OpenSSL: avoid loading server's CA-list-for-client-notification on client
[exim.git] / src / src / tls-openssl.c
CommitLineData
059ec3d9
PH
1/*************************************************
2* Exim - an Internet mail transport agent *
3*************************************************/
4
b10c87b3 5/* Copyright (c) University of Cambridge 1995 - 2019 */
059ec3d9
PH
6/* See the file NOTICE for conditions of use and distribution. */
7
f5d78688
JH
8/* Portions Copyright (c) The OpenSSL Project 1999 */
9
059ec3d9
PH
10/* This module provides the TLS (aka SSL) support for Exim using the OpenSSL
11library. It is #included into the tls.c file when that library is used. The
12code herein is based on a patch that was originally contributed by Steve
13Haslam. It was adapted from stunnel, a GPL program by Michal Trojnara.
14
15No cryptographic code is included in Exim. All this module does is to call
16functions from the OpenSSL library. */
17
18
19/* Heading stuff */
20
21#include <openssl/lhash.h>
22#include <openssl/ssl.h>
23#include <openssl/err.h>
24#include <openssl/rand.h>
10ca4f1c
JH
25#ifndef OPENSSL_NO_ECDH
26# include <openssl/ec.h>
27#endif
f2de3a33 28#ifndef DISABLE_OCSP
e51c7be2 29# include <openssl/ocsp.h>
3f7eeb86 30#endif
c0635b6d 31#ifdef SUPPORT_DANE
05e796ad 32# include "danessl.h"
85098ee7
JH
33#endif
34
3f7eeb86 35
f2de3a33
JH
36#ifndef DISABLE_OCSP
37# define EXIM_OCSP_SKEW_SECONDS (300L)
38# define EXIM_OCSP_MAX_AGE (-1L)
3f7eeb86 39#endif
059ec3d9 40
3bcbbbe2 41#if OPENSSL_VERSION_NUMBER >= 0x0090806fL && !defined(OPENSSL_NO_TLSEXT)
e51c7be2 42# define EXIM_HAVE_OPENSSL_TLSEXT
3bcbbbe2 43#endif
c8dfb21d
JH
44#if OPENSSL_VERSION_NUMBER >= 0x00908000L
45# define EXIM_HAVE_RSA_GENKEY_EX
46#endif
47#if OPENSSL_VERSION_NUMBER >= 0x10100000L
48# define EXIM_HAVE_OCSP_RESP_COUNT
b038d456 49# define OPENSSL_AUTO_SHA256
c8dfb21d
JH
50#else
51# define EXIM_HAVE_EPHEM_RSA_KEX
52# define EXIM_HAVE_RAND_PSEUDO
53#endif
54#if (OPENSSL_VERSION_NUMBER >= 0x0090800fL) && !defined(OPENSSL_NO_SHA256)
8442641e 55# define EXIM_HAVE_SHA256
c8dfb21d 56#endif
34e3241d 57
d7978c0f
JH
58/* X509_check_host provides sane certificate hostname checking, but was added
59to OpenSSL late, after other projects forked off the code-base. So in
60addition to guarding against the base version number, beware that LibreSSL
61does not (at this time) support this function.
62
63If LibreSSL gains a different API, perhaps via libtls, then we'll probably
64opt to disentangle and ask a LibreSSL user to provide glue for a third
65crypto provider for libtls instead of continuing to tie the OpenSSL glue
66into even twistier knots. If LibreSSL gains the same API, we can just
67change this guard and punt the issue for a while longer. */
68
34e3241d
PP
69#ifndef LIBRESSL_VERSION_NUMBER
70# if OPENSSL_VERSION_NUMBER >= 0x010100000L
71# define EXIM_HAVE_OPENSSL_CHECKHOST
8420742d 72# define EXIM_HAVE_OPENSSL_DH_BITS
7a8b9519 73# define EXIM_HAVE_OPENSSL_TLS_METHOD
f20cfa4a 74# define EXIM_HAVE_OPENSSL_KEYLOG
f1be21cf 75# define EXIM_HAVE_OPENSSL_CIPHER_GET_ID
b10c87b3 76# define EXIM_HAVE_SESSION_TICKET
e570d136 77# define EXIM_HAVE_OPESSL_TRACE
012dd02e 78# define EXIM_HAVE_OPESSL_GET0_SERIAL
97277c1f
JH
79# ifndef DISABLE_OCSP
80# define EXIM_HAVE_OCSP
81# endif
7434882d
JH
82# else
83# define EXIM_NEED_OPENSSL_INIT
34e3241d
PP
84# endif
85# if OPENSSL_VERSION_NUMBER >= 0x010000000L \
2dfb468b 86 && (OPENSSL_VERSION_NUMBER & 0x0000ff000L) >= 0x000002000L
34e3241d
PP
87# define EXIM_HAVE_OPENSSL_CHECKHOST
88# endif
11aa88b0 89#endif
10ca4f1c 90
11aa88b0
RA
91#if !defined(LIBRESSL_VERSION_NUMBER) \
92 || LIBRESSL_VERSION_NUMBER >= 0x20010000L
10ca4f1c
JH
93# if !defined(OPENSSL_NO_ECDH)
94# if OPENSSL_VERSION_NUMBER >= 0x0090800fL
8442641e 95# define EXIM_HAVE_ECDH
10ca4f1c
JH
96# endif
97# if OPENSSL_VERSION_NUMBER >= 0x10002000L
10ca4f1c
JH
98# define EXIM_HAVE_OPENSSL_EC_NIST2NID
99# endif
100# endif
2dfb468b 101#endif
3bcbbbe2 102
8a40db1c
JH
103#ifndef LIBRESSL_VERSION_NUMBER
104# if OPENSSL_VERSION_NUMBER >= 0x010101000L
105# define OPENSSL_HAVE_KEYLOG_CB
d7f31bb6 106# define OPENSSL_HAVE_NUM_TICKETS
f1be21cf 107# define EXIM_HAVE_OPENSSL_CIPHER_STD_NAME
97277c1f
JH
108# else
109# define OPENSSL_BAD_SRVR_OURCERT
8a40db1c
JH
110# endif
111#endif
112
67791ce4
JH
113#if !defined(EXIM_HAVE_OPENSSL_TLSEXT) && !defined(DISABLE_OCSP)
114# warning "OpenSSL library version too old; define DISABLE_OCSP in Makefile"
115# define DISABLE_OCSP
116#endif
43e2db44
JH
117
118#ifdef EXPERIMENTAL_TLS_RESUME
119# if OPENSSL_VERSION_NUMBER < 0x0101010L
120# error OpenSSL version too old for session-resumption
121# endif
122#endif
67791ce4 123
a6510420
JH
124#ifdef EXIM_HAVE_OPENSSL_CHECKHOST
125# include <openssl/x509v3.h>
126#endif
127
f1be21cf
JH
128#ifndef EXIM_HAVE_OPENSSL_CIPHER_STD_NAME
129# ifndef EXIM_HAVE_OPENSSL_CIPHER_GET_ID
130# define SSL_CIPHER_get_id(c) (c->id)
131# endif
dca6d121
JH
132# ifndef MACRO_PREDEF
133# include "tls-cipher-stdname.c"
134# endif
f1be21cf
JH
135#endif
136
8442641e
JH
137/*************************************************
138* OpenSSL option parse *
139*************************************************/
140
141typedef struct exim_openssl_option {
142 uschar *name;
143 long value;
144} exim_openssl_option;
145/* We could use a macro to expand, but we need the ifdef and not all the
146options document which version they were introduced in. Policylet: include
147all options unless explicitly for DTLS, let the administrator choose which
148to apply.
149
150This list is current as of:
c8b050fd 151 ==> 1.1.1c <==
2043336d
JH
152
153XXX could we autobuild this list, as with predefined-macros?
c8b050fd 154Seems just parsing ssl.h for SSL_OP_.* would be enough (except to exclude DTLS).
2043336d 155Also allow a numeric literal?
8442641e
JH
156*/
157static exim_openssl_option exim_openssl_options[] = {
158/* KEEP SORTED ALPHABETICALLY! */
159#ifdef SSL_OP_ALL
6d95688d 160 { US"all", (long) SSL_OP_ALL },
8442641e 161#endif
c8b050fd
PP
162#ifdef SSL_OP_ALLOW_NO_DHE_KEX
163 { US"allow_no_dhe_kex", SSL_OP_ALLOW_NO_DHE_KEX },
164#endif
8442641e
JH
165#ifdef SSL_OP_ALLOW_UNSAFE_LEGACY_RENEGOTIATION
166 { US"allow_unsafe_legacy_renegotiation", SSL_OP_ALLOW_UNSAFE_LEGACY_RENEGOTIATION },
167#endif
168#ifdef SSL_OP_CIPHER_SERVER_PREFERENCE
169 { US"cipher_server_preference", SSL_OP_CIPHER_SERVER_PREFERENCE },
170#endif
c8b050fd
PP
171#ifdef SSL_OP_CRYPTOPRO_TLSEXT_BUG
172 { US"cryptopro_tlsext_bug", SSL_OP_CRYPTOPRO_TLSEXT_BUG },
173#endif
8442641e
JH
174#ifdef SSL_OP_DONT_INSERT_EMPTY_FRAGMENTS
175 { US"dont_insert_empty_fragments", SSL_OP_DONT_INSERT_EMPTY_FRAGMENTS },
176#endif
c8b050fd
PP
177#ifdef SSL_OP_ENABLE_MIDDLEBOX_COMPAT
178 { US"enable_middlebox_compat", SSL_OP_ENABLE_MIDDLEBOX_COMPAT },
179#endif
8442641e
JH
180#ifdef SSL_OP_EPHEMERAL_RSA
181 { US"ephemeral_rsa", SSL_OP_EPHEMERAL_RSA },
182#endif
183#ifdef SSL_OP_LEGACY_SERVER_CONNECT
184 { US"legacy_server_connect", SSL_OP_LEGACY_SERVER_CONNECT },
185#endif
186#ifdef SSL_OP_MICROSOFT_BIG_SSLV3_BUFFER
187 { US"microsoft_big_sslv3_buffer", SSL_OP_MICROSOFT_BIG_SSLV3_BUFFER },
188#endif
189#ifdef SSL_OP_MICROSOFT_SESS_ID_BUG
190 { US"microsoft_sess_id_bug", SSL_OP_MICROSOFT_SESS_ID_BUG },
191#endif
192#ifdef SSL_OP_MSIE_SSLV2_RSA_PADDING
193 { US"msie_sslv2_rsa_padding", SSL_OP_MSIE_SSLV2_RSA_PADDING },
194#endif
195#ifdef SSL_OP_NETSCAPE_CHALLENGE_BUG
196 { US"netscape_challenge_bug", SSL_OP_NETSCAPE_CHALLENGE_BUG },
197#endif
198#ifdef SSL_OP_NETSCAPE_REUSE_CIPHER_CHANGE_BUG
199 { US"netscape_reuse_cipher_change_bug", SSL_OP_NETSCAPE_REUSE_CIPHER_CHANGE_BUG },
200#endif
c8b050fd
PP
201#ifdef SSL_OP_NO_ANTI_REPLAY
202 { US"no_anti_replay", SSL_OP_NO_ANTI_REPLAY },
203#endif
8442641e
JH
204#ifdef SSL_OP_NO_COMPRESSION
205 { US"no_compression", SSL_OP_NO_COMPRESSION },
206#endif
c8b050fd
PP
207#ifdef SSL_OP_NO_ENCRYPT_THEN_MAC
208 { US"no_encrypt_then_mac", SSL_OP_NO_ENCRYPT_THEN_MAC },
209#endif
2043336d
JH
210#ifdef SSL_OP_NO_RENEGOTIATION
211 { US"no_renegotiation", SSL_OP_NO_RENEGOTIATION },
212#endif
8442641e
JH
213#ifdef SSL_OP_NO_SESSION_RESUMPTION_ON_RENEGOTIATION
214 { US"no_session_resumption_on_renegotiation", SSL_OP_NO_SESSION_RESUMPTION_ON_RENEGOTIATION },
215#endif
216#ifdef SSL_OP_NO_SSLv2
217 { US"no_sslv2", SSL_OP_NO_SSLv2 },
218#endif
219#ifdef SSL_OP_NO_SSLv3
220 { US"no_sslv3", SSL_OP_NO_SSLv3 },
221#endif
222#ifdef SSL_OP_NO_TICKET
223 { US"no_ticket", SSL_OP_NO_TICKET },
224#endif
225#ifdef SSL_OP_NO_TLSv1
226 { US"no_tlsv1", SSL_OP_NO_TLSv1 },
227#endif
228#ifdef SSL_OP_NO_TLSv1_1
229#if SSL_OP_NO_TLSv1_1 == 0x00000400L
230 /* Error in chosen value in 1.0.1a; see first item in CHANGES for 1.0.1b */
231#warning OpenSSL 1.0.1a uses a bad value for SSL_OP_NO_TLSv1_1, ignoring
232#else
233 { US"no_tlsv1_1", SSL_OP_NO_TLSv1_1 },
234#endif
235#endif
236#ifdef SSL_OP_NO_TLSv1_2
237 { US"no_tlsv1_2", SSL_OP_NO_TLSv1_2 },
238#endif
239#ifdef SSL_OP_NO_TLSv1_3
240 { US"no_tlsv1_3", SSL_OP_NO_TLSv1_3 },
241#endif
c8b050fd
PP
242#ifdef SSL_OP_PRIORITIZE_CHACHA
243 { US"prioritize_chacha", SSL_OP_PRIORITIZE_CHACHA },
244#endif
8442641e
JH
245#ifdef SSL_OP_SAFARI_ECDHE_ECDSA_BUG
246 { US"safari_ecdhe_ecdsa_bug", SSL_OP_SAFARI_ECDHE_ECDSA_BUG },
247#endif
248#ifdef SSL_OP_SINGLE_DH_USE
249 { US"single_dh_use", SSL_OP_SINGLE_DH_USE },
250#endif
251#ifdef SSL_OP_SINGLE_ECDH_USE
252 { US"single_ecdh_use", SSL_OP_SINGLE_ECDH_USE },
253#endif
254#ifdef SSL_OP_SSLEAY_080_CLIENT_DH_BUG
255 { US"ssleay_080_client_dh_bug", SSL_OP_SSLEAY_080_CLIENT_DH_BUG },
256#endif
257#ifdef SSL_OP_SSLREF2_REUSE_CERT_TYPE_BUG
258 { US"sslref2_reuse_cert_type_bug", SSL_OP_SSLREF2_REUSE_CERT_TYPE_BUG },
259#endif
260#ifdef SSL_OP_TLS_BLOCK_PADDING_BUG
261 { US"tls_block_padding_bug", SSL_OP_TLS_BLOCK_PADDING_BUG },
262#endif
263#ifdef SSL_OP_TLS_D5_BUG
264 { US"tls_d5_bug", SSL_OP_TLS_D5_BUG },
265#endif
266#ifdef SSL_OP_TLS_ROLLBACK_BUG
267 { US"tls_rollback_bug", SSL_OP_TLS_ROLLBACK_BUG },
268#endif
c8b050fd
PP
269#ifdef SSL_OP_TLSEXT_PADDING
270 { US"tlsext_padding", SSL_OP_TLSEXT_PADDING },
271#endif
8442641e
JH
272};
273
274#ifndef MACRO_PREDEF
275static int exim_openssl_options_size = nelem(exim_openssl_options);
276#endif
277
278#ifdef MACRO_PREDEF
279void
280options_tls(void)
281{
8442641e
JH
282uschar buf[64];
283
d7978c0f 284for (struct exim_openssl_option * o = exim_openssl_options;
8442641e
JH
285 o < exim_openssl_options + nelem(exim_openssl_options); o++)
286 {
287 /* Trailing X is workaround for problem with _OPT_OPENSSL_NO_TLSV1
288 being a ".ifdef _OPT_OPENSSL_NO_TLSV1_3" match */
289
290 spf(buf, sizeof(buf), US"_OPT_OPENSSL_%T_X", o->name);
291 builtin_macro_create(buf);
292 }
b10c87b3
JH
293
294# ifdef EXPERIMENTAL_TLS_RESUME
295builtin_macro_create_var(US"_RESUME_DECODE", RESUME_DECODE_STRING );
296# endif
e326959e
JH
297# ifdef SSL_OP_NO_TLSv1_3
298builtin_macro_create(US"_HAVE_TLS1_3");
299# endif
97277c1f
JH
300# ifdef OPENSSL_BAD_SRVR_OURCERT
301builtin_macro_create(US"_TLS_BAD_MULTICERT_IN_OURCERT");
302# endif
303# ifdef EXIM_HAVE_OCSP
304builtin_macro_create(US"_HAVE_TLS_OCSP");
305builtin_macro_create(US"_HAVE_TLS_OCSP_LIST");
306# endif
8442641e
JH
307}
308#else
309
310/******************************************************************************/
311
059ec3d9
PH
312/* Structure for collecting random data for seeding. */
313
314typedef struct randstuff {
9e3331ea
TK
315 struct timeval tv;
316 pid_t p;
059ec3d9
PH
317} randstuff;
318
319/* Local static variables */
320
a2ff477a
JH
321static BOOL client_verify_callback_called = FALSE;
322static BOOL server_verify_callback_called = FALSE;
059ec3d9
PH
323static const uschar *sid_ctx = US"exim";
324
d4f09789
PP
325/* We have three different contexts to care about.
326
327Simple case: client, `client_ctx`
328 As a client, we can be doing a callout or cut-through delivery while receiving
329 a message. So we have a client context, which should have options initialised
74f1a423
JH
330 from the SMTP Transport. We may also concurrently want to make TLS connections
331 to utility daemons, so client-contexts are allocated and passed around in call
332 args rather than using a gobal.
d4f09789
PP
333
334Server:
335 There are two cases: with and without ServerNameIndication from the client.
336 Given TLS SNI, we can be using different keys, certs and various other
337 configuration settings, because they're re-expanded with $tls_sni set. This
338 allows vhosting with TLS. This SNI is sent in the handshake.
339 A client might not send SNI, so we need a fallback, and an initial setup too.
340 So as a server, we start out using `server_ctx`.
341 If SNI is sent by the client, then we as server, mid-negotiation, try to clone
342 `server_sni` from `server_ctx` and then initialise settings by re-expanding
343 configuration.
344*/
345
74f1a423
JH
346typedef struct {
347 SSL_CTX * ctx;
348 SSL * ssl;
c09dbcfb 349 gstring * corked;
74f1a423
JH
350} exim_openssl_client_tls_ctx;
351
817d9f57 352static SSL_CTX *server_ctx = NULL;
817d9f57 353static SSL *server_ssl = NULL;
389ca47a 354
35731706 355#ifdef EXIM_HAVE_OPENSSL_TLSEXT
817d9f57 356static SSL_CTX *server_sni = NULL;
35731706 357#endif
059ec3d9
PH
358
359static char ssl_errstring[256];
360
dea4b568 361static int ssl_session_timeout = 7200; /* Two hours */
a2ff477a
JH
362static BOOL client_verify_optional = FALSE;
363static BOOL server_verify_optional = FALSE;
059ec3d9 364
f5d78688 365static BOOL reexpand_tls_files_for_sni = FALSE;
059ec3d9
PH
366
367
5b2fd993
JH
368typedef struct ocsp_resp {
369 struct ocsp_resp * next;
370 OCSP_RESPONSE * resp;
371} ocsp_resplist;
372
7be682ca 373typedef struct tls_ext_ctx_cb {
b10c87b3 374 tls_support * tlsp;
7be682ca
PP
375 uschar *certificate;
376 uschar *privatekey;
f5d78688 377 BOOL is_server;
a6510420 378#ifndef DISABLE_OCSP
c3033f13 379 STACK_OF(X509) *verify_stack; /* chain for verifying the proof */
f5d78688
JH
380 union {
381 struct {
382 uschar *file;
5b2fd993
JH
383 const uschar *file_expanded;
384 ocsp_resplist *olist;
f5d78688
JH
385 } server;
386 struct {
44662487
JH
387 X509_STORE *verify_store; /* non-null if status requested */
388 BOOL verify_required;
f5d78688
JH
389 } client;
390 } u_ocsp;
3f7eeb86 391#endif
7be682ca
PP
392 uschar *dhparam;
393 /* these are cached from first expand */
394 uschar *server_cipher_list;
395 /* only passed down to tls_error: */
396 host_item *host;
55414b25 397 const uschar * verify_cert_hostnames;
0cbf2b82 398#ifndef DISABLE_EVENT
a7538db1
JH
399 uschar * event_action;
400#endif
7be682ca
PP
401} tls_ext_ctx_cb;
402
403/* should figure out a cleanup of API to handle state preserved per
404implementation, for various reasons, which can be void * in the APIs.
