Testsuite: fix munging of now-indented date in stdout
[exim.git] / src / src / tls-openssl.c
CommitLineData
059ec3d9
PH
1/*************************************************
2* Exim - an Internet mail transport agent *
3*************************************************/
4
d4e5e70b 5/* Copyright (c) University of Cambridge 1995 - 2017 */
059ec3d9
PH
6/* See the file NOTICE for conditions of use and distribution. */
7
f5d78688
JH
8/* Portions Copyright (c) The OpenSSL Project 1999 */
9
059ec3d9
PH
10/* This module provides the TLS (aka SSL) support for Exim using the OpenSSL
11library. It is #included into the tls.c file when that library is used. The
12code herein is based on a patch that was originally contributed by Steve
13Haslam. It was adapted from stunnel, a GPL program by Michal Trojnara.
14
15No cryptographic code is included in Exim. All this module does is to call
16functions from the OpenSSL library. */
17
18
19/* Heading stuff */
20
21#include <openssl/lhash.h>
22#include <openssl/ssl.h>
23#include <openssl/err.h>
24#include <openssl/rand.h>
10ca4f1c
JH
25#ifndef OPENSSL_NO_ECDH
26# include <openssl/ec.h>
27#endif
f2de3a33 28#ifndef DISABLE_OCSP
e51c7be2 29# include <openssl/ocsp.h>
3f7eeb86 30#endif
85098ee7
JH
31#ifdef EXPERIMENTAL_DANE
32# include <danessl.h>
33#endif
34
3f7eeb86 35
f2de3a33
JH
36#ifndef DISABLE_OCSP
37# define EXIM_OCSP_SKEW_SECONDS (300L)
38# define EXIM_OCSP_MAX_AGE (-1L)
3f7eeb86 39#endif
059ec3d9 40
3bcbbbe2 41#if OPENSSL_VERSION_NUMBER >= 0x0090806fL && !defined(OPENSSL_NO_TLSEXT)
e51c7be2 42# define EXIM_HAVE_OPENSSL_TLSEXT
3bcbbbe2 43#endif
c8dfb21d
JH
44#if OPENSSL_VERSION_NUMBER >= 0x00908000L
45# define EXIM_HAVE_RSA_GENKEY_EX
46#endif
47#if OPENSSL_VERSION_NUMBER >= 0x10100000L
48# define EXIM_HAVE_OCSP_RESP_COUNT
49#else
50# define EXIM_HAVE_EPHEM_RSA_KEX
51# define EXIM_HAVE_RAND_PSEUDO
52#endif
53#if (OPENSSL_VERSION_NUMBER >= 0x0090800fL) && !defined(OPENSSL_NO_SHA256)
54# define EXIM_HAVE_SHA256
55#endif
34e3241d
PP
56
57/*
58 * X509_check_host provides sane certificate hostname checking, but was added
59 * to OpenSSL late, after other projects forked off the code-base. So in
60 * addition to guarding against the base version number, beware that LibreSSL
61 * does not (at this time) support this function.
62 *
63 * If LibreSSL gains a different API, perhaps via libtls, then we'll probably
64 * opt to disentangle and ask a LibreSSL user to provide glue for a third
65 * crypto provider for libtls instead of continuing to tie the OpenSSL glue
66 * into even twistier knots. If LibreSSL gains the same API, we can just
67 * change this guard and punt the issue for a while longer.
68 */
69#ifndef LIBRESSL_VERSION_NUMBER
70# if OPENSSL_VERSION_NUMBER >= 0x010100000L
71# define EXIM_HAVE_OPENSSL_CHECKHOST
72# endif
73# if OPENSSL_VERSION_NUMBER >= 0x010000000L \
2dfb468b 74 && (OPENSSL_VERSION_NUMBER & 0x0000ff000L) >= 0x000002000L
34e3241d
PP
75# define EXIM_HAVE_OPENSSL_CHECKHOST
76# endif
11aa88b0 77#endif
10ca4f1c 78
11aa88b0
RA
79#if !defined(LIBRESSL_VERSION_NUMBER) \
80 || LIBRESSL_VERSION_NUMBER >= 0x20010000L
10ca4f1c
JH
81# if !defined(OPENSSL_NO_ECDH)
82# if OPENSSL_VERSION_NUMBER >= 0x0090800fL
83# define EXIM_HAVE_ECDH
84# endif
85# if OPENSSL_VERSION_NUMBER >= 0x10002000L
10ca4f1c
JH
86# define EXIM_HAVE_OPENSSL_EC_NIST2NID
87# endif
88# endif
2dfb468b 89#endif
3bcbbbe2 90
67791ce4
JH
91#if !defined(EXIM_HAVE_OPENSSL_TLSEXT) && !defined(DISABLE_OCSP)
92# warning "OpenSSL library version too old; define DISABLE_OCSP in Makefile"
93# define DISABLE_OCSP
94#endif
95
059ec3d9
PH
96/* Structure for collecting random data for seeding. */
97
98typedef struct randstuff {
9e3331ea
TK
99 struct timeval tv;
100 pid_t p;
059ec3d9
PH
101} randstuff;
102
103/* Local static variables */
104
a2ff477a
JH
105static BOOL client_verify_callback_called = FALSE;
106static BOOL server_verify_callback_called = FALSE;
059ec3d9
PH
107static const uschar *sid_ctx = US"exim";
108
d4f09789
PP
109/* We have three different contexts to care about.
110
111Simple case: client, `client_ctx`
112 As a client, we can be doing a callout or cut-through delivery while receiving
113 a message. So we have a client context, which should have options initialised
114 from the SMTP Transport.
115
116Server:
117 There are two cases: with and without ServerNameIndication from the client.
118 Given TLS SNI, we can be using different keys, certs and various other
119 configuration settings, because they're re-expanded with $tls_sni set. This
120 allows vhosting with TLS. This SNI is sent in the handshake.
121 A client might not send SNI, so we need a fallback, and an initial setup too.
122 So as a server, we start out using `server_ctx`.
123 If SNI is sent by the client, then we as server, mid-negotiation, try to clone
124 `server_sni` from `server_ctx` and then initialise settings by re-expanding
125 configuration.
126*/
127
817d9f57
JH
128static SSL_CTX *client_ctx = NULL;
129static SSL_CTX *server_ctx = NULL;
130static SSL *client_ssl = NULL;
131static SSL *server_ssl = NULL;
389ca47a 132
35731706 133#ifdef EXIM_HAVE_OPENSSL_TLSEXT
817d9f57 134static SSL_CTX *server_sni = NULL;
35731706 135#endif
059ec3d9
PH
136
137static char ssl_errstring[256];
138
139static int ssl_session_timeout = 200;
a2ff477a
JH
140static BOOL client_verify_optional = FALSE;
141static BOOL server_verify_optional = FALSE;
059ec3d9 142
f5d78688 143static BOOL reexpand_tls_files_for_sni = FALSE;
059ec3d9
PH
144
145
7be682ca
PP
146typedef struct tls_ext_ctx_cb {
147 uschar *certificate;
148 uschar *privatekey;
f2de3a33 149#ifndef DISABLE_OCSP
f5d78688 150 BOOL is_server;
c3033f13 151 STACK_OF(X509) *verify_stack; /* chain for verifying the proof */
f5d78688
JH
152 union {
153 struct {
154 uschar *file;
155 uschar *file_expanded;
156 OCSP_RESPONSE *response;
157 } server;
158 struct {
44662487
JH
159 X509_STORE *verify_store; /* non-null if status requested */
160 BOOL verify_required;
f5d78688
JH
161 } client;
162 } u_ocsp;
3f7eeb86 163#endif
7be682ca
PP
164 uschar *dhparam;
165 /* these are cached from first expand */
166 uschar *server_cipher_list;
167 /* only passed down to tls_error: */
168 host_item *host;
55414b25 169 const uschar * verify_cert_hostnames;
0cbf2b82 170#ifndef DISABLE_EVENT
a7538db1
JH
171 uschar * event_action;
172#endif
7be682ca
PP
173} tls_ext_ctx_cb;
174
175/* should figure out a cleanup of API to handle state preserved per
176implementation, for various reasons, which can be void * in the APIs.
177For now, we hack around it. */
817d9f57
JH
178tls_ext_ctx_cb *client_static_cbinfo = NULL;
179tls_ext_ctx_cb *server_static_cbinfo = NULL;
7be682ca
PP
180
181static int
983207c1
JH
182setup_certs(SSL_CTX *sctx, uschar *certs, uschar *crl, host_item *host, BOOL optional,
183 int (*cert_vfy_cb)(int, X509_STORE_CTX *) );
059ec3d9 184
3f7eeb86 185/* Callbacks */
3bcbbbe2 186#ifdef EXIM_HAVE_OPENSSL_TLSEXT
3f7eeb86 187static int tls_servername_cb(SSL *s, int *ad ARG_UNUSED, void *arg);
3bcbbbe2 188#endif
f2de3a33 189#ifndef DISABLE_OCSP
f5d78688 190static int tls_server_stapling_cb(SSL *s, void *arg);
3f7eeb86
PP
191#endif
192
059ec3d9
PH
193
194/*************************************************
195* Handle TLS error *
196*************************************************/
197
198/* Called from lots of places when errors occur before actually starting to do
199the TLS handshake, that is, while the session is still in clear. Always returns
200DEFER for a server and FAIL for a client so that most calls can use "return
201tls_error(...)" to do this processing and then give an appropriate return. A
202single function is used for both server and client, because it is called from
203some shared functions.
204
205Argument:
206 prefix text to include in the logged error
207 host NULL if setting up a server;
208 the connected host if setting up a client
7199e1ee 209 msg error message or NULL if we should ask OpenSSL
059ec3d9
PH
210
211Returns: OK/DEFER/FAIL
212*/
213
214static int
23bb6982 215tls_error(uschar * prefix, const host_item * host, uschar * msg)
059ec3d9 216{
c562fd30 217if (!msg)
7199e1ee
TF
218 {
219 ERR_error_string(ERR_get_error(), ssl_errstring);
5ca6d115 220 msg = (uschar *)ssl_errstring;
7199e1ee
TF
221 }
222
c562fd30
JH
223if (host)
224 {
225 log_write(0, LOG_MAIN, "H=%s [%s] TLS error on connection (%s): %s",
226 host->name, host->address, prefix, msg);
227 return FAIL;
228 }
229else
059ec3d9 230 {
7199e1ee 231 uschar *conn_info = smtp_get_connection_info();
5ca6d115 232 if (Ustrncmp(conn_info, US"SMTP ", 5) == 0)
7199e1ee 233 conn_info += 5;
c562fd30 234 /* I'd like to get separated H= here, but too hard for now */
7199e1ee
TF
235 log_write(0, LOG_MAIN, "TLS error on %s (%s): %s",
236 conn_info, prefix, msg);
059ec3d9
PH
237 return DEFER;
238 }
059ec3d9
PH
239}
240
241
242
c8dfb21d 243#ifdef EXIM_HAVE_EPHEM_RSA_KEX
059ec3d9
PH
244/*************************************************
245* Callback to generate RSA key *
246*************************************************/
247
248/*
249Arguments:
250 s SSL connection
251 export not used
252 keylength keylength
253
254Returns: pointer to generated key
255*/
256
257static RSA *
258rsa_callback(SSL *s, int export, int keylength)
259{
260RSA *rsa_key;
c8dfb21d
JH
261#ifdef EXIM_HAVE_RSA_GENKEY_EX
262BIGNUM *bn = BN_new();
263#endif
264
059ec3d9
PH
265export = export; /* Shut picky compilers up */
266DEBUG(D_tls) debug_printf("Generating %d bit RSA key...\n", keylength);
c8dfb21d
JH
267
268#ifdef EXIM_HAVE_RSA_GENKEY_EX
269if ( !BN_set_word(bn, (unsigned long)RSA_F4)
f2cb6292 270 || !(rsa_key = RSA_new())
c8dfb21d
JH
271 || !RSA_generate_key_ex(rsa_key, keylength, bn, NULL)
272 )
273#else
23bb6982 274if (!(rsa_key = RSA_generate_key(keylength, RSA_F4, NULL, NULL)))
c8dfb21d
JH
275#endif
276
059ec3d9
PH
277 {
278 ERR_error_string(ERR_get_error(), ssl_errstring);
279 log_write(0, LOG_MAIN|LOG_PANIC, "TLS error (RSA_generate_key): %s",
280 ssl_errstring);
281 return NULL;
282 }
283return rsa_key;
284}
c8dfb21d 285#endif
059ec3d9
PH
286
287
288
f5d78688 289/* Extreme debug
f2de3a33 290#ifndef DISABLE_OCSP
f5d78688
JH
291void
292x509_store_dump_cert_s_names(X509_STORE * store)
293{
294STACK_OF(X509_OBJECT) * roots= store->objs;
295int i;
296static uschar name[256];
297
298for(i= 0; i<sk_X509_OBJECT_num(roots); i++)
299 {
300 X509_OBJECT * tmp_obj= sk_X509_OBJECT_value(roots, i);
301 if(tmp_obj->type == X509_LU_X509)
302 {
303 X509 * current_cert= tmp_obj->data.x509;
304 X509_NAME_oneline(X509_get_subject_name(current_cert), CS name, sizeof(name));
f69979cf 305 name[sizeof(name)-1] = '\0';
f5d78688
JH
306 debug_printf(" %s\n", name);
307 }
308 }
309}
310#endif
311*/
312
059ec3d9 313
0cbf2b82 314#ifndef DISABLE_EVENT
f69979cf
JH
315static int
316verify_event(tls_support * tlsp, X509 * cert, int depth, const uschar * dn,
317 BOOL *calledp, const BOOL *optionalp, const uschar * what)
318{
319uschar * ev;
320uschar * yield;
321X509 * old_cert;
322
323ev = tlsp == &tls_out ? client_static_cbinfo->event_action : event_action;
324if (ev)
325 {
aaba7d03 326 DEBUG(D_tls) debug_printf("verify_event: %s %d\n", what, depth);
f69979cf
JH
327 old_cert = tlsp->peercert;
328 tlsp->peercert = X509_dup(cert);
329 /* NB we do not bother setting peerdn */
330 if ((yield = event_raise(ev, US"tls:cert", string_sprintf("%d", depth))))
331 {
332 log_write(0, LOG_MAIN, "[%s] %s verify denied by event-action: "
333 "depth=%d cert=%s: %s",
334 tlsp == &tls_out ? deliver_host_address : sender_host_address,
335 what, depth, dn, yield);
336 *calledp = TRUE;
337 if (!*optionalp)
338 {
339 if (old_cert) tlsp->peercert = old_cert; /* restore 1st failing cert */
340 return 1; /* reject (leaving peercert set) */
341 }
342 DEBUG(D_tls) debug_printf("Event-action verify failure overridden "
343 "(host in tls_try_verify_hosts)\n");
344 }
345 X509_free(tlsp->peercert);
346 tlsp->peercert = old_cert;
347 }
348return 0;
349}
350#endif
351
059ec3d9
PH
352/*************************************************
353* Callback for verification *
354*************************************************/
355
356/* The SSL library does certificate verification if set up to do so. This
357callback has the current yes/no state is in "state". If verification succeeded,
f69979cf
JH
358we set the certificate-verified flag. If verification failed, what happens
359depends on whether the client is required to present a verifiable certificate
360or not.
059ec3d9
PH
361
362If verification is optional, we change the state to yes, but still log the
363verification error. For some reason (it really would help to have proper
364documentation of OpenSSL), this callback function then gets called again, this
f69979cf
JH
365time with state = 1. We must take care not to set the private verified flag on
366the second time through.
059ec3d9
PH
367
368Note: this function is not called if the client fails to present a certificate
369when asked. We get here only if a certificate has been received. Handling of
370optional verification for this case is done when requesting SSL to verify, by
371setting SSL_VERIFY_FAIL_IF_NO_PEER_CERT in the non-optional case.
372
a7538db1
JH
373May be called multiple times for different issues with a certificate, even
374for a given "depth" in the certificate chain.
375
059ec3d9 376Arguments:
f2f2c91b
JH
377 preverify_ok current yes/no state as 1/0
378 x509ctx certificate information.
