OK)
2186 {
2187 DEBUG(D_tls) debug_printf("tls_resumption_hosts overrides openssl_options\n");
2188 init_options &= ~SSL_OP_NO_TICKET;
2189 tlsp->resumption |= RESUME_SERVER_TICKET; /* server will give ticket on request */
2190 tlsp->host_resumable = TRUE;
2191 }
2192#endif
2193
77bb000f 2194 DEBUG(D_tls) debug_printf("setting SSL CTX options: %#lx\n", init_options);
7006ee24 2195 if (!(SSL_CTX_set_options(ctx, init_options)))
77bb000f 2196 return tls_error(string_sprintf(
cf0c6164 2197 "SSL_CTX_set_option(%#lx)", init_options), host, NULL, errstr);
77bb000f
PP
2198 }
2199else
2200 DEBUG(D_tls) debug_printf("no SSL CTX options to set\n");
059ec3d9 2201
a28050f8
JH
2202/* We'd like to disable session cache unconditionally, but foolish Outlook
2203Express clients then give up the first TLS connection and make a second one
2204(which works). Only when there is an IMAP service on the same machine.
2205Presumably OE is trying to use the cache for A on B. Leave it enabled for
2206now, until we work out a decent way of presenting control to the config. It
2207will never be used because we use a new context every time. */
2208#ifdef notdef
7006ee24 2209(void) SSL_CTX_set_session_cache_mode(ctx, SSL_SESS_CACHE_OFF);
a28050f8 2210#endif
7006ee24 2211
059ec3d9 2212/* Initialize with DH parameters if supplied */
10ca4f1c 2213/* Initialize ECDH temp key parameter selection */
059ec3d9 2214
7006ee24
JH
2215if ( !init_dh(ctx, dhparam, host, errstr)
2216 || !init_ecdh(ctx, host, errstr)
038597d2
PP
2217 )
2218 return DEFER;
059ec3d9 2219
3f7eeb86 2220/* Set up certificate and key (and perhaps OCSP info) */
059ec3d9 2221
7006ee24 2222if ((rc = tls_expand_session_files(ctx, cbinfo, errstr)) != OK)
23bb6982 2223 return rc;
c91535f3 2224
c3033f13
JH
2225/* If we need to handle SNI or OCSP, do so */
2226
3bcbbbe2 2227#ifdef EXIM_HAVE_OPENSSL_TLSEXT
c3033f13
JH
2228# ifndef DISABLE_OCSP
2229 if (!(cbinfo->verify_stack = sk_X509_new_null()))
2230 {
2231 DEBUG(D_tls) debug_printf("failed to create stack for stapling verify\n");
2232 return FAIL;
2233 }
2234# endif
2235
7a8b9519 2236if (!host) /* server */
3f0945ff 2237 {
f2de3a33 2238# ifndef DISABLE_OCSP
5b2fd993 2239 /* We check u_ocsp.server.file, not server.olist, because we care about if
3f7eeb86
PP
2240 the option exists, not what the current expansion might be, as SNI might
2241 change the certificate and OCSP file in use between now and the time the
2242 callback is invoked. */
f5d78688 2243 if (cbinfo->u_ocsp.server.file)
3f7eeb86 2244 {
7006ee24
JH
2245 SSL_CTX_set_tlsext_status_cb(ctx, tls_server_stapling_cb);
2246 SSL_CTX_set_tlsext_status_arg(ctx, cbinfo);
3f7eeb86 2247 }
f5d78688 2248# endif
3f0945ff
PP
2249 /* We always do this, so that $tls_sni is available even if not used in
2250 tls_certificate */
7006ee24
JH
2251 SSL_CTX_set_tlsext_servername_callback(ctx, tls_servername_cb);
2252 SSL_CTX_set_tlsext_servername_arg(ctx, cbinfo);
3f0945ff 2253 }
f2de3a33 2254# ifndef DISABLE_OCSP
f5d78688
JH
2255else /* client */
2256 if(ocsp_file) /* wanting stapling */
2257 {
2258 if (!(cbinfo->u_ocsp.client.verify_store = X509_STORE_new()))
2259 {
2260 DEBUG(D_tls) debug_printf("failed to create store for stapling verify\n");
2261 return FAIL;
2262 }
7006ee24
JH
2263 SSL_CTX_set_tlsext_status_cb(ctx, tls_client_stapling_cb);
2264 SSL_CTX_set_tlsext_status_arg(ctx, cbinfo);
f5d78688
JH
2265 }
2266# endif
7be682ca 2267#endif
059ec3d9 2268
e51c7be2 2269cbinfo->verify_cert_hostnames = NULL;
e51c7be2 2270
c8dfb21d 2271#ifdef EXIM_HAVE_EPHEM_RSA_KEX
059ec3d9 2272/* Set up the RSA callback */
7006ee24 2273SSL_CTX_set_tmp_rsa_callback(ctx, rsa_callback);
c8dfb21d 2274#endif
059ec3d9 2275
b10c87b3
JH
2276/* Finally, set the session cache timeout, and we are done.
2277The period appears to be also used for (server-generated) session tickets */
059ec3d9 2278
7006ee24 2279SSL_CTX_set_timeout(ctx, ssl_session_timeout);
059ec3d9 2280DEBUG(D_tls) debug_printf("Initialized TLS\n");
7be682ca 2281
817d9f57 2282*cbp = cbinfo;
7006ee24 2283*ctxp = ctx;
7be682ca 2284
059ec3d9
PH
2285return OK;
2286}
2287
2288
2289
2290
2291/*************************************************
2292* Get name of cipher in use *
2293*************************************************/
2294
817d9f57 2295/*
059ec3d9 2296Argument: pointer to an SSL structure for the connection
817d9f57 2297 pointer to number of bits for cipher
f1be21cf 2298Returns: pointer to allocated string in perm-pool
059ec3d9
PH
2299*/
2300
f1be21cf 2301static uschar *
da40b1ec 2302construct_cipher_name(SSL * ssl, const uschar * ver, int * bits)
059ec3d9 2303{
f1be21cf 2304int pool = store_pool;
7a8b9519 2305/* With OpenSSL 1.0.0a, 'c' needs to be const but the documentation doesn't
57b3a7f5
PP
2306yet reflect that. It should be a safe change anyway, even 0.9.8 versions have
2307the accessor functions use const in the prototype. */
059ec3d9 2308
7a8b9519 2309const SSL_CIPHER * c = (const SSL_CIPHER *) SSL_get_current_cipher(ssl);
f1be21cf 2310uschar * s;
059ec3d9 2311
817d9f57 2312SSL_CIPHER_get_bits(c, bits);
059ec3d9 2313
f1be21cf
JH
2314store_pool = POOL_PERM;
2315s = string_sprintf("%s:%s:%u", ver, SSL_CIPHER_get_name(c), *bits);
2316store_pool = pool;
2317DEBUG(D_tls) debug_printf("Cipher: %s\n", s);
2318return s;
2319}
2320
059ec3d9 2321
f1be21cf
JH
2322/* Get IETF-standard name for ciphersuite.