405For now, we hack around it. */
b10c87b3 406tls_ext_ctx_cb *client_static_cbinfo = NULL; /*XXX should not use static; multiple concurrent clients! */
817d9f57 407tls_ext_ctx_cb *server_static_cbinfo = NULL;
7be682ca
PP
408
409static int
983207c1 410setup_certs(SSL_CTX *sctx, uschar *certs, uschar *crl, host_item *host, BOOL optional,
cf0c6164 411 int (*cert_vfy_cb)(int, X509_STORE_CTX *), uschar ** errstr );
059ec3d9 412
3f7eeb86 413/* Callbacks */
3bcbbbe2 414#ifdef EXIM_HAVE_OPENSSL_TLSEXT
3f7eeb86 415static int tls_servername_cb(SSL *s, int *ad ARG_UNUSED, void *arg);
3bcbbbe2 416#endif
f2de3a33 417#ifndef DISABLE_OCSP
f5d78688 418static int tls_server_stapling_cb(SSL *s, void *arg);
3f7eeb86
PP
419#endif
420
059ec3d9 421
b10c87b3 422
4d93129f 423/* Daemon-called, before every connection, key create/rotate */
b10c87b3
JH
424#ifdef EXPERIMENTAL_TLS_RESUME
425static void tk_init(void);
426static int tls_exdata_idx = -1;
427#endif
428
429void
430tls_daemon_init(void)
431{
432#ifdef EXPERIMENTAL_TLS_RESUME
433tk_init();
434#endif
435return;
436}
437
438
059ec3d9
PH
439/*************************************************
440* Handle TLS error *
441*************************************************/
442
443/* Called from lots of places when errors occur before actually starting to do
444the TLS handshake, that is, while the session is still in clear. Always returns
445DEFER for a server and FAIL for a client so that most calls can use "return
446tls_error(...)" to do this processing and then give an appropriate return. A
447single function is used for both server and client, because it is called from
448some shared functions.
449
450Argument:
451 prefix text to include in the logged error
452 host NULL if setting up a server;
453 the connected host if setting up a client
7199e1ee 454 msg error message or NULL if we should ask OpenSSL
cf0c6164 455 errstr pointer to output error message
059ec3d9
PH
456
457Returns: OK/DEFER/FAIL
458*/
459
460static int
cf0c6164 461tls_error(uschar * prefix, const host_item * host, uschar * msg, uschar ** errstr)
059ec3d9 462{
c562fd30 463if (!msg)
7199e1ee 464 {
0abc5a13 465 ERR_error_string_n(ERR_get_error(), ssl_errstring, sizeof(ssl_errstring));
cf0c6164 466 msg = US ssl_errstring;
7199e1ee
TF
467 }
468
5a2a0989
JH
469msg = string_sprintf("(%s): %s", prefix, msg);
470DEBUG(D_tls) debug_printf("TLS error '%s'\n", msg);
471if (errstr) *errstr = msg;
cf0c6164 472return host ? FAIL : DEFER;
059ec3d9
PH
473}
474
475
476
477/*************************************************
478* Callback to generate RSA key *
479*************************************************/
480
481/*
482Arguments:
3ae79556 483 s SSL connection (not used)
059ec3d9
PH
484 export not used
485 keylength keylength
486
487Returns: pointer to generated key
488*/
489
490static RSA *
491rsa_callback(SSL *s, int export, int keylength)
492{
493RSA *rsa_key;
c8dfb21d
JH
494#ifdef EXIM_HAVE_RSA_GENKEY_EX
495BIGNUM *bn = BN_new();
496#endif
497
059ec3d9
PH
498export = export; /* Shut picky compilers up */
499DEBUG(D_tls) debug_printf("Generating %d bit RSA key...\n", keylength);
c8dfb21d
JH
500
501#ifdef EXIM_HAVE_RSA_GENKEY_EX
502if ( !BN_set_word(bn, (unsigned long)RSA_F4)
f2cb6292 503 || !(rsa_key = RSA_new())
c8dfb21d
JH
504 || !RSA_generate_key_ex(rsa_key, keylength, bn, NULL)
505 )
506#else
23bb6982 507if (!(rsa_key = RSA_generate_key(keylength, RSA_F4, NULL, NULL)))
c8dfb21d
JH
508#endif
509
059ec3d9 510 {
0abc5a13 511 ERR_error_string_n(ERR_get_error(), ssl_errstring, sizeof(ssl_errstring));
059ec3d9
PH
512 log_write(0, LOG_MAIN|LOG_PANIC, "TLS error (RSA_generate_key): %s",
513 ssl_errstring);
514 return NULL;
515 }
516return rsa_key;
517}
518
519
520
f5d78688 521/* Extreme debug
f2de3a33 522#ifndef DISABLE_OCSP
f5d78688
JH
523void
524x509_store_dump_cert_s_names(X509_STORE * store)
525{
526STACK_OF(X509_OBJECT) * roots= store->objs;
f5d78688
JH
527static uschar name[256];
528
d7978c0f 529for (int i= 0; i < sk_X509_OBJECT_num(roots); i++)
f5d78688
JH
530 {
531 X509_OBJECT * tmp_obj= sk_X509_OBJECT_value(roots, i);
532 if(tmp_obj->type == X509_LU_X509)
533 {
70e384dd
JH
534 X509_NAME * sn = X509_get_subject_name(tmp_obj->data.x509);
535 if (X509_NAME_oneline(sn, CS name, sizeof(name)))
536 {
537 name[sizeof(name)-1] = '\0';
538 debug_printf(" %s\n", name);
539 }
f5d78688
JH
540 }
541 }
542}
543#endif
544*/
545
059ec3d9 546
0cbf2b82 547#ifndef DISABLE_EVENT
f69979cf
JH
548static int
549verify_event(tls_support * tlsp, X509 * cert, int depth, const uschar * dn,
550 BOOL *calledp, const BOOL *optionalp, const uschar * what)
551{
552uschar * ev;
553uschar * yield;
554X509 * old_cert;
555
556ev = tlsp == &tls_out ? client_static_cbinfo->event_action : event_action;
557if (ev)
558 {
aaba7d03 559 DEBUG(D_tls) debug_printf("verify_event: %s %d\n", what, depth);
f69979cf
JH
560 old_cert = tlsp->peercert;
561 tlsp->peercert = X509_dup(cert);
562 /* NB we do not bother setting peerdn */
563 if ((yield = event_raise(ev, US"tls:cert", string_sprintf("%d", depth))))
564 {
565 log_write(0, LOG_MAIN, "[%s] %s verify denied by event-action: "
566 "depth=%d cert=%s: %s",
567 tlsp == &tls_out ? deliver_host_address : sender_host_address,
568 what, depth, dn, yield);
569 *calledp = TRUE;
570 if (!*optionalp)
571 {
572 if (old_cert) tlsp->peercert = old_cert; /* restore 1st failing cert */
573 return 1; /* reject (leaving peercert set) */
574 }
575 DEBUG(D_tls) debug_printf("Event-action verify failure overridden "
576 "(host in tls_try_verify_hosts)\n");
4a1bd6b9 577 tlsp->verify_override = TRUE;
f69979cf
JH
578 }
579 X509_free(tlsp->peercert);
580 tlsp->peercert = old_cert;
581 }
582return 0;
583}
584#endif
585
059ec3d9
PH
586/*************************************************
587* Callback for verification *
588*************************************************/
589
590/* The SSL library does certificate verification if set up to do so. This
591callback has the current yes/no state is in "state". If verification succeeded,
f69979cf
JH
592we set the certificate-verified flag. If verification failed, what happens
593depends on whether the client is required to present a verifiable certificate
594or not.
059ec3d9
PH
595
596If verification is optional, we change the state to yes, but still log the
597verification error. For some reason (it really would help to have proper
598documentation of OpenSSL), this callback function then gets called again, this
f69979cf
JH
599time with state = 1. We must take care not to set the private verified flag on
600the second time through.
059ec3d9
PH
601
602Note: this function is not called if the client fails to present a certificate
603when asked. We get here only if a certificate has been received. Handling of
604optional verification for this case is done when requesting SSL to verify, by
605setting SSL_VERIFY_FAIL_IF_NO_PEER_CERT in the non-optional case.
606
a7538db1
JH
607May be called multiple times for different issues with a certificate, even
608for a given "depth" in the certificate chain.
609
059ec3d9 610Arguments:
f2f2c91b
JH
611 preverify_ok current yes/no state as 1/0
612 x509ctx certificate information.
613 tlsp per-direction (client vs. server) support data
614 calledp has-been-called flag
615 optionalp verification-is-optional flag
059ec3d9 616
f2f2c91b 617Returns: 0 if verification should fail, otherwise 1
059ec3d9
PH
618*/
619
620static int
70e384dd
JH
621verify_callback(int preverify_ok, X509_STORE_CTX * x509ctx,
622 tls_support * tlsp, BOOL * calledp, BOOL * optionalp)
059ec3d9 623{
421aff85 624X509 * cert = X509_STORE_CTX_get_current_cert(x509ctx);
a7538db1 625int depth = X509_STORE_CTX_get_error_depth(x509ctx);
f69979cf 626uschar dn[256];
059ec3d9 627
70e384dd
JH
628if (!X509_NAME_oneline(X509_get_subject_name(cert), CS dn, sizeof(dn)))
629 {
630 DEBUG(D_tls) debug_printf("X509_NAME_oneline() error\n");
631 log_write(0, LOG_MAIN, "[%s] SSL verify error: internal error",
632 tlsp == &tls_out ? deliver_host_address : sender_host_address);
633 return 0;
634 }
f69979cf 635dn[sizeof(dn)-1] = '\0';
059ec3d9 636
f4e62a87 637tlsp->verify_override = FALSE;
f2f2c91b 638if (preverify_ok == 0)
059ec3d9 639 {
f77197ae
JH
640 uschar * extra = verify_mode ? string_sprintf(" (during %c-verify for [%s])",
641 *verify_mode, sender_host_address)
642 : US"";
643 log_write(0, LOG_MAIN, "[%s] SSL verify error%s: depth=%d error=%s cert=%s",
644 tlsp == &tls_out ? deliver_host_address : sender_host_address,
645 extra, depth,
646 X509_verify_cert_error_string(X509_STORE_CTX_get_error(x509ctx)), dn);
a2ff477a 647 *calledp = TRUE;
9d1c15ef
JH
648 if (!*optionalp)
649 {
f69979cf
JH
650 if (!tlsp->peercert)
651 tlsp->peercert = X509_dup(cert); /* record failing cert */
652 return 0; /* reject */
9d1c15ef 653 }
059ec3d9
PH
654 DEBUG(D_tls) debug_printf("SSL verify failure overridden (host in "
655 "tls_try_verify_hosts)\n");
4a1bd6b9 656 tlsp->verify_override = TRUE;
059ec3d9
PH
657 }
658
a7538db1 659else if (depth != 0)
059ec3d9 660 {
f69979cf 661 DEBUG(D_tls) debug_printf("SSL verify ok: depth=%d SN=%s\n", depth, dn);
f2de3a33 662#ifndef DISABLE_OCSP
f5d78688
JH
663 if (tlsp == &tls_out && client_static_cbinfo->u_ocsp.client.verify_store)
664 { /* client, wanting stapling */
665 /* Add the server cert's signing chain as the one
666 for the verification of the OCSP stapled information. */
94431adb 667
f5d78688 668 if (!X509_STORE_add_cert(client_static_cbinfo->u_ocsp.client.verify_store,
421aff85 669 cert))
f5d78688 670 ERR_clear_error();
c3033f13 671 sk_X509_push(client_static_cbinfo->verify_stack, cert);
f5d78688
JH
672 }
673#endif
0cbf2b82 674#ifndef DISABLE_EVENT
f69979cf
JH
675 if (verify_event(tlsp, cert, depth, dn, calledp, optionalp, US"SSL"))
676 return 0; /* reject, with peercert set */
a7538db1 677#endif
059ec3d9
PH
678 }
679else
680 {
55414b25 681 const uschar * verify_cert_hostnames;
e51c7be2 682
e51c7be2
JH
683 if ( tlsp == &tls_out
684 && ((verify_cert_hostnames = client_static_cbinfo->verify_cert_hostnames)))
afdb5e9c 685 /* client, wanting hostname check */
e51c7be2 686 {
f69979cf 687
740f36d4 688#ifdef EXIM_HAVE_OPENSSL_CHECKHOST
f69979cf
JH
689# ifndef X509_CHECK_FLAG_NO_PARTIAL_WILDCARDS
690# define X509_CHECK_FLAG_NO_PARTIAL_WILDCARDS 0
691# endif
692# ifndef X509_CHECK_FLAG_SINGLE_LABEL_SUBDOMAINS
693# define X509_CHECK_FLAG_SINGLE_LABEL_SUBDOMAINS 0
694# endif
e51c7be2 695 int sep = 0;
55414b25 696 const uschar * list = verify_cert_hostnames;
e51c7be2 697 uschar * name;
d8e7834a
JH
698 int rc;
699 while ((name = string_nextinlist(&list, &sep, NULL, 0)))
f40d5be3 700 if ((rc = X509_check_host(cert, CCS name, 0,
8d692470 701 X509_CHECK_FLAG_NO_PARTIAL_WILDCARDS
740f36d4
JH
702 | X509_CHECK_FLAG_SINGLE_LABEL_SUBDOMAINS,
703 NULL)))
d8e7834a
JH
704 {
705 if (rc < 0)
706 {
93a6fce2 707 log_write(0, LOG_MAIN, "[%s] SSL verify error: internal error",
f77197ae 708 tlsp == &tls_out ? deliver_host_address : sender_host_address);
d8e7834a
JH
709 name = NULL;
710 }
e51c7be2 711 break;
d8e7834a 712 }
e51c7be2 713 if (!name)
f69979cf 714#else
e51c7be2 715 if (!tls_is_name_for_cert(verify_cert_hostnames, cert))
f69979cf 716#endif
e51c7be2 717 {
f77197ae
JH
718 uschar * extra = verify_mode
719 ? string_sprintf(" (during %c-verify for [%s])",
720 *verify_mode, sender_host_address)
721 : US"";
e51c7be2 722 log_write(0, LOG_MAIN,
f77197ae
JH
723 "[%s] SSL verify error%s: certificate name mismatch: DN=\"%s\" H=\"%s\"",
724 tlsp == &tls_out ? deliver_host_address : sender_host_address,
725 extra, dn, verify_cert_hostnames);
a3ef7310
JH
726 *calledp = TRUE;
727 if (!*optionalp)
f69979cf
JH
728 {
729 if (!tlsp->peercert)
730 tlsp->peercert = X509_dup(cert); /* record failing cert */
731 return 0; /* reject */
732 }
4a1bd6b9 733 DEBUG(D_tls) debug_printf("SSL verify name failure overridden (host in "
a3ef7310 734 "tls_try_verify_hosts)\n");
4a1bd6b9 735 tlsp->verify_override = TRUE;
e51c7be2 736 }
f69979cf 737 }
e51c7be2 738
0cbf2b82 739#ifndef DISABLE_EVENT
f69979cf
JH
740 if (verify_event(tlsp, cert, depth, dn, calledp, optionalp, US"SSL"))
741 return 0; /* reject, with peercert set */
e51c7be2
JH
742#endif
743
93dcb1c2 744 DEBUG(D_tls) debug_printf("SSL%s verify ok: depth=0 SN=%s\n",
f69979cf 745 *calledp ? "" : " authenticated", dn);
93dcb1c2 746 *calledp = TRUE;
059ec3d9
PH
747 }
748
a7538db1 749return 1; /* accept, at least for this level */
059ec3d9
PH
750}
751
a2ff477a 752static int
f2f2c91b 753verify_callback_client(int preverify_ok, X509_STORE_CTX *x509ctx)
a2ff477a 754{
f2f2c91b
JH
755return verify_callback(preverify_ok, x509ctx, &tls_out,
756 &client_verify_callback_called, &client_verify_optional);
a2ff477a
JH
757}
758
759static int
f2f2c91b 760verify_callback_server(int preverify_ok, X509_STORE_CTX *x509ctx)
a2ff477a 761{
f2f2c91b
JH
762return verify_callback(preverify_ok, x509ctx, &tls_in,
763 &server_verify_callback_called, &server_verify_optional);
a2ff477a
JH
764}
765
059ec3d9 766
c0635b6d 767#ifdef SUPPORT_DANE
53a7196b 768
e5cccda9
JH
769/* This gets called *by* the dane library verify callback, which interposes
770itself.
771*/
772static int
f2f2c91b 773verify_callback_client_dane(int preverify_ok, X509_STORE_CTX * x509ctx)
e5cccda9
JH
774{
775X509 * cert = X509_STORE_CTX_get_current_cert(x509ctx);
f69979cf 776uschar dn[256];
83b27293 777int depth = X509_STORE_CTX_get_error_depth(x509ctx);
5c75db2e 778#ifndef DISABLE_EVENT
f69979cf 779BOOL dummy_called, optional = FALSE;
83b27293 780#endif
e5cccda9 781
70e384dd
JH
782if (!X509_NAME_oneline(X509_get_subject_name(cert), CS dn, sizeof(dn)))
783 {
784 DEBUG(D_tls) debug_printf("X509_NAME_oneline() error\n");
785 log_write(0, LOG_MAIN, "[%s] SSL verify error: internal error",
786 deliver_host_address);
787 return 0;
788 }
f69979cf 789dn[sizeof(dn)-1] = '\0';
e5cccda9 790
f2f2c91b
JH
791DEBUG(D_tls) debug_printf("verify_callback_client_dane: %s depth %d %s\n",
792 preverify_ok ? "ok":"BAD", depth, dn);
e5cccda9 793
0cbf2b82 794#ifndef DISABLE_EVENT
f69979cf
JH
795 if (verify_event(&tls_out, cert, depth, dn,
796 &dummy_called, &optional, US"DANE"))
797 return 0; /* reject, with peercert set */
83b27293
JH
798#endif
799
f2f2c91b 800if (preverify_ok == 1)
6fbf3599 801 {
4a1bd6b9 802 tls_out.dane_verified = TRUE;
6fbf3599
JH
803#ifndef DISABLE_OCSP
804 if (client_static_cbinfo->u_ocsp.client.verify_store)
805 { /* client, wanting stapling */
806 /* Add the server cert's signing chain as the one
807 for the verification of the OCSP stapled information. */
808
809 if (!X509_STORE_add_cert(client_static_cbinfo->u_ocsp.client.verify_store,
810 cert))
811 ERR_clear_error();
812 sk_X509_push(client_static_cbinfo->verify_stack, cert);
813 }
814#endif
815 }
f2f2c91b
JH
816else
817 {
818 int err = X509_STORE_CTX_get_error(x509ctx);
819 DEBUG(D_tls)
820 debug_printf(" - err %d '%s'\n", err, X509_verify_cert_error_string(err));
3c51463e 821 if (err == X509_V_ERR_APPLICATION_VERIFICATION)
f2f2c91b
JH
822 preverify_ok = 1;
823 }
824return preverify_ok;
e5cccda9 825}
53a7196b 826
c0635b6d 827#endif /*SUPPORT_DANE*/
e5cccda9 828
059ec3d9
PH
829
830/*************************************************
831* Information callback *
832*************************************************/
833
834/* The SSL library functions call this from time to time to indicate what they
7be682ca
PP
835are doing. We copy the string to the debugging output when TLS debugging has
836been requested.