379 tlsp per-direction (client vs. server) support data
380 calledp has-been-called flag
381 optionalp verification-is-optional flag
059ec3d9 382
f2f2c91b 383Returns: 0 if verification should fail, otherwise 1
059ec3d9
PH
384*/
385
386static int
f2f2c91b 387verify_callback(int preverify_ok, X509_STORE_CTX *x509ctx,
421aff85 388 tls_support *tlsp, BOOL *calledp, BOOL *optionalp)
059ec3d9 389{
421aff85 390X509 * cert = X509_STORE_CTX_get_current_cert(x509ctx);
a7538db1 391int depth = X509_STORE_CTX_get_error_depth(x509ctx);
f69979cf 392uschar dn[256];
059ec3d9 393
f69979cf
JH
394X509_NAME_oneline(X509_get_subject_name(cert), CS dn, sizeof(dn));
395dn[sizeof(dn)-1] = '\0';
059ec3d9 396
f2f2c91b 397if (preverify_ok == 0)
059ec3d9 398 {
4c01d6ab
JH
399 log_write(0, LOG_MAIN, "[%s] SSL verify error: depth=%d error=%s cert=%s",
400 tlsp == &tls_out ? deliver_host_address : sender_host_address,
a7538db1 401 depth,
421aff85 402 X509_verify_cert_error_string(X509_STORE_CTX_get_error(x509ctx)),
f69979cf 403 dn);
a2ff477a 404 *calledp = TRUE;
9d1c15ef
JH
405 if (!*optionalp)
406 {
f69979cf
JH
407 if (!tlsp->peercert)
408 tlsp->peercert = X509_dup(cert); /* record failing cert */
409 return 0; /* reject */
9d1c15ef 410 }
059ec3d9
PH
411 DEBUG(D_tls) debug_printf("SSL verify failure overridden (host in "
412 "tls_try_verify_hosts)\n");
059ec3d9
PH
413 }
414
a7538db1 415else if (depth != 0)
059ec3d9 416 {
f69979cf 417 DEBUG(D_tls) debug_printf("SSL verify ok: depth=%d SN=%s\n", depth, dn);
f2de3a33 418#ifndef DISABLE_OCSP
f5d78688
JH
419 if (tlsp == &tls_out && client_static_cbinfo->u_ocsp.client.verify_store)
420 { /* client, wanting stapling */
421 /* Add the server cert's signing chain as the one
422 for the verification of the OCSP stapled information. */
94431adb 423
f5d78688 424 if (!X509_STORE_add_cert(client_static_cbinfo->u_ocsp.client.verify_store,
421aff85 425 cert))
f5d78688 426 ERR_clear_error();
c3033f13 427 sk_X509_push(client_static_cbinfo->verify_stack, cert);
f5d78688
JH
428 }
429#endif
0cbf2b82 430#ifndef DISABLE_EVENT
f69979cf
JH
431 if (verify_event(tlsp, cert, depth, dn, calledp, optionalp, US"SSL"))
432 return 0; /* reject, with peercert set */
a7538db1 433#endif
059ec3d9
PH
434 }
435else
436 {
55414b25 437 const uschar * verify_cert_hostnames;
e51c7be2 438
e51c7be2
JH
439 if ( tlsp == &tls_out
440 && ((verify_cert_hostnames = client_static_cbinfo->verify_cert_hostnames)))
441 /* client, wanting hostname check */
e51c7be2 442 {
f69979cf 443
740f36d4 444#ifdef EXIM_HAVE_OPENSSL_CHECKHOST
f69979cf
JH
445# ifndef X509_CHECK_FLAG_NO_PARTIAL_WILDCARDS
446# define X509_CHECK_FLAG_NO_PARTIAL_WILDCARDS 0
447# endif
448# ifndef X509_CHECK_FLAG_SINGLE_LABEL_SUBDOMAINS
449# define X509_CHECK_FLAG_SINGLE_LABEL_SUBDOMAINS 0
450# endif
e51c7be2 451 int sep = 0;
55414b25 452 const uschar * list = verify_cert_hostnames;
e51c7be2 453 uschar * name;
d8e7834a
JH
454 int rc;
455 while ((name = string_nextinlist(&list, &sep, NULL, 0)))
f40d5be3 456 if ((rc = X509_check_host(cert, CCS name, 0,
8d692470 457 X509_CHECK_FLAG_NO_PARTIAL_WILDCARDS
740f36d4
JH
458 | X509_CHECK_FLAG_SINGLE_LABEL_SUBDOMAINS,
459 NULL)))
d8e7834a
JH
460 {
461 if (rc < 0)
462 {
93a6fce2 463 log_write(0, LOG_MAIN, "[%s] SSL verify error: internal error",
8cfd0f7b 464 deliver_host_address);
d8e7834a
JH
465 name = NULL;
466 }
e51c7be2 467 break;
d8e7834a 468 }
e51c7be2 469 if (!name)
f69979cf 470#else
e51c7be2 471 if (!tls_is_name_for_cert(verify_cert_hostnames, cert))
f69979cf 472#endif
e51c7be2
JH
473 {
474 log_write(0, LOG_MAIN,
b999c483
JH
475 "[%s] SSL verify error: certificate name mismatch: "
476 "DN=\"%s\" H=\"%s\"",
477 deliver_host_address, dn, verify_cert_hostnames);
a3ef7310
JH
478 *calledp = TRUE;
479 if (!*optionalp)
f69979cf
JH
480 {
481 if (!tlsp->peercert)
482 tlsp->peercert = X509_dup(cert); /* record failing cert */
483 return 0; /* reject */
484 }
a3ef7310
JH
485 DEBUG(D_tls) debug_printf("SSL verify failure overridden (host in "
486 "tls_try_verify_hosts)\n");
e51c7be2 487 }
f69979cf 488 }
e51c7be2 489
0cbf2b82 490#ifndef DISABLE_EVENT
f69979cf
JH
491 if (verify_event(tlsp, cert, depth, dn, calledp, optionalp, US"SSL"))
492 return 0; /* reject, with peercert set */
e51c7be2
JH
493#endif
494
93dcb1c2 495 DEBUG(D_tls) debug_printf("SSL%s verify ok: depth=0 SN=%s\n",
f69979cf 496 *calledp ? "" : " authenticated", dn);
93dcb1c2
JH
497 if (!*calledp) tlsp->certificate_verified = TRUE;
498 *calledp = TRUE;
059ec3d9
PH
499 }
500
a7538db1 501return 1; /* accept, at least for this level */
059ec3d9
PH
502}
503
a2ff477a 504static int
f2f2c91b 505verify_callback_client(int preverify_ok, X509_STORE_CTX *x509ctx)
a2ff477a 506{
f2f2c91b
JH
507return verify_callback(preverify_ok, x509ctx, &tls_out,
508 &client_verify_callback_called, &client_verify_optional);
a2ff477a
JH
509}
510
511static int
f2f2c91b 512verify_callback_server(int preverify_ok, X509_STORE_CTX *x509ctx)
a2ff477a 513{
f2f2c91b
JH
514return verify_callback(preverify_ok, x509ctx, &tls_in,
515 &server_verify_callback_called, &server_verify_optional);
a2ff477a
JH
516}
517
059ec3d9 518
e5cccda9 519#ifdef EXPERIMENTAL_DANE
53a7196b 520
e5cccda9
JH
521/* This gets called *by* the dane library verify callback, which interposes
522itself.
523*/
524static int
f2f2c91b 525verify_callback_client_dane(int preverify_ok, X509_STORE_CTX * x509ctx)
e5cccda9
JH
526{
527X509 * cert = X509_STORE_CTX_get_current_cert(x509ctx);
f69979cf 528uschar dn[256];
83b27293 529int depth = X509_STORE_CTX_get_error_depth(x509ctx);
5c75db2e 530#ifndef DISABLE_EVENT
f69979cf 531BOOL dummy_called, optional = FALSE;
83b27293 532#endif
e5cccda9 533
f69979cf
JH
534X509_NAME_oneline(X509_get_subject_name(cert), CS dn, sizeof(dn));
535dn[sizeof(dn)-1] = '\0';
e5cccda9 536
f2f2c91b
JH
537DEBUG(D_tls) debug_printf("verify_callback_client_dane: %s depth %d %s\n",
538 preverify_ok ? "ok":"BAD", depth, dn);
e5cccda9 539
0cbf2b82 540#ifndef DISABLE_EVENT
f69979cf
JH
541 if (verify_event(&tls_out, cert, depth, dn,
542 &dummy_called, &optional, US"DANE"))
543 return 0; /* reject, with peercert set */
83b27293
JH
544#endif
545
f2f2c91b 546if (preverify_ok == 1)
53a7196b 547 tls_out.dane_verified =
e5cccda9 548 tls_out.certificate_verified = TRUE;
f2f2c91b
JH
549else
550 {
551 int err = X509_STORE_CTX_get_error(x509ctx);
552 DEBUG(D_tls)
553 debug_printf(" - err %d '%s'\n", err, X509_verify_cert_error_string(err));
3c51463e 554 if (err == X509_V_ERR_APPLICATION_VERIFICATION)
f2f2c91b
JH
555 preverify_ok = 1;
556 }
557return preverify_ok;
e5cccda9 558}
53a7196b
JH
559
560#endif /*EXPERIMENTAL_DANE*/
e5cccda9 561
059ec3d9
PH
562
563/*************************************************
564* Information callback *
565*************************************************/
566
567/* The SSL library functions call this from time to time to indicate what they
7be682ca
PP
568are doing. We copy the string to the debugging output when TLS debugging has
569been requested.
059ec3d9
PH
570
571Arguments:
572 s the SSL connection
573 where
574 ret
575
576Returns: nothing
577*/
578
579static void
580info_callback(SSL *s, int where, int ret)
581{
582where = where;
583ret = ret;
584DEBUG(D_tls) debug_printf("SSL info: %s\n", SSL_state_string_long(s));
585}
586
587
588
589/*************************************************
590* Initialize for DH *
591*************************************************/
592
593/* If dhparam is set, expand it, and load up the parameters for DH encryption.
594
595Arguments:
038597d2 596 sctx The current SSL CTX (inbound or outbound)
a799883d 597 dhparam DH parameter file or fixed parameter identity string
7199e1ee 598 host connected host, if client; NULL if server
059ec3d9
PH
599
600Returns: TRUE if OK (nothing to set up, or setup worked)
601*/
602
603static BOOL
b8b1b5cb 604init_dh(SSL_CTX *sctx, uschar *dhparam, const host_item *host)
059ec3d9 605{
059ec3d9
PH
606BIO *bio;
607DH *dh;
608uschar *dhexpanded;
a799883d 609const char *pem;
059ec3d9
PH
610
611if (!expand_check(dhparam, US"tls_dhparam", &dhexpanded))
612 return FALSE;
613
0df4ab80 614if (!dhexpanded || !*dhexpanded)
a799883d 615 bio = BIO_new_mem_buf(CS std_dh_prime_default(), -1);
a799883d 616else if (dhexpanded[0] == '/')
059ec3d9 617 {
0df4ab80 618 if (!(bio = BIO_new_file(CS dhexpanded, "r")))
059ec3d9 619 {
7199e1ee 620 tls_error(string_sprintf("could not read dhparams file %s", dhexpanded),
a799883d
PP
621 host, US strerror(errno));
622 return FALSE;
059ec3d9 623 }
a799883d
PP
624 }
625else
626 {
627 if (Ustrcmp(dhexpanded, "none") == 0)
059ec3d9 628 {
a799883d
PP
629 DEBUG(D_tls) debug_printf("Requested no DH parameters.\n");
630 return TRUE;
059ec3d9 631 }
a799883d 632
0df4ab80 633 if (!(pem = std_dh_prime_named(dhexpanded)))
a799883d
PP
634 {
635 tls_error(string_sprintf("Unknown standard DH prime \"%s\"", dhexpanded),
636 host, US strerror(errno));
637 return FALSE;
638 }
639 bio = BIO_new_mem_buf(CS pem, -1);
640 }
641
0df4ab80 642if (!(dh = PEM_read_bio_DHparams(bio, NULL, NULL, NULL)))
a799883d 643 {
059ec3d9 644 BIO_free(bio);
a799883d
PP
645 tls_error(string_sprintf("Could not read tls_dhparams \"%s\"", dhexpanded),
646 host, NULL);
647 return FALSE;
648 }
649
650/* Even if it is larger, we silently return success rather than cause things
651 * to fail out, so that a too-large DH will not knock out all TLS; it's a
652 * debatable choice. */
653if ((8*DH_size(dh)) > tls_dh_max_bits)
654 {
655 DEBUG(D_tls)
656 debug_printf("dhparams file %d bits, is > tls_dh_max_bits limit of %d",
657 8*DH_size(dh), tls_dh_max_bits);
658 }
659else
660 {
661 SSL_CTX_set_tmp_dh(sctx, dh);
662 DEBUG(D_tls)
663 debug_printf("Diffie-Hellman initialized from %s with %d-bit prime\n",
664 dhexpanded ? dhexpanded : US"default", 8*DH_size(dh));
059ec3d9
PH
665 }
666
a799883d
PP
667DH_free(dh);
668BIO_free(bio);
669
670return TRUE;
059ec3d9
PH
671}
672
673
674
675
038597d2
PP
676/*************************************************
677* Initialize for ECDH *
678*************************************************/
679
680/* Load parameters for ECDH encryption.
681
682For now, we stick to NIST P-256 because: it's simple and easy to configure;
683it avoids any patent issues that might bite redistributors; despite events in
684the news and concerns over curve choices, we're not cryptographers, we're not
685pretending to be, and this is "good enough" to be better than no support,
686protecting against most adversaries. Given another year or two, there might
687be sufficient clarity about a "right" way forward to let us make an informed
688decision, instead of a knee-jerk reaction.
689
690Longer-term, we should look at supporting both various named curves and
691external files generated with "openssl ecparam", much as we do for init_dh().
692We should also support "none" as a value, to explicitly avoid initialisation.
693
694Patches welcome.
695
696Arguments:
697 sctx The current SSL CTX (inbound or outbound)
698 host connected host, if client; NULL if server
699
700Returns: TRUE if OK (nothing to set up, or setup worked)
701*/
702
703static BOOL
10ca4f1c 704init_ecdh(SSL_CTX * sctx, host_item * host)
038597d2 705{
63f0dbe0
JH
706#ifdef OPENSSL_NO_ECDH
707return TRUE;
708#else
709
10ca4f1c
JH
710EC_KEY * ecdh;
711uschar * exp_curve;
712int nid;
713BOOL rv;
714
038597d2
PP
715if (host) /* No ECDH setup for clients, only for servers */
716 return TRUE;
717
10ca4f1c 718# ifndef EXIM_HAVE_ECDH
038597d2
PP
719DEBUG(D_tls)
720 debug_printf("No OpenSSL API to define ECDH parameters, skipping\n");
721return TRUE;
038597d2 722# else
10ca4f1c
JH
723
724if (!expand_check(tls_eccurve, US"tls_eccurve", &exp_curve))
725 return FALSE;
726if (!exp_curve || !*exp_curve)
727 return TRUE;
728
8e53a4fc 729/* "auto" needs to be handled carefully.
4c04137d 730 * OpenSSL < 1.0.2: we do not select anything, but fallback to prime256v1
8e53a4fc 731 * OpenSSL < 1.1.0: we have to call SSL_CTX_set_ecdh_auto
4c04137d 732 * (openssl/ssl.h defines SSL_CTRL_SET_ECDH_AUTO)
8e53a4fc
HSHR
733 * OpenSSL >= 1.1.0: we do not set anything, the libray does autoselection
734 * https://github.com/openssl/openssl/commit/fe6ef2472db933f01b59cad82aa925736935984b
735 */
10ca4f1c 736if (Ustrcmp(exp_curve, "auto") == 0)
038597d2 737 {
8e53a4fc 738#if OPENSSL_VERSION_NUMBER < 0x10002000L
10ca4f1c 739 DEBUG(D_tls) debug_printf(
8e53a4fc
HSHR
740 "ECDH OpenSSL < 1.0.2: temp key parameter settings: overriding \"auto\" with \"prime256v1\"\n");
741 exp_curve = "prime256v1";
742#else
743# if defined SSL_CTRL_SET_ECDH_AUTO
744 DEBUG(D_tls) debug_printf(
745 "ECDH OpenSSL 1.0.2+ temp key parameter settings: autoselection\n");
10ca4f1c
JH
746 SSL_CTX_set_ecdh_auto(sctx, 1);
747 return TRUE;
8e53a4fc
HSHR
748# else
749 DEBUG(D_tls) debug_printf(
750 "ECDH OpenSSL 1.1.0+ temp key parameter settings: default selection\n");
751 return TRUE;
752# endif
753#endif
10ca4f1c 754 }
038597d2 755
10ca4f1c
JH
756DEBUG(D_tls) debug_printf("ECDH: curve '%s'\n", exp_curve);
757if ( (nid = OBJ_sn2nid (CCS exp_curve)) == NID_undef
758# ifdef EXIM_HAVE_OPENSSL_EC_NIST2NID
759 && (nid = EC_curve_nist2nid(CCS exp_curve)) == NID_undef
760# endif
761 )
762 {
763 tls_error(string_sprintf("Unknown curve name tls_eccurve '%s'",
764 exp_curve),
765 host, NULL);
766 return FALSE;
767 }
038597d2 768
10ca4f1c
JH
769if (!(ecdh = EC_KEY_new_by_curve_name(nid)))
770 {
aa7751be 771 tls_error(US"Unable to create ec curve", host, NULL);
10ca4f1c 772 return FALSE;
038597d2 773 }
10ca4f1c
JH
774
775/* The "tmp" in the name here refers to setting a temporary key
776not to the stability of the interface. */
777
778if ((rv = SSL_CTX_set_tmp_ecdh(sctx, ecdh) == 0))
779 tls_error(string_sprintf("Error enabling '%s' curve", exp_curve), host, NULL);
780else
781 DEBUG(D_tls) debug_printf("ECDH: enabled '%s' curve\n", exp_curve);
782
783EC_KEY_free(ecdh);
784return !rv;
785
786# endif /*EXIM_HAVE_ECDH*/
787#endif /*OPENSSL_NO_ECDH*/
038597d2
PP
788}
789
790
791
792
f2de3a33 793#ifndef DISABLE_OCSP
3f7eeb86
PP
794/*************************************************
795* Load OCSP information into state *
796*************************************************/
f5d78688 797/* Called to load the server OCSP response from the given file into memory, once
3f7eeb86
PP
798caller has determined this is needed. Checks validity. Debugs a message
799if invalid.
