GnuTLS: Move to more-modern stapling API
[exim.git] / src / src / tls-openssl.c
CommitLineData
059ec3d9
PH
1/*************************************************
2* Exim - an Internet mail transport agent *
3*************************************************/
4
b10c87b3 5/* Copyright (c) University of Cambridge 1995 - 2019 */
059ec3d9
PH
6/* See the file NOTICE for conditions of use and distribution. */
7
f5d78688
JH
8/* Portions Copyright (c) The OpenSSL Project 1999 */
9
059ec3d9
PH
10/* This module provides the TLS (aka SSL) support for Exim using the OpenSSL
11library. It is #included into the tls.c file when that library is used. The
12code herein is based on a patch that was originally contributed by Steve
13Haslam. It was adapted from stunnel, a GPL program by Michal Trojnara.
14
15No cryptographic code is included in Exim. All this module does is to call
16functions from the OpenSSL library. */
17
18
19/* Heading stuff */
20
21#include <openssl/lhash.h>
22#include <openssl/ssl.h>
23#include <openssl/err.h>
24#include <openssl/rand.h>
10ca4f1c
JH
25#ifndef OPENSSL_NO_ECDH
26# include <openssl/ec.h>
27#endif
f2de3a33 28#ifndef DISABLE_OCSP
e51c7be2 29# include <openssl/ocsp.h>
3f7eeb86 30#endif
c0635b6d 31#ifdef SUPPORT_DANE
05e796ad 32# include "danessl.h"
85098ee7
JH
33#endif
34
3f7eeb86 35
f2de3a33
JH
36#ifndef DISABLE_OCSP
37# define EXIM_OCSP_SKEW_SECONDS (300L)
38# define EXIM_OCSP_MAX_AGE (-1L)
3f7eeb86 39#endif
059ec3d9 40
3bcbbbe2 41#if OPENSSL_VERSION_NUMBER >= 0x0090806fL && !defined(OPENSSL_NO_TLSEXT)
e51c7be2 42# define EXIM_HAVE_OPENSSL_TLSEXT
3bcbbbe2 43#endif
c8dfb21d
JH
44#if OPENSSL_VERSION_NUMBER >= 0x00908000L
45# define EXIM_HAVE_RSA_GENKEY_EX
46#endif
47#if OPENSSL_VERSION_NUMBER >= 0x10100000L
48# define EXIM_HAVE_OCSP_RESP_COUNT
49#else
50# define EXIM_HAVE_EPHEM_RSA_KEX
51# define EXIM_HAVE_RAND_PSEUDO
52#endif
53#if (OPENSSL_VERSION_NUMBER >= 0x0090800fL) && !defined(OPENSSL_NO_SHA256)
8442641e 54# define EXIM_HAVE_SHA256
c8dfb21d 55#endif
34e3241d 56
d7978c0f
JH
57/* X509_check_host provides sane certificate hostname checking, but was added
58to OpenSSL late, after other projects forked off the code-base. So in
59addition to guarding against the base version number, beware that LibreSSL
60does not (at this time) support this function.
61
62If LibreSSL gains a different API, perhaps via libtls, then we'll probably
63opt to disentangle and ask a LibreSSL user to provide glue for a third
64crypto provider for libtls instead of continuing to tie the OpenSSL glue
65into even twistier knots. If LibreSSL gains the same API, we can just
66change this guard and punt the issue for a while longer. */
67
34e3241d
PP
68#ifndef LIBRESSL_VERSION_NUMBER
69# if OPENSSL_VERSION_NUMBER >= 0x010100000L
70# define EXIM_HAVE_OPENSSL_CHECKHOST
8420742d 71# define EXIM_HAVE_OPENSSL_DH_BITS
7a8b9519 72# define EXIM_HAVE_OPENSSL_TLS_METHOD
f20cfa4a 73# define EXIM_HAVE_OPENSSL_KEYLOG
f1be21cf 74# define EXIM_HAVE_OPENSSL_CIPHER_GET_ID
b10c87b3 75# define EXIM_HAVE_SESSION_TICKET
e570d136 76# define EXIM_HAVE_OPESSL_TRACE
7434882d
JH
77# else
78# define EXIM_NEED_OPENSSL_INIT
34e3241d
PP
79# endif
80# if OPENSSL_VERSION_NUMBER >= 0x010000000L \
2dfb468b 81 && (OPENSSL_VERSION_NUMBER & 0x0000ff000L) >= 0x000002000L
34e3241d
PP
82# define EXIM_HAVE_OPENSSL_CHECKHOST
83# endif
11aa88b0 84#endif
10ca4f1c 85
11aa88b0
RA
86#if !defined(LIBRESSL_VERSION_NUMBER) \
87 || LIBRESSL_VERSION_NUMBER >= 0x20010000L
10ca4f1c
JH
88# if !defined(OPENSSL_NO_ECDH)
89# if OPENSSL_VERSION_NUMBER >= 0x0090800fL
8442641e 90# define EXIM_HAVE_ECDH
10ca4f1c
JH
91# endif
92# if OPENSSL_VERSION_NUMBER >= 0x10002000L
10ca4f1c
JH
93# define EXIM_HAVE_OPENSSL_EC_NIST2NID
94# endif
95# endif
2dfb468b 96#endif
3bcbbbe2 97
8a40db1c
JH
98#ifndef LIBRESSL_VERSION_NUMBER
99# if OPENSSL_VERSION_NUMBER >= 0x010101000L
100# define OPENSSL_HAVE_KEYLOG_CB
d7f31bb6 101# define OPENSSL_HAVE_NUM_TICKETS
f1be21cf 102# define EXIM_HAVE_OPENSSL_CIPHER_STD_NAME
8a40db1c
JH
103# endif
104#endif
105
67791ce4
JH
106#if !defined(EXIM_HAVE_OPENSSL_TLSEXT) && !defined(DISABLE_OCSP)
107# warning "OpenSSL library version too old; define DISABLE_OCSP in Makefile"
108# define DISABLE_OCSP
109#endif
43e2db44
JH
110
111#ifdef EXPERIMENTAL_TLS_RESUME
112# if OPENSSL_VERSION_NUMBER < 0x0101010L
113# error OpenSSL version too old for session-resumption
114# endif
115#endif
67791ce4 116
a6510420
JH
117#ifdef EXIM_HAVE_OPENSSL_CHECKHOST
118# include <openssl/x509v3.h>
119#endif
120
f1be21cf
JH
121#ifndef EXIM_HAVE_OPENSSL_CIPHER_STD_NAME
122# ifndef EXIM_HAVE_OPENSSL_CIPHER_GET_ID
123# define SSL_CIPHER_get_id(c) (c->id)
124# endif
dca6d121
JH
125# ifndef MACRO_PREDEF
126# include "tls-cipher-stdname.c"
127# endif
f1be21cf
JH
128#endif
129
8442641e
JH
130/*************************************************
131* OpenSSL option parse *
132*************************************************/
133
134typedef struct exim_openssl_option {
135 uschar *name;
136 long value;
137} exim_openssl_option;
138/* We could use a macro to expand, but we need the ifdef and not all the
139options document which version they were introduced in. Policylet: include
140all options unless explicitly for DTLS, let the administrator choose which
141to apply.
142
143This list is current as of:
144 ==> 1.0.1b <==
145Plus SSL_OP_SAFARI_ECDHE_ECDSA_BUG from 2013-June patch/discussion on openssl-dev
146Plus SSL_OP_NO_TLSv1_3 for 1.1.2-dev
147*/
148static exim_openssl_option exim_openssl_options[] = {
149/* KEEP SORTED ALPHABETICALLY! */
150#ifdef SSL_OP_ALL
6d95688d 151 { US"all", (long) SSL_OP_ALL },
8442641e
JH
152#endif
153#ifdef SSL_OP_ALLOW_UNSAFE_LEGACY_RENEGOTIATION
154 { US"allow_unsafe_legacy_renegotiation", SSL_OP_ALLOW_UNSAFE_LEGACY_RENEGOTIATION },
155#endif
156#ifdef SSL_OP_CIPHER_SERVER_PREFERENCE
157 { US"cipher_server_preference", SSL_OP_CIPHER_SERVER_PREFERENCE },
158#endif
159#ifdef SSL_OP_DONT_INSERT_EMPTY_FRAGMENTS
160 { US"dont_insert_empty_fragments", SSL_OP_DONT_INSERT_EMPTY_FRAGMENTS },
161#endif
162#ifdef SSL_OP_EPHEMERAL_RSA
163 { US"ephemeral_rsa", SSL_OP_EPHEMERAL_RSA },
164#endif
165#ifdef SSL_OP_LEGACY_SERVER_CONNECT
166 { US"legacy_server_connect", SSL_OP_LEGACY_SERVER_CONNECT },
167#endif
168#ifdef SSL_OP_MICROSOFT_BIG_SSLV3_BUFFER
169 { US"microsoft_big_sslv3_buffer", SSL_OP_MICROSOFT_BIG_SSLV3_BUFFER },
170#endif
171#ifdef SSL_OP_MICROSOFT_SESS_ID_BUG
172 { US"microsoft_sess_id_bug", SSL_OP_MICROSOFT_SESS_ID_BUG },
173#endif
174#ifdef SSL_OP_MSIE_SSLV2_RSA_PADDING
175 { US"msie_sslv2_rsa_padding", SSL_OP_MSIE_SSLV2_RSA_PADDING },
176#endif
177#ifdef SSL_OP_NETSCAPE_CHALLENGE_BUG
178 { US"netscape_challenge_bug", SSL_OP_NETSCAPE_CHALLENGE_BUG },
179#endif
180#ifdef SSL_OP_NETSCAPE_REUSE_CIPHER_CHANGE_BUG
181 { US"netscape_reuse_cipher_change_bug", SSL_OP_NETSCAPE_REUSE_CIPHER_CHANGE_BUG },
182#endif
183#ifdef SSL_OP_NO_COMPRESSION
184 { US"no_compression", SSL_OP_NO_COMPRESSION },
185#endif
186#ifdef SSL_OP_NO_SESSION_RESUMPTION_ON_RENEGOTIATION
187 { US"no_session_resumption_on_renegotiation", SSL_OP_NO_SESSION_RESUMPTION_ON_RENEGOTIATION },
188#endif
189#ifdef SSL_OP_NO_SSLv2
190 { US"no_sslv2", SSL_OP_NO_SSLv2 },
191#endif
192#ifdef SSL_OP_NO_SSLv3
193 { US"no_sslv3", SSL_OP_NO_SSLv3 },
194#endif
195#ifdef SSL_OP_NO_TICKET
196 { US"no_ticket", SSL_OP_NO_TICKET },
197#endif
198#ifdef SSL_OP_NO_TLSv1
199 { US"no_tlsv1", SSL_OP_NO_TLSv1 },
200#endif
201#ifdef SSL_OP_NO_TLSv1_1
202#if SSL_OP_NO_TLSv1_1 == 0x00000400L
203 /* Error in chosen value in 1.0.1a; see first item in CHANGES for 1.0.1b */
204#warning OpenSSL 1.0.1a uses a bad value for SSL_OP_NO_TLSv1_1, ignoring
205#else
206 { US"no_tlsv1_1", SSL_OP_NO_TLSv1_1 },
207#endif
208#endif
209#ifdef SSL_OP_NO_TLSv1_2
210 { US"no_tlsv1_2", SSL_OP_NO_TLSv1_2 },
211#endif
212#ifdef SSL_OP_NO_TLSv1_3
213 { US"no_tlsv1_3", SSL_OP_NO_TLSv1_3 },
214#endif
215#ifdef SSL_OP_SAFARI_ECDHE_ECDSA_BUG
216 { US"safari_ecdhe_ecdsa_bug", SSL_OP_SAFARI_ECDHE_ECDSA_BUG },
217#endif
218#ifdef SSL_OP_SINGLE_DH_USE
219 { US"single_dh_use", SSL_OP_SINGLE_DH_USE },
220#endif
221#ifdef SSL_OP_SINGLE_ECDH_USE
222 { US"single_ecdh_use", SSL_OP_SINGLE_ECDH_USE },
223#endif
224#ifdef SSL_OP_SSLEAY_080_CLIENT_DH_BUG
225 { US"ssleay_080_client_dh_bug", SSL_OP_SSLEAY_080_CLIENT_DH_BUG },
226#endif
227#ifdef SSL_OP_SSLREF2_REUSE_CERT_TYPE_BUG
228 { US"sslref2_reuse_cert_type_bug", SSL_OP_SSLREF2_REUSE_CERT_TYPE_BUG },
229#endif
230#ifdef SSL_OP_TLS_BLOCK_PADDING_BUG
231 { US"tls_block_padding_bug", SSL_OP_TLS_BLOCK_PADDING_BUG },
232#endif
233#ifdef SSL_OP_TLS_D5_BUG
234 { US"tls_d5_bug", SSL_OP_TLS_D5_BUG },
235#endif
236#ifdef SSL_OP_TLS_ROLLBACK_BUG
237 { US"tls_rollback_bug", SSL_OP_TLS_ROLLBACK_BUG },
238#endif
239};
240
241#ifndef MACRO_PREDEF
242static int exim_openssl_options_size = nelem(exim_openssl_options);
243#endif
244
245#ifdef MACRO_PREDEF
246void
247options_tls(void)
248{
8442641e
JH
249uschar buf[64];
250
d7978c0f 251for (struct exim_openssl_option * o = exim_openssl_options;
8442641e
JH
252 o < exim_openssl_options + nelem(exim_openssl_options); o++)
253 {
254 /* Trailing X is workaround for problem with _OPT_OPENSSL_NO_TLSV1
255 being a ".ifdef _OPT_OPENSSL_NO_TLSV1_3" match */
256
257 spf(buf, sizeof(buf), US"_OPT_OPENSSL_%T_X", o->name);
258 builtin_macro_create(buf);
259 }
b10c87b3
JH
260
261# ifdef EXPERIMENTAL_TLS_RESUME
262builtin_macro_create_var(US"_RESUME_DECODE", RESUME_DECODE_STRING );
263# endif
8442641e
JH
264}
265#else
266
267/******************************************************************************/
268
059ec3d9
PH
269/* Structure for collecting random data for seeding. */
270
271typedef struct randstuff {
9e3331ea
TK
272 struct timeval tv;
273 pid_t p;
059ec3d9
PH
274} randstuff;
275
276/* Local static variables */
277
a2ff477a
JH
278static BOOL client_verify_callback_called = FALSE;
279static BOOL server_verify_callback_called = FALSE;
059ec3d9
PH
280static const uschar *sid_ctx = US"exim";
281
d4f09789
PP
282/* We have three different contexts to care about.
283
284Simple case: client, `client_ctx`
285 As a client, we can be doing a callout or cut-through delivery while receiving
286 a message. So we have a client context, which should have options initialised
74f1a423
JH
287 from the SMTP Transport. We may also concurrently want to make TLS connections
288 to utility daemons, so client-contexts are allocated and passed around in call
289 args rather than using a gobal.
d4f09789
PP
290
291Server:
292 There are two cases: with and without ServerNameIndication from the client.
293 Given TLS SNI, we can be using different keys, certs and various other
294 configuration settings, because they're re-expanded with $tls_sni set. This
295 allows vhosting with TLS. This SNI is sent in the handshake.
296 A client might not send SNI, so we need a fallback, and an initial setup too.
297 So as a server, we start out using `server_ctx`.
298 If SNI is sent by the client, then we as server, mid-negotiation, try to clone
299 `server_sni` from `server_ctx` and then initialise settings by re-expanding
300 configuration.
301*/
302
74f1a423
JH
303typedef struct {
304 SSL_CTX * ctx;
305 SSL * ssl;
c09dbcfb 306 gstring * corked;
74f1a423
JH
307} exim_openssl_client_tls_ctx;
308
817d9f57 309static SSL_CTX *server_ctx = NULL;
817d9f57 310static SSL *server_ssl = NULL;
389ca47a 311
35731706 312#ifdef EXIM_HAVE_OPENSSL_TLSEXT
817d9f57 313static SSL_CTX *server_sni = NULL;
35731706 314#endif
059ec3d9
PH
315
316static char ssl_errstring[256];
317
dea4b568 318static int ssl_session_timeout = 7200; /* Two hours */
a2ff477a
JH
319static BOOL client_verify_optional = FALSE;
320static BOOL server_verify_optional = FALSE;
059ec3d9 321
f5d78688 322static BOOL reexpand_tls_files_for_sni = FALSE;
059ec3d9
PH
323
324
7be682ca 325typedef struct tls_ext_ctx_cb {
b10c87b3 326 tls_support * tlsp;
7be682ca
PP
327 uschar *certificate;
328 uschar *privatekey;
f5d78688 329 BOOL is_server;
a6510420 330#ifndef DISABLE_OCSP
c3033f13 331 STACK_OF(X509) *verify_stack; /* chain for verifying the proof */
f5d78688
JH
332 union {
333 struct {
334 uschar *file;
335 uschar *file_expanded;
336 OCSP_RESPONSE *response;
337 } server;
338 struct {
44662487
JH
339 X509_STORE *verify_store; /* non-null if status requested */
340 BOOL verify_required;
f5d78688
JH
341 } client;
342 } u_ocsp;
3f7eeb86 343#endif
7be682ca
PP
344 uschar *dhparam;
345 /* these are cached from first expand */
346 uschar *server_cipher_list;
347 /* only passed down to tls_error: */
348 host_item *host;
55414b25 349 const uschar * verify_cert_hostnames;
0cbf2b82 350#ifndef DISABLE_EVENT
a7538db1
JH
351 uschar * event_action;
352#endif
7be682ca
PP
353} tls_ext_ctx_cb;
354
355/* should figure out a cleanup of API to handle state preserved per
356implementation, for various reasons, which can be void * in the APIs.
357For now, we hack around it. */
b10c87b3 358tls_ext_ctx_cb *client_static_cbinfo = NULL; /*XXX should not use static; multiple concurrent clients! */
817d9f57 359tls_ext_ctx_cb *server_static_cbinfo = NULL;
7be682ca
PP
360
361static int
983207c1 362setup_certs(SSL_CTX *sctx, uschar *certs, uschar *crl, host_item *host, BOOL optional,
cf0c6164 363 int (*cert_vfy_cb)(int, X509_STORE_CTX *), uschar ** errstr );
059ec3d9 364
3f7eeb86 365/* Callbacks */
3bcbbbe2 366#ifdef EXIM_HAVE_OPENSSL_TLSEXT
3f7eeb86 367static int tls_servername_cb(SSL *s, int *ad ARG_UNUSED, void *arg);
3bcbbbe2 368#endif
f2de3a33 369#ifndef DISABLE_OCSP
f5d78688 370static int tls_server_stapling_cb(SSL *s, void *arg);
3f7eeb86
PP
371#endif
372
059ec3d9 373
b10c87b3 374
4d93129f 375/* Daemon-called, before every connection, key create/rotate */
b10c87b3
JH
376#ifdef EXPERIMENTAL_TLS_RESUME
377static void tk_init(void);
378static int tls_exdata_idx = -1;
379#endif
380
381void
382tls_daemon_init(void)
383{
384#ifdef EXPERIMENTAL_TLS_RESUME
385tk_init();
386#endif
387return;
388}
389
390
059ec3d9
PH
391/*************************************************
392* Handle TLS error *
393*************************************************/
394
395/* Called from lots of places when errors occur before actually starting to do
396the TLS handshake, that is, while the session is still in clear. Always returns
397DEFER for a server and FAIL for a client so that most calls can use "return
398tls_error(...)" to do this processing and then give an appropriate return. A
399single function is used for both server and client, because it is called from
400some shared functions.