059ec3d9
PH
837
838Arguments:
839 s the SSL connection
840 where
841 ret
842
843Returns: nothing
844*/
845
846static void
847info_callback(SSL *s, int where, int ret)
848{
0abc5a13
JH
849DEBUG(D_tls)
850 {
851 const uschar * str;
852
853 if (where & SSL_ST_CONNECT)
48224640 854 str = US"SSL_connect";
0abc5a13 855 else if (where & SSL_ST_ACCEPT)
48224640 856 str = US"SSL_accept";
0abc5a13 857 else
48224640 858 str = US"SSL info (undefined)";
0abc5a13
JH
859
860 if (where & SSL_CB_LOOP)
861 debug_printf("%s: %s\n", str, SSL_state_string_long(s));
862 else if (where & SSL_CB_ALERT)
863 debug_printf("SSL3 alert %s:%s:%s\n",
48224640 864 str = where & SSL_CB_READ ? US"read" : US"write",
0abc5a13
JH
865 SSL_alert_type_string_long(ret), SSL_alert_desc_string_long(ret));
866 else if (where & SSL_CB_EXIT)
867 if (ret == 0)
868 debug_printf("%s: failed in %s\n", str, SSL_state_string_long(s));
869 else if (ret < 0)
870 debug_printf("%s: error in %s\n", str, SSL_state_string_long(s));
871 else if (where & SSL_CB_HANDSHAKE_START)
872 debug_printf("%s: hshake start: %s\n", str, SSL_state_string_long(s));
873 else if (where & SSL_CB_HANDSHAKE_DONE)
874 debug_printf("%s: hshake done: %s\n", str, SSL_state_string_long(s));
875 }
059ec3d9
PH
876}
877
8238bc7b 878#ifdef OPENSSL_HAVE_KEYLOG_CB
8a40db1c
JH
879static void
880keylog_callback(const SSL *ssl, const char *line)
881{
2e5d9e71
JH
882char * filename;
883FILE * fp;
8a40db1c 884DEBUG(D_tls) debug_printf("%.200s\n", line);
2e5d9e71
JH
885if (!(filename = getenv("SSLKEYLOGFILE"))) return;
886if (!(fp = fopen(filename, "a"))) return;
887fprintf(fp, "%s\n", line);
888fclose(fp);
8a40db1c 889}
8238bc7b 890#endif
8a40db1c 891
059ec3d9 892
b10c87b3
JH
893#ifdef EXPERIMENTAL_TLS_RESUME
894/* Manage the keysets used for encrypting the session tickets, on the server. */
895
896typedef struct { /* Session ticket encryption key */
897 uschar name[16];
898
899 const EVP_CIPHER * aes_cipher;
4d93129f 900 uschar aes_key[32]; /* size needed depends on cipher. aes_128 implies 128/8 = 16? */
b10c87b3
JH
901 const EVP_MD * hmac_hash;
902 uschar hmac_key[16];
903 time_t renew;
904 time_t expire;
905} exim_stek;
906
4d93129f
JH
907static exim_stek exim_tk; /* current key */
908static exim_stek exim_tk_old; /* previous key */
b10c87b3
JH
909
910static void
911tk_init(void)
912{
4d93129f
JH
913time_t t = time(NULL);
914
b10c87b3
JH
915if (exim_tk.name[0])
916 {
4d93129f 917 if (exim_tk.renew >= t) return;
b10c87b3
JH
918 exim_tk_old = exim_tk;
919 }
920
921if (f.running_in_test_harness) ssl_session_timeout = 6;
922
923DEBUG(D_tls) debug_printf("OpenSSL: %s STEK\n", exim_tk.name[0] ? "rotating" : "creating");
924if (RAND_bytes(exim_tk.aes_key, sizeof(exim_tk.aes_key)) <= 0) return;
925if (RAND_bytes(exim_tk.hmac_key, sizeof(exim_tk.hmac_key)) <= 0) return;
926if (RAND_bytes(exim_tk.name+1, sizeof(exim_tk.name)-1) <= 0) return;
927
928exim_tk.name[0] = 'E';
4d93129f 929exim_tk.aes_cipher = EVP_aes_256_cbc();
b10c87b3 930exim_tk.hmac_hash = EVP_sha256();
4d93129f
JH
931exim_tk.expire = t + ssl_session_timeout;
932exim_tk.renew = t + ssl_session_timeout/2;
b10c87b3
JH
933}
934
935static exim_stek *
936tk_current(void)
937{
938if (!exim_tk.name[0]) return NULL;
939return &exim_tk;
940}
941
942static exim_stek *
943tk_find(const uschar * name)
944{
945return memcmp(name, exim_tk.name, sizeof(exim_tk.name)) == 0 ? &exim_tk
946 : memcmp(name, exim_tk_old.name, sizeof(exim_tk_old.name)) == 0 ? &exim_tk_old
947 : NULL;
948}
949
950/* Callback for session tickets, on server */
951static int
952ticket_key_callback(SSL * ssl, uschar key_name[16],
953 uschar * iv, EVP_CIPHER_CTX * ctx, HMAC_CTX * hctx, int enc)
954{
955tls_support * tlsp = server_static_cbinfo->tlsp;
956exim_stek * key;
957
958if (enc)
959 {
960 DEBUG(D_tls) debug_printf("ticket_key_callback: create new session\n");
961 tlsp->resumption |= RESUME_CLIENT_REQUESTED;
962
963 if (RAND_bytes(iv, EVP_MAX_IV_LENGTH) <= 0)
964 return -1; /* insufficient random */
965
966 if (!(key = tk_current())) /* current key doesn't exist or isn't valid */
967 return 0; /* key couldn't be created */
968 memcpy(key_name, key->name, 16);
d70fc283 969 DEBUG(D_tls) debug_printf("STEK expire " TIME_T_FMT "\n", key->expire - time(NULL));
b10c87b3
JH
970
971 /*XXX will want these dependent on the ssl session strength */
972 HMAC_Init_ex(hctx, key->hmac_key, sizeof(key->hmac_key),
973 key->hmac_hash, NULL);
974 EVP_EncryptInit_ex(ctx, key->aes_cipher, NULL, key->aes_key, iv);
975
976 DEBUG(D_tls) debug_printf("ticket created\n");
977 return 1;
978 }
979else
980 {
981 time_t now = time(NULL);
982
983 DEBUG(D_tls) debug_printf("ticket_key_callback: retrieve session\n");
984 tlsp->resumption |= RESUME_CLIENT_SUGGESTED;
985
986 if (!(key = tk_find(key_name)) || key->expire < now)
987 {
988 DEBUG(D_tls)
989 {
990 debug_printf("ticket not usable (%s)\n", key ? "expired" : "not found");
d70fc283 991 if (key) debug_printf("STEK expire " TIME_T_FMT "\n", key->expire - now);
b10c87b3
JH
992 }
993 return 0;
994 }
995
996 HMAC_Init_ex(hctx, key->hmac_key, sizeof(key->hmac_key),
997 key->hmac_hash, NULL);
998 EVP_DecryptInit_ex(ctx, key->aes_cipher, NULL, key->aes_key, iv);
999
d70fc283 1000 DEBUG(D_tls) debug_printf("ticket usable, STEK expire " TIME_T_FMT "\n", key->expire - now);
dea4b568
JH
1001
1002 /* The ticket lifetime and renewal are the same as the STEK lifetime and
1003 renewal, which is overenthusiastic. A factor of, say, 3x longer STEK would
1004 be better. To do that we'd have to encode ticket lifetime in the name as
1005 we don't yet see the restored session. Could check posthandshake for TLS1.3
1006 and trigger a new ticket then, but cannot do that for TLS1.2 */
b10c87b3
JH
1007 return key->renew < now ? 2 : 1;
1008 }
1009}
1010#endif
1011
1012
059ec3d9
PH
1013
1014/*************************************************
1015* Initialize for DH *
1016*************************************************/
1017
1018/* If dhparam is set, expand it, and load up the parameters for DH encryption.
1019
1020Arguments:
038597d2 1021 sctx The current SSL CTX (inbound or outbound)
a799883d 1022 dhparam DH parameter file or fixed parameter identity string
7199e1ee 1023 host connected host, if client; NULL if server
cf0c6164 1024 errstr error string pointer
059ec3d9
PH
1025
1026Returns: TRUE if OK (nothing to set up, or setup worked)
1027*/
1028
1029static BOOL
cf0c6164 1030init_dh(SSL_CTX *sctx, uschar *dhparam, const host_item *host, uschar ** errstr)
059ec3d9 1031{
059ec3d9
PH
1032BIO *bio;
1033DH *dh;
1034uschar *dhexpanded;
a799883d 1035const char *pem;
6600985a 1036int dh_bitsize;
059ec3d9 1037
cf0c6164 1038if (!expand_check(dhparam, US"tls_dhparam", &dhexpanded, errstr))
059ec3d9
PH
1039 return FALSE;
1040
0df4ab80 1041if (!dhexpanded || !*dhexpanded)
a799883d 1042 bio = BIO_new_mem_buf(CS std_dh_prime_default(), -1);
a799883d 1043else if (dhexpanded[0] == '/')
059ec3d9 1044 {
0df4ab80 1045 if (!(bio = BIO_new_file(CS dhexpanded, "r")))
059ec3d9 1046 {
7199e1ee 1047 tls_error(string_sprintf("could not read dhparams file %s", dhexpanded),
cf0c6164 1048 host, US strerror(errno), errstr);
a799883d 1049 return FALSE;
059ec3d9 1050 }
a799883d
PP
1051 }
1052else
1053 {
1054 if (Ustrcmp(dhexpanded, "none") == 0)
059ec3d9 1055 {
a799883d
PP
1056 DEBUG(D_tls) debug_printf("Requested no DH parameters.\n");
1057 return TRUE;
059ec3d9 1058 }
a799883d 1059
0df4ab80 1060 if (!(pem = std_dh_prime_named(dhexpanded)))
a799883d
PP
1061 {
1062 tls_error(string_sprintf("Unknown standard DH prime \"%s\"", dhexpanded),
cf0c6164 1063 host, US strerror(errno), errstr);
a799883d
PP
1064 return FALSE;
1065 }
1066 bio = BIO_new_mem_buf(CS pem, -1);
1067 }
1068
0df4ab80 1069if (!(dh = PEM_read_bio_DHparams(bio, NULL, NULL, NULL)))
a799883d 1070 {
059ec3d9 1071 BIO_free(bio);
a799883d 1072 tls_error(string_sprintf("Could not read tls_dhparams \"%s\"", dhexpanded),
cf0c6164 1073 host, NULL, errstr);
a799883d
PP
1074 return FALSE;
1075 }
1076
6600985a
PP
1077/* note: our default limit of 2236 is not a multiple of 8; the limit comes from
1078 * an NSS limit, and the GnuTLS APIs handle bit-sizes fine, so we went with
1079 * 2236. But older OpenSSL can only report in bytes (octets), not bits.
1080 * If someone wants to dance at the edge, then they can raise the limit or use
1081 * current libraries. */
1082#ifdef EXIM_HAVE_OPENSSL_DH_BITS
1083/* Added in commit 26c79d5641d; `git describe --contains` says OpenSSL_1_1_0-pre1~1022
1084 * This predates OpenSSL_1_1_0 (before a, b, ...) so is in all 1.1.0 */
1085dh_bitsize = DH_bits(dh);
1086#else
1087dh_bitsize = 8 * DH_size(dh);
1088#endif
1089
a799883d
PP
1090/* Even if it is larger, we silently return success rather than cause things
1091 * to fail out, so that a too-large DH will not knock out all TLS; it's a
1092 * debatable choice. */
6600985a 1093if (dh_bitsize > tls_dh_max_bits)
a799883d
PP
1094 {
1095 DEBUG(D_tls)
170f4904 1096 debug_printf("dhparams file %d bits, is > tls_dh_max_bits limit of %d\n",
6600985a 1097 dh_bitsize, tls_dh_max_bits);
a799883d
PP
1098 }
1099else
1100 {
1101 SSL_CTX_set_tmp_dh(sctx, dh);
1102 DEBUG(D_tls)
1103 debug_printf("Diffie-Hellman initialized from %s with %d-bit prime\n",
6600985a 1104 dhexpanded ? dhexpanded : US"default", dh_bitsize);
059ec3d9
PH
1105 }
1106
a799883d
PP
1107DH_free(dh);
1108BIO_free(bio);
1109
1110return TRUE;
059ec3d9
PH
1111}
1112
1113
1114
1115
038597d2
PP
1116/*************************************************
1117* Initialize for ECDH *
1118*************************************************/
1119
1120/* Load parameters for ECDH encryption.
1121
1122For now, we stick to NIST P-256 because: it's simple and easy to configure;
1123it avoids any patent issues that might bite redistributors; despite events in
1124the news and concerns over curve choices, we're not cryptographers, we're not
1125pretending to be, and this is "good enough" to be better than no support,
1126protecting against most adversaries. Given another year or two, there might
1127be sufficient clarity about a "right" way forward to let us make an informed
1128decision, instead of a knee-jerk reaction.
1129
1130Longer-term, we should look at supporting both various named curves and
1131external files generated with "openssl ecparam", much as we do for init_dh().
1132We should also support "none" as a value, to explicitly avoid initialisation.
1133
1134Patches welcome.
1135
1136Arguments:
1137 sctx The current SSL CTX (inbound or outbound)
1138 host connected host, if client; NULL if server
cf0c6164 1139 errstr error string pointer
038597d2
PP
1140
1141Returns: TRUE if OK (nothing to set up, or setup worked)
1142*/
1143
1144static BOOL
cf0c6164 1145init_ecdh(SSL_CTX * sctx, host_item * host, uschar ** errstr)
038597d2 1146{
63f0dbe0
JH
1147#ifdef OPENSSL_NO_ECDH
1148return TRUE;
1149#else
1150
10ca4f1c
JH
1151EC_KEY * ecdh;
1152uschar * exp_curve;
1153int nid;
1154BOOL rv;
1155
038597d2
PP
1156if (host) /* No ECDH setup for clients, only for servers */
1157 return TRUE;
1158
10ca4f1c 1159# ifndef EXIM_HAVE_ECDH
038597d2
PP
1160DEBUG(D_tls)
1161 debug_printf("No OpenSSL API to define ECDH parameters, skipping\n");
1162return TRUE;
038597d2 1163# else
10ca4f1c 1164
cf0c6164 1165if (!expand_check(tls_eccurve, US"tls_eccurve", &exp_curve, errstr))
10ca4f1c
JH
1166 return FALSE;
1167if (!exp_curve || !*exp_curve)
1168 return TRUE;
1169
8e53a4fc 1170/* "auto" needs to be handled carefully.
4c04137d 1171 * OpenSSL < 1.0.2: we do not select anything, but fallback to prime256v1
8e53a4fc 1172 * OpenSSL < 1.1.0: we have to call SSL_CTX_set_ecdh_auto
4c04137d 1173 * (openssl/ssl.h defines SSL_CTRL_SET_ECDH_AUTO)
8e53a4fc
HSHR
1174 * OpenSSL >= 1.1.0: we do not set anything, the libray does autoselection
1175 * https://github.com/openssl/openssl/commit/fe6ef2472db933f01b59cad82aa925736935984b
1176 */
10ca4f1c 1177if (Ustrcmp(exp_curve, "auto") == 0)
038597d2 1178 {
8e53a4fc 1179#if OPENSSL_VERSION_NUMBER < 0x10002000L
10ca4f1c 1180 DEBUG(D_tls) debug_printf(
8e53a4fc 1181 "ECDH OpenSSL < 1.0.2: temp key parameter settings: overriding \"auto\" with \"prime256v1\"\n");
78a3bbd5 1182 exp_curve = US"prime256v1";
8e53a4fc
HSHR
1183#else
1184# if defined SSL_CTRL_SET_ECDH_AUTO
1185 DEBUG(D_tls) debug_printf(
1186 "ECDH OpenSSL 1.0.2+ temp key parameter settings: autoselection\n");
10ca4f1c
JH
1187 SSL_CTX_set_ecdh_auto(sctx, 1);
1188 return TRUE;
8e53a4fc
HSHR
1189# else
1190 DEBUG(D_tls) debug_printf(
1191 "ECDH OpenSSL 1.1.0+ temp key parameter settings: default selection\n");
1192 return TRUE;
1193# endif
1194#endif
10ca4f1c 1195 }
038597d2 1196
10ca4f1c
JH
1197DEBUG(D_tls) debug_printf("ECDH: curve '%s'\n", exp_curve);
1198if ( (nid = OBJ_sn2nid (CCS exp_curve)) == NID_undef
1199# ifdef EXIM_HAVE_OPENSSL_EC_NIST2NID
1200 && (nid = EC_curve_nist2nid(CCS exp_curve)) == NID_undef
1201# endif
1202 )
1203 {
cf0c6164
JH
1204 tls_error(string_sprintf("Unknown curve name tls_eccurve '%s'", exp_curve),
1205 host, NULL, errstr);
10ca4f1c
JH
1206 return FALSE;
1207 }
038597d2 1208
10ca4f1c
JH
1209if (!(ecdh = EC_KEY_new_by_curve_name(nid)))
1210 {
cf0c6164 1211 tls_error(US"Unable to create ec curve", host, NULL, errstr);
10ca4f1c 1212 return FALSE;
038597d2 1213 }
10ca4f1c
JH
1214
1215/* The "tmp" in the name here refers to setting a temporary key
1216not to the stability of the interface. */
1217
1218if ((rv = SSL_CTX_set_tmp_ecdh(sctx, ecdh) == 0))
cf0c6164 1219 tls_error(string_sprintf("Error enabling '%s' curve", exp_curve), host, NULL, errstr);
10ca4f1c
JH
1220else
1221 DEBUG(D_tls) debug_printf("ECDH: enabled '%s' curve\n", exp_curve);
1222
1223EC_KEY_free(ecdh);
1224return !rv;
1225
1226# endif /*EXIM_HAVE_ECDH*/
1227#endif /*OPENSSL_NO_ECDH*/
038597d2
PP
1228}
1229
1230
1231
1232
f2de3a33 1233#ifndef DISABLE_OCSP
3f7eeb86
PP
1234/*************************************************
1235* Load OCSP information into state *
1236*************************************************/
f5d78688 1237/* Called to load the server OCSP response from the given file into memory, once
3f7eeb86
PP
1238caller has determined this is needed. Checks validity. Debugs a message
1239if invalid.
1240
1241ASSUMES: single response, for single cert.