800
801ASSUMES: single response, for single cert.
802
803Arguments:
804 sctx the SSL_CTX* to update
805 cbinfo various parts of session state
806 expanded the filename putatively holding an OCSP response
807
808*/
809
810static void
f5d78688 811ocsp_load_response(SSL_CTX *sctx, tls_ext_ctx_cb *cbinfo, const uschar *expanded)
3f7eeb86 812{
ee5b1e28
JH
813BIO * bio;
814OCSP_RESPONSE * resp;
815OCSP_BASICRESP * basic_response;
816OCSP_SINGLERESP * single_response;
817ASN1_GENERALIZEDTIME * rev, * thisupd, * nextupd;
ee5b1e28 818STACK_OF(X509) * sk;
3f7eeb86
PP
819unsigned long verify_flags;
820int status, reason, i;
821
f5d78688
JH
822cbinfo->u_ocsp.server.file_expanded = string_copy(expanded);
823if (cbinfo->u_ocsp.server.response)
3f7eeb86 824 {
f5d78688
JH
825 OCSP_RESPONSE_free(cbinfo->u_ocsp.server.response);
826 cbinfo->u_ocsp.server.response = NULL;
3f7eeb86
PP
827 }
828
ee5b1e28 829if (!(bio = BIO_new_file(CS cbinfo->u_ocsp.server.file_expanded, "rb")))
3f7eeb86
PP
830 {
831 DEBUG(D_tls) debug_printf("Failed to open OCSP response file \"%s\"\n",
f5d78688 832 cbinfo->u_ocsp.server.file_expanded);
3f7eeb86
PP
833 return;
834 }
835
836resp = d2i_OCSP_RESPONSE_bio(bio, NULL);
837BIO_free(bio);
838if (!resp)
839 {
840 DEBUG(D_tls) debug_printf("Error reading OCSP response.\n");
841 return;
842 }
843
ee5b1e28 844if ((status = OCSP_response_status(resp)) != OCSP_RESPONSE_STATUS_SUCCESSFUL)
3f7eeb86
PP
845 {
846 DEBUG(D_tls) debug_printf("OCSP response not valid: %s (%d)\n",
847 OCSP_response_status_str(status), status);
f5d78688 848 goto bad;
3f7eeb86
PP
849 }
850
ee5b1e28 851if (!(basic_response = OCSP_response_get1_basic(resp)))
3f7eeb86
PP
852 {
853 DEBUG(D_tls)
854 debug_printf("OCSP response parse error: unable to extract basic response.\n");
f5d78688 855 goto bad;
3f7eeb86
PP
856 }
857
c3033f13 858sk = cbinfo->verify_stack;
3f7eeb86
PP
859verify_flags = OCSP_NOVERIFY; /* check sigs, but not purpose */
860
861/* May need to expose ability to adjust those flags?
862OCSP_NOSIGS OCSP_NOVERIFY OCSP_NOCHAIN OCSP_NOCHECKS OCSP_NOEXPLICIT
863OCSP_TRUSTOTHER OCSP_NOINTERN */
864
4c04137d 865/* This does a full verify on the OCSP proof before we load it for serving
ee5b1e28
JH
866up; possibly overkill - just date-checks might be nice enough.
867
868OCSP_basic_verify takes a "store" arg, but does not
869use it for the chain verification, which is all we do
870when OCSP_NOVERIFY is set. The content from the wire
871"basic_response" and a cert-stack "sk" are all that is used.
872
c3033f13
JH
873We have a stack, loaded in setup_certs() if tls_verify_certificates
874was a file (not a directory, or "system"). It is unfortunate we
875cannot used the connection context store, as that would neatly
876handle the "system" case too, but there seems to be no library
877function for getting a stack from a store.
e3555426 878[ In OpenSSL 1.1 - ? X509_STORE_CTX_get0_chain(ctx) ? ]
c3033f13
JH
879We do not free the stack since it could be needed a second time for
880SNI handling.
881
4c04137d 882Separately we might try to replace using OCSP_basic_verify() - which seems to not
ee5b1e28
JH
883be a public interface into the OpenSSL library (there's no manual entry) -
884But what with? We also use OCSP_basic_verify in the client stapling callback.
4c04137d 885And there we NEED it; we must verify that status... unless the
ee5b1e28
JH
886library does it for us anyway? */
887
888if ((i = OCSP_basic_verify(basic_response, sk, NULL, verify_flags)) < 0)
3f7eeb86 889 {
ee5b1e28
JH
890 DEBUG(D_tls)
891 {
3f7eeb86
PP
892 ERR_error_string(ERR_get_error(), ssl_errstring);
893 debug_printf("OCSP response verify failure: %s\n", US ssl_errstring);
f5d78688
JH
894 }
895 goto bad;
3f7eeb86
PP
896 }
897
898/* Here's the simplifying assumption: there's only one response, for the
899one certificate we use, and nothing for anything else in a chain. If this
900proves false, we need to extract a cert id from our issued cert
901(tls_certificate) and use that for OCSP_resp_find_status() (which finds the
902right cert in the stack and then calls OCSP_single_get0_status()).
903
904I'm hoping to avoid reworking a bunch more of how we handle state here. */
ee5b1e28
JH
905
906if (!(single_response = OCSP_resp_get0(basic_response, 0)))
3f7eeb86
PP
907 {
908 DEBUG(D_tls)
909 debug_printf("Unable to get first response from OCSP basic response.\n");
f5d78688 910 goto bad;
3f7eeb86
PP
911 }
912
913status = OCSP_single_get0_status(single_response, &reason, &rev, &thisupd, &nextupd);
f5d78688 914if (status != V_OCSP_CERTSTATUS_GOOD)
3f7eeb86 915 {
f5d78688
JH
916 DEBUG(D_tls) debug_printf("OCSP response bad cert status: %s (%d) %s (%d)\n",
917 OCSP_cert_status_str(status), status,
918 OCSP_crl_reason_str(reason), reason);
919 goto bad;
3f7eeb86
PP
920 }
921
922if (!OCSP_check_validity(thisupd, nextupd, EXIM_OCSP_SKEW_SECONDS, EXIM_OCSP_MAX_AGE))
923 {
924 DEBUG(D_tls) debug_printf("OCSP status invalid times.\n");
f5d78688 925 goto bad;
3f7eeb86
PP
926 }
927
f5d78688 928supply_response:
018058b2 929 cbinfo->u_ocsp.server.response = resp;
f5d78688
JH
930return;
931
932bad:
018058b2
JH
933 if (running_in_test_harness)
934 {
935 extern char ** environ;
936 uschar ** p;
bc3c7bb7 937 if (environ) for (p = USS environ; *p != NULL; p++)
018058b2
JH
938 if (Ustrncmp(*p, "EXIM_TESTHARNESS_DISABLE_OCSPVALIDITYCHECK", 42) == 0)
939 {
940 DEBUG(D_tls) debug_printf("Supplying known bad OCSP response\n");
941 goto supply_response;
942 }
943 }
f5d78688 944return;
3f7eeb86 945}
f2de3a33 946#endif /*!DISABLE_OCSP*/
3f7eeb86
PP
947
948
949
950
23bb6982
JH
951/* Create and install a selfsigned certificate, for use in server mode */
952
953static int
954tls_install_selfsign(SSL_CTX * sctx)
955{
956X509 * x509 = NULL;
957EVP_PKEY * pkey;
958RSA * rsa;
959X509_NAME * name;
960uschar * where;
961
962where = US"allocating pkey";
963if (!(pkey = EVP_PKEY_new()))
964 goto err;
965
966where = US"allocating cert";
967if (!(x509 = X509_new()))
968 goto err;
969
970where = US"generating pkey";
971 /* deprecated, use RSA_generate_key_ex() */
972if (!(rsa = RSA_generate_key(1024, RSA_F4, NULL, NULL)))
973 goto err;
974
4c04137d 975where = US"assigning pkey";
23bb6982
JH
976if (!EVP_PKEY_assign_RSA(pkey, rsa))
977 goto err;
978
979X509_set_version(x509, 2); /* N+1 - version 3 */
980ASN1_INTEGER_set(X509_get_serialNumber(x509), 0);
981X509_gmtime_adj(X509_get_notBefore(x509), 0);
982X509_gmtime_adj(X509_get_notAfter(x509), (long)60 * 60); /* 1 hour */
983X509_set_pubkey(x509, pkey);
984
985name = X509_get_subject_name(x509);
986X509_NAME_add_entry_by_txt(name, "C",
4dc2379a 987 MBSTRING_ASC, CUS "UK", -1, -1, 0);
23bb6982 988X509_NAME_add_entry_by_txt(name, "O",
4dc2379a 989 MBSTRING_ASC, CUS "Exim Developers", -1, -1, 0);
23bb6982 990X509_NAME_add_entry_by_txt(name, "CN",
4dc2379a 991 MBSTRING_ASC, CUS smtp_active_hostname, -1, -1, 0);
23bb6982
JH
992X509_set_issuer_name(x509, name);
993
994where = US"signing cert";
995if (!X509_sign(x509, pkey, EVP_md5()))
996 goto err;
997
998where = US"installing selfsign cert";
999if (!SSL_CTX_use_certificate(sctx, x509))
1000 goto err;
1001
1002where = US"installing selfsign key";
1003if (!SSL_CTX_use_PrivateKey(sctx, pkey))
1004 goto err;
1005
1006return OK;
1007
1008err:
1009 (void) tls_error(where, NULL, NULL);
1010 if (x509) X509_free(x509);
1011 if (pkey) EVP_PKEY_free(pkey);
1012 return DEFER;
1013}
1014
1015
1016
1017
059ec3d9 1018/*************************************************
7be682ca
PP
1019* Expand key and cert file specs *
1020*************************************************/
1021
f5d78688 1022/* Called once during tls_init and possibly again during TLS setup, for a
7be682ca
PP
1023new context, if Server Name Indication was used and tls_sni was seen in
1024the certificate string.
1025
1026Arguments:
1027 sctx the SSL_CTX* to update
1028 cbinfo various parts of session state
1029
1030Returns: OK/DEFER/FAIL
1031*/
1032
1033static int
3f7eeb86 1034tls_expand_session_files(SSL_CTX *sctx, tls_ext_ctx_cb *cbinfo)
7be682ca
PP
1035{
1036uschar *expanded;
1037
23bb6982 1038if (!cbinfo->certificate)
7be682ca 1039 {
23bb6982
JH
1040 if (cbinfo->host) /* client */
1041 return OK;
1042 /* server */
1043 if (tls_install_selfsign(sctx) != OK)
1044 return DEFER;
7be682ca 1045 }
23bb6982
JH
1046else
1047 {
1048 if (Ustrstr(cbinfo->certificate, US"tls_sni") ||
1049 Ustrstr(cbinfo->certificate, US"tls_in_sni") ||
1050 Ustrstr(cbinfo->certificate, US"tls_out_sni")
1051 )
1052 reexpand_tls_files_for_sni = TRUE;
7be682ca 1053
23bb6982
JH
1054 if (!expand_check(cbinfo->certificate, US"tls_certificate", &expanded))
1055 return DEFER;
1056
1057 if (expanded != NULL)
1058 {
1059 DEBUG(D_tls) debug_printf("tls_certificate file %s\n", expanded);
1060 if (!SSL_CTX_use_certificate_chain_file(sctx, CS expanded))
1061 return tls_error(string_sprintf(
1062 "SSL_CTX_use_certificate_chain_file file=%s", expanded),
1063 cbinfo->host, NULL);
1064 }
7be682ca 1065
23bb6982
JH
1066 if (cbinfo->privatekey != NULL &&
1067 !expand_check(cbinfo->privatekey, US"tls_privatekey", &expanded))
1068 return DEFER;
7be682ca 1069
23bb6982
JH
1070 /* If expansion was forced to fail, key_expanded will be NULL. If the result
1071 of the expansion is an empty string, ignore it also, and assume the private
1072 key is in the same file as the certificate. */
1073
1074 if (expanded && *expanded)
1075 {
1076 DEBUG(D_tls) debug_printf("tls_privatekey file %s\n", expanded);
1077 if (!SSL_CTX_use_PrivateKey_file(sctx, CS expanded, SSL_FILETYPE_PEM))
1078 return tls_error(string_sprintf(
1079 "SSL_CTX_use_PrivateKey_file file=%s", expanded), cbinfo->host, NULL);
1080 }
7be682ca
PP
1081 }
1082
f2de3a33 1083#ifndef DISABLE_OCSP
f40d5be3 1084if (cbinfo->is_server && cbinfo->u_ocsp.server.file)
3f7eeb86 1085 {
f5d78688 1086 if (!expand_check(cbinfo->u_ocsp.server.file, US"tls_ocsp_file", &expanded))
3f7eeb86
PP
1087 return DEFER;
1088
f40d5be3 1089 if (expanded && *expanded)
3f7eeb86
PP
1090 {
1091 DEBUG(D_tls) debug_printf("tls_ocsp_file %s\n", expanded);
f40d5be3
JH
1092 if ( cbinfo->u_ocsp.server.file_expanded
1093 && (Ustrcmp(expanded, cbinfo->u_ocsp.server.file_expanded) == 0))
3f7eeb86 1094 {
f40d5be3
JH
1095 DEBUG(D_tls) debug_printf(" - value unchanged, using existing values\n");
1096 }
1097 else
f40d5be3 1098 ocsp_load_response(sctx, cbinfo, expanded);
3f7eeb86
PP
1099 }
1100 }
1101#endif
1102
7be682ca
PP
1103return OK;
1104}
1105
1106
1107
1108
1109/*************************************************
1110* Callback to handle SNI *
1111*************************************************/
1112
1113/* Called when acting as server during the TLS session setup if a Server Name
1114Indication extension was sent by the client.
1115
1116API documentation is OpenSSL s_server.c implementation.
1117
1118Arguments:
1119 s SSL* of the current session
1120 ad unknown (part of OpenSSL API) (unused)
1121 arg Callback of "our" registered data
1122
1123Returns: SSL_TLSEXT_ERR_{OK,ALERT_WARNING,ALERT_FATAL,NOACK}
1124*/
1125
3bcbbbe2 1126#ifdef EXIM_HAVE_OPENSSL_TLSEXT
7be682ca 1127static int
7be682ca
PP
1128tls_servername_cb(SSL *s, int *ad ARG_UNUSED, void *arg)
1129{
1130const char *servername = SSL_get_servername(s, TLSEXT_NAMETYPE_host_name);
3f7eeb86 1131tls_ext_ctx_cb *cbinfo = (tls_ext_ctx_cb *) arg;
7be682ca 1132int rc;
3f0945ff 1133int old_pool = store_pool;
7be682ca
PP
1134
1135if (!servername)
1136 return SSL_TLSEXT_ERR_OK;
1137
3f0945ff 1138DEBUG(D_tls) debug_printf("Received TLS SNI \"%s\"%s\n", servername,
7be682ca
PP
1139 reexpand_tls_files_for_sni ? "" : " (unused for certificate selection)");
1140
1141/* Make the extension value available for expansion */
3f0945ff 1142store_pool = POOL_PERM;
817d9f57 1143tls_in.sni = string_copy(US servername);
3f0945ff 1144store_pool = old_pool;
7be682ca
PP
1145
1146if (!reexpand_tls_files_for_sni)
1147 return SSL_TLSEXT_ERR_OK;
1148
1149/* Can't find an SSL_CTX_clone() or equivalent, so we do it manually;
1150not confident that memcpy wouldn't break some internal reference counting.