401
402Argument:
403 prefix text to include in the logged error
404 host NULL if setting up a server;
405 the connected host if setting up a client
7199e1ee 406 msg error message or NULL if we should ask OpenSSL
cf0c6164 407 errstr pointer to output error message
059ec3d9
PH
408
409Returns: OK/DEFER/FAIL
410*/
411
412static int
cf0c6164 413tls_error(uschar * prefix, const host_item * host, uschar * msg, uschar ** errstr)
059ec3d9 414{
c562fd30 415if (!msg)
7199e1ee 416 {
0abc5a13 417 ERR_error_string_n(ERR_get_error(), ssl_errstring, sizeof(ssl_errstring));
cf0c6164 418 msg = US ssl_errstring;
7199e1ee
TF
419 }
420
5a2a0989
JH
421msg = string_sprintf("(%s): %s", prefix, msg);
422DEBUG(D_tls) debug_printf("TLS error '%s'\n", msg);
423if (errstr) *errstr = msg;
cf0c6164 424return host ? FAIL : DEFER;
059ec3d9
PH
425}
426
427
428
429/*************************************************
430* Callback to generate RSA key *
431*************************************************/
432
433/*
434Arguments:
3ae79556 435 s SSL connection (not used)
059ec3d9
PH
436 export not used
437 keylength keylength
438
439Returns: pointer to generated key
440*/
441
442static RSA *
443rsa_callback(SSL *s, int export, int keylength)
444{
445RSA *rsa_key;
c8dfb21d
JH
446#ifdef EXIM_HAVE_RSA_GENKEY_EX
447BIGNUM *bn = BN_new();
448#endif
449
059ec3d9
PH
450export = export; /* Shut picky compilers up */
451DEBUG(D_tls) debug_printf("Generating %d bit RSA key...\n", keylength);
c8dfb21d
JH
452
453#ifdef EXIM_HAVE_RSA_GENKEY_EX
454if ( !BN_set_word(bn, (unsigned long)RSA_F4)
f2cb6292 455 || !(rsa_key = RSA_new())
c8dfb21d
JH
456 || !RSA_generate_key_ex(rsa_key, keylength, bn, NULL)
457 )
458#else
23bb6982 459if (!(rsa_key = RSA_generate_key(keylength, RSA_F4, NULL, NULL)))
c8dfb21d
JH
460#endif
461
059ec3d9 462 {
0abc5a13 463 ERR_error_string_n(ERR_get_error(), ssl_errstring, sizeof(ssl_errstring));
059ec3d9
PH
464 log_write(0, LOG_MAIN|LOG_PANIC, "TLS error (RSA_generate_key): %s",
465 ssl_errstring);
466 return NULL;
467 }
468return rsa_key;
469}
470
471
472
f5d78688 473/* Extreme debug
f2de3a33 474#ifndef DISABLE_OCSP
f5d78688
JH
475void
476x509_store_dump_cert_s_names(X509_STORE * store)
477{
478STACK_OF(X509_OBJECT) * roots= store->objs;
f5d78688
JH
479static uschar name[256];
480
d7978c0f 481for (int i= 0; i < sk_X509_OBJECT_num(roots); i++)
f5d78688
JH
482 {
483 X509_OBJECT * tmp_obj= sk_X509_OBJECT_value(roots, i);
484 if(tmp_obj->type == X509_LU_X509)
485 {
70e384dd
JH
486 X509_NAME * sn = X509_get_subject_name(tmp_obj->data.x509);
487 if (X509_NAME_oneline(sn, CS name, sizeof(name)))
488 {
489 name[sizeof(name)-1] = '\0';
490 debug_printf(" %s\n", name);
491 }
f5d78688
JH
492 }
493 }
494}
495#endif
496*/
497
059ec3d9 498
0cbf2b82 499#ifndef DISABLE_EVENT
f69979cf
JH
500static int
501verify_event(tls_support * tlsp, X509 * cert, int depth, const uschar * dn,
502 BOOL *calledp, const BOOL *optionalp, const uschar * what)
503{
504uschar * ev;
505uschar * yield;
506X509 * old_cert;
507
508ev = tlsp == &tls_out ? client_static_cbinfo->event_action : event_action;
509if (ev)
510 {
aaba7d03 511 DEBUG(D_tls) debug_printf("verify_event: %s %d\n", what, depth);
f69979cf
JH
512 old_cert = tlsp->peercert;
513 tlsp->peercert = X509_dup(cert);
514 /* NB we do not bother setting peerdn */
515 if ((yield = event_raise(ev, US"tls:cert", string_sprintf("%d", depth))))
516 {
517 log_write(0, LOG_MAIN, "[%s] %s verify denied by event-action: "
518 "depth=%d cert=%s: %s",
519 tlsp == &tls_out ? deliver_host_address : sender_host_address,
520 what, depth, dn, yield);
521 *calledp = TRUE;
522 if (!*optionalp)
523 {
524 if (old_cert) tlsp->peercert = old_cert; /* restore 1st failing cert */
525 return 1; /* reject (leaving peercert set) */
526 }
527 DEBUG(D_tls) debug_printf("Event-action verify failure overridden "
528 "(host in tls_try_verify_hosts)\n");
4a1bd6b9 529 tlsp->verify_override = TRUE;
f69979cf
JH
530 }
531 X509_free(tlsp->peercert);
532 tlsp->peercert = old_cert;
533 }
534return 0;
535}
536#endif
537
059ec3d9
PH
538/*************************************************
539* Callback for verification *
540*************************************************/
541
542/* The SSL library does certificate verification if set up to do so. This
543callback has the current yes/no state is in "state". If verification succeeded,
f69979cf
JH
544we set the certificate-verified flag. If verification failed, what happens
545depends on whether the client is required to present a verifiable certificate
546or not.
059ec3d9
PH
547
548If verification is optional, we change the state to yes, but still log the
549verification error. For some reason (it really would help to have proper
550documentation of OpenSSL), this callback function then gets called again, this
f69979cf
JH
551time with state = 1. We must take care not to set the private verified flag on
552the second time through.
059ec3d9
PH
553
554Note: this function is not called if the client fails to present a certificate
555when asked. We get here only if a certificate has been received. Handling of
556optional verification for this case is done when requesting SSL to verify, by
557setting SSL_VERIFY_FAIL_IF_NO_PEER_CERT in the non-optional case.
558
a7538db1
JH
559May be called multiple times for different issues with a certificate, even
560for a given "depth" in the certificate chain.
561
059ec3d9 562Arguments:
f2f2c91b
JH
563 preverify_ok current yes/no state as 1/0
564 x509ctx certificate information.
565 tlsp per-direction (client vs. server) support data
566 calledp has-been-called flag
567 optionalp verification-is-optional flag
059ec3d9 568
f2f2c91b 569Returns: 0 if verification should fail, otherwise 1
059ec3d9
PH
570*/
571
572static int
70e384dd
JH
573verify_callback(int preverify_ok, X509_STORE_CTX * x509ctx,
574 tls_support * tlsp, BOOL * calledp, BOOL * optionalp)
059ec3d9 575{
421aff85 576X509 * cert = X509_STORE_CTX_get_current_cert(x509ctx);
a7538db1 577int depth = X509_STORE_CTX_get_error_depth(x509ctx);
f69979cf 578uschar dn[256];
059ec3d9 579
70e384dd
JH
580if (!X509_NAME_oneline(X509_get_subject_name(cert), CS dn, sizeof(dn)))
581 {
582 DEBUG(D_tls) debug_printf("X509_NAME_oneline() error\n");
583 log_write(0, LOG_MAIN, "[%s] SSL verify error: internal error",
584 tlsp == &tls_out ? deliver_host_address : sender_host_address);
585 return 0;
586 }
f69979cf 587dn[sizeof(dn)-1] = '\0';
059ec3d9 588
f4e62a87 589tlsp->verify_override = FALSE;
f2f2c91b 590if (preverify_ok == 0)
059ec3d9 591 {
f77197ae
JH
592 uschar * extra = verify_mode ? string_sprintf(" (during %c-verify for [%s])",
593 *verify_mode, sender_host_address)
594 : US"";
595 log_write(0, LOG_MAIN, "[%s] SSL verify error%s: depth=%d error=%s cert=%s",
596 tlsp == &tls_out ? deliver_host_address : sender_host_address,
597 extra, depth,
598 X509_verify_cert_error_string(X509_STORE_CTX_get_error(x509ctx)), dn);
a2ff477a 599 *calledp = TRUE;
9d1c15ef
JH
600 if (!*optionalp)
601 {
f69979cf
JH
602 if (!tlsp->peercert)
603 tlsp->peercert = X509_dup(cert); /* record failing cert */
604 return 0; /* reject */
9d1c15ef 605 }
059ec3d9
PH
606 DEBUG(D_tls) debug_printf("SSL verify failure overridden (host in "
607 "tls_try_verify_hosts)\n");
4a1bd6b9 608 tlsp->verify_override = TRUE;
059ec3d9
PH
609 }
610
a7538db1 611else if (depth != 0)
059ec3d9 612 {
f69979cf 613 DEBUG(D_tls) debug_printf("SSL verify ok: depth=%d SN=%s\n", depth, dn);
f2de3a33 614#ifndef DISABLE_OCSP
f5d78688
JH
615 if (tlsp == &tls_out && client_static_cbinfo->u_ocsp.client.verify_store)
616 { /* client, wanting stapling */
617 /* Add the server cert's signing chain as the one
618 for the verification of the OCSP stapled information. */
94431adb 619
f5d78688 620 if (!X509_STORE_add_cert(client_static_cbinfo->u_ocsp.client.verify_store,
421aff85 621 cert))
f5d78688 622 ERR_clear_error();
c3033f13 623 sk_X509_push(client_static_cbinfo->verify_stack, cert);
f5d78688
JH
624 }
625#endif
0cbf2b82 626#ifndef DISABLE_EVENT
f69979cf
JH
627 if (verify_event(tlsp, cert, depth, dn, calledp, optionalp, US"SSL"))
628 return 0; /* reject, with peercert set */
a7538db1 629#endif
059ec3d9
PH
630 }
631else
632 {
55414b25 633 const uschar * verify_cert_hostnames;
e51c7be2 634
e51c7be2
JH
635 if ( tlsp == &tls_out
636 && ((verify_cert_hostnames = client_static_cbinfo->verify_cert_hostnames)))
afdb5e9c 637 /* client, wanting hostname check */
e51c7be2 638 {
f69979cf 639
740f36d4 640#ifdef EXIM_HAVE_OPENSSL_CHECKHOST
f69979cf
JH
641# ifndef X509_CHECK_FLAG_NO_PARTIAL_WILDCARDS
642# define X509_CHECK_FLAG_NO_PARTIAL_WILDCARDS 0
643# endif
644# ifndef X509_CHECK_FLAG_SINGLE_LABEL_SUBDOMAINS
645# define X509_CHECK_FLAG_SINGLE_LABEL_SUBDOMAINS 0
646# endif
e51c7be2 647 int sep = 0;
55414b25 648 const uschar * list = verify_cert_hostnames;
e51c7be2 649 uschar * name;
d8e7834a
JH
650 int rc;
651 while ((name = string_nextinlist(&list, &sep, NULL, 0)))
f40d5be3 652 if ((rc = X509_check_host(cert, CCS name, 0,
8d692470 653 X509_CHECK_FLAG_NO_PARTIAL_WILDCARDS
740f36d4
JH
654 | X509_CHECK_FLAG_SINGLE_LABEL_SUBDOMAINS,
655 NULL)))
d8e7834a
JH
656 {
657 if (rc < 0)
658 {
93a6fce2 659 log_write(0, LOG_MAIN, "[%s] SSL verify error: internal error",
f77197ae 660 tlsp == &tls_out ? deliver_host_address : sender_host_address);
d8e7834a
JH
661 name = NULL;
662 }
e51c7be2 663 break;
d8e7834a 664 }
e51c7be2 665 if (!name)
f69979cf 666#else
e51c7be2 667 if (!tls_is_name_for_cert(verify_cert_hostnames, cert))
f69979cf 668#endif
e51c7be2 669 {
f77197ae
JH
670 uschar * extra = verify_mode
671 ? string_sprintf(" (during %c-verify for [%s])",
672 *verify_mode, sender_host_address)
673 : US"";
e51c7be2 674 log_write(0, LOG_MAIN,
f77197ae
JH
675 "[%s] SSL verify error%s: certificate name mismatch: DN=\"%s\" H=\"%s\"",
676 tlsp == &tls_out ? deliver_host_address : sender_host_address,
677 extra, dn, verify_cert_hostnames);
a3ef7310
JH
678 *calledp = TRUE;
679 if (!*optionalp)
f69979cf
JH
680 {
681 if (!tlsp->peercert)
682 tlsp->peercert = X509_dup(cert); /* record failing cert */
683 return 0; /* reject */
684 }
4a1bd6b9 685 DEBUG(D_tls) debug_printf("SSL verify name failure overridden (host in "
a3ef7310 686 "tls_try_verify_hosts)\n");
4a1bd6b9 687 tlsp->verify_override = TRUE;
e51c7be2 688 }
f69979cf 689 }
e51c7be2 690
0cbf2b82 691#ifndef DISABLE_EVENT
f69979cf
JH
692 if (verify_event(tlsp, cert, depth, dn, calledp, optionalp, US"SSL"))
693 return 0; /* reject, with peercert set */
e51c7be2
JH
694#endif
695
93dcb1c2 696 DEBUG(D_tls) debug_printf("SSL%s verify ok: depth=0 SN=%s\n",
f69979cf 697 *calledp ? "" : " authenticated", dn);
93dcb1c2 698 *calledp = TRUE;
059ec3d9
PH
699 }
700
a7538db1 701return 1; /* accept, at least for this level */
059ec3d9
PH
702}
703
a2ff477a 704static int
f2f2c91b 705verify_callback_client(int preverify_ok, X509_STORE_CTX *x509ctx)
a2ff477a 706{
f2f2c91b
JH
707return verify_callback(preverify_ok, x509ctx, &tls_out,
708 &client_verify_callback_called, &client_verify_optional);
a2ff477a
JH
709}
710
711static int
f2f2c91b 712verify_callback_server(int preverify_ok, X509_STORE_CTX *x509ctx)
a2ff477a 713{
f2f2c91b
JH
714return verify_callback(preverify_ok, x509ctx, &tls_in,
715 &server_verify_callback_called, &server_verify_optional);
a2ff477a
JH
716}
717
059ec3d9 718
c0635b6d 719#ifdef SUPPORT_DANE
53a7196b 720
e5cccda9
JH
721/* This gets called *by* the dane library verify callback, which interposes
722itself.
723*/
724static int
f2f2c91b 725verify_callback_client_dane(int preverify_ok, X509_STORE_CTX * x509ctx)
e5cccda9
JH
726{
727X509 * cert = X509_STORE_CTX_get_current_cert(x509ctx);
f69979cf 728uschar dn[256];
83b27293 729int depth = X509_STORE_CTX_get_error_depth(x509ctx);
5c75db2e 730#ifndef DISABLE_EVENT
f69979cf 731BOOL dummy_called, optional = FALSE;
83b27293 732#endif
e5cccda9 733
70e384dd
JH
734if (!X509_NAME_oneline(X509_get_subject_name(cert), CS dn, sizeof(dn)))
735 {
736 DEBUG(D_tls) debug_printf("X509_NAME_oneline() error\n");
737 log_write(0, LOG_MAIN, "[%s] SSL verify error: internal error",
738 deliver_host_address);
739 return 0;
740 }
f69979cf 741dn[sizeof(dn)-1] = '\0';
e5cccda9 742
f2f2c91b
JH
743DEBUG(D_tls) debug_printf("verify_callback_client_dane: %s depth %d %s\n",
744 preverify_ok ? "ok":"BAD", depth, dn);
e5cccda9 745
0cbf2b82 746#ifndef DISABLE_EVENT
f69979cf
JH
747 if (verify_event(&tls_out, cert, depth, dn,
748 &dummy_called, &optional, US"DANE"))
749 return 0; /* reject, with peercert set */
83b27293
JH
750#endif
751
f2f2c91b 752if (preverify_ok == 1)
6fbf3599 753 {
4a1bd6b9 754 tls_out.dane_verified = TRUE;
6fbf3599
JH
755#ifndef DISABLE_OCSP
756 if (client_static_cbinfo->u_ocsp.client.verify_store)
757 { /* client, wanting stapling */
758 /* Add the server cert's signing chain as the one
759 for the verification of the OCSP stapled information. */
760
761 if (!X509_STORE_add_cert(client_static_cbinfo->u_ocsp.client.verify_store,
762 cert))
763 ERR_clear_error();
764 sk_X509_push(client_static_cbinfo->verify_stack, cert);
765 }
766#endif
767 }
f2f2c91b
JH
768else
769 {
770 int err = X509_STORE_CTX_get_error(x509ctx);
771 DEBUG(D_tls)
772 debug_printf(" - err %d '%s'\n", err, X509_verify_cert_error_string(err));
3c51463e 773 if (err == X509_V_ERR_APPLICATION_VERIFICATION)
f2f2c91b
JH
774 preverify_ok = 1;
775 }
776return preverify_ok;
e5cccda9 777}
53a7196b 778
c0635b6d 779#endif /*SUPPORT_DANE*/
e5cccda9 780
059ec3d9
PH
781
782/*************************************************
783* Information callback *
784*************************************************/
785
786/* The SSL library functions call this from time to time to indicate what they
7be682ca
PP
787are doing. We copy the string to the debugging output when TLS debugging has
788been requested.