1242
1243Arguments:
1244 sctx the SSL_CTX* to update
1245 cbinfo various parts of session state
5b2fd993 1246 filename the filename putatively holding an OCSP response
86ede124 1247 is_pem file is PEM format; otherwise is DER
3f7eeb86
PP
1248
1249*/
1250
1251static void
5b2fd993 1252ocsp_load_response(SSL_CTX * sctx, tls_ext_ctx_cb * cbinfo,
86ede124 1253 const uschar * filename, BOOL is_pem)
3f7eeb86 1254{
ee5b1e28
JH
1255BIO * bio;
1256OCSP_RESPONSE * resp;
1257OCSP_BASICRESP * basic_response;
1258OCSP_SINGLERESP * single_response;
1259ASN1_GENERALIZEDTIME * rev, * thisupd, * nextupd;
ee5b1e28 1260STACK_OF(X509) * sk;
3f7eeb86
PP
1261unsigned long verify_flags;
1262int status, reason, i;
1263
86ede124
JH
1264DEBUG(D_tls)
1265 debug_printf("tls_ocsp_file (%s) '%s'\n", is_pem ? "PEM" : "DER", filename);
3f7eeb86 1266
5b2fd993 1267if (!(bio = BIO_new_file(CS filename, "rb")))
3f7eeb86
PP
1268 {
1269 DEBUG(D_tls) debug_printf("Failed to open OCSP response file \"%s\"\n",
5b2fd993 1270 filename);
3f7eeb86
PP
1271 return;
1272 }
1273
86ede124
JH
1274if (is_pem)
1275 {
1276 uschar * data, * freep;
1277 char * dummy;
1278 long len;
1279 if (!PEM_read_bio(bio, &dummy, &dummy, &data, &len))
1280 {
1281 DEBUG(D_tls) debug_printf("Failed to read PEM file \"%s\"\n",
1282 filename);
1283 return;
1284 }
1285debug_printf("read pem file\n");
1286 freep = data;
1287 resp = d2i_OCSP_RESPONSE(NULL, CUSS &data, len);
1288 OPENSSL_free(freep);
1289 }
1290else
1291 resp = d2i_OCSP_RESPONSE_bio(bio, NULL);
3f7eeb86 1292BIO_free(bio);
86ede124 1293
3f7eeb86
PP
1294if (!resp)
1295 {
1296 DEBUG(D_tls) debug_printf("Error reading OCSP response.\n");
1297 return;
1298 }
1299
ee5b1e28 1300if ((status = OCSP_response_status(resp)) != OCSP_RESPONSE_STATUS_SUCCESSFUL)
3f7eeb86
PP
1301 {
1302 DEBUG(D_tls) debug_printf("OCSP response not valid: %s (%d)\n",
1303 OCSP_response_status_str(status), status);
f5d78688 1304 goto bad;
3f7eeb86
PP
1305 }
1306
5b2fd993
JH
1307#ifdef notdef
1308 {
1309 BIO * bp = BIO_new_fp(debug_file, BIO_NOCLOSE);
1310 OCSP_RESPONSE_print(bp, resp, 0); /* extreme debug: stapling content */
1311 BIO_free(bp);
1312 }
1313#endif
1314
ee5b1e28 1315if (!(basic_response = OCSP_response_get1_basic(resp)))
3f7eeb86
PP
1316 {
1317 DEBUG(D_tls)
1318 debug_printf("OCSP response parse error: unable to extract basic response.\n");
f5d78688 1319 goto bad;
3f7eeb86
PP
1320 }
1321
c3033f13 1322sk = cbinfo->verify_stack;
3f7eeb86
PP
1323verify_flags = OCSP_NOVERIFY; /* check sigs, but not purpose */
1324
1325/* May need to expose ability to adjust those flags?
1326OCSP_NOSIGS OCSP_NOVERIFY OCSP_NOCHAIN OCSP_NOCHECKS OCSP_NOEXPLICIT
1327OCSP_TRUSTOTHER OCSP_NOINTERN */
1328
4c04137d 1329/* This does a full verify on the OCSP proof before we load it for serving
ee5b1e28
JH
1330up; possibly overkill - just date-checks might be nice enough.
1331
1332OCSP_basic_verify takes a "store" arg, but does not
1333use it for the chain verification, which is all we do
1334when OCSP_NOVERIFY is set. The content from the wire
1335"basic_response" and a cert-stack "sk" are all that is used.
1336
c3033f13
JH
1337We have a stack, loaded in setup_certs() if tls_verify_certificates
1338was a file (not a directory, or "system"). It is unfortunate we
1339cannot used the connection context store, as that would neatly
1340handle the "system" case too, but there seems to be no library
1341function for getting a stack from a store.
e3555426 1342[ In OpenSSL 1.1 - ? X509_STORE_CTX_get0_chain(ctx) ? ]
c3033f13
JH
1343We do not free the stack since it could be needed a second time for
1344SNI handling.
1345
4c04137d 1346Separately we might try to replace using OCSP_basic_verify() - which seems to not
5ec37a55 1347be a public interface into the OpenSSL library (there's no manual entry) -
ee5b1e28 1348But what with? We also use OCSP_basic_verify in the client stapling callback.
4c04137d 1349And there we NEED it; we must verify that status... unless the
ee5b1e28
JH
1350library does it for us anyway? */
1351
1352if ((i = OCSP_basic_verify(basic_response, sk, NULL, verify_flags)) < 0)
3f7eeb86 1353 {
ee5b1e28
JH
1354 DEBUG(D_tls)
1355 {
0abc5a13 1356 ERR_error_string_n(ERR_get_error(), ssl_errstring, sizeof(ssl_errstring));
3f7eeb86 1357 debug_printf("OCSP response verify failure: %s\n", US ssl_errstring);
f5d78688
JH
1358 }
1359 goto bad;
3f7eeb86
PP
1360 }
1361
1362/* Here's the simplifying assumption: there's only one response, for the
1363one certificate we use, and nothing for anything else in a chain. If this
1364proves false, we need to extract a cert id from our issued cert
1365(tls_certificate) and use that for OCSP_resp_find_status() (which finds the
1366right cert in the stack and then calls OCSP_single_get0_status()).
1367
5b2fd993
JH
1368I'm hoping to avoid reworking a bunch more of how we handle state here.
1369
1370XXX that will change when we add support for (TLS1.3) whole-chain stapling
1371*/
ee5b1e28
JH
1372
1373if (!(single_response = OCSP_resp_get0(basic_response, 0)))
3f7eeb86
PP
1374 {
1375 DEBUG(D_tls)
1376 debug_printf("Unable to get first response from OCSP basic response.\n");
f5d78688 1377 goto bad;
3f7eeb86
PP
1378 }
1379
1380status = OCSP_single_get0_status(single_response, &reason, &rev, &thisupd, &nextupd);
f5d78688 1381if (status != V_OCSP_CERTSTATUS_GOOD)
3f7eeb86 1382 {
f5d78688
JH
1383 DEBUG(D_tls) debug_printf("OCSP response bad cert status: %s (%d) %s (%d)\n",
1384 OCSP_cert_status_str(status), status,
1385 OCSP_crl_reason_str(reason), reason);
1386 goto bad;
3f7eeb86
PP
1387 }
1388
1389if (!OCSP_check_validity(thisupd, nextupd, EXIM_OCSP_SKEW_SECONDS, EXIM_OCSP_MAX_AGE))
1390 {
1391 DEBUG(D_tls) debug_printf("OCSP status invalid times.\n");
f5d78688 1392 goto bad;
3f7eeb86
PP
1393 }
1394
f5d78688 1395supply_response:
5b2fd993
JH
1396 /* Add the resp to the list used by tls_server_stapling_cb() */
1397 {
1398 ocsp_resplist ** op = &cbinfo->u_ocsp.server.olist, * oentry;
1399 while (oentry = *op)
1400 op = &oentry->next;
1401 *op = oentry = store_get(sizeof(ocsp_resplist), FALSE);
1402 oentry->next = NULL;
1403 oentry->resp = resp;
1404 }
f5d78688
JH
1405return;
1406
1407bad:
8768d548 1408 if (f.running_in_test_harness)
018058b2
JH
1409 {
1410 extern char ** environ;
d7978c0f 1411 if (environ) for (uschar ** p = USS environ; *p; p++)
018058b2
JH
1412 if (Ustrncmp(*p, "EXIM_TESTHARNESS_DISABLE_OCSPVALIDITYCHECK", 42) == 0)
1413 {
1414 DEBUG(D_tls) debug_printf("Supplying known bad OCSP response\n");
1415 goto supply_response;
1416 }
1417 }
f5d78688 1418return;
3f7eeb86 1419}
5b2fd993
JH
1420
1421
1422static void
1423ocsp_free_response_list(tls_ext_ctx_cb * cbinfo)
1424{
1425for (ocsp_resplist * olist = cbinfo->u_ocsp.server.olist; olist;
1426 olist = olist->next)
1427 OCSP_RESPONSE_free(olist->resp);
1428cbinfo->u_ocsp.server.olist = NULL;
1429}
f2de3a33 1430#endif /*!DISABLE_OCSP*/
3f7eeb86
PP
1431
1432
1433
1434
23bb6982
JH
1435/* Create and install a selfsigned certificate, for use in server mode */
1436
1437static int
cf0c6164 1438tls_install_selfsign(SSL_CTX * sctx, uschar ** errstr)
23bb6982
JH
1439{
1440X509 * x509 = NULL;
1441EVP_PKEY * pkey;
1442RSA * rsa;
1443X509_NAME * name;
1444uschar * where;
1445
1446where = US"allocating pkey";
1447if (!(pkey = EVP_PKEY_new()))
1448 goto err;
1449
1450where = US"allocating cert";
1451if (!(x509 = X509_new()))
1452 goto err;
1453
1454where = US"generating pkey";
6aac3239 1455if (!(rsa = rsa_callback(NULL, 0, 2048)))
23bb6982
JH
1456 goto err;
1457
4c04137d 1458where = US"assigning pkey";
23bb6982
JH
1459if (!EVP_PKEY_assign_RSA(pkey, rsa))
1460 goto err;
1461
1462X509_set_version(x509, 2); /* N+1 - version 3 */
1613fd68 1463ASN1_INTEGER_set(X509_get_serialNumber(x509), 1);
23bb6982
JH
1464X509_gmtime_adj(X509_get_notBefore(x509), 0);
1465X509_gmtime_adj(X509_get_notAfter(x509), (long)60 * 60); /* 1 hour */
1466X509_set_pubkey(x509, pkey);
1467
1468name = X509_get_subject_name(x509);
1469X509_NAME_add_entry_by_txt(name, "C",
4dc2379a 1470 MBSTRING_ASC, CUS "UK", -1, -1, 0);
23bb6982 1471X509_NAME_add_entry_by_txt(name, "O",
4dc2379a 1472 MBSTRING_ASC, CUS "Exim Developers", -1, -1, 0);
23bb6982 1473X509_NAME_add_entry_by_txt(name, "CN",
4dc2379a 1474 MBSTRING_ASC, CUS smtp_active_hostname, -1, -1, 0);
23bb6982
JH
1475X509_set_issuer_name(x509, name);
1476
1477where = US"signing cert";
1478if (!X509_sign(x509, pkey, EVP_md5()))
1479 goto err;
1480
1481where = US"installing selfsign cert";
1482if (!SSL_CTX_use_certificate(sctx, x509))
1483 goto err;
1484
1485where = US"installing selfsign key";
1486if (!SSL_CTX_use_PrivateKey(sctx, pkey))
1487 goto err;
1488
1489return OK;
1490
1491err:
cf0c6164 1492 (void) tls_error(where, NULL, NULL, errstr);
23bb6982
JH
1493 if (x509) X509_free(x509);
1494 if (pkey) EVP_PKEY_free(pkey);
1495 return DEFER;
1496}
1497
1498
1499
1500
ba86e143
JH
1501static int
1502tls_add_certfile(SSL_CTX * sctx, tls_ext_ctx_cb * cbinfo, uschar * file,
1503 uschar ** errstr)
1504{
5b2fd993 1505DEBUG(D_tls) debug_printf("tls_certificate file '%s'\n", file);
ba86e143
JH
1506if (!SSL_CTX_use_certificate_chain_file(sctx, CS file))
1507 return tls_error(string_sprintf(
1508 "SSL_CTX_use_certificate_chain_file file=%s", file),
1509 cbinfo->host, NULL, errstr);
1510return 0;
1511}
1512
1513static int
1514tls_add_pkeyfile(SSL_CTX * sctx, tls_ext_ctx_cb * cbinfo, uschar * file,
1515 uschar ** errstr)
1516{
5b2fd993 1517DEBUG(D_tls) debug_printf("tls_privatekey file '%s'\n", file);
ba86e143
JH
1518if (!SSL_CTX_use_PrivateKey_file(sctx, CS file, SSL_FILETYPE_PEM))
1519 return tls_error(string_sprintf(
1520 "SSL_CTX_use_PrivateKey_file file=%s", file), cbinfo->host, NULL, errstr);
1521return 0;
1522}
1523
1524
059ec3d9 1525/*************************************************
7be682ca
PP
1526* Expand key and cert file specs *
1527*************************************************/
1528
f5d78688 1529/* Called once during tls_init and possibly again during TLS setup, for a
7be682ca
PP
1530new context, if Server Name Indication was used and tls_sni was seen in
1531the certificate string.
1532
1533Arguments:
1534 sctx the SSL_CTX* to update
1535 cbinfo various parts of session state
cf0c6164 1536 errstr error string pointer
7be682ca
PP
1537
1538Returns: OK/DEFER/FAIL
1539*/
1540
1541static int
5b2fd993 1542tls_expand_session_files(SSL_CTX * sctx, tls_ext_ctx_cb * cbinfo,
cf0c6164 1543 uschar ** errstr)
7be682ca 1544{
5b2fd993 1545uschar * expanded;
7be682ca 1546
23bb6982 1547if (!cbinfo->certificate)
7be682ca 1548 {
ba86e143 1549 if (!cbinfo->is_server) /* client */
23bb6982 1550 return OK;
afdb5e9c 1551 /* server */
cf0c6164 1552 if (tls_install_selfsign(sctx, errstr) != OK)
23bb6982 1553 return DEFER;
7be682ca 1554 }
23bb6982
JH
1555else
1556 {
ba86e143
JH
1557 int err;
1558
5b2fd993
JH
1559 if ( !reexpand_tls_files_for_sni
1560 && ( Ustrstr(cbinfo->certificate, US"tls_sni")
1561 || Ustrstr(cbinfo->certificate, US"tls_in_sni")
1562 || Ustrstr(cbinfo->certificate, US"tls_out_sni")
1563 ) )
23bb6982 1564 reexpand_tls_files_for_sni = TRUE;
7be682ca 1565
cf0c6164 1566 if (!expand_check(cbinfo->certificate, US"tls_certificate", &expanded, errstr))
23bb6982
JH
1567 return DEFER;
1568
ba86e143
JH
1569 if (expanded)
1570 if (cbinfo->is_server)
1571 {
1572 const uschar * file_list = expanded;
1573 int sep = 0;
1574 uschar * file;
5b2fd993
JH
1575#ifndef DISABLE_OCSP
1576 const uschar * olist = cbinfo->u_ocsp.server.file;
1577 int osep = 0;
1578 uschar * ofile;
86ede124 1579 BOOL fmt_pem = FALSE;
5b2fd993
JH
1580
1581 if (olist)
1582 if (!expand_check(olist, US"tls_ocsp_file", USS &olist, errstr))
1583 return DEFER;
1584 if (olist && !*olist)
1585 olist = NULL;
1586
1587 if ( cbinfo->u_ocsp.server.file_expanded && olist
1588 && (Ustrcmp(olist, cbinfo->u_ocsp.server.file_expanded) == 0))
1589 {
1590 DEBUG(D_tls) debug_printf(" - value unchanged, using existing values\n");
1591 olist = NULL;
1592 }
1593 else
1594 {
1595 ocsp_free_response_list(cbinfo);
1596 cbinfo->u_ocsp.server.file_expanded = olist;
1597 }
1598#endif
ba86e143
JH
1599
1600 while (file = string_nextinlist(&file_list, &sep, NULL, 0))
5b2fd993 1601 {
ba86e143
JH
1602 if ((err = tls_add_certfile(sctx, cbinfo, file, errstr)))
1603 return err;
5b2fd993
JH
1604
1605#ifndef DISABLE_OCSP
1606 if (olist)
1607 if ((ofile = string_nextinlist(&olist, &osep, NULL, 0)))
86ede124
JH
1608 {
1609 if (Ustrncmp(ofile, US"PEM ", 4) == 0)
1610 {
1611 fmt_pem = TRUE;
1612 ofile += 4;
1613 }
1614 else if (Ustrncmp(ofile, US"DER ", 4) == 0)
1615 {
1616 fmt_pem = FALSE;
1617 ofile += 4;
1618 }
1619 ocsp_load_response(sctx, cbinfo, ofile, fmt_pem);
1620 }
5b2fd993
JH
1621 else
1622 DEBUG(D_tls) debug_printf("ran out of ocsp file list\n");
1623#endif
1624 }
ba86e143
JH
1625 }
1626 else /* would there ever be a need for multiple client certs? */
1627 if ((err = tls_add_certfile(sctx, cbinfo, expanded, errstr)))
1628 return err;
7be682ca 1629
5a2a0989
JH
1630 if ( cbinfo->privatekey
1631 && !expand_check(cbinfo->privatekey, US"tls_privatekey", &expanded, errstr))
23bb6982 1632 return DEFER;
7be682ca 1633
23bb6982
JH
1634 /* If expansion was forced to fail, key_expanded will be NULL. If the result
1635 of the expansion is an empty string, ignore it also, and assume the private
1636 key is in the same file as the certificate. */
1637
1638 if (expanded && *expanded)
ba86e143
JH
1639 if (cbinfo->is_server)
1640 {
1641 const uschar * file_list = expanded;
1642 int sep = 0;
1643 uschar * file;
1644
1645 while (file = string_nextinlist(&file_list, &sep, NULL, 0))
1646 if ((err = tls_add_pkeyfile(sctx, cbinfo, file, errstr)))
1647 return err;
1648 }
1649 else /* would there ever be a need for multiple client certs? */
1650 if ((err = tls_add_pkeyfile(sctx, cbinfo, expanded, errstr)))
1651 return err;
7be682ca
PP
1652 }
1653
1654return OK;
1655}
1656
1657
1658
1659
1660/*************************************************
1661* Callback to handle SNI *
1662*************************************************/
1663
1664/* Called when acting as server during the TLS session setup if a Server Name
1665Indication extension was sent by the client.
1666
1667API documentation is OpenSSL s_server.c implementation.
1668
1669Arguments:
1670 s SSL* of the current session
1671 ad unknown (part of OpenSSL API) (unused)
1672 arg Callback of "our" registered data
1673
1674Returns: SSL_TLSEXT_ERR_{OK,ALERT_WARNING,ALERT_FATAL,NOACK}
b10c87b3
JH
1675
1676XXX might need to change to using ClientHello callback,
1677per https://www.openssl.org/docs/manmaster/man3/SSL_client_hello_cb_fn.html
7be682ca
PP
1678*/
1679
3bcbbbe2 1680#ifdef EXIM_HAVE_OPENSSL_TLSEXT
7be682ca 1681static int
7be682ca
PP
1682tls_servername_cb(SSL *s, int *ad ARG_UNUSED, void *arg)
1683{
1684const char *servername = SSL_get_servername(s, TLSEXT_NAMETYPE_host_name);
3f7eeb86 1685tls_ext_ctx_cb *cbinfo = (tls_ext_ctx_cb *) arg;
7be682ca 1686int rc;
3f0945ff 1687int old_pool = store_pool;
cf0c6164 1688uschar * dummy_errstr;
7be682ca
PP
1689
1690if (!servername)
1691 return SSL_TLSEXT_ERR_OK;
1692
3f0945ff 1693DEBUG(D_tls) debug_printf("Received TLS SNI \"%s\"%s\n", servername,
7be682ca
PP
1694 reexpand_tls_files_for_sni ? "" : " (unused for certificate selection)");
1695
1696/* Make the extension value available for expansion */
3f0945ff 1697store_pool = POOL_PERM;
89a80675 1698tls_in.sni = string_copy_taint(US servername, TRUE);
3f0945ff 1699store_pool = old_pool;
7be682ca
PP
1700
1701if (!reexpand_tls_files_for_sni)
1702 return SSL_TLSEXT_ERR_OK;
1703
1704/* Can't find an SSL_CTX_clone() or equivalent, so we do it manually;
1705not confident that memcpy wouldn't break some internal reference counting.