2323Argument: pointer to an SSL structure for the connection
2324Returns: pointer to string
2325*/
2326
2327static const uschar *
2328cipher_stdname_ssl(SSL * ssl)
2329{
2330#ifdef EXIM_HAVE_OPENSSL_CIPHER_STD_NAME
2331return CUS SSL_CIPHER_standard_name(SSL_get_current_cipher(ssl));
2332#else
2333ushort id = 0xffff & SSL_CIPHER_get_id(SSL_get_current_cipher(ssl));
2334return cipher_stdname(id >> 8, id & 0xff);
2335#endif
059ec3d9
PH
2336}
2337
2338
da40b1ec
JH
2339static const uschar *
2340tlsver_name(SSL * ssl)
2341{
2342uschar * s, * p;
2343int pool = store_pool;
2344
2345store_pool = POOL_PERM;
2346s = string_copy(US SSL_get_version(ssl));
2347store_pool = pool;
2348if ((p = Ustrchr(s, 'v'))) /* TLSv1.2 -> TLS1.2 */
2349 for (;; p++) if (!(*p = p[1])) break;
2350return CUS s;
2351}
2352
2353
f69979cf 2354static void
70e384dd 2355peer_cert(SSL * ssl, tls_support * tlsp, uschar * peerdn, unsigned siz)
f69979cf
JH
2356{
2357/*XXX we might consider a list-of-certs variable for the cert chain.
2358SSL_get_peer_cert_chain(SSL*). We'd need a new variable type and support
2359in list-handling functions, also consider the difference between the entire
2360chain and the elements sent by the peer. */
2361
70e384dd
JH
2362tlsp->peerdn = NULL;
2363
f69979cf
JH
2364/* Will have already noted peercert on a verify fail; possibly not the leaf */
2365if (!tlsp->peercert)
2366 tlsp->peercert = SSL_get_peer_certificate(ssl);
2367/* Beware anonymous ciphers which lead to server_cert being NULL */
2368if (tlsp->peercert)
70e384dd
JH
2369 if (!X509_NAME_oneline(X509_get_subject_name(tlsp->peercert), CS peerdn, siz))
2370 { DEBUG(D_tls) debug_printf("X509_NAME_oneline() error\n"); }
2371 else
2372 {
4a1bd6b9
JH
2373 int oldpool = store_pool;
2374
2375 peerdn[siz-1] = '\0'; /* paranoia */
2376 store_pool = POOL_PERM;
2377 tlsp->peerdn = string_copy(peerdn);
2378 store_pool = oldpool;
2379
2380 /* We used to set CV in the cert-verify callbacks (either plain or dane)
2381 but they don't get called on session-resumption. So use the official
2382 interface, which uses the resumed value. Unfortunately this claims verified
2383 when it actually failed but we're in try-verify mode, due to us wanting the
2384 knowlege that it failed so needing to have the callback and forcing a
2385 permissive return. If we don't force it, the TLS startup is failed.
f4e62a87
JH
2386 The extra bit of information is set in verify_override in the cb, stashed
2387 for resumption next to the TLS session, and used here. */
4a1bd6b9
JH
2388
2389 if (!tlsp->verify_override)
4ed67f68
JH
2390 tlsp->certificate_verified =
2391#ifdef SUPPORT_DANE
2392 tlsp->dane_verified ||
2393#endif
2394 SSL_get_verify_result(ssl) == X509_V_OK;
70e384dd 2395 }
f69979cf
JH
2396}
2397
2398
059ec3d9
PH
2399
2400
2401
2402/*************************************************
2403* Set up for verifying certificates *
2404*************************************************/
2405
0e8aed8a 2406#ifndef DISABLE_OCSP
c3033f13
JH
2407/* Load certs from file, return TRUE on success */
2408
2409static BOOL
2410chain_from_pem_file(const uschar * file, STACK_OF(X509) * verify_stack)
2411{
2412BIO * bp;
2413X509 * x;
2414
dec766a1
WB
2415while (sk_X509_num(verify_stack) > 0)
2416 X509_free(sk_X509_pop(verify_stack));
2417
c3033f13
JH
2418if (!(bp = BIO_new_file(CS file, "r"))) return FALSE;
2419while ((x = PEM_read_bio_X509(bp, NULL, 0, NULL)))
2420 sk_X509_push(verify_stack, x);
2421BIO_free(bp);
2422return TRUE;
2423}
0e8aed8a 2424#endif
c3033f13
JH
2425
2426
2427
dec766a1
WB
2428/* Called by both client and server startup; on the server possibly
2429repeated after a Server Name Indication.
059ec3d9
PH
2430
2431Arguments:
7be682ca 2432 sctx SSL_CTX* to initialise
059ec3d9
PH
2433 certs certs file or NULL
2434 crl CRL file or NULL
2435 host NULL in a server; the remote host in a client
2436 optional TRUE if called from a server for a host in tls_try_verify_hosts;
2437 otherwise passed as FALSE
983207c1 2438 cert_vfy_cb Callback function for certificate verification
cf0c6164 2439 errstr error string pointer
059ec3d9
PH
2440
2441Returns: OK/DEFER/FAIL
2442*/
2443
2444static int
983207c1 2445setup_certs(SSL_CTX *sctx, uschar *certs, uschar *crl, host_item *host, BOOL optional,
cf0c6164 2446 int (*cert_vfy_cb)(int, X509_STORE_CTX *), uschar ** errstr)
059ec3d9
PH
2447{
2448uschar *expcerts, *expcrl;
2449
cf0c6164 2450if (!expand_check(certs, US"tls_verify_certificates", &expcerts, errstr))
059ec3d9 2451 return DEFER;
57cc2785 2452DEBUG(D_tls) debug_printf("tls_verify_certificates: %s\n", expcerts);
059ec3d9 2453
10a831a3 2454if (expcerts && *expcerts)
059ec3d9 2455 {
10a831a3
JH
2456 /* Tell the library to use its compiled-in location for the system default
2457 CA bundle. Then add the ones specified in the config, if any. */
cb1d7830 2458
10a831a3 2459 if (!SSL_CTX_set_default_verify_paths(sctx))
cf0c6164 2460 return tls_error(US"SSL_CTX_set_default_verify_paths", host, NULL, errstr);
10a831a3
JH
2461
2462 if (Ustrcmp(expcerts, "system") != 0)
059ec3d9 2463 {
cb1d7830
JH
2464 struct stat statbuf;
2465
cb1d7830
JH
2466 if (Ustat(expcerts, &statbuf) < 0)
2467 {
2468 log_write(0, LOG_MAIN|LOG_PANIC,
2469 "failed to stat %s for certificates", expcerts);
2470 return DEFER;
2471 }
059ec3d9 2472 else
059ec3d9 2473 {
cb1d7830
JH
2474 uschar *file, *dir;
2475 if ((statbuf.st_mode & S_IFMT) == S_IFDIR)
2476 { file = NULL; dir = expcerts; }
2477 else
c3033f13
JH
2478 {
2479 file = expcerts; dir = NULL;
2480#ifndef DISABLE_OCSP
2481 /* In the server if we will be offering an OCSP proof, load chain from
2482 file for verifying the OCSP proof at load time. */
2483
5b2fd993
JH
2484/*XXX Glitch! The file here is tls_verify_certs: the chain for verifying the client cert.
