Explain the 3 SSL_CTX we have
[exim.git] / src / src / tls-openssl.c
CommitLineData
059ec3d9
PH
1/*************************************************
2* Exim - an Internet mail transport agent *
3*************************************************/
4
c4ceed07 5/* Copyright (c) University of Cambridge 1995 - 2012 */
059ec3d9
PH
6/* See the file NOTICE for conditions of use and distribution. */
7
8/* This module provides the TLS (aka SSL) support for Exim using the OpenSSL
9library. It is #included into the tls.c file when that library is used. The
10code herein is based on a patch that was originally contributed by Steve
11Haslam. It was adapted from stunnel, a GPL program by Michal Trojnara.
12
13No cryptographic code is included in Exim. All this module does is to call
14functions from the OpenSSL library. */
15
16
17/* Heading stuff */
18
19#include <openssl/lhash.h>
20#include <openssl/ssl.h>
21#include <openssl/err.h>
22#include <openssl/rand.h>
3f7eeb86
PP
23#ifdef EXPERIMENTAL_OCSP
24#include <openssl/ocsp.h>
25#endif
26
27#ifdef EXPERIMENTAL_OCSP
28#define EXIM_OCSP_SKEW_SECONDS (300L)
29#define EXIM_OCSP_MAX_AGE (-1L)
30#endif
059ec3d9 31
3bcbbbe2
PP
32#if OPENSSL_VERSION_NUMBER >= 0x0090806fL && !defined(OPENSSL_NO_TLSEXT)
33#define EXIM_HAVE_OPENSSL_TLSEXT
34#endif
35
059ec3d9
PH
36/* Structure for collecting random data for seeding. */
37
38typedef struct randstuff {
9e3331ea
TK
39 struct timeval tv;
40 pid_t p;
059ec3d9
PH
41} randstuff;
42
43/* Local static variables */
44
a2ff477a
JH
45static BOOL client_verify_callback_called = FALSE;
46static BOOL server_verify_callback_called = FALSE;
059ec3d9
PH
47static const uschar *sid_ctx = US"exim";
48
d4f09789
PP
49/* We have three different contexts to care about.
50
51Simple case: client, `client_ctx`
52 As a client, we can be doing a callout or cut-through delivery while receiving
53 a message. So we have a client context, which should have options initialised
54 from the SMTP Transport.
55
56Server:
57 There are two cases: with and without ServerNameIndication from the client.
58 Given TLS SNI, we can be using different keys, certs and various other
59 configuration settings, because they're re-expanded with $tls_sni set. This
60 allows vhosting with TLS. This SNI is sent in the handshake.
61 A client might not send SNI, so we need a fallback, and an initial setup too.
62 So as a server, we start out using `server_ctx`.
63 If SNI is sent by the client, then we as server, mid-negotiation, try to clone
64 `server_sni` from `server_ctx` and then initialise settings by re-expanding
65 configuration.
66*/
67
817d9f57
JH
68static SSL_CTX *client_ctx = NULL;
69static SSL_CTX *server_ctx = NULL;
70static SSL *client_ssl = NULL;
71static SSL *server_ssl = NULL;
389ca47a 72
35731706 73#ifdef EXIM_HAVE_OPENSSL_TLSEXT
817d9f57 74static SSL_CTX *server_sni = NULL;
35731706 75#endif
059ec3d9
PH
76
77static char ssl_errstring[256];
78
79static int ssl_session_timeout = 200;
a2ff477a
JH
80static BOOL client_verify_optional = FALSE;
81static BOOL server_verify_optional = FALSE;
059ec3d9 82
7be682ca 83static BOOL reexpand_tls_files_for_sni = FALSE;
059ec3d9
PH
84
85
7be682ca
PP
86typedef struct tls_ext_ctx_cb {
87 uschar *certificate;
88 uschar *privatekey;
3f7eeb86
PP
89#ifdef EXPERIMENTAL_OCSP
90 uschar *ocsp_file;
91 uschar *ocsp_file_expanded;
92 OCSP_RESPONSE *ocsp_response;
93#endif
7be682ca
PP
94 uschar *dhparam;
95 /* these are cached from first expand */
96 uschar *server_cipher_list;
97 /* only passed down to tls_error: */
98 host_item *host;
99} tls_ext_ctx_cb;
100
101/* should figure out a cleanup of API to handle state preserved per
102implementation, for various reasons, which can be void * in the APIs.
103For now, we hack around it. */
817d9f57
JH
104tls_ext_ctx_cb *client_static_cbinfo = NULL;
105tls_ext_ctx_cb *server_static_cbinfo = NULL;
7be682ca
PP
106
107static int
a2ff477a 108setup_certs(SSL_CTX *sctx, uschar *certs, uschar *crl, host_item *host, BOOL optional, BOOL client);
059ec3d9 109
3f7eeb86 110/* Callbacks */
3bcbbbe2 111#ifdef EXIM_HAVE_OPENSSL_TLSEXT
3f7eeb86 112static int tls_servername_cb(SSL *s, int *ad ARG_UNUSED, void *arg);
3bcbbbe2 113#endif
3f7eeb86
PP
114#ifdef EXPERIMENTAL_OCSP
115static int tls_stapling_cb(SSL *s, void *arg);
116#endif
117
059ec3d9
PH
118
119/*************************************************
120* Handle TLS error *
121*************************************************/
122
123/* Called from lots of places when errors occur before actually starting to do
124the TLS handshake, that is, while the session is still in clear. Always returns
125DEFER for a server and FAIL for a client so that most calls can use "return
126tls_error(...)" to do this processing and then give an appropriate return. A
127single function is used for both server and client, because it is called from
128some shared functions.
129
130Argument:
131 prefix text to include in the logged error
132 host NULL if setting up a server;
133 the connected host if setting up a client
7199e1ee 134 msg error message or NULL if we should ask OpenSSL
059ec3d9
PH
135
136Returns: OK/DEFER/FAIL
137*/
138
139static int
7199e1ee 140tls_error(uschar *prefix, host_item *host, uschar *msg)
059ec3d9 141{
7199e1ee
TF
142if (msg == NULL)
143 {
144 ERR_error_string(ERR_get_error(), ssl_errstring);
5ca6d115 145 msg = (uschar *)ssl_errstring;
7199e1ee
TF
146 }
147
059ec3d9
PH
148if (host == NULL)
149 {
7199e1ee 150 uschar *conn_info = smtp_get_connection_info();
5ca6d115 151 if (Ustrncmp(conn_info, US"SMTP ", 5) == 0)
7199e1ee
TF
152 conn_info += 5;
153 log_write(0, LOG_MAIN, "TLS error on %s (%s): %s",
154 conn_info, prefix, msg);
059ec3d9
PH
155 return DEFER;
156 }
157else
158 {
159 log_write(0, LOG_MAIN, "TLS error on connection to %s [%s] (%s): %s",
7199e1ee 160 host->name, host->address, prefix, msg);
059ec3d9
PH
161 return FAIL;
162 }
163}
164
165
166
167/*************************************************
168* Callback to generate RSA key *
169*************************************************/
170
171/*
172Arguments:
173 s SSL connection
174 export not used
175 keylength keylength
176
177Returns: pointer to generated key
178*/
179
180static RSA *
181rsa_callback(SSL *s, int export, int keylength)
182{
183RSA *rsa_key;
184export = export; /* Shut picky compilers up */
185DEBUG(D_tls) debug_printf("Generating %d bit RSA key...\n", keylength);
186rsa_key = RSA_generate_key(keylength, RSA_F4, NULL, NULL);
187if (rsa_key == NULL)
188 {
189 ERR_error_string(ERR_get_error(), ssl_errstring);
190 log_write(0, LOG_MAIN|LOG_PANIC, "TLS error (RSA_generate_key): %s",
191 ssl_errstring);
192 return NULL;
193 }
194return rsa_key;
195}
196
197
198
199
200/*************************************************
201* Callback for verification *
202*************************************************/
203
204/* The SSL library does certificate verification if set up to do so. This
205callback has the current yes/no state is in "state". If verification succeeded,
206we set up the tls_peerdn string. If verification failed, what happens depends
207on whether the client is required to present a verifiable certificate or not.
208
209If verification is optional, we change the state to yes, but still log the
210verification error. For some reason (it really would help to have proper
211documentation of OpenSSL), this callback function then gets called again, this
212time with state = 1. In fact, that's useful, because we can set up the peerdn
213value, but we must take care not to set the private verified flag on the second
214time through.
215
216Note: this function is not called if the client fails to present a certificate
217when asked. We get here only if a certificate has been received. Handling of
218optional verification for this case is done when requesting SSL to verify, by
219setting SSL_VERIFY_FAIL_IF_NO_PEER_CERT in the non-optional case.
220
221Arguments:
222 state current yes/no state as 1/0
223 x509ctx certificate information.
a2ff477a 224 client TRUE for client startup, FALSE for server startup
059ec3d9
PH
225
226Returns: 1 if verified, 0 if not
227*/
228
229static int
a2ff477a 230verify_callback(int state, X509_STORE_CTX *x509ctx, BOOL client)
059ec3d9
PH
231{
232static uschar txt[256];
a2ff477a
JH
233tls_support * tlsp;
234BOOL * calledp;
235BOOL * optionalp;
236
237if (client)
238 {
239 tlsp= &tls_out;
240 calledp= &client_verify_callback_called;
241 optionalp= &client_verify_optional;
242 }
243else
244 {
245 tlsp= &tls_in;
246 calledp= &server_verify_callback_called;
247 optionalp= &server_verify_optional;
248 }
059ec3d9
PH
249
250X509_NAME_oneline(X509_get_subject_name(x509ctx->current_cert),
251 CS txt, sizeof(txt));
252
253if (state == 0)
254 {
255 log_write(0, LOG_MAIN, "SSL verify error: depth=%d error=%s cert=%s",
256 x509ctx->error_depth,
257 X509_verify_cert_error_string(x509ctx->error),
258 txt);
a2ff477a
JH
259 tlsp->certificate_verified = FALSE;
260 *calledp = TRUE;
261 if (!*optionalp) return 0; /* reject */
059ec3d9
PH
262 DEBUG(D_tls) debug_printf("SSL verify failure overridden (host in "
263 "tls_try_verify_hosts)\n");
264 return 1; /* accept */
265 }
266
267if (x509ctx->error_depth != 0)
268 {
269 DEBUG(D_tls) debug_printf("SSL verify ok: depth=%d cert=%s\n",
270 x509ctx->error_depth, txt);
271 }
272else
273 {
274 DEBUG(D_tls) debug_printf("SSL%s peer: %s\n",
a2ff477a
JH
275 *calledp ? "" : " authenticated", txt);
276 tlsp->peerdn = txt;
059ec3d9
PH
277 }
278
a2ff477a
JH
279if (!*calledp) tlsp->certificate_verified = TRUE;
280*calledp = TRUE;
059ec3d9
PH
281
282return 1; /* accept */
283}
284
a2ff477a
JH
285static int
286verify_callback_client(int state, X509_STORE_CTX *x509ctx)
287{
288return verify_callback(state, x509ctx, TRUE);
289}
290
291static int
292verify_callback_server(int state, X509_STORE_CTX *x509ctx)
293{
294return verify_callback(state, x509ctx, FALSE);
295}
296
059ec3d9
PH
297
298
299/*************************************************
300* Information callback *
301*************************************************/
302
303/* The SSL library functions call this from time to time to indicate what they
7be682ca
PP
304are doing. We copy the string to the debugging output when TLS debugging has
305been requested.