059ec3d9
PH
789
790Arguments:
791 s the SSL connection
792 where
793 ret
794
795Returns: nothing
796*/
797
798static void
799info_callback(SSL *s, int where, int ret)
800{
0abc5a13
JH
801DEBUG(D_tls)
802 {
803 const uschar * str;
804
805 if (where & SSL_ST_CONNECT)
48224640 806 str = US"SSL_connect";
0abc5a13 807 else if (where & SSL_ST_ACCEPT)
48224640 808 str = US"SSL_accept";
0abc5a13 809 else
48224640 810 str = US"SSL info (undefined)";
0abc5a13
JH
811
812 if (where & SSL_CB_LOOP)
813 debug_printf("%s: %s\n", str, SSL_state_string_long(s));
814 else if (where & SSL_CB_ALERT)
815 debug_printf("SSL3 alert %s:%s:%s\n",
48224640 816 str = where & SSL_CB_READ ? US"read" : US"write",
0abc5a13
JH
817 SSL_alert_type_string_long(ret), SSL_alert_desc_string_long(ret));
818 else if (where & SSL_CB_EXIT)
819 if (ret == 0)
820 debug_printf("%s: failed in %s\n", str, SSL_state_string_long(s));
821 else if (ret < 0)
822 debug_printf("%s: error in %s\n", str, SSL_state_string_long(s));
823 else if (where & SSL_CB_HANDSHAKE_START)
824 debug_printf("%s: hshake start: %s\n", str, SSL_state_string_long(s));
825 else if (where & SSL_CB_HANDSHAKE_DONE)
826 debug_printf("%s: hshake done: %s\n", str, SSL_state_string_long(s));
827 }
059ec3d9
PH
828}
829
8238bc7b 830#ifdef OPENSSL_HAVE_KEYLOG_CB
8a40db1c
JH
831static void
832keylog_callback(const SSL *ssl, const char *line)
833{
834DEBUG(D_tls) debug_printf("%.200s\n", line);
835}
8238bc7b 836#endif
8a40db1c 837
059ec3d9 838
b10c87b3
JH
839#ifdef EXPERIMENTAL_TLS_RESUME
840/* Manage the keysets used for encrypting the session tickets, on the server. */
841
842typedef struct { /* Session ticket encryption key */
843 uschar name[16];
844
845 const EVP_CIPHER * aes_cipher;
4d93129f 846 uschar aes_key[32]; /* size needed depends on cipher. aes_128 implies 128/8 = 16? */
b10c87b3
JH
847 const EVP_MD * hmac_hash;
848 uschar hmac_key[16];
849 time_t renew;
850 time_t expire;
851} exim_stek;
852
4d93129f
JH
853static exim_stek exim_tk; /* current key */
854static exim_stek exim_tk_old; /* previous key */
b10c87b3
JH
855
856static void
857tk_init(void)
858{
4d93129f
JH
859time_t t = time(NULL);
860
b10c87b3
JH
861if (exim_tk.name[0])
862 {
4d93129f 863 if (exim_tk.renew >= t) return;
b10c87b3
JH
864 exim_tk_old = exim_tk;
865 }
866
867if (f.running_in_test_harness) ssl_session_timeout = 6;
868
869DEBUG(D_tls) debug_printf("OpenSSL: %s STEK\n", exim_tk.name[0] ? "rotating" : "creating");
870if (RAND_bytes(exim_tk.aes_key, sizeof(exim_tk.aes_key)) <= 0) return;
871if (RAND_bytes(exim_tk.hmac_key, sizeof(exim_tk.hmac_key)) <= 0) return;
872if (RAND_bytes(exim_tk.name+1, sizeof(exim_tk.name)-1) <= 0) return;
873
874exim_tk.name[0] = 'E';
4d93129f 875exim_tk.aes_cipher = EVP_aes_256_cbc();
b10c87b3 876exim_tk.hmac_hash = EVP_sha256();
4d93129f
JH
877exim_tk.expire = t + ssl_session_timeout;
878exim_tk.renew = t + ssl_session_timeout/2;
b10c87b3
JH
879}
880
881static exim_stek *
882tk_current(void)
883{
884if (!exim_tk.name[0]) return NULL;
885return &exim_tk;
886}
887
888static exim_stek *
889tk_find(const uschar * name)
890{
891return memcmp(name, exim_tk.name, sizeof(exim_tk.name)) == 0 ? &exim_tk
892 : memcmp(name, exim_tk_old.name, sizeof(exim_tk_old.name)) == 0 ? &exim_tk_old
893 : NULL;
894}
895
896/* Callback for session tickets, on server */
897static int
898ticket_key_callback(SSL * ssl, uschar key_name[16],
899 uschar * iv, EVP_CIPHER_CTX * ctx, HMAC_CTX * hctx, int enc)
900{
901tls_support * tlsp = server_static_cbinfo->tlsp;
902exim_stek * key;
903
904if (enc)
905 {
906 DEBUG(D_tls) debug_printf("ticket_key_callback: create new session\n");
907 tlsp->resumption |= RESUME_CLIENT_REQUESTED;
908
909 if (RAND_bytes(iv, EVP_MAX_IV_LENGTH) <= 0)
910 return -1; /* insufficient random */
911
912 if (!(key = tk_current())) /* current key doesn't exist or isn't valid */
913 return 0; /* key couldn't be created */
914 memcpy(key_name, key->name, 16);
d70fc283 915 DEBUG(D_tls) debug_printf("STEK expire " TIME_T_FMT "\n", key->expire - time(NULL));
b10c87b3
JH
916
917 /*XXX will want these dependent on the ssl session strength */
918 HMAC_Init_ex(hctx, key->hmac_key, sizeof(key->hmac_key),
919 key->hmac_hash, NULL);
920 EVP_EncryptInit_ex(ctx, key->aes_cipher, NULL, key->aes_key, iv);
921
922 DEBUG(D_tls) debug_printf("ticket created\n");
923 return 1;
924 }
925else
926 {
927 time_t now = time(NULL);
928
929 DEBUG(D_tls) debug_printf("ticket_key_callback: retrieve session\n");
930 tlsp->resumption |= RESUME_CLIENT_SUGGESTED;
931
932 if (!(key = tk_find(key_name)) || key->expire < now)
933 {
934 DEBUG(D_tls)
935 {
936 debug_printf("ticket not usable (%s)\n", key ? "expired" : "not found");
d70fc283 937 if (key) debug_printf("STEK expire " TIME_T_FMT "\n", key->expire - now);
b10c87b3
JH
938 }
939 return 0;
940 }
941
942 HMAC_Init_ex(hctx, key->hmac_key, sizeof(key->hmac_key),
943 key->hmac_hash, NULL);
944 EVP_DecryptInit_ex(ctx, key->aes_cipher, NULL, key->aes_key, iv);
945
d70fc283 946 DEBUG(D_tls) debug_printf("ticket usable, STEK expire " TIME_T_FMT "\n", key->expire - now);
dea4b568
JH
947
948 /* The ticket lifetime and renewal are the same as the STEK lifetime and
949 renewal, which is overenthusiastic. A factor of, say, 3x longer STEK would
950 be better. To do that we'd have to encode ticket lifetime in the name as
951 we don't yet see the restored session. Could check posthandshake for TLS1.3
952 and trigger a new ticket then, but cannot do that for TLS1.2 */
b10c87b3
JH
953 return key->renew < now ? 2 : 1;
954 }
955}
956#endif
957
958
059ec3d9
PH
959
960/*************************************************
961* Initialize for DH *
962*************************************************/
963
964/* If dhparam is set, expand it, and load up the parameters for DH encryption.
965
966Arguments:
038597d2 967 sctx The current SSL CTX (inbound or outbound)
a799883d 968 dhparam DH parameter file or fixed parameter identity string
7199e1ee 969 host connected host, if client; NULL if server
cf0c6164 970 errstr error string pointer
059ec3d9
PH
971
972Returns: TRUE if OK (nothing to set up, or setup worked)
973*/
974
975static BOOL
cf0c6164 976init_dh(SSL_CTX *sctx, uschar *dhparam, const host_item *host, uschar ** errstr)
059ec3d9 977{
059ec3d9
PH
978BIO *bio;
979DH *dh;
980uschar *dhexpanded;
a799883d 981const char *pem;
6600985a 982int dh_bitsize;
059ec3d9 983
cf0c6164 984if (!expand_check(dhparam, US"tls_dhparam", &dhexpanded, errstr))
059ec3d9
PH
985 return FALSE;
986
0df4ab80 987if (!dhexpanded || !*dhexpanded)
a799883d 988 bio = BIO_new_mem_buf(CS std_dh_prime_default(), -1);
a799883d 989else if (dhexpanded[0] == '/')
059ec3d9 990 {
0df4ab80 991 if (!(bio = BIO_new_file(CS dhexpanded, "r")))
059ec3d9 992 {
7199e1ee 993 tls_error(string_sprintf("could not read dhparams file %s", dhexpanded),
cf0c6164 994 host, US strerror(errno), errstr);
a799883d 995 return FALSE;
059ec3d9 996 }
a799883d
PP
997 }
998else
999 {
1000 if (Ustrcmp(dhexpanded, "none") == 0)
059ec3d9 1001 {
a799883d
PP
1002 DEBUG(D_tls) debug_printf("Requested no DH parameters.\n");
1003 return TRUE;
059ec3d9 1004 }
a799883d 1005
0df4ab80 1006 if (!(pem = std_dh_prime_named(dhexpanded)))
a799883d
PP
1007 {
1008 tls_error(string_sprintf("Unknown standard DH prime \"%s\"", dhexpanded),
cf0c6164 1009 host, US strerror(errno), errstr);
a799883d
PP
1010 return FALSE;
1011 }
1012 bio = BIO_new_mem_buf(CS pem, -1);
1013 }
1014
0df4ab80 1015if (!(dh = PEM_read_bio_DHparams(bio, NULL, NULL, NULL)))
a799883d 1016 {
059ec3d9 1017 BIO_free(bio);
a799883d 1018 tls_error(string_sprintf("Could not read tls_dhparams \"%s\"", dhexpanded),
cf0c6164 1019 host, NULL, errstr);
a799883d
PP
1020 return FALSE;
1021 }
1022
6600985a
PP
1023/* note: our default limit of 2236 is not a multiple of 8; the limit comes from
1024 * an NSS limit, and the GnuTLS APIs handle bit-sizes fine, so we went with
1025 * 2236. But older OpenSSL can only report in bytes (octets), not bits.
1026 * If someone wants to dance at the edge, then they can raise the limit or use
1027 * current libraries. */
1028#ifdef EXIM_HAVE_OPENSSL_DH_BITS
1029/* Added in commit 26c79d5641d; `git describe --contains` says OpenSSL_1_1_0-pre1~1022
1030 * This predates OpenSSL_1_1_0 (before a, b, ...) so is in all 1.1.0 */
1031dh_bitsize = DH_bits(dh);
1032#else
1033dh_bitsize = 8 * DH_size(dh);
1034#endif
1035
a799883d
PP
1036/* Even if it is larger, we silently return success rather than cause things
1037 * to fail out, so that a too-large DH will not knock out all TLS; it's a
1038 * debatable choice. */
6600985a 1039if (dh_bitsize > tls_dh_max_bits)
a799883d
PP
1040 {
1041 DEBUG(D_tls)
170f4904 1042 debug_printf("dhparams file %d bits, is > tls_dh_max_bits limit of %d\n",
6600985a 1043 dh_bitsize, tls_dh_max_bits);
a799883d
PP
1044 }
1045else
1046 {
1047 SSL_CTX_set_tmp_dh(sctx, dh);
1048 DEBUG(D_tls)
1049 debug_printf("Diffie-Hellman initialized from %s with %d-bit prime\n",
6600985a 1050 dhexpanded ? dhexpanded : US"default", dh_bitsize);
059ec3d9
PH
1051 }
1052
a799883d
PP
1053DH_free(dh);
1054BIO_free(bio);
1055
1056return TRUE;
059ec3d9
PH
1057}
1058
1059
1060
1061
038597d2
PP
1062/*************************************************
1063* Initialize for ECDH *
1064*************************************************/
1065
1066/* Load parameters for ECDH encryption.
1067
1068For now, we stick to NIST P-256 because: it's simple and easy to configure;
1069it avoids any patent issues that might bite redistributors; despite events in
1070the news and concerns over curve choices, we're not cryptographers, we're not
1071pretending to be, and this is "good enough" to be better than no support,
1072protecting against most adversaries. Given another year or two, there might
1073be sufficient clarity about a "right" way forward to let us make an informed
1074decision, instead of a knee-jerk reaction.
1075
1076Longer-term, we should look at supporting both various named curves and
1077external files generated with "openssl ecparam", much as we do for init_dh().
1078We should also support "none" as a value, to explicitly avoid initialisation.
1079
1080Patches welcome.
1081
1082Arguments:
1083 sctx The current SSL CTX (inbound or outbound)
1084 host connected host, if client; NULL if server
cf0c6164 1085 errstr error string pointer
038597d2
PP
1086
1087Returns: TRUE if OK (nothing to set up, or setup worked)
1088*/
1089
1090static BOOL
cf0c6164 1091init_ecdh(SSL_CTX * sctx, host_item * host, uschar ** errstr)
038597d2 1092{
63f0dbe0
JH
1093#ifdef OPENSSL_NO_ECDH
1094return TRUE;
1095#else
1096
10ca4f1c
JH
1097EC_KEY * ecdh;
1098uschar * exp_curve;
1099int nid;
1100BOOL rv;
1101
038597d2
PP
1102if (host) /* No ECDH setup for clients, only for servers */
1103 return TRUE;
1104
10ca4f1c 1105# ifndef EXIM_HAVE_ECDH
038597d2
PP
1106DEBUG(D_tls)
1107 debug_printf("No OpenSSL API to define ECDH parameters, skipping\n");
1108return TRUE;
038597d2 1109# else
10ca4f1c 1110
cf0c6164 1111if (!expand_check(tls_eccurve, US"tls_eccurve", &exp_curve, errstr))
10ca4f1c
JH
1112 return FALSE;
1113if (!exp_curve || !*exp_curve)
1114 return TRUE;
1115
8e53a4fc 1116/* "auto" needs to be handled carefully.
4c04137d 1117 * OpenSSL < 1.0.2: we do not select anything, but fallback to prime256v1
8e53a4fc 1118 * OpenSSL < 1.1.0: we have to call SSL_CTX_set_ecdh_auto
4c04137d 1119 * (openssl/ssl.h defines SSL_CTRL_SET_ECDH_AUTO)
8e53a4fc
HSHR
1120 * OpenSSL >= 1.1.0: we do not set anything, the libray does autoselection
1121 * https://github.com/openssl/openssl/commit/fe6ef2472db933f01b59cad82aa925736935984b
1122 */
10ca4f1c 1123if (Ustrcmp(exp_curve, "auto") == 0)
038597d2 1124 {
8e53a4fc 1125#if OPENSSL_VERSION_NUMBER < 0x10002000L
10ca4f1c 1126 DEBUG(D_tls) debug_printf(
8e53a4fc 1127 "ECDH OpenSSL < 1.0.2: temp key parameter settings: overriding \"auto\" with \"prime256v1\"\n");
78a3bbd5 1128 exp_curve = US"prime256v1";
8e53a4fc
HSHR
1129#else
1130# if defined SSL_CTRL_SET_ECDH_AUTO
1131 DEBUG(D_tls) debug_printf(
1132 "ECDH OpenSSL 1.0.2+ temp key parameter settings: autoselection\n");
10ca4f1c
JH
1133 SSL_CTX_set_ecdh_auto(sctx, 1);
1134 return TRUE;
8e53a4fc
HSHR
1135# else
1136 DEBUG(D_tls) debug_printf(
1137 "ECDH OpenSSL 1.1.0+ temp key parameter settings: default selection\n");
1138 return TRUE;
1139# endif
1140#endif
10ca4f1c 1141 }
038597d2 1142
10ca4f1c
JH
1143DEBUG(D_tls) debug_printf("ECDH: curve '%s'\n", exp_curve);
1144if ( (nid = OBJ_sn2nid (CCS exp_curve)) == NID_undef
1145# ifdef EXIM_HAVE_OPENSSL_EC_NIST2NID
1146 && (nid = EC_curve_nist2nid(CCS exp_curve)) == NID_undef
1147# endif
1148 )
1149 {
cf0c6164
JH
1150 tls_error(string_sprintf("Unknown curve name tls_eccurve '%s'", exp_curve),
1151 host, NULL, errstr);
10ca4f1c
JH
1152 return FALSE;
1153 }
038597d2 1154
10ca4f1c
JH
1155if (!(ecdh = EC_KEY_new_by_curve_name(nid)))
1156 {
cf0c6164 1157 tls_error(US"Unable to create ec curve", host, NULL, errstr);
10ca4f1c 1158 return FALSE;
038597d2 1159 }
10ca4f1c
JH
1160
1161/* The "tmp" in the name here refers to setting a temporary key
1162not to the stability of the interface. */
1163
1164if ((rv = SSL_CTX_set_tmp_ecdh(sctx, ecdh) == 0))
cf0c6164 1165 tls_error(string_sprintf("Error enabling '%s' curve", exp_curve), host, NULL, errstr);
10ca4f1c
JH
1166else
1167 DEBUG(D_tls) debug_printf("ECDH: enabled '%s' curve\n", exp_curve);
1168
1169EC_KEY_free(ecdh);
1170return !rv;
1171
1172# endif /*EXIM_HAVE_ECDH*/
1173#endif /*OPENSSL_NO_ECDH*/
038597d2
PP
1174}
1175
1176
1177
1178
f2de3a33 1179#ifndef DISABLE_OCSP
3f7eeb86
PP
1180/*************************************************
1181* Load OCSP information into state *
1182*************************************************/
f5d78688 1183/* Called to load the server OCSP response from the given file into memory, once
3f7eeb86
PP
1184caller has determined this is needed. Checks validity. Debugs a message
1185if invalid.
1186
1187ASSUMES: single response, for single cert.
1188
1189Arguments:
1190 sctx the SSL_CTX* to update
1191 cbinfo various parts of session state
1192 expanded the filename putatively holding an OCSP response
1193
1194*/
1195
1196static void
f5d78688 1197ocsp_load_response(SSL_CTX *sctx, tls_ext_ctx_cb *cbinfo, const uschar *expanded)
3f7eeb86 1198{
ee5b1e28
JH
1199BIO * bio;
1200OCSP_RESPONSE * resp;
1201OCSP_BASICRESP * basic_response;
1202OCSP_SINGLERESP * single_response;
1203ASN1_GENERALIZEDTIME * rev, * thisupd, * nextupd;
ee5b1e28 1204STACK_OF(X509) * sk;
3f7eeb86
PP
1205unsigned long verify_flags;
1206int status, reason, i;
1207
f5d78688
JH
1208cbinfo->u_ocsp.server.file_expanded = string_copy(expanded);
1209if (cbinfo->u_ocsp.server.response)
3f7eeb86 1210 {
f5d78688
JH
1211 OCSP_RESPONSE_free(cbinfo->u_ocsp.server.response);
1212 cbinfo->u_ocsp.server.response = NULL;
3f7eeb86
PP
1213 }
1214
ee5b1e28 1215if (!(bio = BIO_new_file(CS cbinfo->u_ocsp.server.file_expanded, "rb")))
3f7eeb86
PP
1216 {
1217 DEBUG(D_tls) debug_printf("Failed to open OCSP response file \"%s\"\n",
f5d78688 1218 cbinfo->u_ocsp.server.file_expanded);
3f7eeb86
PP
1219 return;
1220 }
1221
1222resp = d2i_OCSP_RESPONSE_bio(bio, NULL);
1223BIO_free(bio);
1224if (!resp)
1225 {
1226 DEBUG(D_tls) debug_printf("Error reading OCSP response.\n");
1227 return;
1228 }
1229
ee5b1e28 1230if ((status = OCSP_response_status(resp)) != OCSP_RESPONSE_STATUS_SUCCESSFUL)
3f7eeb86
PP
1231 {
1232 DEBUG(D_tls) debug_printf("OCSP response not valid: %s (%d)\n",
1233 OCSP_response_status_str(status), status);
f5d78688 1234 goto bad;
3f7eeb86
PP
1235 }
1236
ee5b1e28 1237if (!(basic_response = OCSP_response_get1_basic(resp)))
3f7eeb86
PP
1238 {
1239 DEBUG(D_tls)
1240 debug_printf("OCSP response parse error: unable to extract basic response.\n");
f5d78688 1241 goto bad;
3f7eeb86
PP
1242 }
1243
c3033f13 1244sk = cbinfo->verify_stack;
3f7eeb86
PP
1245verify_flags = OCSP_NOVERIFY; /* check sigs, but not purpose */
1246
1247/* May need to expose ability to adjust those flags?
1248OCSP_NOSIGS OCSP_NOVERIFY OCSP_NOCHAIN OCSP_NOCHECKS OCSP_NOEXPLICIT
1249OCSP_TRUSTOTHER OCSP_NOINTERN */
1250
4c04137d 1251/* This does a full verify on the OCSP proof before we load it for serving
ee5b1e28
JH
1252up; possibly overkill - just date-checks might be nice enough.
1253
1254OCSP_basic_verify takes a "store" arg, but does not
1255use it for the chain verification, which is all we do
1256when OCSP_NOVERIFY is set. The content from the wire
1257"basic_response" and a cert-stack "sk" are all that is used.
1258
c3033f13
JH
1259We have a stack, loaded in setup_certs() if tls_verify_certificates
1260was a file (not a directory, or "system"). It is unfortunate we
1261cannot used the connection context store, as that would neatly
1262handle the "system" case too, but there seems to be no library
1263function for getting a stack from a store.
e3555426 1264[ In OpenSSL 1.1 - ? X509_STORE_CTX_get0_chain(ctx) ? ]
c3033f13
JH
1265We do not free the stack since it could be needed a second time for
1266SNI handling.