2485This is inconsistent with the need to verify the OCSP proof of the server cert.
2486*/
2487
c3033f13
JH
2488 if ( !host
2489 && statbuf.st_size > 0
2490 && server_static_cbinfo->u_ocsp.server.file
2491 && !chain_from_pem_file(file, server_static_cbinfo->verify_stack)
2492 )
2493 {
2494 log_write(0, LOG_MAIN|LOG_PANIC,
57887ecc 2495 "failed to load cert chain from %s", file);
c3033f13
JH
2496 return DEFER;
2497 }
2498#endif
2499 }
cb1d7830 2500
d06f582f 2501 /* If a certificate file is empty, the load function fails with an
cb1d7830
JH
2502 unhelpful error message. If we skip it, we get the correct behaviour (no
2503 certificates are recognized, but the error message is still misleading (it
c3033f13 2504 says no certificate was supplied). But this is better. */
cb1d7830 2505
f2f2c91b
JH
2506 if ( (!file || statbuf.st_size > 0)
2507 && !SSL_CTX_load_verify_locations(sctx, CS file, CS dir))
cf0c6164 2508 return tls_error(US"SSL_CTX_load_verify_locations", host, NULL, errstr);
cb1d7830 2509
d06f582f
JH
2510 /* On the server load the list of CAs for which we will accept certs, for
2511 sending to the client. This is only for the one-file
2512 tls_verify_certificates variant.
d7978c0f
JH
2513 If a list isn't loaded into the server, but some verify locations are set,
2514 the server end appears to make a wildcard request for client certs.
10a831a3 2515 Meanwhile, the client library as default behaviour *ignores* the list
cb1d7830
JH
2516 we send over the wire - see man SSL_CTX_set_client_cert_cb.
2517 Because of this, and that the dir variant is likely only used for
d7978c0f
JH
2518 the public-CA bundle (not for a private CA), not worth fixing. */
2519
f2f2c91b 2520 if (file)
cb1d7830 2521 {
2009ecca 2522 STACK_OF(X509_NAME) * names = SSL_load_client_CA_file(CS file);
dec766a1 2523
d06f582f 2524 if (!host) SSL_CTX_set_client_CA_list(sctx, names);
f2f2c91b 2525 DEBUG(D_tls) debug_printf("Added %d certificate authorities.\n",
cb1d7830 2526 sk_X509_NAME_num(names));
cb1d7830 2527 }
059ec3d9
PH
2528 }
2529 }
2530
2531 /* Handle a certificate revocation list. */
2532
10a831a3 2533#if OPENSSL_VERSION_NUMBER > 0x00907000L
059ec3d9 2534
8b417f2c 2535 /* This bit of code is now the version supplied by Lars Mainka. (I have
10a831a3 2536 merely reformatted it into the Exim code style.)
8b417f2c 2537
10a831a3
JH
2538 "From here I changed the code to add support for multiple crl's
2539 in pem format in one file or to support hashed directory entries in
2540 pem format instead of a file. This method now uses the library function
2541 X509_STORE_load_locations to add the CRL location to the SSL context.
2542 OpenSSL will then handle the verify against CA certs and CRLs by
2543 itself in the verify callback." */
8b417f2c 2544
cf0c6164 2545 if (!expand_check(crl, US"tls_crl", &expcrl, errstr)) return DEFER;
10a831a3 2546 if (expcrl && *expcrl)
059ec3d9 2547 {
8b417f2c
PH
2548 struct stat statbufcrl;
2549 if (Ustat(expcrl, &statbufcrl) < 0)
2550 {
2551 log_write(0, LOG_MAIN|LOG_PANIC,
2552 "failed to stat %s for certificates revocation lists", expcrl);
2553 return DEFER;
2554 }
2555 else
059ec3d9 2556 {
8b417f2c
PH
2557 /* is it a file or directory? */
2558 uschar *file, *dir;
7be682ca 2559 X509_STORE *cvstore = SSL_CTX_get_cert_store(sctx);
8b417f2c 2560 if ((statbufcrl.st_mode & S_IFMT) == S_IFDIR)
059ec3d9 2561 {
8b417f2c
PH
2562 file = NULL;
2563 dir = expcrl;
2564 DEBUG(D_tls) debug_printf("SSL CRL value is a directory %s\n", dir);
059ec3d9
PH
2565 }
2566 else
2567 {
8b417f2c
PH
2568 file = expcrl;
2569 dir = NULL;
2570 DEBUG(D_tls) debug_printf("SSL CRL value is a file %s\n", file);
059ec3d9 2571 }
8b417f2c 2572 if (X509_STORE_load_locations(cvstore, CS file, CS dir) == 0)
cf0c6164 2573 return tls_error(US"X509_STORE_load_locations", host, NULL, errstr);
8b417f2c
PH
2574
2575 /* setting the flags to check against the complete crl chain */
2576
2577 X509_STORE_set_flags(cvstore,
2578 X509_V_FLAG_CRL_CHECK|X509_V_FLAG_CRL_CHECK_ALL);
059ec3d9 2579 }
059ec3d9
PH
2580 }
2581
10a831a3 2582#endif /* OPENSSL_VERSION_NUMBER > 0x00907000L */
059ec3d9
PH
2583
2584 /* If verification is optional, don't fail if no certificate */
2585
7be682ca 2586 SSL_CTX_set_verify(sctx,
5a2a0989 2587 SSL_VERIFY_PEER | (optional ? 0 : SSL_VERIFY_FAIL_IF_NO_PEER_CERT),
983207c1 2588 cert_vfy_cb);
059ec3d9
PH
2589 }
2590
2591return OK;
2592}
2593
2594
2595
2596/*************************************************
2597* Start a TLS session in a server *
2598*************************************************/
2599
2600/* This is called when Exim is running as a server, after having received
2601the STARTTLS command. It must respond to that command, and then negotiate
2602a TLS session.
2603
2604Arguments:
2605 require_ciphers allowed ciphers
cf0c6164 2606 errstr pointer to error message
059ec3d9
PH
2607
2608Returns: OK on success
2609 DEFER for errors before the start of the negotiation
4c04137d 2610 FAIL for errors during the negotiation; the server can't
059ec3d9
PH
2611 continue running.