059ec3d9
PH
306
307Arguments:
308 s the SSL connection
309 where
310 ret
311
312Returns: nothing
313*/
314
315static void
316info_callback(SSL *s, int where, int ret)
317{
318where = where;
319ret = ret;
320DEBUG(D_tls) debug_printf("SSL info: %s\n", SSL_state_string_long(s));
321}
322
323
324
325/*************************************************
326* Initialize for DH *
327*************************************************/
328
329/* If dhparam is set, expand it, and load up the parameters for DH encryption.
330
331Arguments:
a799883d 332 dhparam DH parameter file or fixed parameter identity string
7199e1ee 333 host connected host, if client; NULL if server
059ec3d9
PH
334
335Returns: TRUE if OK (nothing to set up, or setup worked)
336*/
337
338static BOOL
a799883d 339init_dh(SSL_CTX *sctx, uschar *dhparam, host_item *host)
059ec3d9 340{
059ec3d9
PH
341BIO *bio;
342DH *dh;
343uschar *dhexpanded;
a799883d 344const char *pem;
059ec3d9
PH
345
346if (!expand_check(dhparam, US"tls_dhparam", &dhexpanded))
347 return FALSE;
348
a799883d 349if (dhexpanded == NULL || *dhexpanded == '\0')
059ec3d9 350 {
a799883d 351 bio = BIO_new_mem_buf(CS std_dh_prime_default(), -1);
059ec3d9 352 }
a799883d 353else if (dhexpanded[0] == '/')
059ec3d9 354 {
a799883d
PP
355 bio = BIO_new_file(CS dhexpanded, "r");
356 if (bio == NULL)
059ec3d9 357 {
7199e1ee 358 tls_error(string_sprintf("could not read dhparams file %s", dhexpanded),
a799883d
PP
359 host, US strerror(errno));
360 return FALSE;
059ec3d9 361 }
a799883d
PP
362 }
363else
364 {
365 if (Ustrcmp(dhexpanded, "none") == 0)
059ec3d9 366 {
a799883d
PP
367 DEBUG(D_tls) debug_printf("Requested no DH parameters.\n");
368 return TRUE;
059ec3d9 369 }
a799883d
PP
370
371 pem = std_dh_prime_named(dhexpanded);
372 if (!pem)
373 {
374 tls_error(string_sprintf("Unknown standard DH prime \"%s\"", dhexpanded),
375 host, US strerror(errno));
376 return FALSE;
377 }
378 bio = BIO_new_mem_buf(CS pem, -1);
379 }
380
381dh = PEM_read_bio_DHparams(bio, NULL, NULL, NULL);
382if (dh == NULL)
383 {
059ec3d9 384 BIO_free(bio);
a799883d
PP
385 tls_error(string_sprintf("Could not read tls_dhparams \"%s\"", dhexpanded),
386 host, NULL);
387 return FALSE;
388 }
389
390/* Even if it is larger, we silently return success rather than cause things
391 * to fail out, so that a too-large DH will not knock out all TLS; it's a
392 * debatable choice. */
393if ((8*DH_size(dh)) > tls_dh_max_bits)
394 {
395 DEBUG(D_tls)
396 debug_printf("dhparams file %d bits, is > tls_dh_max_bits limit of %d",
397 8*DH_size(dh), tls_dh_max_bits);
398 }
399else
400 {
401 SSL_CTX_set_tmp_dh(sctx, dh);
402 DEBUG(D_tls)
403 debug_printf("Diffie-Hellman initialized from %s with %d-bit prime\n",
404 dhexpanded ? dhexpanded : US"default", 8*DH_size(dh));
059ec3d9
PH
405 }
406
a799883d
PP
407DH_free(dh);
408BIO_free(bio);
409
410return TRUE;
059ec3d9
PH
411}
412
413
414
415
3f7eeb86
PP
416#ifdef EXPERIMENTAL_OCSP
417/*************************************************
418* Load OCSP information into state *
419*************************************************/
420
421/* Called to load the OCSP response from the given file into memory, once
422caller has determined this is needed. Checks validity. Debugs a message
423if invalid.
424
425ASSUMES: single response, for single cert.
426
427Arguments:
428 sctx the SSL_CTX* to update
429 cbinfo various parts of session state
430 expanded the filename putatively holding an OCSP response
431
432*/
433
434static void
435ocsp_load_response(SSL_CTX *sctx,
436 tls_ext_ctx_cb *cbinfo,
437 const uschar *expanded)
438{
439BIO *bio;
440OCSP_RESPONSE *resp;
441OCSP_BASICRESP *basic_response;
442OCSP_SINGLERESP *single_response;
443ASN1_GENERALIZEDTIME *rev, *thisupd, *nextupd;
444X509_STORE *store;
445unsigned long verify_flags;
446int status, reason, i;
447
448cbinfo->ocsp_file_expanded = string_copy(expanded);
449if (cbinfo->ocsp_response)
450 {
451 OCSP_RESPONSE_free(cbinfo->ocsp_response);
452 cbinfo->ocsp_response = NULL;
453 }
454
455bio = BIO_new_file(CS cbinfo->ocsp_file_expanded, "rb");
456if (!bio)
457 {
458 DEBUG(D_tls) debug_printf("Failed to open OCSP response file \"%s\"\n",
459 cbinfo->ocsp_file_expanded);
460 return;
461 }
462
463resp = d2i_OCSP_RESPONSE_bio(bio, NULL);
464BIO_free(bio);
465if (!resp)
466 {
467 DEBUG(D_tls) debug_printf("Error reading OCSP response.\n");
468 return;
469 }
470
471status = OCSP_response_status(resp);
472if (status != OCSP_RESPONSE_STATUS_SUCCESSFUL)
473 {
474 DEBUG(D_tls) debug_printf("OCSP response not valid: %s (%d)\n",
475 OCSP_response_status_str(status), status);
476 return;
477 }
478
479basic_response = OCSP_response_get1_basic(resp);
480if (!basic_response)
481 {
482 DEBUG(D_tls)
483 debug_printf("OCSP response parse error: unable to extract basic response.\n");
484 return;
485 }
486
487store = SSL_CTX_get_cert_store(sctx);
488verify_flags = OCSP_NOVERIFY; /* check sigs, but not purpose */
489
490/* May need to expose ability to adjust those flags?
491OCSP_NOSIGS OCSP_NOVERIFY OCSP_NOCHAIN OCSP_NOCHECKS OCSP_NOEXPLICIT
492OCSP_TRUSTOTHER OCSP_NOINTERN */
493
494i = OCSP_basic_verify(basic_response, NULL, store, verify_flags);
495if (i <= 0)
496 {
497 DEBUG(D_tls) {
498 ERR_error_string(ERR_get_error(), ssl_errstring);
499 debug_printf("OCSP response verify failure: %s\n", US ssl_errstring);
500 }
501 return;
502 }
503
504/* Here's the simplifying assumption: there's only one response, for the
505one certificate we use, and nothing for anything else in a chain. If this
506proves false, we need to extract a cert id from our issued cert
507(tls_certificate) and use that for OCSP_resp_find_status() (which finds the
508right cert in the stack and then calls OCSP_single_get0_status()).
509
510I'm hoping to avoid reworking a bunch more of how we handle state here. */
511single_response = OCSP_resp_get0(basic_response, 0);
512if (!single_response)
513 {
514 DEBUG(D_tls)
515 debug_printf("Unable to get first response from OCSP basic response.\n");
516 return;
517 }
518
519status = OCSP_single_get0_status(single_response, &reason, &rev, &thisupd, &nextupd);
520/* how does this status differ from the one above? */
521if (status != OCSP_RESPONSE_STATUS_SUCCESSFUL)
522 {
523 DEBUG(D_tls) debug_printf("OCSP response not valid (take 2): %s (%d)\n",
524 OCSP_response_status_str(status), status);
525 return;
526 }
527
528if (!OCSP_check_validity(thisupd, nextupd, EXIM_OCSP_SKEW_SECONDS, EXIM_OCSP_MAX_AGE))
529 {
530 DEBUG(D_tls) debug_printf("OCSP status invalid times.\n");
531 return;
532 }
533
534cbinfo->ocsp_response = resp;
535}
536#endif
537
538
539
540
059ec3d9 541/*************************************************
7be682ca
PP
542* Expand key and cert file specs *
543*************************************************/
544
545/* Called once during tls_init and possibly againt during TLS setup, for a
546new context, if Server Name Indication was used and tls_sni was seen in
547the certificate string.