1267
4c04137d 1268Separately we might try to replace using OCSP_basic_verify() - which seems to not
5ec37a55 1269be a public interface into the OpenSSL library (there's no manual entry) -
ee5b1e28 1270But what with? We also use OCSP_basic_verify in the client stapling callback.
4c04137d 1271And there we NEED it; we must verify that status... unless the
ee5b1e28
JH
1272library does it for us anyway? */
1273
1274if ((i = OCSP_basic_verify(basic_response, sk, NULL, verify_flags)) < 0)
3f7eeb86 1275 {
ee5b1e28
JH
1276 DEBUG(D_tls)
1277 {
0abc5a13 1278 ERR_error_string_n(ERR_get_error(), ssl_errstring, sizeof(ssl_errstring));
3f7eeb86 1279 debug_printf("OCSP response verify failure: %s\n", US ssl_errstring);
f5d78688
JH
1280 }
1281 goto bad;
3f7eeb86
PP
1282 }
1283
1284/* Here's the simplifying assumption: there's only one response, for the
1285one certificate we use, and nothing for anything else in a chain. If this
1286proves false, we need to extract a cert id from our issued cert
1287(tls_certificate) and use that for OCSP_resp_find_status() (which finds the
1288right cert in the stack and then calls OCSP_single_get0_status()).
1289
1290I'm hoping to avoid reworking a bunch more of how we handle state here. */
ee5b1e28
JH
1291
1292if (!(single_response = OCSP_resp_get0(basic_response, 0)))
3f7eeb86
PP
1293 {
1294 DEBUG(D_tls)
1295 debug_printf("Unable to get first response from OCSP basic response.\n");
f5d78688 1296 goto bad;
3f7eeb86
PP
1297 }
1298
1299status = OCSP_single_get0_status(single_response, &reason, &rev, &thisupd, &nextupd);
f5d78688 1300if (status != V_OCSP_CERTSTATUS_GOOD)
3f7eeb86 1301 {
f5d78688
JH
1302 DEBUG(D_tls) debug_printf("OCSP response bad cert status: %s (%d) %s (%d)\n",
1303 OCSP_cert_status_str(status), status,
1304 OCSP_crl_reason_str(reason), reason);
1305 goto bad;
3f7eeb86
PP
1306 }
1307
1308if (!OCSP_check_validity(thisupd, nextupd, EXIM_OCSP_SKEW_SECONDS, EXIM_OCSP_MAX_AGE))
1309 {
1310 DEBUG(D_tls) debug_printf("OCSP status invalid times.\n");
f5d78688 1311 goto bad;
3f7eeb86
PP
1312 }
1313
f5d78688 1314supply_response:
e5489333
JH
1315 /*XXX stack? (these tag points are for multiple leaf-cert support for ocsp */
1316 cbinfo->u_ocsp.server.response = resp;
f5d78688
JH
1317return;
1318
1319bad:
8768d548 1320 if (f.running_in_test_harness)
018058b2
JH
1321 {
1322 extern char ** environ;
d7978c0f 1323 if (environ) for (uschar ** p = USS environ; *p; p++)
018058b2
JH
1324 if (Ustrncmp(*p, "EXIM_TESTHARNESS_DISABLE_OCSPVALIDITYCHECK", 42) == 0)
1325 {
1326 DEBUG(D_tls) debug_printf("Supplying known bad OCSP response\n");
1327 goto supply_response;
1328 }
1329 }
f5d78688 1330return;
3f7eeb86 1331}
f2de3a33 1332#endif /*!DISABLE_OCSP*/
3f7eeb86
PP
1333
1334
1335
1336
23bb6982
JH
1337/* Create and install a selfsigned certificate, for use in server mode */
1338
1339static int
cf0c6164 1340tls_install_selfsign(SSL_CTX * sctx, uschar ** errstr)
23bb6982
JH
1341{
1342X509 * x509 = NULL;
1343EVP_PKEY * pkey;
1344RSA * rsa;
1345X509_NAME * name;
1346uschar * where;
1347
1348where = US"allocating pkey";
1349if (!(pkey = EVP_PKEY_new()))
1350 goto err;
1351
1352where = US"allocating cert";
1353if (!(x509 = X509_new()))
1354 goto err;
1355
1356where = US"generating pkey";
6aac3239 1357if (!(rsa = rsa_callback(NULL, 0, 2048)))
23bb6982
JH
1358 goto err;
1359
4c04137d 1360where = US"assigning pkey";
23bb6982
JH
1361if (!EVP_PKEY_assign_RSA(pkey, rsa))
1362 goto err;
1363
1364X509_set_version(x509, 2); /* N+1 - version 3 */
1613fd68 1365ASN1_INTEGER_set(X509_get_serialNumber(x509), 1);
23bb6982
JH
1366X509_gmtime_adj(X509_get_notBefore(x509), 0);
1367X509_gmtime_adj(X509_get_notAfter(x509), (long)60 * 60); /* 1 hour */
1368X509_set_pubkey(x509, pkey);
1369
1370name = X509_get_subject_name(x509);
1371X509_NAME_add_entry_by_txt(name, "C",
4dc2379a 1372 MBSTRING_ASC, CUS "UK", -1, -1, 0);
23bb6982 1373X509_NAME_add_entry_by_txt(name, "O",
4dc2379a 1374 MBSTRING_ASC, CUS "Exim Developers", -1, -1, 0);
23bb6982 1375X509_NAME_add_entry_by_txt(name, "CN",
4dc2379a 1376 MBSTRING_ASC, CUS smtp_active_hostname, -1, -1, 0);
23bb6982
JH
1377X509_set_issuer_name(x509, name);
1378
1379where = US"signing cert";
1380if (!X509_sign(x509, pkey, EVP_md5()))
1381 goto err;
1382
1383where = US"installing selfsign cert";
1384if (!SSL_CTX_use_certificate(sctx, x509))
1385 goto err;
1386
1387where = US"installing selfsign key";
1388if (!SSL_CTX_use_PrivateKey(sctx, pkey))
1389 goto err;
1390
1391return OK;
1392
1393err:
cf0c6164 1394 (void) tls_error(where, NULL, NULL, errstr);
23bb6982
JH
1395 if (x509) X509_free(x509);
1396 if (pkey) EVP_PKEY_free(pkey);
1397 return DEFER;
1398}
1399
1400
1401
1402
ba86e143
JH
1403static int
1404tls_add_certfile(SSL_CTX * sctx, tls_ext_ctx_cb * cbinfo, uschar * file,
1405 uschar ** errstr)
1406{
1407DEBUG(D_tls) debug_printf("tls_certificate file %s\n", file);
1408if (!SSL_CTX_use_certificate_chain_file(sctx, CS file))
1409 return tls_error(string_sprintf(
1410 "SSL_CTX_use_certificate_chain_file file=%s", file),
1411 cbinfo->host, NULL, errstr);
1412return 0;
1413}
1414
1415static int
1416tls_add_pkeyfile(SSL_CTX * sctx, tls_ext_ctx_cb * cbinfo, uschar * file,
1417 uschar ** errstr)
1418{
1419DEBUG(D_tls) debug_printf("tls_privatekey file %s\n", file);
1420if (!SSL_CTX_use_PrivateKey_file(sctx, CS file, SSL_FILETYPE_PEM))
1421 return tls_error(string_sprintf(
1422 "SSL_CTX_use_PrivateKey_file file=%s", file), cbinfo->host, NULL, errstr);
1423return 0;
1424}
1425
1426
059ec3d9 1427/*************************************************
7be682ca
PP
1428* Expand key and cert file specs *
1429*************************************************/
1430
f5d78688 1431/* Called once during tls_init and possibly again during TLS setup, for a
7be682ca
PP
1432new context, if Server Name Indication was used and tls_sni was seen in
1433the certificate string.
1434
1435Arguments:
1436 sctx the SSL_CTX* to update
1437 cbinfo various parts of session state
cf0c6164 1438 errstr error string pointer
7be682ca
PP
1439
1440Returns: OK/DEFER/FAIL
1441*/
1442
1443static int
cf0c6164
JH
1444tls_expand_session_files(SSL_CTX *sctx, tls_ext_ctx_cb *cbinfo,
1445 uschar ** errstr)
7be682ca
PP
1446{
1447uschar *expanded;
1448
23bb6982 1449if (!cbinfo->certificate)
7be682ca 1450 {
ba86e143 1451 if (!cbinfo->is_server) /* client */
23bb6982 1452 return OK;
afdb5e9c 1453 /* server */
cf0c6164 1454 if (tls_install_selfsign(sctx, errstr) != OK)
23bb6982 1455 return DEFER;
7be682ca 1456 }
23bb6982
JH
1457else
1458 {
ba86e143
JH
1459 int err;
1460
23bb6982
JH
1461 if (Ustrstr(cbinfo->certificate, US"tls_sni") ||
1462 Ustrstr(cbinfo->certificate, US"tls_in_sni") ||
1463 Ustrstr(cbinfo->certificate, US"tls_out_sni")
1464 )
1465 reexpand_tls_files_for_sni = TRUE;
7be682ca 1466
cf0c6164 1467 if (!expand_check(cbinfo->certificate, US"tls_certificate", &expanded, errstr))
23bb6982
JH
1468 return DEFER;
1469
ba86e143
JH
1470 if (expanded)
1471 if (cbinfo->is_server)
1472 {
1473 const uschar * file_list = expanded;
1474 int sep = 0;
1475 uschar * file;
1476
1477 while (file = string_nextinlist(&file_list, &sep, NULL, 0))
1478 if ((err = tls_add_certfile(sctx, cbinfo, file, errstr)))
1479 return err;
1480 }
1481 else /* would there ever be a need for multiple client certs? */
1482 if ((err = tls_add_certfile(sctx, cbinfo, expanded, errstr)))
1483 return err;
7be682ca 1484
5a2a0989
JH
1485 if ( cbinfo->privatekey
1486 && !expand_check(cbinfo->privatekey, US"tls_privatekey", &expanded, errstr))
23bb6982 1487 return DEFER;
7be682ca 1488
23bb6982
JH
1489 /* If expansion was forced to fail, key_expanded will be NULL. If the result
1490 of the expansion is an empty string, ignore it also, and assume the private
1491 key is in the same file as the certificate. */
1492
1493 if (expanded && *expanded)
ba86e143
JH
1494 if (cbinfo->is_server)
1495 {
1496 const uschar * file_list = expanded;
1497 int sep = 0;
1498 uschar * file;
1499
1500 while (file = string_nextinlist(&file_list, &sep, NULL, 0))
1501 if ((err = tls_add_pkeyfile(sctx, cbinfo, file, errstr)))
1502 return err;
1503 }
1504 else /* would there ever be a need for multiple client certs? */
1505 if ((err = tls_add_pkeyfile(sctx, cbinfo, expanded, errstr)))
1506 return err;
7be682ca
PP
1507 }
1508
f2de3a33 1509#ifndef DISABLE_OCSP
f40d5be3 1510if (cbinfo->is_server && cbinfo->u_ocsp.server.file)
3f7eeb86 1511 {
47195144 1512 /*XXX stack*/
cf0c6164 1513 if (!expand_check(cbinfo->u_ocsp.server.file, US"tls_ocsp_file", &expanded, errstr))
3f7eeb86
PP
1514 return DEFER;
1515
f40d5be3 1516 if (expanded && *expanded)
3f7eeb86
PP
1517 {
1518 DEBUG(D_tls) debug_printf("tls_ocsp_file %s\n", expanded);
f40d5be3
JH
1519 if ( cbinfo->u_ocsp.server.file_expanded
1520 && (Ustrcmp(expanded, cbinfo->u_ocsp.server.file_expanded) == 0))
3f7eeb86 1521 {
f40d5be3
JH
1522 DEBUG(D_tls) debug_printf(" - value unchanged, using existing values\n");
1523 }
1524 else
f40d5be3 1525 ocsp_load_response(sctx, cbinfo, expanded);
3f7eeb86
PP
1526 }
1527 }
1528#endif
1529
7be682ca
PP
1530return OK;
1531}
1532
1533
1534
1535
1536/*************************************************
1537* Callback to handle SNI *
1538*************************************************/
1539
1540/* Called when acting as server during the TLS session setup if a Server Name
1541Indication extension was sent by the client.
1542
1543API documentation is OpenSSL s_server.c implementation.
1544
1545Arguments:
1546 s SSL* of the current session
1547 ad unknown (part of OpenSSL API) (unused)
1548 arg Callback of "our" registered data
1549
1550Returns: SSL_TLSEXT_ERR_{OK,ALERT_WARNING,ALERT_FATAL,NOACK}
b10c87b3
JH
1551
1552XXX might need to change to using ClientHello callback,
1553per https://www.openssl.org/docs/manmaster/man3/SSL_client_hello_cb_fn.html
7be682ca
PP
1554*/
1555
3bcbbbe2 1556#ifdef EXIM_HAVE_OPENSSL_TLSEXT
7be682ca 1557static int
7be682ca
PP
1558tls_servername_cb(SSL *s, int *ad ARG_UNUSED, void *arg)
1559{
1560const char *servername = SSL_get_servername(s, TLSEXT_NAMETYPE_host_name);
3f7eeb86 1561tls_ext_ctx_cb *cbinfo = (tls_ext_ctx_cb *) arg;
7be682ca 1562int rc;
3f0945ff 1563int old_pool = store_pool;
cf0c6164 1564uschar * dummy_errstr;
7be682ca
PP
1565
1566if (!servername)
1567 return SSL_TLSEXT_ERR_OK;
1568
3f0945ff 1569DEBUG(D_tls) debug_printf("Received TLS SNI \"%s\"%s\n", servername,
7be682ca
PP
1570 reexpand_tls_files_for_sni ? "" : " (unused for certificate selection)");
1571
1572/* Make the extension value available for expansion */
3f0945ff 1573store_pool = POOL_PERM;
89a80675 1574tls_in.sni = string_copy_taint(US servername, TRUE);
3f0945ff 1575store_pool = old_pool;
7be682ca
PP
1576
1577if (!reexpand_tls_files_for_sni)
1578 return SSL_TLSEXT_ERR_OK;
1579
1580/* Can't find an SSL_CTX_clone() or equivalent, so we do it manually;
1581not confident that memcpy wouldn't break some internal reference counting.
1582Especially since there's a references struct member, which would be off. */
1583
7a8b9519
JH
1584#ifdef EXIM_HAVE_OPENSSL_TLS_METHOD
1585if (!(server_sni = SSL_CTX_new(TLS_server_method())))
1586#else
0df4ab80 1587if (!(server_sni = SSL_CTX_new(SSLv23_server_method())))
7a8b9519 1588#endif
7be682ca 1589 {
0abc5a13 1590 ERR_error_string_n(ERR_get_error(), ssl_errstring, sizeof(ssl_errstring));
7be682ca 1591 DEBUG(D_tls) debug_printf("SSL_CTX_new() failed: %s\n", ssl_errstring);
5a2a0989 1592 goto bad;
7be682ca
PP
1593 }
1594
1595/* Not sure how many of these are actually needed, since SSL object
1596already exists. Might even need this selfsame callback, for reneg? */
1597
817d9f57
JH
1598SSL_CTX_set_info_callback(server_sni, SSL_CTX_get_info_callback(server_ctx));
1599SSL_CTX_set_mode(server_sni, SSL_CTX_get_mode(server_ctx));
1600SSL_CTX_set_options(server_sni, SSL_CTX_get_options(server_ctx));
1601SSL_CTX_set_timeout(server_sni, SSL_CTX_get_timeout(server_ctx));
1602SSL_CTX_set_tlsext_servername_callback(server_sni, tls_servername_cb);
1603SSL_CTX_set_tlsext_servername_arg(server_sni, cbinfo);
038597d2 1604
cf0c6164
JH
1605if ( !init_dh(server_sni, cbinfo->dhparam, NULL, &dummy_errstr)
1606 || !init_ecdh(server_sni, NULL, &dummy_errstr)
038597d2 1607 )
5a2a0989 1608 goto bad;
038597d2 1609
ca954d7f
JH
1610if ( cbinfo->server_cipher_list
1611 && !SSL_CTX_set_cipher_list(server_sni, CS cbinfo->server_cipher_list))
5a2a0989 1612 goto bad;
ca954d7f 1613
f2de3a33 1614#ifndef DISABLE_OCSP
f5d78688 1615if (cbinfo->u_ocsp.server.file)
3f7eeb86 1616 {
f5d78688 1617 SSL_CTX_set_tlsext_status_cb(server_sni, tls_server_stapling_cb);
14c7b357 1618 SSL_CTX_set_tlsext_status_arg(server_sni, cbinfo);
3f7eeb86
PP
1619 }
1620#endif
7be682ca 1621
c3033f13 1622if ((rc = setup_certs(server_sni, tls_verify_certificates, tls_crl, NULL, FALSE,
cf0c6164 1623 verify_callback_server, &dummy_errstr)) != OK)
5a2a0989 1624 goto bad;
7be682ca 1625
3f7eeb86
PP
1626/* do this after setup_certs, because this can require the certs for verifying
1627OCSP information. */
cf0c6164 1628if ((rc = tls_expand_session_files(server_sni, cbinfo, &dummy_errstr)) != OK)
5a2a0989 1629 goto bad;
a799883d 1630
7be682ca 1631DEBUG(D_tls) debug_printf("Switching SSL context.\n");
817d9f57 1632SSL_set_SSL_CTX(s, server_sni);
7be682ca 1633return SSL_TLSEXT_ERR_OK;
5a2a0989
JH
1634
1635bad: return SSL_TLSEXT_ERR_ALERT_FATAL;
7be682ca 1636}
3bcbbbe2 1637#endif /* EXIM_HAVE_OPENSSL_TLSEXT */
7be682ca
PP
1638
1639
1640
1641
f2de3a33 1642#ifndef DISABLE_OCSP
f5d78688 1643
3f7eeb86
PP
1644/*************************************************
1645* Callback to handle OCSP Stapling *
1646*************************************************/
1647
1648/* Called when acting as server during the TLS session setup if the client
1649requests OCSP information with a Certificate Status Request.
1650
1651Documentation via openssl s_server.c and the Apache patch from the OpenSSL
1652project.