2612*/
2613
2614int
cf0c6164 2615tls_server_start(const uschar * require_ciphers, uschar ** errstr)
059ec3d9
PH
2616{
2617int rc;
cf0c6164
JH
2618uschar * expciphers;
2619tls_ext_ctx_cb * cbinfo;
f69979cf 2620static uschar peerdn[256];
059ec3d9
PH
2621
2622/* Check for previous activation */
2623
74f1a423 2624if (tls_in.active.sock >= 0)
059ec3d9 2625 {
cf0c6164 2626 tls_error(US"STARTTLS received after TLS started", NULL, US"", errstr);
925ac8e4 2627 smtp_printf("554 Already in TLS\r\n", FALSE);
059ec3d9
PH
2628 return FAIL;
2629 }
2630
2631/* Initialize the SSL library. If it fails, it will already have logged
2632the error. */
2633
817d9f57 2634rc = tls_init(&server_ctx, NULL, tls_dhparam, tls_certificate, tls_privatekey,
f2de3a33 2635#ifndef DISABLE_OCSP
5b2fd993 2636 tls_ocsp_file,
3f7eeb86 2637#endif
b10c87b3 2638 NULL, &server_static_cbinfo, &tls_in, errstr);
059ec3d9 2639if (rc != OK) return rc;
817d9f57 2640cbinfo = server_static_cbinfo;
059ec3d9 2641
cf0c6164 2642if (!expand_check(require_ciphers, US"tls_require_ciphers", &expciphers, errstr))
059ec3d9
PH
2643 return FAIL;
2644
2645/* In OpenSSL, cipher components are separated by hyphens. In GnuTLS, they
17c76198
PP
2646were historically separated by underscores. So that I can use either form in my
2647tests, and also for general convenience, we turn underscores into hyphens here.
0c3807a8
JH
2648
2649XXX SSL_CTX_set_cipher_list() is replaced by SSL_CTX_set_ciphersuites()
2650for TLS 1.3 . Since we do not call it at present we get the default list:
2651TLS_AES_256_GCM_SHA384:TLS_CHACHA20_POLY1305_SHA256:TLS_AES_128_GCM_SHA256
17c76198 2652*/
059ec3d9 2653
c3033f13 2654if (expciphers)
059ec3d9 2655 {
b10c87b3 2656 for (uschar * s = expciphers; *s; s++ ) if (*s == '_') *s = '-';
059ec3d9 2657 DEBUG(D_tls) debug_printf("required ciphers: %s\n", expciphers);
817d9f57 2658 if (!SSL_CTX_set_cipher_list(server_ctx, CS expciphers))
cf0c6164 2659 return tls_error(US"SSL_CTX_set_cipher_list", NULL, NULL, errstr);
7be682ca 2660 cbinfo->server_cipher_list = expciphers;
059ec3d9
PH
2661 }
2662
2663/* If this is a host for which certificate verification is mandatory or
2664optional, set up appropriately. */
2665
817d9f57 2666tls_in.certificate_verified = FALSE;
c0635b6d 2667#ifdef SUPPORT_DANE
53a7196b
JH
2668tls_in.dane_verified = FALSE;
2669#endif
a2ff477a 2670server_verify_callback_called = FALSE;
059ec3d9
PH
2671
2672if (verify_check_host(&tls_verify_hosts) == OK)
2673 {
983207c1 2674 rc = setup_certs(server_ctx, tls_verify_certificates, tls_crl, NULL,
afdb5e9c 2675 FALSE, verify_callback_server, errstr);
059ec3d9 2676 if (rc != OK) return rc;
a2ff477a 2677 server_verify_optional = FALSE;
059ec3d9
PH
2678 }
2679else if (verify_check_host(&tls_try_verify_hosts) == OK)
2680 {
983207c1 2681 rc = setup_certs(server_ctx, tls_verify_certificates, tls_crl, NULL,
afdb5e9c 2682 TRUE, verify_callback_server, errstr);
059ec3d9 2683 if (rc != OK) return rc;
a2ff477a 2684 server_verify_optional = TRUE;
059ec3d9
PH
2685 }
2686
b10c87b3
JH
2687#ifdef EXPERIMENTAL_TLS_RESUME
2688SSL_CTX_set_tlsext_ticket_key_cb(server_ctx, ticket_key_callback);
2689/* despite working, appears to always return failure, so ignoring */
2690#endif
2691#ifdef OPENSSL_HAVE_NUM_TICKETS
2692# ifdef EXPERIMENTAL_TLS_RESUME
2693SSL_CTX_set_num_tickets(server_ctx, tls_in.host_resumable ? 1 : 0);
2694# else
2695SSL_CTX_set_num_tickets(server_ctx, 0); /* send no TLS1.3 stateful-tickets */
2696# endif
2697#endif
2698
2699
059ec3d9
PH
2700/* Prepare for new connection */
2701
cf0c6164
JH
2702if (!(server_ssl = SSL_new(server_ctx)))
2703 return tls_error(US"SSL_new", NULL, NULL, errstr);
da3ad30d
PP
2704
2705/* Warning: we used to SSL_clear(ssl) here, it was removed.
2706 *
2707 * With the SSL_clear(), we get strange interoperability bugs with
2708 * OpenSSL 1.0.1b and TLS1.1/1.2. It looks as though this may be a bug in
2709 * OpenSSL itself, as a clear should not lead to inability to follow protocols.
2710 *
2711 * The SSL_clear() call is to let an existing SSL* be reused, typically after
2712 * session shutdown. In this case, we have a brand new object and there's no
2713 * obvious reason to immediately clear it. I'm guessing that this was
2714 * originally added because of incomplete initialisation which the clear fixed,
2715 * in some historic release.