548
549Arguments:
550 sctx the SSL_CTX* to update
551 cbinfo various parts of session state
552
553Returns: OK/DEFER/FAIL
554*/
555
556static int
3f7eeb86 557tls_expand_session_files(SSL_CTX *sctx, tls_ext_ctx_cb *cbinfo)
7be682ca
PP
558{
559uschar *expanded;
560
561if (cbinfo->certificate == NULL)
562 return OK;
563
d9b2312b
JH
564if (Ustrstr(cbinfo->certificate, US"tls_sni") ||
565 Ustrstr(cbinfo->certificate, US"tls_in_sni") ||
566 Ustrstr(cbinfo->certificate, US"tls_out_sni")
567 )
7be682ca
PP
568 reexpand_tls_files_for_sni = TRUE;
569
570if (!expand_check(cbinfo->certificate, US"tls_certificate", &expanded))
571 return DEFER;
572
573if (expanded != NULL)
574 {
575 DEBUG(D_tls) debug_printf("tls_certificate file %s\n", expanded);
576 if (!SSL_CTX_use_certificate_chain_file(sctx, CS expanded))
577 return tls_error(string_sprintf(
578 "SSL_CTX_use_certificate_chain_file file=%s", expanded),
579 cbinfo->host, NULL);
580 }
581
582if (cbinfo->privatekey != NULL &&
583 !expand_check(cbinfo->privatekey, US"tls_privatekey", &expanded))
584 return DEFER;
585
586/* If expansion was forced to fail, key_expanded will be NULL. If the result
587of the expansion is an empty string, ignore it also, and assume the private
588key is in the same file as the certificate. */
589
590if (expanded != NULL && *expanded != 0)
591 {
592 DEBUG(D_tls) debug_printf("tls_privatekey file %s\n", expanded);
593 if (!SSL_CTX_use_PrivateKey_file(sctx, CS expanded, SSL_FILETYPE_PEM))
594 return tls_error(string_sprintf(
595 "SSL_CTX_use_PrivateKey_file file=%s", expanded), cbinfo->host, NULL);
596 }
597
3f7eeb86
PP
598#ifdef EXPERIMENTAL_OCSP
599if (cbinfo->ocsp_file != NULL)
600 {
601 if (!expand_check(cbinfo->ocsp_file, US"tls_ocsp_file", &expanded))
602 return DEFER;
603
604 if (expanded != NULL && *expanded != 0)
605 {
606 DEBUG(D_tls) debug_printf("tls_ocsp_file %s\n", expanded);
607 if (cbinfo->ocsp_file_expanded &&
608 (Ustrcmp(expanded, cbinfo->ocsp_file_expanded) == 0))
609 {
610 DEBUG(D_tls)
611 debug_printf("tls_ocsp_file value unchanged, using existing values.\n");
612 } else {
613 ocsp_load_response(sctx, cbinfo, expanded);
614 }
615 }
616 }
617#endif
618
7be682ca
PP
619return OK;
620}
621
622
623
624
625/*************************************************
626* Callback to handle SNI *
627*************************************************/
628
629/* Called when acting as server during the TLS session setup if a Server Name
630Indication extension was sent by the client.
631
632API documentation is OpenSSL s_server.c implementation.
633
634Arguments:
635 s SSL* of the current session
636 ad unknown (part of OpenSSL API) (unused)
637 arg Callback of "our" registered data
638
639Returns: SSL_TLSEXT_ERR_{OK,ALERT_WARNING,ALERT_FATAL,NOACK}
640*/
641
3bcbbbe2 642#ifdef EXIM_HAVE_OPENSSL_TLSEXT
7be682ca 643static int
7be682ca
PP
644tls_servername_cb(SSL *s, int *ad ARG_UNUSED, void *arg)
645{
646const char *servername = SSL_get_servername(s, TLSEXT_NAMETYPE_host_name);
3f7eeb86 647tls_ext_ctx_cb *cbinfo = (tls_ext_ctx_cb *) arg;
7be682ca 648int rc;
3f0945ff 649int old_pool = store_pool;
7be682ca
PP
650
651if (!servername)
652 return SSL_TLSEXT_ERR_OK;
653
3f0945ff 654DEBUG(D_tls) debug_printf("Received TLS SNI \"%s\"%s\n", servername,
7be682ca
PP
655 reexpand_tls_files_for_sni ? "" : " (unused for certificate selection)");
656
657/* Make the extension value available for expansion */
3f0945ff 658store_pool = POOL_PERM;
817d9f57 659tls_in.sni = string_copy(US servername);
3f0945ff 660store_pool = old_pool;
7be682ca
PP
661
662if (!reexpand_tls_files_for_sni)
663 return SSL_TLSEXT_ERR_OK;
664
665/* Can't find an SSL_CTX_clone() or equivalent, so we do it manually;
666not confident that memcpy wouldn't break some internal reference counting.
667Especially since there's a references struct member, which would be off. */
668
817d9f57
JH
669server_sni = SSL_CTX_new(SSLv23_server_method());
670if (!server_sni)
7be682ca
PP
671 {
672 ERR_error_string(ERR_get_error(), ssl_errstring);
673 DEBUG(D_tls) debug_printf("SSL_CTX_new() failed: %s\n", ssl_errstring);
674 return SSL_TLSEXT_ERR_NOACK;
675 }
676
677/* Not sure how many of these are actually needed, since SSL object
678already exists. Might even need this selfsame callback, for reneg? */
679
817d9f57
JH
680SSL_CTX_set_info_callback(server_sni, SSL_CTX_get_info_callback(server_ctx));
681SSL_CTX_set_mode(server_sni, SSL_CTX_get_mode(server_ctx));
682SSL_CTX_set_options(server_sni, SSL_CTX_get_options(server_ctx));
683SSL_CTX_set_timeout(server_sni, SSL_CTX_get_timeout(server_ctx));
684SSL_CTX_set_tlsext_servername_callback(server_sni, tls_servername_cb);
685SSL_CTX_set_tlsext_servername_arg(server_sni, cbinfo);
7be682ca 686if (cbinfo->server_cipher_list)
817d9f57 687 SSL_CTX_set_cipher_list(server_sni, CS cbinfo->server_cipher_list);
3f7eeb86
PP
688#ifdef EXPERIMENTAL_OCSP
689if (cbinfo->ocsp_file)
690 {
817d9f57 691 SSL_CTX_set_tlsext_status_cb(server_sni, tls_stapling_cb);
5e55c7a9 692 SSL_CTX_set_tlsext_status_arg(server_ctx, cbinfo);
3f7eeb86
PP
693 }
694#endif
7be682ca 695
a2ff477a 696rc = setup_certs(server_sni, tls_verify_certificates, tls_crl, NULL, FALSE, FALSE);
7be682ca
PP
697if (rc != OK) return SSL_TLSEXT_ERR_NOACK;
698
3f7eeb86
PP
699/* do this after setup_certs, because this can require the certs for verifying
700OCSP information. */
817d9f57 701rc = tls_expand_session_files(server_sni, cbinfo);
7be682ca
PP
702if (rc != OK) return SSL_TLSEXT_ERR_NOACK;
703
389ca47a 704rc = init_dh(server_sni, cbinfo->dhparam, NULL);
a799883d
PP
705if (rc != OK) return SSL_TLSEXT_ERR_NOACK;
706
7be682ca 707DEBUG(D_tls) debug_printf("Switching SSL context.\n");
817d9f57 708SSL_set_SSL_CTX(s, server_sni);
7be682ca
PP
709
710return SSL_TLSEXT_ERR_OK;
711}
3bcbbbe2 712#endif /* EXIM_HAVE_OPENSSL_TLSEXT */
7be682ca
PP
713
714
715
716
3f7eeb86
PP
717#ifdef EXPERIMENTAL_OCSP
718/*************************************************
719* Callback to handle OCSP Stapling *
720*************************************************/
721
722/* Called when acting as server during the TLS session setup if the client
723requests OCSP information with a Certificate Status Request.
724
725Documentation via openssl s_server.c and the Apache patch from the OpenSSL
726project.
727
728*/
729
730static int
731tls_stapling_cb(SSL *s, void *arg)
732{
733const tls_ext_ctx_cb *cbinfo = (tls_ext_ctx_cb *) arg;
734uschar *response_der;
735int response_der_len;
736
737DEBUG(D_tls) debug_printf("Received TLS status request (OCSP stapling); %s response.\n",
738 cbinfo->ocsp_response ? "have" : "lack");
739if (!cbinfo->ocsp_response)
740 return SSL_TLSEXT_ERR_NOACK;
741
742response_der = NULL;
743response_der_len = i2d_OCSP_RESPONSE(cbinfo->ocsp_response, &response_der);
744if (response_der_len <= 0)
745 return SSL_TLSEXT_ERR_NOACK;
746
5e55c7a9 747SSL_set_tlsext_status_ocsp_resp(server_ssl, response_der, response_der_len);
3f7eeb86
PP
748return SSL_TLSEXT_ERR_OK;
749}
750
751#endif /* EXPERIMENTAL_OCSP */
752
753
754
755
7be682ca 756/*************************************************
059ec3d9
PH
757* Initialize for TLS *
758*************************************************/
759
760/* Called from both server and client code, to do preliminary initialization of
761the library.
762
763Arguments:
764 host connected host, if client; NULL if server
765 dhparam DH parameter file
766 certificate certificate file
767 privatekey private key
768 addr address if client; NULL if server (for some randomness)
769
770Returns: OK/DEFER/FAIL
771*/
772
773static int
817d9f57 774tls_init(SSL_CTX **ctxp, host_item *host, uschar *dhparam, uschar *certificate,
3f7eeb86
PP
775 uschar *privatekey,
776#ifdef EXPERIMENTAL_OCSP
777 uschar *ocsp_file,
778#endif
817d9f57 779 address_item *addr, tls_ext_ctx_cb ** cbp)
059ec3d9 780{
77bb000f 781long init_options;
7be682ca 782int rc;
77bb000f 783BOOL okay;
7be682ca
PP
784tls_ext_ctx_cb *cbinfo;
785
786cbinfo = store_malloc(sizeof(tls_ext_ctx_cb));
787cbinfo->certificate = certificate;
788cbinfo->privatekey = privatekey;
3f7eeb86
PP
789#ifdef EXPERIMENTAL_OCSP
790cbinfo->ocsp_file = ocsp_file;
791#endif
7be682ca
PP
792cbinfo->dhparam = dhparam;
793cbinfo->host = host;
77bb000f 794
059ec3d9
PH
795SSL_load_error_strings(); /* basic set up */
796OpenSSL_add_ssl_algorithms();
797
388d6564 798#if (OPENSSL_VERSION_NUMBER >= 0x0090800fL) && !defined(OPENSSL_NO_SHA256)
77bb000f 799/* SHA256 is becoming ever more popular. This makes sure it gets added to the
a0475b69
TK
800list of available digests. */
801EVP_add_digest(EVP_sha256());
cf1ef1a9 802#endif
a0475b69 803
f0f5a555
PP
804/* Create a context.