1653
1654*/
1655
1656static int
f5d78688 1657tls_server_stapling_cb(SSL *s, void *arg)
3f7eeb86
PP
1658{
1659const tls_ext_ctx_cb *cbinfo = (tls_ext_ctx_cb *) arg;
47195144 1660uschar *response_der; /*XXX blob */
3f7eeb86
PP
1661int response_der_len;
1662
47195144
JH
1663/*XXX stack: use SSL_get_certificate() to see which cert; from that work
1664out which ocsp blob to send. Unfortunately, SSL_get_certificate is known
1665buggy in current OpenSSL; it returns the last cert loaded always rather than
1666the one actually presented. So we can't support a stack of OCSP proofs at
1667this time. */
1668
af4a1bca 1669DEBUG(D_tls)
b3ef41c9 1670 debug_printf("Received TLS status request (OCSP stapling); %s response\n",
f5d78688
JH
1671 cbinfo->u_ocsp.server.response ? "have" : "lack");
1672
44662487 1673tls_in.ocsp = OCSP_NOT_RESP;
f5d78688 1674if (!cbinfo->u_ocsp.server.response)
3f7eeb86
PP
1675 return SSL_TLSEXT_ERR_NOACK;
1676
1677response_der = NULL;
47195144 1678response_der_len = i2d_OCSP_RESPONSE(cbinfo->u_ocsp.server.response, /*XXX stack*/
44662487 1679 &response_der);
3f7eeb86
PP
1680if (response_der_len <= 0)
1681 return SSL_TLSEXT_ERR_NOACK;
1682
5e55c7a9 1683SSL_set_tlsext_status_ocsp_resp(server_ssl, response_der, response_der_len);
44662487 1684tls_in.ocsp = OCSP_VFIED;
3f7eeb86
PP
1685return SSL_TLSEXT_ERR_OK;
1686}
1687
3f7eeb86 1688
f5d78688
JH
1689static void
1690time_print(BIO * bp, const char * str, ASN1_GENERALIZEDTIME * time)
1691{
1692BIO_printf(bp, "\t%s: ", str);
1693ASN1_GENERALIZEDTIME_print(bp, time);
1694BIO_puts(bp, "\n");
1695}
1696
1697static int
1698tls_client_stapling_cb(SSL *s, void *arg)
1699{
1700tls_ext_ctx_cb * cbinfo = arg;
1701const unsigned char * p;
1702int len;
1703OCSP_RESPONSE * rsp;
1704OCSP_BASICRESP * bs;
1705int i;
1706
1707DEBUG(D_tls) debug_printf("Received TLS status response (OCSP stapling):");
1708len = SSL_get_tlsext_status_ocsp_resp(s, &p);
1709if(!p)
1710 {
44662487 1711 /* Expect this when we requested ocsp but got none */
6c6d6e48 1712 if (cbinfo->u_ocsp.client.verify_required && LOGGING(tls_cipher))
44662487 1713 log_write(0, LOG_MAIN, "Received TLS status callback, null content");
f5d78688
JH
1714 else
1715 DEBUG(D_tls) debug_printf(" null\n");
44662487 1716 return cbinfo->u_ocsp.client.verify_required ? 0 : 1;
f5d78688 1717 }
018058b2 1718
c82de233
JH
1719if (!(rsp = d2i_OCSP_RESPONSE(NULL, &p, len)))
1720 {
1721 tls_out.ocsp = OCSP_FAILED; /*XXX should use tlsp-> to permit concurrent outbound */
6c6d6e48 1722 if (LOGGING(tls_cipher))
1eca31ca 1723 log_write(0, LOG_MAIN, "Received TLS cert status response, parse error");
f5d78688
JH
1724 else
1725 DEBUG(D_tls) debug_printf(" parse error\n");
1726 return 0;
c82de233 1727 }
f5d78688 1728
c82de233 1729if (!(bs = OCSP_response_get1_basic(rsp)))
f5d78688 1730 {
018058b2 1731 tls_out.ocsp = OCSP_FAILED;
6c6d6e48 1732 if (LOGGING(tls_cipher))
1eca31ca 1733 log_write(0, LOG_MAIN, "Received TLS cert status response, error parsing response");
f5d78688
JH
1734 else
1735 DEBUG(D_tls) debug_printf(" error parsing response\n");
1736 OCSP_RESPONSE_free(rsp);
1737 return 0;
1738 }
1739
1740/* We'd check the nonce here if we'd put one in the request. */
1741/* However that would defeat cacheability on the server so we don't. */
1742
f5d78688
JH
1743/* This section of code reworked from OpenSSL apps source;
1744 The OpenSSL Project retains copyright:
1745 Copyright (c) 1999 The OpenSSL Project. All rights reserved.
1746*/
1747 {
1748 BIO * bp = NULL;
f5d78688
JH
1749 int status, reason;
1750 ASN1_GENERALIZEDTIME *rev, *thisupd, *nextupd;
1751
57887ecc 1752 DEBUG(D_tls) bp = BIO_new_fp(debug_file, BIO_NOCLOSE);
f5d78688
JH
1753
1754 /*OCSP_RESPONSE_print(bp, rsp, 0); extreme debug: stapling content */
1755
1756 /* Use the chain that verified the server cert to verify the stapled info */
1757 /* DEBUG(D_tls) x509_store_dump_cert_s_names(cbinfo->u_ocsp.client.verify_store); */
1758
c3033f13 1759 if ((i = OCSP_basic_verify(bs, cbinfo->verify_stack,
44662487 1760 cbinfo->u_ocsp.client.verify_store, 0)) <= 0)
f5d78688 1761 {
018058b2 1762 tls_out.ocsp = OCSP_FAILED;
57887ecc
JH
1763 if (LOGGING(tls_cipher)) log_write(0, LOG_MAIN,
1764 "Received TLS cert status response, itself unverifiable: %s",
1765 ERR_reason_error_string(ERR_peek_error()));
f5d78688
JH
1766 BIO_printf(bp, "OCSP response verify failure\n");
1767 ERR_print_errors(bp);
57887ecc 1768 OCSP_RESPONSE_print(bp, rsp, 0);
c8dfb21d 1769 goto failed;
f5d78688
JH
1770 }
1771
1772 BIO_printf(bp, "OCSP response well-formed and signed OK\n");
1773
c8dfb21d
JH
1774 /*XXX So we have a good stapled OCSP status. How do we know
1775 it is for the cert of interest? OpenSSL 1.1.0 has a routine
1776 OCSP_resp_find_status() which matches on a cert id, which presumably
1777 we should use. Making an id needs OCSP_cert_id_new(), which takes
1778 issuerName, issuerKey, serialNumber. Are they all in the cert?
1779
1780 For now, carry on blindly accepting the resp. */
1781
f5d78688 1782 {
f5d78688
JH
1783 OCSP_SINGLERESP * single;
1784
c8dfb21d
JH
1785#ifdef EXIM_HAVE_OCSP_RESP_COUNT
1786 if (OCSP_resp_count(bs) != 1)
1787#else
1788 STACK_OF(OCSP_SINGLERESP) * sresp = bs->tbsResponseData->responses;
f5d78688 1789 if (sk_OCSP_SINGLERESP_num(sresp) != 1)
c8dfb21d 1790#endif
f5d78688 1791 {
018058b2 1792 tls_out.ocsp = OCSP_FAILED;
44662487
JH
1793 log_write(0, LOG_MAIN, "OCSP stapling "
1794 "with multiple responses not handled");
c8dfb21d 1795 goto failed;
f5d78688
JH
1796 }
1797 single = OCSP_resp_get0(bs, 0);
44662487
JH
1798 status = OCSP_single_get0_status(single, &reason, &rev,
1799 &thisupd, &nextupd);
f5d78688
JH
1800 }
1801
f5d78688
JH
1802 DEBUG(D_tls) time_print(bp, "This OCSP Update", thisupd);
1803 DEBUG(D_tls) if(nextupd) time_print(bp, "Next OCSP Update", nextupd);
44662487
JH
1804 if (!OCSP_check_validity(thisupd, nextupd,
1805 EXIM_OCSP_SKEW_SECONDS, EXIM_OCSP_MAX_AGE))
f5d78688 1806 {
018058b2 1807 tls_out.ocsp = OCSP_FAILED;
f5d78688
JH
1808 DEBUG(D_tls) ERR_print_errors(bp);
1809 log_write(0, LOG_MAIN, "Server OSCP dates invalid");
f5d78688 1810 }
44662487 1811 else
f5d78688 1812 {
44662487
JH
1813 DEBUG(D_tls) BIO_printf(bp, "Certificate status: %s\n",
1814 OCSP_cert_status_str(status));
1815 switch(status)
1816 {
1817 case V_OCSP_CERTSTATUS_GOOD:
44662487 1818 tls_out.ocsp = OCSP_VFIED;
018058b2 1819 i = 1;
c8dfb21d 1820 goto good;
44662487 1821 case V_OCSP_CERTSTATUS_REVOKED:
018058b2 1822 tls_out.ocsp = OCSP_FAILED;
44662487
JH
1823 log_write(0, LOG_MAIN, "Server certificate revoked%s%s",
1824 reason != -1 ? "; reason: " : "",
1825 reason != -1 ? OCSP_crl_reason_str(reason) : "");
1826 DEBUG(D_tls) time_print(bp, "Revocation Time", rev);
44662487
JH
1827 break;
1828 default:
018058b2 1829 tls_out.ocsp = OCSP_FAILED;
44662487
JH
1830 log_write(0, LOG_MAIN,
1831 "Server certificate status unknown, in OCSP stapling");
44662487
JH
1832 break;
1833 }
f5d78688 1834 }
c8dfb21d
JH
1835 failed:
1836 i = cbinfo->u_ocsp.client.verify_required ? 0 : 1;
1837 good:
f5d78688
JH
1838 BIO_free(bp);
1839 }
1840
1841OCSP_RESPONSE_free(rsp);
1842return i;
1843}
f2de3a33 1844#endif /*!DISABLE_OCSP*/
3f7eeb86
PP
1845
1846
7be682ca 1847/*************************************************
059ec3d9
PH
1848* Initialize for TLS *
1849*************************************************/
1850
e51c7be2
JH
1851/* Called from both server and client code, to do preliminary initialization
1852of the library. We allocate and return a context structure.
059ec3d9
PH
1853
1854Arguments:
946ecbe0 1855 ctxp returned SSL context
059ec3d9
PH
1856 host connected host, if client; NULL if server
1857 dhparam DH parameter file
1858 certificate certificate file
1859 privatekey private key
f5d78688 1860 ocsp_file file of stapling info (server); flag for require ocsp (client)
059ec3d9 1861 addr address if client; NULL if server (for some randomness)
946ecbe0 1862 cbp place to put allocated callback context
cf0c6164 1863 errstr error string pointer
059ec3d9
PH
1864
1865Returns: OK/DEFER/FAIL
1866*/
1867
1868static int
817d9f57 1869tls_init(SSL_CTX **ctxp, host_item *host, uschar *dhparam, uschar *certificate,
3f7eeb86 1870 uschar *privatekey,
f2de3a33 1871#ifndef DISABLE_OCSP
47195144 1872 uschar *ocsp_file, /*XXX stack, in server*/
3f7eeb86 1873#endif
b10c87b3
JH
1874 address_item *addr, tls_ext_ctx_cb ** cbp,
1875 tls_support * tlsp,
1876 uschar ** errstr)
059ec3d9 1877{
7006ee24 1878SSL_CTX * ctx;
77bb000f 1879long init_options;
7be682ca 1880int rc;
a7538db1 1881tls_ext_ctx_cb * cbinfo;
7be682ca
PP
1882
1883cbinfo = store_malloc(sizeof(tls_ext_ctx_cb));
b10c87b3 1884cbinfo->tlsp = tlsp;
7be682ca
PP
1885cbinfo->certificate = certificate;
1886cbinfo->privatekey = privatekey;
a6510420 1887cbinfo->is_server = host==NULL;
f2de3a33 1888#ifndef DISABLE_OCSP
c3033f13 1889cbinfo->verify_stack = NULL;
a6510420 1890if (!host)
f5d78688
JH
1891 {
1892 cbinfo->u_ocsp.server.file = ocsp_file;
1893 cbinfo->u_ocsp.server.file_expanded = NULL;
1894 cbinfo->u_ocsp.server.response = NULL;
1895 }
1896else
1897 cbinfo->u_ocsp.client.verify_store = NULL;
3f7eeb86 1898#endif
7be682ca 1899cbinfo->dhparam = dhparam;
0df4ab80 1900cbinfo->server_cipher_list = NULL;
7be682ca 1901cbinfo->host = host;
0cbf2b82 1902#ifndef DISABLE_EVENT
a7538db1
JH
1903cbinfo->event_action = NULL;
1904#endif
77bb000f 1905
7434882d 1906#ifdef EXIM_NEED_OPENSSL_INIT
059ec3d9
PH
1907SSL_load_error_strings(); /* basic set up */
1908OpenSSL_add_ssl_algorithms();
7434882d 1909#endif
059ec3d9 1910
c8dfb21d 1911#ifdef EXIM_HAVE_SHA256
77bb000f 1912/* SHA256 is becoming ever more popular. This makes sure it gets added to the
a0475b69
TK
1913list of available digests. */
1914EVP_add_digest(EVP_sha256());
cf1ef1a9 1915#endif
a0475b69 1916
f0f5a555
PP
1917/* Create a context.
1918The OpenSSL docs in 1.0.1b have not been updated to clarify TLS variant
1919negotiation in the different methods; as far as I can tell, the only
1920*_{server,client}_method which allows negotiation is SSLv23, which exists even
1921when OpenSSL is built without SSLv2 support.
1922By disabling with openssl_options, we can let admins re-enable with the
1923existing knob. */
059ec3d9 1924
7a8b9519
JH
1925#ifdef EXIM_HAVE_OPENSSL_TLS_METHOD
1926if (!(ctx = SSL_CTX_new(host ? TLS_client_method() : TLS_server_method())))
1927#else
7006ee24 1928if (!(ctx = SSL_CTX_new(host ? SSLv23_client_method() : SSLv23_server_method())))
7a8b9519 1929#endif
7006ee24 1930 return tls_error(US"SSL_CTX_new", host, NULL, errstr);
059ec3d9
PH
1931
1932/* It turns out that we need to seed the random number generator this early in
1933order to get the full complement of ciphers to work. It took me roughly a day
1934of work to discover this by experiment.
1935
1936On systems that have /dev/urandom, SSL may automatically seed itself from
1937there. Otherwise, we have to make something up as best we can. Double check
1938afterwards. */
1939
1940if (!RAND_status())
1941 {
1942 randstuff r;
9e3331ea 1943 gettimeofday(&r.tv, NULL);
059ec3d9
PH
1944 r.p = getpid();
1945
5903c6ff
JH
1946 RAND_seed(US (&r), sizeof(r));
1947 RAND_seed(US big_buffer, big_buffer_size);
1948 if (addr != NULL) RAND_seed(US addr, sizeof(addr));
059ec3d9
PH
1949
1950 if (!RAND_status())
7199e1ee 1951 return tls_error(US"RAND_status", host,
cf0c6164 1952 US"unable to seed random number generator", errstr);
059ec3d9
PH
1953 }
1954
1955/* Set up the information callback, which outputs if debugging is at a suitable
1956level. */
1957
b10c87b3
JH
1958DEBUG(D_tls)
1959 {
1960 SSL_CTX_set_info_callback(ctx, (void (*)())info_callback);
e570d136
JH
1961#if defined(EXIM_HAVE_OPESSL_TRACE) && !defined(OPENSSL_NO_SSL_TRACE)
1962 /* this needs a debug build of OpenSSL */
b10c87b3
JH
1963 SSL_CTX_set_msg_callback(ctx, (void (*)())SSL_trace);
1964#endif
8a40db1c 1965#ifdef OPENSSL_HAVE_KEYLOG_CB
b10c87b3 1966 SSL_CTX_set_keylog_callback(ctx, (void (*)())keylog_callback);
8a40db1c 1967#endif
b10c87b3 1968 }
059ec3d9 1969
c80c5570 1970/* Automatically re-try reads/writes after renegotiation. */
7006ee24 1971(void) SSL_CTX_set_mode(ctx, SSL_MODE_AUTO_RETRY);
c80c5570 1972
77bb000f
PP
1973/* Apply administrator-supplied work-arounds.
1974Historically we applied just one requested option,
1975SSL_OP_DONT_INSERT_EMPTY_FRAGMENTS, but when bug 994 requested a second, we
1976moved to an administrator-controlled list of options to specify and
1977grandfathered in the first one as the default value for "openssl_options".
059ec3d9 1978
77bb000f
PP
1979No OpenSSL version number checks: the options we accept depend upon the
1980availability of the option value macros from OpenSSL. */
059ec3d9 1981
7006ee24 1982if (!tls_openssl_options_parse(openssl_options, &init_options))
cf0c6164 1983 return tls_error(US"openssl_options parsing failed", host, NULL, errstr);
77bb000f 1984
b10c87b3
JH
1985#ifdef EXPERIMENTAL_TLS_RESUME
1986tlsp->resumption = RESUME_SUPPORTED;
1987#endif
77bb000f
PP
1988if (init_options)
1989 {
b10c87b3
JH
1990#ifdef EXPERIMENTAL_TLS_RESUME
1991 /* Should the server offer session resumption? */
1992 if (!host && verify_check_host(&tls_resumption_hosts) == OK)
1993 {
1994 DEBUG(D_tls) debug_printf("tls_resumption_hosts overrides openssl_options\n");
1995 init_options &= ~SSL_OP_NO_TICKET;
1996 tlsp->resumption |= RESUME_SERVER_TICKET; /* server will give ticket on request */
1997 tlsp->host_resumable = TRUE;
1998 }
1999#endif
2000
77bb000f 2001 DEBUG(D_tls) debug_printf("setting SSL CTX options: %#lx\n", init_options);
7006ee24 2002 if (!(SSL_CTX_set_options(ctx, init_options)))
77bb000f 2003 return tls_error(string_sprintf(
cf0c6164 2004 "SSL_CTX_set_option(%#lx)", init_options), host, NULL, errstr);
77bb000f
PP
2005 }
2006else
2007 DEBUG(D_tls) debug_printf("no SSL CTX options to set\n");
059ec3d9 2008
a28050f8
JH
2009/* We'd like to disable session cache unconditionally, but foolish Outlook
2010Express clients then give up the first TLS connection and make a second one
2011(which works). Only when there is an IMAP service on the same machine.
2012Presumably OE is trying to use the cache for A on B. Leave it enabled for
2013now, until we work out a decent way of presenting control to the config. It
2014will never be used because we use a new context every time. */
2015#ifdef notdef
7006ee24 2016(void) SSL_CTX_set_session_cache_mode(ctx, SSL_SESS_CACHE_OFF);
a28050f8 2017#endif
7006ee24 2018
059ec3d9 2019/* Initialize with DH parameters if supplied */
10ca4f1c 2020/* Initialize ECDH temp key parameter selection */
059ec3d9 2021
7006ee24
JH
2022if ( !init_dh(ctx, dhparam, host, errstr)
2023 || !init_ecdh(ctx, host, errstr)
038597d2
PP
2024 )
2025 return DEFER;
059ec3d9 2026
3f7eeb86 2027/* Set up certificate and key (and perhaps OCSP info) */
059ec3d9 2028
7006ee24 2029if ((rc = tls_expand_session_files(ctx, cbinfo, errstr)) != OK)
23bb6982 2030 return rc;
c91535f3 2031
c3033f13
JH
2032/* If we need to handle SNI or OCSP, do so */
2033
3bcbbbe2 2034#ifdef EXIM_HAVE_OPENSSL_TLSEXT
c3033f13
JH
2035# ifndef DISABLE_OCSP
2036 if (!(cbinfo->verify_stack = sk_X509_new_null()))
2037 {
2038 DEBUG(D_tls) debug_printf("failed to create stack for stapling verify\n");
2039 return FAIL;
2040 }
2041# endif
2042
7a8b9519 2043if (!host) /* server */
3f0945ff 2044 {
f2de3a33 2045# ifndef DISABLE_OCSP
f5d78688 2046 /* We check u_ocsp.server.file, not server.response, because we care about if
3f7eeb86
PP
2047 the option exists, not what the current expansion might be, as SNI might
2048 change the certificate and OCSP file in use between now and the time the
2049 callback is invoked. */
f5d78688 2050 if (cbinfo->u_ocsp.server.file)
3f7eeb86 2051 {
7006ee24
JH
2052 SSL_CTX_set_tlsext_status_cb(ctx, tls_server_stapling_cb);
2053 SSL_CTX_set_tlsext_status_arg(ctx, cbinfo);
3f7eeb86 2054 }
f5d78688 2055# endif
3f0945ff
PP
2056 /* We always do this, so that $tls_sni is available even if not used in
2057 tls_certificate */
7006ee24
JH
2058 SSL_CTX_set_tlsext_servername_callback(ctx, tls_servername_cb);
2059 SSL_CTX_set_tlsext_servername_arg(ctx, cbinfo);
3f0945ff 2060 }
f2de3a33 2061# ifndef DISABLE_OCSP
f5d78688
JH
2062else /* client */
2063 if(ocsp_file) /* wanting stapling */
2064 {
2065 if (!(cbinfo->u_ocsp.client.verify_store = X509_STORE_new()))
2066 {
2067 DEBUG(D_tls) debug_printf("failed to create store for stapling verify\n");
2068 return FAIL;
2069 }
7006ee24
JH
2070 SSL_CTX_set_tlsext_status_cb(ctx, tls_client_stapling_cb);
2071 SSL_CTX_set_tlsext_status_arg(ctx, cbinfo);
f5d78688
JH
2072 }
2073# endif
7be682ca 2074#endif
059ec3d9 2075
e51c7be2 2076cbinfo->verify_cert_hostnames = NULL;
e51c7be2 2077
c8dfb21d 2078#ifdef EXIM_HAVE_EPHEM_RSA_KEX
059ec3d9 2079/* Set up the RSA callback */
7006ee24 2080SSL_CTX_set_tmp_rsa_callback(ctx, rsa_callback);
c8dfb21d 2081#endif
059ec3d9 2082
b10c87b3
JH
2083/* Finally, set the session cache timeout, and we are done.