2716 */
059ec3d9
PH
2717
2718/* Set context and tell client to go ahead, except in the case of TLS startup
2719on connection, where outputting anything now upsets the clients and tends to
2720make them disconnect. We need to have an explicit fflush() here, to force out
2721the response. Other smtp_printf() calls do not need it, because in non-TLS
2722mode, the fflush() happens when smtp_getc() is called. */
2723
817d9f57
JH
2724SSL_set_session_id_context(server_ssl, sid_ctx, Ustrlen(sid_ctx));
2725if (!tls_in.on_connect)
059ec3d9 2726 {
925ac8e4 2727 smtp_printf("220 TLS go ahead\r\n", FALSE);
059ec3d9
PH
2728 fflush(smtp_out);
2729 }
2730
2731/* Now negotiate the TLS session. We put our own timer on it, since it seems
2732that the OpenSSL library doesn't. */
2733
817d9f57
JH
2734SSL_set_wfd(server_ssl, fileno(smtp_out));
2735SSL_set_rfd(server_ssl, fileno(smtp_in));
2736SSL_set_accept_state(server_ssl);
059ec3d9
PH
2737
2738DEBUG(D_tls) debug_printf("Calling SSL_accept\n");
2739
2740sigalrm_seen = FALSE;
c2a1bba0 2741if (smtp_receive_timeout > 0) ALARM(smtp_receive_timeout);
817d9f57 2742rc = SSL_accept(server_ssl);
c2a1bba0 2743ALARM_CLR(0);
059ec3d9
PH
2744
2745if (rc <= 0)
2746 {
c31e16a5
JH
2747 int error = SSL_get_error(server_ssl, rc);
2748 switch(error)
2749 {
2750 case SSL_ERROR_NONE:
2751 break;
2752
2753 case SSL_ERROR_ZERO_RETURN:
2754 DEBUG(D_tls) debug_printf("Got SSL_ERROR_ZERO_RETURN\n");
2755 (void) tls_error(US"SSL_accept", NULL, sigalrm_seen ? US"timed out" : NULL, errstr);
2756
2757 if (SSL_get_shutdown(server_ssl) == SSL_RECEIVED_SHUTDOWN)
2758 SSL_shutdown(server_ssl);
2759
2760 tls_close(NULL, TLS_NO_SHUTDOWN);
2761 return FAIL;
2762
2763 /* Handle genuine errors */
2764 case SSL_ERROR_SSL:
fa9e4a1d
JH
2765 {
2766 uschar * s = US"SSL_accept";
b50e778f 2767 int r = ERR_GET_REASON(ERR_peek_error());
b008f54f
JH
2768 if ( r == SSL_R_WRONG_VERSION_NUMBER
2769#ifdef SSL_R_VERSION_TOO_LOW
2770 || r == SSL_R_VERSION_TOO_LOW
2771#endif
b50e778f 2772 || r == SSL_R_UNKNOWN_PROTOCOL || r == SSL_R_UNSUPPORTED_PROTOCOL)
fa9e4a1d
JH
2773 s = string_sprintf("%s (%s)", s, SSL_get_version(server_ssl));
2774 (void) tls_error(s, NULL, sigalrm_seen ? US"timed out" : NULL, errstr);
c31e16a5 2775 return FAIL;
fa9e4a1d 2776 }
c31e16a5
JH
2777
2778 default:
2779 DEBUG(D_tls) debug_printf("Got SSL error %d\n", error);
2780 if (error == SSL_ERROR_SYSCALL)
2781 {
2782 if (!errno)
2783 {
2784 *errstr = US"SSL_accept: TCP connection closed by peer";
2785 return FAIL;
2786 }
2787 DEBUG(D_tls) debug_printf(" - syscall %s\n", strerror(errno));
2788 }
2789 (void) tls_error(US"SSL_accept", NULL, sigalrm_seen ? US"timed out" : NULL, errstr);
2790 return FAIL;
2791 }
059ec3d9
PH
2792 }
2793
2794DEBUG(D_tls) debug_printf("SSL_accept was successful\n");
25fa0868 2795ERR_clear_error(); /* Even success can leave errors in the stack. Seen with
b10c87b3
JH
2796 anon-authentication ciphersuite negotiated. */
2797
2798#ifdef EXPERIMENTAL_TLS_RESUME
2799if (SSL_session_reused(server_ssl))
2800 {
2801 tls_in.resumption |= RESUME_USED;
2802 DEBUG(D_tls) debug_printf("Session reused\n");
2803 }
2804#endif
059ec3d9 2805
da40b1ec
JH
2806/* TLS has been set up. Record data for the connection,
2807adjust the input functions to read via TLS, and initialize things. */
059ec3d9 2808
17ba0f52 2809#ifdef SSL_get_extms_support
1c519e07 2810tls_in.ext_master_secret = SSL_get_extms_support(server_ssl) == 1;
17ba0f52 2811#endif
f69979cf
JH
2812peer_cert(server_ssl, &tls_in, peerdn, sizeof(peerdn));
2813
da40b1ec
JH
2814tls_in.ver = tlsver_name(server_ssl);
2815tls_in.cipher = construct_cipher_name(server_ssl, tls_in.ver, &tls_in.bits);
f1be21cf
JH
2816tls_in.cipher_stdname = cipher_stdname_ssl(server_ssl);
2817
059ec3d9
PH
2818DEBUG(D_tls)
2819 {
2820 uschar buf[2048];
f1be21cf 2821 if (SSL_get_shared_ciphers(server_ssl, CS buf, sizeof(buf)))
059ec3d9 2822 debug_printf("Shared ciphers: %s\n", buf);
f20cfa4a
JH
2823
2824#ifdef EXIM_HAVE_OPENSSL_KEYLOG
2825 {
10ed27e0 2826 BIO * bp = BIO_new_fp(debug_file, BIO_NOCLOSE);
f20cfa4a 2827 SSL_SESSION_print_keylog(bp, SSL_get_session(server_ssl));
f20cfa4a
JH
2828 BIO_free(bp);
2829 }
2830#endif
b10c87b3
JH
2831
2832#ifdef EXIM_HAVE_SESSION_TICKET
2833 {
2834 SSL_SESSION * ss = SSL_get_session(server_ssl);
40618fb6 2835 if (SSL_SESSION_has_ticket(ss)) /* 1.1.0 */
b10c87b3
JH
2836 debug_printf("The session has a ticket, life %lu seconds\n",
2837 SSL_SESSION_get_ticket_lifetime_hint(ss));
2838 }
2839#endif
059ec3d9
PH
2840 }
2841
9d1c15ef
JH
2842/* Record the certificate we presented */
2843 {
2844 X509 * crt = SSL_get_certificate(server_ssl);
2845 tls_in.ourcert = crt ? X509_dup(crt) : NULL;
2846 }
059ec3d9 2847
b1a32a3c
JH
2848/* Channel-binding info for authenticators
2849See description in https://paquier.xyz/postgresql-2/channel-binding-openssl/ */
2850 {
2851 uschar c, * s;
2852 size_t len = SSL_get_peer_finished(server_ssl, &c, 0);
2853 int old_pool = store_pool;
c8b050fd 2854
b1a32a3c
JH
2855 SSL_get_peer_finished(server_ssl, s = store_get((int)len, FALSE), len);
2856 store_pool = POOL_PERM;
2857 tls_in.channelbinding = b64encode_taint(CUS s, (int)len, FALSE);
2858 store_pool = old_pool;
14a806d6 2859 DEBUG(D_tls) debug_printf("Have channel bindings cached for possible auth usage %p\n", tls_in.channelbinding);
b1a32a3c
JH
2860 }
2861
817d9f57
JH
2862/* Only used by the server-side tls (tls_in), including tls_getc.
2863 Client-side (tls_out) reads (seem to?) go via
2864 smtp_read_response()/ip_recv().