805The OpenSSL docs in 1.0.1b have not been updated to clarify TLS variant
806negotiation in the different methods; as far as I can tell, the only
807*_{server,client}_method which allows negotiation is SSLv23, which exists even
808when OpenSSL is built without SSLv2 support.
809By disabling with openssl_options, we can let admins re-enable with the
810existing knob. */
059ec3d9 811
817d9f57 812*ctxp = SSL_CTX_new((host == NULL)?
059ec3d9
PH
813 SSLv23_server_method() : SSLv23_client_method());
814
817d9f57 815if (*ctxp == NULL) return tls_error(US"SSL_CTX_new", host, NULL);
059ec3d9
PH
816
817/* It turns out that we need to seed the random number generator this early in
818order to get the full complement of ciphers to work. It took me roughly a day
819of work to discover this by experiment.
820
821On systems that have /dev/urandom, SSL may automatically seed itself from
822there. Otherwise, we have to make something up as best we can. Double check
823afterwards. */
824
825if (!RAND_status())
826 {
827 randstuff r;
9e3331ea 828 gettimeofday(&r.tv, NULL);
059ec3d9
PH
829 r.p = getpid();
830
831 RAND_seed((uschar *)(&r), sizeof(r));
832 RAND_seed((uschar *)big_buffer, big_buffer_size);
833 if (addr != NULL) RAND_seed((uschar *)addr, sizeof(addr));
834
835 if (!RAND_status())
7199e1ee 836 return tls_error(US"RAND_status", host,
5ca6d115 837 US"unable to seed random number generator");
059ec3d9
PH
838 }
839
840/* Set up the information callback, which outputs if debugging is at a suitable
841level. */
842
817d9f57 843SSL_CTX_set_info_callback(*ctxp, (void (*)())info_callback);
059ec3d9 844
c80c5570 845/* Automatically re-try reads/writes after renegotiation. */
817d9f57 846(void) SSL_CTX_set_mode(*ctxp, SSL_MODE_AUTO_RETRY);
c80c5570 847
77bb000f
PP
848/* Apply administrator-supplied work-arounds.
849Historically we applied just one requested option,
850SSL_OP_DONT_INSERT_EMPTY_FRAGMENTS, but when bug 994 requested a second, we
851moved to an administrator-controlled list of options to specify and
852grandfathered in the first one as the default value for "openssl_options".
059ec3d9 853
77bb000f
PP
854No OpenSSL version number checks: the options we accept depend upon the
855availability of the option value macros from OpenSSL. */
059ec3d9 856
77bb000f
PP
857okay = tls_openssl_options_parse(openssl_options, &init_options);
858if (!okay)
73a46702 859 return tls_error(US"openssl_options parsing failed", host, NULL);
77bb000f
PP
860
861if (init_options)
862 {
863 DEBUG(D_tls) debug_printf("setting SSL CTX options: %#lx\n", init_options);
817d9f57 864 if (!(SSL_CTX_set_options(*ctxp, init_options)))
77bb000f
PP
865 return tls_error(string_sprintf(
866 "SSL_CTX_set_option(%#lx)", init_options), host, NULL);
867 }
868else
869 DEBUG(D_tls) debug_printf("no SSL CTX options to set\n");
059ec3d9
PH
870
871/* Initialize with DH parameters if supplied */
872
817d9f57 873if (!init_dh(*ctxp, dhparam, host)) return DEFER;
059ec3d9 874
3f7eeb86 875/* Set up certificate and key (and perhaps OCSP info) */
059ec3d9 876
817d9f57 877rc = tls_expand_session_files(*ctxp, cbinfo);
7be682ca 878if (rc != OK) return rc;
c91535f3 879
7be682ca 880/* If we need to handle SNI, do so */
3bcbbbe2 881#ifdef EXIM_HAVE_OPENSSL_TLSEXT
3f0945ff
PP
882if (host == NULL)
883 {
3f7eeb86
PP
884#ifdef EXPERIMENTAL_OCSP
885 /* We check ocsp_file, not ocsp_response, because we care about if
886 the option exists, not what the current expansion might be, as SNI might
887 change the certificate and OCSP file in use between now and the time the
888 callback is invoked. */
889 if (cbinfo->ocsp_file)
890 {
5e55c7a9
PP
891 SSL_CTX_set_tlsext_status_cb(server_ctx, tls_stapling_cb);
892 SSL_CTX_set_tlsext_status_arg(server_ctx, cbinfo);
3f7eeb86
PP
893 }
894#endif
3f0945ff
PP
895 /* We always do this, so that $tls_sni is available even if not used in
896 tls_certificate */
817d9f57
JH
897 SSL_CTX_set_tlsext_servername_callback(*ctxp, tls_servername_cb);
898 SSL_CTX_set_tlsext_servername_arg(*ctxp, cbinfo);
3f0945ff 899 }
7be682ca 900#endif
059ec3d9
PH
901
902/* Set up the RSA callback */
903
817d9f57 904SSL_CTX_set_tmp_rsa_callback(*ctxp, rsa_callback);
059ec3d9
PH
905
906/* Finally, set the timeout, and we are done */
907
817d9f57 908SSL_CTX_set_timeout(*ctxp, ssl_session_timeout);
059ec3d9 909DEBUG(D_tls) debug_printf("Initialized TLS\n");
7be682ca 910
817d9f57 911*cbp = cbinfo;
7be682ca 912
059ec3d9
PH
913return OK;
914}
915
916
917
918
919/*************************************************
920* Get name of cipher in use *
921*************************************************/
922
817d9f57 923/*
059ec3d9 924Argument: pointer to an SSL structure for the connection
817d9f57
JH
925 buffer to use for answer
926 size of buffer
927 pointer to number of bits for cipher
059ec3d9
PH
928Returns: nothing
929*/
930
931static void
817d9f57 932construct_cipher_name(SSL *ssl, uschar *cipherbuf, int bsize, int *bits)
059ec3d9 933{
57b3a7f5
PP
934/* With OpenSSL 1.0.0a, this needs to be const but the documentation doesn't
935yet reflect that. It should be a safe change anyway, even 0.9.8 versions have
936the accessor functions use const in the prototype. */
937const SSL_CIPHER *c;
059ec3d9 938uschar *ver;
059ec3d9
PH
939
940switch (ssl->session->ssl_version)
941 {
942 case SSL2_VERSION:
943 ver = US"SSLv2";
944 break;
945
946 case SSL3_VERSION:
947 ver = US"SSLv3";
948 break;
949
950 case TLS1_VERSION:
951 ver = US"TLSv1";
952 break;
953
c80c5570
PP
954#ifdef TLS1_1_VERSION
955 case TLS1_1_VERSION:
956 ver = US"TLSv1.1";
957 break;
958#endif
959
960#ifdef TLS1_2_VERSION
961 case TLS1_2_VERSION:
962 ver = US"TLSv1.2";
963 break;
964#endif
965
059ec3d9
PH
966 default:
967 ver = US"UNKNOWN";
968 }
969
57b3a7f5 970c = (const SSL_CIPHER *) SSL_get_current_cipher(ssl);
817d9f57 971SSL_CIPHER_get_bits(c, bits);
059ec3d9 972
817d9f57
JH
973string_format(cipherbuf, bsize, "%s:%s:%u", ver,
974 SSL_CIPHER_get_name(c), *bits);
059ec3d9
PH
975
976DEBUG(D_tls) debug_printf("Cipher: %s\n", cipherbuf);
977}
978
979
980
981
982
983/*************************************************
984* Set up for verifying certificates *
985*************************************************/
986
987/* Called by both client and server startup
988
989Arguments:
7be682ca 990 sctx SSL_CTX* to initialise
059ec3d9
PH
991 certs certs file or NULL
992 crl CRL file or NULL
993 host NULL in a server; the remote host in a client
994 optional TRUE if called from a server for a host in tls_try_verify_hosts;
995 otherwise passed as FALSE
a2ff477a 996 client TRUE if called for client startup, FALSE for server startup
059ec3d9
PH
997
998Returns: OK/DEFER/FAIL
999*/
1000
1001static int
a2ff477a 1002setup_certs(SSL_CTX *sctx, uschar *certs, uschar *crl, host_item *host, BOOL optional, BOOL client)
059ec3d9
PH
1003{
1004uschar *expcerts, *expcrl;
1005
1006if (!expand_check(certs, US"tls_verify_certificates", &expcerts))
1007 return DEFER;
1008
1009if (expcerts != NULL)
1010 {
1011 struct stat statbuf;
7be682ca 1012 if (!SSL_CTX_set_default_verify_paths(sctx))
7199e1ee 1013 return tls_error(US"SSL_CTX_set_default_verify_paths", host, NULL);
059ec3d9
PH
1014
1015 if (Ustat(expcerts, &statbuf) < 0)
1016 {
1017 log_write(0, LOG_MAIN|LOG_PANIC,
1018 "failed to stat %s for certificates", expcerts);
1019 return DEFER;
1020 }
1021 else
1022 {
1023 uschar *file, *dir;
1024 if ((statbuf.st_mode & S_IFMT) == S_IFDIR)
1025 { file = NULL; dir = expcerts; }
1026 else
1027 { file = expcerts; dir = NULL; }
1028
1029 /* If a certificate file is empty, the next function fails with an
1030 unhelpful error message. If we skip it, we get the correct behaviour (no
1031 certificates are recognized, but the error message is still misleading (it
1032 says no certificate was supplied.) But this is better. */
1033
1034 if ((file == NULL || statbuf.st_size > 0) &&
7be682ca 1035 !SSL_CTX_load_verify_locations(sctx, CS file, CS dir))
7199e1ee 1036 return tls_error(US"SSL_CTX_load_verify_locations", host, NULL);
059ec3d9
PH
1037
1038 if (file != NULL)
1039 {
7be682ca 1040 SSL_CTX_set_client_CA_list(sctx, SSL_load_client_CA_file(CS file));
059ec3d9
PH
1041 }
1042 }
1043
1044 /* Handle a certificate revocation list. */
1045
1046 #if OPENSSL_VERSION_NUMBER > 0x00907000L
1047
8b417f2c
PH
1048 /* This bit of code is now the version supplied by Lars Mainka. (I have
1049 * merely reformatted it into the Exim code style.)