1706Especially since there's a references struct member, which would be off. */
1707
7a8b9519
JH
1708#ifdef EXIM_HAVE_OPENSSL_TLS_METHOD
1709if (!(server_sni = SSL_CTX_new(TLS_server_method())))
1710#else
0df4ab80 1711if (!(server_sni = SSL_CTX_new(SSLv23_server_method())))
7a8b9519 1712#endif
7be682ca 1713 {
0abc5a13 1714 ERR_error_string_n(ERR_get_error(), ssl_errstring, sizeof(ssl_errstring));
7be682ca 1715 DEBUG(D_tls) debug_printf("SSL_CTX_new() failed: %s\n", ssl_errstring);
5a2a0989 1716 goto bad;
7be682ca
PP
1717 }
1718
1719/* Not sure how many of these are actually needed, since SSL object
1720already exists. Might even need this selfsame callback, for reneg? */
1721
817d9f57
JH
1722SSL_CTX_set_info_callback(server_sni, SSL_CTX_get_info_callback(server_ctx));
1723SSL_CTX_set_mode(server_sni, SSL_CTX_get_mode(server_ctx));
1724SSL_CTX_set_options(server_sni, SSL_CTX_get_options(server_ctx));
1725SSL_CTX_set_timeout(server_sni, SSL_CTX_get_timeout(server_ctx));
1726SSL_CTX_set_tlsext_servername_callback(server_sni, tls_servername_cb);
1727SSL_CTX_set_tlsext_servername_arg(server_sni, cbinfo);
038597d2 1728
cf0c6164
JH
1729if ( !init_dh(server_sni, cbinfo->dhparam, NULL, &dummy_errstr)
1730 || !init_ecdh(server_sni, NULL, &dummy_errstr)
038597d2 1731 )
5a2a0989 1732 goto bad;
038597d2 1733
ca954d7f
JH
1734if ( cbinfo->server_cipher_list
1735 && !SSL_CTX_set_cipher_list(server_sni, CS cbinfo->server_cipher_list))
5a2a0989 1736 goto bad;
ca954d7f 1737
f2de3a33 1738#ifndef DISABLE_OCSP
f5d78688 1739if (cbinfo->u_ocsp.server.file)
3f7eeb86 1740 {
f5d78688 1741 SSL_CTX_set_tlsext_status_cb(server_sni, tls_server_stapling_cb);
14c7b357 1742 SSL_CTX_set_tlsext_status_arg(server_sni, cbinfo);
3f7eeb86
PP
1743 }
1744#endif
7be682ca 1745
c3033f13 1746if ((rc = setup_certs(server_sni, tls_verify_certificates, tls_crl, NULL, FALSE,
cf0c6164 1747 verify_callback_server, &dummy_errstr)) != OK)
5a2a0989 1748 goto bad;
7be682ca 1749
3f7eeb86
PP
1750/* do this after setup_certs, because this can require the certs for verifying
1751OCSP information. */
cf0c6164 1752if ((rc = tls_expand_session_files(server_sni, cbinfo, &dummy_errstr)) != OK)
5a2a0989 1753 goto bad;
a799883d 1754
7be682ca 1755DEBUG(D_tls) debug_printf("Switching SSL context.\n");
817d9f57 1756SSL_set_SSL_CTX(s, server_sni);
7be682ca 1757return SSL_TLSEXT_ERR_OK;
5a2a0989
JH
1758
1759bad: return SSL_TLSEXT_ERR_ALERT_FATAL;
7be682ca 1760}
3bcbbbe2 1761#endif /* EXIM_HAVE_OPENSSL_TLSEXT */
7be682ca
PP
1762
1763
1764
1765
f2de3a33 1766#ifndef DISABLE_OCSP
f5d78688 1767
3f7eeb86
PP
1768/*************************************************
1769* Callback to handle OCSP Stapling *
1770*************************************************/
1771
1772/* Called when acting as server during the TLS session setup if the client
1773requests OCSP information with a Certificate Status Request.
1774
1775Documentation via openssl s_server.c and the Apache patch from the OpenSSL
1776project.
1777
1778*/
1779
1780static int
f5d78688 1781tls_server_stapling_cb(SSL *s, void *arg)
3f7eeb86 1782{
5b2fd993
JH
1783const tls_ext_ctx_cb * cbinfo = (tls_ext_ctx_cb *) arg;
1784ocsp_resplist * olist = cbinfo->u_ocsp.server.olist;
1785uschar * response_der; /*XXX blob */
3f7eeb86
PP
1786int response_der_len;
1787
af4a1bca 1788DEBUG(D_tls)
5b2fd993
JH
1789 debug_printf("Received TLS status request (OCSP stapling); %s response list\n",
1790 olist ? "have" : "lack");
f5d78688 1791
44662487 1792tls_in.ocsp = OCSP_NOT_RESP;
5b2fd993 1793if (!olist)
3f7eeb86
PP
1794 return SSL_TLSEXT_ERR_NOACK;
1795
012dd02e 1796#ifdef EXIM_HAVE_OPESSL_GET0_SERIAL
5b2fd993
JH
1797 {
1798 const X509 * cert_sent = SSL_get_certificate(s);
1799 const ASN1_INTEGER * cert_serial = X509_get0_serialNumber(cert_sent);
1800 const BIGNUM * cert_bn = ASN1_INTEGER_to_BN(cert_serial, NULL);
1801 const X509_NAME * cert_issuer = X509_get_issuer_name(cert_sent);
1802 uschar * chash;
1803 uint chash_len;
1804
1805 for (; olist; olist = olist->next)
1806 {
1807 OCSP_BASICRESP * bs = OCSP_response_get1_basic(olist->resp);
1808 const OCSP_SINGLERESP * single = OCSP_resp_get0(bs, 0);
1809 const OCSP_CERTID * cid = OCSP_SINGLERESP_get0_id(single);
1810 ASN1_INTEGER * res_cert_serial;
1811 const BIGNUM * resp_bn;
1812 ASN1_OCTET_STRING * res_cert_iNameHash;
1813
1814
1815 (void) OCSP_id_get0_info(&res_cert_iNameHash, NULL, NULL, &res_cert_serial,
1816 (OCSP_CERTID *) cid);
1817 resp_bn = ASN1_INTEGER_to_BN(res_cert_serial, NULL);
1818
1819 DEBUG(D_tls)
1820 {
1821 debug_printf("cert serial: %s\n", BN_bn2hex(cert_bn));
1822 debug_printf("resp serial: %s\n", BN_bn2hex(resp_bn));
1823 }
1824
1825 if (BN_cmp(cert_bn, resp_bn) == 0)
1826 {
1827 DEBUG(D_tls) debug_printf("matched serial for ocsp\n");
1828
1829 /*XXX TODO: check the rest of the list for duplicate matches.
1830 If any, need to also check the Issuer Name hash.
1831 Without this, we will provide the wrong status in the case of
1832 duplicate id. */
1833
1834 break;
1835 }
1836 DEBUG(D_tls) debug_printf("not match serial for ocsp\n");
1837 }
1838 if (!olist)
1839 {
1840 DEBUG(D_tls) debug_printf("failed to find match for ocsp\n");
1841 return SSL_TLSEXT_ERR_NOACK;
1842 }
1843 }
012dd02e
JH
1844#else
1845if (olist->next)
1846 {
1847 DEBUG(D_tls) debug_printf("OpenSSL version too early to support multi-leaf OCSP\n");
1848 return SSL_TLSEXT_ERR_NOACK;
1849 }
1850#endif
5b2fd993
JH
1851
1852/*XXX could we do the i2d earlier, rather than during the callback? */
3f7eeb86 1853response_der = NULL;
5b2fd993 1854response_der_len = i2d_OCSP_RESPONSE(olist->resp, &response_der);
3f7eeb86
PP
1855if (response_der_len <= 0)
1856 return SSL_TLSEXT_ERR_NOACK;
1857
5e55c7a9 1858SSL_set_tlsext_status_ocsp_resp(server_ssl, response_der, response_der_len);
44662487 1859tls_in.ocsp = OCSP_VFIED;
3f7eeb86
PP
1860return SSL_TLSEXT_ERR_OK;
1861}
1862
3f7eeb86 1863
f5d78688
JH
1864static void
1865time_print(BIO * bp, const char * str, ASN1_GENERALIZEDTIME * time)
1866{
1867BIO_printf(bp, "\t%s: ", str);
1868ASN1_GENERALIZEDTIME_print(bp, time);
1869BIO_puts(bp, "\n");
1870}
1871
1872static int
1873tls_client_stapling_cb(SSL *s, void *arg)
1874{
1875tls_ext_ctx_cb * cbinfo = arg;
1876const unsigned char * p;
1877int len;
1878OCSP_RESPONSE * rsp;
1879OCSP_BASICRESP * bs;
1880int i;
1881
14003634 1882DEBUG(D_tls) debug_printf("Received TLS status callback (OCSP stapling):\n");
f5d78688
JH
1883len = SSL_get_tlsext_status_ocsp_resp(s, &p);
1884if(!p)
1885 {
44662487 1886 /* Expect this when we requested ocsp but got none */
6c6d6e48 1887 if (cbinfo->u_ocsp.client.verify_required && LOGGING(tls_cipher))
14003634 1888 log_write(0, LOG_MAIN, "Required TLS certificate status not received");
f5d78688
JH
1889 else
1890 DEBUG(D_tls) debug_printf(" null\n");
44662487 1891 return cbinfo->u_ocsp.client.verify_required ? 0 : 1;
f5d78688 1892 }
018058b2 1893
c82de233
JH
1894if (!(rsp = d2i_OCSP_RESPONSE(NULL, &p, len)))
1895 {
1896 tls_out.ocsp = OCSP_FAILED; /*XXX should use tlsp-> to permit concurrent outbound */
6c6d6e48 1897 if (LOGGING(tls_cipher))
1eca31ca 1898 log_write(0, LOG_MAIN, "Received TLS cert status response, parse error");
f5d78688
JH
1899 else
1900 DEBUG(D_tls) debug_printf(" parse error\n");
1901 return 0;
c82de233 1902 }
f5d78688 1903
c82de233 1904if (!(bs = OCSP_response_get1_basic(rsp)))
f5d78688 1905 {
018058b2 1906 tls_out.ocsp = OCSP_FAILED;
6c6d6e48 1907 if (LOGGING(tls_cipher))
1eca31ca 1908 log_write(0, LOG_MAIN, "Received TLS cert status response, error parsing response");
f5d78688
JH
1909 else
1910 DEBUG(D_tls) debug_printf(" error parsing response\n");
1911 OCSP_RESPONSE_free(rsp);
1912 return 0;
1913 }
1914
1915/* We'd check the nonce here if we'd put one in the request. */
1916/* However that would defeat cacheability on the server so we don't. */
1917
f5d78688
JH
1918/* This section of code reworked from OpenSSL apps source;
1919 The OpenSSL Project retains copyright:
1920 Copyright (c) 1999 The OpenSSL Project. All rights reserved.
1921*/
1922 {
1923 BIO * bp = NULL;
86ede124
JH
1924#ifndef EXIM_HAVE_OCSP_RESP_COUNT
1925 STACK_OF(OCSP_SINGLERESP) * sresp = bs->tbsResponseData->responses;
1926#endif
f5d78688 1927
57887ecc 1928 DEBUG(D_tls) bp = BIO_new_fp(debug_file, BIO_NOCLOSE);
f5d78688
JH
1929
1930 /*OCSP_RESPONSE_print(bp, rsp, 0); extreme debug: stapling content */
1931
1932 /* Use the chain that verified the server cert to verify the stapled info */
1933 /* DEBUG(D_tls) x509_store_dump_cert_s_names(cbinfo->u_ocsp.client.verify_store); */
1934
c3033f13 1935 if ((i = OCSP_basic_verify(bs, cbinfo->verify_stack,
86ede124
JH
1936 cbinfo->u_ocsp.client.verify_store, OCSP_NOEXPLICIT)) <= 0)
1937 if (ERR_peek_error())
1938 {
1939 tls_out.ocsp = OCSP_FAILED;
1940 if (LOGGING(tls_cipher)) log_write(0, LOG_MAIN,
1941 "Received TLS cert status response, itself unverifiable: %s",
1942 ERR_reason_error_string(ERR_peek_error()));
1943 BIO_printf(bp, "OCSP response verify failure\n");
1944 ERR_print_errors(bp);
1945 OCSP_RESPONSE_print(bp, rsp, 0);
1946 goto failed;
1947 }
1948 else
1949 DEBUG(D_tls) debug_printf("no explicit trust for OCSP signing"
1950 " in the root CA certificate; ignoring\n");
f5d78688 1951
86ede124 1952 DEBUG(D_tls) debug_printf("OCSP response well-formed and signed OK\n");
f5d78688 1953
c8dfb21d
JH
1954 /*XXX So we have a good stapled OCSP status. How do we know
1955 it is for the cert of interest? OpenSSL 1.1.0 has a routine
1956 OCSP_resp_find_status() which matches on a cert id, which presumably
1957 we should use. Making an id needs OCSP_cert_id_new(), which takes
1958 issuerName, issuerKey, serialNumber. Are they all in the cert?
1959
1960 For now, carry on blindly accepting the resp. */
1961
86ede124 1962 for (int idx =
c8dfb21d 1963#ifdef EXIM_HAVE_OCSP_RESP_COUNT
86ede124 1964 OCSP_resp_count(bs) - 1;
c8dfb21d 1965#else
86ede124 1966 sk_OCSP_SINGLERESP_num(sresp) - 1;
c8dfb21d 1967#endif
86ede124
JH
1968 idx >= 0; idx--)
1969 {
1970 OCSP_SINGLERESP * single = OCSP_resp_get0(bs, idx);
1971 int status, reason;
1972 ASN1_GENERALIZEDTIME * rev, * thisupd, * nextupd;
1973
1974 /*XXX so I can see putting a loop in here to handle a rsp with >1 singleresp
1975 - but what happens with a GnuTLS-style input?
1976
1977 we could do with a debug label for each singleresp
1978 - it has a certID with a serialNumber, but I see no API to get that
1979 */
44662487
JH
1980 status = OCSP_single_get0_status(single, &reason, &rev,
1981 &thisupd, &nextupd);
f5d78688 1982
86ede124
JH
1983 DEBUG(D_tls) time_print(bp, "This OCSP Update", thisupd);
1984 DEBUG(D_tls) if(nextupd) time_print(bp, "Next OCSP Update", nextupd);
1985 if (!OCSP_check_validity(thisupd, nextupd,
1986 EXIM_OCSP_SKEW_SECONDS, EXIM_OCSP_MAX_AGE))
1987 {
1988 tls_out.ocsp = OCSP_FAILED;
1989 DEBUG(D_tls) ERR_print_errors(bp);
1990 log_write(0, LOG_MAIN, "Server OSCP dates invalid");
1991 goto failed;
1992 }
1993
44662487
JH
1994 DEBUG(D_tls) BIO_printf(bp, "Certificate status: %s\n",
1995 OCSP_cert_status_str(status));
1996 switch(status)
1997 {
1998 case V_OCSP_CERTSTATUS_GOOD:
86ede124 1999 continue; /* the idx loop */
44662487
JH
2000 case V_OCSP_CERTSTATUS_REVOKED:
2001 log_write(0, LOG_MAIN, "Server certificate revoked%s%s",
2002 reason != -1 ? "; reason: " : "",
2003 reason != -1 ? OCSP_crl_reason_str(reason) : "");
2004 DEBUG(D_tls) time_print(bp, "Revocation Time", rev);
44662487
JH
2005 break;
2006 default:
2007 log_write(0, LOG_MAIN,
2008 "Server certificate status unknown, in OCSP stapling");
44662487
JH
2009 break;
2010 }
86ede124
JH
2011
2012 goto failed;
f5d78688 2013 }
86ede124
JH
2014
2015 i = 1;
2016 tls_out.ocsp = OCSP_VFIED;
2017 goto good;
2018
c8dfb21d 2019 failed:
86ede124 2020 tls_out.ocsp = OCSP_FAILED;
c8dfb21d
JH
2021 i = cbinfo->u_ocsp.client.verify_required ? 0 : 1;
2022 good:
f5d78688
JH
2023 BIO_free(bp);
2024 }
2025
2026OCSP_RESPONSE_free(rsp);
2027return i;
2028}
f2de3a33 2029#endif /*!DISABLE_OCSP*/
3f7eeb86
PP
2030
2031
7be682ca 2032/*************************************************
059ec3d9
PH
2033* Initialize for TLS *
2034*************************************************/
2035
b038d456
JH
2036static void
2037tls_openssl_init(void)
2038{
2039#ifdef EXIM_NEED_OPENSSL_INIT
2040SSL_load_error_strings(); /* basic set up */
2041OpenSSL_add_ssl_algorithms();
2042#endif
2043
2044#if defined(EXIM_HAVE_SHA256) && !defined(OPENSSL_AUTO_SHA256)
2045/* SHA256 is becoming ever more popular. This makes sure it gets added to the
2046list of available digests. */
2047EVP_add_digest(EVP_sha256());
2048#endif
2049}
2050
2051
2052
e51c7be2
JH
2053/* Called from both server and client code, to do preliminary initialization
2054of the library. We allocate and return a context structure.
059ec3d9
PH
2055
2056Arguments:
946ecbe0 2057 ctxp returned SSL context
059ec3d9
PH
2058 host connected host, if client; NULL if server
2059 dhparam DH parameter file
2060 certificate certificate file
2061 privatekey private key
f5d78688 2062 ocsp_file file of stapling info (server); flag for require ocsp (client)
059ec3d9 2063 addr address if client; NULL if server (for some randomness)
946ecbe0 2064 cbp place to put allocated callback context
cf0c6164 2065 errstr error string pointer
059ec3d9
PH
2066
2067Returns: OK/DEFER/FAIL
2068*/
2069
2070static int
817d9f57 2071tls_init(SSL_CTX **ctxp, host_item *host, uschar *dhparam, uschar *certificate,
3f7eeb86 2072 uschar *privatekey,
f2de3a33 2073#ifndef DISABLE_OCSP
5b2fd993 2074 uschar *ocsp_file,
3f7eeb86 2075#endif
b10c87b3
JH
2076 address_item *addr, tls_ext_ctx_cb ** cbp,
2077 tls_support * tlsp,
2078 uschar ** errstr)
059ec3d9 2079{
7006ee24 2080SSL_CTX * ctx;
77bb000f 2081long init_options;
7be682ca 2082int rc;
a7538db1 2083tls_ext_ctx_cb * cbinfo;
7be682ca
PP
2084
2085cbinfo = store_malloc(sizeof(tls_ext_ctx_cb));
b10c87b3 2086cbinfo->tlsp = tlsp;
7be682ca
PP
2087cbinfo->certificate = certificate;
2088cbinfo->privatekey = privatekey;
a6510420 2089cbinfo->is_server = host==NULL;
f2de3a33 2090#ifndef DISABLE_OCSP
c3033f13 2091cbinfo->verify_stack = NULL;
a6510420 2092if (!host)
f5d78688
JH
2093 {
2094 cbinfo->u_ocsp.server.file = ocsp_file;
2095 cbinfo->u_ocsp.server.file_expanded = NULL;
5b2fd993 2096 cbinfo->u_ocsp.server.olist = NULL;
f5d78688
JH
2097 }
2098else
2099 cbinfo->u_ocsp.client.verify_store = NULL;
3f7eeb86 2100#endif
7be682ca 2101cbinfo->dhparam = dhparam;
0df4ab80 2102cbinfo->server_cipher_list = NULL;
7be682ca 2103cbinfo->host = host;
0cbf2b82 2104#ifndef DISABLE_EVENT
a7538db1
JH
2105cbinfo->event_action = NULL;
2106#endif
77bb000f 2107
b038d456 2108tls_openssl_init();
a0475b69 2109
f0f5a555
PP
2110/* Create a context.