1151Especially since there's a references struct member, which would be off. */
1152
0df4ab80 1153if (!(server_sni = SSL_CTX_new(SSLv23_server_method())))
7be682ca
PP
1154 {
1155 ERR_error_string(ERR_get_error(), ssl_errstring);
1156 DEBUG(D_tls) debug_printf("SSL_CTX_new() failed: %s\n", ssl_errstring);
1157 return SSL_TLSEXT_ERR_NOACK;
1158 }
1159
1160/* Not sure how many of these are actually needed, since SSL object
1161already exists. Might even need this selfsame callback, for reneg? */
1162
817d9f57
JH
1163SSL_CTX_set_info_callback(server_sni, SSL_CTX_get_info_callback(server_ctx));
1164SSL_CTX_set_mode(server_sni, SSL_CTX_get_mode(server_ctx));
1165SSL_CTX_set_options(server_sni, SSL_CTX_get_options(server_ctx));
1166SSL_CTX_set_timeout(server_sni, SSL_CTX_get_timeout(server_ctx));
1167SSL_CTX_set_tlsext_servername_callback(server_sni, tls_servername_cb);
1168SSL_CTX_set_tlsext_servername_arg(server_sni, cbinfo);
038597d2
PP
1169
1170if ( !init_dh(server_sni, cbinfo->dhparam, NULL)
1171 || !init_ecdh(server_sni, NULL)
1172 )
1173 return SSL_TLSEXT_ERR_NOACK;
1174
7be682ca 1175if (cbinfo->server_cipher_list)
817d9f57 1176 SSL_CTX_set_cipher_list(server_sni, CS cbinfo->server_cipher_list);
f2de3a33 1177#ifndef DISABLE_OCSP
f5d78688 1178if (cbinfo->u_ocsp.server.file)
3f7eeb86 1179 {
f5d78688 1180 SSL_CTX_set_tlsext_status_cb(server_sni, tls_server_stapling_cb);
14c7b357 1181 SSL_CTX_set_tlsext_status_arg(server_sni, cbinfo);
3f7eeb86
PP
1182 }
1183#endif
7be682ca 1184
c3033f13
JH
1185if ((rc = setup_certs(server_sni, tls_verify_certificates, tls_crl, NULL, FALSE,
1186 verify_callback_server)) != OK)
1187 return SSL_TLSEXT_ERR_NOACK;
7be682ca 1188
3f7eeb86
PP
1189/* do this after setup_certs, because this can require the certs for verifying
1190OCSP information. */
038597d2 1191if ((rc = tls_expand_session_files(server_sni, cbinfo)) != OK)
0df4ab80 1192 return SSL_TLSEXT_ERR_NOACK;
a799883d 1193
7be682ca 1194DEBUG(D_tls) debug_printf("Switching SSL context.\n");
817d9f57 1195SSL_set_SSL_CTX(s, server_sni);
7be682ca
PP
1196
1197return SSL_TLSEXT_ERR_OK;
1198}
3bcbbbe2 1199#endif /* EXIM_HAVE_OPENSSL_TLSEXT */
7be682ca
PP
1200
1201
1202
1203
f2de3a33 1204#ifndef DISABLE_OCSP
f5d78688 1205
3f7eeb86
PP
1206/*************************************************
1207* Callback to handle OCSP Stapling *
1208*************************************************/
1209
1210/* Called when acting as server during the TLS session setup if the client
1211requests OCSP information with a Certificate Status Request.
1212
1213Documentation via openssl s_server.c and the Apache patch from the OpenSSL
1214project.
1215
1216*/
1217
1218static int
f5d78688 1219tls_server_stapling_cb(SSL *s, void *arg)
3f7eeb86
PP
1220{
1221const tls_ext_ctx_cb *cbinfo = (tls_ext_ctx_cb *) arg;
1222uschar *response_der;
1223int response_der_len;
1224
af4a1bca 1225DEBUG(D_tls)
b3ef41c9 1226 debug_printf("Received TLS status request (OCSP stapling); %s response\n",
f5d78688
JH
1227 cbinfo->u_ocsp.server.response ? "have" : "lack");
1228
44662487 1229tls_in.ocsp = OCSP_NOT_RESP;
f5d78688 1230if (!cbinfo->u_ocsp.server.response)
3f7eeb86
PP
1231 return SSL_TLSEXT_ERR_NOACK;
1232
1233response_der = NULL;
44662487
JH
1234response_der_len = i2d_OCSP_RESPONSE(cbinfo->u_ocsp.server.response,
1235 &response_der);
3f7eeb86
PP
1236if (response_der_len <= 0)
1237 return SSL_TLSEXT_ERR_NOACK;
1238
5e55c7a9 1239SSL_set_tlsext_status_ocsp_resp(server_ssl, response_der, response_der_len);
44662487 1240tls_in.ocsp = OCSP_VFIED;
3f7eeb86
PP
1241return SSL_TLSEXT_ERR_OK;
1242}
1243
3f7eeb86 1244
f5d78688
JH
1245static void
1246time_print(BIO * bp, const char * str, ASN1_GENERALIZEDTIME * time)
1247{
1248BIO_printf(bp, "\t%s: ", str);
1249ASN1_GENERALIZEDTIME_print(bp, time);
1250BIO_puts(bp, "\n");
1251}
1252
1253static int
1254tls_client_stapling_cb(SSL *s, void *arg)
1255{
1256tls_ext_ctx_cb * cbinfo = arg;
1257const unsigned char * p;
1258int len;
1259OCSP_RESPONSE * rsp;
1260OCSP_BASICRESP * bs;
1261int i;
1262
1263DEBUG(D_tls) debug_printf("Received TLS status response (OCSP stapling):");
1264len = SSL_get_tlsext_status_ocsp_resp(s, &p);
1265if(!p)
1266 {
44662487 1267 /* Expect this when we requested ocsp but got none */
6c6d6e48 1268 if (cbinfo->u_ocsp.client.verify_required && LOGGING(tls_cipher))
44662487 1269 log_write(0, LOG_MAIN, "Received TLS status callback, null content");
f5d78688
JH
1270 else
1271 DEBUG(D_tls) debug_printf(" null\n");
44662487 1272 return cbinfo->u_ocsp.client.verify_required ? 0 : 1;
f5d78688 1273 }
018058b2 1274
f5d78688
JH
1275if(!(rsp = d2i_OCSP_RESPONSE(NULL, &p, len)))
1276 {
018058b2 1277 tls_out.ocsp = OCSP_FAILED;
6c6d6e48 1278 if (LOGGING(tls_cipher))
1eca31ca 1279 log_write(0, LOG_MAIN, "Received TLS cert status response, parse error");
f5d78688
JH
1280 else
1281 DEBUG(D_tls) debug_printf(" parse error\n");
1282 return 0;
1283 }
1284
1285if(!(bs = OCSP_response_get1_basic(rsp)))
1286 {
018058b2 1287 tls_out.ocsp = OCSP_FAILED;
6c6d6e48 1288 if (LOGGING(tls_cipher))
1eca31ca 1289 log_write(0, LOG_MAIN, "Received TLS cert status response, error parsing response");
f5d78688
JH
1290 else
1291 DEBUG(D_tls) debug_printf(" error parsing response\n");
1292 OCSP_RESPONSE_free(rsp);
1293 return 0;
1294 }
1295
1296/* We'd check the nonce here if we'd put one in the request. */
1297/* However that would defeat cacheability on the server so we don't. */
1298
f5d78688
JH
1299/* This section of code reworked from OpenSSL apps source;
1300 The OpenSSL Project retains copyright:
1301 Copyright (c) 1999 The OpenSSL Project. All rights reserved.
1302*/
1303 {
1304 BIO * bp = NULL;
f5d78688
JH
1305 int status, reason;
1306 ASN1_GENERALIZEDTIME *rev, *thisupd, *nextupd;
1307
1308 DEBUG(D_tls) bp = BIO_new_fp(stderr, BIO_NOCLOSE);
1309
1310 /*OCSP_RESPONSE_print(bp, rsp, 0); extreme debug: stapling content */
1311
1312 /* Use the chain that verified the server cert to verify the stapled info */
1313 /* DEBUG(D_tls) x509_store_dump_cert_s_names(cbinfo->u_ocsp.client.verify_store); */
1314
c3033f13 1315 if ((i = OCSP_basic_verify(bs, cbinfo->verify_stack,
44662487 1316 cbinfo->u_ocsp.client.verify_store, 0)) <= 0)
f5d78688 1317 {
018058b2 1318 tls_out.ocsp = OCSP_FAILED;
6c6d6e48 1319 if (LOGGING(tls_cipher))
1eca31ca 1320 log_write(0, LOG_MAIN, "Received TLS cert status response, itself unverifiable");
f5d78688
JH
1321 BIO_printf(bp, "OCSP response verify failure\n");
1322 ERR_print_errors(bp);
c8dfb21d 1323 goto failed;
f5d78688
JH
1324 }
1325
1326 BIO_printf(bp, "OCSP response well-formed and signed OK\n");
1327
c8dfb21d
JH
1328 /*XXX So we have a good stapled OCSP status. How do we know
1329 it is for the cert of interest? OpenSSL 1.1.0 has a routine
1330 OCSP_resp_find_status() which matches on a cert id, which presumably
1331 we should use. Making an id needs OCSP_cert_id_new(), which takes
1332 issuerName, issuerKey, serialNumber. Are they all in the cert?
1333
1334 For now, carry on blindly accepting the resp. */
1335
f5d78688 1336 {
f5d78688
JH
1337 OCSP_SINGLERESP * single;
1338
c8dfb21d
JH
1339#ifdef EXIM_HAVE_OCSP_RESP_COUNT
1340 if (OCSP_resp_count(bs) != 1)
1341#else
1342 STACK_OF(OCSP_SINGLERESP) * sresp = bs->tbsResponseData->responses;
f5d78688 1343 if (sk_OCSP_SINGLERESP_num(sresp) != 1)
c8dfb21d 1344#endif
f5d78688 1345 {
018058b2 1346 tls_out.ocsp = OCSP_FAILED;
44662487
JH
1347 log_write(0, LOG_MAIN, "OCSP stapling "
1348 "with multiple responses not handled");
c8dfb21d 1349 goto failed;
f5d78688
JH
1350 }
1351 single = OCSP_resp_get0(bs, 0);
44662487
JH
1352 status = OCSP_single_get0_status(single, &reason, &rev,
1353 &thisupd, &nextupd);
f5d78688
JH
1354 }
1355
f5d78688
JH
1356 DEBUG(D_tls) time_print(bp, "This OCSP Update", thisupd);
1357 DEBUG(D_tls) if(nextupd) time_print(bp, "Next OCSP Update", nextupd);
44662487
JH
1358 if (!OCSP_check_validity(thisupd, nextupd,
1359 EXIM_OCSP_SKEW_SECONDS, EXIM_OCSP_MAX_AGE))
f5d78688 1360 {
018058b2 1361 tls_out.ocsp = OCSP_FAILED;
f5d78688
JH
1362 DEBUG(D_tls) ERR_print_errors(bp);
1363 log_write(0, LOG_MAIN, "Server OSCP dates invalid");
f5d78688 1364 }
44662487 1365 else
f5d78688 1366 {
44662487
JH
1367 DEBUG(D_tls) BIO_printf(bp, "Certificate status: %s\n",
1368 OCSP_cert_status_str(status));
1369 switch(status)
1370 {
1371 case V_OCSP_CERTSTATUS_GOOD:
44662487 1372 tls_out.ocsp = OCSP_VFIED;
018058b2 1373 i = 1;
c8dfb21d 1374 goto good;
44662487 1375 case V_OCSP_CERTSTATUS_REVOKED:
018058b2 1376 tls_out.ocsp = OCSP_FAILED;
44662487
JH
1377 log_write(0, LOG_MAIN, "Server certificate revoked%s%s",
1378 reason != -1 ? "; reason: " : "",
1379 reason != -1 ? OCSP_crl_reason_str(reason) : "");
1380 DEBUG(D_tls) time_print(bp, "Revocation Time", rev);
44662487
JH
1381 break;
1382 default:
018058b2 1383 tls_out.ocsp = OCSP_FAILED;
44662487
JH
1384 log_write(0, LOG_MAIN,
1385 "Server certificate status unknown, in OCSP stapling");
44662487
JH
1386 break;
1387 }
f5d78688 1388 }
c8dfb21d
JH
1389 failed:
1390 i = cbinfo->u_ocsp.client.verify_required ? 0 : 1;
1391 good:
f5d78688
JH
1392 BIO_free(bp);
1393 }
1394
1395OCSP_RESPONSE_free(rsp);
1396return i;
1397}
f2de3a33 1398#endif /*!DISABLE_OCSP*/
3f7eeb86
PP
1399
1400
7be682ca 1401/*************************************************
059ec3d9
PH
1402* Initialize for TLS *
1403*************************************************/
1404
e51c7be2
JH
1405/* Called from both server and client code, to do preliminary initialization
1406of the library. We allocate and return a context structure.
059ec3d9
PH
1407
1408Arguments:
946ecbe0 1409 ctxp returned SSL context
059ec3d9
PH
1410 host connected host, if client; NULL if server
1411 dhparam DH parameter file
1412 certificate certificate file
1413 privatekey private key
f5d78688 1414 ocsp_file file of stapling info (server); flag for require ocsp (client)
059ec3d9 1415 addr address if client; NULL if server (for some randomness)
946ecbe0 1416 cbp place to put allocated callback context
059ec3d9
PH
1417
1418Returns: OK/DEFER/FAIL
1419*/
1420
1421static int
817d9f57 1422tls_init(SSL_CTX **ctxp, host_item *host, uschar *dhparam, uschar *certificate,
3f7eeb86 1423 uschar *privatekey,
f2de3a33 1424#ifndef DISABLE_OCSP
3f7eeb86
PP
1425 uschar *ocsp_file,
1426#endif
817d9f57 1427 address_item *addr, tls_ext_ctx_cb ** cbp)
059ec3d9 1428{
77bb000f 1429long init_options;
7be682ca 1430int rc;
77bb000f 1431BOOL okay;
a7538db1 1432tls_ext_ctx_cb * cbinfo;
7be682ca
PP
1433
1434cbinfo = store_malloc(sizeof(tls_ext_ctx_cb));
1435cbinfo->certificate = certificate;
1436cbinfo->privatekey = privatekey;
f2de3a33 1437#ifndef DISABLE_OCSP
c3033f13 1438cbinfo->verify_stack = NULL;
f5d78688
JH
1439if ((cbinfo->is_server = host==NULL))
1440 {
1441 cbinfo->u_ocsp.server.file = ocsp_file;
1442 cbinfo->u_ocsp.server.file_expanded = NULL;
1443 cbinfo->u_ocsp.server.response = NULL;
1444 }
1445else
1446 cbinfo->u_ocsp.client.verify_store = NULL;
3f7eeb86 1447#endif
7be682ca 1448cbinfo->dhparam = dhparam;
0df4ab80 1449cbinfo->server_cipher_list = NULL;
7be682ca 1450cbinfo->host = host;
0cbf2b82 1451#ifndef DISABLE_EVENT
a7538db1
JH
1452cbinfo->event_action = NULL;
1453#endif
77bb000f 1454
059ec3d9
PH
1455SSL_load_error_strings(); /* basic set up */
1456OpenSSL_add_ssl_algorithms();
1457
c8dfb21d 1458#ifdef EXIM_HAVE_SHA256
77bb000f 1459/* SHA256 is becoming ever more popular. This makes sure it gets added to the
a0475b69
TK
1460list of available digests. */
1461EVP_add_digest(EVP_sha256());
cf1ef1a9 1462#endif
a0475b69 1463
f0f5a555
PP
1464/* Create a context.
1465The OpenSSL docs in 1.0.1b have not been updated to clarify TLS variant
1466negotiation in the different methods; as far as I can tell, the only
1467*_{server,client}_method which allows negotiation is SSLv23, which exists even
1468when OpenSSL is built without SSLv2 support.
1469By disabling with openssl_options, we can let admins re-enable with the
1470existing knob. */
059ec3d9 1471
c8dfb21d 1472*ctxp = SSL_CTX_new(host ? SSLv23_client_method() : SSLv23_server_method());
059ec3d9 1473
c8dfb21d 1474if (!*ctxp) return tls_error(US"SSL_CTX_new", host, NULL);
059ec3d9
PH
1475
1476/* It turns out that we need to seed the random number generator this early in
1477order to get the full complement of ciphers to work. It took me roughly a day
1478of work to discover this by experiment.