1050
1051 * "From here I changed the code to add support for multiple crl's
1052 * in pem format in one file or to support hashed directory entries in
1053 * pem format instead of a file. This method now uses the library function
1054 * X509_STORE_load_locations to add the CRL location to the SSL context.
1055 * OpenSSL will then handle the verify against CA certs and CRLs by
1056 * itself in the verify callback." */
1057
059ec3d9
PH
1058 if (!expand_check(crl, US"tls_crl", &expcrl)) return DEFER;
1059 if (expcrl != NULL && *expcrl != 0)
1060 {
8b417f2c
PH
1061 struct stat statbufcrl;
1062 if (Ustat(expcrl, &statbufcrl) < 0)
1063 {
1064 log_write(0, LOG_MAIN|LOG_PANIC,
1065 "failed to stat %s for certificates revocation lists", expcrl);
1066 return DEFER;
1067 }
1068 else
059ec3d9 1069 {
8b417f2c
PH
1070 /* is it a file or directory? */
1071 uschar *file, *dir;
7be682ca 1072 X509_STORE *cvstore = SSL_CTX_get_cert_store(sctx);
8b417f2c 1073 if ((statbufcrl.st_mode & S_IFMT) == S_IFDIR)
059ec3d9 1074 {
8b417f2c
PH
1075 file = NULL;
1076 dir = expcrl;
1077 DEBUG(D_tls) debug_printf("SSL CRL value is a directory %s\n", dir);
059ec3d9
PH
1078 }
1079 else
1080 {
8b417f2c
PH
1081 file = expcrl;
1082 dir = NULL;
1083 DEBUG(D_tls) debug_printf("SSL CRL value is a file %s\n", file);
059ec3d9 1084 }
8b417f2c 1085 if (X509_STORE_load_locations(cvstore, CS file, CS dir) == 0)
7199e1ee 1086 return tls_error(US"X509_STORE_load_locations", host, NULL);
8b417f2c
PH
1087
1088 /* setting the flags to check against the complete crl chain */
1089
1090 X509_STORE_set_flags(cvstore,
1091 X509_V_FLAG_CRL_CHECK|X509_V_FLAG_CRL_CHECK_ALL);
059ec3d9 1092 }
059ec3d9
PH
1093 }
1094
1095 #endif /* OPENSSL_VERSION_NUMBER > 0x00907000L */
1096
1097 /* If verification is optional, don't fail if no certificate */
1098
7be682ca 1099 SSL_CTX_set_verify(sctx,
059ec3d9 1100 SSL_VERIFY_PEER | (optional? 0 : SSL_VERIFY_FAIL_IF_NO_PEER_CERT),
a2ff477a 1101 client ? verify_callback_client : verify_callback_server);
059ec3d9
PH
1102 }
1103
1104return OK;
1105}
1106
1107
1108
1109/*************************************************
1110* Start a TLS session in a server *
1111*************************************************/
1112
1113/* This is called when Exim is running as a server, after having received
1114the STARTTLS command. It must respond to that command, and then negotiate
1115a TLS session.
1116
1117Arguments:
1118 require_ciphers allowed ciphers
1119
1120Returns: OK on success
1121 DEFER for errors before the start of the negotiation
1122 FAIL for errors during the negotation; the server can't
1123 continue running.
1124*/
1125
1126int
17c76198 1127tls_server_start(const uschar *require_ciphers)
059ec3d9
PH
1128{
1129int rc;
1130uschar *expciphers;
7be682ca 1131tls_ext_ctx_cb *cbinfo;
817d9f57 1132static uschar cipherbuf[256];
059ec3d9
PH
1133
1134/* Check for previous activation */
1135
817d9f57 1136if (tls_in.active >= 0)
059ec3d9 1137 {
5ca6d115 1138 tls_error(US"STARTTLS received after TLS started", NULL, US"");
059ec3d9
PH
1139 smtp_printf("554 Already in TLS\r\n");
1140 return FAIL;
1141 }
1142
1143/* Initialize the SSL library. If it fails, it will already have logged
1144the error. */
1145
817d9f57 1146rc = tls_init(&server_ctx, NULL, tls_dhparam, tls_certificate, tls_privatekey,
3f7eeb86
PP
1147#ifdef EXPERIMENTAL_OCSP
1148 tls_ocsp_file,
1149#endif
817d9f57 1150 NULL, &server_static_cbinfo);
059ec3d9 1151if (rc != OK) return rc;
817d9f57 1152cbinfo = server_static_cbinfo;
059ec3d9
PH
1153
1154if (!expand_check(require_ciphers, US"tls_require_ciphers", &expciphers))
1155 return FAIL;
1156
1157/* In OpenSSL, cipher components are separated by hyphens. In GnuTLS, they
17c76198
PP
1158were historically separated by underscores. So that I can use either form in my
1159tests, and also for general convenience, we turn underscores into hyphens here.
1160*/
059ec3d9
PH
1161
1162if (expciphers != NULL)
1163 {
1164 uschar *s = expciphers;
1165 while (*s != 0) { if (*s == '_') *s = '-'; s++; }
1166 DEBUG(D_tls) debug_printf("required ciphers: %s\n", expciphers);
817d9f57 1167 if (!SSL_CTX_set_cipher_list(server_ctx, CS expciphers))
7199e1ee 1168 return tls_error(US"SSL_CTX_set_cipher_list", NULL, NULL);
7be682ca 1169 cbinfo->server_cipher_list = expciphers;
059ec3d9
PH
1170 }
1171
1172/* If this is a host for which certificate verification is mandatory or
1173optional, set up appropriately. */
1174
817d9f57 1175tls_in.certificate_verified = FALSE;
a2ff477a 1176server_verify_callback_called = FALSE;
059ec3d9
PH
1177
1178if (verify_check_host(&tls_verify_hosts) == OK)
1179 {
a2ff477a 1180 rc = setup_certs(server_ctx, tls_verify_certificates, tls_crl, NULL, FALSE, FALSE);
059ec3d9 1181 if (rc != OK) return rc;
a2ff477a 1182 server_verify_optional = FALSE;
059ec3d9
PH
1183 }
1184else if (verify_check_host(&tls_try_verify_hosts) == OK)
1185 {
a2ff477a 1186 rc = setup_certs(server_ctx, tls_verify_certificates, tls_crl, NULL, TRUE, FALSE);
059ec3d9 1187 if (rc != OK) return rc;
a2ff477a 1188 server_verify_optional = TRUE;
059ec3d9
PH
1189 }
1190
1191/* Prepare for new connection */
1192
817d9f57 1193if ((server_ssl = SSL_new(server_ctx)) == NULL) return tls_error(US"SSL_new", NULL, NULL);
da3ad30d
PP
1194
1195/* Warning: we used to SSL_clear(ssl) here, it was removed.
1196 *
1197 * With the SSL_clear(), we get strange interoperability bugs with
1198 * OpenSSL 1.0.1b and TLS1.1/1.2. It looks as though this may be a bug in
1199 * OpenSSL itself, as a clear should not lead to inability to follow protocols.
1200 *
1201 * The SSL_clear() call is to let an existing SSL* be reused, typically after
1202 * session shutdown. In this case, we have a brand new object and there's no
1203 * obvious reason to immediately clear it. I'm guessing that this was
1204 * originally added because of incomplete initialisation which the clear fixed,
1205 * in some historic release.
1206 */
059ec3d9
PH
1207
1208/* Set context and tell client to go ahead, except in the case of TLS startup
1209on connection, where outputting anything now upsets the clients and tends to
1210make them disconnect. We need to have an explicit fflush() here, to force out
1211the response. Other smtp_printf() calls do not need it, because in non-TLS
1212mode, the fflush() happens when smtp_getc() is called. */
1213
817d9f57
JH
1214SSL_set_session_id_context(server_ssl, sid_ctx, Ustrlen(sid_ctx));
1215if (!tls_in.on_connect)
059ec3d9
PH
1216 {
1217 smtp_printf("220 TLS go ahead\r\n");
1218 fflush(smtp_out);
1219 }
1220
1221/* Now negotiate the TLS session. We put our own timer on it, since it seems
1222that the OpenSSL library doesn't. */
1223
817d9f57
JH
1224SSL_set_wfd(server_ssl, fileno(smtp_out));
1225SSL_set_rfd(server_ssl, fileno(smtp_in));
1226SSL_set_accept_state(server_ssl);
059ec3d9
PH
1227
1228DEBUG(D_tls) debug_printf("Calling SSL_accept\n");
1229
1230sigalrm_seen = FALSE;
1231if (smtp_receive_timeout > 0) alarm(smtp_receive_timeout);
817d9f57 1232rc = SSL_accept(server_ssl);
059ec3d9
PH
1233alarm(0);
1234
1235if (rc <= 0)
1236 {
7199e1ee 1237 tls_error(US"SSL_accept", NULL, sigalrm_seen ? US"timed out" : NULL);
77bb000f
PP
1238 if (ERR_get_error() == 0)
1239 log_write(0, LOG_MAIN,
a053d125 1240 "TLS client disconnected cleanly (rejected our certificate?)");
059ec3d9
PH
1241 return FAIL;
1242 }
1243
1244DEBUG(D_tls) debug_printf("SSL_accept was successful\n");
1245
1246/* TLS has been set up. Adjust the input functions to read via TLS,
1247and initialize things. */
1248
817d9f57
JH
1249construct_cipher_name(server_ssl, cipherbuf, sizeof(cipherbuf), &tls_in.bits);
1250tls_in.cipher = cipherbuf;
059ec3d9
PH
1251
1252DEBUG(D_tls)
1253 {
1254 uschar buf[2048];
817d9f57 1255 if (SSL_get_shared_ciphers(server_ssl, CS buf, sizeof(buf)) != NULL)
059ec3d9
PH
1256 debug_printf("Shared ciphers: %s\n", buf);
1257 }
1258
1259
817d9f57
JH
1260/* Only used by the server-side tls (tls_in), including tls_getc.
1261 Client-side (tls_out) reads (seem to?) go via
1262 smtp_read_response()/ip_recv().