2865 Hence no need to duplicate for _in and _out.
2866 */
b808677c 2867if (!ssl_xfer_buffer) ssl_xfer_buffer = store_malloc(ssl_xfer_buffer_size);
059ec3d9 2868ssl_xfer_buffer_lwm = ssl_xfer_buffer_hwm = 0;
8b77d27a 2869ssl_xfer_eof = ssl_xfer_error = FALSE;
059ec3d9
PH
2870
2871receive_getc = tls_getc;
0d81dabc 2872receive_getbuf = tls_getbuf;
584e96c6 2873receive_get_cache = tls_get_cache;
059ec3d9
PH
2874receive_ungetc = tls_ungetc;
2875receive_feof = tls_feof;
2876receive_ferror = tls_ferror;
58eb016e 2877receive_smtp_buffered = tls_smtp_buffered;
059ec3d9 2878
74f1a423
JH
2879tls_in.active.sock = fileno(smtp_out);
2880tls_in.active.tls_ctx = NULL; /* not using explicit ctx for server-side */
059ec3d9
PH
2881return OK;
2882}
2883
2884
2885
2886
043b1248
JH
2887static int
2888tls_client_basic_ctx_init(SSL_CTX * ctx,
cf0c6164
JH
2889 host_item * host, smtp_transport_options_block * ob, tls_ext_ctx_cb * cbinfo,
2890 uschar ** errstr)
043b1248
JH
2891{
2892int rc;
94431adb 2893/* stick to the old behaviour for compatibility if tls_verify_certificates is
043b1248
JH
2894 set but both tls_verify_hosts and tls_try_verify_hosts is not set. Check only
2895 the specified host patterns if one of them is defined */
2896
610ff438
JH
2897if ( ( !ob->tls_verify_hosts
2898 && (!ob->tls_try_verify_hosts || !*ob->tls_try_verify_hosts)
2899 )
3c07dd2d 2900 || verify_check_given_host(CUSS &ob->tls_verify_hosts, host) == OK
aa2a70ba 2901 )
043b1248 2902 client_verify_optional = FALSE;
3c07dd2d 2903else if (verify_check_given_host(CUSS &ob->tls_try_verify_hosts, host) == OK)
aa2a70ba
JH
2904 client_verify_optional = TRUE;
2905else
2906 return OK;
2907
2908if ((rc = setup_certs(ctx, ob->tls_verify_certificates,
cf0c6164
JH
2909 ob->tls_crl, host, client_verify_optional, verify_callback_client,
2910 errstr)) != OK)
aa2a70ba 2911 return rc;
043b1248 2912
3c07dd2d 2913if (verify_check_given_host(CUSS &ob->tls_verify_cert_hostnames, host) == OK)
043b1248 2914 {
4af0d74a 2915 cbinfo->verify_cert_hostnames =
8c5d388a 2916#ifdef SUPPORT_I18N
4af0d74a
JH
2917 string_domain_utf8_to_alabel(host->name, NULL);
2918#else
2919 host->name;
2920#endif
aa2a70ba
JH
2921 DEBUG(D_tls) debug_printf("Cert hostname to check: \"%s\"\n",
2922 cbinfo->verify_cert_hostnames);
043b1248 2923 }
043b1248
JH
2924return OK;
2925}
059ec3d9 2926
fde080a4 2927
c0635b6d 2928#ifdef SUPPORT_DANE
fde080a4 2929static int
cf0c6164 2930dane_tlsa_load(SSL * ssl, host_item * host, dns_answer * dnsa, uschar ** errstr)
fde080a4 2931{
fde080a4
JH
2932dns_scan dnss;
2933const char * hostnames[2] = { CS host->name, NULL };
2934int found = 0;
2935
2936if (DANESSL_init(ssl, NULL, hostnames) != 1)
cf0c6164 2937 return tls_error(US"hostnames load", host, NULL, errstr);
fde080a4 2938
d7978c0f 2939for (dns_record * rr = dns_next_rr(dnsa, &dnss, RESET_ANSWERS); rr;
fde080a4 2940 rr = dns_next_rr(dnsa, &dnss, RESET_NEXT)
1b76ad22 2941 ) if (rr->type == T_TLSA && rr->size > 3)
fde080a4 2942 {
c3033f13 2943 const uschar * p = rr->data;
fde080a4
JH
2944 uint8_t usage, selector, mtype;
2945 const char * mdname;
2946
fde080a4 2947 usage = *p++;
133d2546
JH
2948
2949 /* Only DANE-TA(2) and DANE-EE(3) are supported */
2950 if (usage != 2 && usage != 3) continue;
2951
fde080a4
JH
2952 selector = *p++;
2953 mtype = *p++;
2954
2955 switch (mtype)
2956 {
133d2546
JH
2957 default: continue; /* Only match-types 0, 1, 2 are supported */
2958 case 0: mdname = NULL; break;
2959 case 1: mdname = "sha256"; break;
2960 case 2: mdname = "sha512"; break;
fde080a4
JH
2961 }
2962
133d2546 2963 found++;
fde080a4
JH
2964 switch (DANESSL_add_tlsa(ssl, usage, selector, mdname, p, rr->size - 3))
2965 {
2966 default:
cf0c6164 2967 return tls_error(US"tlsa load", host, NULL, errstr);
c035b645 2968 case 0: /* action not taken */
fde080a4
JH
2969 case 1: break;
2970 }
594706ea
JH
2971
2972 tls_out.tlsa_usage |= 1<<usage;
fde080a4
JH
2973 }
2974
2975if (found)
2976 return OK;
2977
133d2546 2978log_write(0, LOG_MAIN, "DANE error: No usable TLSA records");
6ebd79ec 2979return DEFER;
fde080a4 2980}
c0635b6d 2981#endif /*SUPPORT_DANE*/
fde080a4
JH
2982
2983
2984
b10c87b3
JH
2985#ifdef EXPERIMENTAL_TLS_RESUME
2986/* On the client, get any stashed session for the given IP from hints db
2987and apply it to the ssl-connection for attempted resumption. */
2988
2989static void
2990tls_retrieve_session(tls_support * tlsp, SSL * ssl, const uschar * key)
2991{
2992tlsp->resumption |= RESUME_SUPPORTED;
2993if (tlsp->host_resumable)
2994 {
2995 dbdata_tls_session * dt;
2996 int len;
2997 open_db dbblock, * dbm_file;
2998
2999 tlsp->resumption |= RESUME_CLIENT_REQUESTED;
3000 DEBUG(D_tls) debug_printf("checking for resumable session for %s\n", key);
c685a2e3 3001 if ((dbm_file = dbfn_open(US"tls", O_RDWR, &dbblock, FALSE, FALSE)))
b10c87b3
JH
3002 {