1479
1480On systems that have /dev/urandom, SSL may automatically seed itself from
1481there. Otherwise, we have to make something up as best we can. Double check
1482afterwards. */
1483
1484if (!RAND_status())
1485 {
1486 randstuff r;
9e3331ea 1487 gettimeofday(&r.tv, NULL);
059ec3d9
PH
1488 r.p = getpid();
1489
1490 RAND_seed((uschar *)(&r), sizeof(r));
1491 RAND_seed((uschar *)big_buffer, big_buffer_size);
1492 if (addr != NULL) RAND_seed((uschar *)addr, sizeof(addr));
1493
1494 if (!RAND_status())
7199e1ee 1495 return tls_error(US"RAND_status", host,
5ca6d115 1496 US"unable to seed random number generator");
059ec3d9
PH
1497 }
1498
1499/* Set up the information callback, which outputs if debugging is at a suitable
1500level. */
1501
f69979cf 1502DEBUG(D_tls) SSL_CTX_set_info_callback(*ctxp, (void (*)())info_callback);
059ec3d9 1503
c80c5570 1504/* Automatically re-try reads/writes after renegotiation. */
817d9f57 1505(void) SSL_CTX_set_mode(*ctxp, SSL_MODE_AUTO_RETRY);
c80c5570 1506
77bb000f
PP
1507/* Apply administrator-supplied work-arounds.
1508Historically we applied just one requested option,
1509SSL_OP_DONT_INSERT_EMPTY_FRAGMENTS, but when bug 994 requested a second, we
1510moved to an administrator-controlled list of options to specify and
1511grandfathered in the first one as the default value for "openssl_options".
059ec3d9 1512
77bb000f
PP
1513No OpenSSL version number checks: the options we accept depend upon the
1514availability of the option value macros from OpenSSL. */
059ec3d9 1515
77bb000f
PP
1516okay = tls_openssl_options_parse(openssl_options, &init_options);
1517if (!okay)
73a46702 1518 return tls_error(US"openssl_options parsing failed", host, NULL);
77bb000f
PP
1519
1520if (init_options)
1521 {
1522 DEBUG(D_tls) debug_printf("setting SSL CTX options: %#lx\n", init_options);
817d9f57 1523 if (!(SSL_CTX_set_options(*ctxp, init_options)))
77bb000f
PP
1524 return tls_error(string_sprintf(
1525 "SSL_CTX_set_option(%#lx)", init_options), host, NULL);
1526 }
1527else
1528 DEBUG(D_tls) debug_printf("no SSL CTX options to set\n");
059ec3d9
PH
1529
1530/* Initialize with DH parameters if supplied */
10ca4f1c 1531/* Initialize ECDH temp key parameter selection */
059ec3d9 1532
038597d2
PP
1533if ( !init_dh(*ctxp, dhparam, host)
1534 || !init_ecdh(*ctxp, host)
1535 )
1536 return DEFER;
059ec3d9 1537
3f7eeb86 1538/* Set up certificate and key (and perhaps OCSP info) */
059ec3d9 1539
23bb6982
JH
1540if ((rc = tls_expand_session_files(*ctxp, cbinfo)) != OK)
1541 return rc;
c91535f3 1542
c3033f13
JH
1543/* If we need to handle SNI or OCSP, do so */
1544
3bcbbbe2 1545#ifdef EXIM_HAVE_OPENSSL_TLSEXT
c3033f13
JH
1546# ifndef DISABLE_OCSP
1547 if (!(cbinfo->verify_stack = sk_X509_new_null()))
1548 {
1549 DEBUG(D_tls) debug_printf("failed to create stack for stapling verify\n");
1550 return FAIL;
1551 }
1552# endif
1553
f5d78688 1554if (host == NULL) /* server */
3f0945ff 1555 {
f2de3a33 1556# ifndef DISABLE_OCSP
f5d78688 1557 /* We check u_ocsp.server.file, not server.response, because we care about if
3f7eeb86
PP
1558 the option exists, not what the current expansion might be, as SNI might
1559 change the certificate and OCSP file in use between now and the time the
1560 callback is invoked. */
f5d78688 1561 if (cbinfo->u_ocsp.server.file)
3f7eeb86 1562 {
f5d78688 1563 SSL_CTX_set_tlsext_status_cb(server_ctx, tls_server_stapling_cb);
5e55c7a9 1564 SSL_CTX_set_tlsext_status_arg(server_ctx, cbinfo);
3f7eeb86 1565 }
f5d78688 1566# endif
3f0945ff
PP
1567 /* We always do this, so that $tls_sni is available even if not used in
1568 tls_certificate */
817d9f57
JH
1569 SSL_CTX_set_tlsext_servername_callback(*ctxp, tls_servername_cb);
1570 SSL_CTX_set_tlsext_servername_arg(*ctxp, cbinfo);
3f0945ff 1571 }
f2de3a33 1572# ifndef DISABLE_OCSP
f5d78688
JH
1573else /* client */
1574 if(ocsp_file) /* wanting stapling */
1575 {
1576 if (!(cbinfo->u_ocsp.client.verify_store = X509_STORE_new()))
1577 {
1578 DEBUG(D_tls) debug_printf("failed to create store for stapling verify\n");
1579 return FAIL;
1580 }
1581 SSL_CTX_set_tlsext_status_cb(*ctxp, tls_client_stapling_cb);
1582 SSL_CTX_set_tlsext_status_arg(*ctxp, cbinfo);
1583 }
1584# endif
7be682ca 1585#endif
059ec3d9 1586
e51c7be2 1587cbinfo->verify_cert_hostnames = NULL;
e51c7be2 1588
c8dfb21d 1589#ifdef EXIM_HAVE_EPHEM_RSA_KEX
059ec3d9 1590/* Set up the RSA callback */
817d9f57 1591SSL_CTX_set_tmp_rsa_callback(*ctxp, rsa_callback);
c8dfb21d 1592#endif
059ec3d9
PH
1593
1594/* Finally, set the timeout, and we are done */
1595
817d9f57 1596SSL_CTX_set_timeout(*ctxp, ssl_session_timeout);
059ec3d9 1597DEBUG(D_tls) debug_printf("Initialized TLS\n");
7be682ca 1598
817d9f57 1599*cbp = cbinfo;
7be682ca 1600
059ec3d9
PH
1601return OK;
1602}
1603
1604
1605
1606
1607/*************************************************
1608* Get name of cipher in use *
1609*************************************************/
1610
817d9f57 1611/*
059ec3d9 1612Argument: pointer to an SSL structure for the connection
817d9f57
JH
1613 buffer to use for answer
1614 size of buffer
1615 pointer to number of bits for cipher
059ec3d9
PH
1616Returns: nothing
1617*/
1618
1619static void
817d9f57 1620construct_cipher_name(SSL *ssl, uschar *cipherbuf, int bsize, int *bits)
059ec3d9 1621{
57b3a7f5
PP
1622/* With OpenSSL 1.0.0a, this needs to be const but the documentation doesn't
1623yet reflect that. It should be a safe change anyway, even 0.9.8 versions have
1624the accessor functions use const in the prototype. */
1625const SSL_CIPHER *c;
d9784128 1626const uschar *ver;
059ec3d9 1627
d9784128 1628ver = (const uschar *)SSL_get_version(ssl);
059ec3d9 1629
57b3a7f5 1630c = (const SSL_CIPHER *) SSL_get_current_cipher(ssl);
817d9f57 1631SSL_CIPHER_get_bits(c, bits);
059ec3d9 1632
817d9f57
JH
1633string_format(cipherbuf, bsize, "%s:%s:%u", ver,
1634 SSL_CIPHER_get_name(c), *bits);
059ec3d9
PH
1635
1636DEBUG(D_tls) debug_printf("Cipher: %s\n", cipherbuf);
1637}
1638
1639
f69979cf
JH
1640static void
1641peer_cert(SSL * ssl, tls_support * tlsp, uschar * peerdn, unsigned bsize)
1642{
1643/*XXX we might consider a list-of-certs variable for the cert chain.
1644SSL_get_peer_cert_chain(SSL*). We'd need a new variable type and support
1645in list-handling functions, also consider the difference between the entire
1646chain and the elements sent by the peer. */
1647
1648/* Will have already noted peercert on a verify fail; possibly not the leaf */
1649if (!tlsp->peercert)
1650 tlsp->peercert = SSL_get_peer_certificate(ssl);
1651/* Beware anonymous ciphers which lead to server_cert being NULL */
1652if (tlsp->peercert)
1653 {
1654 X509_NAME_oneline(X509_get_subject_name(tlsp->peercert), CS peerdn, bsize);
1655 peerdn[bsize-1] = '\0';
1656 tlsp->peerdn = peerdn; /*XXX a static buffer... */
1657 }
1658else
1659 tlsp->peerdn = NULL;
1660}
1661
1662
059ec3d9
PH
1663
1664
1665
1666/*************************************************
1667* Set up for verifying certificates *
1668*************************************************/
1669
c3033f13
JH
1670/* Load certs from file, return TRUE on success */
1671
1672static BOOL
1673chain_from_pem_file(const uschar * file, STACK_OF(X509) * verify_stack)
1674{
1675BIO * bp;
1676X509 * x;
1677
1678if (!(bp = BIO_new_file(CS file, "r"))) return FALSE;
1679while ((x = PEM_read_bio_X509(bp, NULL, 0, NULL)))
1680 sk_X509_push(verify_stack, x);
1681BIO_free(bp);
1682return TRUE;
1683}
1684
1685
1686
059ec3d9
PH
1687/* Called by both client and server startup
1688
1689Arguments:
7be682ca 1690 sctx SSL_CTX* to initialise
059ec3d9
PH
1691 certs certs file or NULL
1692 crl CRL file or NULL
1693 host NULL in a server; the remote host in a client
1694 optional TRUE if called from a server for a host in tls_try_verify_hosts;
1695 otherwise passed as FALSE
983207c1 1696 cert_vfy_cb Callback function for certificate verification
059ec3d9
PH
1697
1698Returns: OK/DEFER/FAIL
1699*/
1700
1701static int
983207c1
JH
1702setup_certs(SSL_CTX *sctx, uschar *certs, uschar *crl, host_item *host, BOOL optional,
1703 int (*cert_vfy_cb)(int, X509_STORE_CTX *) )
059ec3d9
PH
1704{
1705uschar *expcerts, *expcrl;
1706
1707if (!expand_check(certs, US"tls_verify_certificates", &expcerts))
1708 return DEFER;
1709
10a831a3 1710if (expcerts && *expcerts)
059ec3d9 1711 {
10a831a3
JH
1712 /* Tell the library to use its compiled-in location for the system default
1713 CA bundle. Then add the ones specified in the config, if any. */
cb1d7830 1714
10a831a3
JH
1715 if (!SSL_CTX_set_default_verify_paths(sctx))
1716 return tls_error(US"SSL_CTX_set_default_verify_paths", host, NULL);
1717
1718 if (Ustrcmp(expcerts, "system") != 0)
059ec3d9 1719 {
cb1d7830
JH
1720 struct stat statbuf;
1721
cb1d7830
JH
1722 if (Ustat(expcerts, &statbuf) < 0)
1723 {
1724 log_write(0, LOG_MAIN|LOG_PANIC,
1725 "failed to stat %s for certificates", expcerts);
1726 return DEFER;
1727 }
059ec3d9 1728 else
059ec3d9 1729 {
cb1d7830
JH
1730 uschar *file, *dir;
1731 if ((statbuf.st_mode & S_IFMT) == S_IFDIR)
1732 { file = NULL; dir = expcerts; }
1733 else
c3033f13
JH
1734 {
1735 file = expcerts; dir = NULL;
1736#ifndef DISABLE_OCSP
1737 /* In the server if we will be offering an OCSP proof, load chain from
1738 file for verifying the OCSP proof at load time. */
1739
1740 if ( !host
1741 && statbuf.st_size > 0
1742 && server_static_cbinfo->u_ocsp.server.file
1743 && !chain_from_pem_file(file, server_static_cbinfo->verify_stack)
1744 )
1745 {
1746 log_write(0, LOG_MAIN|LOG_PANIC,
1747 "failed to load cert hain from %s", file);
1748 return DEFER;
1749 }
1750#endif
1751 }
cb1d7830
JH
1752
1753 /* If a certificate file is empty, the next function fails with an
1754 unhelpful error message. If we skip it, we get the correct behaviour (no
1755 certificates are recognized, but the error message is still misleading (it
c3033f13 1756 says no certificate was supplied). But this is better. */
cb1d7830 1757
f2f2c91b
JH
1758 if ( (!file || statbuf.st_size > 0)
1759 && !SSL_CTX_load_verify_locations(sctx, CS file, CS dir))
cb1d7830
JH
1760 return tls_error(US"SSL_CTX_load_verify_locations", host, NULL);
1761
1762 /* Load the list of CAs for which we will accept certs, for sending
1763 to the client. This is only for the one-file tls_verify_certificates
1764 variant.
1765 If a list isn't loaded into the server, but
1766 some verify locations are set, the server end appears to make
4c04137d 1767 a wildcard request for client certs.
10a831a3 1768 Meanwhile, the client library as default behaviour *ignores* the list
cb1d7830
JH
1769 we send over the wire - see man SSL_CTX_set_client_cert_cb.
1770 Because of this, and that the dir variant is likely only used for
1771 the public-CA bundle (not for a private CA), not worth fixing.
1772 */
f2f2c91b 1773 if (file)
cb1d7830
JH
1774 {
1775 STACK_OF(X509_NAME) * names = SSL_load_client_CA_file(CS file);
f2f2c91b
JH
1776
1777 DEBUG(D_tls) debug_printf("Added %d certificate authorities.\n",
cb1d7830
JH
1778 sk_X509_NAME_num(names));
1779 SSL_CTX_set_client_CA_list(sctx, names);
1780 }
059ec3d9
PH
1781 }
1782 }
1783
1784 /* Handle a certificate revocation list. */
1785
10a831a3 1786#if OPENSSL_VERSION_NUMBER > 0x00907000L
059ec3d9 1787
8b417f2c 1788 /* This bit of code is now the version supplied by Lars Mainka. (I have
10a831a3 1789 merely reformatted it into the Exim code style.)
8b417f2c 1790
10a831a3
JH
1791 "From here I changed the code to add support for multiple crl's
1792 in pem format in one file or to support hashed directory entries in
1793 pem format instead of a file. This method now uses the library function
1794 X509_STORE_load_locations to add the CRL location to the SSL context.
1795 OpenSSL will then handle the verify against CA certs and CRLs by
1796 itself in the verify callback." */
8b417f2c 1797
059ec3d9 1798 if (!expand_check(crl, US"tls_crl", &expcrl)) return DEFER;
10a831a3 1799 if (expcrl && *expcrl)
059ec3d9 1800 {
8b417f2c
PH
1801 struct stat statbufcrl;
1802 if (Ustat(expcrl, &statbufcrl) < 0)
1803 {
1804 log_write(0, LOG_MAIN|LOG_PANIC,
1805 "failed to stat %s for certificates revocation lists", expcrl);
1806 return DEFER;
1807 }
1808 else
059ec3d9 1809 {
8b417f2c
PH
1810 /* is it a file or directory? */
1811 uschar *file, *dir;
7be682ca 1812 X509_STORE *cvstore = SSL_CTX_get_cert_store(sctx);
8b417f2c 1813 if ((statbufcrl.st_mode & S_IFMT) == S_IFDIR)
059ec3d9 1814 {
8b417f2c
PH
1815 file = NULL;
1816 dir = expcrl;
1817 DEBUG(D_tls) debug_printf("SSL CRL value is a directory %s\n", dir);
059ec3d9
PH
1818 }
1819 else
1820 {
8b417f2c
PH
1821 file = expcrl;
1822 dir = NULL;
1823 DEBUG(D_tls) debug_printf("SSL CRL value is a file %s\n", file);
059ec3d9 1824 }
8b417f2c 1825 if (X509_STORE_load_locations(cvstore, CS file, CS dir) == 0)
7199e1ee 1826 return tls_error(US"X509_STORE_load_locations", host, NULL);
8b417f2c
PH
1827
1828 /* setting the flags to check against the complete crl chain */
1829
1830 X509_STORE_set_flags(cvstore,
1831 X509_V_FLAG_CRL_CHECK|X509_V_FLAG_CRL_CHECK_ALL);
059ec3d9 1832 }
059ec3d9
PH
1833 }
1834
10a831a3 1835#endif /* OPENSSL_VERSION_NUMBER > 0x00907000L */
059ec3d9
PH
1836
1837 /* If verification is optional, don't fail if no certificate */
1838
7be682ca 1839 SSL_CTX_set_verify(sctx,
059ec3d9 1840 SSL_VERIFY_PEER | (optional? 0 : SSL_VERIFY_FAIL_IF_NO_PEER_CERT),
983207c1 1841 cert_vfy_cb);
059ec3d9
PH
1842 }
1843
1844return OK;
1845}
1846
1847
1848
1849/*************************************************
1850* Start a TLS session in a server *
1851*************************************************/
1852
1853/* This is called when Exim is running as a server, after having received
1854the STARTTLS command. It must respond to that command, and then negotiate
1855a TLS session.
1856
1857Arguments:
1858 require_ciphers allowed ciphers
1859
1860Returns: OK on success
1861 DEFER for errors before the start of the negotiation
4c04137d 1862 FAIL for errors during the negotiation; the server can't
059ec3d9
PH
1863 continue running.