2084The period appears to be also used for (server-generated) session tickets */
059ec3d9 2085
7006ee24 2086SSL_CTX_set_timeout(ctx, ssl_session_timeout);
059ec3d9 2087DEBUG(D_tls) debug_printf("Initialized TLS\n");
7be682ca 2088
817d9f57 2089*cbp = cbinfo;
7006ee24 2090*ctxp = ctx;
7be682ca 2091
059ec3d9
PH
2092return OK;
2093}
2094
2095
2096
2097
2098/*************************************************
2099* Get name of cipher in use *
2100*************************************************/
2101
817d9f57 2102/*
059ec3d9 2103Argument: pointer to an SSL structure for the connection
817d9f57 2104 pointer to number of bits for cipher
f1be21cf 2105Returns: pointer to allocated string in perm-pool
059ec3d9
PH
2106*/
2107
f1be21cf
JH
2108static uschar *
2109construct_cipher_name(SSL * ssl, int * bits)
059ec3d9 2110{
f1be21cf 2111int pool = store_pool;
7a8b9519 2112/* With OpenSSL 1.0.0a, 'c' needs to be const but the documentation doesn't
57b3a7f5
PP
2113yet reflect that. It should be a safe change anyway, even 0.9.8 versions have
2114the accessor functions use const in the prototype. */
059ec3d9 2115
7a8b9519
JH
2116const uschar * ver = CUS SSL_get_version(ssl);
2117const SSL_CIPHER * c = (const SSL_CIPHER *) SSL_get_current_cipher(ssl);
f1be21cf 2118uschar * s;
059ec3d9 2119
817d9f57 2120SSL_CIPHER_get_bits(c, bits);
059ec3d9 2121
f1be21cf
JH
2122store_pool = POOL_PERM;
2123s = string_sprintf("%s:%s:%u", ver, SSL_CIPHER_get_name(c), *bits);
2124store_pool = pool;
2125DEBUG(D_tls) debug_printf("Cipher: %s\n", s);
2126return s;
2127}
2128
059ec3d9 2129
f1be21cf
JH
2130/* Get IETF-standard name for ciphersuite.
2131Argument: pointer to an SSL structure for the connection
2132Returns: pointer to string
2133*/
2134
2135static const uschar *
2136cipher_stdname_ssl(SSL * ssl)
2137{
2138#ifdef EXIM_HAVE_OPENSSL_CIPHER_STD_NAME
2139return CUS SSL_CIPHER_standard_name(SSL_get_current_cipher(ssl));
2140#else
2141ushort id = 0xffff & SSL_CIPHER_get_id(SSL_get_current_cipher(ssl));
2142return cipher_stdname(id >> 8, id & 0xff);
2143#endif
059ec3d9
PH
2144}
2145
2146
f69979cf 2147static void
70e384dd 2148peer_cert(SSL * ssl, tls_support * tlsp, uschar * peerdn, unsigned siz)
f69979cf
JH
2149{
2150/*XXX we might consider a list-of-certs variable for the cert chain.
2151SSL_get_peer_cert_chain(SSL*). We'd need a new variable type and support
2152in list-handling functions, also consider the difference between the entire
2153chain and the elements sent by the peer. */
2154
70e384dd
JH
2155tlsp->peerdn = NULL;
2156
f69979cf
JH
2157/* Will have already noted peercert on a verify fail; possibly not the leaf */
2158if (!tlsp->peercert)
2159 tlsp->peercert = SSL_get_peer_certificate(ssl);
2160/* Beware anonymous ciphers which lead to server_cert being NULL */
2161if (tlsp->peercert)
70e384dd
JH
2162 if (!X509_NAME_oneline(X509_get_subject_name(tlsp->peercert), CS peerdn, siz))
2163 { DEBUG(D_tls) debug_printf("X509_NAME_oneline() error\n"); }
2164 else
2165 {
4a1bd6b9
JH
2166 int oldpool = store_pool;
2167
2168 peerdn[siz-1] = '\0'; /* paranoia */
2169 store_pool = POOL_PERM;
2170 tlsp->peerdn = string_copy(peerdn);
2171 store_pool = oldpool;
2172
2173 /* We used to set CV in the cert-verify callbacks (either plain or dane)
2174 but they don't get called on session-resumption. So use the official
2175 interface, which uses the resumed value. Unfortunately this claims verified
2176 when it actually failed but we're in try-verify mode, due to us wanting the
2177 knowlege that it failed so needing to have the callback and forcing a
2178 permissive return. If we don't force it, the TLS startup is failed.
f4e62a87
JH
2179 The extra bit of information is set in verify_override in the cb, stashed
2180 for resumption next to the TLS session, and used here. */
4a1bd6b9
JH
2181
2182 if (!tlsp->verify_override)
2183 tlsp->certificate_verified = SSL_get_verify_result(ssl) == X509_V_OK;
70e384dd 2184 }
f69979cf
JH
2185}
2186
2187
059ec3d9
PH
2188
2189
2190
2191/*************************************************
2192* Set up for verifying certificates *
2193*************************************************/
2194
0e8aed8a 2195#ifndef DISABLE_OCSP
c3033f13
JH
2196/* Load certs from file, return TRUE on success */
2197
2198static BOOL
2199chain_from_pem_file(const uschar * file, STACK_OF(X509) * verify_stack)
2200{
2201BIO * bp;
2202X509 * x;
2203
dec766a1
WB
2204while (sk_X509_num(verify_stack) > 0)
2205 X509_free(sk_X509_pop(verify_stack));
2206
c3033f13
JH
2207if (!(bp = BIO_new_file(CS file, "r"))) return FALSE;
2208while ((x = PEM_read_bio_X509(bp, NULL, 0, NULL)))
2209 sk_X509_push(verify_stack, x);
2210BIO_free(bp);
2211return TRUE;
2212}
0e8aed8a 2213#endif
c3033f13
JH
2214
2215
2216
dec766a1
WB
2217/* Called by both client and server startup; on the server possibly
2218repeated after a Server Name Indication.
059ec3d9
PH
2219
2220Arguments:
7be682ca 2221 sctx SSL_CTX* to initialise
059ec3d9
PH
2222 certs certs file or NULL
2223 crl CRL file or NULL
2224 host NULL in a server; the remote host in a client
2225 optional TRUE if called from a server for a host in tls_try_verify_hosts;
2226 otherwise passed as FALSE
983207c1 2227 cert_vfy_cb Callback function for certificate verification
cf0c6164 2228 errstr error string pointer
059ec3d9
PH
2229
2230Returns: OK/DEFER/FAIL
2231*/
2232
2233static int
983207c1 2234setup_certs(SSL_CTX *sctx, uschar *certs, uschar *crl, host_item *host, BOOL optional,
cf0c6164 2235 int (*cert_vfy_cb)(int, X509_STORE_CTX *), uschar ** errstr)
059ec3d9
PH
2236{
2237uschar *expcerts, *expcrl;
2238
cf0c6164 2239if (!expand_check(certs, US"tls_verify_certificates", &expcerts, errstr))
059ec3d9 2240 return DEFER;
57cc2785 2241DEBUG(D_tls) debug_printf("tls_verify_certificates: %s\n", expcerts);
059ec3d9 2242
10a831a3 2243if (expcerts && *expcerts)
059ec3d9 2244 {
10a831a3
JH
2245 /* Tell the library to use its compiled-in location for the system default
2246 CA bundle. Then add the ones specified in the config, if any. */
cb1d7830 2247
10a831a3 2248 if (!SSL_CTX_set_default_verify_paths(sctx))
cf0c6164 2249 return tls_error(US"SSL_CTX_set_default_verify_paths", host, NULL, errstr);
10a831a3
JH
2250
2251 if (Ustrcmp(expcerts, "system") != 0)
059ec3d9 2252 {
cb1d7830
JH
2253 struct stat statbuf;
2254
cb1d7830
JH
2255 if (Ustat(expcerts, &statbuf) < 0)
2256 {
2257 log_write(0, LOG_MAIN|LOG_PANIC,
2258 "failed to stat %s for certificates", expcerts);
2259 return DEFER;
2260 }
059ec3d9 2261 else
059ec3d9 2262 {
cb1d7830
JH
2263 uschar *file, *dir;
2264 if ((statbuf.st_mode & S_IFMT) == S_IFDIR)
2265 { file = NULL; dir = expcerts; }
2266 else
c3033f13
JH
2267 {
2268 file = expcerts; dir = NULL;
2269#ifndef DISABLE_OCSP
2270 /* In the server if we will be offering an OCSP proof, load chain from
2271 file for verifying the OCSP proof at load time. */
2272
2273 if ( !host
2274 && statbuf.st_size > 0
2275 && server_static_cbinfo->u_ocsp.server.file
2276 && !chain_from_pem_file(file, server_static_cbinfo->verify_stack)
2277 )
2278 {
2279 log_write(0, LOG_MAIN|LOG_PANIC,
57887ecc 2280 "failed to load cert chain from %s", file);
c3033f13
JH
2281 return DEFER;
2282 }
2283#endif
2284 }
cb1d7830
JH
2285
2286 /* If a certificate file is empty, the next function fails with an
2287 unhelpful error message. If we skip it, we get the correct behaviour (no
2288 certificates are recognized, but the error message is still misleading (it
c3033f13 2289 says no certificate was supplied). But this is better. */
cb1d7830 2290
f2f2c91b
JH
2291 if ( (!file || statbuf.st_size > 0)
2292 && !SSL_CTX_load_verify_locations(sctx, CS file, CS dir))
cf0c6164 2293 return tls_error(US"SSL_CTX_load_verify_locations", host, NULL, errstr);
cb1d7830
JH
2294
2295 /* Load the list of CAs for which we will accept certs, for sending
2296 to the client. This is only for the one-file tls_verify_certificates
2297 variant.
d7978c0f
JH
2298 If a list isn't loaded into the server, but some verify locations are set,
2299 the server end appears to make a wildcard request for client certs.
10a831a3 2300 Meanwhile, the client library as default behaviour *ignores* the list
cb1d7830
JH
2301 we send over the wire - see man SSL_CTX_set_client_cert_cb.
2302 Because of this, and that the dir variant is likely only used for
d7978c0f
JH
2303 the public-CA bundle (not for a private CA), not worth fixing. */
2304
f2f2c91b 2305 if (file)
cb1d7830 2306 {
2009ecca 2307 STACK_OF(X509_NAME) * names = SSL_load_client_CA_file(CS file);
dec766a1
WB
2308
2309 SSL_CTX_set_client_CA_list(sctx, names);
f2f2c91b 2310 DEBUG(D_tls) debug_printf("Added %d certificate authorities.\n",
cb1d7830 2311 sk_X509_NAME_num(names));
cb1d7830 2312 }
059ec3d9
PH
2313 }
2314 }
2315
2316 /* Handle a certificate revocation list. */
2317
10a831a3 2318#if OPENSSL_VERSION_NUMBER > 0x00907000L
059ec3d9 2319
8b417f2c 2320 /* This bit of code is now the version supplied by Lars Mainka. (I have
10a831a3 2321 merely reformatted it into the Exim code style.)
8b417f2c 2322
10a831a3
JH
2323 "From here I changed the code to add support for multiple crl's
2324 in pem format in one file or to support hashed directory entries in
2325 pem format instead of a file. This method now uses the library function
2326 X509_STORE_load_locations to add the CRL location to the SSL context.
2327 OpenSSL will then handle the verify against CA certs and CRLs by
2328 itself in the verify callback." */
8b417f2c 2329
cf0c6164 2330 if (!expand_check(crl, US"tls_crl", &expcrl, errstr)) return DEFER;
10a831a3 2331 if (expcrl && *expcrl)
059ec3d9 2332 {
8b417f2c
PH
2333 struct stat statbufcrl;
2334 if (Ustat(expcrl, &statbufcrl) < 0)
2335 {
2336 log_write(0, LOG_MAIN|LOG_PANIC,
2337 "failed to stat %s for certificates revocation lists", expcrl);
2338 return DEFER;
2339 }
2340 else
059ec3d9 2341 {
8b417f2c
PH
2342 /* is it a file or directory? */
2343 uschar *file, *dir;
7be682ca 2344 X509_STORE *cvstore = SSL_CTX_get_cert_store(sctx);
8b417f2c 2345 if ((statbufcrl.st_mode & S_IFMT) == S_IFDIR)
059ec3d9 2346 {
8b417f2c
PH
2347 file = NULL;
2348 dir = expcrl;
2349 DEBUG(D_tls) debug_printf("SSL CRL value is a directory %s\n", dir);
059ec3d9
PH
2350 }
2351 else
2352 {
8b417f2c
PH
2353 file = expcrl;
2354 dir = NULL;
2355 DEBUG(D_tls) debug_printf("SSL CRL value is a file %s\n", file);
059ec3d9 2356 }
8b417f2c 2357 if (X509_STORE_load_locations(cvstore, CS file, CS dir) == 0)
cf0c6164 2358 return tls_error(US"X509_STORE_load_locations", host, NULL, errstr);
8b417f2c
PH
2359
2360 /* setting the flags to check against the complete crl chain */
2361
2362 X509_STORE_set_flags(cvstore,
2363 X509_V_FLAG_CRL_CHECK|X509_V_FLAG_CRL_CHECK_ALL);
059ec3d9 2364 }
059ec3d9
PH
2365 }
2366
10a831a3 2367#endif /* OPENSSL_VERSION_NUMBER > 0x00907000L */
059ec3d9
PH
2368
2369 /* If verification is optional, don't fail if no certificate */
2370
7be682ca 2371 SSL_CTX_set_verify(sctx,
5a2a0989 2372 SSL_VERIFY_PEER | (optional ? 0 : SSL_VERIFY_FAIL_IF_NO_PEER_CERT),
983207c1 2373 cert_vfy_cb);
059ec3d9
PH
2374 }
2375
2376return OK;
2377}
2378
2379
2380
2381/*************************************************
2382* Start a TLS session in a server *
2383*************************************************/
2384
2385/* This is called when Exim is running as a server, after having received
2386the STARTTLS command. It must respond to that command, and then negotiate
2387a TLS session.
2388
2389Arguments:
2390 require_ciphers allowed ciphers
cf0c6164 2391 errstr pointer to error message
059ec3d9
PH
2392
2393Returns: OK on success
2394 DEFER for errors before the start of the negotiation
4c04137d 2395 FAIL for errors during the negotiation; the server can't
059ec3d9
PH
2396 continue running.
2397*/
2398
2399int
cf0c6164 2400tls_server_start(const uschar * require_ciphers, uschar ** errstr)
059ec3d9
PH
2401{
2402int rc;
cf0c6164
JH
2403uschar * expciphers;
2404tls_ext_ctx_cb * cbinfo;
f69979cf 2405static uschar peerdn[256];
059ec3d9
PH
2406
2407/* Check for previous activation */
2408
74f1a423 2409if (tls_in.active.sock >= 0)
059ec3d9 2410 {
cf0c6164 2411 tls_error(US"STARTTLS received after TLS started", NULL, US"", errstr);
925ac8e4 2412 smtp_printf("554 Already in TLS\r\n", FALSE);
059ec3d9
PH
2413 return FAIL;
2414 }
2415
2416/* Initialize the SSL library. If it fails, it will already have logged
2417the error. */
2418
817d9f57 2419rc = tls_init(&server_ctx, NULL, tls_dhparam, tls_certificate, tls_privatekey,
f2de3a33 2420#ifndef DISABLE_OCSP
47195144 2421 tls_ocsp_file, /*XXX stack*/
3f7eeb86 2422#endif
b10c87b3 2423 NULL, &server_static_cbinfo, &tls_in, errstr);
059ec3d9 2424if (rc != OK) return rc;
817d9f57 2425cbinfo = server_static_cbinfo;
059ec3d9 2426
cf0c6164 2427if (!expand_check(require_ciphers, US"tls_require_ciphers", &expciphers, errstr))
059ec3d9
PH
2428 return FAIL;
2429
2430/* In OpenSSL, cipher components are separated by hyphens. In GnuTLS, they
17c76198
PP
2431were historically separated by underscores. So that I can use either form in my
2432tests, and also for general convenience, we turn underscores into hyphens here.
0c3807a8
JH
2433
2434XXX SSL_CTX_set_cipher_list() is replaced by SSL_CTX_set_ciphersuites()
2435for TLS 1.3 . Since we do not call it at present we get the default list:
2436TLS_AES_256_GCM_SHA384:TLS_CHACHA20_POLY1305_SHA256:TLS_AES_128_GCM_SHA256
17c76198 2437*/
059ec3d9 2438
c3033f13 2439if (expciphers)
059ec3d9 2440 {
b10c87b3 2441 for (uschar * s = expciphers; *s; s++ ) if (*s == '_') *s = '-';
059ec3d9 2442 DEBUG(D_tls) debug_printf("required ciphers: %s\n", expciphers);
817d9f57 2443 if (!SSL_CTX_set_cipher_list(server_ctx, CS expciphers))
cf0c6164 2444 return tls_error(US"SSL_CTX_set_cipher_list", NULL, NULL, errstr);
7be682ca 2445 cbinfo->server_cipher_list = expciphers;
059ec3d9
PH
2446 }
2447
2448/* If this is a host for which certificate verification is mandatory or
2449optional, set up appropriately. */
2450
817d9f57 2451tls_in.certificate_verified = FALSE;
c0635b6d 2452#ifdef SUPPORT_DANE
53a7196b
JH
2453tls_in.dane_verified = FALSE;
2454#endif
a2ff477a 2455server_verify_callback_called = FALSE;
059ec3d9
PH
2456
2457if (verify_check_host(&tls_verify_hosts) == OK)
2458 {
983207c1 2459 rc = setup_certs(server_ctx, tls_verify_certificates, tls_crl, NULL,
afdb5e9c 2460 FALSE, verify_callback_server, errstr);
059ec3d9 2461 if (rc != OK) return rc;
a2ff477a 2462 server_verify_optional = FALSE;
059ec3d9
PH
2463 }
2464else if (verify_check_host(&tls_try_verify_hosts) == OK)
2465 {
983207c1 2466 rc = setup_certs(server_ctx, tls_verify_certificates, tls_crl, NULL,
afdb5e9c 2467 TRUE, verify_callback_server, errstr);
059ec3d9 2468 if (rc != OK) return rc;
a2ff477a 2469 server_verify_optional = TRUE;
059ec3d9
PH
2470 }
2471
b10c87b3
JH
2472#ifdef EXPERIMENTAL_TLS_RESUME
2473SSL_CTX_set_tlsext_ticket_key_cb(server_ctx, ticket_key_callback);
2474/* despite working, appears to always return failure, so ignoring */
2475#endif
2476#ifdef OPENSSL_HAVE_NUM_TICKETS
2477# ifdef EXPERIMENTAL_TLS_RESUME
2478SSL_CTX_set_num_tickets(server_ctx, tls_in.host_resumable ? 1 : 0);
2479# else
2480SSL_CTX_set_num_tickets(server_ctx, 0); /* send no TLS1.3 stateful-tickets */
2481# endif
2482#endif
2483
2484
059ec3d9
PH
2485/* Prepare for new connection */
2486
cf0c6164
JH
2487if (!(server_ssl = SSL_new(server_ctx)))
2488 return tls_error(US"SSL_new", NULL, NULL, errstr);
da3ad30d
PP
2489
2490/* Warning: we used to SSL_clear(ssl) here, it was removed.