2111The OpenSSL docs in 1.0.1b have not been updated to clarify TLS variant
2112negotiation in the different methods; as far as I can tell, the only
2113*_{server,client}_method which allows negotiation is SSLv23, which exists even
2114when OpenSSL is built without SSLv2 support.
2115By disabling with openssl_options, we can let admins re-enable with the
2116existing knob. */
059ec3d9 2117
7a8b9519
JH
2118#ifdef EXIM_HAVE_OPENSSL_TLS_METHOD
2119if (!(ctx = SSL_CTX_new(host ? TLS_client_method() : TLS_server_method())))
2120#else
7006ee24 2121if (!(ctx = SSL_CTX_new(host ? SSLv23_client_method() : SSLv23_server_method())))
7a8b9519 2122#endif
7006ee24 2123 return tls_error(US"SSL_CTX_new", host, NULL, errstr);
059ec3d9
PH
2124
2125/* It turns out that we need to seed the random number generator this early in
2126order to get the full complement of ciphers to work. It took me roughly a day
2127of work to discover this by experiment.
2128
2129On systems that have /dev/urandom, SSL may automatically seed itself from
2130there. Otherwise, we have to make something up as best we can. Double check
2131afterwards. */
2132
2133if (!RAND_status())
2134 {
2135 randstuff r;
9e3331ea 2136 gettimeofday(&r.tv, NULL);
059ec3d9
PH
2137 r.p = getpid();
2138
5903c6ff
JH
2139 RAND_seed(US (&r), sizeof(r));
2140 RAND_seed(US big_buffer, big_buffer_size);
2141 if (addr != NULL) RAND_seed(US addr, sizeof(addr));
059ec3d9
PH
2142
2143 if (!RAND_status())
7199e1ee 2144 return tls_error(US"RAND_status", host,
cf0c6164 2145 US"unable to seed random number generator", errstr);
059ec3d9
PH
2146 }
2147
2148/* Set up the information callback, which outputs if debugging is at a suitable
2149level. */
2150
b10c87b3
JH
2151DEBUG(D_tls)
2152 {
2153 SSL_CTX_set_info_callback(ctx, (void (*)())info_callback);
e570d136
JH
2154#if defined(EXIM_HAVE_OPESSL_TRACE) && !defined(OPENSSL_NO_SSL_TRACE)
2155 /* this needs a debug build of OpenSSL */
b10c87b3
JH
2156 SSL_CTX_set_msg_callback(ctx, (void (*)())SSL_trace);
2157#endif
8a40db1c 2158#ifdef OPENSSL_HAVE_KEYLOG_CB
b10c87b3 2159 SSL_CTX_set_keylog_callback(ctx, (void (*)())keylog_callback);
8a40db1c 2160#endif
b10c87b3 2161 }
059ec3d9 2162
c80c5570 2163/* Automatically re-try reads/writes after renegotiation. */
7006ee24 2164(void) SSL_CTX_set_mode(ctx, SSL_MODE_AUTO_RETRY);
c80c5570 2165
77bb000f
PP
2166/* Apply administrator-supplied work-arounds.
2167Historically we applied just one requested option,
2168SSL_OP_DONT_INSERT_EMPTY_FRAGMENTS, but when bug 994 requested a second, we
2169moved to an administrator-controlled list of options to specify and
2170grandfathered in the first one as the default value for "openssl_options".
059ec3d9 2171
77bb000f
PP
2172No OpenSSL version number checks: the options we accept depend upon the
2173availability of the option value macros from OpenSSL. */
059ec3d9 2174
7006ee24 2175if (!tls_openssl_options_parse(openssl_options, &init_options))
cf0c6164 2176 return tls_error(US"openssl_options parsing failed", host, NULL, errstr);
77bb000f 2177
b10c87b3
JH
2178#ifdef EXPERIMENTAL_TLS_RESUME
2179tlsp->resumption = RESUME_SUPPORTED;
2180#endif
77bb000f
PP
2181if (init_options)
2182 {
b10c87b3
JH
2183#ifdef EXPERIMENTAL_TLS_RESUME
2184 /* Should the server offer session resumption? */
2185 if (!host && verify_check_host(&tls_resumption_hosts) == OK)
2186 {
2187 DEBUG(D_tls) debug_printf("tls_resumption_hosts overrides openssl_options\n");
2188 init_options &= ~SSL_OP_NO_TICKET;
2189 tlsp->resumption |= RESUME_SERVER_TICKET; /* server will give ticket on request */
2190 tlsp->host_resumable = TRUE;
2191 }
2192#endif
2193
77bb000f 2194 DEBUG(D_tls) debug_printf("setting SSL CTX options: %#lx\n", init_options);
7006ee24 2195 if (!(SSL_CTX_set_options(ctx, init_options)))
77bb000f 2196 return tls_error(string_sprintf(
cf0c6164 2197 "SSL_CTX_set_option(%#lx)", init_options), host, NULL, errstr);
77bb000f
PP
2198 }
2199else
2200 DEBUG(D_tls) debug_printf("no SSL CTX options to set\n");
059ec3d9 2201
a28050f8
JH
2202/* We'd like to disable session cache unconditionally, but foolish Outlook
2203Express clients then give up the first TLS connection and make a second one
2204(which works). Only when there is an IMAP service on the same machine.
2205Presumably OE is trying to use the cache for A on B. Leave it enabled for
2206now, until we work out a decent way of presenting control to the config. It
2207will never be used because we use a new context every time. */
2208#ifdef notdef
7006ee24 2209(void) SSL_CTX_set_session_cache_mode(ctx, SSL_SESS_CACHE_OFF);
a28050f8 2210#endif
7006ee24 2211
059ec3d9 2212/* Initialize with DH parameters if supplied */
10ca4f1c 2213/* Initialize ECDH temp key parameter selection */
059ec3d9 2214
7006ee24
JH
2215if ( !init_dh(ctx, dhparam, host, errstr)
2216 || !init_ecdh(ctx, host, errstr)
038597d2
PP
2217 )
2218 return DEFER;
059ec3d9 2219
3f7eeb86 2220/* Set up certificate and key (and perhaps OCSP info) */
059ec3d9 2221
7006ee24 2222if ((rc = tls_expand_session_files(ctx, cbinfo, errstr)) != OK)
23bb6982 2223 return rc;
c91535f3 2224
c3033f13
JH
2225/* If we need to handle SNI or OCSP, do so */
2226
3bcbbbe2 2227#ifdef EXIM_HAVE_OPENSSL_TLSEXT
c3033f13
JH
2228# ifndef DISABLE_OCSP
2229 if (!(cbinfo->verify_stack = sk_X509_new_null()))
2230 {
2231 DEBUG(D_tls) debug_printf("failed to create stack for stapling verify\n");
2232 return FAIL;
2233 }
2234# endif
2235
7a8b9519 2236if (!host) /* server */
3f0945ff 2237 {
f2de3a33 2238# ifndef DISABLE_OCSP
5b2fd993 2239 /* We check u_ocsp.server.file, not server.olist, because we care about if
3f7eeb86
PP
2240 the option exists, not what the current expansion might be, as SNI might
2241 change the certificate and OCSP file in use between now and the time the
2242 callback is invoked. */
f5d78688 2243 if (cbinfo->u_ocsp.server.file)
3f7eeb86 2244 {
7006ee24
JH
2245 SSL_CTX_set_tlsext_status_cb(ctx, tls_server_stapling_cb);
2246 SSL_CTX_set_tlsext_status_arg(ctx, cbinfo);
3f7eeb86 2247 }
f5d78688 2248# endif
3f0945ff
PP
2249 /* We always do this, so that $tls_sni is available even if not used in
2250 tls_certificate */
7006ee24
JH
2251 SSL_CTX_set_tlsext_servername_callback(ctx, tls_servername_cb);
2252 SSL_CTX_set_tlsext_servername_arg(ctx, cbinfo);
3f0945ff 2253 }
f2de3a33 2254# ifndef DISABLE_OCSP
f5d78688
JH
2255else /* client */
2256 if(ocsp_file) /* wanting stapling */
2257 {
2258 if (!(cbinfo->u_ocsp.client.verify_store = X509_STORE_new()))
2259 {
2260 DEBUG(D_tls) debug_printf("failed to create store for stapling verify\n");
2261 return FAIL;
2262 }
7006ee24
JH
2263 SSL_CTX_set_tlsext_status_cb(ctx, tls_client_stapling_cb);
2264 SSL_CTX_set_tlsext_status_arg(ctx, cbinfo);
f5d78688
JH
2265 }
2266# endif
7be682ca 2267#endif
059ec3d9 2268
e51c7be2 2269cbinfo->verify_cert_hostnames = NULL;
e51c7be2 2270
c8dfb21d 2271#ifdef EXIM_HAVE_EPHEM_RSA_KEX
059ec3d9 2272/* Set up the RSA callback */
7006ee24 2273SSL_CTX_set_tmp_rsa_callback(ctx, rsa_callback);
c8dfb21d 2274#endif
059ec3d9 2275
b10c87b3
JH
2276/* Finally, set the session cache timeout, and we are done.
2277The period appears to be also used for (server-generated) session tickets */
059ec3d9 2278
7006ee24 2279SSL_CTX_set_timeout(ctx, ssl_session_timeout);
059ec3d9 2280DEBUG(D_tls) debug_printf("Initialized TLS\n");
7be682ca 2281
817d9f57 2282*cbp = cbinfo;
7006ee24 2283*ctxp = ctx;
7be682ca 2284
059ec3d9
PH
2285return OK;
2286}
2287
2288
2289
2290
2291/*************************************************
2292* Get name of cipher in use *
2293*************************************************/
2294
817d9f57 2295/*
059ec3d9 2296Argument: pointer to an SSL structure for the connection
817d9f57 2297 pointer to number of bits for cipher
f1be21cf 2298Returns: pointer to allocated string in perm-pool
059ec3d9
PH
2299*/
2300
f1be21cf 2301static uschar *
da40b1ec 2302construct_cipher_name(SSL * ssl, const uschar * ver, int * bits)
059ec3d9 2303{
f1be21cf 2304int pool = store_pool;
7a8b9519 2305/* With OpenSSL 1.0.0a, 'c' needs to be const but the documentation doesn't
57b3a7f5
PP
2306yet reflect that. It should be a safe change anyway, even 0.9.8 versions have
2307the accessor functions use const in the prototype. */
059ec3d9 2308
7a8b9519 2309const SSL_CIPHER * c = (const SSL_CIPHER *) SSL_get_current_cipher(ssl);
f1be21cf 2310uschar * s;
059ec3d9 2311
817d9f57 2312SSL_CIPHER_get_bits(c, bits);
059ec3d9 2313
f1be21cf
JH
2314store_pool = POOL_PERM;
2315s = string_sprintf("%s:%s:%u", ver, SSL_CIPHER_get_name(c), *bits);
2316store_pool = pool;
2317DEBUG(D_tls) debug_printf("Cipher: %s\n", s);
2318return s;
2319}
2320
059ec3d9 2321
f1be21cf
JH
2322/* Get IETF-standard name for ciphersuite.
2323Argument: pointer to an SSL structure for the connection
2324Returns: pointer to string
2325*/
2326
2327static const uschar *
2328cipher_stdname_ssl(SSL * ssl)
2329{
2330#ifdef EXIM_HAVE_OPENSSL_CIPHER_STD_NAME
2331return CUS SSL_CIPHER_standard_name(SSL_get_current_cipher(ssl));
2332#else
2333ushort id = 0xffff & SSL_CIPHER_get_id(SSL_get_current_cipher(ssl));
2334return cipher_stdname(id >> 8, id & 0xff);
2335#endif
059ec3d9
PH
2336}
2337
2338
da40b1ec
JH
2339static const uschar *
2340tlsver_name(SSL * ssl)
2341{
2342uschar * s, * p;
2343int pool = store_pool;
2344
2345store_pool = POOL_PERM;
2346s = string_copy(US SSL_get_version(ssl));
2347store_pool = pool;
2348if ((p = Ustrchr(s, 'v'))) /* TLSv1.2 -> TLS1.2 */
2349 for (;; p++) if (!(*p = p[1])) break;
2350return CUS s;
2351}
2352
2353
f69979cf 2354static void
70e384dd 2355peer_cert(SSL * ssl, tls_support * tlsp, uschar * peerdn, unsigned siz)
f69979cf
JH
2356{
2357/*XXX we might consider a list-of-certs variable for the cert chain.
2358SSL_get_peer_cert_chain(SSL*). We'd need a new variable type and support
2359in list-handling functions, also consider the difference between the entire
2360chain and the elements sent by the peer. */
2361
70e384dd
JH
2362tlsp->peerdn = NULL;
2363
f69979cf
JH
2364/* Will have already noted peercert on a verify fail; possibly not the leaf */
2365if (!tlsp->peercert)
2366 tlsp->peercert = SSL_get_peer_certificate(ssl);
2367/* Beware anonymous ciphers which lead to server_cert being NULL */
2368if (tlsp->peercert)
70e384dd
JH
2369 if (!X509_NAME_oneline(X509_get_subject_name(tlsp->peercert), CS peerdn, siz))
2370 { DEBUG(D_tls) debug_printf("X509_NAME_oneline() error\n"); }
2371 else
2372 {
4a1bd6b9
JH
2373 int oldpool = store_pool;
2374
2375 peerdn[siz-1] = '\0'; /* paranoia */
2376 store_pool = POOL_PERM;
2377 tlsp->peerdn = string_copy(peerdn);
2378 store_pool = oldpool;
2379
2380 /* We used to set CV in the cert-verify callbacks (either plain or dane)
2381 but they don't get called on session-resumption. So use the official
2382 interface, which uses the resumed value. Unfortunately this claims verified
2383 when it actually failed but we're in try-verify mode, due to us wanting the
2384 knowlege that it failed so needing to have the callback and forcing a
2385 permissive return. If we don't force it, the TLS startup is failed.
f4e62a87
JH
2386 The extra bit of information is set in verify_override in the cb, stashed
2387 for resumption next to the TLS session, and used here. */
4a1bd6b9
JH
2388
2389 if (!tlsp->verify_override)
4ed67f68
JH
2390 tlsp->certificate_verified =
2391#ifdef SUPPORT_DANE
2392 tlsp->dane_verified ||
2393#endif
2394 SSL_get_verify_result(ssl) == X509_V_OK;
70e384dd 2395 }
f69979cf
JH
2396}
2397
2398
059ec3d9
PH
2399
2400
2401
2402/*************************************************
2403* Set up for verifying certificates *
2404*************************************************/
2405
0e8aed8a 2406#ifndef DISABLE_OCSP
c3033f13
JH
2407/* Load certs from file, return TRUE on success */
2408
2409static BOOL
2410chain_from_pem_file(const uschar * file, STACK_OF(X509) * verify_stack)
2411{
2412BIO * bp;
2413X509 * x;
2414
dec766a1
WB
2415while (sk_X509_num(verify_stack) > 0)
2416 X509_free(sk_X509_pop(verify_stack));
2417
c3033f13
JH
2418if (!(bp = BIO_new_file(CS file, "r"))) return FALSE;
2419while ((x = PEM_read_bio_X509(bp, NULL, 0, NULL)))
2420 sk_X509_push(verify_stack, x);
2421BIO_free(bp);
2422return TRUE;
2423}
0e8aed8a 2424#endif
c3033f13
JH
2425
2426
2427
dec766a1
WB
2428/* Called by both client and server startup; on the server possibly
2429repeated after a Server Name Indication.
059ec3d9
PH
2430
2431Arguments:
7be682ca 2432 sctx SSL_CTX* to initialise
059ec3d9
PH
2433 certs certs file or NULL
2434 crl CRL file or NULL
2435 host NULL in a server; the remote host in a client
2436 optional TRUE if called from a server for a host in tls_try_verify_hosts;
2437 otherwise passed as FALSE
983207c1 2438 cert_vfy_cb Callback function for certificate verification
cf0c6164 2439 errstr error string pointer
059ec3d9
PH
2440
2441Returns: OK/DEFER/FAIL
2442*/
2443
2444static int
983207c1 2445setup_certs(SSL_CTX *sctx, uschar *certs, uschar *crl, host_item *host, BOOL optional,
cf0c6164 2446 int (*cert_vfy_cb)(int, X509_STORE_CTX *), uschar ** errstr)
059ec3d9
PH
2447{
2448uschar *expcerts, *expcrl;
2449
cf0c6164 2450if (!expand_check(certs, US"tls_verify_certificates", &expcerts, errstr))
059ec3d9 2451 return DEFER;
57cc2785 2452DEBUG(D_tls) debug_printf("tls_verify_certificates: %s\n", expcerts);
059ec3d9 2453
10a831a3 2454if (expcerts && *expcerts)
059ec3d9 2455 {
10a831a3
JH
2456 /* Tell the library to use its compiled-in location for the system default
2457 CA bundle. Then add the ones specified in the config, if any. */
cb1d7830 2458
10a831a3 2459 if (!SSL_CTX_set_default_verify_paths(sctx))
cf0c6164 2460 return tls_error(US"SSL_CTX_set_default_verify_paths", host, NULL, errstr);
10a831a3
JH
2461
2462 if (Ustrcmp(expcerts, "system") != 0)
059ec3d9 2463 {
cb1d7830
JH
2464 struct stat statbuf;
2465
cb1d7830
JH
2466 if (Ustat(expcerts, &statbuf) < 0)
2467 {
2468 log_write(0, LOG_MAIN|LOG_PANIC,
2469 "failed to stat %s for certificates", expcerts);
2470 return DEFER;
2471 }
059ec3d9 2472 else
059ec3d9 2473 {
cb1d7830
JH
2474 uschar *file, *dir;
2475 if ((statbuf.st_mode & S_IFMT) == S_IFDIR)
2476 { file = NULL; dir = expcerts; }
2477 else
c3033f13
JH
2478 {
2479 file = expcerts; dir = NULL;
2480#ifndef DISABLE_OCSP
2481 /* In the server if we will be offering an OCSP proof, load chain from
2482 file for verifying the OCSP proof at load time. */
2483
5b2fd993
JH
2484/*XXX Glitch! The file here is tls_verify_certs: the chain for verifying the client cert.
2485This is inconsistent with the need to verify the OCSP proof of the server cert.
2486*/
2487
c3033f13
JH
2488 if ( !host
2489 && statbuf.st_size > 0
2490 && server_static_cbinfo->u_ocsp.server.file
2491 && !chain_from_pem_file(file, server_static_cbinfo->verify_stack)
2492 )
2493 {
2494 log_write(0, LOG_MAIN|LOG_PANIC,
57887ecc 2495 "failed to load cert chain from %s", file);
c3033f13
JH
2496 return DEFER;
2497 }
2498#endif
2499 }
cb1d7830 2500
d06f582f 2501 /* If a certificate file is empty, the load function fails with an
cb1d7830
JH
2502 unhelpful error message. If we skip it, we get the correct behaviour (no
2503 certificates are recognized, but the error message is still misleading (it
c3033f13 2504 says no certificate was supplied). But this is better. */
cb1d7830 2505
f2f2c91b
JH
2506 if ( (!file || statbuf.st_size > 0)
2507 && !SSL_CTX_load_verify_locations(sctx, CS file, CS dir))
cf0c6164 2508 return tls_error(US"SSL_CTX_load_verify_locations", host, NULL, errstr);
cb1d7830 2509
d06f582f
JH
2510 /* On the server load the list of CAs for which we will accept certs, for
2511 sending to the client. This is only for the one-file
2512 tls_verify_certificates variant.
d7978c0f
JH
2513 If a list isn't loaded into the server, but some verify locations are set,
2514 the server end appears to make a wildcard request for client certs.