1263 Hence no need to duplicate for _in and _out.
1264 */
059ec3d9
PH
1265ssl_xfer_buffer = store_malloc(ssl_xfer_buffer_size);
1266ssl_xfer_buffer_lwm = ssl_xfer_buffer_hwm = 0;
1267ssl_xfer_eof = ssl_xfer_error = 0;
1268
1269receive_getc = tls_getc;
1270receive_ungetc = tls_ungetc;
1271receive_feof = tls_feof;
1272receive_ferror = tls_ferror;
58eb016e 1273receive_smtp_buffered = tls_smtp_buffered;
059ec3d9 1274
817d9f57 1275tls_in.active = fileno(smtp_out);
059ec3d9
PH
1276return OK;
1277}
1278
1279
1280
1281
1282
1283/*************************************************
1284* Start a TLS session in a client *
1285*************************************************/
1286
1287/* Called from the smtp transport after STARTTLS has been accepted.
1288
1289Argument:
1290 fd the fd of the connection
1291 host connected host (for messages)
83da1223 1292 addr the first address
059ec3d9
PH
1293 dhparam DH parameter file
1294 certificate certificate file
1295 privatekey private key file
3f0945ff 1296 sni TLS SNI to send to remote host
059ec3d9
PH
1297 verify_certs file for certificate verify
1298 crl file containing CRL
1299 require_ciphers list of allowed ciphers
54c90be1
PP
1300 dh_min_bits minimum number of bits acceptable in server's DH prime
1301 (unused in OpenSSL)
83da1223 1302 timeout startup timeout
059ec3d9
PH
1303
1304Returns: OK on success
1305 FAIL otherwise - note that tls_error() will not give DEFER
1306 because this is not a server
1307*/
1308
1309int
1310tls_client_start(int fd, host_item *host, address_item *addr, uschar *dhparam,
3f0945ff
PP
1311 uschar *certificate, uschar *privatekey, uschar *sni,
1312 uschar *verify_certs, uschar *crl,
54c90be1 1313 uschar *require_ciphers, int dh_min_bits ARG_UNUSED, int timeout)
059ec3d9
PH
1314{
1315static uschar txt[256];
1316uschar *expciphers;
1317X509* server_cert;
1318int rc;
817d9f57 1319static uschar cipherbuf[256];
059ec3d9 1320
817d9f57 1321rc = tls_init(&client_ctx, host, dhparam, certificate, privatekey,
3f7eeb86
PP
1322#ifdef EXPERIMENTAL_OCSP
1323 NULL,
1324#endif
817d9f57 1325 addr, &client_static_cbinfo);
059ec3d9
PH
1326if (rc != OK) return rc;
1327
817d9f57 1328tls_out.certificate_verified = FALSE;
a2ff477a 1329client_verify_callback_called = FALSE;
059ec3d9
PH
1330
1331if (!expand_check(require_ciphers, US"tls_require_ciphers", &expciphers))
1332 return FAIL;
1333
1334/* In OpenSSL, cipher components are separated by hyphens. In GnuTLS, they
1335are separated by underscores. So that I can use either form in my tests, and
1336also for general convenience, we turn underscores into hyphens here. */
1337
1338if (expciphers != NULL)
1339 {
1340 uschar *s = expciphers;
1341 while (*s != 0) { if (*s == '_') *s = '-'; s++; }
1342 DEBUG(D_tls) debug_printf("required ciphers: %s\n", expciphers);
817d9f57 1343 if (!SSL_CTX_set_cipher_list(client_ctx, CS expciphers))
7199e1ee 1344 return tls_error(US"SSL_CTX_set_cipher_list", host, NULL);
059ec3d9
PH
1345 }
1346
a2ff477a 1347rc = setup_certs(client_ctx, verify_certs, crl, host, FALSE, TRUE);
059ec3d9
PH
1348if (rc != OK) return rc;
1349
817d9f57
JH
1350if ((client_ssl = SSL_new(client_ctx)) == NULL) return tls_error(US"SSL_new", host, NULL);
1351SSL_set_session_id_context(client_ssl, sid_ctx, Ustrlen(sid_ctx));
1352SSL_set_fd(client_ssl, fd);
1353SSL_set_connect_state(client_ssl);
059ec3d9 1354
3f0945ff
PP
1355if (sni)
1356 {
817d9f57 1357 if (!expand_check(sni, US"tls_sni", &tls_out.sni))
3f0945ff 1358 return FAIL;
ec4b68e5 1359 if (tls_out.sni == NULL)
2c9a0e86
PP
1360 {
1361 DEBUG(D_tls) debug_printf("Setting TLS SNI forced to fail, not sending\n");
1362 }
ec4b68e5 1363 else if (!Ustrlen(tls_out.sni))
817d9f57 1364 tls_out.sni = NULL;
3f0945ff
PP
1365 else
1366 {
35731706 1367#ifdef EXIM_HAVE_OPENSSL_TLSEXT
817d9f57
JH
1368 DEBUG(D_tls) debug_printf("Setting TLS SNI \"%s\"\n", tls_out.sni);
1369 SSL_set_tlsext_host_name(client_ssl, tls_out.sni);
35731706
PP
1370#else
1371 DEBUG(D_tls)
1372 debug_printf("OpenSSL at build-time lacked SNI support, ignoring \"%s\"\n",
1373 tls_sni);
1374#endif
3f0945ff
PP
1375 }
1376 }
1377
059ec3d9
PH
1378/* There doesn't seem to be a built-in timeout on connection. */
1379
1380DEBUG(D_tls) debug_printf("Calling SSL_connect\n");
1381sigalrm_seen = FALSE;
1382alarm(timeout);
817d9f57 1383rc = SSL_connect(client_ssl);
059ec3d9
PH
1384alarm(0);
1385
1386if (rc <= 0)
7199e1ee 1387 return tls_error(US"SSL_connect", host, sigalrm_seen ? US"timed out" : NULL);
059ec3d9
PH
1388
1389DEBUG(D_tls) debug_printf("SSL_connect succeeded\n");
1390
453a6645 1391/* Beware anonymous ciphers which lead to server_cert being NULL */
817d9f57 1392server_cert = SSL_get_peer_certificate (client_ssl);
453a6645
PP
1393if (server_cert)
1394 {
817d9f57 1395 tls_out.peerdn = US X509_NAME_oneline(X509_get_subject_name(server_cert),
453a6645 1396 CS txt, sizeof(txt));
817d9f57 1397 tls_out.peerdn = txt;
453a6645
PP
1398 }
1399else
817d9f57 1400 tls_out.peerdn = NULL;
059ec3d9 1401
817d9f57
JH
1402construct_cipher_name(client_ssl, cipherbuf, sizeof(cipherbuf), &tls_out.bits);
1403tls_out.cipher = cipherbuf;
059ec3d9 1404
817d9f57 1405tls_out.active = fd;
059ec3d9
PH
1406return OK;
1407}
1408
1409
1410
1411
1412
1413/*************************************************
1414* TLS version of getc *
1415*************************************************/
1416
1417/* This gets the next byte from the TLS input buffer. If the buffer is empty,
1418it refills the buffer via the SSL reading function.
1419
1420Arguments: none
1421Returns: the next character or EOF
817d9f57
JH
1422
1423Only used by the server-side TLS.
059ec3d9
PH
1424*/
1425
1426int
1427tls_getc(void)
1428{
1429if (ssl_xfer_buffer_lwm >= ssl_xfer_buffer_hwm)
1430 {
1431 int error;
1432 int inbytes;
1433
817d9f57 1434 DEBUG(D_tls) debug_printf("Calling SSL_read(%p, %p, %u)\n", server_ssl,
c80c5570 1435 ssl_xfer_buffer, ssl_xfer_buffer_size);
059ec3d9
PH
1436
1437 if (smtp_receive_timeout > 0) alarm(smtp_receive_timeout);
817d9f57
JH
1438 inbytes = SSL_read(server_ssl, CS ssl_xfer_buffer, ssl_xfer_buffer_size);
1439 error = SSL_get_error(server_ssl, inbytes);
059ec3d9
PH
1440 alarm(0);
1441
1442 /* SSL_ERROR_ZERO_RETURN appears to mean that the SSL session has been
1443 closed down, not that the socket itself has been closed down. Revert to
1444 non-SSL handling. */
1445
1446 if (error == SSL_ERROR_ZERO_RETURN)
1447 {
1448 DEBUG(D_tls) debug_printf("Got SSL_ERROR_ZERO_RETURN\n");
1449
1450 receive_getc = smtp_getc;
1451 receive_ungetc = smtp_ungetc;
1452 receive_feof = smtp_feof;
1453 receive_ferror = smtp_ferror;
58eb016e 1454 receive_smtp_buffered = smtp_buffered;
059ec3d9 1455
817d9f57
JH
1456 SSL_free(server_ssl);
1457 server_ssl = NULL;
1458 tls_in.active = -1;
1459 tls_in.bits = 0;
1460 tls_in.cipher = NULL;
1461 tls_in.peerdn = NULL;
1462 tls_in.sni = NULL;
059ec3d9
PH
1463
1464 return smtp_getc();
1465 }
1466
1467 /* Handle genuine errors */
1468
ba084640
PP
1469 else if (error == SSL_ERROR_SSL)
1470 {
1471 ERR_error_string(ERR_get_error(), ssl_errstring);
89dd51cd 1472 log_write(0, LOG_MAIN, "TLS error (SSL_read): %s", ssl_errstring);
ba084640
PP
1473 ssl_xfer_error = 1;
1474 return EOF;
1475 }
1476
059ec3d9
PH
1477 else if (error != SSL_ERROR_NONE)
1478 {
1479 DEBUG(D_tls) debug_printf("Got SSL error %d\n", error);
1480 ssl_xfer_error = 1;
1481 return EOF;
1482 }
c80c5570 1483
80a47a2c
TK
1484#ifndef DISABLE_DKIM
1485 dkim_exim_verify_feed(ssl_xfer_buffer, inbytes);
1486#endif
059ec3d9
PH
1487 ssl_xfer_buffer_hwm = inbytes;
1488 ssl_xfer_buffer_lwm = 0;
1489 }
1490
1491/* Something in the buffer; return next uschar */
1492
1493return ssl_xfer_buffer[ssl_xfer_buffer_lwm++];
1494}
1495
1496
1497
1498/*************************************************
1499* Read bytes from TLS channel *
1500*************************************************/
1501
1502/*
1503Arguments:
1504 buff buffer of data
1505 len size of buffer
1506
1507Returns: the number of bytes read
1508 -1 after a failed read
817d9f57
JH
1509
1510Only used by the client-side TLS.