1864*/
1865
1866int
17c76198 1867tls_server_start(const uschar *require_ciphers)
059ec3d9
PH
1868{
1869int rc;
1870uschar *expciphers;
7be682ca 1871tls_ext_ctx_cb *cbinfo;
f69979cf 1872static uschar peerdn[256];
817d9f57 1873static uschar cipherbuf[256];
059ec3d9
PH
1874
1875/* Check for previous activation */
1876
817d9f57 1877if (tls_in.active >= 0)
059ec3d9 1878 {
5ca6d115 1879 tls_error(US"STARTTLS received after TLS started", NULL, US"");
059ec3d9
PH
1880 smtp_printf("554 Already in TLS\r\n");
1881 return FAIL;
1882 }
1883
1884/* Initialize the SSL library. If it fails, it will already have logged
1885the error. */
1886
817d9f57 1887rc = tls_init(&server_ctx, NULL, tls_dhparam, tls_certificate, tls_privatekey,
f2de3a33 1888#ifndef DISABLE_OCSP
3f7eeb86
PP
1889 tls_ocsp_file,
1890#endif
817d9f57 1891 NULL, &server_static_cbinfo);
059ec3d9 1892if (rc != OK) return rc;
817d9f57 1893cbinfo = server_static_cbinfo;
059ec3d9
PH
1894
1895if (!expand_check(require_ciphers, US"tls_require_ciphers", &expciphers))
1896 return FAIL;
1897
1898/* In OpenSSL, cipher components are separated by hyphens. In GnuTLS, they
17c76198
PP
1899were historically separated by underscores. So that I can use either form in my
1900tests, and also for general convenience, we turn underscores into hyphens here.
1901*/
059ec3d9 1902
c3033f13 1903if (expciphers)
059ec3d9 1904 {
c3033f13 1905 uschar * s = expciphers;
059ec3d9
PH
1906 while (*s != 0) { if (*s == '_') *s = '-'; s++; }
1907 DEBUG(D_tls) debug_printf("required ciphers: %s\n", expciphers);
817d9f57 1908 if (!SSL_CTX_set_cipher_list(server_ctx, CS expciphers))
7199e1ee 1909 return tls_error(US"SSL_CTX_set_cipher_list", NULL, NULL);
7be682ca 1910 cbinfo->server_cipher_list = expciphers;
059ec3d9
PH
1911 }
1912
1913/* If this is a host for which certificate verification is mandatory or
1914optional, set up appropriately. */
1915
817d9f57 1916tls_in.certificate_verified = FALSE;
53a7196b
JH
1917#ifdef EXPERIMENTAL_DANE
1918tls_in.dane_verified = FALSE;
1919#endif
a2ff477a 1920server_verify_callback_called = FALSE;
059ec3d9
PH
1921
1922if (verify_check_host(&tls_verify_hosts) == OK)
1923 {
983207c1
JH
1924 rc = setup_certs(server_ctx, tls_verify_certificates, tls_crl, NULL,
1925 FALSE, verify_callback_server);
059ec3d9 1926 if (rc != OK) return rc;
a2ff477a 1927 server_verify_optional = FALSE;
059ec3d9
PH
1928 }
1929else if (verify_check_host(&tls_try_verify_hosts) == OK)
1930 {
983207c1
JH
1931 rc = setup_certs(server_ctx, tls_verify_certificates, tls_crl, NULL,
1932 TRUE, verify_callback_server);
059ec3d9 1933 if (rc != OK) return rc;
a2ff477a 1934 server_verify_optional = TRUE;
059ec3d9
PH
1935 }
1936
1937/* Prepare for new connection */
1938
c3033f13 1939if (!(server_ssl = SSL_new(server_ctx))) return tls_error(US"SSL_new", NULL, NULL);
da3ad30d
PP
1940
1941/* Warning: we used to SSL_clear(ssl) here, it was removed.
1942 *
1943 * With the SSL_clear(), we get strange interoperability bugs with
1944 * OpenSSL 1.0.1b and TLS1.1/1.2. It looks as though this may be a bug in
1945 * OpenSSL itself, as a clear should not lead to inability to follow protocols.
1946 *
1947 * The SSL_clear() call is to let an existing SSL* be reused, typically after
1948 * session shutdown. In this case, we have a brand new object and there's no
1949 * obvious reason to immediately clear it. I'm guessing that this was
1950 * originally added because of incomplete initialisation which the clear fixed,
1951 * in some historic release.
1952 */
059ec3d9
PH
1953
1954/* Set context and tell client to go ahead, except in the case of TLS startup
1955on connection, where outputting anything now upsets the clients and tends to
1956make them disconnect. We need to have an explicit fflush() here, to force out
1957the response. Other smtp_printf() calls do not need it, because in non-TLS
1958mode, the fflush() happens when smtp_getc() is called. */
1959
817d9f57
JH
1960SSL_set_session_id_context(server_ssl, sid_ctx, Ustrlen(sid_ctx));
1961if (!tls_in.on_connect)
059ec3d9
PH
1962 {
1963 smtp_printf("220 TLS go ahead\r\n");
1964 fflush(smtp_out);
1965 }
1966
1967/* Now negotiate the TLS session. We put our own timer on it, since it seems
1968that the OpenSSL library doesn't. */
1969
817d9f57
JH
1970SSL_set_wfd(server_ssl, fileno(smtp_out));
1971SSL_set_rfd(server_ssl, fileno(smtp_in));
1972SSL_set_accept_state(server_ssl);
059ec3d9
PH
1973
1974DEBUG(D_tls) debug_printf("Calling SSL_accept\n");
1975
1976sigalrm_seen = FALSE;
1977if (smtp_receive_timeout > 0) alarm(smtp_receive_timeout);
817d9f57 1978rc = SSL_accept(server_ssl);
059ec3d9
PH
1979alarm(0);
1980
1981if (rc <= 0)
1982 {
7199e1ee 1983 tls_error(US"SSL_accept", NULL, sigalrm_seen ? US"timed out" : NULL);
77bb000f
PP
1984 if (ERR_get_error() == 0)
1985 log_write(0, LOG_MAIN,
a053d125 1986 "TLS client disconnected cleanly (rejected our certificate?)");
059ec3d9
PH
1987 return FAIL;
1988 }
1989
1990DEBUG(D_tls) debug_printf("SSL_accept was successful\n");
1991
1992/* TLS has been set up. Adjust the input functions to read via TLS,
1993and initialize things. */
1994
f69979cf
JH
1995peer_cert(server_ssl, &tls_in, peerdn, sizeof(peerdn));
1996
817d9f57
JH
1997construct_cipher_name(server_ssl, cipherbuf, sizeof(cipherbuf), &tls_in.bits);
1998tls_in.cipher = cipherbuf;
059ec3d9
PH
1999
2000DEBUG(D_tls)
2001 {
2002 uschar buf[2048];
817d9f57 2003 if (SSL_get_shared_ciphers(server_ssl, CS buf, sizeof(buf)) != NULL)
059ec3d9
PH
2004 debug_printf("Shared ciphers: %s\n", buf);
2005 }
2006
9d1c15ef
JH
2007/* Record the certificate we presented */
2008 {
2009 X509 * crt = SSL_get_certificate(server_ssl);
2010 tls_in.ourcert = crt ? X509_dup(crt) : NULL;
2011 }
059ec3d9 2012
817d9f57
JH
2013/* Only used by the server-side tls (tls_in), including tls_getc.
2014 Client-side (tls_out) reads (seem to?) go via
2015 smtp_read_response()/ip_recv().
2016 Hence no need to duplicate for _in and _out.
2017 */
059ec3d9
PH
2018ssl_xfer_buffer = store_malloc(ssl_xfer_buffer_size);
2019ssl_xfer_buffer_lwm = ssl_xfer_buffer_hwm = 0;
2020ssl_xfer_eof = ssl_xfer_error = 0;
2021
2022receive_getc = tls_getc;
584e96c6 2023receive_get_cache = tls_get_cache;
059ec3d9
PH
2024receive_ungetc = tls_ungetc;
2025receive_feof = tls_feof;
2026receive_ferror = tls_ferror;
58eb016e 2027receive_smtp_buffered = tls_smtp_buffered;
059ec3d9 2028
817d9f57 2029tls_in.active = fileno(smtp_out);
059ec3d9
PH
2030return OK;
2031}
2032
2033
2034
2035
043b1248
JH
2036static int
2037tls_client_basic_ctx_init(SSL_CTX * ctx,
01a4a5c5 2038 host_item * host, smtp_transport_options_block * ob, tls_ext_ctx_cb * cbinfo
043b1248
JH
2039 )
2040{
2041int rc;
94431adb 2042/* stick to the old behaviour for compatibility if tls_verify_certificates is
043b1248
JH
2043 set but both tls_verify_hosts and tls_try_verify_hosts is not set. Check only
2044 the specified host patterns if one of them is defined */
2045
610ff438
JH
2046if ( ( !ob->tls_verify_hosts
2047 && (!ob->tls_try_verify_hosts || !*ob->tls_try_verify_hosts)
2048 )
5130845b 2049 || (verify_check_given_host(&ob->tls_verify_hosts, host) == OK)
aa2a70ba 2050 )
043b1248 2051 client_verify_optional = FALSE;
5130845b 2052else if (verify_check_given_host(&ob->tls_try_verify_hosts, host) == OK)
aa2a70ba
JH
2053 client_verify_optional = TRUE;
2054else
2055 return OK;
2056
2057if ((rc = setup_certs(ctx, ob->tls_verify_certificates,
2058 ob->tls_crl, host, client_verify_optional, verify_callback_client)) != OK)
2059 return rc;
043b1248 2060
5130845b 2061if (verify_check_given_host(&ob->tls_verify_cert_hostnames, host) == OK)
043b1248 2062 {
4af0d74a 2063 cbinfo->verify_cert_hostnames =
8c5d388a 2064#ifdef SUPPORT_I18N
4af0d74a
JH
2065 string_domain_utf8_to_alabel(host->name, NULL);
2066#else
2067 host->name;
2068#endif
aa2a70ba
JH
2069 DEBUG(D_tls) debug_printf("Cert hostname to check: \"%s\"\n",
2070 cbinfo->verify_cert_hostnames);
043b1248 2071 }
043b1248
JH
2072return OK;
2073}
059ec3d9 2074
fde080a4
JH
2075
2076#ifdef EXPERIMENTAL_DANE
2077static int
fde080a4
JH
2078dane_tlsa_load(SSL * ssl, host_item * host, dns_answer * dnsa)
2079{
2080dns_record * rr;
2081dns_scan dnss;
2082const char * hostnames[2] = { CS host->name, NULL };
2083int found = 0;
2084
2085if (DANESSL_init(ssl, NULL, hostnames) != 1)
2086 return tls_error(US"hostnames load", host, NULL);
2087
2088for (rr = dns_next_rr(dnsa, &dnss, RESET_ANSWERS);
2089 rr;
2090 rr = dns_next_rr(dnsa, &dnss, RESET_NEXT)
2091 ) if (rr->type == T_TLSA)
2092 {
c3033f13 2093 const uschar * p = rr->data;
fde080a4
JH
2094 uint8_t usage, selector, mtype;
2095 const char * mdname;
2096
fde080a4 2097 usage = *p++;
133d2546
JH
2098
2099 /* Only DANE-TA(2) and DANE-EE(3) are supported */
2100 if (usage != 2 && usage != 3) continue;
2101
fde080a4
JH
2102 selector = *p++;
2103 mtype = *p++;
2104
2105 switch (mtype)
2106 {
133d2546
JH
2107 default: continue; /* Only match-types 0, 1, 2 are supported */
2108 case 0: mdname = NULL; break;
2109 case 1: mdname = "sha256"; break;
2110 case 2: mdname = "sha512"; break;
fde080a4
JH
2111 }
2112
133d2546 2113 found++;
fde080a4
JH
2114 switch (DANESSL_add_tlsa(ssl, usage, selector, mdname, p, rr->size - 3))
2115 {
2116 default:
fde080a4 2117 return tls_error(US"tlsa load", host, NULL);
c035b645 2118 case 0: /* action not taken */
fde080a4
JH
2119 case 1: break;
2120 }
594706ea
JH
2121
2122 tls_out.tlsa_usage |= 1<<usage;
fde080a4
JH
2123 }
2124
2125if (found)
2126 return OK;
2127
133d2546 2128log_write(0, LOG_MAIN, "DANE error: No usable TLSA records");
6ebd79ec 2129return DEFER;
fde080a4
JH
2130}
2131#endif /*EXPERIMENTAL_DANE*/
2132
2133
2134
059ec3d9
PH
2135/*************************************************
2136* Start a TLS session in a client *
2137*************************************************/
2138
2139/* Called from the smtp transport after STARTTLS has been accepted.