10a831a3 2515 Meanwhile, the client library as default behaviour *ignores* the list
cb1d7830
JH
2516 we send over the wire - see man SSL_CTX_set_client_cert_cb.
2517 Because of this, and that the dir variant is likely only used for
d7978c0f
JH
2518 the public-CA bundle (not for a private CA), not worth fixing. */
2519
f2f2c91b 2520 if (file)
cb1d7830 2521 {
2009ecca 2522 STACK_OF(X509_NAME) * names = SSL_load_client_CA_file(CS file);
dec766a1 2523
d06f582f 2524 if (!host) SSL_CTX_set_client_CA_list(sctx, names);
f2f2c91b 2525 DEBUG(D_tls) debug_printf("Added %d certificate authorities.\n",
cb1d7830 2526 sk_X509_NAME_num(names));
cb1d7830 2527 }
059ec3d9
PH
2528 }
2529 }
2530
2531 /* Handle a certificate revocation list. */
2532
10a831a3 2533#if OPENSSL_VERSION_NUMBER > 0x00907000L
059ec3d9 2534
8b417f2c 2535 /* This bit of code is now the version supplied by Lars Mainka. (I have
10a831a3 2536 merely reformatted it into the Exim code style.)
8b417f2c 2537
10a831a3
JH
2538 "From here I changed the code to add support for multiple crl's
2539 in pem format in one file or to support hashed directory entries in
2540 pem format instead of a file. This method now uses the library function
2541 X509_STORE_load_locations to add the CRL location to the SSL context.
2542 OpenSSL will then handle the verify against CA certs and CRLs by
2543 itself in the verify callback." */
8b417f2c 2544
cf0c6164 2545 if (!expand_check(crl, US"tls_crl", &expcrl, errstr)) return DEFER;
10a831a3 2546 if (expcrl && *expcrl)
059ec3d9 2547 {
8b417f2c
PH
2548 struct stat statbufcrl;
2549 if (Ustat(expcrl, &statbufcrl) < 0)
2550 {
2551 log_write(0, LOG_MAIN|LOG_PANIC,
2552 "failed to stat %s for certificates revocation lists", expcrl);
2553 return DEFER;
2554 }
2555 else
059ec3d9 2556 {
8b417f2c
PH
2557 /* is it a file or directory? */
2558 uschar *file, *dir;
7be682ca 2559 X509_STORE *cvstore = SSL_CTX_get_cert_store(sctx);
8b417f2c 2560 if ((statbufcrl.st_mode & S_IFMT) == S_IFDIR)
059ec3d9 2561 {
8b417f2c
PH
2562 file = NULL;
2563 dir = expcrl;
2564 DEBUG(D_tls) debug_printf("SSL CRL value is a directory %s\n", dir);
059ec3d9
PH
2565 }
2566 else
2567 {
8b417f2c
PH
2568 file = expcrl;
2569 dir = NULL;
2570 DEBUG(D_tls) debug_printf("SSL CRL value is a file %s\n", file);
059ec3d9 2571 }
8b417f2c 2572 if (X509_STORE_load_locations(cvstore, CS file, CS dir) == 0)
cf0c6164 2573 return tls_error(US"X509_STORE_load_locations", host, NULL, errstr);
8b417f2c
PH
2574
2575 /* setting the flags to check against the complete crl chain */
2576
2577 X509_STORE_set_flags(cvstore,
2578 X509_V_FLAG_CRL_CHECK|X509_V_FLAG_CRL_CHECK_ALL);
059ec3d9 2579 }
059ec3d9
PH
2580 }
2581
10a831a3 2582#endif /* OPENSSL_VERSION_NUMBER > 0x00907000L */
059ec3d9
PH
2583
2584 /* If verification is optional, don't fail if no certificate */
2585
7be682ca 2586 SSL_CTX_set_verify(sctx,
5a2a0989 2587 SSL_VERIFY_PEER | (optional ? 0 : SSL_VERIFY_FAIL_IF_NO_PEER_CERT),
983207c1 2588 cert_vfy_cb);
059ec3d9
PH
2589 }
2590
2591return OK;
2592}
2593
2594
2595
2596/*************************************************
2597* Start a TLS session in a server *
2598*************************************************/
2599
2600/* This is called when Exim is running as a server, after having received
2601the STARTTLS command. It must respond to that command, and then negotiate
2602a TLS session.
2603
2604Arguments:
2605 require_ciphers allowed ciphers
cf0c6164 2606 errstr pointer to error message
059ec3d9
PH
2607
2608Returns: OK on success
2609 DEFER for errors before the start of the negotiation
4c04137d 2610 FAIL for errors during the negotiation; the server can't
059ec3d9
PH
2611 continue running.
2612*/
2613
2614int
cf0c6164 2615tls_server_start(const uschar * require_ciphers, uschar ** errstr)
059ec3d9
PH
2616{
2617int rc;
cf0c6164
JH
2618uschar * expciphers;
2619tls_ext_ctx_cb * cbinfo;
f69979cf 2620static uschar peerdn[256];
059ec3d9
PH
2621
2622/* Check for previous activation */
2623
74f1a423 2624if (tls_in.active.sock >= 0)
059ec3d9 2625 {
cf0c6164 2626 tls_error(US"STARTTLS received after TLS started", NULL, US"", errstr);
925ac8e4 2627 smtp_printf("554 Already in TLS\r\n", FALSE);
059ec3d9
PH
2628 return FAIL;
2629 }
2630
2631/* Initialize the SSL library. If it fails, it will already have logged
2632the error. */
2633
817d9f57 2634rc = tls_init(&server_ctx, NULL, tls_dhparam, tls_certificate, tls_privatekey,
f2de3a33 2635#ifndef DISABLE_OCSP
5b2fd993 2636 tls_ocsp_file,
3f7eeb86 2637#endif
b10c87b3 2638 NULL, &server_static_cbinfo, &tls_in, errstr);
059ec3d9 2639if (rc != OK) return rc;
817d9f57 2640cbinfo = server_static_cbinfo;
059ec3d9 2641
cf0c6164 2642if (!expand_check(require_ciphers, US"tls_require_ciphers", &expciphers, errstr))
059ec3d9
PH
2643 return FAIL;
2644
2645/* In OpenSSL, cipher components are separated by hyphens. In GnuTLS, they
17c76198
PP
2646were historically separated by underscores. So that I can use either form in my
2647tests, and also for general convenience, we turn underscores into hyphens here.
0c3807a8
JH
2648
2649XXX SSL_CTX_set_cipher_list() is replaced by SSL_CTX_set_ciphersuites()
2650for TLS 1.3 . Since we do not call it at present we get the default list:
2651TLS_AES_256_GCM_SHA384:TLS_CHACHA20_POLY1305_SHA256:TLS_AES_128_GCM_SHA256
17c76198 2652*/
059ec3d9 2653
c3033f13 2654if (expciphers)
059ec3d9 2655 {
b10c87b3 2656 for (uschar * s = expciphers; *s; s++ ) if (*s == '_') *s = '-';
059ec3d9 2657 DEBUG(D_tls) debug_printf("required ciphers: %s\n", expciphers);
817d9f57 2658 if (!SSL_CTX_set_cipher_list(server_ctx, CS expciphers))
cf0c6164 2659 return tls_error(US"SSL_CTX_set_cipher_list", NULL, NULL, errstr);
7be682ca 2660 cbinfo->server_cipher_list = expciphers;
059ec3d9
PH
2661 }
2662
2663/* If this is a host for which certificate verification is mandatory or
2664optional, set up appropriately. */
2665
817d9f57 2666tls_in.certificate_verified = FALSE;
c0635b6d 2667#ifdef SUPPORT_DANE
53a7196b
JH
2668tls_in.dane_verified = FALSE;
2669#endif
a2ff477a 2670server_verify_callback_called = FALSE;
059ec3d9
PH
2671
2672if (verify_check_host(&tls_verify_hosts) == OK)
2673 {
983207c1 2674 rc = setup_certs(server_ctx, tls_verify_certificates, tls_crl, NULL,
afdb5e9c 2675 FALSE, verify_callback_server, errstr);
059ec3d9 2676 if (rc != OK) return rc;
a2ff477a 2677 server_verify_optional = FALSE;
059ec3d9
PH
2678 }
2679else if (verify_check_host(&tls_try_verify_hosts) == OK)
2680 {
983207c1 2681 rc = setup_certs(server_ctx, tls_verify_certificates, tls_crl, NULL,
afdb5e9c 2682 TRUE, verify_callback_server, errstr);
059ec3d9 2683 if (rc != OK) return rc;
a2ff477a 2684 server_verify_optional = TRUE;
059ec3d9
PH
2685 }
2686
b10c87b3
JH
2687#ifdef EXPERIMENTAL_TLS_RESUME
2688SSL_CTX_set_tlsext_ticket_key_cb(server_ctx, ticket_key_callback);
2689/* despite working, appears to always return failure, so ignoring */
2690#endif
2691#ifdef OPENSSL_HAVE_NUM_TICKETS
2692# ifdef EXPERIMENTAL_TLS_RESUME
2693SSL_CTX_set_num_tickets(server_ctx, tls_in.host_resumable ? 1 : 0);
2694# else
2695SSL_CTX_set_num_tickets(server_ctx, 0); /* send no TLS1.3 stateful-tickets */
2696# endif
2697#endif
2698
2699
059ec3d9
PH
2700/* Prepare for new connection */
2701
cf0c6164
JH
2702if (!(server_ssl = SSL_new(server_ctx)))
2703 return tls_error(US"SSL_new", NULL, NULL, errstr);
da3ad30d
PP
2704
2705/* Warning: we used to SSL_clear(ssl) here, it was removed.
2706 *
2707 * With the SSL_clear(), we get strange interoperability bugs with
2708 * OpenSSL 1.0.1b and TLS1.1/1.2. It looks as though this may be a bug in
2709 * OpenSSL itself, as a clear should not lead to inability to follow protocols.
2710 *
2711 * The SSL_clear() call is to let an existing SSL* be reused, typically after
2712 * session shutdown. In this case, we have a brand new object and there's no
2713 * obvious reason to immediately clear it. I'm guessing that this was
2714 * originally added because of incomplete initialisation which the clear fixed,
2715 * in some historic release.
2716 */
059ec3d9
PH
2717
2718/* Set context and tell client to go ahead, except in the case of TLS startup
2719on connection, where outputting anything now upsets the clients and tends to
2720make them disconnect. We need to have an explicit fflush() here, to force out
2721the response. Other smtp_printf() calls do not need it, because in non-TLS
2722mode, the fflush() happens when smtp_getc() is called. */
2723
817d9f57
JH
2724SSL_set_session_id_context(server_ssl, sid_ctx, Ustrlen(sid_ctx));
2725if (!tls_in.on_connect)
059ec3d9 2726 {
925ac8e4 2727 smtp_printf("220 TLS go ahead\r\n", FALSE);
059ec3d9
PH
2728 fflush(smtp_out);
2729 }
2730
2731/* Now negotiate the TLS session. We put our own timer on it, since it seems
2732that the OpenSSL library doesn't. */
2733
817d9f57
JH
2734SSL_set_wfd(server_ssl, fileno(smtp_out));
2735SSL_set_rfd(server_ssl, fileno(smtp_in));
2736SSL_set_accept_state(server_ssl);
059ec3d9
PH
2737
2738DEBUG(D_tls) debug_printf("Calling SSL_accept\n");
2739
2740sigalrm_seen = FALSE;
c2a1bba0 2741if (smtp_receive_timeout > 0) ALARM(smtp_receive_timeout);
817d9f57 2742rc = SSL_accept(server_ssl);
c2a1bba0 2743ALARM_CLR(0);
059ec3d9
PH
2744
2745if (rc <= 0)
2746 {
c31e16a5
JH
2747 int error = SSL_get_error(server_ssl, rc);
2748 switch(error)
2749 {
2750 case SSL_ERROR_NONE:
2751 break;
2752
2753 case SSL_ERROR_ZERO_RETURN:
2754 DEBUG(D_tls) debug_printf("Got SSL_ERROR_ZERO_RETURN\n");
2755 (void) tls_error(US"SSL_accept", NULL, sigalrm_seen ? US"timed out" : NULL, errstr);
2756
2757 if (SSL_get_shutdown(server_ssl) == SSL_RECEIVED_SHUTDOWN)
2758 SSL_shutdown(server_ssl);
2759
2760 tls_close(NULL, TLS_NO_SHUTDOWN);
2761 return FAIL;
2762
2763 /* Handle genuine errors */
2764 case SSL_ERROR_SSL:
fa9e4a1d
JH
2765 {
2766 uschar * s = US"SSL_accept";
4ed67f68 2767 unsigned long e = ERR_peek_error();
fa9e4a1d
JH
2768 if (ERR_GET_REASON(e) == SSL_R_WRONG_VERSION_NUMBER)
2769 s = string_sprintf("%s (%s)", s, SSL_get_version(server_ssl));
2770 (void) tls_error(s, NULL, sigalrm_seen ? US"timed out" : NULL, errstr);
c31e16a5 2771 return FAIL;
fa9e4a1d 2772 }
c31e16a5
JH
2773
2774 default:
2775 DEBUG(D_tls) debug_printf("Got SSL error %d\n", error);
2776 if (error == SSL_ERROR_SYSCALL)
2777 {
2778 if (!errno)
2779 {
2780 *errstr = US"SSL_accept: TCP connection closed by peer";
2781 return FAIL;
2782 }
2783 DEBUG(D_tls) debug_printf(" - syscall %s\n", strerror(errno));
2784 }
2785 (void) tls_error(US"SSL_accept", NULL, sigalrm_seen ? US"timed out" : NULL, errstr);
2786 return FAIL;
2787 }
059ec3d9
PH
2788 }
2789
2790DEBUG(D_tls) debug_printf("SSL_accept was successful\n");
25fa0868 2791ERR_clear_error(); /* Even success can leave errors in the stack. Seen with
b10c87b3
JH
2792 anon-authentication ciphersuite negotiated. */
2793
2794#ifdef EXPERIMENTAL_TLS_RESUME
2795if (SSL_session_reused(server_ssl))
2796 {
2797 tls_in.resumption |= RESUME_USED;
2798 DEBUG(D_tls) debug_printf("Session reused\n");
2799 }
2800#endif
059ec3d9 2801
da40b1ec
JH
2802/* TLS has been set up. Record data for the connection,
2803adjust the input functions to read via TLS, and initialize things. */
059ec3d9 2804
17ba0f52 2805#ifdef SSL_get_extms_support
1c519e07 2806tls_in.ext_master_secret = SSL_get_extms_support(server_ssl) == 1;
17ba0f52 2807#endif
f69979cf
JH
2808peer_cert(server_ssl, &tls_in, peerdn, sizeof(peerdn));
2809
da40b1ec
JH
2810tls_in.ver = tlsver_name(server_ssl);
2811tls_in.cipher = construct_cipher_name(server_ssl, tls_in.ver, &tls_in.bits);
f1be21cf
JH
2812tls_in.cipher_stdname = cipher_stdname_ssl(server_ssl);
2813
059ec3d9
PH
2814DEBUG(D_tls)
2815 {
2816 uschar buf[2048];
f1be21cf 2817 if (SSL_get_shared_ciphers(server_ssl, CS buf, sizeof(buf)))
059ec3d9 2818 debug_printf("Shared ciphers: %s\n", buf);
f20cfa4a
JH
2819
2820#ifdef EXIM_HAVE_OPENSSL_KEYLOG
2821 {
10ed27e0 2822 BIO * bp = BIO_new_fp(debug_file, BIO_NOCLOSE);
f20cfa4a 2823 SSL_SESSION_print_keylog(bp, SSL_get_session(server_ssl));
f20cfa4a
JH
2824 BIO_free(bp);
2825 }
2826#endif
b10c87b3
JH
2827
2828#ifdef EXIM_HAVE_SESSION_TICKET
2829 {
2830 SSL_SESSION * ss = SSL_get_session(server_ssl);
40618fb6 2831 if (SSL_SESSION_has_ticket(ss)) /* 1.1.0 */
b10c87b3
JH
2832 debug_printf("The session has a ticket, life %lu seconds\n",
2833 SSL_SESSION_get_ticket_lifetime_hint(ss));
2834 }
2835#endif
059ec3d9
PH
2836 }
2837
9d1c15ef
JH
2838/* Record the certificate we presented */
2839 {
2840 X509 * crt = SSL_get_certificate(server_ssl);
2841 tls_in.ourcert = crt ? X509_dup(crt) : NULL;
2842 }
059ec3d9 2843
b1a32a3c
JH
2844/* Channel-binding info for authenticators
2845See description in https://paquier.xyz/postgresql-2/channel-binding-openssl/ */
2846 {
2847 uschar c, * s;
2848 size_t len = SSL_get_peer_finished(server_ssl, &c, 0);
2849 int old_pool = store_pool;
c8b050fd 2850
b1a32a3c
JH
2851 SSL_get_peer_finished(server_ssl, s = store_get((int)len, FALSE), len);
2852 store_pool = POOL_PERM;
2853 tls_in.channelbinding = b64encode_taint(CUS s, (int)len, FALSE);
2854 store_pool = old_pool;
14a806d6 2855 DEBUG(D_tls) debug_printf("Have channel bindings cached for possible auth usage %p\n", tls_in.channelbinding);
b1a32a3c
JH
2856 }
2857
817d9f57
JH
2858/* Only used by the server-side tls (tls_in), including tls_getc.
2859 Client-side (tls_out) reads (seem to?) go via
2860 smtp_read_response()/ip_recv().