059ec3d9
PH
1511*/
1512
1513int
389ca47a 1514tls_read(BOOL is_server, uschar *buff, size_t len)
059ec3d9 1515{
389ca47a 1516SSL *ssl = is_server ? server_ssl : client_ssl;
059ec3d9
PH
1517int inbytes;
1518int error;
1519
389ca47a 1520DEBUG(D_tls) debug_printf("Calling SSL_read(%p, %p, %u)\n", ssl,
c80c5570 1521 buff, (unsigned int)len);
059ec3d9 1522
389ca47a
JH
1523inbytes = SSL_read(ssl, CS buff, len);
1524error = SSL_get_error(ssl, inbytes);
059ec3d9
PH
1525
1526if (error == SSL_ERROR_ZERO_RETURN)
1527 {
1528 DEBUG(D_tls) debug_printf("Got SSL_ERROR_ZERO_RETURN\n");
1529 return -1;
1530 }
1531else if (error != SSL_ERROR_NONE)
1532 {
1533 return -1;
1534 }
1535
1536return inbytes;
1537}
1538
1539
1540
1541
1542
1543/*************************************************
1544* Write bytes down TLS channel *
1545*************************************************/
1546
1547/*
1548Arguments:
817d9f57 1549 is_server channel specifier
059ec3d9
PH
1550 buff buffer of data
1551 len number of bytes
1552
1553Returns: the number of bytes after a successful write,
1554 -1 after a failed write
817d9f57
JH
1555
1556Used by both server-side and client-side TLS.
059ec3d9
PH
1557*/
1558
1559int
817d9f57 1560tls_write(BOOL is_server, const uschar *buff, size_t len)
059ec3d9
PH
1561{
1562int outbytes;
1563int error;
1564int left = len;
817d9f57 1565SSL *ssl = is_server ? server_ssl : client_ssl;
059ec3d9 1566
c80c5570 1567DEBUG(D_tls) debug_printf("tls_do_write(%p, %d)\n", buff, left);
059ec3d9
PH
1568while (left > 0)
1569 {
c80c5570 1570 DEBUG(D_tls) debug_printf("SSL_write(SSL, %p, %d)\n", buff, left);
059ec3d9
PH
1571 outbytes = SSL_write(ssl, CS buff, left);
1572 error = SSL_get_error(ssl, outbytes);
1573 DEBUG(D_tls) debug_printf("outbytes=%d error=%d\n", outbytes, error);
1574 switch (error)
1575 {
1576 case SSL_ERROR_SSL:
1577 ERR_error_string(ERR_get_error(), ssl_errstring);
1578 log_write(0, LOG_MAIN, "TLS error (SSL_write): %s", ssl_errstring);
1579 return -1;
1580
1581 case SSL_ERROR_NONE:
1582 left -= outbytes;
1583 buff += outbytes;
1584 break;
1585
1586 case SSL_ERROR_ZERO_RETURN:
1587 log_write(0, LOG_MAIN, "SSL channel closed on write");
1588 return -1;
1589
817d9f57
JH
1590 case SSL_ERROR_SYSCALL:
1591 log_write(0, LOG_MAIN, "SSL_write: (from %s) syscall: %s",
1592 sender_fullhost ? sender_fullhost : US"<unknown>",
1593 strerror(errno));
1594
059ec3d9
PH
1595 default:
1596 log_write(0, LOG_MAIN, "SSL_write error %d", error);
1597 return -1;
1598 }
1599 }
1600return len;
1601}
1602
1603
1604
1605/*************************************************
1606* Close down a TLS session *
1607*************************************************/
1608
1609/* This is also called from within a delivery subprocess forked from the
1610daemon, to shut down the TLS library, without actually doing a shutdown (which
1611would tamper with the SSL session in the parent process).
1612
1613Arguments: TRUE if SSL_shutdown is to be called
1614Returns: nothing
817d9f57
JH
1615
1616Used by both server-side and client-side TLS.
059ec3d9
PH
1617*/
1618
1619void
817d9f57 1620tls_close(BOOL is_server, BOOL shutdown)
059ec3d9 1621{
817d9f57 1622SSL **sslp = is_server ? &server_ssl : &client_ssl;
389ca47a 1623int *fdp = is_server ? &tls_in.active : &tls_out.active;
817d9f57
JH
1624
1625if (*fdp < 0) return; /* TLS was not active */
059ec3d9
PH
1626
1627if (shutdown)
1628 {
1629 DEBUG(D_tls) debug_printf("tls_close(): shutting down SSL\n");
817d9f57 1630 SSL_shutdown(*sslp);
059ec3d9
PH
1631 }
1632
817d9f57
JH
1633SSL_free(*sslp);
1634*sslp = NULL;
059ec3d9 1635
817d9f57 1636*fdp = -1;
059ec3d9
PH
1637}
1638
36f12725
NM
1639
1640
1641
1642/*************************************************
3375e053
PP
1643* Let tls_require_ciphers be checked at startup *
1644*************************************************/
1645
1646/* The tls_require_ciphers option, if set, must be something which the
1647library can parse.
1648
1649Returns: NULL on success, or error message
1650*/
1651
1652uschar *
1653tls_validate_require_cipher(void)
1654{
1655SSL_CTX *ctx;
1656uschar *s, *expciphers, *err;
1657
1658/* this duplicates from tls_init(), we need a better "init just global
1659state, for no specific purpose" singleton function of our own */
1660
1661SSL_load_error_strings();
1662OpenSSL_add_ssl_algorithms();
1663#if (OPENSSL_VERSION_NUMBER >= 0x0090800fL) && !defined(OPENSSL_NO_SHA256)
1664/* SHA256 is becoming ever more popular. This makes sure it gets added to the
1665list of available digests. */
1666EVP_add_digest(EVP_sha256());
1667#endif
1668
1669if (!(tls_require_ciphers && *tls_require_ciphers))
1670 return NULL;
1671
1672if (!expand_check(tls_require_ciphers, US"tls_require_ciphers", &expciphers))
1673 return US"failed to expand tls_require_ciphers";
1674
1675if (!(expciphers && *expciphers))
1676 return NULL;
1677
1678/* normalisation ripped from above */
1679s = expciphers;
1680while (*s != 0) { if (*s == '_') *s = '-'; s++; }
1681
1682err = NULL;
1683
1684ctx = SSL_CTX_new(SSLv23_server_method());
1685if (!ctx)
1686 {
1687 ERR_error_string(ERR_get_error(), ssl_errstring);
1688 return string_sprintf("SSL_CTX_new() failed: %s", ssl_errstring);
1689 }
1690
1691DEBUG(D_tls)
1692 debug_printf("tls_require_ciphers expands to \"%s\"\n", expciphers);
1693
1694if (!SSL_CTX_set_cipher_list(ctx, CS expciphers))
1695 {
1696 ERR_error_string(ERR_get_error(), ssl_errstring);
1697 err = string_sprintf("SSL_CTX_set_cipher_list(%s) failed", expciphers);
1698 }
1699
1700SSL_CTX_free(ctx);
1701
1702return err;
1703}
1704
1705
1706
1707
1708/*************************************************
36f12725
NM
1709* Report the library versions. *
1710*************************************************/
1711
1712/* There have historically been some issues with binary compatibility in
1713OpenSSL libraries; if Exim (like many other applications) is built against
1714one version of OpenSSL but the run-time linker picks up another version,
1715it can result in serious failures, including crashing with a SIGSEGV. So
1716report the version found by the compiler and the run-time version.
1717
1718Arguments: a FILE* to print the results to
1719Returns: nothing
1720*/
1721
1722void
1723tls_version_report(FILE *f)
1724{
754a0503
PP
1725fprintf(f, "Library version: OpenSSL: Compile: %s\n"
1726 " Runtime: %s\n",
1727 OPENSSL_VERSION_TEXT,
1728 SSLeay_version(SSLEAY_VERSION));
36f12725
NM
1729}
1730
9e3331ea
TK
1731
1732
1733
1734/*************************************************
17c76198 1735* Random number generation *
9e3331ea
TK
1736*************************************************/
1737
1738/* Pseudo-random number generation. The result is not expected to be
1739cryptographically strong but not so weak that someone will shoot themselves
1740in the foot using it as a nonce in input in some email header scheme or
1741whatever weirdness they'll twist this into. The result should handle fork()
1742and avoid repeating sequences. OpenSSL handles that for us.
1743
1744Arguments:
1745 max range maximum
1746Returns a random number in range [0, max-1]
1747*/
1748
1749int
17c76198 1750vaguely_random_number(int max)
9e3331ea
TK
1751{
1752unsigned int r;
1753int i, needed_len;
1754uschar *p;
1755uschar smallbuf[sizeof(r)];
1756
1757if (max <= 1)
1758 return 0;
1759
1760/* OpenSSL auto-seeds from /dev/random, etc, but this a double-check. */
1761if (!RAND_status())
1762 {
1763 randstuff r;
1764 gettimeofday(&r.tv, NULL);
1765 r.p = getpid();
1766
1767 RAND_seed((uschar *)(&r), sizeof(r));
1768 }
1769/* We're after pseudo-random, not random; if we still don't have enough data
1770in the internal PRNG then our options are limited. We could sleep and hope
1771for entropy to come along (prayer technique) but if the system is so depleted
1772in the first place then something is likely to just keep taking it. Instead,
1773we'll just take whatever little bit of pseudo-random we can still manage to
1774get. */
1775
1776needed_len = sizeof(r);
1777/* Don't take 8 times more entropy than needed if int is 8 octets and we were
1778asked for a number less than 10. */
1779for (r = max, i = 0; r; ++i)
1780 r >>= 1;
1781i = (i + 7) / 8;
1782if (i < needed_len)
1783 needed_len = i;
1784
1785/* We do not care if crypto-strong */
17c76198
PP
1786i = RAND_pseudo_bytes(smallbuf, needed_len);
1787if (i < 0)
1788 {
1789 DEBUG(D_all)
1790 debug_printf("OpenSSL RAND_pseudo_bytes() not supported by RAND method, using fallback.\n");
1791 return vaguely_random_number_fallback(max);
1792 }
1793
9e3331ea
TK
1794r = 0;
1795for (p = smallbuf; needed_len; --needed_len, ++p)
1796 {
1797 r *= 256;
1798 r += *p;
1799 }
1800
1801/* We don't particularly care about weighted results; if someone wants
1802smooth distribution and cares enough then they should submit a patch then. */
1803return r % max;
1804}
1805
77bb000f
PP
1806
1807
1808
1809/*************************************************
1810* OpenSSL option parse *
1811*************************************************/
1812
1813/* Parse one option for tls_openssl_options_parse below
1814
1815Arguments:
1816 name one option name
1817 value place to store a value for it
1818Returns success or failure in parsing
1819*/
1820
1821struct exim_openssl_option {
1822 uschar *name;
1823 long value;
1824};
1825/* We could use a macro to expand, but we need the ifdef and not all the
1826options document which version they were introduced in. Policylet: include
1827all options unless explicitly for DTLS, let the administrator choose which
1828to apply.