2140
2141Argument:
2142 fd the fd of the connection
2143 host connected host (for messages)
83da1223 2144 addr the first address
a7538db1 2145 tb transport (always smtp)
0e66b3b6 2146 tlsa_dnsa tlsa lookup, if DANE, else null
059ec3d9
PH
2147
2148Returns: OK on success
2149 FAIL otherwise - note that tls_error() will not give DEFER
2150 because this is not a server
2151*/
2152
2153int
f5d78688 2154tls_client_start(int fd, host_item *host, address_item *addr,
0e66b3b6
JH
2155 transport_instance *tb
2156#ifdef EXPERIMENTAL_DANE
2157 , dns_answer * tlsa_dnsa
2158#endif
2159 )
059ec3d9 2160{
a7538db1
JH
2161smtp_transport_options_block * ob =
2162 (smtp_transport_options_block *)tb->options_block;
f69979cf 2163static uschar peerdn[256];
868f5672 2164uschar * expciphers;
059ec3d9 2165int rc;
817d9f57 2166static uschar cipherbuf[256];
043b1248
JH
2167
2168#ifndef DISABLE_OCSP
043b1248 2169BOOL request_ocsp = FALSE;
6634ac8d 2170BOOL require_ocsp = FALSE;
043b1248 2171#endif
043b1248
JH
2172
2173#ifdef EXPERIMENTAL_DANE
594706ea 2174tls_out.tlsa_usage = 0;
043b1248
JH
2175#endif
2176
f2de3a33 2177#ifndef DISABLE_OCSP
043b1248 2178 {
4f59c424
JH
2179# ifdef EXPERIMENTAL_DANE
2180 if ( tlsa_dnsa
2181 && ob->hosts_request_ocsp[0] == '*'
2182 && ob->hosts_request_ocsp[1] == '\0'
2183 )
2184 {
2185 /* Unchanged from default. Use a safer one under DANE */
2186 request_ocsp = TRUE;
2187 ob->hosts_request_ocsp = US"${if or { {= {0}{$tls_out_tlsa_usage}} "
2188 " {= {4}{$tls_out_tlsa_usage}} } "
2189 " {*}{}}";
2190 }
2191# endif
2192
5130845b
JH
2193 if ((require_ocsp =
2194 verify_check_given_host(&ob->hosts_require_ocsp, host) == OK))
fca41d5a
JH
2195 request_ocsp = TRUE;
2196 else
fca41d5a 2197# ifdef EXPERIMENTAL_DANE
4f59c424 2198 if (!request_ocsp)
fca41d5a 2199# endif
5130845b
JH
2200 request_ocsp =
2201 verify_check_given_host(&ob->hosts_request_ocsp, host) == OK;
043b1248 2202 }
f5d78688 2203#endif
059ec3d9 2204
65867078
JH
2205rc = tls_init(&client_ctx, host, NULL,
2206 ob->tls_certificate, ob->tls_privatekey,
f2de3a33 2207#ifndef DISABLE_OCSP
44662487 2208 (void *)(long)request_ocsp,
3f7eeb86 2209#endif
817d9f57 2210 addr, &client_static_cbinfo);
059ec3d9
PH
2211if (rc != OK) return rc;
2212
817d9f57 2213tls_out.certificate_verified = FALSE;
a2ff477a 2214client_verify_callback_called = FALSE;
059ec3d9 2215
65867078
JH
2216if (!expand_check(ob->tls_require_ciphers, US"tls_require_ciphers",
2217 &expciphers))
059ec3d9
PH
2218 return FAIL;
2219
2220/* In OpenSSL, cipher components are separated by hyphens. In GnuTLS, they
2221are separated by underscores. So that I can use either form in my tests, and
2222also for general convenience, we turn underscores into hyphens here. */
2223
2224if (expciphers != NULL)
2225 {
2226 uschar *s = expciphers;
2227 while (*s != 0) { if (*s == '_') *s = '-'; s++; }
2228 DEBUG(D_tls) debug_printf("required ciphers: %s\n", expciphers);
817d9f57 2229 if (!SSL_CTX_set_cipher_list(client_ctx, CS expciphers))
7199e1ee 2230 return tls_error(US"SSL_CTX_set_cipher_list", host, NULL);
059ec3d9
PH
2231 }
2232
043b1248 2233#ifdef EXPERIMENTAL_DANE
0e66b3b6 2234if (tlsa_dnsa)
a63be306 2235 {
02af313d
JH
2236 SSL_CTX_set_verify(client_ctx,
2237 SSL_VERIFY_PEER | SSL_VERIFY_FAIL_IF_NO_PEER_CERT,
2238 verify_callback_client_dane);
e5cccda9 2239
043b1248 2240 if (!DANESSL_library_init())
b4161d10 2241 return tls_error(US"library init", host, NULL);
043b1248 2242 if (DANESSL_CTX_init(client_ctx) <= 0)
b4161d10 2243 return tls_error(US"context init", host, NULL);
043b1248
JH
2244 }
2245else
e51c7be2 2246
043b1248
JH
2247#endif
2248
01a4a5c5
JH
2249 if ((rc = tls_client_basic_ctx_init(client_ctx, host, ob, client_static_cbinfo))
2250 != OK)
65867078 2251 return rc;
059ec3d9 2252
65867078
JH
2253if ((client_ssl = SSL_new(client_ctx)) == NULL)
2254 return tls_error(US"SSL_new", host, NULL);
817d9f57
JH
2255SSL_set_session_id_context(client_ssl, sid_ctx, Ustrlen(sid_ctx));
2256SSL_set_fd(client_ssl, fd);
2257SSL_set_connect_state(client_ssl);
059ec3d9 2258
65867078 2259if (ob->tls_sni)
3f0945ff 2260 {
65867078 2261 if (!expand_check(ob->tls_sni, US"tls_sni", &tls_out.sni))
3f0945ff 2262 return FAIL;
ec4b68e5 2263 if (tls_out.sni == NULL)
2c9a0e86
PP
2264 {
2265 DEBUG(D_tls) debug_printf("Setting TLS SNI forced to fail, not sending\n");
2266 }
ec4b68e5 2267 else if (!Ustrlen(tls_out.sni))
817d9f57 2268 tls_out.sni = NULL;
3f0945ff
PP
2269 else
2270 {
35731706 2271#ifdef EXIM_HAVE_OPENSSL_TLSEXT
817d9f57
JH
2272 DEBUG(D_tls) debug_printf("Setting TLS SNI \"%s\"\n", tls_out.sni);
2273 SSL_set_tlsext_host_name(client_ssl, tls_out.sni);
35731706 2274#else
66802652 2275 log_write(0, LOG_MAIN, "SNI unusable with this OpenSSL library version; ignoring \"%s\"\n",
02d9264f 2276 tls_out.sni);
35731706 2277#endif
3f0945ff
PP
2278 }
2279 }
2280
594706ea 2281#ifdef EXPERIMENTAL_DANE
0e66b3b6
JH
2282if (tlsa_dnsa)
2283 if ((rc = dane_tlsa_load(client_ssl, host, tlsa_dnsa)) != OK)
594706ea
JH
2284 return rc;
2285#endif
2286
f2de3a33 2287#ifndef DISABLE_OCSP
f5d78688
JH
2288/* Request certificate status at connection-time. If the server
2289does OCSP stapling we will get the callback (set in tls_init()) */
b50c8b84 2290# ifdef EXPERIMENTAL_DANE
44662487
JH
2291if (request_ocsp)
2292 {
594706ea 2293 const uschar * s;
41afb5cb
JH
2294 if ( ((s = ob->hosts_require_ocsp) && Ustrstr(s, US"tls_out_tlsa_usage"))
2295 || ((s = ob->hosts_request_ocsp) && Ustrstr(s, US"tls_out_tlsa_usage"))
594706ea
JH
2296 )
2297 { /* Re-eval now $tls_out_tlsa_usage is populated. If
2298 this means we avoid the OCSP request, we wasted the setup
2299 cost in tls_init(). */
5130845b
JH
2300 require_ocsp = verify_check_given_host(&ob->hosts_require_ocsp, host) == OK;
2301 request_ocsp = require_ocsp
2302 || verify_check_given_host(&ob->hosts_request_ocsp, host) == OK;
594706ea
JH
2303 }
2304 }
b50c8b84
JH
2305# endif
2306
594706ea
JH
2307if (request_ocsp)
2308 {
f5d78688 2309 SSL_set_tlsext_status_type(client_ssl, TLSEXT_STATUSTYPE_ocsp);
44662487
JH
2310 client_static_cbinfo->u_ocsp.client.verify_required = require_ocsp;
2311 tls_out.ocsp = OCSP_NOT_RESP;
2312 }
f5d78688
JH
2313#endif
2314
0cbf2b82 2315#ifndef DISABLE_EVENT
774ef2d7 2316client_static_cbinfo->event_action = tb->event_action;
a7538db1 2317#endif
043b1248 2318
059ec3d9
PH
2319/* There doesn't seem to be a built-in timeout on connection. */
2320
2321DEBUG(D_tls) debug_printf("Calling SSL_connect\n");
2322sigalrm_seen = FALSE;
65867078 2323alarm(ob->command_timeout);
817d9f57 2324rc = SSL_connect(client_ssl);
059ec3d9
PH
2325alarm(0);
2326
043b1248 2327#ifdef EXPERIMENTAL_DANE
0e66b3b6 2328if (tlsa_dnsa)
fde080a4 2329 DANESSL_cleanup(client_ssl);
043b1248
JH
2330#endif
2331
059ec3d9 2332if (rc <= 0)
7199e1ee 2333 return tls_error(US"SSL_connect", host, sigalrm_seen ? US"timed out" : NULL);
059ec3d9
PH
2334
2335DEBUG(D_tls) debug_printf("SSL_connect succeeded\n");
2336
f69979cf 2337peer_cert(client_ssl, &tls_out, peerdn, sizeof(peerdn));
059ec3d9 2338
817d9f57
JH
2339construct_cipher_name(client_ssl, cipherbuf, sizeof(cipherbuf), &tls_out.bits);
2340tls_out.cipher = cipherbuf;
059ec3d9 2341
9d1c15ef
JH
2342/* Record the certificate we presented */
2343 {
2344 X509 * crt = SSL_get_certificate(client_ssl);
2345 tls_out.ourcert = crt ? X509_dup(crt) : NULL;
2346 }
2347
817d9f57 2348tls_out.active = fd;
059ec3d9
PH
2349return OK;
2350}
2351
2352
2353
2354
2355
2356/*************************************************
2357* TLS version of getc *
2358*************************************************/
2359
2360/* This gets the next byte from the TLS input buffer. If the buffer is empty,
2361it refills the buffer via the SSL reading function.
2362
bd8fbe36 2363Arguments: lim Maximum amount to read/buffer
059ec3d9 2364Returns: the next character or EOF
817d9f57
JH
2365
2366Only used by the server-side TLS.
059ec3d9
PH
2367*/
2368
2369int
bd8fbe36 2370tls_getc(unsigned lim)
059ec3d9
PH
2371{
2372if (ssl_xfer_buffer_lwm >= ssl_xfer_buffer_hwm)
2373 {
2374 int error;
2375 int inbytes;
2376
817d9f57 2377 DEBUG(D_tls) debug_printf("Calling SSL_read(%p, %p, %u)\n", server_ssl,
c80c5570 2378 ssl_xfer_buffer, ssl_xfer_buffer_size);
059ec3d9
PH
2379
2380 if (smtp_receive_timeout > 0) alarm(smtp_receive_timeout);
bd8fbe36
JH
2381 inbytes = SSL_read(server_ssl, CS ssl_xfer_buffer,
2382 MIN(ssl_xfer_buffer_size, lim));
817d9f57 2383 error = SSL_get_error(server_ssl, inbytes);
059ec3d9
PH
2384 alarm(0);
2385
2386 /* SSL_ERROR_ZERO_RETURN appears to mean that the SSL session has been
2387 closed down, not that the socket itself has been closed down. Revert to
2388 non-SSL handling. */
2389
2390 if (error == SSL_ERROR_ZERO_RETURN)
2391 {
2392 DEBUG(D_tls) debug_printf("Got SSL_ERROR_ZERO_RETURN\n");
2393
2394 receive_getc = smtp_getc;
584e96c6 2395 receive_get_cache = smtp_get_cache;
059ec3d9
PH
2396 receive_ungetc = smtp_ungetc;
2397 receive_feof = smtp_feof;
2398 receive_ferror = smtp_ferror;
58eb016e 2399 receive_smtp_buffered = smtp_buffered;
059ec3d9 2400
817d9f57
JH
2401 SSL_free(server_ssl);
2402 server_ssl = NULL;
2403 tls_in.active = -1;
2404 tls_in.bits = 0;
2405 tls_in.cipher = NULL;
2406 tls_in.peerdn = NULL;
2407 tls_in.sni = NULL;
059ec3d9 2408
bd8fbe36 2409 return smtp_getc(lim);
059ec3d9
PH
2410 }
2411
2412 /* Handle genuine errors */
2413
ba084640
PP
2414 else if (error == SSL_ERROR_SSL)
2415 {
2416 ERR_error_string(ERR_get_error(), ssl_errstring);
89dd51cd 2417 log_write(0, LOG_MAIN, "TLS error (SSL_read): %s", ssl_errstring);
ba084640
PP
2418 ssl_xfer_error = 1;
2419 return EOF;
2420 }
2421
059ec3d9
PH
2422 else if (error != SSL_ERROR_NONE)
2423 {
2424 DEBUG(D_tls) debug_printf("Got SSL error %d\n", error);
2425 ssl_xfer_error = 1;
2426 return EOF;
2427 }
c80c5570 2428
80a47a2c
TK
2429#ifndef DISABLE_DKIM
2430 dkim_exim_verify_feed(ssl_xfer_buffer, inbytes);
2431#endif
059ec3d9
PH
2432 ssl_xfer_buffer_hwm = inbytes;
2433 ssl_xfer_buffer_lwm = 0;
2434 }
2435
2436/* Something in the buffer; return next uschar */
2437
2438return ssl_xfer_buffer[ssl_xfer_buffer_lwm++];
2439}
2440
584e96c6
JH
2441void
2442tls_get_cache()
2443{
9960d1e5 2444#ifndef DISABLE_DKIM
584e96c6
JH
2445int n = ssl_xfer_buffer_hwm - ssl_xfer_buffer_lwm;
2446if (n > 0)
2447 dkim_exim_verify_feed(ssl_xfer_buffer+ssl_xfer_buffer_lwm, n);
584e96c6 2448#endif
9960d1e5 2449}
584e96c6 2450
059ec3d9
PH
2451
2452
2453/*************************************************
2454* Read bytes from TLS channel *
2455*************************************************/
2456
2457/*
2458Arguments:
2459 buff buffer of data
2460 len size of buffer
2461
2462Returns: the number of bytes read
2463 -1 after a failed read
817d9f57
JH
2464
2465Only used by the client-side TLS.
059ec3d9
PH
2466*/
2467
2468int
389ca47a 2469tls_read(BOOL is_server, uschar *buff, size_t len)
059ec3d9 2470{
389ca47a 2471SSL *ssl = is_server ? server_ssl : client_ssl;
059ec3d9
PH
2472int inbytes;
2473int error;
2474
389ca47a 2475DEBUG(D_tls) debug_printf("Calling SSL_read(%p, %p, %u)\n", ssl,
c80c5570 2476 buff, (unsigned int)len);
059ec3d9 2477
389ca47a
JH
2478inbytes = SSL_read(ssl, CS buff, len);
2479error = SSL_get_error(ssl, inbytes);
059ec3d9
PH
2480
2481if (error == SSL_ERROR_ZERO_RETURN)
2482 {
2483 DEBUG(D_tls) debug_printf("Got SSL_ERROR_ZERO_RETURN\n");
2484 return -1;
2485 }
2486else if (error != SSL_ERROR_NONE)
2487 {
2488 return -1;
2489 }
2490
2491return inbytes;
2492}
2493
2494
2495
2496
2497
2498/*************************************************
2499* Write bytes down TLS channel *
2500*************************************************/
2501
2502/*
2503Arguments:
817d9f57 2504 is_server channel specifier
059ec3d9
PH
2505 buff buffer of data
2506 len number of bytes
2507
2508Returns: the number of bytes after a successful write,
2509 -1 after a failed write
817d9f57
JH
2510
2511Used by both server-side and client-side TLS.
059ec3d9
PH
2512*/
2513
2514int
817d9f57 2515tls_write(BOOL is_server, const uschar *buff, size_t len)
059ec3d9
PH
2516{
2517int outbytes;
2518int error;
2519int left = len;
817d9f57 2520SSL *ssl = is_server ? server_ssl : client_ssl;
059ec3d9 2521
c80c5570 2522DEBUG(D_tls) debug_printf("tls_do_write(%p, %d)\n", buff, left);
059ec3d9
PH
2523while (left > 0)
2524 {
c80c5570 2525 DEBUG(D_tls) debug_printf("SSL_write(SSL, %p, %d)\n", buff, left);
059ec3d9
PH
2526 outbytes = SSL_write(ssl, CS buff, left);
2527 error = SSL_get_error(ssl, outbytes);
2528 DEBUG(D_tls) debug_printf("outbytes=%d error=%d\n", outbytes, error);
2529 switch (error)
2530 {
2531 case SSL_ERROR_SSL:
96f5fe4c
JH
2532 ERR_error_string(ERR_get_error(), ssl_errstring);
2533 log_write(0, LOG_MAIN, "TLS error (SSL_write): %s", ssl_errstring);
2534 return -1;
059ec3d9
PH
2535
2536 case SSL_ERROR_NONE:
96f5fe4c
JH
2537 left -= outbytes;
2538 buff += outbytes;
2539 break;
059ec3d9
PH
2540
2541 case SSL_ERROR_ZERO_RETURN:
96f5fe4c
JH
2542 log_write(0, LOG_MAIN, "SSL channel closed on write");
2543 return -1;
059ec3d9 2544
817d9f57 2545 case SSL_ERROR_SYSCALL:
96f5fe4c
JH
2546 log_write(0, LOG_MAIN, "SSL_write: (from %s) syscall: %s",
2547 sender_fullhost ? sender_fullhost : US"<unknown>",
2548 strerror(errno));
2549 return -1;
817d9f57 2550
059ec3d9 2551 default:
96f5fe4c
JH
2552 log_write(0, LOG_MAIN, "SSL_write error %d", error);
2553 return -1;
059ec3d9
PH
2554 }
2555 }
2556return len;
2557}
2558
2559
2560
2561/*************************************************
2562* Close down a TLS session *
2563*************************************************/
2564
2565/* This is also called from within a delivery subprocess forked from the
2566daemon, to shut down the TLS library, without actually doing a shutdown (which
2567would tamper with the SSL session in the parent process).
2568
2569Arguments: TRUE if SSL_shutdown is to be called
2570Returns: nothing
817d9f57
JH
2571
2572Used by both server-side and client-side TLS.
059ec3d9
PH
2573*/
2574
2575void
817d9f57 2576tls_close(BOOL is_server, BOOL shutdown)
059ec3d9 2577{
817d9f57 2578SSL **sslp = is_server ? &server_ssl : &client_ssl;
389ca47a 2579int *fdp = is_server ? &tls_in.active : &tls_out.active;
817d9f57
JH
2580
2581if (*fdp < 0) return; /* TLS was not active */
059ec3d9
PH
2582
2583if (shutdown)
2584 {
ec8b777a 2585 DEBUG(D_tls) debug_printf("tls_close(): shutting down SSL\n");
817d9f57 2586 SSL_shutdown(*sslp);
059ec3d9
PH
2587 }
2588
817d9f57
JH
2589SSL_free(*sslp);
2590*sslp = NULL;
059ec3d9 2591
817d9f57 2592*fdp = -1;
059ec3d9
PH
2593}
2594
36f12725
NM
2595
2596
2597
2598/*************************************************
3375e053
PP
2599* Let tls_require_ciphers be checked at startup *
2600*************************************************/
2601
2602/* The tls_require_ciphers option, if set, must be something which the
2603library can parse.