2861 Hence no need to duplicate for _in and _out.
2862 */
b808677c 2863if (!ssl_xfer_buffer) ssl_xfer_buffer = store_malloc(ssl_xfer_buffer_size);
059ec3d9 2864ssl_xfer_buffer_lwm = ssl_xfer_buffer_hwm = 0;
8b77d27a 2865ssl_xfer_eof = ssl_xfer_error = FALSE;
059ec3d9
PH
2866
2867receive_getc = tls_getc;
0d81dabc 2868receive_getbuf = tls_getbuf;
584e96c6 2869receive_get_cache = tls_get_cache;
059ec3d9
PH
2870receive_ungetc = tls_ungetc;
2871receive_feof = tls_feof;
2872receive_ferror = tls_ferror;
58eb016e 2873receive_smtp_buffered = tls_smtp_buffered;
059ec3d9 2874
74f1a423
JH
2875tls_in.active.sock = fileno(smtp_out);
2876tls_in.active.tls_ctx = NULL; /* not using explicit ctx for server-side */
059ec3d9
PH
2877return OK;
2878}
2879
2880
2881
2882
043b1248
JH
2883static int
2884tls_client_basic_ctx_init(SSL_CTX * ctx,
cf0c6164
JH
2885 host_item * host, smtp_transport_options_block * ob, tls_ext_ctx_cb * cbinfo,
2886 uschar ** errstr)
043b1248
JH
2887{
2888int rc;
94431adb 2889/* stick to the old behaviour for compatibility if tls_verify_certificates is
043b1248
JH
2890 set but both tls_verify_hosts and tls_try_verify_hosts is not set. Check only
2891 the specified host patterns if one of them is defined */
2892
610ff438
JH
2893if ( ( !ob->tls_verify_hosts
2894 && (!ob->tls_try_verify_hosts || !*ob->tls_try_verify_hosts)
2895 )
3c07dd2d 2896 || verify_check_given_host(CUSS &ob->tls_verify_hosts, host) == OK
aa2a70ba 2897 )
043b1248 2898 client_verify_optional = FALSE;
3c07dd2d 2899else if (verify_check_given_host(CUSS &ob->tls_try_verify_hosts, host) == OK)
aa2a70ba
JH
2900 client_verify_optional = TRUE;
2901else
2902 return OK;
2903
2904if ((rc = setup_certs(ctx, ob->tls_verify_certificates,
cf0c6164
JH
2905 ob->tls_crl, host, client_verify_optional, verify_callback_client,
2906 errstr)) != OK)
aa2a70ba 2907 return rc;
043b1248 2908
3c07dd2d 2909if (verify_check_given_host(CUSS &ob->tls_verify_cert_hostnames, host) == OK)
043b1248 2910 {
4af0d74a 2911 cbinfo->verify_cert_hostnames =
8c5d388a 2912#ifdef SUPPORT_I18N
4af0d74a
JH
2913 string_domain_utf8_to_alabel(host->name, NULL);
2914#else
2915 host->name;
2916#endif
aa2a70ba
JH
2917 DEBUG(D_tls) debug_printf("Cert hostname to check: \"%s\"\n",
2918 cbinfo->verify_cert_hostnames);
043b1248 2919 }
043b1248
JH
2920return OK;
2921}
059ec3d9 2922
fde080a4 2923
c0635b6d 2924#ifdef SUPPORT_DANE
fde080a4 2925static int
cf0c6164 2926dane_tlsa_load(SSL * ssl, host_item * host, dns_answer * dnsa, uschar ** errstr)
fde080a4 2927{
fde080a4
JH
2928dns_scan dnss;
2929const char * hostnames[2] = { CS host->name, NULL };
2930int found = 0;
2931
2932if (DANESSL_init(ssl, NULL, hostnames) != 1)
cf0c6164 2933 return tls_error(US"hostnames load", host, NULL, errstr);
fde080a4 2934
d7978c0f 2935for (dns_record * rr = dns_next_rr(dnsa, &dnss, RESET_ANSWERS); rr;
fde080a4 2936 rr = dns_next_rr(dnsa, &dnss, RESET_NEXT)
1b76ad22 2937 ) if (rr->type == T_TLSA && rr->size > 3)
fde080a4 2938 {
c3033f13 2939 const uschar * p = rr->data;
fde080a4
JH
2940 uint8_t usage, selector, mtype;
2941 const char * mdname;
2942
fde080a4 2943 usage = *p++;
133d2546
JH
2944
2945 /* Only DANE-TA(2) and DANE-EE(3) are supported */
2946 if (usage != 2 && usage != 3) continue;
2947
fde080a4
JH
2948 selector = *p++;
2949 mtype = *p++;
2950
2951 switch (mtype)
2952 {
133d2546
JH
2953 default: continue; /* Only match-types 0, 1, 2 are supported */
2954 case 0: mdname = NULL; break;
2955 case 1: mdname = "sha256"; break;
2956 case 2: mdname = "sha512"; break;
fde080a4
JH
2957 }
2958
133d2546 2959 found++;
fde080a4
JH
2960 switch (DANESSL_add_tlsa(ssl, usage, selector, mdname, p, rr->size - 3))
2961 {
2962 default:
cf0c6164 2963 return tls_error(US"tlsa load", host, NULL, errstr);
c035b645 2964 case 0: /* action not taken */
fde080a4
JH
2965 case 1: break;
2966 }
594706ea
JH
2967
2968 tls_out.tlsa_usage |= 1<<usage;
fde080a4
JH
2969 }
2970
2971if (found)
2972 return OK;
2973
133d2546 2974log_write(0, LOG_MAIN, "DANE error: No usable TLSA records");
6ebd79ec 2975return DEFER;
fde080a4 2976}
c0635b6d 2977#endif /*SUPPORT_DANE*/
fde080a4
JH
2978
2979
2980
b10c87b3
JH
2981#ifdef EXPERIMENTAL_TLS_RESUME
2982/* On the client, get any stashed session for the given IP from hints db
2983and apply it to the ssl-connection for attempted resumption. */
2984
2985static void
2986tls_retrieve_session(tls_support * tlsp, SSL * ssl, const uschar * key)
2987{
2988tlsp->resumption |= RESUME_SUPPORTED;
2989if (tlsp->host_resumable)
2990 {
2991 dbdata_tls_session * dt;
2992 int len;
2993 open_db dbblock, * dbm_file;
2994
2995 tlsp->resumption |= RESUME_CLIENT_REQUESTED;
2996 DEBUG(D_tls) debug_printf("checking for resumable session for %s\n", key);
2997 if ((dbm_file = dbfn_open(US"tls", O_RDONLY, &dbblock, FALSE, FALSE)))
2998 {
2999 /* key for the db is the IP */
3000 if ((dt = dbfn_read_with_length(dbm_file, key, &len)))
3001 {
3002 SSL_SESSION * ss = NULL;
3003 const uschar * sess_asn1 = dt->session;
3004
3005 len -= sizeof(dbdata_tls_session);
3006 if (!(d2i_SSL_SESSION(&ss, &sess_asn1, (long)len)))
3007 {
3008 DEBUG(D_tls)
3009 {
3010 ERR_error_string_n(ERR_get_error(),
3011 ssl_errstring, sizeof(ssl_errstring));
3012 debug_printf("decoding session: %s\n", ssl_errstring);
3013 }
3014 }
a775dd1d 3015#ifdef EXIM_HAVE_SESSION_TICKET
4f1d23a1
JH
3016 else if ( SSL_SESSION_get_ticket_lifetime_hint(ss) + dt->time_stamp
3017 < time(NULL))
3018 {
3019 DEBUG(D_tls) debug_printf("session expired\n");
3020 dbfn_delete(dbm_file, key);
3021 }
a775dd1d 3022#endif
b10c87b3
JH
3023 else if (!SSL_set_session(ssl, ss))
3024 {
3025 DEBUG(D_tls)
3026 {
3027 ERR_error_string_n(ERR_get_error(),
3028 ssl_errstring, sizeof(ssl_errstring));
3029 debug_printf("applying session to ssl: %s\n", ssl_errstring);
3030 }
3031 }
3032 else
3033 {
3034 DEBUG(D_tls) debug_printf("good session\n");
3035 tlsp->resumption |= RESUME_CLIENT_SUGGESTED;
f4e62a87 3036 tlsp->verify_override = dt->verify_override;
c82de233 3037 tlsp->ocsp = dt->ocsp;
b10c87b3
JH
3038 }
3039 }
3040 else
3041 DEBUG(D_tls) debug_printf("no session record\n");
3042 dbfn_close(dbm_file);
3043 }
3044 }
3045}
3046
3047
3048/* On the client, save the session for later resumption */
3049
3050static int
3051tls_save_session_cb(SSL * ssl, SSL_SESSION * ss)
3052{
3053tls_ext_ctx_cb * cbinfo = SSL_get_ex_data(ssl, tls_exdata_idx);
3054tls_support * tlsp;
3055
3056DEBUG(D_tls) debug_printf("tls_save_session_cb\n");
3057
3058if (!cbinfo || !(tlsp = cbinfo->tlsp)->host_resumable) return 0;
3059
40618fb6
JH
3060# ifdef OPENSSL_HAVE_NUM_TICKETS
3061if (SSL_SESSION_is_resumable(ss)) /* 1.1.1 */
3062# endif
b10c87b3
JH
3063 {
3064 int len = i2d_SSL_SESSION(ss, NULL);
3065 int dlen = sizeof(dbdata_tls_session) + len;
f3ebb786 3066 dbdata_tls_session * dt = store_get(dlen, TRUE);
b10c87b3
JH
3067 uschar * s = dt->session;
3068 open_db dbblock, * dbm_file;
3069
3070 DEBUG(D_tls) debug_printf("session is resumable\n");
3071 tlsp->resumption |= RESUME_SERVER_TICKET; /* server gave us a ticket */
3072
f4e62a87 3073 dt->verify_override = tlsp->verify_override;
c82de233 3074 dt->ocsp = tlsp->ocsp;
f4e62a87 3075 (void) i2d_SSL_SESSION(ss, &s); /* s gets bumped to end */
b10c87b3
JH
3076
3077 if ((dbm_file = dbfn_open(US"tls", O_RDWR, &dbblock, FALSE, FALSE)))
3078 {
3079 const uschar * key = cbinfo->host->address;
3080 dbfn_delete(dbm_file, key);
3081 dbfn_write(dbm_file, key, dt, dlen);
3082 dbfn_close(dbm_file);
3083 DEBUG(D_tls) debug_printf("wrote session (len %u) to db\n",
3084 (unsigned)dlen);
3085 }
3086 }
b10c87b3
JH
3087return 1;
3088}
3089
3090
3091static void
3092tls_client_ctx_resume_prehandshake(
3093 exim_openssl_client_tls_ctx * exim_client_ctx, tls_support * tlsp,
3094 smtp_transport_options_block * ob, host_item * host)
3095{
3096/* Should the client request a session resumption ticket? */
3097if (verify_check_given_host(CUSS &ob->tls_resumption_hosts, host) == OK)
3098 {
3099 tlsp->host_resumable = TRUE;
3100
3101 SSL_CTX_set_session_cache_mode(exim_client_ctx->ctx,
3102 SSL_SESS_CACHE_CLIENT
3103 | SSL_SESS_CACHE_NO_INTERNAL | SSL_SESS_CACHE_NO_AUTO_CLEAR);
3104 SSL_CTX_sess_set_new_cb(exim_client_ctx->ctx, tls_save_session_cb);
3105 }
3106}
3107
3108static BOOL
3109tls_client_ssl_resume_prehandshake(SSL * ssl, tls_support * tlsp,
3110 host_item * host, uschar ** errstr)
3111{
3112if (tlsp->host_resumable)
3113 {
3114 DEBUG(D_tls)
3115 debug_printf("tls_resumption_hosts overrides openssl_options, enabling tickets\n");
3116 SSL_clear_options(ssl, SSL_OP_NO_TICKET);
3117
3118 tls_exdata_idx = SSL_get_ex_new_index(0, 0, 0, 0, 0);
3119 if (!SSL_set_ex_data(ssl, tls_exdata_idx, client_static_cbinfo))
3120 {
3121 tls_error(US"set ex_data", host, NULL, errstr);
3122 return FALSE;
3123 }
3124 debug_printf("tls_exdata_idx %d cbinfo %p\n", tls_exdata_idx, client_static_cbinfo);
3125 }
3126
3127tlsp->resumption = RESUME_SUPPORTED;
3128/* Pick up a previous session, saved on an old ticket */
3129tls_retrieve_session(tlsp, ssl, host->address);
3130return TRUE;
3131}
3132
3133static void
3134tls_client_resume_posthandshake(exim_openssl_client_tls_ctx * exim_client_ctx,
3135 tls_support * tlsp)
3136{
3137if (SSL_session_reused(exim_client_ctx->ssl))
3138 {
3139 DEBUG(D_tls) debug_printf("The session was reused\n");
3140 tlsp->resumption |= RESUME_USED;
3141 }
3142}
3143#endif /* EXPERIMENTAL_TLS_RESUME */
3144
3145
059ec3d9
PH
3146/*************************************************
3147* Start a TLS session in a client *
3148*************************************************/
3149
3150/* Called from the smtp transport after STARTTLS has been accepted.
3151
c05bdbd6
JH
3152Arguments:
3153 cctx connection context
3154 conn_args connection details
3155 cookie datum for randomness; can be NULL
3156 tlsp record details of TLS channel configuration here; must be non-NULL
3157 errstr error string pointer
3158
3159Returns: TRUE for success with TLS session context set in connection context,
3160 FALSE on error
059ec3d9
PH
3161*/
3162
c05bdbd6
JH
3163BOOL
3164tls_client_start(client_conn_ctx * cctx, smtp_connect_args * conn_args,
3165 void * cookie, tls_support * tlsp, uschar ** errstr)
059ec3d9 3166{
c05bdbd6
JH
3167host_item * host = conn_args->host; /* for msgs and option-tests */
3168transport_instance * tb = conn_args->tblock; /* always smtp or NULL */
afdb5e9c
JH
3169smtp_transport_options_block * ob = tb
3170 ? (smtp_transport_options_block *)tb->options_block
3171 : &smtp_transport_option_defaults;
74f1a423 3172exim_openssl_client_tls_ctx * exim_client_ctx;
868f5672 3173uschar * expciphers;
059ec3d9 3174int rc;
c05bdbd6 3175static uschar peerdn[256];
043b1248
JH
3176
3177#ifndef DISABLE_OCSP
043b1248 3178BOOL request_ocsp = FALSE;
6634ac8d 3179BOOL require_ocsp = FALSE;
043b1248 3180#endif
043b1248 3181
74f1a423
JH
3182rc = store_pool;
3183store_pool = POOL_PERM;
f3ebb786 3184exim_client_ctx = store_get(sizeof(exim_openssl_client_tls_ctx), FALSE);
c09dbcfb 3185exim_client_ctx->corked = NULL;
74f1a423
JH
3186store_pool = rc;
3187
c0635b6d 3188#ifdef SUPPORT_DANE
74f1a423 3189tlsp->tlsa_usage = 0;
043b1248
JH
3190#endif
3191
f2de3a33 3192#ifndef DISABLE_OCSP
043b1248 3193 {
c0635b6d 3194# ifdef SUPPORT_DANE
c05bdbd6 3195 if ( conn_args->dane
4f59c424
JH
3196 && ob->hosts_request_ocsp[0] == '*'
3197 && ob->hosts_request_ocsp[1] == '\0'
3198 )
3199 {
3200 /* Unchanged from default. Use a safer one under DANE */
3201 request_ocsp = TRUE;
3202 ob->hosts_request_ocsp = US"${if or { {= {0}{$tls_out_tlsa_usage}} "
3203 " {= {4}{$tls_out_tlsa_usage}} } "
3204 " {*}{}}";
3205 }
3206# endif
3207
5130845b 3208 if ((require_ocsp =
3c07dd2d 3209 verify_check_given_host(CUSS &ob->hosts_require_ocsp, host) == OK))
fca41d5a
JH
3210 request_ocsp = TRUE;
3211 else
c0635b6d 3212# ifdef SUPPORT_DANE
4f59c424 3213 if (!request_ocsp)
fca41d5a 3214# endif
5130845b 3215 request_ocsp =
3c07dd2d 3216 verify_check_given_host(CUSS &ob->hosts_request_ocsp, host) == OK;
043b1248 3217 }
f5d78688 3218#endif
059ec3d9 3219
74f1a423 3220rc = tls_init(&exim_client_ctx->ctx, host, NULL,
65867078 3221 ob->tls_certificate, ob->tls_privatekey,
f2de3a33 3222#ifndef DISABLE_OCSP
44662487 3223 (void *)(long)request_ocsp,
3f7eeb86 3224#endif
b10c87b3 3225 cookie, &client_static_cbinfo, tlsp, errstr);
c05bdbd6 3226if (rc != OK) return FALSE;
059ec3d9 3227
74f1a423 3228tlsp->certificate_verified = FALSE;
a2ff477a 3229client_verify_callback_called = FALSE;
059ec3d9 3230
5ec37a55
PP
3231expciphers = NULL;
3232#ifdef SUPPORT_DANE
c05bdbd6 3233if (conn_args->dane)
5ec37a55
PP
3234 {
3235 /* We fall back to tls_require_ciphers if unset, empty or forced failure, but
3236 other failures should be treated as problems. */
3237 if (ob->dane_require_tls_ciphers &&
3238 !expand_check(ob->dane_require_tls_ciphers, US"dane_require_tls_ciphers",
3239 &expciphers, errstr))
c05bdbd6 3240 return FALSE;
5ec37a55
PP
3241 if (expciphers && *expciphers == '\0')
3242 expciphers = NULL;
3243 }
3244#endif
3245if (!expciphers &&
3246 !expand_check(ob->tls_require_ciphers, US"tls_require_ciphers",
3247 &expciphers, errstr))
c05bdbd6 3248 return FALSE;
059ec3d9
PH
3249
3250/* In OpenSSL, cipher components are separated by hyphens. In GnuTLS, they
3251are separated by underscores. So that I can use either form in my tests, and
3252also for general convenience, we turn underscores into hyphens here. */
3253
cf0c6164 3254if (expciphers)
059ec3d9
PH
3255 {
3256 uschar *s = expciphers;
cf0c6164 3257 while (*s) { if (*s == '_') *s = '-'; s++; }
059ec3d9 3258 DEBUG(D_tls) debug_printf("required ciphers: %s\n", expciphers);
74f1a423
JH
3259 if (!SSL_CTX_set_cipher_list(exim_client_ctx->ctx, CS expciphers))
3260 {
3261 tls_error(US"SSL_CTX_set_cipher_list", host, NULL, errstr);
c05bdbd6 3262 return FALSE;
74f1a423 3263 }
059ec3d9
PH
3264 }
3265
c0635b6d 3266#ifdef SUPPORT_DANE
c05bdbd6 3267if (conn_args->dane)
a63be306 3268 {
74f1a423 3269 SSL_CTX_set_verify(exim_client_ctx->ctx,
02af313d
JH
3270 SSL_VERIFY_PEER | SSL_VERIFY_FAIL_IF_NO_PEER_CERT,
3271 verify_callback_client_dane);
e5cccda9 3272
043b1248 3273 if (!DANESSL_library_init())
74f1a423
JH
3274 {
3275 tls_error(US"library init", host, NULL, errstr);
c05bdbd6 3276 return FALSE;
74f1a423
JH
3277 }
3278 if (DANESSL_CTX_init(exim_client_ctx->ctx) <= 0)
3279 {
3280 tls_error(US"context init", host, NULL, errstr);
c05bdbd6 3281 return FALSE;
74f1a423 3282 }
043b1248
JH
3283 }
3284else
e51c7be2 3285
043b1248
JH
3286#endif
3287
74f1a423
JH
3288 if (tls_client_basic_ctx_init(exim_client_ctx->ctx, host, ob,
3289 client_static_cbinfo, errstr) != OK)
c05bdbd6 3290 return FALSE;
059ec3d9 3291
b10c87b3
JH
3292#ifdef EXPERIMENTAL_TLS_RESUME
3293tls_client_ctx_resume_prehandshake(exim_client_ctx, tlsp, ob, host);
3294#endif
3295
3296
74f1a423
JH
3297if (!(exim_client_ctx->ssl = SSL_new(exim_client_ctx->ctx)))
3298 {
3299 tls_error(US"SSL_new", host, NULL, errstr);
c05bdbd6 3300 return FALSE;
74f1a423
JH
3301 }
3302SSL_set_session_id_context(exim_client_ctx->ssl, sid_ctx, Ustrlen(sid_ctx));
b10c87b3 3303
c05bdbd6 3304SSL_set_fd(exim_client_ctx->ssl, cctx->sock);
74f1a423 3305SSL_set_connect_state(exim_client_ctx->ssl);
059ec3d9 3306
65867078 3307if (ob->tls_sni)
3f0945ff 3308 {
74f1a423 3309 if (!expand_check(ob->tls_sni, US"tls_sni", &tlsp->sni, errstr))
c05bdbd6 3310 return FALSE;
74f1a423 3311 if (!tlsp->sni)
2c9a0e86
PP
3312 {
3313 DEBUG(D_tls) debug_printf("Setting TLS SNI forced to fail, not sending\n");
3314 }
74f1a423
JH
3315 else if (!Ustrlen(tlsp->sni))
3316 tlsp->sni = NULL;
3f0945ff
PP
3317 else
3318 {
35731706 3319#ifdef EXIM_HAVE_OPENSSL_TLSEXT
74f1a423
JH
3320 DEBUG(D_tls) debug_printf("Setting TLS SNI \"%s\"\n", tlsp->sni);
3321 SSL_set_tlsext_host_name(exim_client_ctx->ssl, tlsp->sni);
35731706 3322#else
66802652 3323 log_write(0, LOG_MAIN, "SNI unusable with this OpenSSL library version; ignoring \"%s\"\n",
74f1a423 3324 tlsp->sni);
35731706 3325#endif
3f0945ff
PP
3326 }
3327 }
3328
c0635b6d 3329#ifdef SUPPORT_DANE
c05bdbd6
JH
3330if (conn_args->dane)