1829
1830This list is current as of:
c80c5570 1831 ==> 1.0.1b <== */
77bb000f
PP
1832static struct exim_openssl_option exim_openssl_options[] = {
1833/* KEEP SORTED ALPHABETICALLY! */
1834#ifdef SSL_OP_ALL
73a46702 1835 { US"all", SSL_OP_ALL },
77bb000f
PP
1836#endif
1837#ifdef SSL_OP_ALLOW_UNSAFE_LEGACY_RENEGOTIATION
73a46702 1838 { US"allow_unsafe_legacy_renegotiation", SSL_OP_ALLOW_UNSAFE_LEGACY_RENEGOTIATION },
77bb000f
PP
1839#endif
1840#ifdef SSL_OP_CIPHER_SERVER_PREFERENCE
73a46702 1841 { US"cipher_server_preference", SSL_OP_CIPHER_SERVER_PREFERENCE },
77bb000f
PP
1842#endif
1843#ifdef SSL_OP_DONT_INSERT_EMPTY_FRAGMENTS
73a46702 1844 { US"dont_insert_empty_fragments", SSL_OP_DONT_INSERT_EMPTY_FRAGMENTS },
77bb000f
PP
1845#endif
1846#ifdef SSL_OP_EPHEMERAL_RSA
73a46702 1847 { US"ephemeral_rsa", SSL_OP_EPHEMERAL_RSA },
77bb000f
PP
1848#endif
1849#ifdef SSL_OP_LEGACY_SERVER_CONNECT
73a46702 1850 { US"legacy_server_connect", SSL_OP_LEGACY_SERVER_CONNECT },
77bb000f
PP
1851#endif
1852#ifdef SSL_OP_MICROSOFT_BIG_SSLV3_BUFFER
73a46702 1853 { US"microsoft_big_sslv3_buffer", SSL_OP_MICROSOFT_BIG_SSLV3_BUFFER },
77bb000f
PP
1854#endif
1855#ifdef SSL_OP_MICROSOFT_SESS_ID_BUG
73a46702 1856 { US"microsoft_sess_id_bug", SSL_OP_MICROSOFT_SESS_ID_BUG },
77bb000f
PP
1857#endif
1858#ifdef SSL_OP_MSIE_SSLV2_RSA_PADDING
73a46702 1859 { US"msie_sslv2_rsa_padding", SSL_OP_MSIE_SSLV2_RSA_PADDING },
77bb000f
PP
1860#endif
1861#ifdef SSL_OP_NETSCAPE_CHALLENGE_BUG
73a46702 1862 { US"netscape_challenge_bug", SSL_OP_NETSCAPE_CHALLENGE_BUG },
77bb000f
PP
1863#endif
1864#ifdef SSL_OP_NETSCAPE_REUSE_CIPHER_CHANGE_BUG
73a46702 1865 { US"netscape_reuse_cipher_change_bug", SSL_OP_NETSCAPE_REUSE_CIPHER_CHANGE_BUG },
77bb000f 1866#endif
c80c5570
PP
1867#ifdef SSL_OP_NO_COMPRESSION
1868 { US"no_compression", SSL_OP_NO_COMPRESSION },
1869#endif
77bb000f 1870#ifdef SSL_OP_NO_SESSION_RESUMPTION_ON_RENEGOTIATION
73a46702 1871 { US"no_session_resumption_on_renegotiation", SSL_OP_NO_SESSION_RESUMPTION_ON_RENEGOTIATION },
77bb000f 1872#endif
c0c7b2da
PP
1873#ifdef SSL_OP_NO_SSLv2
1874 { US"no_sslv2", SSL_OP_NO_SSLv2 },
1875#endif
1876#ifdef SSL_OP_NO_SSLv3
1877 { US"no_sslv3", SSL_OP_NO_SSLv3 },
1878#endif
1879#ifdef SSL_OP_NO_TICKET
1880 { US"no_ticket", SSL_OP_NO_TICKET },
1881#endif
1882#ifdef SSL_OP_NO_TLSv1
1883 { US"no_tlsv1", SSL_OP_NO_TLSv1 },
1884#endif
c80c5570
PP
1885#ifdef SSL_OP_NO_TLSv1_1
1886#if SSL_OP_NO_TLSv1_1 == 0x00000400L
1887 /* Error in chosen value in 1.0.1a; see first item in CHANGES for 1.0.1b */
1888#warning OpenSSL 1.0.1a uses a bad value for SSL_OP_NO_TLSv1_1, ignoring
1889#else
1890 { US"no_tlsv1_1", SSL_OP_NO_TLSv1_1 },
1891#endif
1892#endif
1893#ifdef SSL_OP_NO_TLSv1_2
1894 { US"no_tlsv1_2", SSL_OP_NO_TLSv1_2 },
1895#endif
77bb000f 1896#ifdef SSL_OP_SINGLE_DH_USE
73a46702 1897 { US"single_dh_use", SSL_OP_SINGLE_DH_USE },
77bb000f
PP
1898#endif
1899#ifdef SSL_OP_SINGLE_ECDH_USE
73a46702 1900 { US"single_ecdh_use", SSL_OP_SINGLE_ECDH_USE },
77bb000f
PP
1901#endif
1902#ifdef SSL_OP_SSLEAY_080_CLIENT_DH_BUG
73a46702 1903 { US"ssleay_080_client_dh_bug", SSL_OP_SSLEAY_080_CLIENT_DH_BUG },
77bb000f
PP
1904#endif
1905#ifdef SSL_OP_SSLREF2_REUSE_CERT_TYPE_BUG
73a46702 1906 { US"sslref2_reuse_cert_type_bug", SSL_OP_SSLREF2_REUSE_CERT_TYPE_BUG },
77bb000f
PP
1907#endif
1908#ifdef SSL_OP_TLS_BLOCK_PADDING_BUG
73a46702 1909 { US"tls_block_padding_bug", SSL_OP_TLS_BLOCK_PADDING_BUG },
77bb000f
PP
1910#endif
1911#ifdef SSL_OP_TLS_D5_BUG
73a46702 1912 { US"tls_d5_bug", SSL_OP_TLS_D5_BUG },
77bb000f
PP
1913#endif
1914#ifdef SSL_OP_TLS_ROLLBACK_BUG
73a46702 1915 { US"tls_rollback_bug", SSL_OP_TLS_ROLLBACK_BUG },
77bb000f
PP
1916#endif
1917};
1918static int exim_openssl_options_size =
1919 sizeof(exim_openssl_options)/sizeof(struct exim_openssl_option);
1920
c80c5570 1921
77bb000f
PP
1922static BOOL
1923tls_openssl_one_option_parse(uschar *name, long *value)
1924{
1925int first = 0;
1926int last = exim_openssl_options_size;
1927while (last > first)
1928 {
1929 int middle = (first + last)/2;
1930 int c = Ustrcmp(name, exim_openssl_options[middle].name);
1931 if (c == 0)
1932 {
1933 *value = exim_openssl_options[middle].value;
1934 return TRUE;
1935 }
1936 else if (c > 0)
1937 first = middle + 1;
1938 else
1939 last = middle;
1940 }
1941return FALSE;
1942}
1943
1944
1945
1946
1947/*************************************************
1948* OpenSSL option parsing logic *
1949*************************************************/
1950
1951/* OpenSSL has a number of compatibility options which an administrator might
1952reasonably wish to set. Interpret a list similarly to decode_bits(), so that
1953we look like log_selector.
1954
1955Arguments:
1956 option_spec the administrator-supplied string of options
1957 results ptr to long storage for the options bitmap
1958Returns success or failure
1959*/
1960
1961BOOL
1962tls_openssl_options_parse(uschar *option_spec, long *results)
1963{
1964long result, item;
1965uschar *s, *end;
1966uschar keep_c;
1967BOOL adding, item_parsed;
1968
0e944a0d 1969result = 0L;
b1770b6e 1970/* Prior to 4.80 we or'd in SSL_OP_DONT_INSERT_EMPTY_FRAGMENTS; removed
da3ad30d 1971 * from default because it increases BEAST susceptibility. */
f0f5a555
PP
1972#ifdef SSL_OP_NO_SSLv2
1973result |= SSL_OP_NO_SSLv2;
1974#endif
77bb000f
PP
1975
1976if (option_spec == NULL)
1977 {
1978 *results = result;
1979 return TRUE;
1980 }
1981
1982for (s=option_spec; *s != '\0'; /**/)
1983 {
1984 while (isspace(*s)) ++s;
1985 if (*s == '\0')
1986 break;
1987 if (*s != '+' && *s != '-')
1988 {
1989 DEBUG(D_tls) debug_printf("malformed openssl option setting: "
0e944a0d 1990 "+ or - expected but found \"%s\"\n", s);
77bb000f
PP
1991 return FALSE;
1992 }
1993 adding = *s++ == '+';
1994 for (end = s; (*end != '\0') && !isspace(*end); ++end) /**/ ;
1995 keep_c = *end;
1996 *end = '\0';
1997 item_parsed = tls_openssl_one_option_parse(s, &item);
1998 if (!item_parsed)
1999 {
0e944a0d 2000 DEBUG(D_tls) debug_printf("openssl option setting unrecognised: \"%s\"\n", s);
77bb000f
PP
2001 return FALSE;
2002 }
2003 DEBUG(D_tls) debug_printf("openssl option, %s from %lx: %lx (%s)\n",
2004 adding ? "adding" : "removing", result, item, s);
2005 if (adding)
2006 result |= item;
2007 else
2008 result &= ~item;
2009 *end = keep_c;
2010 s = end;
2011 }
2012
2013*results = result;
2014return TRUE;
2015}
2016
059ec3d9 2017/* End of tls-openssl.c */