2491 *
2492 * With the SSL_clear(), we get strange interoperability bugs with
2493 * OpenSSL 1.0.1b and TLS1.1/1.2. It looks as though this may be a bug in
2494 * OpenSSL itself, as a clear should not lead to inability to follow protocols.
2495 *
2496 * The SSL_clear() call is to let an existing SSL* be reused, typically after
2497 * session shutdown. In this case, we have a brand new object and there's no
2498 * obvious reason to immediately clear it. I'm guessing that this was
2499 * originally added because of incomplete initialisation which the clear fixed,
2500 * in some historic release.
2501 */
059ec3d9
PH
2502
2503/* Set context and tell client to go ahead, except in the case of TLS startup
2504on connection, where outputting anything now upsets the clients and tends to
2505make them disconnect. We need to have an explicit fflush() here, to force out
2506the response. Other smtp_printf() calls do not need it, because in non-TLS
2507mode, the fflush() happens when smtp_getc() is called. */
2508
817d9f57
JH
2509SSL_set_session_id_context(server_ssl, sid_ctx, Ustrlen(sid_ctx));
2510if (!tls_in.on_connect)
059ec3d9 2511 {
925ac8e4 2512 smtp_printf("220 TLS go ahead\r\n", FALSE);
059ec3d9
PH
2513 fflush(smtp_out);
2514 }
2515
2516/* Now negotiate the TLS session. We put our own timer on it, since it seems
2517that the OpenSSL library doesn't. */
2518
817d9f57
JH
2519SSL_set_wfd(server_ssl, fileno(smtp_out));
2520SSL_set_rfd(server_ssl, fileno(smtp_in));
2521SSL_set_accept_state(server_ssl);
059ec3d9
PH
2522
2523DEBUG(D_tls) debug_printf("Calling SSL_accept\n");
2524
2525sigalrm_seen = FALSE;
c2a1bba0 2526if (smtp_receive_timeout > 0) ALARM(smtp_receive_timeout);
817d9f57 2527rc = SSL_accept(server_ssl);
c2a1bba0 2528ALARM_CLR(0);
059ec3d9
PH
2529
2530if (rc <= 0)
2531 {
cf0c6164 2532 (void) tls_error(US"SSL_accept", NULL, sigalrm_seen ? US"timed out" : NULL, errstr);
059ec3d9
PH
2533 return FAIL;
2534 }
2535
2536DEBUG(D_tls) debug_printf("SSL_accept was successful\n");
25fa0868 2537ERR_clear_error(); /* Even success can leave errors in the stack. Seen with
b10c87b3
JH
2538 anon-authentication ciphersuite negotiated. */
2539
2540#ifdef EXPERIMENTAL_TLS_RESUME
2541if (SSL_session_reused(server_ssl))
2542 {
2543 tls_in.resumption |= RESUME_USED;
2544 DEBUG(D_tls) debug_printf("Session reused\n");
2545 }
2546#endif
059ec3d9
PH
2547
2548/* TLS has been set up. Adjust the input functions to read via TLS,
2549and initialize things. */
2550
f69979cf
JH
2551peer_cert(server_ssl, &tls_in, peerdn, sizeof(peerdn));
2552
f1be21cf
JH
2553tls_in.cipher = construct_cipher_name(server_ssl, &tls_in.bits);
2554tls_in.cipher_stdname = cipher_stdname_ssl(server_ssl);
2555
059ec3d9
PH
2556DEBUG(D_tls)
2557 {
2558 uschar buf[2048];
f1be21cf 2559 if (SSL_get_shared_ciphers(server_ssl, CS buf, sizeof(buf)))
059ec3d9 2560 debug_printf("Shared ciphers: %s\n", buf);
f20cfa4a
JH
2561
2562#ifdef EXIM_HAVE_OPENSSL_KEYLOG
2563 {
10ed27e0 2564 BIO * bp = BIO_new_fp(debug_file, BIO_NOCLOSE);
f20cfa4a 2565 SSL_SESSION_print_keylog(bp, SSL_get_session(server_ssl));
f20cfa4a
JH
2566 BIO_free(bp);
2567 }
2568#endif
b10c87b3
JH
2569
2570#ifdef EXIM_HAVE_SESSION_TICKET
2571 {
2572 SSL_SESSION * ss = SSL_get_session(server_ssl);
40618fb6 2573 if (SSL_SESSION_has_ticket(ss)) /* 1.1.0 */
b10c87b3
JH
2574 debug_printf("The session has a ticket, life %lu seconds\n",
2575 SSL_SESSION_get_ticket_lifetime_hint(ss));
2576 }
2577#endif
059ec3d9
PH
2578 }
2579
9d1c15ef
JH
2580/* Record the certificate we presented */
2581 {
2582 X509 * crt = SSL_get_certificate(server_ssl);
2583 tls_in.ourcert = crt ? X509_dup(crt) : NULL;
2584 }
059ec3d9 2585
817d9f57
JH
2586/* Only used by the server-side tls (tls_in), including tls_getc.
2587 Client-side (tls_out) reads (seem to?) go via
2588 smtp_read_response()/ip_recv().
2589 Hence no need to duplicate for _in and _out.
2590 */
b808677c 2591if (!ssl_xfer_buffer) ssl_xfer_buffer = store_malloc(ssl_xfer_buffer_size);
059ec3d9 2592ssl_xfer_buffer_lwm = ssl_xfer_buffer_hwm = 0;
8b77d27a 2593ssl_xfer_eof = ssl_xfer_error = FALSE;
059ec3d9
PH
2594
2595receive_getc = tls_getc;
0d81dabc 2596receive_getbuf = tls_getbuf;
584e96c6 2597receive_get_cache = tls_get_cache;
059ec3d9
PH
2598receive_ungetc = tls_ungetc;
2599receive_feof = tls_feof;
2600receive_ferror = tls_ferror;
58eb016e 2601receive_smtp_buffered = tls_smtp_buffered;
059ec3d9 2602
74f1a423
JH
2603tls_in.active.sock = fileno(smtp_out);
2604tls_in.active.tls_ctx = NULL; /* not using explicit ctx for server-side */
059ec3d9
PH
2605return OK;
2606}
2607
2608
2609
2610
043b1248
JH
2611static int
2612tls_client_basic_ctx_init(SSL_CTX * ctx,
cf0c6164
JH
2613 host_item * host, smtp_transport_options_block * ob, tls_ext_ctx_cb * cbinfo,
2614 uschar ** errstr)
043b1248
JH
2615{
2616int rc;
94431adb 2617/* stick to the old behaviour for compatibility if tls_verify_certificates is
043b1248
JH
2618 set but both tls_verify_hosts and tls_try_verify_hosts is not set. Check only
2619 the specified host patterns if one of them is defined */
2620
610ff438
JH
2621if ( ( !ob->tls_verify_hosts
2622 && (!ob->tls_try_verify_hosts || !*ob->tls_try_verify_hosts)
2623 )
3c07dd2d 2624 || verify_check_given_host(CUSS &ob->tls_verify_hosts, host) == OK
aa2a70ba 2625 )
043b1248 2626 client_verify_optional = FALSE;
3c07dd2d 2627else if (verify_check_given_host(CUSS &ob->tls_try_verify_hosts, host) == OK)
aa2a70ba
JH
2628 client_verify_optional = TRUE;
2629else
2630 return OK;
2631
2632if ((rc = setup_certs(ctx, ob->tls_verify_certificates,
cf0c6164
JH
2633 ob->tls_crl, host, client_verify_optional, verify_callback_client,
2634 errstr)) != OK)
aa2a70ba 2635 return rc;
043b1248 2636
3c07dd2d 2637if (verify_check_given_host(CUSS &ob->tls_verify_cert_hostnames, host) == OK)
043b1248 2638 {
4af0d74a 2639 cbinfo->verify_cert_hostnames =
8c5d388a 2640#ifdef SUPPORT_I18N
4af0d74a
JH
2641 string_domain_utf8_to_alabel(host->name, NULL);
2642#else
2643 host->name;
2644#endif
aa2a70ba
JH
2645 DEBUG(D_tls) debug_printf("Cert hostname to check: \"%s\"\n",
2646 cbinfo->verify_cert_hostnames);
043b1248 2647 }
043b1248
JH
2648return OK;
2649}
059ec3d9 2650
fde080a4 2651
c0635b6d 2652#ifdef SUPPORT_DANE
fde080a4 2653static int
cf0c6164 2654dane_tlsa_load(SSL * ssl, host_item * host, dns_answer * dnsa, uschar ** errstr)
fde080a4 2655{
fde080a4
JH
2656dns_scan dnss;
2657const char * hostnames[2] = { CS host->name, NULL };
2658int found = 0;
2659
2660if (DANESSL_init(ssl, NULL, hostnames) != 1)
cf0c6164 2661 return tls_error(US"hostnames load", host, NULL, errstr);
fde080a4 2662
d7978c0f 2663for (dns_record * rr = dns_next_rr(dnsa, &dnss, RESET_ANSWERS); rr;
fde080a4 2664 rr = dns_next_rr(dnsa, &dnss, RESET_NEXT)
1b76ad22 2665 ) if (rr->type == T_TLSA && rr->size > 3)
fde080a4 2666 {
c3033f13 2667 const uschar * p = rr->data;
fde080a4
JH
2668 uint8_t usage, selector, mtype;
2669 const char * mdname;
2670
fde080a4 2671 usage = *p++;
133d2546
JH
2672
2673 /* Only DANE-TA(2) and DANE-EE(3) are supported */
2674 if (usage != 2 && usage != 3) continue;
2675
fde080a4
JH
2676 selector = *p++;
2677 mtype = *p++;
2678
2679 switch (mtype)
2680 {
133d2546
JH
2681 default: continue; /* Only match-types 0, 1, 2 are supported */
2682 case 0: mdname = NULL; break;
2683 case 1: mdname = "sha256"; break;
2684 case 2: mdname = "sha512"; break;
fde080a4
JH
2685 }
2686
133d2546 2687 found++;
fde080a4
JH
2688 switch (DANESSL_add_tlsa(ssl, usage, selector, mdname, p, rr->size - 3))
2689 {
2690 default:
cf0c6164 2691 return tls_error(US"tlsa load", host, NULL, errstr);
c035b645 2692 case 0: /* action not taken */
fde080a4
JH
2693 case 1: break;
2694 }
594706ea
JH
2695
2696 tls_out.tlsa_usage |= 1<<usage;
fde080a4
JH
2697 }
2698
2699if (found)
2700 return OK;
2701
133d2546 2702log_write(0, LOG_MAIN, "DANE error: No usable TLSA records");
6ebd79ec 2703return DEFER;
fde080a4 2704}
c0635b6d 2705#endif /*SUPPORT_DANE*/
fde080a4
JH
2706
2707
2708
b10c87b3
JH
2709#ifdef EXPERIMENTAL_TLS_RESUME
2710/* On the client, get any stashed session for the given IP from hints db
2711and apply it to the ssl-connection for attempted resumption. */
2712
2713static void
2714tls_retrieve_session(tls_support * tlsp, SSL * ssl, const uschar * key)
2715{
2716tlsp->resumption |= RESUME_SUPPORTED;
2717if (tlsp->host_resumable)
2718 {
2719 dbdata_tls_session * dt;
2720 int len;
2721 open_db dbblock, * dbm_file;
2722
2723 tlsp->resumption |= RESUME_CLIENT_REQUESTED;
2724 DEBUG(D_tls) debug_printf("checking for resumable session for %s\n", key);
2725 if ((dbm_file = dbfn_open(US"tls", O_RDONLY, &dbblock, FALSE, FALSE)))
2726 {
2727 /* key for the db is the IP */
2728 if ((dt = dbfn_read_with_length(dbm_file, key, &len)))
2729 {
2730 SSL_SESSION * ss = NULL;
2731 const uschar * sess_asn1 = dt->session;
2732
2733 len -= sizeof(dbdata_tls_session);
2734 if (!(d2i_SSL_SESSION(&ss, &sess_asn1, (long)len)))
2735 {
2736 DEBUG(D_tls)
2737 {
2738 ERR_error_string_n(ERR_get_error(),
2739 ssl_errstring, sizeof(ssl_errstring));
2740 debug_printf("decoding session: %s\n", ssl_errstring);
2741 }
2742 }
a775dd1d 2743#ifdef EXIM_HAVE_SESSION_TICKET
4f1d23a1
JH
2744 else if ( SSL_SESSION_get_ticket_lifetime_hint(ss) + dt->time_stamp
2745 < time(NULL))
2746 {
2747 DEBUG(D_tls) debug_printf("session expired\n");
2748 dbfn_delete(dbm_file, key);
2749 }
a775dd1d 2750#endif
b10c87b3
JH
2751 else if (!SSL_set_session(ssl, ss))
2752 {
2753 DEBUG(D_tls)
2754 {
2755 ERR_error_string_n(ERR_get_error(),
2756 ssl_errstring, sizeof(ssl_errstring));
2757 debug_printf("applying session to ssl: %s\n", ssl_errstring);
2758 }
2759 }
2760 else
2761 {
2762 DEBUG(D_tls) debug_printf("good session\n");
2763 tlsp->resumption |= RESUME_CLIENT_SUGGESTED;
f4e62a87 2764 tlsp->verify_override = dt->verify_override;
c82de233 2765 tlsp->ocsp = dt->ocsp;
b10c87b3
JH
2766 }
2767 }
2768 else
2769 DEBUG(D_tls) debug_printf("no session record\n");
2770 dbfn_close(dbm_file);
2771 }
2772 }
2773}
2774
2775
2776/* On the client, save the session for later resumption */
2777
2778static int
2779tls_save_session_cb(SSL * ssl, SSL_SESSION * ss)
2780{
2781tls_ext_ctx_cb * cbinfo = SSL_get_ex_data(ssl, tls_exdata_idx);
2782tls_support * tlsp;
2783
2784DEBUG(D_tls) debug_printf("tls_save_session_cb\n");
2785
2786if (!cbinfo || !(tlsp = cbinfo->tlsp)->host_resumable) return 0;
2787
40618fb6
JH
2788# ifdef OPENSSL_HAVE_NUM_TICKETS
2789if (SSL_SESSION_is_resumable(ss)) /* 1.1.1 */
2790# endif
b10c87b3
JH
2791 {
2792 int len = i2d_SSL_SESSION(ss, NULL);
2793 int dlen = sizeof(dbdata_tls_session) + len;
f3ebb786 2794 dbdata_tls_session * dt = store_get(dlen, TRUE);
b10c87b3
JH
2795 uschar * s = dt->session;
2796 open_db dbblock, * dbm_file;
2797
2798 DEBUG(D_tls) debug_printf("session is resumable\n");
2799 tlsp->resumption |= RESUME_SERVER_TICKET; /* server gave us a ticket */
2800
f4e62a87 2801 dt->verify_override = tlsp->verify_override;
c82de233 2802 dt->ocsp = tlsp->ocsp;
f4e62a87 2803 (void) i2d_SSL_SESSION(ss, &s); /* s gets bumped to end */
b10c87b3
JH
2804
2805 if ((dbm_file = dbfn_open(US"tls", O_RDWR, &dbblock, FALSE, FALSE)))
2806 {
2807 const uschar * key = cbinfo->host->address;
2808 dbfn_delete(dbm_file, key);
2809 dbfn_write(dbm_file, key, dt, dlen);
2810 dbfn_close(dbm_file);
2811 DEBUG(D_tls) debug_printf("wrote session (len %u) to db\n",
2812 (unsigned)dlen);
2813 }
2814 }
b10c87b3
JH
2815return 1;
2816}
2817
2818
2819static void
2820tls_client_ctx_resume_prehandshake(
2821 exim_openssl_client_tls_ctx * exim_client_ctx, tls_support * tlsp,
2822 smtp_transport_options_block * ob, host_item * host)
2823{
2824/* Should the client request a session resumption ticket? */
2825if (verify_check_given_host(CUSS &ob->tls_resumption_hosts, host) == OK)
2826 {
2827 tlsp->host_resumable = TRUE;
2828
2829 SSL_CTX_set_session_cache_mode(exim_client_ctx->ctx,
2830 SSL_SESS_CACHE_CLIENT
2831 | SSL_SESS_CACHE_NO_INTERNAL | SSL_SESS_CACHE_NO_AUTO_CLEAR);
2832 SSL_CTX_sess_set_new_cb(exim_client_ctx->ctx, tls_save_session_cb);
2833 }
2834}
2835
2836static BOOL
2837tls_client_ssl_resume_prehandshake(SSL * ssl, tls_support * tlsp,
2838 host_item * host, uschar ** errstr)
2839{
2840if (tlsp->host_resumable)
2841 {
2842 DEBUG(D_tls)
2843 debug_printf("tls_resumption_hosts overrides openssl_options, enabling tickets\n");
2844 SSL_clear_options(ssl, SSL_OP_NO_TICKET);
2845
2846 tls_exdata_idx = SSL_get_ex_new_index(0, 0, 0, 0, 0);
2847 if (!SSL_set_ex_data(ssl, tls_exdata_idx, client_static_cbinfo))
2848 {
2849 tls_error(US"set ex_data", host, NULL, errstr);
2850 return FALSE;
2851 }
2852 debug_printf("tls_exdata_idx %d cbinfo %p\n", tls_exdata_idx, client_static_cbinfo);
2853 }
2854
2855tlsp->resumption = RESUME_SUPPORTED;
2856/* Pick up a previous session, saved on an old ticket */
2857tls_retrieve_session(tlsp, ssl, host->address);
2858return TRUE;
2859}
2860
2861static void
2862tls_client_resume_posthandshake(exim_openssl_client_tls_ctx * exim_client_ctx,
2863 tls_support * tlsp)
2864{
2865if (SSL_session_reused(exim_client_ctx->ssl))
2866 {
2867 DEBUG(D_tls) debug_printf("The session was reused\n");
2868 tlsp->resumption |= RESUME_USED;
2869 }
2870}
2871#endif /* EXPERIMENTAL_TLS_RESUME */
2872
2873
059ec3d9
PH
2874/*************************************************
2875* Start a TLS session in a client *
2876*************************************************/
2877
2878/* Called from the smtp transport after STARTTLS has been accepted.