2604
2605Returns: NULL on success, or error message
2606*/
2607
2608uschar *
2609tls_validate_require_cipher(void)
2610{
2611SSL_CTX *ctx;
2612uschar *s, *expciphers, *err;
2613
2614/* this duplicates from tls_init(), we need a better "init just global
2615state, for no specific purpose" singleton function of our own */
2616
2617SSL_load_error_strings();
2618OpenSSL_add_ssl_algorithms();
2619#if (OPENSSL_VERSION_NUMBER >= 0x0090800fL) && !defined(OPENSSL_NO_SHA256)
2620/* SHA256 is becoming ever more popular. This makes sure it gets added to the
2621list of available digests. */
2622EVP_add_digest(EVP_sha256());
2623#endif
2624
2625if (!(tls_require_ciphers && *tls_require_ciphers))
2626 return NULL;
2627
2628if (!expand_check(tls_require_ciphers, US"tls_require_ciphers", &expciphers))
2629 return US"failed to expand tls_require_ciphers";
2630
2631if (!(expciphers && *expciphers))
2632 return NULL;
2633
2634/* normalisation ripped from above */
2635s = expciphers;
2636while (*s != 0) { if (*s == '_') *s = '-'; s++; }
2637
2638err = NULL;
2639
2640ctx = SSL_CTX_new(SSLv23_server_method());
2641if (!ctx)
2642 {
2643 ERR_error_string(ERR_get_error(), ssl_errstring);
2644 return string_sprintf("SSL_CTX_new() failed: %s", ssl_errstring);
2645 }
2646
2647DEBUG(D_tls)
2648 debug_printf("tls_require_ciphers expands to \"%s\"\n", expciphers);
2649
2650if (!SSL_CTX_set_cipher_list(ctx, CS expciphers))
2651 {
2652 ERR_error_string(ERR_get_error(), ssl_errstring);
2653 err = string_sprintf("SSL_CTX_set_cipher_list(%s) failed", expciphers);
2654 }
2655
2656SSL_CTX_free(ctx);
2657
2658return err;
2659}
2660
2661
2662
2663
2664/*************************************************
36f12725
NM
2665* Report the library versions. *
2666*************************************************/
2667
2668/* There have historically been some issues with binary compatibility in
2669OpenSSL libraries; if Exim (like many other applications) is built against
2670one version of OpenSSL but the run-time linker picks up another version,
2671it can result in serious failures, including crashing with a SIGSEGV. So
2672report the version found by the compiler and the run-time version.
2673
f64a1e23
PP
2674Note: some OS vendors backport security fixes without changing the version
2675number/string, and the version date remains unchanged. The _build_ date
2676will change, so we can more usefully assist with version diagnosis by also
2677reporting the build date.
2678
36f12725
NM
2679Arguments: a FILE* to print the results to
2680Returns: nothing
2681*/
2682
2683void
2684tls_version_report(FILE *f)
2685{
754a0503 2686fprintf(f, "Library version: OpenSSL: Compile: %s\n"
f64a1e23
PP
2687 " Runtime: %s\n"
2688 " : %s\n",
754a0503 2689 OPENSSL_VERSION_TEXT,
f64a1e23
PP
2690 SSLeay_version(SSLEAY_VERSION),
2691 SSLeay_version(SSLEAY_BUILT_ON));
2692/* third line is 38 characters for the %s and the line is 73 chars long;
2693the OpenSSL output includes a "built on: " prefix already. */
36f12725
NM
2694}
2695
9e3331ea
TK
2696
2697
2698
2699/*************************************************
17c76198 2700* Random number generation *
9e3331ea
TK
2701*************************************************/
2702
2703/* Pseudo-random number generation. The result is not expected to be
2704cryptographically strong but not so weak that someone will shoot themselves
2705in the foot using it as a nonce in input in some email header scheme or
2706whatever weirdness they'll twist this into. The result should handle fork()
2707and avoid repeating sequences. OpenSSL handles that for us.
2708
2709Arguments:
2710 max range maximum
2711Returns a random number in range [0, max-1]
2712*/
2713
2714int
17c76198 2715vaguely_random_number(int max)
9e3331ea
TK
2716{
2717unsigned int r;
2718int i, needed_len;
de6135a0
PP
2719static pid_t pidlast = 0;
2720pid_t pidnow;
9e3331ea
TK
2721uschar *p;
2722uschar smallbuf[sizeof(r)];
2723
2724if (max <= 1)
2725 return 0;
2726
de6135a0
PP
2727pidnow = getpid();
2728if (pidnow != pidlast)
2729 {
2730 /* Although OpenSSL documents that "OpenSSL makes sure that the PRNG state
2731 is unique for each thread", this doesn't apparently apply across processes,
2732 so our own warning from vaguely_random_number_fallback() applies here too.
2733 Fix per PostgreSQL. */
2734 if (pidlast != 0)
2735 RAND_cleanup();
2736 pidlast = pidnow;
2737 }
2738
9e3331ea
TK
2739/* OpenSSL auto-seeds from /dev/random, etc, but this a double-check. */
2740if (!RAND_status())
2741 {
2742 randstuff r;
2743 gettimeofday(&r.tv, NULL);
2744 r.p = getpid();
2745
2746 RAND_seed((uschar *)(&r), sizeof(r));
2747 }
2748/* We're after pseudo-random, not random; if we still don't have enough data
2749in the internal PRNG then our options are limited. We could sleep and hope
2750for entropy to come along (prayer technique) but if the system is so depleted
2751in the first place then something is likely to just keep taking it. Instead,
2752we'll just take whatever little bit of pseudo-random we can still manage to
2753get. */
2754
2755needed_len = sizeof(r);
2756/* Don't take 8 times more entropy than needed if int is 8 octets and we were
2757asked for a number less than 10. */
2758for (r = max, i = 0; r; ++i)
2759 r >>= 1;
2760i = (i + 7) / 8;
2761if (i < needed_len)
2762 needed_len = i;
2763
c8dfb21d 2764#ifdef EXIM_HAVE_RAND_PSEUDO
9e3331ea 2765/* We do not care if crypto-strong */
17c76198 2766i = RAND_pseudo_bytes(smallbuf, needed_len);
c8dfb21d
JH
2767#else
2768i = RAND_bytes(smallbuf, needed_len);
2769#endif
2770
17c76198
PP
2771if (i < 0)
2772 {
2773 DEBUG(D_all)
2774 debug_printf("OpenSSL RAND_pseudo_bytes() not supported by RAND method, using fallback.\n");
2775 return vaguely_random_number_fallback(max);
2776 }
2777
9e3331ea
TK
2778r = 0;
2779for (p = smallbuf; needed_len; --needed_len, ++p)
2780 {
2781 r *= 256;
2782 r += *p;
2783 }
2784
2785/* We don't particularly care about weighted results; if someone wants
2786smooth distribution and cares enough then they should submit a patch then. */
2787return r % max;
2788}
2789
77bb000f
PP
2790
2791
2792
2793/*************************************************
2794* OpenSSL option parse *
2795*************************************************/
2796
2797/* Parse one option for tls_openssl_options_parse below
2798
2799Arguments:
2800 name one option name
2801 value place to store a value for it
2802Returns success or failure in parsing
2803*/
2804
2805struct exim_openssl_option {
2806 uschar *name;
2807 long value;
2808};
2809/* We could use a macro to expand, but we need the ifdef and not all the
2810options document which version they were introduced in. Policylet: include
2811all options unless explicitly for DTLS, let the administrator choose which
2812to apply.
2813
2814This list is current as of:
e2fbf4a2
PP
2815 ==> 1.0.1b <==
2816Plus SSL_OP_SAFARI_ECDHE_ECDSA_BUG from 2013-June patch/discussion on openssl-dev
2817*/
77bb000f
PP
2818static struct exim_openssl_option exim_openssl_options[] = {
2819/* KEEP SORTED ALPHABETICALLY! */
2820#ifdef SSL_OP_ALL
73a46702 2821 { US"all", SSL_OP_ALL },
77bb000f
PP
2822#endif
2823#ifdef SSL_OP_ALLOW_UNSAFE_LEGACY_RENEGOTIATION
73a46702 2824 { US"allow_unsafe_legacy_renegotiation", SSL_OP_ALLOW_UNSAFE_LEGACY_RENEGOTIATION },
77bb000f
PP
2825#endif
2826#ifdef SSL_OP_CIPHER_SERVER_PREFERENCE
73a46702 2827 { US"cipher_server_preference", SSL_OP_CIPHER_SERVER_PREFERENCE },
77bb000f
PP
2828#endif
2829#ifdef SSL_OP_DONT_INSERT_EMPTY_FRAGMENTS
73a46702 2830 { US"dont_insert_empty_fragments", SSL_OP_DONT_INSERT_EMPTY_FRAGMENTS },
77bb000f
PP
2831#endif
2832#ifdef SSL_OP_EPHEMERAL_RSA
73a46702 2833 { US"ephemeral_rsa", SSL_OP_EPHEMERAL_RSA },
77bb000f
PP
2834#endif
2835#ifdef SSL_OP_LEGACY_SERVER_CONNECT
73a46702 2836 { US"legacy_server_connect", SSL_OP_LEGACY_SERVER_CONNECT },
77bb000f
PP
2837#endif
2838#ifdef SSL_OP_MICROSOFT_BIG_SSLV3_BUFFER
73a46702 2839 { US"microsoft_big_sslv3_buffer", SSL_OP_MICROSOFT_BIG_SSLV3_BUFFER },
77bb000f
PP
2840#endif
2841#ifdef SSL_OP_MICROSOFT_SESS_ID_BUG
73a46702 2842 { US"microsoft_sess_id_bug", SSL_OP_MICROSOFT_SESS_ID_BUG },
77bb000f
PP
2843#endif
2844#ifdef SSL_OP_MSIE_SSLV2_RSA_PADDING
73a46702 2845 { US"msie_sslv2_rsa_padding", SSL_OP_MSIE_SSLV2_RSA_PADDING },
77bb000f
PP
2846#endif
2847#ifdef SSL_OP_NETSCAPE_CHALLENGE_BUG
73a46702 2848 { US"netscape_challenge_bug", SSL_OP_NETSCAPE_CHALLENGE_BUG },
77bb000f
PP
2849#endif
2850#ifdef SSL_OP_NETSCAPE_REUSE_CIPHER_CHANGE_BUG
73a46702 2851 { US"netscape_reuse_cipher_change_bug", SSL_OP_NETSCAPE_REUSE_CIPHER_CHANGE_BUG },
77bb000f 2852#endif
c80c5570
PP
2853#ifdef SSL_OP_NO_COMPRESSION
2854 { US"no_compression", SSL_OP_NO_COMPRESSION },
2855#endif
77bb000f 2856#ifdef SSL_OP_NO_SESSION_RESUMPTION_ON_RENEGOTIATION
73a46702 2857 { US"no_session_resumption_on_renegotiation", SSL_OP_NO_SESSION_RESUMPTION_ON_RENEGOTIATION },
77bb000f 2858#endif
c0c7b2da
PP
2859#ifdef SSL_OP_NO_SSLv2
2860 { US"no_sslv2", SSL_OP_NO_SSLv2 },
2861#endif
2862#ifdef SSL_OP_NO_SSLv3
2863 { US"no_sslv3", SSL_OP_NO_SSLv3 },
2864#endif
2865#ifdef SSL_OP_NO_TICKET
2866 { US"no_ticket", SSL_OP_NO_TICKET },
2867#endif
2868#ifdef SSL_OP_NO_TLSv1
2869 { US"no_tlsv1", SSL_OP_NO_TLSv1 },
2870#endif
c80c5570
PP
2871#ifdef SSL_OP_NO_TLSv1_1
2872#if SSL_OP_NO_TLSv1_1 == 0x00000400L
2873 /* Error in chosen value in 1.0.1a; see first item in CHANGES for 1.0.1b */
2874#warning OpenSSL 1.0.1a uses a bad value for SSL_OP_NO_TLSv1_1, ignoring
2875#else
2876 { US"no_tlsv1_1", SSL_OP_NO_TLSv1_1 },
2877#endif
2878#endif
2879#ifdef SSL_OP_NO_TLSv1_2
2880 { US"no_tlsv1_2", SSL_OP_NO_TLSv1_2 },
2881#endif
e2fbf4a2
PP
2882#ifdef SSL_OP_SAFARI_ECDHE_ECDSA_BUG
2883 { US"safari_ecdhe_ecdsa_bug", SSL_OP_SAFARI_ECDHE_ECDSA_BUG },
2884#endif
77bb000f 2885#ifdef SSL_OP_SINGLE_DH_USE
73a46702 2886 { US"single_dh_use", SSL_OP_SINGLE_DH_USE },
77bb000f
PP
2887#endif
2888#ifdef SSL_OP_SINGLE_ECDH_USE
73a46702 2889 { US"single_ecdh_use", SSL_OP_SINGLE_ECDH_USE },
77bb000f
PP
2890#endif
2891#ifdef SSL_OP_SSLEAY_080_CLIENT_DH_BUG
73a46702 2892 { US"ssleay_080_client_dh_bug", SSL_OP_SSLEAY_080_CLIENT_DH_BUG },
77bb000f
PP
2893#endif
2894#ifdef SSL_OP_SSLREF2_REUSE_CERT_TYPE_BUG
73a46702 2895 { US"sslref2_reuse_cert_type_bug", SSL_OP_SSLREF2_REUSE_CERT_TYPE_BUG },
77bb000f
PP
2896#endif
2897#ifdef SSL_OP_TLS_BLOCK_PADDING_BUG
73a46702 2898 { US"tls_block_padding_bug", SSL_OP_TLS_BLOCK_PADDING_BUG },
77bb000f
PP
2899#endif
2900#ifdef SSL_OP_TLS_D5_BUG
73a46702 2901 { US"tls_d5_bug", SSL_OP_TLS_D5_BUG },
77bb000f
PP
2902#endif
2903#ifdef SSL_OP_TLS_ROLLBACK_BUG
73a46702 2904 { US"tls_rollback_bug", SSL_OP_TLS_ROLLBACK_BUG },
77bb000f
PP
2905#endif
2906};
2907static int exim_openssl_options_size =
2908 sizeof(exim_openssl_options)/sizeof(struct exim_openssl_option);
2909
c80c5570 2910
77bb000f
PP
2911static BOOL
2912tls_openssl_one_option_parse(uschar *name, long *value)
2913{
2914int first = 0;
2915int last = exim_openssl_options_size;
2916while (last > first)
2917 {
2918 int middle = (first + last)/2;
2919 int c = Ustrcmp(name, exim_openssl_options[middle].name);
2920 if (c == 0)
2921 {
2922 *value = exim_openssl_options[middle].value;
2923 return TRUE;
2924 }
2925 else if (c > 0)
2926 first = middle + 1;
2927 else
2928 last = middle;
2929 }
2930return FALSE;
2931}
2932
2933
2934
2935
2936/*************************************************
2937* OpenSSL option parsing logic *
2938*************************************************/
2939
2940/* OpenSSL has a number of compatibility options which an administrator might
2941reasonably wish to set. Interpret a list similarly to decode_bits(), so that
2942we look like log_selector.
2943
2944Arguments:
2945 option_spec the administrator-supplied string of options
2946 results ptr to long storage for the options bitmap
2947Returns success or failure
2948*/
2949
2950BOOL
2951tls_openssl_options_parse(uschar *option_spec, long *results)
2952{
2953long result, item;
2954uschar *s, *end;
2955uschar keep_c;
2956BOOL adding, item_parsed;
2957
0e944a0d 2958result = 0L;
b1770b6e 2959/* Prior to 4.80 we or'd in SSL_OP_DONT_INSERT_EMPTY_FRAGMENTS; removed
da3ad30d 2960 * from default because it increases BEAST susceptibility. */
f0f5a555
PP
2961#ifdef SSL_OP_NO_SSLv2
2962result |= SSL_OP_NO_SSLv2;
2963#endif
a57b6200
JH
2964#ifdef SSL_OP_SINGLE_DH_USE
2965result |= SSL_OP_SINGLE_DH_USE;
2966#endif
77bb000f
PP
2967
2968if (option_spec == NULL)
2969 {
2970 *results = result;
2971 return TRUE;
2972 }
2973
2974for (s=option_spec; *s != '\0'; /**/)
2975 {
2976 while (isspace(*s)) ++s;
2977 if (*s == '\0')
2978 break;
2979 if (*s != '+' && *s != '-')
2980 {
2981 DEBUG(D_tls) debug_printf("malformed openssl option setting: "
0e944a0d 2982 "+ or - expected but found \"%s\"\n", s);
77bb000f
PP
2983 return FALSE;
2984 }
2985 adding = *s++ == '+';
2986 for (end = s; (*end != '\0') && !isspace(*end); ++end) /**/ ;
2987 keep_c = *end;
2988 *end = '\0';
2989 item_parsed = tls_openssl_one_option_parse(s, &item);
96f5fe4c 2990 *end = keep_c;
77bb000f
PP
2991 if (!item_parsed)
2992 {
0e944a0d 2993 DEBUG(D_tls) debug_printf("openssl option setting unrecognised: \"%s\"\n", s);
77bb000f
PP
2994 return FALSE;
2995 }
2996 DEBUG(D_tls) debug_printf("openssl option, %s from %lx: %lx (%s)\n",
2997 adding ? "adding" : "removing", result, item, s);
2998 if (adding)
2999 result |= item;
3000 else
3001 result &= ~item;
77bb000f
PP
3002 s = end;
3003 }
3004
3005*results = result;
3006return TRUE;
3007}
3008
9d1c15ef
JH
3009/* vi: aw ai sw=2
3010*/
059ec3d9 3011/* End of tls-openssl.c */