3003 /* key for the db is the IP */
3004 if ((dt = dbfn_read_with_length(dbm_file, key, &len)))
3005 {
3006 SSL_SESSION * ss = NULL;
3007 const uschar * sess_asn1 = dt->session;
3008
3009 len -= sizeof(dbdata_tls_session);
3010 if (!(d2i_SSL_SESSION(&ss, &sess_asn1, (long)len)))
3011 {
3012 DEBUG(D_tls)
3013 {
3014 ERR_error_string_n(ERR_get_error(),
3015 ssl_errstring, sizeof(ssl_errstring));
3016 debug_printf("decoding session: %s\n", ssl_errstring);
3017 }
3018 }
a775dd1d 3019#ifdef EXIM_HAVE_SESSION_TICKET
4f1d23a1
JH
3020 else if ( SSL_SESSION_get_ticket_lifetime_hint(ss) + dt->time_stamp
3021 < time(NULL))
3022 {
3023 DEBUG(D_tls) debug_printf("session expired\n");
3024 dbfn_delete(dbm_file, key);
3025 }
a775dd1d 3026#endif
b10c87b3
JH
3027 else if (!SSL_set_session(ssl, ss))
3028 {
3029 DEBUG(D_tls)
3030 {
3031 ERR_error_string_n(ERR_get_error(),
3032 ssl_errstring, sizeof(ssl_errstring));
3033 debug_printf("applying session to ssl: %s\n", ssl_errstring);
3034 }
3035 }
3036 else
3037 {
3038 DEBUG(D_tls) debug_printf("good session\n");
3039 tlsp->resumption |= RESUME_CLIENT_SUGGESTED;
f4e62a87 3040 tlsp->verify_override = dt->verify_override;
c82de233 3041 tlsp->ocsp = dt->ocsp;
b10c87b3
JH
3042 }
3043 }
3044 else
3045 DEBUG(D_tls) debug_printf("no session record\n");
3046 dbfn_close(dbm_file);
3047 }
3048 }
3049}
3050
3051
3052/* On the client, save the session for later resumption */
3053
3054static int
3055tls_save_session_cb(SSL * ssl, SSL_SESSION * ss)
3056{
3057tls_ext_ctx_cb * cbinfo = SSL_get_ex_data(ssl, tls_exdata_idx);
3058tls_support * tlsp;
3059
3060DEBUG(D_tls) debug_printf("tls_save_session_cb\n");
3061
3062if (!cbinfo || !(tlsp = cbinfo->tlsp)->host_resumable) return 0;
3063
40618fb6
JH
3064# ifdef OPENSSL_HAVE_NUM_TICKETS
3065if (SSL_SESSION_is_resumable(ss)) /* 1.1.1 */
3066# endif
b10c87b3
JH
3067 {
3068 int len = i2d_SSL_SESSION(ss, NULL);
3069 int dlen = sizeof(dbdata_tls_session) + len;
f3ebb786 3070 dbdata_tls_session * dt = store_get(dlen, TRUE);
b10c87b3
JH
3071 uschar * s = dt->session;
3072 open_db dbblock, * dbm_file;
3073
3074 DEBUG(D_tls) debug_printf("session is resumable\n");
3075 tlsp->resumption |= RESUME_SERVER_TICKET; /* server gave us a ticket */
3076
f4e62a87 3077 dt->verify_override = tlsp->verify_override;
c82de233 3078 dt->ocsp = tlsp->ocsp;
f4e62a87 3079 (void) i2d_SSL_SESSION(ss, &s); /* s gets bumped to end */
b10c87b3
JH
3080
3081 if ((dbm_file = dbfn_open(US"tls", O_RDWR, &dbblock, FALSE, FALSE)))
3082 {
3083 const uschar * key = cbinfo->host->address;
3084 dbfn_delete(dbm_file, key);
3085 dbfn_write(dbm_file, key, dt, dlen);
3086 dbfn_close(dbm_file);
3087 DEBUG(D_tls) debug_printf("wrote session (len %u) to db\n",
3088 (unsigned)dlen);
3089 }
3090 }
b10c87b3
JH
3091return 1;
3092}
3093
3094
3095static void
3096tls_client_ctx_resume_prehandshake(
3097 exim_openssl_client_tls_ctx * exim_client_ctx, tls_support * tlsp,
3098 smtp_transport_options_block * ob, host_item * host)
3099{
3100/* Should the client request a session resumption ticket? */
3101if (verify_check_given_host(CUSS &ob->tls_resumption_hosts, host) == OK)
3102 {
3103 tlsp->host_resumable = TRUE;
3104
3105 SSL_CTX_set_session_cache_mode(exim_client_ctx->ctx,
3106 SSL_SESS_CACHE_CLIENT
3107 | SSL_SESS_CACHE_NO_INTERNAL | SSL_SESS_CACHE_NO_AUTO_CLEAR);
3108 SSL_CTX_sess_set_new_cb(exim_client_ctx->ctx, tls_save_session_cb);
3109 }
3110}
3111
3112static BOOL
3113tls_client_ssl_resume_prehandshake(SSL * ssl, tls_support * tlsp,
3114 host_item * host, uschar ** errstr)
3115{
3116if (tlsp->host_resumable)
3117 {
3118 DEBUG(D_tls)
3119 debug_printf("tls_resumption_hosts overrides openssl_options, enabling tickets\n");
3120 SSL_clear_options(ssl, SSL_OP_NO_TICKET);
3121
3122 tls_exdata_idx = SSL_get_ex_new_index(0, 0, 0, 0, 0);
3123 if (!SSL_set_ex_data(ssl, tls_exdata_idx, client_static_cbinfo))
3124 {
3125 tls_error(US"set ex_data", host, NULL, errstr);
3126 return FALSE;
3127 }
3128 debug_printf("tls_exdata_idx %d cbinfo %p\n", tls_exdata_idx, client_static_cbinfo);
3129 }
3130
3131tlsp->resumption = RESUME_SUPPORTED;
3132/* Pick up a previous session, saved on an old ticket */
3133tls_retrieve_session(tlsp, ssl, host->address);
3134return TRUE;
3135}
3136
3137static void
3138tls_client_resume_posthandshake(exim_openssl_client_tls_ctx * exim_client_ctx,
3139 tls_support * tlsp)
3140{
3141if (SSL_session_reused(exim_client_ctx->ssl))
3142 {
3143 DEBUG(D_tls) debug_printf("The session was reused\n");
3144 tlsp->resumption |= RESUME_USED;
3145 }
3146}
3147#endif /* EXPERIMENTAL_TLS_RESUME */
3148
3149
059ec3d9
PH
3150/*************************************************
3151* Start a TLS session in a client *
3152*************************************************/
3153
3154/* Called from the smtp transport after STARTTLS has been accepted.