2879
c05bdbd6
JH
2880Arguments:
2881 cctx connection context
2882 conn_args connection details
2883 cookie datum for randomness; can be NULL
2884 tlsp record details of TLS channel configuration here; must be non-NULL
2885 errstr error string pointer
2886
2887Returns: TRUE for success with TLS session context set in connection context,
2888 FALSE on error
059ec3d9
PH
2889*/
2890
c05bdbd6
JH
2891BOOL
2892tls_client_start(client_conn_ctx * cctx, smtp_connect_args * conn_args,
2893 void * cookie, tls_support * tlsp, uschar ** errstr)
059ec3d9 2894{
c05bdbd6
JH
2895host_item * host = conn_args->host; /* for msgs and option-tests */
2896transport_instance * tb = conn_args->tblock; /* always smtp or NULL */
afdb5e9c
JH
2897smtp_transport_options_block * ob = tb
2898 ? (smtp_transport_options_block *)tb->options_block
2899 : &smtp_transport_option_defaults;
74f1a423 2900exim_openssl_client_tls_ctx * exim_client_ctx;
868f5672 2901uschar * expciphers;
059ec3d9 2902int rc;
c05bdbd6 2903static uschar peerdn[256];
043b1248
JH
2904
2905#ifndef DISABLE_OCSP
043b1248 2906BOOL request_ocsp = FALSE;
6634ac8d 2907BOOL require_ocsp = FALSE;
043b1248 2908#endif
043b1248 2909
74f1a423
JH
2910rc = store_pool;
2911store_pool = POOL_PERM;
f3ebb786 2912exim_client_ctx = store_get(sizeof(exim_openssl_client_tls_ctx), FALSE);
c09dbcfb 2913exim_client_ctx->corked = NULL;
74f1a423
JH
2914store_pool = rc;
2915
c0635b6d 2916#ifdef SUPPORT_DANE
74f1a423 2917tlsp->tlsa_usage = 0;
043b1248
JH
2918#endif
2919
f2de3a33 2920#ifndef DISABLE_OCSP
043b1248 2921 {
c0635b6d 2922# ifdef SUPPORT_DANE
c05bdbd6 2923 if ( conn_args->dane
4f59c424
JH
2924 && ob->hosts_request_ocsp[0] == '*'
2925 && ob->hosts_request_ocsp[1] == '\0'
2926 )
2927 {
2928 /* Unchanged from default. Use a safer one under DANE */
2929 request_ocsp = TRUE;
2930 ob->hosts_request_ocsp = US"${if or { {= {0}{$tls_out_tlsa_usage}} "
2931 " {= {4}{$tls_out_tlsa_usage}} } "
2932 " {*}{}}";
2933 }
2934# endif
2935
5130845b 2936 if ((require_ocsp =
3c07dd2d 2937 verify_check_given_host(CUSS &ob->hosts_require_ocsp, host) == OK))
fca41d5a
JH
2938 request_ocsp = TRUE;
2939 else
c0635b6d 2940# ifdef SUPPORT_DANE
4f59c424 2941 if (!request_ocsp)
fca41d5a 2942# endif
5130845b 2943 request_ocsp =
3c07dd2d 2944 verify_check_given_host(CUSS &ob->hosts_request_ocsp, host) == OK;
043b1248 2945 }
f5d78688 2946#endif
059ec3d9 2947
74f1a423 2948rc = tls_init(&exim_client_ctx->ctx, host, NULL,
65867078 2949 ob->tls_certificate, ob->tls_privatekey,
f2de3a33 2950#ifndef DISABLE_OCSP
44662487 2951 (void *)(long)request_ocsp,
3f7eeb86 2952#endif
b10c87b3 2953 cookie, &client_static_cbinfo, tlsp, errstr);
c05bdbd6 2954if (rc != OK) return FALSE;
059ec3d9 2955
74f1a423 2956tlsp->certificate_verified = FALSE;
a2ff477a 2957client_verify_callback_called = FALSE;
059ec3d9 2958
5ec37a55
PP
2959expciphers = NULL;
2960#ifdef SUPPORT_DANE
c05bdbd6 2961if (conn_args->dane)
5ec37a55
PP
2962 {
2963 /* We fall back to tls_require_ciphers if unset, empty or forced failure, but
2964 other failures should be treated as problems. */
2965 if (ob->dane_require_tls_ciphers &&
2966 !expand_check(ob->dane_require_tls_ciphers, US"dane_require_tls_ciphers",
2967 &expciphers, errstr))
c05bdbd6 2968 return FALSE;
5ec37a55
PP
2969 if (expciphers && *expciphers == '\0')
2970 expciphers = NULL;
2971 }
2972#endif
2973if (!expciphers &&
2974 !expand_check(ob->tls_require_ciphers, US"tls_require_ciphers",
2975 &expciphers, errstr))
c05bdbd6 2976 return FALSE;
059ec3d9
PH
2977
2978/* In OpenSSL, cipher components are separated by hyphens. In GnuTLS, they
2979are separated by underscores. So that I can use either form in my tests, and
2980also for general convenience, we turn underscores into hyphens here. */
2981
cf0c6164 2982if (expciphers)
059ec3d9
PH
2983 {
2984 uschar *s = expciphers;
cf0c6164 2985 while (*s) { if (*s == '_') *s = '-'; s++; }
059ec3d9 2986 DEBUG(D_tls) debug_printf("required ciphers: %s\n", expciphers);
74f1a423
JH
2987 if (!SSL_CTX_set_cipher_list(exim_client_ctx->ctx, CS expciphers))
2988 {
2989 tls_error(US"SSL_CTX_set_cipher_list", host, NULL, errstr);
c05bdbd6 2990 return FALSE;
74f1a423 2991 }
059ec3d9
PH
2992 }
2993
c0635b6d 2994#ifdef SUPPORT_DANE
c05bdbd6 2995if (conn_args->dane)
a63be306 2996 {
74f1a423 2997 SSL_CTX_set_verify(exim_client_ctx->ctx,
02af313d
JH
2998 SSL_VERIFY_PEER | SSL_VERIFY_FAIL_IF_NO_PEER_CERT,
2999 verify_callback_client_dane);
e5cccda9 3000
043b1248 3001 if (!DANESSL_library_init())
74f1a423
JH
3002 {
3003 tls_error(US"library init", host, NULL, errstr);
c05bdbd6 3004 return FALSE;
74f1a423
JH
3005 }
3006 if (DANESSL_CTX_init(exim_client_ctx->ctx) <= 0)
3007 {
3008 tls_error(US"context init", host, NULL, errstr);
c05bdbd6 3009 return FALSE;
74f1a423 3010 }
043b1248
JH
3011 }
3012else
e51c7be2 3013
043b1248
JH
3014#endif
3015
74f1a423
JH
3016 if (tls_client_basic_ctx_init(exim_client_ctx->ctx, host, ob,
3017 client_static_cbinfo, errstr) != OK)
c05bdbd6 3018 return FALSE;
059ec3d9 3019
b10c87b3
JH
3020#ifdef EXPERIMENTAL_TLS_RESUME
3021tls_client_ctx_resume_prehandshake(exim_client_ctx, tlsp, ob, host);
3022#endif
3023
3024
74f1a423
JH
3025if (!(exim_client_ctx->ssl = SSL_new(exim_client_ctx->ctx)))
3026 {
3027 tls_error(US"SSL_new", host, NULL, errstr);
c05bdbd6 3028 return FALSE;
74f1a423
JH
3029 }
3030SSL_set_session_id_context(exim_client_ctx->ssl, sid_ctx, Ustrlen(sid_ctx));
b10c87b3 3031
c05bdbd6 3032SSL_set_fd(exim_client_ctx->ssl, cctx->sock);
74f1a423 3033SSL_set_connect_state(exim_client_ctx->ssl);
059ec3d9 3034
65867078 3035if (ob->tls_sni)
3f0945ff 3036 {
74f1a423 3037 if (!expand_check(ob->tls_sni, US"tls_sni", &tlsp->sni, errstr))
c05bdbd6 3038 return FALSE;
74f1a423 3039 if (!tlsp->sni)
2c9a0e86
PP
3040 {
3041 DEBUG(D_tls) debug_printf("Setting TLS SNI forced to fail, not sending\n");
3042 }
74f1a423
JH
3043 else if (!Ustrlen(tlsp->sni))
3044 tlsp->sni = NULL;
3f0945ff
PP
3045 else
3046 {
35731706 3047#ifdef EXIM_HAVE_OPENSSL_TLSEXT
74f1a423
JH
3048 DEBUG(D_tls) debug_printf("Setting TLS SNI \"%s\"\n", tlsp->sni);
3049 SSL_set_tlsext_host_name(exim_client_ctx->ssl, tlsp->sni);
35731706 3050#else
66802652 3051 log_write(0, LOG_MAIN, "SNI unusable with this OpenSSL library version; ignoring \"%s\"\n",
74f1a423 3052 tlsp->sni);
35731706 3053#endif
3f0945ff
PP
3054 }
3055 }
3056
c0635b6d 3057#ifdef SUPPORT_DANE
c05bdbd6
JH
3058if (conn_args->dane)
3059 if (dane_tlsa_load(exim_client_ctx->ssl, host, &conn_args->tlsa_dnsa, errstr) != OK)
3060 return FALSE;
594706ea
JH
3061#endif
3062
f2de3a33 3063#ifndef DISABLE_OCSP
f5d78688
JH
3064/* Request certificate status at connection-time. If the server
3065does OCSP stapling we will get the callback (set in tls_init()) */
c0635b6d 3066# ifdef SUPPORT_DANE
44662487
JH
3067if (request_ocsp)
3068 {
594706ea 3069 const uschar * s;
41afb5cb
JH
3070 if ( ((s = ob->hosts_require_ocsp) && Ustrstr(s, US"tls_out_tlsa_usage"))
3071 || ((s = ob->hosts_request_ocsp) && Ustrstr(s, US"tls_out_tlsa_usage"))
594706ea
JH
3072 )
3073 { /* Re-eval now $tls_out_tlsa_usage is populated. If
3074 this means we avoid the OCSP request, we wasted the setup
3075 cost in tls_init(). */
3c07dd2d 3076 require_ocsp = verify_check_given_host(CUSS &ob->hosts_require_ocsp, host) == OK;
5130845b 3077 request_ocsp = require_ocsp
3c07dd2d 3078 || verify_check_given_host(CUSS &ob->hosts_request_ocsp, host) == OK;
594706ea
JH
3079 }
3080 }
b50c8b84
JH
3081# endif
3082
594706ea
JH
3083if (request_ocsp)
3084 {
74f1a423 3085 SSL_set_tlsext_status_type(exim_client_ctx->ssl, TLSEXT_STATUSTYPE_ocsp);
44662487 3086 client_static_cbinfo->u_ocsp.client.verify_required = require_ocsp;
74f1a423 3087 tlsp->ocsp = OCSP_NOT_RESP;
44662487 3088 }
f5d78688
JH
3089#endif
3090
c82de233
JH
3091#ifdef EXPERIMENTAL_TLS_RESUME
3092if (!tls_client_ssl_resume_prehandshake(exim_client_ctx->ssl, tlsp, host,
3093 errstr))
3094 return FALSE;
3095#endif
3096
0cbf2b82 3097#ifndef DISABLE_EVENT
afdb5e9c 3098client_static_cbinfo->event_action = tb ? tb->event_action : NULL;
a7538db1 3099#endif
043b1248 3100
059ec3d9
PH
3101/* There doesn't seem to be a built-in timeout on connection. */
3102
3103DEBUG(D_tls) debug_printf("Calling SSL_connect\n");
3104sigalrm_seen = FALSE;
c2a1bba0 3105ALARM(ob->command_timeout);
74f1a423 3106rc = SSL_connect(exim_client_ctx->ssl);
c2a1bba0 3107ALARM_CLR(0);
059ec3d9 3108
c0635b6d 3109#ifdef SUPPORT_DANE
c05bdbd6 3110if (conn_args->dane)
74f1a423 3111 DANESSL_cleanup(exim_client_ctx->ssl);
043b1248
JH
3112#endif
3113
059ec3d9 3114if (rc <= 0)
74f1a423
JH
3115 {
3116 tls_error(US"SSL_connect", host, sigalrm_seen ? US"timed out" : NULL, errstr);
c05bdbd6 3117 return FALSE;
74f1a423 3118 }
059ec3d9 3119
f20cfa4a
JH
3120DEBUG(D_tls)
3121 {
3122 debug_printf("SSL_connect succeeded\n");
3123#ifdef EXIM_HAVE_OPENSSL_KEYLOG
3124 {
10ed27e0
JH
3125 BIO * bp = BIO_new_fp(debug_file, BIO_NOCLOSE);
3126 SSL_SESSION_print_keylog(bp, SSL_get_session(exim_client_ctx->ssl));
3127 BIO_free(bp);
f20cfa4a
JH
3128 }
3129#endif
3130 }
059ec3d9 3131
b10c87b3
JH
3132#ifdef EXPERIMENTAL_TLS_RESUME
3133tls_client_resume_posthandshake(exim_client_ctx, tlsp);
3134#endif
3135
74f1a423 3136peer_cert(exim_client_ctx->ssl, tlsp, peerdn, sizeof(peerdn));
059ec3d9 3137
f1be21cf
JH
3138tlsp->cipher = construct_cipher_name(exim_client_ctx->ssl, &tlsp->bits);
3139tlsp->cipher_stdname = cipher_stdname_ssl(exim_client_ctx->ssl);
059ec3d9 3140
9d1c15ef
JH
3141/* Record the certificate we presented */
3142 {
74f1a423
JH
3143 X509 * crt = SSL_get_certificate(exim_client_ctx->ssl);
3144 tlsp->ourcert = crt ? X509_dup(crt) : NULL;
9d1c15ef
JH
3145 }
3146
c05bdbd6 3147tlsp->active.sock = cctx->sock;
74f1a423 3148tlsp->active.tls_ctx = exim_client_ctx;
c05bdbd6
JH
3149cctx->tls_ctx = exim_client_ctx;
3150return TRUE;
059ec3d9
PH
3151}
3152
3153
3154
3155
3156
0d81dabc
JH
3157static BOOL
3158tls_refill(unsigned lim)
3159{
3160int error;
3161int inbytes;
3162
3163DEBUG(D_tls) debug_printf("Calling SSL_read(%p, %p, %u)\n", server_ssl,
3164 ssl_xfer_buffer, ssl_xfer_buffer_size);
3165
c2a1bba0 3166if (smtp_receive_timeout > 0) ALARM(smtp_receive_timeout);
0d81dabc
JH
3167inbytes = SSL_read(server_ssl, CS ssl_xfer_buffer,
3168 MIN(ssl_xfer_buffer_size, lim));
3169error = SSL_get_error(server_ssl, inbytes);
c2a1bba0 3170if (smtp_receive_timeout > 0) ALARM_CLR(0);
9723f966
JH
3171
3172if (had_command_timeout) /* set by signal handler */
3173 smtp_command_timeout_exit(); /* does not return */
3174if (had_command_sigterm)
3175 smtp_command_sigterm_exit();
3176if (had_data_timeout)
3177 smtp_data_timeout_exit();
3178if (had_data_sigint)
3179 smtp_data_sigint_exit();
0d81dabc
JH
3180
3181/* SSL_ERROR_ZERO_RETURN appears to mean that the SSL session has been
3182closed down, not that the socket itself has been closed down. Revert to
3183non-SSL handling. */
3184
74f1a423 3185switch(error)
0d81dabc 3186 {
74f1a423
JH
3187 case SSL_ERROR_NONE:
3188 break;
3189
3190 case SSL_ERROR_ZERO_RETURN:
3191 DEBUG(D_tls) debug_printf("Got SSL_ERROR_ZERO_RETURN\n");
0d81dabc 3192
74f1a423
JH
3193 if (SSL_get_shutdown(server_ssl) == SSL_RECEIVED_SHUTDOWN)
3194 SSL_shutdown(server_ssl);
dec766a1 3195
bd231acd 3196 tls_close(NULL, TLS_NO_SHUTDOWN);
74f1a423 3197 return FALSE;
0d81dabc 3198
74f1a423
JH
3199 /* Handle genuine errors */
3200 case SSL_ERROR_SSL:
0abc5a13 3201 ERR_error_string_n(ERR_get_error(), ssl_errstring, sizeof(ssl_errstring));
74f1a423
JH
3202 log_write(0, LOG_MAIN, "TLS error (SSL_read): %s", ssl_errstring);
3203 ssl_xfer_error = TRUE;
3204 return FALSE;
0d81dabc 3205
74f1a423
JH
3206 default:
3207 DEBUG(D_tls) debug_printf("Got SSL error %d\n", error);
3208 DEBUG(D_tls) if (error == SSL_ERROR_SYSCALL)
3209 debug_printf(" - syscall %s\n", strerror(errno));
3210 ssl_xfer_error = TRUE;
3211 return FALSE;
0d81dabc
JH
3212 }
3213
3214#ifndef DISABLE_DKIM
3215dkim_exim_verify_feed(ssl_xfer_buffer, inbytes);
3216#endif
3217ssl_xfer_buffer_hwm = inbytes;
3218ssl_xfer_buffer_lwm = 0;
3219return TRUE;
3220}
3221
3222
059ec3d9
PH
3223/*************************************************
3224* TLS version of getc *
3225*************************************************/
3226
3227/* This gets the next byte from the TLS input buffer. If the buffer is empty,
3228it refills the buffer via the SSL reading function.
3229
bd8fbe36 3230Arguments: lim Maximum amount to read/buffer
059ec3d9 3231Returns: the next character or EOF
817d9f57
JH
3232
3233Only used by the server-side TLS.
059ec3d9
PH
3234*/
3235
3236int
bd8fbe36 3237tls_getc(unsigned lim)
059ec3d9
PH
3238{
3239if (ssl_xfer_buffer_lwm >= ssl_xfer_buffer_hwm)
0d81dabc
JH
3240 if (!tls_refill(lim))
3241 return ssl_xfer_error ? EOF : smtp_getc(lim);
059ec3d9 3242
0d81dabc 3243/* Something in the buffer; return next uschar */
059ec3d9 3244
0d81dabc
JH
3245return ssl_xfer_buffer[ssl_xfer_buffer_lwm++];
3246}
059ec3d9 3247
0d81dabc
JH
3248uschar *
3249tls_getbuf(unsigned * len)
3250{
3251unsigned size;
3252uschar * buf;
ba084640 3253
0d81dabc
JH
3254if (ssl_xfer_buffer_lwm >= ssl_xfer_buffer_hwm)
3255 if (!tls_refill(*len))
059ec3d9 3256 {
0d81dabc
JH
3257 if (!ssl_xfer_error) return smtp_getbuf(len);
3258 *len = 0;
3259 return NULL;
059ec3d9 3260 }
c80c5570 3261
0d81dabc
JH
3262if ((size = ssl_xfer_buffer_hwm - ssl_xfer_buffer_lwm) > *len)
3263 size = *len;
3264buf = &ssl_xfer_buffer[ssl_xfer_buffer_lwm];
3265ssl_xfer_buffer_lwm += size;
3266*len = size;
3267return buf;
059ec3d9
PH
3268}
3269
0d81dabc 3270
584e96c6
JH
3271void
3272tls_get_cache()
3273{
9960d1e5 3274#ifndef DISABLE_DKIM
584e96c6
JH
3275int n = ssl_xfer_buffer_hwm - ssl_xfer_buffer_lwm;
3276if (n > 0)
3277 dkim_exim_verify_feed(ssl_xfer_buffer+ssl_xfer_buffer_lwm, n);
584e96c6 3278#endif
9960d1e5 3279}
584e96c6 3280
059ec3d9 3281
925ac8e4
JH
3282BOOL
3283tls_could_read(void)
3284{
a5ffa9b4 3285return ssl_xfer_buffer_lwm < ssl_xfer_buffer_hwm || SSL_pending(server_ssl) > 0;
925ac8e4
JH
3286}
3287
059ec3d9
PH
3288
3289/*************************************************
3290* Read bytes from TLS channel *