3155
c05bdbd6
JH
3156Arguments:
3157 cctx connection context
3158 conn_args connection details
3159 cookie datum for randomness; can be NULL
3160 tlsp record details of TLS channel configuration here; must be non-NULL
3161 errstr error string pointer
3162
3163Returns: TRUE for success with TLS session context set in connection context,
3164 FALSE on error
059ec3d9
PH
3165*/
3166
c05bdbd6
JH
3167BOOL
3168tls_client_start(client_conn_ctx * cctx, smtp_connect_args * conn_args,
3169 void * cookie, tls_support * tlsp, uschar ** errstr)
059ec3d9 3170{
c05bdbd6
JH
3171host_item * host = conn_args->host; /* for msgs and option-tests */
3172transport_instance * tb = conn_args->tblock; /* always smtp or NULL */
afdb5e9c
JH
3173smtp_transport_options_block * ob = tb
3174 ? (smtp_transport_options_block *)tb->options_block
3175 : &smtp_transport_option_defaults;
74f1a423 3176exim_openssl_client_tls_ctx * exim_client_ctx;
868f5672 3177uschar * expciphers;
059ec3d9 3178int rc;
c05bdbd6 3179static uschar peerdn[256];
043b1248
JH
3180
3181#ifndef DISABLE_OCSP
043b1248 3182BOOL request_ocsp = FALSE;
6634ac8d 3183BOOL require_ocsp = FALSE;
043b1248 3184#endif
043b1248 3185
74f1a423
JH
3186rc = store_pool;
3187store_pool = POOL_PERM;
f3ebb786 3188exim_client_ctx = store_get(sizeof(exim_openssl_client_tls_ctx), FALSE);
c09dbcfb 3189exim_client_ctx->corked = NULL;
74f1a423
JH
3190store_pool = rc;
3191
c0635b6d 3192#ifdef SUPPORT_DANE
74f1a423 3193tlsp->tlsa_usage = 0;
043b1248
JH
3194#endif
3195
f2de3a33 3196#ifndef DISABLE_OCSP
043b1248 3197 {
c0635b6d 3198# ifdef SUPPORT_DANE
c05bdbd6 3199 if ( conn_args->dane
4f59c424
JH
3200 && ob->hosts_request_ocsp[0] == '*'
3201 && ob->hosts_request_ocsp[1] == '\0'
3202 )
3203 {
3204 /* Unchanged from default. Use a safer one under DANE */
3205 request_ocsp = TRUE;
3206 ob->hosts_request_ocsp = US"${if or { {= {0}{$tls_out_tlsa_usage}} "
3207 " {= {4}{$tls_out_tlsa_usage}} } "
3208 " {*}{}}";
3209 }
3210# endif
3211
5130845b 3212 if ((require_ocsp =
3c07dd2d 3213 verify_check_given_host(CUSS &ob->hosts_require_ocsp, host) == OK))
fca41d5a
JH
3214 request_ocsp = TRUE;
3215 else
c0635b6d 3216# ifdef SUPPORT_DANE
4f59c424 3217 if (!request_ocsp)
fca41d5a 3218# endif
5130845b 3219 request_ocsp =
3c07dd2d 3220 verify_check_given_host(CUSS &ob->hosts_request_ocsp, host) == OK;
043b1248 3221 }
f5d78688 3222#endif
059ec3d9 3223
74f1a423 3224rc = tls_init(&exim_client_ctx->ctx, host, NULL,
65867078 3225 ob->tls_certificate, ob->tls_privatekey,
f2de3a33 3226#ifndef DISABLE_OCSP
44662487 3227 (void *)(long)request_ocsp,
3f7eeb86 3228#endif
b10c87b3 3229 cookie, &client_static_cbinfo, tlsp, errstr);
c05bdbd6 3230if (rc != OK) return FALSE;
059ec3d9 3231
74f1a423 3232tlsp->certificate_verified = FALSE;
a2ff477a 3233client_verify_callback_called = FALSE;
059ec3d9 3234
5ec37a55
PP
3235expciphers = NULL;
3236#ifdef SUPPORT_DANE
c05bdbd6 3237if (conn_args->dane)
5ec37a55
PP
3238 {
3239 /* We fall back to tls_require_ciphers if unset, empty or forced failure, but
3240 other failures should be treated as problems. */
3241 if (ob->dane_require_tls_ciphers &&
3242 !expand_check(ob->dane_require_tls_ciphers, US"dane_require_tls_ciphers",
3243 &expciphers, errstr))
c05bdbd6 3244 return FALSE;
5ec37a55
PP
3245 if (expciphers && *expciphers == '\0')
3246 expciphers = NULL;
3247 }
3248#endif
3249if (!expciphers &&
3250 !expand_check(ob->tls_require_ciphers, US"tls_require_ciphers",
3251 &expciphers, errstr))
c05bdbd6 3252 return FALSE;
059ec3d9
PH
3253
3254/* In OpenSSL, cipher components are separated by hyphens. In GnuTLS, they
3255are separated by underscores. So that I can use either form in my tests, and
3256also for general convenience, we turn underscores into hyphens here. */
3257
cf0c6164 3258if (expciphers)
059ec3d9
PH
3259 {
3260 uschar *s = expciphers;
cf0c6164 3261 while (*s) { if (*s == '_') *s = '-'; s++; }
059ec3d9 3262 DEBUG(D_tls) debug_printf("required ciphers: %s\n", expciphers);
74f1a423
JH
3263 if (!SSL_CTX_set_cipher_list(exim_client_ctx->ctx, CS expciphers))
3264 {
3265 tls_error(US"SSL_CTX_set_cipher_list", host, NULL, errstr);
c05bdbd6 3266 return FALSE;
74f1a423 3267 }
059ec3d9
PH
3268 }
3269
c0635b6d 3270#ifdef SUPPORT_DANE
c05bdbd6 3271if (conn_args->dane)
a63be306 3272 {
74f1a423 3273 SSL_CTX_set_verify(exim_client_ctx->ctx,
02af313d
JH
3274 SSL_VERIFY_PEER | SSL_VERIFY_FAIL_IF_NO_PEER_CERT,
3275 verify_callback_client_dane);
e5cccda9 3276
043b1248 3277 if (!DANESSL_library_init())
74f1a423
JH
3278 {
3279 tls_error(US"library init", host, NULL, errstr);
c05bdbd6 3280 return FALSE;
74f1a423
JH
3281 }
3282 if (DANESSL_CTX_init(exim_client_ctx->ctx) <= 0)
3283 {
3284 tls_error(US"context init", host, NULL, errstr);
c05bdbd6 3285 return FALSE;
74f1a423 3286 }
043b1248
JH
3287 }
3288else
e51c7be2 3289
043b1248
JH
3290#endif
3291
74f1a423
JH
3292 if (tls_client_basic_ctx_init(exim_client_ctx->ctx, host, ob,
3293 client_static_cbinfo, errstr) != OK)
c05bdbd6 3294 return FALSE;
059ec3d9 3295
b10c87b3
JH
3296#ifdef EXPERIMENTAL_TLS_RESUME
3297tls_client_ctx_resume_prehandshake(exim_client_ctx, tlsp, ob, host);
3298#endif
3299
3300
74f1a423
JH
3301if (!(exim_client_ctx->ssl = SSL_new(exim_client_ctx->ctx)))
3302 {
3303 tls_error(US"SSL_new", host, NULL, errstr);
c05bdbd6 3304 return FALSE;
74f1a423
JH
3305 }
3306SSL_set_session_id_context(exim_client_ctx->ssl, sid_ctx, Ustrlen(sid_ctx));
b10c87b3 3307
c05bdbd6 3308SSL_set_fd(exim_client_ctx->ssl, cctx->sock);
74f1a423 3309SSL_set_connect_state(exim_client_ctx->ssl);
059ec3d9 3310
65867078 3311if (ob->tls_sni)
3f0945ff 3312 {
74f1a423 3313 if (!expand_check(ob->tls_sni, US"tls_sni", &tlsp->sni, errstr))
c05bdbd6 3314 return FALSE;
74f1a423 3315 if (!tlsp->sni)
2c9a0e86
PP
3316 {
3317 DEBUG(D_tls) debug_printf("Setting TLS SNI forced to fail, not sending\n");
3318 }
74f1a423
JH
3319 else if (!Ustrlen(tlsp->sni))
3320 tlsp->sni = NULL;
3f0945ff
PP
3321 else
3322 {
35731706 3323#ifdef EXIM_HAVE_OPENSSL_TLSEXT
74f1a423
JH
3324 DEBUG(D_tls) debug_printf("Setting TLS SNI \"%s\"\n", tlsp->sni);
3325 SSL_set_tlsext_host_name(exim_client_ctx->ssl, tlsp->sni);
35731706 3326#else
66802652 3327 log_write(0, LOG_MAIN, "SNI unusable with this OpenSSL library version; ignoring \"%s\"\n",
74f1a423 3328 tlsp->sni);
35731706 3329#endif